@elitedcs/ghl-mcp 3.58.0 → 3.60.0

package/dist/index.js

@@ -114,8 +114,8 @@ var init_ghl_client = __esm({
           Version: version || GHL_API_VERSION
         };
       }
-      buildUrl(path13, params) {
-        const url = new URL(path13, GHL_BASE_URL);
+      buildUrl(path14, params) {
+        const url = new URL(path14, GHL_BASE_URL);
         if (params) {
           for (const [key, value] of Object.entries(params)) {
             if (value !== void 0 && value !== null) {
@@ -125,8 +125,8 @@ var init_ghl_client = __esm({
         }
         return url.toString();
       }
-      async request(method, path13, options = {}, attempt = 0) {
-        const url = this.buildUrl(path13, options.params);
+      async request(method, path14, options = {}, attempt = 0) {
+        const url = this.buildUrl(path14, options.params);
         const headers = this.buildHeaders(options.version);
         const fetchOptions = {
           method,
@@ -144,14 +144,14 @@ var init_ghl_client = __esm({
         } catch (error) {
           clearTimeout(timeout);
           if (error instanceof Error && error.name === "AbortError") {
-            throw new Error(`Request timeout (30s): ${method} ${path13}`);
+            throw new Error(`Request timeout (30s): ${method} ${path14}`);
           }
           if (!options.noRetry && attempt < MAX_RETRIES) {
             const delay4 = computeRetryDelay(null, attempt, BASE_DELAY_MS);
-            process.stderr.write(`[ghl-mcp] Network error on ${method} ${path13}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay4}ms
+            process.stderr.write(`[ghl-mcp] Network error on ${method} ${path14}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay4}ms
 `);
             await new Promise((r) => setTimeout(r, delay4));
-            return this.request(method, path13, options, attempt + 1);
+            return this.request(method, path14, options, attempt + 1);
           }
           throw error;
         } finally {
@@ -159,10 +159,10 @@ var init_ghl_client = __esm({
         }
         if (!options.noRetry && (response.status === 429 || response.status >= 500) && attempt < MAX_RETRIES) {
           const delay4 = computeRetryDelay(response.headers.get("Retry-After"), attempt, BASE_DELAY_MS);
-          process.stderr.write(`[ghl-mcp] ${response.status} on ${method} ${path13}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay4}ms
+          process.stderr.write(`[ghl-mcp] ${response.status} on ${method} ${path14}, retry ${attempt + 1}/${MAX_RETRIES} in ${delay4}ms
 `);
           await new Promise((r) => setTimeout(r, delay4));
-          return this.request(method, path13, options, attempt + 1);
+          return this.request(method, path14, options, attempt + 1);
         }
         if (!response.ok) {
           let errorBody = "";
@@ -171,7 +171,7 @@ var init_ghl_client = __esm({
           } catch {
           }
           throw new Error(
-            `GHL API Error ${response.status} ${response.statusText}: ${method} ${path13}
+            `GHL API Error ${response.status} ${response.statusText}: ${method} ${path14}
 ${errorBody}`
           );
         }
@@ -183,20 +183,20 @@ ${errorBody}`
           return { message: text };
         }
       }
-      async get(path13, options) {
-        return this.request("GET", path13, options);
+      async get(path14, options) {
+        return this.request("GET", path14, options);
       }
-      async post(path13, options) {
-        return this.request("POST", path13, options);
+      async post(path14, options) {
+        return this.request("POST", path14, options);
       }
-      async put(path13, options) {
-        return this.request("PUT", path13, options);
+      async put(path14, options) {
+        return this.request("PUT", path14, options);
       }
-      async patch(path13, options) {
-        return this.request("PATCH", path13, options);
+      async patch(path14, options) {
+        return this.request("PATCH", path14, options);
       }
-      async delete(path13, options) {
-        return this.request("DELETE", path13, options);
+      async delete(path14, options) {
+        return this.request("DELETE", path14, options);
       }
       /**
        * Helper: resolves locationId from args or falls back to default
@@ -1270,9 +1270,9 @@ function planFromPayload(payload) {
   return payload?.plan === "command-os" ? "command-os" : "mcp";
 }
 function legacyDeviceFingerprint() {
-  const os6 = require("node:os");
+  const os7 = require("node:os");
   const crypto5 = require("node:crypto");
-  const raw = `${os6.hostname()}:${os6.userInfo().username}:${os6.platform()}:${os6.arch()}`;
+  const raw = `${os7.hostname()}:${os7.userInfo().username}:${os7.platform()}:${os7.arch()}`;
   return crypto5.createHash("sha256").update(raw).digest("hex").slice(0, 16);
 }
 function deviceFingerprint(opts) {
@@ -1508,12 +1508,16 @@ function registerSetupTool(server2, pkgVersion) {
   if (pkgVersion) setupPkgVersion = pkgVersion;
   server2.tool(
     "setup_ghl_mcp",
-    "First-run setup for GHL Command MCP. Validates your license and GHL credentials, then writes them to a per-user credentials file. Restart Claude after this completes to load all 233 tools (179 if you skip the optional Firebase fields; add Firebase later with enable_workflow_builder).",
+    "First-run setup AND license upgrades for GHL Command MCP. Validates your license and GHL credentials, then writes them to a per-user credentials file; restart Claude once after it completes. UPGRADING an existing install (e.g. free key to paid)? Supply ONLY email + license_key \u2014 the GHL credentials and any Workflow Builder unlock already saved on this machine are reused and kept; do not re-enter ghl_api_key or ghl_location_id. No license yet? Paid ($97/mo) at https://ghlcommand.com \u2014 or a FREE read-only key, instantly, at https://ghlcommand.com/free.",
     {
       email: import_zod42.z.string().email().describe("Email used at purchase."),
       license_key: import_zod42.z.string().min(20).describe("License key from your purchase email."),
-      ghl_api_key: import_zod42.z.string().min(10).describe("GHL Private Integration key (starts with 'pit-'). Created INSIDE the sub-account at Settings > Integrations > Private Integrations."),
-      ghl_location_id: import_zod42.z.string().min(10).describe("GHL Location ID (sub-account ID). Found in your GHL URL: /location/THIS_PART/dashboard."),
+      // v3.60.0: optional AS A PAIR for the one-line upgrade. Supply both, or
+      // neither (reuses the pair saved on this machine). Never one alone —
+      // mixing a fresh key with a stale stored location (or vice versa) would
+      // silently persist a mismatched tuple (Codex-agreed atomic-pair rule).
+      ghl_api_key: import_zod42.z.string().min(10).optional().describe("GHL Private Integration key (starts with 'pit-'). Created INSIDE the sub-account at Settings > Integrations > Private Integrations. OMIT together with ghl_location_id to reuse the pair already saved on this machine (upgrades)."),
+      ghl_location_id: import_zod42.z.string().min(10).optional().describe("GHL Location ID (sub-account ID). Found in your GHL URL: /location/THIS_PART/dashboard. OMIT together with ghl_api_key to reuse the saved pair (upgrades)."),
       ghl_company_id: import_zod42.z.string().optional().describe("(Agency only) Company ID for multi-location access."),
       // v3.25.0: one-paste shortcut. Run `auto_capture_firebase_script` first;
       // it returns a console script that fills the clipboard with this exact
@@ -1531,9 +1535,40 @@ function registerSetupTool(server2, pkgVersion) {
         emit("setup_failed", { pkgVersion: setupPkgVersion, reasonCode: LICENSE_REASON_MAP[lic.reason] });
         return { content: [{ type: "text", text: `License check failed: ${lic.error}
 
-Purchase a license at https://elitedcs.com/ghl-mcp-server or contact support.` }], isError: true };
+Purchase a license at https://ghlcommand.com \u2014 or get a FREE read-only key instantly at https://ghlcommand.com/free. Stuck? Reply to any email from us or write support@ghlcommand.com.` }], isError: true };
       }
-      const ghl = await validateGhl(args.ghl_api_key, args.ghl_location_id);
+      const priorForPair = readCredentials();
+      const suppliedApiKey = args.ghl_api_key?.trim();
+      const suppliedLocationId = args.ghl_location_id?.trim();
+      if (suppliedApiKey && !suppliedLocationId || !suppliedApiKey && suppliedLocationId) {
+        return {
+          content: [{
+            type: "text",
+            text: "Provide BOTH ghl_api_key and ghl_location_id, or NEITHER (to reuse the pair already saved on this machine). Mixing one new value with one saved value is not allowed \u2014 they are validated and stored as a pair."
