@elitedcs/ghl-mcp 3.81.1 → 3.82.0

package/dist/index.js

@@ -1006,10 +1006,10 @@ function parkedRefusal(current, next, parked) {
   const currentById = new Map(current.filter(hasId).map((a) => [a.id, a]));
   const nextById = new Map(next.filter(hasId).map((a) => [a.id, a]));
   const contactsByStep = new Map(occupied.map((p) => [p.currentStepId, p.total]));
-  const guarded = protectedClosure([...contactsByStep.keys()], currentById);
+  const guarded2 = protectedClosure([...contactsByStep.keys()], currentById);
   const deleted = [];
   const altered = [];
-  for (const id of guarded) {
+  for (const id of guarded2) {
     const before = currentById.get(id);
     if (!before) continue;
     const after = nextById.get(id);
@@ -1019,11 +1019,11 @@ function parkedRefusal(current, next, parked) {
     }
     if (stable(before) !== stable(after)) altered.push(id);
   }
-  for (const id of guarded) {
+  for (const id of guarded2) {
     const head3 = currentById.get(id);
     if (!head3) continue;
     for (const target of branchTargetStepIds(head3)) {
-      if (guarded.has(target) || deleted.includes(target)) continue;
+      if (guarded2.has(target) || deleted.includes(target)) continue;
       if (currentById.has(target) && !nextById.has(target)) deleted.push(target);
     }
   }
@@ -12921,7 +12921,8 @@ var init_schema = __esm({
       }).strict(),
       logo: import_zod42.z.object({
         inlineSvg: import_zod42.z.string().optional(),
-        dataUri: import_zod42.z.string().optional(),
+        // A raster image carried inline (png/jpeg/gif/webp, base64): the brand page puts it straight into an <img src>.
+        dataUri: import_zod42.z.string().regex(/^data:image\/(png|jpe?g|gif|webp);base64,[A-Za-z0-9+/=]+$/, "logo.dataUri must be a base64 png, jpeg, gif or webp data URI").optional(),
         width: import_zod42.z.number().optional(),
         height: import_zod42.z.number().optional(),
         whiteFillFixed: import_zod42.z.boolean(),
@@ -13294,6 +13295,108 @@ var init_store = __esm({
   }
 });
 
+// src/command-os/design/svg-sanitize.ts
+function unquote(v) {
+  return v.replace(/^"(.*)"$/s, "$1").replace(/^'(.*)'$/s, "$1");
+}
+function decoded(v) {
+  let s = v;
+  for (let i = 0; i < 5; i++) {
+    const next = s.replace(/&#x([0-9a-f]{1,6});?/gi, (_m, h) => String.fromCodePoint(parseInt(h, 16))).replace(/&#(\d{1,7});?/g, (_m, n) => String.fromCodePoint(Math.min(parseInt(n, 10), 1114111))).replace(/&([a-z]+);/gi, (m, name) => NAMED_ENTITIES[name.toLowerCase()] ?? m);
+    if (next === s) break;
+    s = next;
+  }
+  s = s.replace(/\\([0-9a-f]{1,6})\s?/gi, (_m, h) => String.fromCodePoint(parseInt(h, 16))).replace(/\\(.)/g, "$1");
+  return s.replace(/[\u0000-\u0020\u007f-\u009f\u200b-\u200f\u2028\u2029\ufeff]/g, "");
+}
+function safeUrl(raw) {
+  const s = decoded(unquote(raw)).toLowerCase();
+  if (/[&\\<>]/.test(s)) return false;
+  return s === "" || s.startsWith("#") || isRasterDataUri(s);
+}
+function safeStyle(v) {
+  const s = decoded(v);
+  if (/[&\\<>]/.test(s)) return false;
+  return !/url\s*\(|@import|expression\s*\(|javascript:|vbscript:|behavior\s*:|-moz-binding|@charset|@namespace|image-set\s*\(|src\s*:/i.test(s);
+}
+function isRasterDataUri(v) {
+  return typeof v === "string" && /^data:image\/(png|jpe?g|gif|webp);base64,[a-z0-9+/=]+$/i.test(v);
+}
+function sanitizeSvg(input) {
+  if (typeof input !== "string") throw new Error(SVG_SHAPE_ERROR);
+  let svg = input.replace(CDATA, "").replace(COMMENTS, "").replace(PROCESSING, "").replace(DOCTYPE, "").trim();
+  if (!SHAPE.test(svg) || svg.length > SVG_MAX_BYTES) throw new Error(SVG_SHAPE_ERROR);
+  let before = "";
+  while (before !== svg) {
+    before = svg;
+    svg = svg.replace(DROP_ELEMENTS, "");
+  }
+  const classRules = /* @__PURE__ */ new Map();
+  svg = svg.replace(/<style\b[^>]*>([\s\S]*?)<\/style>/gi, (_m, css2) => {
+    for (const rule5 of css2.matchAll(/([^{}]+)\{([^{}]*)\}/g)) {
+      const decls = rule5[2].trim().replace(/;\s*$/, "");
+      if (!decls || !safeStyle(decls)) continue;
+      for (const sel of rule5[1].split(",")) {
+        const cm = /^\s*\.([A-Za-z_][\w-]*)\s*$/.exec(sel);
+        if (cm) classRules.set(cm[1], classRules.has(cm[1]) ? `${classRules.get(cm[1])};${decls}` : decls);
+      }
+    }
+    return "";
+  });
+  const attrValue = (v) => `"${v.replace(/"/g, "&quot;")}"`;
+  svg = svg.replace(TAG, (_m, name, attrs, selfClose) => {
+    let kept = [];
+    let classes = [];
+    let ownStyle = "";
+    for (const a of attrs.matchAll(ATTR)) {
+      const key = a[1];
+      const k = key.toLowerCase();
+      const hasValue = a[2] !== void 0;
+      const val = a[2] ?? "";
+      if (k.startsWith("on")) continue;
+      if (URL_ATTRS.has(k) && !safeUrl(val)) continue;
+      if (k === "style" && !safeStyle(unquote(val))) continue;
+      if (/javascript:|data:text|vbscript:|data:image\/svg/i.test(decoded(unquote(val)))) continue;
+      if (k === "class") classes = unquote(val).split(/\s+/).filter(Boolean);
+      if (k === "style") ownStyle = unquote(val);
+      kept.push(hasValue ? `${key}=${/^["']/.test(val) ? val : attrValue(val)}` : key);
+    }
+    const fromClasses = classes.flatMap((c) => classRules.has(c) ? [classRules.get(c)] : []);
+    if (fromClasses.length) {
+      kept = kept.filter((a) => !/^style=/i.test(a));
+      kept.push(`style=${attrValue([...fromClasses, ownStyle].filter(Boolean).join(";"))}`);
+    }
+    return `<${name}${kept.length ? " " + kept.join(" ") : ""}${selfClose ? "/" : ""}>`;
+  });
+  if (/<style\b/i.test(svg) || !SHAPE.test(svg)) throw new Error(SVG_SHAPE_ERROR);
+  return svg;
+}
+function sanitizeSvgOrDrop(input) {
+  try {
+    return sanitizeSvg(input);
+  } catch {
+    return void 0;
+  }
+}
+var SVG_MAX_BYTES, SVG_SHAPE_ERROR, DROP_ELEMENTS, COMMENTS, PROCESSING, DOCTYPE, CDATA, TAG, ATTR, URL_ATTRS, NAMED_ENTITIES, SHAPE;
+var init_svg_sanitize = __esm({
+  "src/command-os/design/svg-sanitize.ts"() {
+    "use strict";
+    SVG_MAX_BYTES = 6e4;
+    SVG_SHAPE_ERROR = "The logo must be one <svg>\u2026</svg> under 60 KB.";
+    DROP_ELEMENTS = /<\s*(script|foreignObject|iframe|object|embed|handler|set|animate|animateMotion|animateTransform|discard|audio|video)\b[^>]*(?:\/\s*>|>[\s\S]*?<\/\s*\1\s*>)/gi;
+    COMMENTS = /<!--[\s\S]*?-->/g;
+    PROCESSING = /<\?[\s\S]*?\?>/g;
+    DOCTYPE = /<!DOCTYPE[\s\S]*?(?:\[[\s\S]*?\])?\s*>/gi;
+    CDATA = /<!\[CDATA\[[\s\S]*?\]\]>/g;
+    TAG = /<([a-zA-Z][\w:.-]*)((?:\s+[^\s=>/]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+))?)*)\s*(\/?)>/g;
+    ATTR = /([^\s=/]+)(?:\s*=\s*("[^"]*"|'[^']*'|[^\s>]+))?/g;
+    URL_ATTRS = /* @__PURE__ */ new Set(["href", "xlink:href", "src", "from", "to", "values", "by", "formaction", "action"]);
+    NAMED_ENTITIES = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'", nbsp: " " };
+    SHAPE = /^<svg[\s>][\s\S]*<\/svg>$/i;
+  }
+});
+
 // src/command-os/design/extract.ts
 async function fetchText(url, fetchImpl, timeoutMs = 15e3) {
   const ctl = new AbortController();
@@ -13702,10 +13805,15 @@ function deriveBrandDna(raw, opts = {}) {
       fixed = true;
     }
     const vb = svg.match(/viewBox=["']\s*[\d.-]+\s+[\d.-]+\s+([\d.]+)\s+([\d.]+)/i);
-    logoSvg = svg;
-    logo = { inlineSvg: svg.length <= 6e4 ? svg : void 0, whiteFillFixed: fixed, source: bl.where, rights: opts.rights ? "declared" : "inherits", ...vb && { width: parseFloat(vb[1]), height: parseFloat(vb[2]) } };
-    declared++;
-    evidence["logo"] = `${bl.where}${fixed ? "; white fills replaced with currentColor" : ""}`;
+    const clean = sanitizeSvgOrDrop(svg);
+    if (clean) {
+      logoSvg = clean;
+      logo = { inlineSvg: clean, whiteFillFixed: fixed, source: bl.where, rights: opts.rights ? "declared" : "inherits", ...vb && { width: parseFloat(vb[1]), height: parseFloat(vb[2]) } };
+      declared++;
+      evidence["logo"] = `${bl.where}${fixed ? "; white fills replaced with currentColor" : ""}${clean !== svg ? "; scripts, handlers and outside references stripped" : ""}`;
+    } else {
+      evidence["logo"] = `${bl.where}: not a plain drawing (or over 60 KB), so it was not kept`;
+    }
   } else if (raw.logo?.bytes && raw.logo.kind !== "svg") {
     logoPng = raw.logo.bytes;
     const mime = raw.logo.kind === "png" ? "image/png" : raw.logo.kind === "webp" ? "image/webp" : "image/jpeg";
@@ -13769,6 +13877,7 @@ var init_extract = __esm({
     init_fonts();
     init_schema();
     init_store();
+    init_svg_sanitize();
     UA = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 GHLCommand-DesignStudio/0.1";
     rank = (arr) => {
       const m = /* @__PURE__ */ new Map();
@@ -21870,7 +21979,7 @@ function safeParse(raw) {
     return {};
   }
 }
-function safeUrl(x, max = MAX_URL) {
+function safeUrl2(x, max = MAX_URL) {
   const raw = str2(x, max);
   if (!raw) return void 0;
   let u;
@@ -21898,8 +22007,8 @@ function sanitizeProfile(raw) {
     agencyName: str2(r.agencyName, 80),
     legalName: str2(r.legalName),
     accent: normalizeAccent(r.accent),
-    logoUrl: safeUrl(r.logoUrl),
-    website: safeUrl(r.website),
+    logoUrl: safeUrl2(r.logoUrl),
+    website: safeUrl2(r.website),
     sender: drop({
       fromName: str2(sender?.fromName, 80),
       replyTo: str2(sender?.replyTo),
@@ -21940,9 +22049,44 @@ function sanitizeProfile(raw) {
       timezone: str2(defaults?.timezone, 64),
       industry: str2(defaults?.industry, 64)
     }),
+    agencyOs: sanitizeAgencyOs(r.agencyOs),
     updated_at: str2(r.updated_at, 40)
   };
 }
+function sanitizeAgencyOs(raw) {
+  if (!raw || typeof raw !== "object") return void 0;
+  const r = raw;
+  const ica = r.ica ?? {};
+  const offer = r.offer ?? {};
+  const lines = (x) => list(x, (s) => str2(s, MAX_STR * 2));
+  const out = drop({
+    story: str2(r.story, MAX_PARA),
+    method: str2(r.method, MAX_PARA),
+    voice: str2(r.voice, 400),
+    values: lines(r.values),
+    goals: str2(r.goals, 400),
+    proof: lines(r.proof),
+    ica: drop({
+      who: str2(ica.who, 400),
+      pains: lines(ica.pains),
+      desires: lines(ica.desires),
+      objections: lines(ica.objections),
+      triggers: lines(ica.triggers),
+      vocabulary: lines(ica.vocabulary),
+      hangouts: lines(ica.hangouts),
+      villains: lines(ica.villains)
+    }),
+    offer: drop({
+      name: str2(offer.name, 120),
+      promise: str2(offer.promise, 400),
+      valueStack: lines(offer.valueStack),
+      price: str2(offer.price, 120),
+      guarantee: str2(offer.guarantee, 600),
+      accelerators: lines(offer.accelerators)
+    })
+  });
+  return out && Object.keys(out).length ? out : void 0;
+}
 function legacyBranding(profileFile) {
   try {
     const raw = JSON.parse(fs12.readFileSync(path11.join(path11.dirname(profileFile), "cockpit-state.json"), "utf8"));
@@ -21960,6 +22104,23 @@ function readAgencyProfile(file = agencyProfilePath()) {
   const legacy = legacyBranding(file);
   return legacy.agencyName || legacy.accent ? sanitizeProfile({ ...EMPTY, ...legacy }) : { ...EMPTY };
 }
+function mergeNested(base, patch, depth) {
+  const out = { ...base };
+  for (const [ck, cv] of Object.entries(patch)) {
+    if (ck === "__proto__" || ck === "constructor" || ck === "prototype") continue;
+    if (cv === void 0) continue;
+    if (cv === null) {
+      delete out[ck];
+      continue;
+    }
+    if (depth > 1 && isPlainObject(cv) && isPlainObject(out[ck])) {
+      out[ck] = mergeNested(out[ck], cv, depth - 1);
+      continue;
+    }
+    out[ck] = cv;
+  }
+  return out;
+}
 function mergeAgencyProfile(existing, patch) {
   const p = isPlainObject(patch) ? patch : {};
   const merged = Object.assign(/* @__PURE__ */ Object.create(null), existing);
@@ -21972,17 +22133,7 @@ function mergeAgencyProfile(existing, patch) {
       continue;
     }
     if (NESTED.has(k) && isPlainObject(v)) {
-      const base = isPlainObject(merged[k]) ? { ...merged[k] } : {};
-      for (const [ck, cv] of Object.entries(v)) {
-        if (ck === "__proto__" || ck === "constructor" || ck === "prototype") continue;
-        if (cv === void 0) continue;
-        if (cv === null) {
-          delete base[ck];
-          continue;
-        }
-        base[ck] = cv;
-      }
-      merged[k] = base;
+      merged[k] = mergeNested(isPlainObject(merged[k]) ? merged[k] : {}, v, 2);
       continue;
     }
     merged[k] = v;
@@ -22043,7 +22194,7 @@ function writeAgencyProfile(patch, file = agencyProfilePath()) {
 function profileIsUsable(p) {
   return Boolean(p.agencyName);
 }
-var fs12, path11, AGENCY_PROFILE_ENV, EMPTY, MAX_URL, MAX_SOP, PATCHABLE, NESTED, isPlainObject;
+var fs12, path11, AGENCY_PROFILE_ENV, EMPTY, MAX_URL, MAX_SOP, MAX_PARA, PATCHABLE, NESTED, isPlainObject;
 var init_agency_profile = __esm({
   "src/agency-profile.ts"() {
     "use strict";
@@ -22055,6 +22206,7 @@ var init_agency_profile = __esm({
     EMPTY = { v: 1 };
     MAX_URL = 500;
     MAX_SOP = 2e3;
+    MAX_PARA = 2e3;
     PATCHABLE = [
       "agencyName",
       "legalName",
@@ -22066,9 +22218,10 @@ var init_agency_profile = __esm({
       "pricing",
       "delivery",
       "staff",
-      "defaults"
+      "defaults",
+      "agencyOs"
     ];
-    NESTED = /* @__PURE__ */ new Set(["sender", "pricing", "delivery", "defaults"]);
+    NESTED = /* @__PURE__ */ new Set(["sender", "pricing", "delivery", "defaults", "agencyOs"]);
     isPlainObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
   }
 });
@@ -22262,7 +22415,7 @@ function parseNote(body) {
   if (!s || typeof s !== "object" || typeof s.biz !== "string") return null;
   if (!s.ans || typeof s.ans !== "object") return null;
   return {
-    state: { biz: s.biz, trade: s.trade, ans: s.ans, skip: s.skip ?? {}, asm: s.asm ?? {} },
+    state: { biz: s.biz, trade: s.trade, ans: s.ans, skip: s.skip ?? {}, asm: s.asm ?? {}, ...s.client && typeof s.client === "object" ? { client: s.client } : {} },
     computed: p.computed ?? null
   };
 }
@@ -22820,7 +22973,12 @@ function renderReport(opts) {
   out.push("<header>");
   if (agency.name) out.push('<p class="by">Prepared by ' + esc(agency.name) + "</p>");
   out.push("<h1>Where " + biz + " is leaking</h1>");
+  var who = state.client && state.client.name ? esc(state.client.name) + (state.client.role ? ", " + esc(state.client.role) : "") : "";
+  if (who) out.push('<p class="for">Prepared for ' + who + "</p>");
   if (date) out.push('<p class="when">' + esc(date) + "</p>");
+  if (agency.method || agency.promise) {
+    out.push('<p class="about">' + [agency.method, agency.promise].filter(Boolean).map(esc).join(" ") + "</p>");
+  }
   out.push("</header>");
   if (r.verdict === "insufficient") {
     out.push('<div class="verdict stop"><b>We could not put a number on this yet</b>' + esc(r.line || "") + "</div>");
@@ -22939,7 +23097,7 @@ function sourceLine(state, r, labels) {
 }
 function footer(agency) {
   if (!agency.name) return "";
-  return "<footer>" + esc(agency.name) + (agency.contact ? " &middot; " + esc(agency.contact) : "") + "</footer>";
+  return "<footer>" + esc(agency.name) + (agency.contact ? " &middot; " + esc(agency.contact) : "") + (agency.guarantee ? '<br><span class="guarantee">' + esc(agency.guarantee) + "</span>" : "") + "</footer>";
 }
 function css(accent) {
   return [
@@ -22951,6 +23109,9 @@ function css(accent) {
     ".by{font-size:.72rem;letter-spacing:.09em;text-transform:uppercase;color:var(--a);margin:0 0 .4rem;font-weight:600}",
     "h1{font-size:1.9rem;line-height:1.15;margin:0;font-weight:700}",
     ".when{color:var(--mut);font-size:.82rem;margin:.4rem 0 0}",
+    ".for{color:var(--ink);font-size:.95rem;margin:.5rem 0 0}",
+    ".about{color:var(--mut);font-size:.95rem;margin:.6rem 0 0;max-width:38rem}",
+    ".guarantee{color:var(--mut);font-size:.85rem}",
     "h2{font-size:1.15rem;margin:2rem 0 .5rem;font-weight:700}",
     "table{border-collapse:collapse;width:100%;margin:.6rem 0;font-size:.94rem}",
     "th,td{text-align:left;padding:.5rem .6rem;border-bottom:1px solid var(--rule);vertical-align:top}",
@@ -22988,7 +23149,7 @@ function today() {
   return (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
 }
 function normalise(s) {
-  return { biz: s.biz, trade: s.trade, ans: s.ans, skip: s.skip ?? {}, asm: s.asm ?? {} };
+  return { biz: s.biz, trade: s.trade, ans: s.ans, skip: s.skip ?? {}, asm: s.asm ?? {}, ...s.client ? { client: s.client } : {} };
 }
 function computedFor(state) {
   const r = compute(state.ans, state.skip, state.asm);
@@ -23004,9 +23165,11 @@ function computedFor(state) {
 async function createPipeline(client, locationId2) {
   try {
     await client.post("/opportunities/pipelines", {
-      locationId: locationId2,
-      name: PIPELINE_NAME,
-      stages: STAGES.map((name, position2) => ({ name, position: position2, showInFunnel: true, showInPieChart: true }))
+      body: {
+        locationId: locationId2,
+        name: PIPELINE_NAME,
+        stages: STAGES.map((name, position2) => ({ name, position: position2, showInFunnel: true, showInPieChart: true }))
+      }
     });
     return { ok: true };
   } catch (e) {
@@ -23045,6 +23208,87 @@ async function findStage(client, locationId2, stage, mayCreate = false) {
   }
   return { pipelineId: pipe.id, stageId: st.id, stageName: stage };
 }
+async function saveAssessment(client, locationId2, args) {
+  const state = normalise(args.assessment);
+  const computed = computedFor(state);
+  const stage = stageFor({ verdict: computed.verdict, proposalSent: args.proposalSent, outcome: args.outcome });
+  const { payload: contactBody, dedupable } = buildContact(state, stage, {
+    name: args.contactName,
+    email: args.email,
+    phone: args.phone
+  });
+  const upserted = await client.post("/contacts/upsert", {
+    body: { ...contactBody, locationId: locationId2 }
+  });
+  const contactId = upserted?.contact?.id ?? upserted?.id;
+  if (!contactId) {
+    return { saved: false, error: "GoHighLevel did not return a contact id, so nothing was written. Nothing partial was left behind." };
+  }
+  const bodies = buildNoteBodies(buildNote(state, computed, LOOKUP, today()));
+  const noteIds = [];
+  for (const body of bodies) {
+    const note = await client.post(`/contacts/${contactId}/notes`, { body: { body } });
+    const id = note?.note?.id ?? note?.id;
+    if (id) noteIds.push(id);
+  }
+  if (noteIds.length !== bodies.length) {
+    return {
+      saved: false,
+      contactId,
+      error: `the answer sheet needed ${bodies.length} note(s) and only ${noteIds.length} were written. A part-written record will NOT load \u2014 it refuses rather than returning half an assessment. Save again.`
+    };
+  }
+  const hit = await findStage(client, locationId2, stage, args.createPipeline === true);
+  const opp = buildOpportunity(state, computed, stage, args.proposalValue);
+  let opportunity = null;
+  let opportunityNote = null;
+  if ("error" in hit) {
+    opportunityNote = hit.error;
+  } else {
+    const body = {
+      locationId: locationId2,
+      contactId,
+      name: opp.name,
+      status: opp.status,
+      monetaryValue: opp.monetaryValue,
+      pipelineId: hit.pipelineId,
+      pipelineStageId: hit.stageId,
+      source: "Command OS assessment"
+    };
+    try {
+      opportunity = await client.post("/opportunities/", { body });
+    } catch (e) {
+      const raw = String(e?.message ?? e);
+      const existing = /OPPORTUNITY_NO_DUPLICATE/.test(raw) ? raw.match(/"existingId"\s*:\s*"([^"]+)"/)?.[1] : void 0;
+      if (!existing) throw e;
+      opportunity = await client.put(`/opportunities/${existing}`, {
+        body: {
+          name: opp.name,
+          status: opp.status,
+          monetaryValue: opp.monetaryValue,
+          pipelineId: hit.pipelineId,
+          pipelineStageId: hit.stageId
+        }
+      });
+      opportunityNote = `This business already had a deal on your Assessments board, so it was moved to "${stage}" and its value updated rather than a second one being created.`;
+    }
+  }
+  return {
+    saved: true,
+    contactId,
+    noteIds,
+    notesWritten: bodies.length,
+    stage,
+    tag: tagFor(stage),
+    verdict: computed.verdict,
+    monthly: Math.round(computed.monthly),
+    hoursPerWeek: Number(computed.hrsWk.toFixed(1)),
+    opportunity,
+    opportunityNote,
+    warning: dedupable ? null : "No email or phone was given, so this contact cannot be matched next time and a second assessment for the same business would create a second contact.",
+    whereItLives: `Contact ${contactId} in location ${locationId2}. Anyone on your team with a GoHighLevel login can open it.`
+  };
+}
 function registerAssessmentTools(server2, client) {
   safeTool(
     server2,
@@ -23061,88 +23305,7 @@ function registerAssessmentTools(server2, client) {
       proposalSent: import_zod62.z.boolean().optional(),
       createPipeline: import_zod62.z.boolean().optional().describe('Create the "Assessments" pipeline in your own GoHighLevel if it is not there yet. Off by default: it is a write to your account, so it is asked for rather than assumed. Say yes the first time and never again.')
     },
-    async (args) => {
-      const locationId2 = client.resolveLocationId(args.locationId);
-      const state = normalise(args.assessment);
-      const computed = computedFor(state);
-      const stage = stageFor({ verdict: computed.verdict, proposalSent: args.proposalSent, outcome: args.outcome });
-      const { payload: contactBody, dedupable } = buildContact(state, stage, {
-        name: args.contactName,
-        email: args.email,
-        phone: args.phone
-      });
-      const upserted = await client.post("/contacts/upsert", {
-        body: { ...contactBody, locationId: locationId2 }
-      });
-      const contactId = upserted?.contact?.id ?? upserted?.id;
-      if (!contactId) {
-        return { saved: false, error: "GoHighLevel did not return a contact id, so nothing was written. Nothing partial was left behind." };
-      }
-      const bodies = buildNoteBodies(buildNote(state, computed, LOOKUP, today()));
-      const noteIds = [];
-      for (const body of bodies) {
-        const note = await client.post(`/contacts/${contactId}/notes`, { body: { body } });
-        const id = note?.note?.id ?? note?.id;
-        if (id) noteIds.push(id);
-      }
-      if (noteIds.length !== bodies.length) {
-        return {
-          saved: false,
-          contactId,
-          error: `the answer sheet needed ${bodies.length} note(s) and only ${noteIds.length} were written. A part-written record will NOT load \u2014 it refuses rather than returning half an assessment. Save again.`
-        };
-      }
-      const hit = await findStage(client, locationId2, stage, args.createPipeline === true);
-      const opp = buildOpportunity(state, computed, stage, args.proposalValue);
-      let opportunity = null;
-      let opportunityNote = null;
-      if ("error" in hit) {
-        opportunityNote = hit.error;
-      } else {
-        const body = {
-          locationId: locationId2,
-          contactId,
-          name: opp.name,
-          status: opp.status,
-          monetaryValue: opp.monetaryValue,
-          pipelineId: hit.pipelineId,
-          pipelineStageId: hit.stageId,
-          source: "Command OS assessment"
-        };
-        try {
-          opportunity = await client.post("/opportunities/", { body });
-        } catch (e) {
-          const raw = String(e?.message ?? e);
-          const existing = /OPPORTUNITY_NO_DUPLICATE/.test(raw) ? raw.match(/"existingId"\s*:\s*"([^"]+)"/)?.[1] : void 0;
-          if (!existing) throw e;
-          opportunity = await client.put(`/opportunities/${existing}`, {
-            body: {
-              name: opp.name,
-              status: opp.status,
-              monetaryValue: opp.monetaryValue,
-              pipelineId: hit.pipelineId,
-              pipelineStageId: hit.stageId
-            }
-          });
-          opportunityNote = `This business already had a deal on your Assessments board, so it was moved to "${stage}" and its value updated rather than a second one being created.`;
-        }
-      }
-      return {
-        saved: true,
-        contactId,
-        noteIds,
-        notesWritten: bodies.length,
-        stage,
-        tag: tagFor(stage),
-        verdict: computed.verdict,
-        monthly: Math.round(computed.monthly),
-        hoursPerWeek: Number(computed.hrsWk.toFixed(1)),
-        opportunity,
-        opportunityNote,
-        warning: dedupable ? null : "No email or phone was given, so this contact cannot be matched next time and a second assessment for the same business would create a second contact.",
-        whereItLives: `Contact ${contactId} in location ${locationId2}. Anyone on your team with a GoHighLevel login can open it.`
-      };
-    }
+    async (args) => saveAssessment(client, client.resolveLocationId(args.locationId), args)
   );
   safeTool(
     server2,
@@ -23340,7 +23503,8 @@ var init_assessment = __esm({
       trade: import_zod62.z.string().optional().describe("Their trade. Decides which benchmarks may be applied."),
       ans: import_zod62.z.record(import_zod62.z.union([import_zod62.z.string(), import_zod62.z.number()])).describe("questionId -> answer, exactly as typed."),
       skip: import_zod62.z.record(import_zod62.z.boolean()).optional().describe("questionId -> true where they did not know."),
-      asm: import_zod62.z.record(import_zod62.z.number()).optional().describe("assumption id -> rate as a decimal.")
+      asm: import_zod62.z.record(import_zod62.z.number()).optional().describe("assumption id -> rate as a decimal."),
+      client: import_zod62.z.object({ name: import_zod62.z.string().max(120), role: import_zod62.z.string().max(80), email: import_zod62.z.string().max(200), phone: import_zod62.z.string().max(40), website: import_zod62.z.string().max(300), city: import_zod62.z.string().max(120) }).partial().optional().describe("The person and place this is for, as typed on The client step. Rides with the answers so a load brings it back.")
     });
   }
 });
@@ -24315,9 +24479,9 @@ function scanTags(html2) {
     if (!m[1]) {
       const raw = m[3];
       let a;
-      ATTR.lastIndex = 0;
-      while (a = ATTR.exec(raw)) {
-        if (a.index === ATTR.lastIndex) ATTR.lastIndex++;
+      ATTR2.lastIndex = 0;
+      while (a = ATTR2.exec(raw)) {
+        if (a.index === ATTR2.lastIndex) ATTR2.lastIndex++;
         const k = a[1].toLowerCase();
         if (k === "/") continue;
         attrs[k] = (a[2] ?? a[3] ?? a[4] ?? "").trim();
@@ -24420,13 +24584,13 @@ function lintDesignContract(html2, medium) {
     }
   };
 }
-var SLIDE_TYPES, ROLES, ATTR;
+var SLIDE_TYPES, ROLES, ATTR2;
 var init_lint = __esm({
   "src/command-os/design/lint.ts"() {
     "use strict";
     SLIDE_TYPES = ["title", "section", "content", "quote", "closing"];
     ROLES = ["headline", "body", "caption", "logo", "cta-primary", "cta-secondary", "nav", "eyebrow"];
-    ATTR = /([\w:.-]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+)))?/g;
+    ATTR2 = /([\w:.-]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+)))?/g;
   }
 });
 