+          }],
+          isError: true
+        };
+      }
+      let ghlApiKey;
+      let ghlLocationId;
+      let usedStoredPair = false;
+      if (suppliedApiKey && suppliedLocationId) {
+        ghlApiKey = suppliedApiKey;
+        ghlLocationId = suppliedLocationId;
+      } else if (priorForPair?.ghl_api_key && priorForPair?.ghl_location_id) {
+        ghlApiKey = priorForPair.ghl_api_key;
+        ghlLocationId = priorForPair.ghl_location_id;
+        usedStoredPair = true;
+      } else {
+        return {
+          content: [{
+            type: "text",
+            text: 'No GHL credentials supplied and none saved on this machine yet. For a first-time setup you need both:\n  ghl_api_key \u2014 a Private Integration key (pit-...) created INSIDE your sub-account: Settings > Integrations > Private Integrations (click "Select all" on scopes, copy the WHOLE key)\n  ghl_location_id \u2014 the part of your GHL URL after /location/\nFull walkthrough: https://ghlcommand.com/start'
+          }],
+          isError: true
+        };
+      }
+      const ghl = await validateGhl(ghlApiKey, ghlLocationId);
       if (!ghl.ok) {
         emit("setup_failed", { pkgVersion: setupPkgVersion, reasonCode: ghl.reason });
         return { content: [{ type: "text", text: `GHL credential check failed: ${ghl.error}` }], isError: true };
@@ -1573,21 +1608,34 @@ Purchase a license at https://elitedcs.com/ghl-mcp-server or contact support.` }
         if (!fb.ok) {
           workflowBuilderNote = `
 
-Note: Firebase credentials rejected (${fb.error}). Saved without Workflow Builder. Re-run setup_ghl_mcp later with fresh Firebase fields (use auto_capture_firebase_script for a one-paste flow) to enable it.`;
+Note: Firebase credentials rejected (${fb.error}).`;
         } else {
           workflowBuilderEnabled = true;
         }
       }
+      const prior = priorForPair;
+      const priorFirebase = prior?.ghl_user_id && prior?.ghl_firebase_api_key && prior?.ghl_firebase_refresh_token ? {
+        userId: prior.ghl_user_id,
+        fbApi: prior.ghl_firebase_api_key,
+        fbRefresh: prior.ghl_firebase_refresh_token
+      } : null;
+      const finalFirebase = workflowBuilderEnabled ? { userId: resolvedUserId.trim(), fbApi: resolvedFbApi.trim(), fbRefresh: resolvedFbRefresh.trim() } : priorFirebase;
+      if (!workflowBuilderEnabled && wantsWorkflowBuilder && priorFirebase) {
+        workflowBuilderNote += ` KEPT your existing working Workflow Builder credentials \u2014 nothing was lost. To refresh them later, run capture_firebase_interactive.`;
+      } else if (!workflowBuilderEnabled && wantsWorkflowBuilder) {
+        workflowBuilderNote += ` Saved without Workflow Builder. Run capture_firebase_interactive (one browser login) to finish the install.`;
+      }
+      const builderActive = finalFirebase !== null;
       writeCredentials({
         license_key: args.license_key.trim(),
         email: args.email.trim(),
         verified_at: (/* @__PURE__ */ new Date()).toISOString(),
-        ghl_api_key: args.ghl_api_key.trim(),
-        ghl_location_id: args.ghl_location_id.trim(),
-        ghl_company_id: args.ghl_company_id?.trim() || void 0,
-        ghl_user_id: workflowBuilderEnabled ? resolvedUserId?.trim() : void 0,
-        ghl_firebase_api_key: workflowBuilderEnabled ? resolvedFbApi?.trim() : void 0,
-        ghl_firebase_refresh_token: workflowBuilderEnabled ? resolvedFbRefresh?.trim() : void 0,
+        ghl_api_key: ghlApiKey,
+        ghl_location_id: ghlLocationId,
+        ghl_company_id: args.ghl_company_id?.trim() || prior?.ghl_company_id || void 0,
+        ghl_user_id: finalFirebase?.userId,
+        ghl_firebase_api_key: finalFirebase?.fbApi,
+        ghl_firebase_refresh_token: finalFirebase?.fbRefresh,
         // v3.24.0+ attestation. Tied to email + license + device fingerprint;
         // verified on every MCP startup. Closes the hand-crafted creds bypass.
         signed_attestation: lic.signedAttestation
@@ -1600,30 +1648,44 @@ Note: Firebase credentials rejected (${fb.error}). Saved without Workflow Builde
       const telemetryLine = telemetryDisabled(process.env) ? "" : `
 
 ${TELEMETRY_DISCLOSURE}`;
-      const toolCount = isFree ? workflowBuilderEnabled ? "107" : "89" : workflowBuilderEnabled ? "233" : "179";
-      const wfLine = workflowBuilderEnabled ? "Workflow Builder: enabled." : "Workflow Builder: not configured (optional).";
-      const wfTip = workflowBuilderEnabled ? "" : isFree ? `
-Unlock the account auditor next (the free tier's best tool): say "Unlock the Workflow Builder" \u2014 one browser login enables audit_workflows, validate_workflow, and the full-detail reads.` : "\nTo enable Workflow Builder later (52 extra Firebase-gated tools): run enable_workflow_builder with your three Firebase values. No need to re-enter license/API key/location ID.";
-      const freeTip = isFree ? "\n\nFree tier: 107 read-only tools (89 before the one-login auditor unlock). Write tools stay visible but answer with upgrade info instead of acting. Full version ($97/mo founding rate, same key upgrades in place): https://ghlcommand.com" : "";
+      const finishedCount = isFree ? "107" : "233";
+      const freeTip = isFree ? `
+
+Free tier: read-only. Write tools stay visible but answer with upgrade info instead of acting. Full version ($97/mo founding rate) upgrades in place \u2014 same install, you only swap the license key: https://ghlcommand.com` : "";
+      const upgradeLine = usedStoredPair && prior && prior.license_key !== args.license_key.trim() ? `License updated \u2014 everything you set up before is kept.
+` : "";
+      const text = builderActive ? [
+        `Setup complete!`,
+        ``,
+        upgradeLine + `License: verified (installs ${lic.installs})${isFree ? " \u2014 FREE read-only tier" : ""}.`,
+        `GHL: connected to "${ghl.locationName}".`,
+        `Workflow Builder: enabled.`,
+        ``,
+        `Credentials saved to: ${credentialsPath()}`,
+        ``,
+        `**Restart Claude once (quit fully and reopen) to load all ${finishedCount} ${isFree ? "read-only " : ""}tools.**`,
+        ``,
+        `After restart, try: "List my GHL contacts" \u2014 or "Audit my workflows" to find what's silently broken.${freeTip}`,
+        workflowBuilderNote,
+        telemetryLine
+      ] : [
+        `Step 1 of 2 done \u2014 one more step finishes the install.`,
+        ``,
+        upgradeLine + `License: verified (installs ${lic.installs})${isFree ? " \u2014 FREE read-only tier" : ""}.`,
+        `GHL: connected to "${ghl.locationName}".`,
+        `Credentials saved to: ${credentialsPath()}`,
+        ``,
+        `**Step 2 \u2014 run \`capture_firebase_interactive\` now.** A Chrome window opens; log into GHL once; the install finishes itself (about 60 seconds). It powers the account auditor${isFree ? "" : " and the workflow/funnel/form builders"} \u2014 the reason you installed this.`,
+        `(No Chrome on this machine? Run \`auto_capture_firebase_script\` for the copy-paste path.)`,
+        ``,
+        `**Then restart Claude once** (quit fully and reopen) and all ${finishedCount} ${isFree ? "read-only " : ""}tools load. One restart total \u2014 do step 2 first.`,
+        ``,
+        `Checkpoint after restart: ask "Audit my workflows".${freeTip}`,
+        workflowBuilderNote,
+        telemetryLine
+      ];
       return {
-        content: [{
-          type: "text",
-          text: [
-            `Setup complete!`,
-            ``,
-            `License: verified (installs ${lic.installs})${isFree ? " \u2014 FREE read-only tier" : ""}.`,
-            `GHL: connected to "${ghl.locationName}".`,
-            wfLine,
-            ``,
-            `Credentials saved to: ${credentialsPath()}`,
-            ``,
-            `**Restart Claude (quit fully and reopen) to load all ${toolCount} ${isFree ? "read-only " : ""}tools.**`,
-            ``,
-            `After restart, try: "List my GHL contacts" or "Show my pipelines".${wfTip}${freeTip}`,
-            workflowBuilderNote,
-            telemetryLine
-          ].join("\n")
-        }]
+        content: [{ type: "text", text: text.join("\n") }]
       };
     }
   );
@@ -1631,7 +1693,7 @@ Unlock the account auditor next (the free tier's best tool): say "Unlock the Wor
 function registerEnableWorkflowBuilderTool(server2) {
   server2.tool(
     "enable_workflow_builder",
-    "Add Firebase credentials to an existing GHL Command install to unlock 54 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 179 to 233 after the next Claude restart.",
+    "Add Firebase credentials to an existing GHL Command install to unlock 52 additional tools across the internal-API modules: workflow builder (create/edit/clone/delete/publish/validate workflows, build_if_else_branch, build_goal_event, get_trigger_registry), funnel + page builder, form builder, pipeline builder, workflow cloner, smart lists, reputation, email campaigns, email templates, and memberships, plus the pre-deploy validator. On the FREE tier this same login unlocks the read-only auditor suite (audit_workflows, validate_workflow, full-detail workflow/funnel/pipeline reads). Requires you've already run setup_ghl_mcp. EASIEST PATH: run `capture_firebase_interactive` instead \u2014 a Chrome window opens, you log into GHL, zero pasting. Use THIS tool when you have JSON from `auto_capture_firebase_script` (console-paste path) to put in `firebase_paste`, or the three manual DevTools fields. Tool count goes from 181 to 233 after the next Claude restart.",
     {
       // v3.25.0: one-paste path. Tool runs `auto_capture_firebase_script` to
       // get the console script; the script returns a JSON object that pastes
@@ -2390,12 +2452,409 @@ var init_question_set = __esm({
   }
 });
 
+// src/config-installer.ts
+var config_installer_exports = {};
+__export(config_installer_exports, {
+  EXIT_ABORTED: () => EXIT_ABORTED,
+  EXIT_OK: () => EXIT_OK,
+  EXIT_REFUSED: () => EXIT_REFUSED,
+  EXIT_USAGE: () => EXIT_USAGE,
+  atomicReplace: () => atomicReplace,
+  baselineOf: () => baselineOf,
+  candidateConfigPaths: () => candidateConfigPaths,
+  chooseBackupPath: () => chooseBackupPath,
+  resolveConfigPath: () => resolveConfigPath,
+  resolveSymlinkPolicy: () => resolveSymlinkPolicy,
+  runInstall: () => runInstall
+});
+function defaultIO() {
+  return {
+    out: (l) => process.stdout.write(l + "\n"),
+    err: (l) => process.stderr.write(l + "\n"),
+    rename: (from, to) => fs9.renameSync(from, to),
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms))
+  };
+}
+function candidateConfigPaths(opts) {
+  const platform2 = opts?.platform ?? process.platform;
+  const home = opts?.home ?? os4.homedir();
+  const file = "claude_desktop_config.json";
+  const candidates = [];
+  if (platform2 === "darwin") {
+    candidates.push(path8.join(home, "Library", "Application Support", "Claude", file));
+  } else if (platform2 === "win32") {
+    const appData = opts?.appData ?? process.env.APPDATA ?? path8.join(home, "AppData", "Roaming");
+    candidates.push(path8.join(appData, "Claude", file));
+    const localAppData = opts?.localAppData ?? process.env.LOCALAPPDATA ?? path8.join(home, "AppData", "Local");
+    const packagesDir = path8.join(localAppData, "Packages");
+    try {
+      for (const entry of fs9.readdirSync(packagesDir)) {
+        if (entry.startsWith("Claude_")) {
+          candidates.push(path8.join(packagesDir, entry, "LocalCache", "Roaming", "Claude", file));
+        }
+      }
+    } catch {
+    }
+  } else {
+    candidates.push(path8.join(home, ".config", "Claude", file));
+  }
+  return candidates;
+}
+function resolveConfigPath(explicitPath) {
+  if (explicitPath) {
+    const p = path8.resolve(explicitPath);
+    return { configPath: p, exists: fs9.existsSync(p) };
+  }
+  const candidates = candidateConfigPaths();
+  const existing = candidates.filter((c) => fs9.existsSync(c));
+  if (existing.length > 1) {
+    throw new InstallStop(
+      EXIT_REFUSED,
+      [
+        "More than one Claude settings file was found, and picking the wrong one would break your setup:",
+        ...existing.map((p) => `  ${p}`),
+        "Run the command again with --path and the one Claude actually uses. Nothing was changed."