@@ -24556,8 +24720,9 @@ function composeBrief(d, brief) {
   ];
   const chosenContract = conversionMode ? conversionContract : contract;
   const checklist = design.map((r) => `${r.id} ${r.name} \u2014 ${r.threshold}`);
-  const logoBlock = d.logo?.inlineSvg ? `Logo markup (use verbatim, colour via currentColor):
-${d.logo.inlineSvg.slice(0, 6e3)}` : d.logo?.dataUri ? `Logo markup: <img src="${d.logo.dataUri.slice(0, 40)}\u2026" alt="${d.name}" data-role="logo" data-media="semantic"> (the full data URI is in the brand file)` : 'No logo is stored for this brand; use the brand name set in the display face as a wordmark, data-role="logo".';
+  const cleanLogo = d.logo?.inlineSvg ? sanitizeSvgOrDrop(d.logo.inlineSvg) : void 0;
+  const logoBlock = cleanLogo ? `Logo markup (use verbatim, colour via currentColor):
+${cleanLogo.slice(0, 6e3)}` : d.logo?.dataUri ? `Logo markup: <img src="${d.logo.dataUri.slice(0, 40)}\u2026" alt="${d.name}" data-role="logo" data-media="semantic"> (the full data URI is in the brand file)` : 'No logo is stored for this brand; use the brand name set in the display face as a wordmark, data-role="logo".';
   const markdown = [
     `# Design brief \u2014 ${brief.medium} for ${d.name}`,
     "",
@@ -24610,6 +24775,7 @@ var init_brief = __esm({
     init_color();
     init_fonts();
     init_lint();
+    init_svg_sanitize();
   }
 });
 
@@ -26562,7 +26728,7 @@ function readAgencyBranding(base = appDataDir()) {
     const out = {};
     if (typeof st.agencyName === "string" && st.agencyName.trim()) out.agencyName = st.agencyName.trim();
     if (isHex(st.agencyAccent)) out.accent = st.agencyAccent;
-    if (typeof st.agencyLogoDataUri === "string" && st.agencyLogoDataUri.startsWith("data:image/")) out.logoDataUri = st.agencyLogoDataUri;
+    if (isRasterDataUri(st.agencyLogoDataUri)) out.logoDataUri = st.agencyLogoDataUri;
     return out;
   } catch {
     return {};
@@ -26572,7 +26738,7 @@ function resolveBranding(overrides = {}, base) {
   const saved = readAgencyBranding(base);
   const agencyName = overrides.agencyName?.trim() || saved.agencyName;
   const accent = isHex(overrides.accent) ? overrides.accent : saved.accent ?? DEFAULT_ACCENT;
-  const logoDataUri = overrides.logoDataUri ?? saved.logoDataUri;
+  const logoDataUri = isRasterDataUri(overrides.logoDataUri) ? overrides.logoDataUri : saved.logoDataUri;
   return { ...agencyName && { agencyName }, accent, ...logoDataUri && { logoDataUri } };
 }
 var import_node_fs2, import_node_path2, DEFAULT_ACCENT;
@@ -26582,6 +26748,7 @@ var init_branding = __esm({
     import_node_fs2 = require("node:fs");
     import_node_path2 = require("node:path");
     init_credentials_store();
+    init_svg_sanitize();
     DEFAULT_ACCENT = "#B8934A";
   }
 });
@@ -26631,7 +26798,7 @@ td.ev{font-family:ui-monospace,Menlo,monospace;font-size:12.5px;color:var(--mute
 .shots a{font-size:13px;color:var(--accent)}
 footer{margin-top:40px;color:var(--muted);font-size:13px;border-top:1px solid var(--line);padding-top:12px}
 </style></head><body><div class="wrap">
-<header><div>${b.logoDataUri ? `<img src="${b.logoDataUri}" alt="" style="height:28px;margin-bottom:8px">` : ""}<h1>Design check</h1><div class="agency">${b.agencyName ? esc2(b.agencyName) + " \xB7 " : ""}${esc2(v.medium)} \xB7 ${esc2(v.target)} \xB7 ${esc2(v.at.slice(0, 16).replace("T", " "))} \xB7 ${v.renderedWith === "browser" ? "rendered in a browser" : "static checks only"}</div></div><div class="verdict ${verdictClass}">${v.verdict === "PASS" ? "Passes every measured rule" : v.verdict === "FAIL" ? "Fails a measured rule" : "Not graded"}</div></header>
+<header><div>${isRasterDataUri(b.logoDataUri) ? `<img src="${esc2(b.logoDataUri)}" alt="" style="height:28px;margin-bottom:8px">` : ""}<h1>Design check</h1><div class="agency">${b.agencyName ? esc2(b.agencyName) + " \xB7 " : ""}${esc2(v.medium)} \xB7 ${esc2(v.target)} \xB7 ${esc2(v.at.slice(0, 16).replace("T", " "))} \xB7 ${v.renderedWith === "browser" ? "rendered in a browser" : "static checks only"}</div></div><div class="verdict ${verdictClass}">${v.verdict === "PASS" ? "Passes every measured rule" : v.verdict === "FAIL" ? "Fails a measured rule" : "Not graded"}</div></header>
 <p class="scope"><strong>What this report is not.</strong> Every rule here measures craft \u2014 type, spacing, colour, contrast, structure, performance, and the tells that make a page look machine-made. <strong>None of them measures whether the page persuades anyone.</strong> A page can pass every rule and still be boring, unconvincing and unsellable: no hook, no proof, no reason to care. Judge the writing separately, and never read a pass here as "this is a good page".</p>
 <div class="conf ${v.conformance.ok ? "ok" : ""}"><b>${v.conformance.ok ? "The file honours the output contract." : "The file breaks the output contract, so the design rules were not graded."}</b>${v.conformance.problems.length ? `<ul>${v.conformance.problems.map((p) => `<li>${esc2(p)}</li>`).join("")}</ul>` : ""}${v.conformance.warnings.length ? `<div class="det">Warnings: ${v.conformance.warnings.map(esc2).join(" \xB7 ")}</div>` : ""}</div>
 <div class="sum"><div><b>${s.measuredPass}</b><span>measured, pass</span></div><div><b>${s.measuredFail}</b><span>measured, fail</span></div><div><b>${s.proxyPass}</b><span>proxy, pass</span></div><div><b>${s.proxyFail}</b><span>proxy, fail</span></div><div><b>${s.asserted}</b><span>judgment calls</span></div><div><b>${s.na + s.unchecked}</b><span>not applicable / not checked</span></div></div>
@@ -26646,6 +26813,7 @@ var init_report2 = __esm({
   "src/command-os/design/report.ts"() {
     "use strict";
     init_branding();
+    init_svg_sanitize();
     esc2 = (s) => String(s ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
     STATE_LABEL = {
       "MEASURED-PASS": "Pass",
@@ -27428,8 +27596,14 @@ function registerDesignStudioTools(server2) {
         d.provenance.evidence["shape.radius"] = `set by ${stamp}`;
       }
       if (a.logoSvg) {
-        if (!/^\s*<svg[\s\S]*<\/svg>\s*$/i.test(a.logoSvg) || a.logoSvg.length > 6e4) throw new Error("logoSvg must be one <svg>\u2026</svg> under 60 KB. Nothing was changed.");
-        d.logo = { inlineSvg: a.logoSvg, whiteFillFixed: false, source: `set by ${stamp}`, rights: "declared" };
+        let clean;
+        try {
+          clean = sanitizeSvg(a.logoSvg);
+        } catch (e) {
+          throw new Error(`${e.message} Nothing was changed.`);
+        }
+        a.logoSvg = clean;
+        d.logo = { inlineSvg: clean, whiteFillFixed: false, source: `set by ${stamp}`, rights: "declared" };
         d.provenance.evidence["logo"] = `set by ${stamp}`;
       }
       if (a.tone) d.voice.tone = a.tone;
@@ -27655,6 +27829,7 @@ var init_design_studio = __esm({
     init_fonts();
     init_color();
     init_branding();
+    init_svg_sanitize();
     summarise2 = (d) => ({
       slug: d.slug,
       name: d.name,
@@ -28820,9 +28995,9 @@ function registerConnectorTools(server2) {
       links.push(...proposeClientLinks(result.customers, known, observedAt));
       const timeZone = readAgencyProfile()?.defaults?.timezone;
       const bridged = bridgeToEngagements(identities, links, observations, clients, { timeZone });
-      const nameOf = (t) => clients[t]?.clientName ?? t;
-      const owed = owedByClient(outstanding(result.invoices), identities, links, nameOf);
-      const abandoned = owedByClient(writtenOff(result.invoices), identities, links, nameOf);
+      const nameOf2 = (t) => clients[t]?.clientName ?? t;
+      const owed = owedByClient(outstanding(result.invoices), identities, links, nameOf2);
+      const abandoned = owedByClient(writtenOff(result.invoices), identities, links, nameOf2);
       const renewals = renewalsDue(result.subs);
       let written = 0;
       let created = 0;
@@ -28864,7 +29039,7 @@ function registerConnectorTools(server2) {
           stripeCustomerId: c.id,
           email: c.email ?? null,
           name: c.name ?? null,
-          looksLike: hits.length === 1 ? nameOf(hits[0]) : null,
+          looksLike: hits.length === 1 ? nameOf2(hits[0]) : null,
           looksLikeClientKey: hits.length === 1 ? hits[0] : null
         };
       });
@@ -33396,7 +33571,7 @@ function runStage(locationId2, stage, onEvent, opts = {}) {
   const permission = buildPermission(locationId2, { name: opts.name, approvedAt: opts.approvedAt });
   if (!permission.allowed) return Promise.reject(new Error(`Refused: ${permission.reason}`));
   const locationName = SANDBOX_ALLOWLIST[locationId2] || opts.name || locationId2;
-  const spec = STAGE_SPECS[stage];
+  const spec = opts.spec ?? STAGE_SPECS[stage];
   if (!spec) return Promise.reject(new Error(`Stage ${stage} is not powered yet.`));
   return new Promise((resolve11) => {
     void (async () => {
@@ -33736,6 +33911,7 @@ var init_handoff_pack = __esm({
     "use strict";
     init_report_tokens();
     import_zod69 = require("zod");
+    init_svg_sanitize();
     RunnerCheckSchema = import_zod69.z.object({
       name: import_zod69.z.string().min(1),
       state: import_zod69.z.enum(["CHECKED", "DONE_UNCHECKED"]),
@@ -34808,7 +34984,7 @@ function idFor(kind, what) {
   for (let i = 0; i < what.length; i++) h = h * 31 + what.charCodeAt(i) >>> 0;
   return `site-${kind}-${h.toString(36)}`;
 }
-function safeUrl2(u) {
+function safeUrl3(u) {
   const s = trim(u, 500);
   if (!s) return "";
   try {
@@ -34841,7 +35017,7 @@ function siteObservationsToFindings(input) {
       refused.push({ what: "(no description)", reason: "the observation said nothing" });
       continue;
     }
-    const evidence = (o.evidence ?? []).map((e) => ({ url: safeUrl2(e?.url), quote: trim(e?.quote, 300) })).filter((e) => e.url && e.quote);
+    const evidence = (o.evidence ?? []).map((e) => ({ url: safeUrl3(e?.url), quote: trim(e?.quote, 300) })).filter((e) => e.url && e.quote);
     if (o.kind === "present") {
       if (!evidence.length) {
         refused.push({ what, reason: "said the site does something, without quoting where" });
@@ -34865,7 +35041,7 @@ function siteObservationsToFindings(input) {
       }
     }
     if (o.kind === "absent") {
-      const checked = (o.checkedPages ?? []).map(safeUrl2).filter(Boolean);
+      const checked = (o.checkedPages ?? []).map(safeUrl3).filter(Boolean);
       if (!checked.length) {
         refused.push({ what, reason: "claimed something is missing without saying what was read \u2014 unverifiable, so it does not ship" });
         continue;
@@ -34884,7 +35060,7 @@ function siteObservationsToFindings(input) {
       remedy: remedyFor(kind),
       fix: "manual",
       minutes: kind === "contradiction" ? 15 : 30,
-      evidence: kind === "contradiction" ? evidence.map((e) => ({ tool: "website", detail: `"${e.quote}" \u2014 ${e.url}` })) : (o.checkedPages ?? []).map(safeUrl2).filter(Boolean).map((u) => ({ tool: "website", detail: `checked, not found: ${u}` }))
+      evidence: kind === "contradiction" ? evidence.map((e) => ({ tool: "website", detail: `"${e.quote}" \u2014 ${e.url}` })) : (o.checkedPages ?? []).map(safeUrl3).filter(Boolean).map((u) => ({ tool: "website", detail: `checked, not found: ${u}` }))
     });
   }
   return {
@@ -36123,8 +36299,22 @@ async function submitIntakeAnswers(client, locationId2, snapshot, answers, conta
     return { ok: false, unmapped, error: e instanceof Error ? e.message : String(e) };
   }
 }
+function escapeHtml2(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function intakeEmailHtml(to, formUrl, agencyName) {
+  if (!/^https:\/\/[^\s"'<>]+$/.test(formUrl)) throw new Error("the form link is not a web address");
+  return [
+    `<p>Hi ${escapeHtml2(to.firstName?.trim() || "there")},</p>`,
+    `<p>Before we build out your account, we need the details only you can give us. It takes about ten minutes, and you can stop and come back to it.</p>`,
+    `<p><a href="${escapeHtml2(formUrl)}"><strong>Open your onboarding questionnaire</strong></a></p>`,
+    `<p>Answer what you know. Anything you're unsure about, leave it and we'll cover it on our next call.</p>`,
+    `<p>${escapeHtml2(agencyName)}</p>`
+  ].join("");
+}
 async function emailIntakeLink(client, locationId2, to, formUrl, agencyName) {
   try {
+    const html2 = intakeEmailHtml(to, formUrl, agencyName);
     const found = await client.get("/contacts/", { params: { locationId: locationId2, query: to.email, limit: 5 } });
     let contactId = (found.contacts ?? []).find((c) => c.email?.toLowerCase() === to.email.toLowerCase())?.id;
     if (!contactId) {
@@ -36134,13 +36324,6 @@ async function emailIntakeLink(client, locationId2, to, formUrl, agencyName) {
       contactId = made.contact?.id;
     }
     if (!contactId) throw new Error("could not create a contact to email");
-    const html2 = [
-      `<p>Hi ${to.firstName || "there"},</p>`,
-      `<p>Before we build out your account, we need the details only you can give us. It takes about ten minutes, and you can stop and come back to it.</p>`,
-      `<p><a href="${formUrl}"><strong>Open your onboarding questionnaire</strong></a></p>`,
-      `<p>Answer what you know. Anything you're unsure about, leave it and we'll cover it on our next call.</p>`,
-      `<p>${agencyName}</p>`
-    ].join("");
     await client.post("/conversations/messages", {
       body: { type: "Email", contactId, emailTo: to.email, subject: "Your onboarding questionnaire", html: html2 }
     });
@@ -36165,9 +36348,14 @@ function prefillTools(source, recorderPatterns = []) {
   const deny = "Bash,Write,Edit,MultiEdit,NotebookEdit,Task";
   if (source.kind === "text") return { allow: "", deny: deny + ",WebFetch,WebSearch,Read,Glob,Grep" };
   if (source.kind === "url") return { allow: "WebFetch", deny: deny + ",WebSearch,Read,Glob,Grep" };
+  if (source.kind === "file") return { allow: "Read", deny: deny + ",WebFetch,WebSearch,Glob,Grep" };
   return { allow: recorderPatterns.join(","), deny: deny + ",Read,Glob,Grep" };
 }
 function sourcePreamble(source) {
+  if (source.kind === "file") {
+    return `Read the document at this exact path with the Read tool and use its contents as the material: ${source.path}
+It may be a PDF, a Word document or plain text (the file is "${source.name}"). If it cannot be read or is empty, say so \u2014 do not guess from the file name.`;
+  }
   if (source.kind === "url") {
     return `Fetch this and use it as the material: ${source.url}
 If it needs a login or returns nothing usable, say so \u2014 do not guess from the URL alone.`;
@@ -36204,7 +36392,7 @@ function prefillPromptForSource(labels, source) {
 ${body}` : body;
 }
 async function prefillFromSource(spawnClaude, labels, source, recorderPatterns = []) {
-  const empty = source.kind === "text" && !source.text.trim() || source.kind === "url" && !source.url.trim() || source.kind === "recorder" && !source.instruction.trim();
+  const empty = source.kind === "text" && !source.text.trim() || source.kind === "url" && !source.url.trim() || source.kind === "recorder" && !source.instruction.trim() || source.kind === "file" && !source.path.trim();
   if (empty) return { ok: false, answers: {}, unknown: labels, error: "nothing to read" };
   return runPrefill(() => spawnClaude(prefillPromptForSource(labels, source), prefillTools(source, recorderPatterns)), labels);
 }
@@ -38928,10 +39116,10 @@ async function executeBackbone(plan, deps, opts = {}) {
   }
   return { ok: true, idMap, built, manual, published, publishFailed, deferred, staff, templates, templatesUnverified, templatesFormatNote, calendarPending, refreshed, missingSteps, recipients };
 }
-async function buildSimple(objects, type, list2, create, nameOf, pollForNew, idMap, built) {
+async function buildSimple(objects, type, list2, create, nameOf2, pollForNew, idMap, built) {
   if (objects.length === 0) return null;
   for (const obj of objects) {
-    const name = nameOf(obj);
+    const name = nameOf2(obj);
     let existing;
     try {
       existing = await list2();
@@ -40938,6 +41126,340 @@ var init_intake_contact = __esm({
   }
 });
 