+      ].join("\n")
+    );
+  }
+  if (existing.length === 1) return { configPath: existing[0], exists: true };
+  return { configPath: candidates[0], exists: false };
+}
+function resolveSymlinkPolicy(configPath, explicitPath, home = os4.homedir()) {
+  let st;
+  try {
+    st = fs9.lstatSync(configPath);
+  } catch {
+    return configPath;
+  }
+  if (!st.isSymbolicLink()) return configPath;
+  let real;
+  try {
+    real = fs9.realpathSync(configPath);
+  } catch {
+    throw new InstallStop(
+      EXIT_REFUSED,
+      `${configPath} is a link that points to a file that does not exist. Fix or remove the link, or run again with --path to a real file. Nothing was changed.`
+    );
+  }
+  const rel = path8.relative(path8.resolve(home), real);
+  const outsideHome = rel.startsWith("..") || path8.isAbsolute(rel);
+  if (outsideHome && !explicitPath) {
+    throw new InstallStop(
+      EXIT_REFUSED,
+      `${configPath} is a link pointing outside your home folder (to ${real}). If that is intentional, run again with --path pointing at it directly. Nothing was changed.`
+    );
+  }
+  return real;
+}
+function readConfigBytes(configPath) {
+  const bytes = fs9.readFileSync(configPath);
+  const stat = fs9.statSync(configPath);
+  if (bytes.length >= 2 && (bytes[0] === 255 && bytes[1] === 254 || bytes[0] === 254 && bytes[1] === 255)) {
+    throw new InstallStop(
+      EXIT_REFUSED,
+      "This settings file is saved in an encoding this command doesn't edit (UTF-16). Nothing was changed. Reply to your setup email and we'll sort it out."
+    );
+  }
+  const hadBom = bytes.length >= 3 && bytes.subarray(0, 3).equals(BOM_UTF8);
+  const text = (hadBom ? bytes.subarray(3) : bytes).toString("utf8");
+  return { text, hadBom, bytes, stat };
+}
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function wrongShapeStop() {
+  return new InstallStop(
+    EXIT_REFUSED,
+    "This settings file doesn't have the layout Claude uses, so this command won't rewrite it. Nothing was changed. Reply to your setup email and we'll sort it out."
+  );
+}
+function parseTiered(text) {
+  if (text.trim() === "") return { tier: 1, root: {} };
+  try {
+    const strict = JSON.parse(text);
+    if (!isPlainObject(strict)) throw wrongShapeStop();
+    return { tier: 1, root: strict };
+  } catch (e) {
+    if (e instanceof InstallStop) throw e;
+  }
+  try {
+    const tolerant = import_json5.default.parse(text);
+    if (!isPlainObject(tolerant)) throw wrongShapeStop();
+    return { tier: 2, root: tolerant };
+  } catch (e) {
+    if (e instanceof InstallStop) throw e;
+  }
+  return { tier: 3, root: null };
+}
+function entriesEqual(a) {
+  if (!isPlainObject(a)) return false;
+  return a.command === DESIRED_ENTRY.command && Array.isArray(a.args) && a.args.length === DESIRED_ENTRY.args.length && a.args.every((v, i) => v === DESIRED_ENTRY.args[i]);
+}
+function mergeGhlEntry(root, force) {
+  const existing = root.mcpServers;
+  if (existing !== void 0 && !isPlainObject(existing)) {
+    throw wrongShapeStop();
+  }
+  const servers = isPlainObject(existing) ? existing : {};
+  const keptServers = Object.keys(servers).filter((k) => k !== SERVER_KEY);
+  let action;
+  if (SERVER_KEY in servers) {
+    if (entriesEqual(servers[SERVER_KEY])) {
+      action = "identical";
+    } else if (!force) {
+      throw new InstallStop(
+        EXIT_REFUSED,
+        "A different GHL Command entry is already in this file. Run again with --force to replace it, or leave it as is. Nothing was changed."
+      );
+    } else {
+      action = "replaced";
+    }
+  } else {
+    action = "added";
+  }
+  servers[SERVER_KEY] = { command: DESIRED_ENTRY.command, args: [...DESIRED_ENTRY.args] };
+  root.mcpServers = servers;
+  return { merged: root, keptServers, action };
+}
+function backupStamp(now) {
+  const p = (n, w = 2) => String(n).padStart(w, "0");
+  return `${now.getFullYear()}${p(now.getMonth() + 1)}${p(now.getDate())}-${p(now.getHours())}${p(now.getMinutes())}${p(now.getSeconds())}`;
+}
+function chooseBackupPath(configPath, now = /* @__PURE__ */ new Date()) {
+  const base = `${configPath}.bak-${backupStamp(now)}`;
+  if (!fs9.existsSync(base)) return base;
+  for (let i = 2; ; i++) {
+    const candidate = `${base}-${i}`;
+    if (!fs9.existsSync(candidate)) return candidate;
+  }
+}
+function writeVerifiedBackup(configPath, originalBytes) {
+  const backupPath = chooseBackupPath(configPath);
+  try {
+    fs9.writeFileSync(backupPath, originalBytes);
+    const readBack = fs9.readFileSync(backupPath);
+    if (!readBack.equals(originalBytes)) {
+      throw new Error("backup read-back did not match");
+    }
+  } catch (e) {
+    try {
+      fs9.rmSync(backupPath, { force: true });
+    } catch {
+    }
+    throw new InstallStop(
+      EXIT_ABORTED,
+      `A safety copy of your settings could not be saved, so nothing was changed. (${e instanceof Error ? e.message : String(e)})`
+    );
+  }
+  return backupPath;
+}
+function sha2562(bytes) {
+  return (0, import_node_crypto3.createHash)("sha256").update(bytes).digest("hex");
+}
+function baselineOf(bytes, stat) {
+  return { size: stat.size, mtimeMs: stat.mtimeMs, hash: sha2562(bytes) };
+}
+function assertNotStale(configPath, baseline) {
+  let ok = false;
+  try {
+    const st = fs9.statSync(configPath);
+    if (st.size === baseline.size && st.mtimeMs === baseline.mtimeMs) {
+      ok = sha2562(fs9.readFileSync(configPath)) === baseline.hash;
+    } else {
+      ok = false;
+    }
+  } catch {
+    ok = false;
+  }
+  if (!ok) {
+    throw new InstallStop(
+      EXIT_ABORTED,
+      "Your settings file changed while this command was running, so it stopped without touching it. Run the command again."
+    );
+  }
+}
+async function atomicReplace(opts) {
+  const dir = path8.dirname(opts.configPath);
+  const tempPath = path8.join(dir, `.${path8.basename(opts.configPath)}.tmp-${process.pid}-${(0, import_node_crypto3.randomBytes)(4).toString("hex")}`);
+  const fd = fs9.openSync(tempPath, "w");
+  try {
+    fs9.writeFileSync(fd, opts.newBytes);
+    fs9.fsyncSync(fd);
+  } finally {
+    fs9.closeSync(fd);
+  }
+  try {
+    for (let attempt = 0; ; attempt++) {
+      if (opts.baseline) assertNotStale(opts.configPath, opts.baseline);
+      try {
+        opts.io.rename(tempPath, opts.configPath);
+        break;
+      } catch (e) {
+        const code = e.code ?? "";
+        const retryable = LOCK_ERROR_CODES.has(code) && attempt < RENAME_RETRY_DELAYS_MS.length;
+        if (!retryable) {
+          if (LOCK_ERROR_CODES.has(code)) {
+            throw new InstallStop(
+              EXIT_ABORTED,
+              "Claude is holding this file. Quit Claude completely (right-click the Claude icon by your clock and choose Quit \u2014 on Mac press Cmd+Q), then run this command again. Nothing was changed."