+// src/command-os/client-capabilities.ts
+function findArray(raw, key) {
+  if (Array.isArray(raw)) return raw;
+  if (!raw || typeof raw !== "object") return null;
+  const seen = /* @__PURE__ */ new Set();
+  const byKey = (o, depth) => {
+    if (!o || typeof o !== "object" || seen.has(o) || depth > 3) return null;
+    seen.add(o);
+    const r = o;
+    if (key && Array.isArray(r[key])) return r[key];
+    for (const v of Object.values(r)) {
+      const hit = byKey(v, depth + 1);
+      if (hit) return hit;
+    }
+    return null;
+  };
+  if (key) {
+    const hit = byKey(raw, 0);
+    if (hit) return hit;
+    const r = raw;
+    for (const env of ["data", "results"]) {
+      const inner = r[env];
+      if (Array.isArray(inner)) return inner;
+      if (inner && typeof inner === "object" && Array.isArray(inner[key])) return inner[key];
+    }
+    return null;
+  }
+  seen.clear();
+  const anyArray = (o, depth) => {
+    if (!o || typeof o !== "object" || seen.has(o) || depth > 2) return null;
+    seen.add(o);
+    for (const v of Object.values(o)) if (Array.isArray(v)) return v;
+    for (const v of Object.values(o)) {
+      const hit = anyArray(v, depth + 1);
+      if (hit) return hit;
+    }
+    return null;
+  };
+  return anyArray(raw, 0);
+}
+function capabilityByKey(key) {
+  return CAPABILITIES.find((c) => c.key === key);
+}
+function nameOf(item, field) {
+  if (!item || typeof item !== "object") return "";
+  const o = item;
+  for (const k of [field, "name", "title", "label", "agentName", "value", "phoneNumber"].filter(Boolean)) {
+    const v = o[k];
+    if (typeof v === "string" && v.trim()) return v.trim();
+    if (v && typeof v === "object" && typeof v.singular === "string") return String(v.singular);
+  }
+  return "";
+}
+var CAPABILITY_GROUPS, N, AI2, CAPABILITIES, NO_BUILD_BUTTON;
+var init_client_capabilities = __esm({
+  "src/command-os/client-capabilities.ts"() {
+    "use strict";
+    CAPABILITY_GROUPS = [
+      { key: "setup", label: "Set up", blurb: "The bones of the account: who, where, what it sells and where people book." },
+      { key: "messaging", label: "Messaging and automation", blurb: "What runs on its own once a lead arrives, and what goes out to the whole list." },
+      { key: "ai", label: "AI employee", blurb: "The bot that answers texts, the agent that answers calls, and the demo you show a prospect." },
+      { key: "money", label: "Money and paperwork", blurb: "Getting paid and getting it signed." },
+      { key: "reputation", label: "Reputation and content", blurb: "Reviews, social posts and the blog." },
+      { key: "health", label: "Health and handoff", blurb: "Proving it works, keeping it clean, and handing it over." }
+    ];
+    N = (label, path36, params, key, nameField, version) => ({ label, path: path36, params, key, nameField, version });
+    AI2 = "2021-04-15";
+    CAPABILITIES = [
+      // ── Set up ──────────────────────────────────────────────────────────────
+      {
+        key: "intake",
+        group: "setup",
+        label: "Intake and documents",
+        what: "What the client told you, in one place: the intake answers, and the documents and links they sent.",
+        says: "Show me {client}'s intake answers and what is still unanswered.",
+        hub: "guides/blueprint-build-a-client-account.html",
+        reads: [N("forms on the account", "/forms/", { locationId: "{loc}", limit: "100" }, "forms", "name")],
+        blueprint: "The Blueprint intake form and its answers. Document and link uploads are the next build."
+      },
+      {
+        key: "pipelines",
+        group: "setup",
+        label: "Pipelines and stages",
+        what: "The board every lead moves across, from first contact to paid, with a stage for each step the client actually takes.",
+        says: "Stand up a pipeline for {client} with the stages a new lead moves through, from first contact to paid.",
+        hub: "guides/stand-up-a-pipeline.html",
+        reads: [N("pipelines", "/opportunities/pipelines", { locationId: "{loc}" }, "pipelines", "name")],
+        blueprint: "One pipeline, Patient Journey or the industry's equivalent, with seven stages."
+      },
+      {
+        key: "calendars",
+        group: "setup",
+        label: "Calendars and booking",
+        what: "Where people book: the calendar, its hours, who gets the appointment, and the reminders around it.",
+        says: "Set up a booking calendar for {client}: consultation, 30 minutes, weekdays 9 to 5, round robin across the staff.",
+        hub: "guides/set-up-a-booking-calendar.html",
+        reads: [N("calendars", "/calendars/", { locationId: "{loc}" }, "calendars", "name")],
+        blueprint: "One consultation calendar, round robin, 30-minute slots, pointed at the staff from the brief."
+      },
+      {
+        key: "forms",
+        group: "setup",
+        label: "Forms and surveys",
+        what: "The questions a lead answers before anyone calls them, and where those answers land.",
+        says: "Build an intake form for {client} that asks for name, email, phone and what they are interested in, and show me where the answers land.",
+        hub: "guides/create-forms-and-read-submissions.html",
+        reads: [N("forms", "/forms/", { locationId: "{loc}", limit: "100" }, "forms", "name"), N("surveys", "/surveys/", { locationId: "{loc}", limit: "100" }, "surveys", "name")],
+        blueprint: "One New Client Inquiry form, wired to the intake funnel."
+      },
+      {
+        key: "pages",
+        group: "setup",
+        label: "Pages and funnels",
+        what: "The website, the landing page and the funnel a lead lands on. Brands is only the shelf; this is where a page gets built.",
+        says: "Build {client} a landing page for their main offer using their brand from the shelf, with a booking button that opens their calendar. Show me the draft before it goes live.",
+        hub: "guides/page-studio-pages-and-sites.html",
+        reads: [N("funnels", "/funnels/funnel/list", { locationId: "{loc}", limit: "50" }, "funnels", "name")],
+        blueprint: "One intake funnel with the inquiry form on it. Full sites and offer pages are built here, one at a time."
+      },
+      {
+        key: "fields",
+        group: "setup",
+        label: "Fields, values and tags",
+        what: "The custom fields the account records, the values every message reads from, and the tags that move people between sequences.",
+        says: "Show me {client}'s custom fields, custom values and tags, and add the ones the build needs.",
+        hub: "guides/custom-fields-and-objects.html",
+        reads: [
+          N("custom fields", "/locations/{loc}/customFields", void 0, "customFields", "name"),
+          N("custom values", "/locations/{loc}/customValues", void 0, "customValues", "name"),
+          N("tags", "/locations/{loc}/tags", void 0, "tags", "name")
+        ],
+        blueprint: "Six fields, four custom values and 24 tags, including the hand-off tags the sequences use."
+      },
+      {
+        key: "staff",
+        group: "setup",
+        label: "Staff and users",
+        what: "Who works in the account, what each one may see, and who gets the alerts and the appointments.",
+        says: "Show me the staff on {client}'s account and who is assigned to the calendar and the alerts.",
+        hub: "guides/account-admin-basics.html",
+        reads: [N("users", "/users/", { locationId: "{loc}" }, "users", "name")],
+        blueprint: "One user per staff member in the brief, added in GoHighLevel's own screen because the API refuses to create them."
+      },
+      {
+        key: "phone",
+        group: "setup",
+        label: "Phone numbers and A2P",
+        what: "The number the account texts and calls from, and the registration without which no text is delivered.",
+        says: "Show me {client}'s phone numbers and whether A2P registration is done, and what is left to do by hand.",
+        hub: "guides/account-admin-basics.html",
+        reads: [N("phone numbers", "/phone-system/numbers/", { locationId: "{loc}" }, "phoneNumbers", "title")],
+        blueprint: "Nothing. Numbers and A2P are bought and registered by hand in GoHighLevel; the build checks they exist."
+      },
+      // ── Messaging and automation ────────────────────────────────────────────
+      {
+        key: "workflows",
+        group: "messaging",
+        label: "Workflows and automations",
+        what: "What happens on its own when a lead arrives, books, goes quiet or replies: speed to lead, missed-call text-back, nurture, reminders, no-show rescue.",
+        says: "Show me {client}'s workflows and which of the standard eight are missing, then build the missing ones as drafts for my review.",
+        hub: "guides/speed-to-lead.html",
+        reads: [N("workflows", "/workflows/", { locationId: "{loc}" }, "workflows", "name")],
+        blueprint: "Eight workflows: Speed to Lead, Lead Nurture, Win-back, Replied Stop and Route, Missed Call Text-Back, Confirm and Move, Reminders, No-Show Rescue."
+      },
+      {
+        key: "reactivation",
+        group: "messaging",
+        label: "Reactivation campaigns",
+        what: "Bringing a cold list back: one reason to return per message, over a month, to everyone who went quiet.",
+        says: "Build a reactivation campaign for {client}: find everyone who has not booked in 90 days and run the win-back sequence on them, as a draft first.",
+        hub: "guides/win-back-a-cold-list.html",
+        reads: [N("workflows", "/workflows/", { locationId: "{loc}" }, "workflows", "name"), N("campaigns", "/campaigns/", { locationId: "{loc}" }, "campaigns", "name")],
+        blueprint: "The Win-back sequence, five touches over 31 days, started by the winback-start tag."
+      },
+      {
+        key: "templates",
+        group: "messaging",
+        label: "Email and SMS templates",
+        what: "The messages themselves, written once in the client's voice and reused by every workflow and broadcast.",
+        says: "Show me {client}'s email and text templates, and write the ones the sequences still need in their voice.",
+        hub: "guides/build-email-templates.html",
+        reads: [N("email templates", "/emails/builder", { locationId: "{loc}", limit: "100" }, "builders", "name")],
+        blueprint: "Fifteen emails and seventeen texts, send-ready, one copy guide."
+      },
+      {
+        key: "broadcasts",
+        group: "messaging",
+        label: "Broadcasts and email campaigns",
+        what: "One message to a whole list, now or scheduled: an offer, an event, a newsletter.",
+        says: "Draft an email to {client}'s list about their next event and show it to me. Do not send or schedule anything; I do that.",
+        hub: "guides/send-texts-and-emails.html",
+        reads: [N("scheduled emails", "/emails/schedule", { locationId: "{loc}", limit: "50" }, "schedules", "name"), N("email templates", "/emails/builder", { locationId: "{loc}", limit: "100" }, "builders", "name")]
+      },
+      // ── AI employee ─────────────────────────────────────────────────────────
+      {
+        key: "conversation-ai",
+        group: "ai",
+        label: "Conversation AI",
+        what: "GoHighLevel's name for the bot that answers texts and chats from the client's own website and written answers.",
+        says: "Build {client} a Conversation AI bot: read their website into a knowledge base, build the bot in suggestive mode, and show me its first answers.",
+        hub: "command-os/ai-employee.html",
+        reads: [
+          N("knowledge bases", "/knowledge-bases/", { locationId: "{loc}", limit: "50" }, "knowledgeBases", "name", AI2),
+          N("bots", "/conversation-ai/agents/search", { limit: "50" }, "agents", "name", AI2)
+        ]
+      },
+      {
+        key: "voice-ai",
+        group: "ai",
+        label: "Voice AI",
+        what: "GoHighLevel's name for the agent that answers the phone. Built without a number, given one on purpose, proven by the transcript.",
+        says: "Check whether a call can land on {client}'s account, then build a Voice AI agent that answers, books and takes a message. Leave it unbound until I say.",
+        hub: "modules/11-your-ai-employee/lesson-05-the-phone-agent.html",
+        reads: [N("phone agents", "/voice-ai/agents", { locationId: "{loc}", page: "1", pageSize: "50" }, "agents", "agentName", AI2), N("phone numbers", "/phone-system/numbers/", { locationId: "{loc}" }, "phoneNumbers", "title")]
+      },
+      {
+        key: "demo",
+        group: "ai",
+        label: "Prospect demo",
+        what: "One sentence about a prospect's business becomes a bot they can text, on your own demo account, and one command puts it back. It messages a real prospect, so it runs from your own Claude with you watching, never from a button.",
+        says: "Prepare an AI employee demo for {client} from their website and arm it so they can text it.",
+        hub: "modules/11-your-ai-employee/lesson-04-the-five-minute-demo.html",
+        reads: []
+      },
+      // ── Money and paperwork ─────────────────────────────────────────────────
+      {
+        key: "payments",
+        group: "money",
+        label: "Products, invoices and payments",
+        what: "What the client sells, the invoices that ask for it, and the payments that came in.",
+        says: "Show me {client}'s products and open invoices, and set up the three packages with payment links.",
+        hub: "guides/invoices-and-payments.html",
+        reads: [N("products", "/products/", { locationId: "{loc}", limit: "100" }, "products", "name"), N("invoices", "/invoices/", { altId: "{loc}", altType: "location", limit: "50", offset: "0" }, "invoices", "name")]
+      },
+      {
+        key: "documents",
+        group: "money",
+        label: "Documents and signatures",
+        what: "The templates a new patient agreement or a proposal is made from.",
+        says: "Show me {client}'s document templates and tell me what a new patient agreement from the template would say. I press send.",
+        hub: "guides/documents-and-contracts.html",
+        reads: [N("document templates", "/proposals/templates", { locationId: "{loc}", limit: "50" }, "data", "name")]
+      },
+      {
+        key: "memberships",
+        group: "money",
+        label: "Memberships and courses",
+        what: "Courses, memberships and the content behind a paywall.",
+        says: "Set up a members area for {client} with their program as a course, and show me the offer page.",
+        hub: "guides/courses-and-memberships.html",
+        reads: []
+      },
+      // ── Reputation and content ──────────────────────────────────────────────
+      {
+        key: "reviews",
+        group: "reputation",
+        label: "Reviews",
+        what: "Asking for reviews at the right moment, and watching the ones that arrive.",
+        says: "Show me {client}'s latest reviews and set up a review request after every completed appointment.",
+        hub: "guides/watch-your-reviews.html",
+        reads: []
+      },
+      {
+        key: "social",
+        group: "reputation",