+            );
+          }
+          throw e;
+        }
+        await opts.io.sleep(RENAME_RETRY_DELAYS_MS[attempt]);
+      }
+    }
+  } catch (e) {
+    try {
+      fs9.rmSync(tempPath, { force: true });
+    } catch {
+    }
+    throw e;
+  }
+  try {
+    const dirFd = fs9.openSync(dir, "r");
+    try {
+      fs9.fsyncSync(dirFd);
+    } finally {
+      fs9.closeSync(dirFd);
+    }
+  } catch {
+  }
+}
+function successReport(io, args) {
+  io.out("Added GHL Command to Claude Desktop.");
+  io.out("");
+  io.out(`  Settings file: ${args.configPath}`);
+  if (args.backupPath) io.out(`  Backup saved:  ${args.backupPath}`);
+  if (args.tier !== 3 && args.keptServers.length > 0) {
+    io.out(`  Kept your other tools: ${args.keptServers.join(", ")}`);
+  }
+  if (args.tier === 2) {
+    io.out("");
+    io.out(`Your settings file was rewritten in a cleaner format. The original is saved at ${args.backupPath}.`);
+  }
+  if (args.tier === 3 && args.hadOriginal) {
+    io.out("");
+    io.out(
+      `GHL Command is ready. If you had other tools connected before, reply to your setup email and we'll reconnect them \u2014 your previous settings are saved at ${args.backupPath}.`
+    );
+  }
+  io.out("");
+  io.out("NEXT STEP \u2014 quit Claude completely, not just the window:");
+  io.out("  Windows: right-click the Claude icon by the clock, choose Quit");
+  io.out("  Mac:     Cmd+Q");
+  io.out("Then reopen Claude and run setup with your license key.");
+}
+async function runInstall(argv, ioOverride) {
+  const io = { ...defaultIO(), ...ioOverride };
+  let flags;
+  try {
+    flags = (0, import_node_util.parseArgs)({
+      args: argv,
+      options: {
+        "dry-run": { type: "boolean" },
+        "print-only": { type: "boolean" },
+        path: { type: "string" },
+        force: { type: "boolean" }
+      },
+      strict: true,
+      allowPositionals: false
+    }).values;
+  } catch (e) {
+    io.err(e instanceof Error ? e.message : String(e));
+    io.err("Usage: ghl-mcp cli install [--dry-run] [--print-only] [--path <file>] [--force]");
+    return EXIT_USAGE;
+  }
+  try {
+    const resolved2 = resolveConfigPath(flags.path);
+    const configPath = resolveSymlinkPolicy(resolved2.configPath, flags.path !== void 0);
+    const exists = fs9.existsSync(configPath);
+    let read = null;
+    let outcome;
+    if (exists) {
+      read = readConfigBytes(configPath);
+      outcome = parseTiered(read.text);
+    } else {
+      outcome = { tier: 1, root: {} };
+    }
+    const { merged, keptServers, action } = outcome.tier === 3 ? { merged: { mcpServers: { [SERVER_KEY]: { command: DESIRED_ENTRY.command, args: [...DESIRED_ENTRY.args] } } }, keptServers: [], action: "added" } : mergeGhlEntry(outcome.root, flags.force === true);
+    if (action === "identical") {
+      io.out("GHL Command is already set up in Claude Desktop \u2014 nothing to do.");
+      return EXIT_OK;
+    }
+    const newText = JSON.stringify(merged, null, 2) + "\n";
+    const newBytes = read?.hadBom ? Buffer.concat([BOM_UTF8, Buffer.from(newText, "utf8")]) : Buffer.from(newText, "utf8");
+    if (flags["print-only"]) {
+      io.out(newText.trimEnd());
+      return EXIT_OK;
+    }
+    if (flags["dry-run"]) {
+      io.out(`Would edit:    ${configPath}${exists ? "" : "  (new file)"}`);
+      io.out(`Would ${action === "replaced" ? "replace" : "add"} the "${SERVER_KEY}" entry.`);
+      if (keptServers.length > 0) io.out(`Would keep:    ${keptServers.join(", ")}`);
+      if (exists) io.out(`Would back up: ${chooseBackupPath(configPath)}`);
+      if (outcome.tier === 2) io.out("Would rewrite the file in a cleaner format (original kept as the backup).");
+      if (outcome.tier === 3) io.out("Would write a fresh settings file (original kept as the backup).");
+      return EXIT_OK;
+    }
+    const backupPath = exists && read ? writeVerifiedBackup(configPath, read.bytes) : null;
+    if (!exists) fs9.mkdirSync(path8.dirname(configPath), { recursive: true });
+    await atomicReplace({
+      configPath,
+      newBytes,
+      baseline: exists && read ? baselineOf(read.bytes, read.stat) : null,
+      io
+    });
+    successReport(io, { configPath, backupPath, keptServers, tier: outcome.tier, hadOriginal: exists });
+    return EXIT_OK;
+  } catch (e) {
+    if (e instanceof InstallStop) {
+      io.err(e.message);
+      return e.exitCode;
+    }
+    io.err(`Something went wrong and nothing was changed: ${e instanceof Error ? e.message : String(e)}`);
+    return EXIT_ABORTED;
+  }
+}
+var fs9, os4, path8, import_node_crypto3, import_node_util, import_json5, SERVER_KEY, DESIRED_ENTRY, EXIT_OK, EXIT_USAGE, EXIT_REFUSED, EXIT_ABORTED, RENAME_RETRY_DELAYS_MS, LOCK_ERROR_CODES, BOM_UTF8, InstallStop;
+var init_config_installer = __esm({
+  "src/config-installer.ts"() {
+    "use strict";
+    fs9 = __toESM(require("node:fs"));
+    os4 = __toESM(require("node:os"));
+    path8 = __toESM(require("node:path"));
+    import_node_crypto3 = require("node:crypto");
+    import_node_util = require("node:util");
+    import_json5 = __toESM(require("json5"));
+    SERVER_KEY = "ghl";
+    DESIRED_ENTRY = Object.freeze({
+      command: "npx",
+      args: Object.freeze(["-y", "@elitedcs/ghl-mcp@latest"])
+    });
+    EXIT_OK = 0;
+    EXIT_USAGE = 2;
+    EXIT_REFUSED = 3;
+    EXIT_ABORTED = 4;
+    RENAME_RETRY_DELAYS_MS = [200, 500, 1e3];
+    LOCK_ERROR_CODES = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES"]);
+    BOM_UTF8 = Buffer.from([239, 187, 191]);
+    InstallStop = class extends Error {
+      constructor(exitCode, message) {
+        super(message);
+        this.exitCode = exitCode;
+      }
+      exitCode;
+    };
+  }
+});
+
 // package.json
 var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.58.0",
+      version: "3.60.0",
       mcpName: "io.github.drjerryrelth/ghl-command",
       description: "GoHighLevel MCP Server for Claude. 233 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
@@ -2458,6 +2917,7 @@ var require_package = __commonJS({
       dependencies: {
         "@modelcontextprotocol/sdk": "^1.29.0",
         dotenv: "^16.5.0",
+        json5: "^2.2.3",
         "playwright-core": "^1.61.1",
         zod: "^3.24.4"
       },
@@ -2485,7 +2945,7 @@ function launchCommand(port = 7300) {
   return `npx -y @elitedcs/ghl-mcp@latest dashboard --port=${port}`;
 }
 function installingEntry() {
-  return path9.join(__dirname, "index.js");
+  return path10.join(__dirname, "index.js");
 }
 function planLauncher(platform2, home, port = 7300, entry = installingEntry()) {
   const cmd = launchCommand(port);
@@ -2493,12 +2953,12 @@ function planLauncher(platform2, home, port = 7300, entry = installingEntry()) {
     const systemApps = "/Applications";
     let base = home;
     try {
-      fs10.accessSync(systemApps, fs10.constants.W_OK);
+      fs11.accessSync(systemApps, fs11.constants.W_OK);
       base = "";
     } catch {
     }
-    const appDir = base ? path9.join(home, "Applications", "Command OS.app") : path9.join(systemApps, "Command OS.app");
-    const macOSDir = path9.join(appDir, "Contents", "MacOS");
+    const appDir = base ? path10.join(home, "Applications", "Command OS.app") : path10.join(systemApps, "Command OS.app");
+    const macOSDir = path10.join(appDir, "Contents", "MacOS");
     const script = [
       "#!/bin/bash",
       "# GHL Command \u2014 Command OS launcher (regenerate: ghl-mcp install-launcher)",
@@ -2527,13 +2987,13 @@ function planLauncher(platform2, home, port = 7300, entry = installingEntry()) {
       targetPath: appDir,
       humanLocation: base ? "your personal Applications folder at ~/Applications (Finder \u2192 Go \u2192 Home \u2192 Applications)" : "your Applications folder \u2014 open Finder \u2192 Applications and look for \u201CCommand OS\u201D",
       files: [
-        { path: path9.join(macOSDir, "command-os"), contents: script, executable: true },
-        { path: path9.join(appDir, "Contents", "Info.plist"), contents: plist, executable: false }
+        { path: path10.join(macOSDir, "command-os"), contents: script, executable: true },
+        { path: path10.join(appDir, "Contents", "Info.plist"), contents: plist, executable: false }
       ]
     };
   }
   if (platform2 === "win32") {
-    const target2 = path9.join(home, "Desktop", "Command OS.cmd");
+    const target2 = path10.join(home, "Desktop", "Command OS.cmd");
     return {
       platform: platform2,
       targetPath: target2,
@@ -2546,7 +3006,7 @@ function planLauncher(platform2, home, port = 7300, entry = installingEntry()) {
       ].join("\r\n"), executable: false }]
     };
   }
-  const target = path9.join(home, ".local", "share", "applications", "command-os.desktop");
+  const target = path10.join(home, ".local", "share", "applications", "command-os.desktop");
   return {
     platform: platform2,
     targetPath: target,
@@ -2570,11 +3030,11 @@ function planLauncher(platform2, home, port = 7300, entry = installingEntry()) {
 function installLauncher(argv = []) {
   const portArg = argv.find((a) => a.startsWith("--port="));
   const port = portArg ? Number(portArg.split("=")[1]) : 7300;
-  const plan = planLauncher(process.platform, os4.homedir(), port, installingEntry());
+  const plan = planLauncher(process.platform, os5.homedir(), port, installingEntry());
   try {
     for (const f of plan.files) {
-      fs10.mkdirSync(path9.dirname(f.path), { recursive: true });
-      fs10.writeFileSync(f.path, f.contents, { mode: f.executable ? 493 : 420 });
+      fs11.mkdirSync(path10.dirname(f.path), { recursive: true });
+      fs11.writeFileSync(f.path, f.contents, { mode: f.executable ? 493 : 420 });
     }
   } catch (e) {
     process.stderr.write(`
@@ -2594,13 +3054,13 @@ function installLauncher(argv = []) {
   ].join("\n"));
   return 0;
 }
-var fs10, os4, path9;
+var fs11, os5, path10;
 var init_launcher = __esm({
   "src/launcher.ts"() {
     "use strict";
-    fs10 = __toESM(require("fs"));
-    os4 = __toESM(require("os"));
-    path9 = __toESM(require("path"));
+    fs11 = __toESM(require("fs"));
+    os5 = __toESM(require("os"));
+    path10 = __toESM(require("path"));
   }
 });
 
@@ -2629,10 +3089,10 @@ function stageBlockedBy(stages, stage) {
   return null;
 }
 function claudeBin() {
-  const fallback = path10.join(os5.homedir(), ".local", "bin", "claude");
-  const fromPath = (process.env.PATH || "").split(path10.delimiter).map((d) => path10.join(d, "claude")).find((p) => {
+  const fallback = path11.join(os6.homedir(), ".local", "bin", "claude");
+  const fromPath = (process.env.PATH || "").split(path11.delimiter).map((d) => path11.join(d, "claude")).find((p) => {
     try {
-      fs11.accessSync(p, fs11.constants.X_OK);
+      fs12.accessSync(p, fs12.constants.X_OK);
       return true;
     } catch {
       return false;
@@ -2640,7 +3100,7 @@ function claudeBin() {
   });
   if (fromPath) return fromPath;
   try {
-    fs11.accessSync(fallback, fs11.constants.X_OK);
+    fs12.accessSync(fallback, fs12.constants.X_OK);
     return fallback;
   } catch {
   }
@@ -2689,7 +3149,7 @@ function runStage(locationId2, stage, onEvent, opts = {}) {
   const locationName = SANDBOX_ALLOWLIST[locationId2] || opts.name || locationId2;
   const spec = STAGE_SPECS[stage];
   if (!spec) return Promise.reject(new Error(`Stage ${stage} is not powered yet.`));
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const bin = claudeBin();
     onEvent({ kind: "status", line: `Starting ${spec.name} on ${locationName} (headless Claude, ${spec.allowedTools.length} tools allowed)\u2026` });
     const child = (0, import_child_process2.spawn)(bin, buildClaudeArgs(spec, locationId2, locationName, opts.context), {
@@ -2735,31 +3195,31 @@ function runStage(locationId2, stage, onEvent, opts = {}) {
       if (code !== 0 && !lastText) {
         const outcome2 = { ok: false, error: `claude exited ${code}: ${stderrTail.trim().slice(-200) || "no output"}` };
         onEvent({ kind: "error", line: outcome2.error });
-        resolve6(outcome2);
+        resolve7(outcome2);
         return;
       }
       const outcome = parseResultLine(lastText);
       const detail = outcome.error || (outcome.issues?.length ? outcome.issues.join(" \xB7 ") : "") || outcome.summary || "no detail reported";
       const success = outcome.formId ? `Done: form "${outcome.formName}" (${outcome.formId})` : `Done: ${outcome.summary ?? "stage complete"}`;
       onEvent({ kind: "result", line: outcome.ok ? success : `Not passed: ${detail}` });
-      resolve6(outcome);
+      resolve7(outcome);
     });
     child.on("error", (err) => {
       clearTimeout(timeout);
       const outcome = { ok: false, error: `could not start claude: ${err.message}` };
       onEvent({ kind: "error", line: outcome.error });
-      resolve6(outcome);
+      resolve7(outcome);
     });
   });
 }
-var import_child_process2, fs11, os5, path10, SANDBOX_ALLOWLIST, PROTECTED_LOCATIONS, STAGE_SPECS, HUMAN_GATE_STAGES;
+var import_child_process2, fs12, os6, path11, SANDBOX_ALLOWLIST, PROTECTED_LOCATIONS, STAGE_SPECS, HUMAN_GATE_STAGES;
 var init_stage_runner = __esm({
   "src/stage-runner.ts"() {
     "use strict";
     import_child_process2 = require("child_process");
-    fs11 = __toESM(require("fs"));
-    os5 = __toESM(require("os"));
-    path10 = __toESM(require("path"));
+    fs12 = __toESM(require("fs"));
+    os6 = __toESM(require("os"));
+    path11 = __toESM(require("path"));
     SANDBOX_ALLOWLIST = {
       JrV2p35O3hY2wqhr2c0T: "MCP Testing",
       jHP5wkYRineXDlzAOEbW: "Blueprint Demo"
@@ -3479,11 +3939,11 @@ __export(dashboard_exports, {
   writeOverlay: () => writeOverlay
 });
 function overlayPath() {
-  return path11.join(appDataDir(), "intake-overlay.json");
+  return path12.join(appDataDir(), "intake-overlay.json");
 }
 function readOverlay() {
   try {
-    const raw = JSON.parse(fs12.readFileSync(overlayPath(), "utf8"));
+    const raw = JSON.parse(fs13.readFileSync(overlayPath(), "utf8"));
     if (raw && typeof raw === "object") return raw;
   } catch {
   }
@@ -3491,7 +3951,7 @@ function readOverlay() {
 }
 function writeOverlay(layer) {
   ensureAppDataDir();
-  fs12.writeFileSync(overlayPath(), JSON.stringify(layer, null, 2), { mode: 384 });
+  fs13.writeFileSync(overlayPath(), JSON.stringify(layer, null, 2), { mode: 384 });
 }
 function recoverStuckStages(state) {
   let recovered = 0;
@@ -3503,11 +3963,11 @@ function recoverStuckStages(state) {
   return { state: { ...state, clients }, recovered };
 }
 function cockpitStatePath() {
-  return path11.join(appDataDir(), "cockpit-state.json");
+  return path12.join(appDataDir(), "cockpit-state.json");
 }
 function readCockpitState() {
   try {
-    const raw = JSON.parse(fs12.readFileSync(cockpitStatePath(), "utf8"));
+    const raw = JSON.parse(fs13.readFileSync(cockpitStatePath(), "utf8"));
     if (raw && raw.v === 1 && raw.clients && typeof raw.clients === "object") return raw;
   } catch {
   }
@@ -3515,7 +3975,7 @@ function readCockpitState() {
 }
 function writeCockpitState(state) {
   ensureAppDataDir();
-  fs12.writeFileSync(cockpitStatePath(), JSON.stringify(state, null, 2), { mode: 384 });
+  fs13.writeFileSync(cockpitStatePath(), JSON.stringify(state, null, 2), { mode: 384 });
 }
 function setStage(state, locationId2, stageIndex, status) {
   if (!Number.isInteger(stageIndex) || stageIndex < 0 || stageIndex >= STAGES.length) throw new Error("bad stage index");
@@ -3607,7 +4067,7 @@ function notify(message) {
 `);
   try {
     ensureAppDataDir();
-    fs12.appendFileSync(path11.join(appDataDir(), "cockpit.log"), `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}
+    fs13.appendFileSync(path12.join(appDataDir(), "cockpit.log"), `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}
 `);
   } catch {
   }
@@ -4308,17 +4768,17 @@ async function runDashboard(argv) {
             const source = args.url ? { kind: "url", url: String(args.url) } : args.instruction ? { kind: "recorder", instruction: String(args.instruction) } : { kind: "text", text: String(args.transcript ?? "") };
             let recorderPatterns = [];
             if (source.kind === "recorder") {
-              recorderPatterns = await new Promise((resolve6) => {
+              recorderPatterns = await new Promise((resolve7) => {
                 const ls = (0, import_child_process4.spawn)(claudeBin(), ["mcp", "list"], { stdio: ["ignore", "pipe", "ignore"] });
                 let buf = "";
                 ls.stdout.on("data", (d) => {
                   buf += d.toString();
                 });
-                ls.on("close", () => resolve6(recorderAllowPatterns(buf)));
-                ls.on("error", () => resolve6([]));
+                ls.on("close", () => resolve7(recorderAllowPatterns(buf)));
+                ls.on("error", () => resolve7([]));
                 setTimeout(() => {
                   ls.kill("SIGKILL");
-                  resolve6(recorderAllowPatterns(buf));
+                  resolve7(recorderAllowPatterns(buf));
                 }, 9e4).unref?.();
               });
               if (!recorderPatterns.length) {
@@ -4328,7 +4788,7 @@ async function runDashboard(argv) {
               }
             }
             const out = await prefillFromSource(
-              (prompt, tools) => new Promise((resolve6, reject) => {
+              (prompt, tools) => new Promise((resolve7, reject) => {
                 const argv2 = ["-p", prompt, "--max-turns", "25", "--disallowedTools", tools.deny];
                 if (tools.allow) argv2.push("--allowedTools", tools.allow);
                 else argv2.push("--allowedTools", "");
@@ -4337,7 +4797,7 @@ async function runDashboard(argv) {
                 child.stdout.on("data", (d) => {
                   out2 += d.toString();
                 });
-                child.on("close", () => resolve6(out2));
+                child.on("close", () => resolve7(out2));
                 child.on("error", reject);
                 setTimeout(() => child.kill("SIGKILL"), 5 * 60 * 1e3).unref?.();
               }),
@@ -4469,13 +4929,13 @@ async function runDashboard(argv) {
             }
           }
           const review = await generateReview(
-            (prompt) => new Promise((resolve6, reject) => {
+            (prompt) => new Promise((resolve7, reject) => {
               const child = (0, import_child_process4.spawn)(claudeBin(), ["-p", prompt, "--allowedTools", "", "--disallowedTools", "Bash,Write,Edit,WebFetch,WebSearch,Task,Read,Glob,Grep", "--max-turns", "6"], { stdio: ["ignore", "pipe", "pipe"] });
               let out = "";
               child.stdout.on("data", (d) => {
                 out += d.toString();
               });
-              child.on("close", () => resolve6(out));
+              child.on("close", () => resolve7(out));
               child.on("error", reject);
               setTimeout(() => child.kill("SIGKILL"), 6 * 60 * 1e3).unref?.();
             }),
@@ -4648,9 +5108,9 @@ async function runDashboard(argv) {
     res.end();
   });
   try {
-    await new Promise((resolve6, reject) => {
+    await new Promise((resolve7, reject) => {
       server2.once("error", reject);
-      server2.listen(port, "127.0.0.1", resolve6);
+      server2.listen(port, "127.0.0.1", resolve7);
     });
   } catch (e) {
     const msg2 = e?.code === "EADDRINUSE" ? `Port ${port} is busy with another program. Close it, or start Command OS on a different port.` : `Command OS could not start: ${e instanceof Error ? e.message : String(e)}`;
@@ -4676,18 +5136,18 @@ async function runDashboard(argv) {
     if (adopted) process.stderr.write(`  Synced ${adopted} client${adopted === 1 ? "" : "s"} from your GHL (teammate updates).