+        label: "Social posting",
+        what: "Posts scheduled to the client's connected social accounts.",
+        says: "Show me which social accounts {client} has connected, then write this week's posts for me to review. Nothing is posted until I say.",
+        hub: "guides/social-posting.html",
+        reads: [N("connected social accounts", "/social-media-posting/{loc}/accounts", void 0, "accounts", "name")]
+      },
+      {
+        key: "blogs",
+        group: "reputation",
+        label: "Blogs",
+        what: "The client's blog and its posts.",
+        says: "Show me {client}'s blogs and draft a post on their most asked question.",
+        hub: "guides/social-posting.html",
+        reads: [N("blogs", "/blogs/site/all", { locationId: "{loc}", limit: "50" }, "data", "name")]
+      },
+      // ── Health and handoff ──────────────────────────────────────────────────
+      {
+        key: "checkup",
+        group: "health",
+        label: "Checkup and audit",
+        what: "Whether the account works the way a lead would meet it, and whether every workflow can still be saved.",
+        says: "Run a checkup on {client}'s account and audit every workflow, then tell me what is broken before the client finds it.",
+        hub: "guides/run-a-checkup.html",
+        reads: [N("workflows", "/workflows/", { locationId: "{loc}" }, "workflows", "name")],
+        blueprint: "The Verify stage runs this after every build."
+      },
+      {
+        key: "contacts",
+        group: "health",
+        label: "Contacts and data cleanup",
+        what: "The people in the account, the duplicates, the tags, and the lists you report from.",
+        says: "Show me how many contacts {client} has, find the duplicates, and tag everyone who has not booked in 90 days.",
+        hub: "guides/bulk-tag-and-clean-up.html",
+        reads: [N("tags", "/locations/{loc}/tags", void 0, "tags", "name")]
+      },
+      {
+        key: "integrations",
+        group: "health",
+        label: "Integrations and webhooks",
+        what: "Sending the account's data to other apps, tracked links, and custom objects.",
+        says: "Set up a webhook so every new {client} lead lands in their spreadsheet, and give me a tracked link for the ad.",
+        hub: "guides/send-data-to-other-apps.html",
+        reads: [N("trigger links", "/links/", { locationId: "{loc}" }, "links", "name"), N("custom objects", "/objects/", { locationId: "{loc}" }, "objects", "labels")]
+      },
+      {
+        key: "handoff",
+        group: "health",
+        label: "Go-live and handoff",
+        what: "The final sign-off, the handoff page the client receives, and the snapshot that lets the build be reused.",
+        says: "Build {client}'s handoff page and the offboarding kit, and tell me what is still waiting on someone else.",
+        hub: "guides/snapshots-and-reusing-a-build.html",
+        reads: [],
+        blueprint: "Stage 7, Go-live, ends with the handoff page."
+      }
+    ];
+    NO_BUILD_BUTTON = /* @__PURE__ */ new Set(["demo", "documents", "social"]);
+  }
+});
+
+// src/command-os/script-json.ts
+function scriptJson(value) {
+  return JSON.stringify(value === void 0 ? null : value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/&/g, "\\u0026").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+var init_script_json = __esm({
+  "src/command-os/script-json.ts"() {
+    "use strict";
+  }
+});
+
 // src/command-os/cockpit-shell.ts
 function cockpitTokensCss(opts = {}) {
   const webfont = opts.webfont !== false;
@@ -41020,21 +41542,74 @@ function cockpitChromeCss() {
   .stepper button:disabled{opacity:.35;cursor:default}
   .stepper output{font-size:var(--fs-label);min-width:2.6rem;text-align:center;color:var(--ink-2)}
   footer{color:var(--ink-3);font-size:var(--fs-sm);text-align:center;margin:2rem 0;padding:0 1rem}
-  @media (max-width: 52rem){.brand-sub,.localpill{display:none}}
+  /* \u2500\u2500 The two-column shell: the hub's sidebar, ported (hub.css .side) \u2500\u2500 */
+  .shell{display:flex;align-items:stretch;min-height:calc(100vh - 3rem)}
+  .side{width:13.5rem;flex:none;box-sizing:border-box;background:var(--navy-deep);color:rgba(250,247,242,.74);padding:1rem .6rem 3rem;position:sticky;top:3rem;height:calc(100vh - 3rem);overflow-y:auto}
+  .side-group{margin-bottom:1rem}
+  .side-label{font-size:var(--fs-label);font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:rgba(250,247,242,.42);padding:.3rem .7rem}
+  .side a,.side .active{display:flex;align-items:center;gap:.55rem;padding:.42rem .7rem;border-radius:.45rem;color:rgba(250,247,242,.78);font-size:var(--fs-sm);font-weight:500;text-decoration:none}
+  .side a:hover{background:rgba(255,255,255,.08);color:#FAF7F2;text-decoration:none}
+  .side .active{background:rgba(255,255,255,.09);color:#FAF7F2;box-shadow:inset .18rem 0 0 var(--gold-light)}
+  .side .tag{margin-left:auto;font-size:var(--fs-label);font-weight:500;color:rgba(250,247,242,.5);white-space:nowrap}
+  .side .tag.soon{color:#CEAB6A}
+  .side .side-client{display:block;text-transform:none;letter-spacing:0;font-weight:500;color:#CEAB6A;margin-top:.15rem}
+  .side a.sub,.side .active.sub{padding-left:1.5rem;font-size:var(--fs-label);font-weight:500}
+  .side .active.grp{box-shadow:none;background:none;color:#FAF7F2}
+  .side-foot{margin-top:.6rem;padding:.7rem .7rem;border-top:1px solid rgba(255,255,255,.09);font-size:var(--fs-label);color:rgba(250,247,242,.45);line-height:1.5;display:flex;flex-direction:column;gap:.3rem}
+  .side-foot a{display:inline;padding:0;color:rgba(250,247,242,.78)}
+  .content{flex:1;min-width:0}
+  .topbar .screens{display:none}
+  @media (max-width: 52rem){.brand-sub,.localpill{display:none}.side{display:none}.topbar .screens{display:flex;align-items:center;gap:.4rem}}
 `;
 }
-function cockpitHeaderHtml(active) {
+function forThisClientHtml(capability) {
+  const current = capability ? CAPABILITIES.find((c) => c.key === capability) : void 0;
+  const rows = CAPABILITY_GROUPS.map((g) => {
+    const caps = CAPABILITIES.filter((c) => c.group === g.key);
+    const first = caps[0];
+    const open = current?.group === g.key;
+    const head3 = open ? `<span class="active grp" aria-current="true">${g.label}</span>` : `<a class="grp" href="/for/${first?.key ?? ""}" title="${g.blurb}">${g.label}</a>`;
+    const subs = open ? caps.map((c) => c.key === capability ? `<span class="active sub" aria-current="page">${c.label}</span>` : `<a class="sub" href="/for/${c.key}" title="${c.what.replace(/"/g, "&quot;")}">${c.label}</a>`).join("\n        ") : "";
+    return head3 + (subs ? "\n        " + subs : "");
+  }).join("\n        ");
+  return `<div class="side-group"><div class="side-label">For this client <span id="side-client" class="side-client"></span></div>
+        ${rows}
+      </div>`;
+}
+function cockpitSidebarHtml(active, capability) {
+  const groups = SIDEBAR.map(([label, rows]) => {
+    const links = rows.map((r) => {
+      const tag = r.note ? `<span class="tag soon">${r.note}</span>` : r.hub ? `<span class="tag">hub &nearr;</span>` : "";
+      return r.screen === active ? `<span class="active" aria-current="page">${r.label}</span>` : `<a href="${r.href}"${r.title ? ` title="${r.title}"` : ""}${r.hub ? ' target="_blank" rel="noopener"' : ""}>${r.label}${tag}</a>`;
+    }).join("\n        ");
+    return `<div class="side-group"><div class="side-label">${label}</div>
+        ${links}
+      </div>`;
+  }).join("\n      ");
+  return `<aside class="side" aria-label="Command OS">
+      ${groups}
+      ${forThisClientHtml(capability)}
+      <div class="side-foot"><a href="${HUB_URL}#do">&larr; Back to hub</a><span>Runs on this computer. What you type stays here. What Claude reads for you goes to your own Claude account; a link or a call recording is fetched from its own site or recorder first. No copy comes to us.</span></div>
+    </aside>`;
+}
+function cockpitHeaderHtml(active, opts = {}) {
   const links = NAV.filter((n) => n.key !== active).map((n) => `<a class="backhub" href="${n.href}" title="${n.title}">${n.label}</a>`).join("");
   const here = NAV.find((n) => n.key === active);
   return `<header class="topbar">
   <a class="brand" href="${HUB_URL}#do" title="Back to the member hub"><span class="brand-mark">G</span><span><span class="brand-name">GHL Command</span><span class="brand-sub">&nbsp; Command OS</span></span></a>
   <a class="backhub" href="${HUB_URL}#do">&larr; Back to hub</a>
   <div class="topbar-right">
-    ${here ? `<span class="backhub" aria-current="page">${here.label}</span>` : ""}${links}
+    <span class="screens">${here ? `<span class="backhub" aria-current="page">${here.label}</span>` : ""}${links}</span>
     <span class="localpill">Runs on this computer</span>
     <div class="stepper" role="group" aria-label="Type size"><button id="sz-down" type="button" aria-label="Smaller type">A&minus;</button><output id="sz-val" aria-live="polite">${TYPE_DEFAULT}px</output><button id="sz-up" type="button" aria-label="Larger type">A+</button></div>
   </div>
-</header>`;
+</header>
+<div class="shell">
+${cockpitSidebarHtml(active, opts.capability)}
+<div class="content">`;
+}
+function cockpitShellClose() {
+  return `</div></div>`;
 }
 function cockpitHeadHtml(title2, opts = {}) {
   const fonts = opts.webfont === false ? "" : COCKPIT_FONT_LINKS;
@@ -41042,10 +41617,12 @@ function cockpitHeadHtml(title2, opts = {}) {
 ${fonts}
 <style>${cockpitTokensCss(opts)}${cockpitChromeCss()}${opts.extraCss ?? ""}</style></head>`;
 }
-var HUB_URL, COCKPIT_FONT_LINKS, TYPE_MIN, TYPE_MAX, TYPE_DEFAULT, TYPE_STORAGE_KEY, NAV, COCKPIT_TYPE_JS;
+var HUB_URL, COCKPIT_FONT_LINKS, TYPE_MIN, TYPE_MAX, TYPE_DEFAULT, TYPE_STORAGE_KEY, NAV, SIDEBAR, COCKPIT_TYPE_JS;
 var init_cockpit_shell = __esm({
   "src/command-os/cockpit-shell.ts"() {
     "use strict";
+    init_client_capabilities();
+    init_script_json();
     HUB_URL = "https://os.ghlcommand.com/";
     COCKPIT_FONT_LINKS = `<link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin><link href="https://fonts.googleapis.com/css2?family=DM+Sans:opsz,wght@9..40,400;9..40,500;9..40,600;9..40,700&family=Playfair+Display:ital,wght@0,400;0,500;0,600;1,400&display=swap" rel="stylesheet">`;
     TYPE_MIN = 20;
@@ -41053,13 +41630,28 @@ var init_cockpit_shell = __esm({
     TYPE_DEFAULT = 22;
     TYPE_STORAGE_KEY = "cmdos-cockpit-fs";
     NAV = [
-      { key: "board", href: "/", label: "Board", title: "Every client account and where its build stands" },
-      { key: "agency", href: "/agency", label: "Your agency", title: "Your agency's own details, used on every client" },
-      { key: "brands", href: "/brands", label: "Brands", title: "Brands: pull a client's brand from their site, or start from a reference look" },
-      { key: "assessment", href: "/assessment", label: "Assessment", title: "Run the paid assessment on a prospect. Everything stays on this computer." }
+      { key: "board", href: "/", label: "Board", title: "What is waiting on you, and every client account" },
+      { key: "agency", href: "/agency", label: "Your agency", title: "Your agency's own details, set up once and used on every client" },
+      { key: "assessment", href: "/assessment", label: "Assessment", title: "Run the paid assessment on a prospect. The answers stay on this computer until you save them to your own GoHighLevel account." },
+      { key: "brands", href: "/brands", label: "Brands", title: "The shelf every deck, page and report starts from" }
+    ];
+    SIDEBAR = [
+      ["Start", [
+        { label: "Board", href: "/", screen: "board", title: NAV[0].title },
+        { label: "Your agency", href: "/agency", screen: "agency", title: NAV[1].title }
+      ]],
+      ["Clients", [
+        { label: "Assessment", href: "/assessment", screen: "assessment", title: NAV[2].title },
+        { label: "Build a Client Account", href: "/new", screen: "new", title: "Register the account, answer the intake, then run the seven stages" },
+        { label: "Work Queue", href: "/queue", screen: "queue", title: "The steps waiting on you, across every client" },
+        { label: "Client Builds", href: "/clients", screen: "clients", title: "Every client account and where its build stands" }
+      ]],
+      ["Design Studio", [
+        { label: "Brands", href: "/brands", screen: "brands", title: NAV[3].title }
+      ]]
     ];
     COCKPIT_TYPE_JS = `/* Type size stepper \u2014 same behaviour as the hub (${TYPE_MIN}\u2013${TYPE_MAX}px, remembered). */
-(function(){var MIN=${TYPE_MIN},MAX=${TYPE_MAX},STEP=2,DEF=${TYPE_DEFAULT},KEY=${JSON.stringify(TYPE_STORAGE_KEY)};
+(function(){var MIN=${TYPE_MIN},MAX=${TYPE_MAX},STEP=2,DEF=${TYPE_DEFAULT},KEY=${scriptJson(TYPE_STORAGE_KEY)};
  var down=document.getElementById("sz-down"),up=document.getElementById("sz-up"),val=document.getElementById("sz-val");
  if(!down||!up||!val)return;
  var size=DEF;try{var s=parseInt(localStorage.getItem(KEY),10);if(s>=MIN&&s<=MAX)size=s}catch(e){}
@@ -41073,6 +41665,8 @@ var init_cockpit_shell = __esm({
 // src/agency-profile-page.ts
 function agencyProfilePageHtml(p, clients = [], seatToken = "") {
   const offers = (p.offers ?? []).map((o) => `${o.name}${o.priceFloor ? ` \u2014 ${o.priceFloor}${o.cadence === "monthly" ? "/mo" : ""}` : ""}`).join("\n");
+  const os7 = p.agencyOs ?? {};
+  const lines = (xs) => (xs ?? []).join("\n");
   const sops = (p.delivery?.sops ?? []).join("\n");
   const staff = (p.staff ?? []).map((m) => [m.name, m.role, m.email].filter(Boolean).join(" \xB7 ")).join("\n");
   const clientBlocks = clients.map((c) => {
@@ -41139,21 +41733,21 @@ ${cockpitHeaderHtml("agency")}
  <form id="f">
   <fieldset><legend>Brand</legend>
    <label for="agencyName">Agency name, as clients see it</label>
-   <input id="agencyName" name="agencyName" value="${esc3(p.agencyName)}" placeholder="Elite DCs">
+   <input id="agencyName" name="agencyName" value="${esc3(p.agencyName)}" placeholder="Your Agency">
    <div class="row">
     <div><label for="accent">Brand colour</label><input type="color" id="accent" name="accent" value="${esc3(p.accent || "#b8934a")}"></div>
-    <div><label for="website">Website</label><input id="website" name="website" value="${esc3(p.website)}" placeholder="https://elitedcs.com"></div>
+    <div><label for="website">Website</label><input id="website" name="website" value="${esc3(p.website)}" placeholder="https://youragency.com"></div>
    </div>
    <label for="logoUrl">Logo URL</label>
-   <input id="logoUrl" name="logoUrl" value="${esc3(p.logoUrl)}" placeholder="https://elitedcs.com/logo.svg">
+   <input id="logoUrl" name="logoUrl" value="${esc3(p.logoUrl)}" placeholder="https://youragency.com/logo.svg">
    <p class="hint">Must start with https. A logo link that isn't https is refused, because this one goes on pages your prospects open.</p>
    <label for="legalName">Registered entity, if different</label>
-   <input id="legalName" name="legalName" value="${esc3(p.legalName)}" placeholder="Elite DCS LLC \u2014 used on contracts and A2P">
+   <input id="legalName" name="legalName" value="${esc3(p.legalName)}" placeholder="Your Agency LLC \u2014 used on contracts and A2P">
   </fieldset>
 