 `);
   });
-  return await new Promise((resolve6) => {
-    const stop = () => server2.close(() => resolve6(0));
+  return await new Promise((resolve7) => {
+    const stop = () => server2.close(() => resolve7(0));
     process.on("SIGINT", stop);
     process.on("SIGTERM", stop);
   });
 }
-var fs12, path11, http, import_child_process3, import_child_process4, osmod, STAGES, ACCOUNT_TYPES, activeRun, UPGRADE_MSG;
+var fs13, path12, http, import_child_process3, import_child_process4, osmod, STAGES, ACCOUNT_TYPES, activeRun, UPGRADE_MSG;
 var init_dashboard = __esm({
   "src/dashboard.ts"() {
     "use strict";
-    fs12 = __toESM(require("fs"));
-    path11 = __toESM(require("path"));
+    fs13 = __toESM(require("fs"));
+    path12 = __toESM(require("path"));
     http = __toESM(require("http"));
     import_child_process3 = require("child_process");
     init_credentials_store();
@@ -4722,8 +5182,8 @@ var init_dashboard = __esm({
 
 // src/index.ts
 var dotenv2 = __toESM(require("dotenv"));
-var path12 = __toESM(require("path"));
-var fs13 = __toESM(require("fs"));
+var path13 = __toESM(require("path"));
+var fs14 = __toESM(require("fs"));
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 init_ghl_client();
@@ -8758,16 +9218,16 @@ function registerEmailTools(server2, client) {
 function registerEmailBuilderInternalTools(server2, builderClient) {
   const client = builderClient;
   if (!client) return;
-  async function builderRequest(method, path13, body) {
+  async function builderRequest(method, path14, body) {
     const headers = await client.buildHeaders();
-    const response = await fetch(`${EMAIL_BUILDER_BASE}${path13}`, {
+    const response = await fetch(`${EMAIL_BUILDER_BASE}${path14}`, {
       method,
       headers,
       body: body ? JSON.stringify(body) : void 0
     });
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Email Builder API Error ${response.status}: ${method} /emails/builder${path13}
+      throw new Error(`Email Builder API Error ${response.status}: ${method} /emails/builder${path14}
 ${text2}`);
     }
     const text = await response.text();
@@ -10024,23 +10484,23 @@ var import_zod36 = require("zod");
 function registerFunnelBuilderTools(server2, builderClient) {
   const client = builderClient;
   if (!client) return;
-  async function internalGet(path13) {
-    return client.request("GET", path13);
+  async function internalGet(path14) {
+    return client.request("GET", path14);
   }
-  async function internalPost(path13, body) {
-    return client.request("POST", path13, body);
+  async function internalPost(path14, body) {
+    return client.request("POST", path14, body);
   }
-  async function internalPut(path13, body) {
-    return client.request("PUT", path13, body);
+  async function internalPut(path14, body) {
+    return client.request("PUT", path14, body);
   }
-  async function internalDelete(path13) {
-    return client.request("DELETE", path13);
+  async function internalDelete(path14) {
+    return client.request("DELETE", path14);
   }
-  async function funnelRequest(method, path13, body) {
+  async function funnelRequest(method, path14, body) {
     const headers = await client.buildHeaders();
     headers.Origin = "https://app.gohighlevel.com";
     headers.Referer = "https://app.gohighlevel.com/";
-    const url = `https://backend.leadconnectorhq.com/funnels${path13}`;
+    const url = `https://backend.leadconnectorhq.com/funnels${path14}`;
     const options = { method, headers };
     if (body && (method === "POST" || method === "PUT")) {
       options.body = JSON.stringify(body);
@@ -10048,7 +10508,7 @@ function registerFunnelBuilderTools(server2, builderClient) {
     const response = await fetch(url, options);
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Funnel API Error ${response.status}: ${method} ${path13}
+      throw new Error(`Funnel API Error ${response.status}: ${method} ${path14}
 ${text2}`);
     }
     const text = await response.text();
@@ -10993,12 +11453,12 @@ var valueCardSchema = import_zod37.z.object({
 function registerPageStudioTools(server2, builderClient) {
   const client = builderClient;
   if (!client) return;
-  async function funnelRequest(method, path13) {
+  async function funnelRequest(method, path14) {
     const headers = await client.buildHeaders();
     headers.Origin = "https://app.gohighlevel.com";
     headers.Referer = "https://app.gohighlevel.com/";
-    const response = await fetch(`https://backend.leadconnectorhq.com/funnels${path13}`, { method, headers });
-    if (!response.ok) throw new Error(`Funnel API Error ${response.status}: ${method} ${path13}
+    const response = await fetch(`https://backend.leadconnectorhq.com/funnels${path14}`, { method, headers });
+    if (!response.ok) throw new Error(`Funnel API Error ${response.status}: ${method} ${path14}
 ${await response.text()}`);
     const text = await response.text();
     return text ? JSON.parse(text) : {};
@@ -11317,9 +11777,9 @@ function buildUpdateFormPath(formId, locationId2) {
 function buildUpdateFormBody(name, formData) {
   return { name, formData };
 }
-async function formApiRequest(client, method, path13, body) {
+async function formApiRequest(client, method, path14, body) {
   const headers = await client.buildHeaders();
-  const url = `https://backend.leadconnectorhq.com/forms${path13}`;
+  const url = `https://backend.leadconnectorhq.com/forms${path14}`;
   const options = { method, headers };
   if (body && (method === "POST" || method === "PUT")) {
     options.body = JSON.stringify(body);
@@ -11327,7 +11787,7 @@ async function formApiRequest(client, method, path13, body) {
   const response = await fetch(url, options);
   if (!response.ok) {
     const text2 = await response.text();
-    throw new Error(`Form API Error ${response.status}: ${method} ${path13}
+    throw new Error(`Form API Error ${response.status}: ${method} ${path14}
 ${text2}`);
   }
   const text = await response.text();
@@ -11341,7 +11801,7 @@ ${text2}`);
 function registerFormBuilderTools(server2, builderClient, publicClient) {
   const client = builderClient;
   if (!client) return;
-  const formRequest = (method, path13, body) => formApiRequest(client, method, path13, body);
+  const formRequest = (method, path14, body) => formApiRequest(client, method, path14, body);
   server2.tool(
     "get_form_full",
     "Get a form with full builder data: all fields (labels, types, IDs, validation), conditional logic, auto-responder config, email notification settings, styling, and version history. This is the internal API \u2014 it returns everything the form builder UI shows.",
@@ -11462,10 +11922,10 @@ function registerFormBuilderTools(server2, builderClient, publicClient) {
     },
     async ({ formId, limit, skip }) => {
       try {
-        let path13 = `/submissions?locationId=${client.locationId}&limit=${limit ?? 20}`;
-        if (formId) path13 += `&formId=${formId}`;
-        if (skip) path13 += `&skip=${skip}`;
-        const result = await formRequest("GET", path13);
+        let path14 = `/submissions?locationId=${client.locationId}&limit=${limit ?? 20}`;
+        if (formId) path14 += `&formId=${formId}`;
+        if (skip) path14 += `&skip=${skip}`;
+        const result = await formRequest("GET", path14);
         return {
           content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
         };
@@ -11858,9 +12318,9 @@ var import_zod40 = require("zod");
 function registerPipelineBuilderTools(server2, builderClient) {
   const client = builderClient;
   if (!client) return;
-  async function pipelineRequest(method, path13, body) {
+  async function pipelineRequest(method, path14, body) {
     const headers = await client.buildHeaders();
-    const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path13}`;
+    const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path14}`;
     const options = { method, headers };
     if (body && (method === "POST" || method === "PUT" || method === "PATCH")) {
       options.body = JSON.stringify(body);
@@ -11868,7 +12328,7 @@ function registerPipelineBuilderTools(server2, builderClient) {
     const response = await fetch(url, options);
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Pipeline API Error ${response.status}: ${method} ${path13}
+      throw new Error(`Pipeline API Error ${response.status}: ${method} ${path14}
 ${text2}`);
     }
     const text = await response.text();
@@ -12613,7 +13073,7 @@ ${lines.join("\n")}
 // src/tools/bulk-operations.ts
 var import_zod44 = require("zod");
 function delay(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 function formatResults(op, results, total) {
   return `${op}: ${results.success} success, ${results.failed} failed out of ${total}.${results.errors.length ? "\nErrors:\n" + results.errors.join("\n") : ""}`;
@@ -12738,7 +13198,7 @@ function registerBulkOperationTools(server2, client) {
 // src/tools/account-export.ts
 var import_zod45 = require("zod");
 function delay2(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 function registerAccountExportTools(server2, client) {
   const builderClient = WorkflowBuilderClient.fromEnv();
@@ -13059,9 +13519,9 @@ var OBJECT_KEYS = ["contacts", "opportunity"];
 function registerSmartListTools(server2, builderClient) {
   const client = builderClient;
   if (!client) return;
-  async function smartListRequest(method, path13, body) {
+  async function smartListRequest(method, path14, body) {
     const headers = await client.buildHeaders();
-    const url = `${SMARTLIST_BASE}${path13}`;
+    const url = `${SMARTLIST_BASE}${path14}`;
     const options = { method, headers };
     if (body && (method === "POST" || method === "PUT")) {
       options.body = JSON.stringify(body);
@@ -13069,7 +13529,7 @@ function registerSmartListTools(server2, builderClient) {
     const response = await fetch(url, options);
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Smart Lists API Error ${response.status}: ${method} ${path13}
+      throw new Error(`Smart Lists API Error ${response.status}: ${method} ${path14}
 ${text2}`);
     }
     const text = await response.text();
@@ -13201,12 +13661,12 @@ var REPUTATION_BASE = "https://backend.leadconnectorhq.com/reputation";
 function registerReputationTools(server2, builderClient) {
   const client = builderClient;
   if (!client) return;
-  async function reputationRequest(method, path13) {
+  async function reputationRequest(method, path14) {
     const headers = await client.buildHeaders();
-    const response = await fetch(`${REPUTATION_BASE}${path13}`, { method, headers });
+    const response = await fetch(`${REPUTATION_BASE}${path14}`, { method, headers });
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Reputation API Error ${response.status}: ${method} ${path13}
+      throw new Error(`Reputation API Error ${response.status}: ${method} ${path14}
 ${text2}`);
     }
     const text = await response.text();
@@ -13321,16 +13781,16 @@ var MEMBERSHIP_BASE = "https://backend.leadconnectorhq.com/membership";
 function registerMembershipTools(server2, builderClient) {
   const client = builderClient;
   if (!client) return;
-  async function membershipRequest(path13, method = "GET", body) {
+  async function membershipRequest(path14, method = "GET", body) {
     const headers = await client.buildHeaders();
-    const response = await fetch(`${MEMBERSHIP_BASE}${path13}`, {
+    const response = await fetch(`${MEMBERSHIP_BASE}${path14}`, {
       method,
       headers,
       body: body ? JSON.stringify(body) : void 0
     });
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Membership API Error ${response.status}: ${method} ${path13}
+      throw new Error(`Membership API Error ${response.status}: ${method} ${path14}
 ${text2}`);
     }
     const text = await response.text();
@@ -13499,7 +13959,7 @@ var import_zod51 = require("zod");
 var fs7 = __toESM(require("fs"));
 var path6 = __toESM(require("path"));
 function delay3(ms) {
-  return new Promise((resolve6) => setTimeout(resolve6, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 var TemplateSchema = import_zod51.z.object({
   templateName: import_zod51.z.string(),
@@ -13643,7 +14103,7 @@ function registerTemplateDeployerTools(server2, client) {
         const locId = client.resolveLocationId(locationId2);
         const safePath = validateTemplatePath(templateFile);
         const template = TemplateSchema.parse(JSON.parse(fs7.readFileSync(safePath, "utf-8")));
-        const resolve6 = (text) => {
+        const resolve7 = (text) => {
           if (typeof text !== "string") return text;
           let result = text;
           for (const [key, value] of Object.entries(answers)) {
@@ -13656,7 +14116,7 @@ function registerTemplateDeployerTools(server2, client) {
           return result;
         };
         const resolveObj = (obj) => {
-          if (typeof obj === "string") return resolve6(obj);
+          if (typeof obj === "string") return resolve7(obj);
           if (Array.isArray(obj)) return obj.map(resolveObj);
           if (obj && typeof obj === "object") {
             const result = {};
@@ -14336,7 +14796,35 @@ async function fullWorkflowCatalog(builderClient) {
   return { ids, rows, complete };
 }
 function registerValidatorTools(server2, client, builderClient) {
-  if (!builderClient) return;
+  if (!builderClient) {
+    const finishInstallStub = (asked) => ({
+      content: [{
+        type: "text",
+        text: [
+          `\`${asked}\` needs the one-time browser login that finishes your install (step 2 of 2).`,
+          "",
+          'Say: **"Unlock the Workflow Builder"** (or run `capture_firebase_interactive`).',
+          "A Chrome window opens, you log into GHL once, and the install finishes itself \u2014 about 60 seconds.",
+          "Then restart Claude once, and this tool will be live.",
+          "",
+          "No Chrome on this machine? Run `auto_capture_firebase_script` for the copy-paste path instead."
+        ].join("\n")
+      }]
+    });
+    server2.tool(
+      "validate_workflow",
+      "Pre-flight ID validation for ONE deployed GHL workflow. [NEEDS INSTALL STEP 2 \u2014 run capture_firebase_interactive (one-time browser login) to activate this tool.]",
+      { workflowId: import_zod52.z.string().describe("The workflow ID to validate.") },
+      async () => finishInstallStub("validate_workflow")
+    );
+    server2.tool(
+      "audit_workflows",
+      "Account-wide silent-failure audit of every workflow. [NEEDS INSTALL STEP 2 \u2014 run capture_firebase_interactive (one-time browser login) to activate this tool.]",
+      {},
+      async () => finishInstallStub("audit_workflows")
+    );
+    return;
+  }
   server2.tool(
     "validate_workflow",
     "Pre-flight ID validation for ONE deployed GHL workflow. Scans every trigger and action for references to pipelines, pipeline stages, custom fields, users, workflows, forms, calendars, and surveys; verifies each ID exists in the current location. Use BEFORE publish_workflow when a workflow was edited, or when a published workflow stops behaving. Catches the silent-failure bug where invalid IDs make GHL skip all subsequent actions. Never reports a false break \u2014 anything it cannot fully verify is marked 'unverified', not 'error'.",
@@ -14521,7 +15009,7 @@ function registerDiagnosticTools(server2, installedVersion, client, builderClien
       })();
       const firebasePromise = (async () => {
         if (!builderClient) {
-          return { name: "Firebase auth (workflow builder)", status: "skip", detail: "Not configured. The 54 Firebase-gated tools need Firebase credentials. The other 179 tools work fine without. To add it: run enable_workflow_builder with the three Firebase values from your GHL browser session (see elitedcs.com/ghl-mcp-firebase for DevTools steps). Do NOT put Firebase values as env vars in your Claude Desktop config \u2014 that path is unreliable and is the usual reason this still shows skip after a restart. enable_workflow_builder saves and verifies them for you." };
+          return { name: "Firebase auth (workflow builder)", status: "skip", detail: "Not configured \u2014 your install is one step from finished. Run capture_firebase_interactive: a Chrome window opens, you log into GHL once, and it captures + verifies everything itself (about 60 seconds). This powers the account auditor and the Firebase-gated tools. No Chrome on this machine? auto_capture_firebase_script is the copy-paste path. Do NOT put Firebase values as env vars in your Claude Desktop config \u2014 that path is unreliable and is the usual reason this still shows skip after a restart." };
         }
         const result = await builderClient.checkAuth();
         const tokenCompany = builderClient.getTokenCompanyId();
@@ -15317,9 +15805,9 @@ function presetForBusinessType(type) {
       return "generic";
   }
 }
-function setPath(target, path13, value) {
+function setPath(target, path14, value) {
   if (value === void 0) return;
-  const parts = path13.split(".");
+  const parts = path14.split(".");
   let node = target;
   for (let i = 0; i < parts.length - 1; i++) {
     const k = parts[i];
@@ -17405,15 +17893,15 @@ function extractFunnelId(result) {
   return void 0;
 }
 function makeExecuteDeps(client, builderClient, locationId2) {
-  const pipelineApi = async (method, path13, body) => {
+  const pipelineApi = async (method, path14, body) => {
     const headers = await builderClient.buildHeaders();
-    const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path13}`;
+    const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path14}`;
     const options = { method, headers };
     if (body && (method === "POST" || method === "PUT")) options.body = JSON.stringify(body);
     const response = await fetch(url, options);
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Pipeline API ${response.status}: ${method} ${path13}
+      throw new Error(`Pipeline API ${response.status}: ${method} ${path14}
 ${text2.slice(0, 300)}`);
     }
     const text = await response.text();
@@ -17424,17 +17912,17 @@ ${text2.slice(0, 300)}`);
       return JSON.parse(text.replace(/[\x00-\x1F\x7F]/g, ""));
     }
   };
-  const funnelApi = async (method, path13, body) => {
+  const funnelApi = async (method, path14, body) => {
     const headers = await builderClient.buildHeaders();
     headers.Origin = "https://app.gohighlevel.com";
     headers.Referer = "https://app.gohighlevel.com/";
-    const url = `https://backend.leadconnectorhq.com/funnels${path13}`;
+    const url = `https://backend.leadconnectorhq.com/funnels${path14}`;
     const options = { method, headers };
     if (body && (method === "POST" || method === "PUT")) options.body = JSON.stringify(body);
     const response = await fetch(url, options);
     if (!response.ok) {
       const text2 = await response.text();
-      throw new Error(`Funnel API ${response.status}: ${method} ${path13}
+      throw new Error(`Funnel API ${response.status}: ${method} ${path14}
 ${text2.slice(0, 300)}`);
     }
     const text = await response.text();