   <fieldset><legend>Who messages come from</legend>
    <div class="row">
-    <div><label for="fromName">From name</label><input id="fromName" name="fromName" value="${esc3(p.sender?.fromName)}" placeholder="Dr Jerry Relth"></div>
+    <div><label for="fromName">From name</label><input id="fromName" name="fromName" value="${esc3(p.sender?.fromName)}" placeholder="Dr Pat Owner"></div>
     <div><label for="replyTo">Reply-to email</label><input id="replyTo" name="replyTo" value="${esc3(p.sender?.replyTo)}"></div>
     <div><label for="phone">Phone</label><input id="phone" name="phone" value="${esc3(p.sender?.phone)}"></div>
    </div>
@@ -41171,11 +41765,61 @@ ${cockpitHeaderHtml("agency")}
    <p class="hint">The floors are the numbers below which you don't take the work. Anything quoting a price checks them first.</p>
   </fieldset>
 
+  <fieldset><legend>Brand DNA \u2014 who you are (Agency OS build 1)</legend>
+   <p class="hint">Filled in once, in your own words. Used on the assessment report, in proposals, in every Claude session's opening brief, and by the Agency OS builds.</p>
+   <label for="story">Your story \u2014 why this agency exists, in two or three sentences</label>
+   <textarea id="story" name="story" placeholder="I ran a clinic for twelve years and watched good practices lose patients to voicemail\u2026">${esc3(os7.story)}</textarea>
+   <label for="method">Your method \u2014 how you get results, and what you call it</label>
+   <textarea id="method" name="method" placeholder="The Full Room method: one weekend, a full calendar, a system that keeps booking after we leave">${esc3(os7.method)}</textarea>
+   <div class="two">
+    <div><label for="voice">How you sound \u2014 three words, then a sentence</label><textarea id="voice" name="voice" placeholder="Direct, warm, clinical. Specifics over hype.">${esc3(os7.voice)}</textarea></div>
+    <div><label for="goals">Your goal for the next twelve months</label><textarea id="goals" name="goals" placeholder="$50k a month from 51 subscribers">${esc3(os7.goals)}</textarea></div>
+   </div>
+   <label for="values">What you stand for and what you refuse to do \u2014 one per line</label>
+   <textarea id="values" name="values" placeholder="Never a false all-clear&#10;No cold texting anyone who did not opt in">${esc3(lines(os7.values))}</textarea>
+   <label for="proof">Proof you may state, with permission \u2014 one per line</label>
+   <textarea id="proof" name="proof" placeholder="Radiance Med Spa: 34 consults booked in one weekend (permission on file)">${esc3(lines(os7.proof))}</textarea>
+  </fieldset>
+
+  <fieldset><legend>Ideal client \u2014 who you serve (build 2)</legend>
+   <label for="icaWho">Who they are \u2014 role, business, size, where</label>
+   <textarea id="icaWho" name="icaWho" placeholder="The owner of a two-provider med spa in a mid-size US city, doing $40k a month and answering the phone herself">${esc3(os7.ica?.who)}</textarea>
+   <div class="two">
+    <div><label for="icaPains">Their pains, worst first \u2014 one per line</label><textarea id="icaPains" name="icaPains">${esc3(lines(os7.ica?.pains))}</textarea></div>
+    <div><label for="icaDesires">What they want, most first \u2014 one per line</label><textarea id="icaDesires" name="icaDesires">${esc3(lines(os7.ica?.desires))}</textarea></div>
+   </div>
+   <div class="two">
+    <div><label for="icaObjections">Why they say no \u2014 one per line</label><textarea id="icaObjections" name="icaObjections">${esc3(lines(os7.ica?.objections))}</textarea></div>
+    <div><label for="icaTriggers">What makes them buy now \u2014 one per line</label><textarea id="icaTriggers" name="icaTriggers">${esc3(lines(os7.ica?.triggers))}</textarea></div>
+   </div>
+   <div class="two">
+    <div><label for="icaVocabulary">Their own words for the problem \u2014 one per line</label><textarea id="icaVocabulary" name="icaVocabulary">${esc3(lines(os7.ica?.vocabulary))}</textarea></div>
+    <div><label for="icaHangouts">Where they read, listen and gather \u2014 one per line</label><textarea id="icaHangouts" name="icaHangouts">${esc3(lines(os7.ica?.hangouts))}</textarea></div>
+   </div>
+   <label for="icaVillains">What they have tried and blame \u2014 one per line</label>
+   <textarea id="icaVillains" name="icaVillains" placeholder="The last agency that charged $3,000 a month for two posts a week">${esc3(lines(os7.ica?.villains))}</textarea>
+  </fieldset>
+
+  <fieldset><legend>The offer \u2014 what you promise (build 3)</legend>
+   <div class="two">
+    <div><label for="offerName">The offer's name</label><input id="offerName" name="offerName" value="${esc3(os7.offer?.name)}" placeholder="The Full Room"></div>
+    <div><label for="offerPrice">Price, and what it is per</label><input id="offerPrice" name="offerPrice" value="${esc3(os7.offer?.price)}" placeholder="$5,000 per event plus 30% of revenue"></div>
+   </div>
+   <label for="offerPromise">The promise \u2014 one sentence a prospect could repeat</label>
+   <textarea id="offerPromise" name="offerPromise" placeholder="A full room in one weekend, and a system that keeps booking after we leave">${esc3(os7.offer?.promise)}</textarea>
+   <label for="offerStack">What is in it \u2014 one per line</label>
+   <textarea id="offerStack" name="offerStack" placeholder="The campaign page&#10;The AI receptionist&#10;The 30-day nurture">${esc3(lines(os7.offer?.valueStack))}</textarea>
+   <div class="two">
+    <div><label for="offerGuarantee">The guarantee, exactly as you would say it</label><textarea id="offerGuarantee" name="offerGuarantee">${esc3(os7.offer?.guarantee)}</textarea></div>
+    <div><label for="offerAccelerators">Why now \u2014 bonuses, deadlines, scarcity, one per line</label><textarea id="offerAccelerators" name="offerAccelerators">${esc3(lines(os7.offer?.accelerators))}</textarea></div>
+   </div>
+  </fieldset>
+
   <fieldset><legend>How you deliver</legend>
    <label for="sops">Delivery SOPs \u2014 one per line</label>
    <textarea id="sops" name="sops" placeholder="Every build gets a rollback journal before go-live">${esc3(sops)}</textarea>
    <label for="staff">Staff \u2014 one per line, "name \xB7 role \xB7 email"</label>
-   <textarea id="staff" name="staff" placeholder="Dr Jerry Relth \xB7 owner \xB7 jerry@elitedcs.com">${esc3(staff)}</textarea>
+   <textarea id="staff" name="staff" placeholder="Dr Pat Owner \xB7 owner \xB7 pat@youragency.com">${esc3(staff)}</textarea>
    <p class="hint">Who may approve what is recorded here for reference. The approval gates themselves are still enforced by the ritual, not by this list.</p>
   </fieldset>
 
@@ -41198,12 +41842,12 @@ ${cockpitHeaderHtml("agency")}
  </fieldset>
 
 ${clientsSection}
-</main>
+</main>${cockpitShellClose()}
 <script>
 ${READ_NUMBER_JS}
 /* Served key first: this page is reachable on its own, so it cannot depend on
    the board having been opened first in this browser. */
-const SERVED=${JSON.stringify(seatToken)};
+const SERVED=${scriptJson(seatToken)};
 const KEY=SERVED||new URLSearchParams(location.search).get("seat")||localStorage.getItem("cockpit_seat")||"";
 try{if(SERVED)localStorage.setItem("cockpit_seat",SERVED)}catch(e){}
 /* The Anthropic key: saved on its own, and CHECKED before it is kept. A key that
@@ -41254,7 +41898,14 @@ document.getElementById("f").addEventListener("submit",async e=>{
   offers:offers.length?offers:null,
   pricing:{minMonthly:num("minMonthly"),minSetup:num("minSetup"),currency:v("currency")||null},
   delivery:{sops:lines("sops").length?lines("sops"):null},
-  staff:staff.length?staff:null};
+  staff:staff.length?staff:null,
+  agencyOs:{story:v("story")||null,method:v("method")||null,voice:v("voice")||null,goals:v("goals")||null,
+   values:lines("values").length?lines("values"):null,proof:lines("proof").length?lines("proof"):null,
+   ica:{who:v("icaWho")||null,pains:lines("icaPains").length?lines("icaPains"):null,desires:lines("icaDesires").length?lines("icaDesires"):null,
+    objections:lines("icaObjections").length?lines("icaObjections"):null,triggers:lines("icaTriggers").length?lines("icaTriggers"):null,
+    vocabulary:lines("icaVocabulary").length?lines("icaVocabulary"):null,hangouts:lines("icaHangouts").length?lines("icaHangouts"):null,villains:lines("icaVillains").length?lines("icaVillains"):null},
+   offer:{name:v("offerName")||null,promise:v("offerPromise")||null,price:v("offerPrice")||null,guarantee:v("offerGuarantee")||null,
+    valueStack:lines("offerStack").length?lines("offerStack"):null,accelerators:lines("offerAccelerators").length?lines("offerAccelerators"):null}}};
  const m=document.getElementById("msg");
  const badNum=["minMonthly","minSetup"].find(id=>body.pricing[id]===undefined);
  if(badNum){m.textContent="That is not a number I can read, so nothing was saved. Check the "+(badNum==="minMonthly"?"minimum monthly":"minimum setup fee")+".";return}
@@ -41302,6 +41953,7 @@ var init_agency_profile_page = __esm({
     "use strict";
     init_cockpit_shell();
     init_client_engagements();
+    init_script_json();
     READ_NUMBER_JS = `function readNumber(raw){
  var s=String(raw==null?"":raw).trim();
  if(!s)return{clear:true};
@@ -41856,7 +42508,14 @@ function renderReport(opts) {
   out.push("<header>");
   if (agency.name) out.push('<p class="by">Prepared by ' + esc(agency.name) + "</p>");
   out.push("<h1>Where " + biz + " is leaking</h1>");
+  var who = state.client && state.client.name ? esc(state.client.name) + (state.client.role ? ", " + esc(state.client.role) : "") : "";
+  if (who) out.push('<p class="for">Prepared for ' + who + "</p>");
   if (date) out.push('<p class="when">' + esc(date) + "</p>");
+  // The agency's own method and promise, from Layer 1's Agency OS inputs. Their
+  // words, never ours; absent when they have not written them.
+  if (agency.method || agency.promise) {
+    out.push('<p class="about">' + [agency.method, agency.promise].filter(Boolean).map(esc).join(" ") + "</p>");
+  }
   out.push("</header>");
 