@@ -18351,21 +18839,29 @@ function registerMetaTools(server2, installedVersion) {
 }
 
 // src/cli.ts
-var import_node_util = require("node:util");
-var fs9 = __toESM(require("fs"));
-var path8 = __toESM(require("path"));
+var import_node_util2 = require("node:util");
+var fs10 = __toESM(require("fs"));
+var path9 = __toESM(require("path"));
 var import_crypto2 = require("crypto");
 init_ghl_client();
 init_token_registry();
 init_credentials_store();
 init_setup_tool();
-var EXIT_OK = 0;
-var EXIT_USAGE = 2;
+var EXIT_OK2 = 0;
+var EXIT_USAGE2 = 2;
 var EXIT_VALIDATION = 3;
 var EXIT_FS = 4;
 var USAGE = `Usage: ghl-mcp cli <subcommand> [options]
 
 Subcommands:
+  install                    Add GHL Command to Claude Desktop's settings file
+                             (merges safely with existing MCP servers; backs up
+                             first; repairs unreadable configs where possible)
+      --dry-run              Show what would change without writing anything
+      --print-only           Print the merged JSON instead of writing it
+      --path <file>          Explicit claude_desktop_config.json location
+      --force                Replace a different existing "ghl" entry
+
   register-location          Add a sub-account's Private Integration key
       --location-id <id>     GHL Location ID (required)
       --api-key <pit-...>    The sub-account's Private Integration key (required)
@@ -18396,9 +18892,9 @@ function errLine(msg2) {
 function preflightWritable() {
   try {
     const dir = ensureAppDataDir();
-    const probe = path8.join(dir, `.write-probe.${process.pid}.${(0, import_crypto2.randomBytes)(4).toString("hex")}`);
-    fs9.writeFileSync(probe, "ok");
-    fs9.unlinkSync(probe);
+    const probe = path9.join(dir, `.write-probe.${process.pid}.${(0, import_crypto2.randomBytes)(4).toString("hex")}`);
+    fs10.writeFileSync(probe, "ok");
+    fs10.unlinkSync(probe);
     return true;
   } catch (error) {
     errLine(`Config dir is not writable: ${error instanceof Error ? error.message : String(error)}`);
@@ -18422,7 +18918,7 @@ function confirmSaved(registry2) {
 function parse(argv, options, required) {
   let parsed;
   try {
-    parsed = (0, import_node_util.parseArgs)({ args: argv, options, strict: true, allowPositionals: false });
+    parsed = (0, import_node_util2.parseArgs)({ args: argv, options, strict: true, allowPositionals: false });
   } catch (error) {
     return { usageError: error instanceof Error ? error.message : String(error) };
   }
@@ -18449,7 +18945,7 @@ async function cmdRegisterLocation(argv, registry2) {
   if ("usageError" in p) {
     errLine(p.usageError);
     errLine(USAGE);
-    return EXIT_USAGE;
+    return EXIT_USAGE2;
   }
   const locationId2 = p.values["location-id"].trim();
   const apiKey2 = p.values["api-key"].trim();
@@ -18482,7 +18978,7 @@ async function cmdRegisterLocation(argv, registry2) {
 `
   );
   restartReminder();
-  return EXIT_OK;
+  return EXIT_OK2;
 }
 async function cmdRegisterCompanyFirebase(argv, registry2) {
   const p = parse(
@@ -18500,7 +18996,7 @@ async function cmdRegisterCompanyFirebase(argv, registry2) {
   if ("usageError" in p) {
     errLine(p.usageError);
     errLine(USAGE);
-    return EXIT_USAGE;
+    return EXIT_USAGE2;
   }
   const typedCompanyId = p.values["company-id"].trim();
   const refreshToken = p.values["refresh-token"].trim();
@@ -18510,7 +19006,7 @@ async function cmdRegisterCompanyFirebase(argv, registry2) {
   if (!apiKey2) {
     errLine("No Firebase API key available. Pass --api-key (starts with 'AIza'), or seed the home");
     errLine("Firebase first (the key is identical across GHL accounts).");
-    return EXIT_USAGE;
+    return EXIT_USAGE2;
   }
   let canonicalCompanyId = typedCompanyId;
   if (!p.values["no-validate"]) {
@@ -18549,7 +19045,7 @@ async function cmdRegisterCompanyFirebase(argv, registry2) {
 `
   );
   restartReminder();
-  return EXIT_OK;
+  return EXIT_OK2;
 }
 async function cmdRegisterAgencyKey(argv, registry2) {
   const p = parse(
@@ -18560,7 +19056,7 @@ async function cmdRegisterAgencyKey(argv, registry2) {
   if ("usageError" in p) {
     errLine(p.usageError);
     errLine(USAGE);
-    return EXIT_USAGE;
+    return EXIT_USAGE2;
   }
   const apiKey2 = p.values["api-key"].trim();
   if (!p.values["no-validate"]) {
@@ -18589,7 +19085,7 @@ async function cmdRegisterAgencyKey(argv, registry2) {
   process.stdout.write(`Registered agency key: ${apiKey2.substring(0, 12)}... \u2192 ${tokenRegistryPath()}
 `);
   restartReminder();
-  return EXIT_OK;
+  return EXIT_OK2;
 }
 function cmdListLocations(registry2) {
   const locs = registry2.listLocations().map((loc) => {
@@ -18606,15 +19102,19 @@ function cmdListLocations(registry2) {
     companyFirebases: companies.map(({ companyId, name }) => ({ companyId, ...name ? { name } : {} }))
   };
   process.stdout.write(JSON.stringify(out, null, 2) + "\n");
-  return EXIT_OK;
+  return EXIT_OK2;
 }
 async function runCli(subcommand, argv) {
+  if (subcommand === "install") {
+    const { runInstall: runInstall2 } = await Promise.resolve().then(() => (init_config_installer(), config_installer_exports));
+    return runInstall2(argv);
+  }
   let registry2;
   try {
     registry2 = new TokenRegistry();
   } catch (error) {
     errLine(error instanceof Error ? error.message : String(error));
-    return EXIT_USAGE;
+    return EXIT_USAGE2;
   }
   const loadFailure = registry2.getLoadFailure();
   if (loadFailure) {
@@ -18635,11 +19135,11 @@ async function runCli(subcommand, argv) {
     case "--help":
     case "-h":
       process.stdout.write(USAGE + "\n");
-      return subcommand === void 0 ? EXIT_USAGE : EXIT_OK;
+      return subcommand === void 0 ? EXIT_USAGE2 : EXIT_OK2;
     default:
       errLine(`Unknown subcommand: ${subcommand}`);
       errLine(USAGE);
-      return EXIT_USAGE;
+      return EXIT_USAGE2;
   }
 }
 
@@ -18648,7 +19148,7 @@ var bundledPkg = require_package();
 var pkg = (() => {
   try {
     const onDisk = JSON.parse(
-      fs13.readFileSync(path12.resolve(__dirname, "..", "package.json"), "utf8")
+      fs14.readFileSync(path13.resolve(__dirname, "..", "package.json"), "utf8")
     );
     if (typeof onDisk.version === "string" && onDisk.version.length > 0) {
       return { version: onDisk.version };
@@ -18661,7 +19161,7 @@ dotenv2.config();
 setPkgVersion(pkg.version);
 {
   const configDirOverride = process.env.GHL_MCP_CONFIG_DIR?.trim();
-  if (configDirOverride && !path12.isAbsolute(configDirOverride)) {
+  if (configDirOverride && !path13.isAbsolute(configDirOverride)) {
     process.stderr.write(
       `[ghl-mcp] GHL_MCP_CONFIG_DIR must be an absolute path (got "${configDirOverride}"). Use e.g. /data/ghl-mcp in a container, with a volume mounted at /data.
 `
@@ -18674,20 +19174,20 @@ process.on("unhandledRejection", (reason) => {
 `);
 });
 function hardenSecretFilePerms() {
-  const repoDir = path12.resolve(__dirname, "..");
+  const repoDir = path13.resolve(__dirname, "..");
   const candidates = [
-    { file: path12.join(repoDir, "start-mcp.sh"), mode: 448 },
+    { file: path13.join(repoDir, "start-mcp.sh"), mode: 448 },
     // Legacy registry location (pre-migration); new location lives in app-data.
-    { file: path12.join(repoDir, ".ghl-tokens.json"), mode: 384 },
+    { file: path13.join(repoDir, ".ghl-tokens.json"), mode: 384 },
     { file: tokenRegistryPath(), mode: 384 }
   ];
   for (const { file, mode } of candidates) {
     let current;
     try {
-      if (!fs13.existsSync(file)) continue;
-      current = fs13.statSync(file).mode & 511;
+      if (!fs14.existsSync(file)) continue;
+      current = fs14.statSync(file).mode & 511;
       if (current !== mode) {
-        fs13.chmodSync(file, mode);
+        fs14.chmodSync(file, mode);
       }
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
@@ -18878,7 +19378,10 @@ async function resolveAccessAndRegister() {
     registerSetupTool(server, pkg.version);
     registerLeadCaptureTool(server);
     registerOutOfBand(
-      [{ name: "auto_capture_firebase_script", register: () => registerFirebaseCaptureScriptTool(server) }],
+      [
+        { name: "auto_capture_firebase_script", register: () => registerFirebaseCaptureScriptTool(server) },
+        { name: "capture_firebase_interactive", register: () => registerInteractiveCaptureTool(server) }
+      ],
       gatingConfig,
       outOfBandTracker
     );
@@ -18892,6 +19395,13 @@ async function resolveAccessAndRegister() {
         // a fresh refresh token when it rotates. Registered on the FREE tier too:
         // the Firebase login powers the read-only auditor tools (audit_workflows,
         // validate_workflow, *_full reads) — only the write tools stay gated.
+        // v3.60.0: setup_ghl_mcp registers in NORMAL mode too — it is the
+        // ONE-LINE UPGRADE path ("email + new license key, nothing else").
+        // Before this it existed only in bootstrap, so an installed free user
+        // pasting the upgrade line got "Tool setup_ghl_mcp not found" — the
+        // exact audience the upgrade exists for. Caught by the live wire
+        // proof, not by unit tests (the handler worked; registration didn't).
+        { name: "setup_ghl_mcp", register: () => registerSetupTool(server, pkg.version) },
         { name: "enable_workflow_builder", register: () => registerEnableWorkflowBuilderTool(server) },
         { name: "auto_capture_firebase_script", register: () => registerFirebaseCaptureScriptTool(server) },
         // One-click Builder unlock — buyer just logs into a Chrome window the