   // \u2500\u2500 the three verdicts are three different documents \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
@@ -42029,7 +42688,8 @@ function sourceLine(state, r, labels) {
 
 function footer(agency) {
   if (!agency.name) return "";
-  return '<footer>' + esc(agency.name) + (agency.contact ? " &middot; " + esc(agency.contact) : "") + "</footer>";
+  return '<footer>' + esc(agency.name) + (agency.contact ? " &middot; " + esc(agency.contact) : "")
+    + (agency.guarantee ? '<br><span class="guarantee">' + esc(agency.guarantee) + "</span>" : "") + "</footer>";
 }
 
 function css(accent) {
@@ -42042,6 +42702,9 @@ function css(accent) {
     ".by{font-size:.72rem;letter-spacing:.09em;text-transform:uppercase;color:var(--a);margin:0 0 .4rem;font-weight:600}",
     "h1{font-size:1.9rem;line-height:1.15;margin:0;font-weight:700}",
     ".when{color:var(--mut);font-size:.82rem;margin:.4rem 0 0}",
+    ".for{color:var(--ink);font-size:.95rem;margin:.5rem 0 0}",
+    ".about{color:var(--mut);font-size:.95rem;margin:.6rem 0 0;max-width:38rem}",
+    ".guarantee{color:var(--mut);font-size:.85rem}",
     "h2{font-size:1.15rem;margin:2rem 0 .5rem;font-weight:700}",
     "table{border-collapse:collapse;width:100%;margin:.6rem 0;font-size:.94rem}",
     "th,td{text-align:left;padding:.5rem .6rem;border-bottom:1px solid var(--rule);vertical-align:top}",
@@ -42071,9 +42734,10 @@ function css(accent) {
 
 /* \u2500\u2500 state (persistence only; all maths lives in engine.js) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */
 var K="cmdos-assessment-v1";
-var S={biz:"",trade:"",ans:{},skip:{},asm:{},tab:"ask",area:"money"};
+var S={biz:"",trade:"",client:{},saveTo:"",ans:{},skip:{},asm:{},tab:"ask",area:"client"};
 ASSUMPTIONS.forEach(function(a){S.asm[a[0]]=a[2]});
 try{var raw=localStorage.getItem(K);if(raw)S=Object.assign(S,JSON.parse(raw))}catch(e){}
+if(!S.client)S.client={};if(S.saveTo===undefined)S.saveTo="";
 function save(){try{localStorage.setItem(K,JSON.stringify(S))}catch(e){}}
 function txt(id){return S.skip[id]?null:(S.ans[id]||null)}
 function money(n){return "$"+Math.round(n).toLocaleString()}
@@ -42088,7 +42752,7 @@ function head(){
   document.getElementById("lHrs").textContent=r.hrsWk?r.hrsWk.toFixed(1):"\u2014";
   document.getElementById("lMon").textContent=r.monthly?money(r.monthly):"\u2014";
   document.getElementById("bizname").textContent=S.biz||"New assessment";
-  document.getElementById("bizmeta").textContent=S.trade||"";
+  document.getElementById("bizmeta").textContent=[S.trade,(S.client&&S.client.name)?"with "+S.client.name:""].filter(Boolean).join(" \xB7 ");
 }
 
 /**
@@ -42124,7 +42788,7 @@ function bizWarnHtml(){
     +'The report below is addressed to &ldquo;your business&rdquo; until you give it one. It renders either way, and that is the problem: it looks finished and is not sendable.'
     +' <button class="mini" onclick="goBiz()">Take me to it</button></div>';
 }
-function goBiz(){S.tab="set";save();draw();
+function goBiz(){S.tab="ask";S.area="client";save();draw();
   var el=document.getElementById("f_biz");
   if(el){el.scrollIntoView({behavior:"smooth",block:"center"});el.focus()}}
 /** Every standing warning, in one place, so all three tabs show the same set. */
@@ -42135,9 +42799,12 @@ function goCore(){S.tab="ask";S.area="money";save();draw();
   if(g.length){var el=document.getElementById("q_"+g[0]);
     if(el){el.scrollIntoView({behavior:"smooth",block:"center"});var i=el.querySelector("input");if(i)i.focus()}}}
 
+/** How much of the client step is filled: the two the report needs plus the contact. */
+function clientCount(){var c=S.client||{};var f=[S.biz,S.trade,c.name,c.email||c.phone].filter(function(v){return v&&String(v).trim()}).length;return f+"/4"}
 function railHtml(){
   if(S.tab!=="ask")return "";
-  return AREAS.map(function(a){return '<button class="'+(S.area===a[0]?"on":"")+'" onclick="goArea(\\''+a[0]+'\\')">'
+  return '<button class="'+(S.area==="client"?"on":"")+'" onclick="goArea(\\'client\\')">The client<span class="c">'+clientCount()+'</span></button>'
+    +AREAS.map(function(a){return '<button class="'+(S.area===a[0]?"on":"")+'" onclick="goArea(\\''+a[0]+'\\')">'
     +a[1]+'<span class="c">'+areaCount(a[0])+'</span></button>'}).join("")}
 
 function inputFor(q){
@@ -42150,7 +42817,38 @@ function inputFor(q){
     +'<button class="mini '+(sk?"on":"")+'" onclick="skip(\\''+id+'\\')">'+(sk?"marked don\\'t know":"don\\'t know")+'</button>'
     +'<button class="mini" onclick="why(\\''+id+'\\')">why</button></div>'}
 
+/**
+ * The first step: who this is for. Most operators use the assessment as the
+ * sales pitch and the proposal, so the client and the business come before any
+ * number (Jerry, 2026-09-05). It also says which account on the board the
+ * assessment belongs to, so Save to GoHighLevel knows where to put it.
+ */
+function escH(s){return String(s==null?"":s).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&#39;")}
+function cf(k,ph,type){var c=S.client||{};return '<input class="a" type="'+(type||"text")+'" placeholder="'+escH(ph)+'" value="'+escH(c[k]||"")+'" oninput="setClient(\\''+k+'\\',this.value)">'}
+function setClient(k,v){if(!S.client)S.client={};S.client[k]=v;save();head()}
+function setSaveTo(v){S.saveTo=v;save();try{localStorage.setItem(K+":saveTo",v)}catch(e){}}
+function accountSelectHtml(){
+  var list=window.COMMAND_OS_CLIENTS;
+  if(!list||!list.length)return '<p class="probe">Open this page from Command OS to choose the account it is saved into.</p>';
+  var cur=S.saveTo;try{if(!cur)cur=localStorage.getItem(K+":saveTo")||""}catch(e){}
+  return '<div class="row"><select class="a" onchange="setSaveTo(this.value)"><option value="">Which account does this belong to?</option>'
+    +list.map(function(c){return '<option value="'+escH(c.locationId)+'"'+(c.locationId===cur?" selected":"")+'>'+escH(c.name)+'</option>'}).join("")
+    +'</select></div><p class="why" style="display:block">Usually your own agency account: the prospect becomes a contact there, the answers a note on that contact, and the deal a card on your Assessments board. A client account only once they are one.</p>';
+}
+function clientHtml(){
+  return warnsHtml()+'<h2>The client</h2><p class="intro">&ldquo;Before any number: who this is for, and where it lives.&rdquo;</p>'
+    +'<div class="q done" id="q_client"><p class="ask">The business</p>'
+    +'<div class="row"><input class="a" id="f_biz" placeholder="Business name" value="'+escH(S.biz||"")+'" oninput="S.biz=this.value;save();head()">'
+    +'<input class="a" placeholder="Trade (med spa, dental, home care\u2026)" value="'+escH(S.trade||"")+'" oninput="S.trade=this.value;save();head()"></div>'
+    +'<div class="row">'+cf("website","Website","url")+cf("city","City, state")+'</div></div>'
+    +'<div class="q done"><p class="ask">The person you are talking to</p>'
+    +'<div class="row">'+cf("name","Their name")+cf("role","Their role (owner, office manager\u2026)")+'</div>'
+    +'<div class="row">'+cf("email","Email","email")+cf("phone","Phone","tel")+'</div>'
+    +'<p class="why" style="display:block">An email or a phone number is what lets the same business be found again next time instead of a second contact being created.</p></div>'
+    +'<div class="q done"><p class="ask">Where this assessment is saved</p>'+accountSelectHtml()+'</div>'
+    +'<div class="btnrow"><button class="btn" onclick="goArea(\\''+AREAS[0][0]+'\\')">Next: '+AREAS[0][1]+'</button></div>'}
 function askHtml(){
+  if(S.area==="client")return clientHtml();
   var a=AREAS.filter(function(x){return x[0]===S.area})[0];
   var qs=Q.filter(function(q){return q[1]===S.area});
   return warnsHtml()+'<h2>'+a[1]+'</h2><p class="intro">&ldquo;'+a[2]+'&rdquo;</p>'
@@ -42169,8 +42867,7 @@ function setHtml(){
       return '<div class="assume"><div><b>'+a[1]+'</b><br><span class="unit">'+a[3]+'</span></div>'
       +'<input class="a" style="max-width:5rem" value="'+(S.asm[a[0]])+'" oninput="setAsm(\\''+a[0]+'\\',this.value)"></div>'}).join("")
     +'</div><div class="card"><h2 style="font-size:1rem">Who is this for?</h2>'
-    +'<div class="row"><input class="a" id="f_biz" placeholder="Business name" value="'+(S.biz||"")+'" oninput="S.biz=this.value;save();head()">'
-    +'<input class="a" placeholder="Trade" value="'+(S.trade||"")+'" oninput="S.trade=this.value;save();head()"></div></div>'}
+    +'<p class="intro">'+(S.biz?escH(S.biz)+(S.trade?", "+escH(S.trade):""):"No business named yet")+'. <button class="mini" onclick="goBiz()">Edit on The client step</button></p></div>'}
 
 function findHtml(){
   var r=R();
@@ -42205,8 +42902,8 @@ function reportHtml(){
   var labels={};
   ASSUMPTIONS.forEach(function(a){labels[a[0]]=a[3]});
   return renderReport({
-    state:{biz:S.biz,trade:S.trade,ans:S.ans},
-    computed:r, agency:S.agency||{}, services:S.services||[],
+    state:{biz:S.biz,trade:S.trade,ans:S.ans,client:S.client||{}},
+    computed:r, agency:S.agency||window.COMMAND_OS_AGENCY||{}, services:S.services||[],
     assumptionLabels:labels,
     date:new Date().toLocaleDateString(undefined,{day:"numeric",month:"long",year:"numeric"}),
     answered:answered
@@ -42220,7 +42917,9 @@ function repHtml(){
   +'<div class="card" style="padding:0;overflow:hidden"><iframe id="rpv" style="width:100%;height:34rem;border:0;background:#fff" title="Report preview"></iframe></div>'
   +'<div class="btnrow"><button class="btn" onclick="openReport()">Open it full size</button>'
   +'<button class="btn ghost" onclick="showSource()">Save the report</button>'
-  +'<button class="btn ghost" onclick="dl()">Save answers</button></div>'
+  +'<button class="btn ghost" onclick="dl()">Save answers</button>'
+  +(window.COMMAND_OS_CLIENTS?'<button class="btn" onclick="saveToGhl()">Save to GoHighLevel</button>':'')+'</div>'
+  +'<div id="savemsg"></div>'
   +'<div class="note"><b>Publishing it</b>Open it full size and print to PDF, or hand the file to your own site. Putting it on your domain automatically is the next piece, and it is not built yet.</div>';
 }
 function paintReport(){
@@ -42250,7 +42949,7 @@ function skip(id){S.skip[id]=!S.skip[id];if(S.skip[id])S.ans[id]="";save();draw(
 function why(id){var el=document.getElementById("q_"+id);if(el)el.classList.toggle("open")}
 function setAsm(k,v){S.asm[k]=parseRate(v);save();head()}
 function goArea(a){S.area=a;save();draw();window.scrollTo({top:0,behavior:"smooth"})}
-function nextArea(){var i=AREAS.map(function(x){return x[0]}).indexOf(S.area);
+function nextArea(){if(S.area==="client"){goArea(AREAS[0][0]);return}var i=AREAS.map(function(x){return x[0]}).indexOf(S.area);
   if(i<AREAS.length-1)goArea(AREAS[i+1][0]);else tab("find")}
 function tab(t){S.tab=t;save();draw();window.scrollTo({top:0,behavior:"smooth"})}
 /** One copy box, two callers. */
@@ -42301,7 +43000,23 @@ function dl(){
   var text=JSON.stringify(S,null,2), name=slug(S.biz)+"-answers.json";
   dump(savedMsg(saveFile(name,text,"application/json"),name), text);
 }
-function wipe(){if(!confirm)return;S.ans={};S.skip={};S.biz="";S.trade="";S.tab="ask";S.area="money";save();draw()}
+function wipe(){if(!confirm)return;S.ans={};S.skip={};S.biz="";S.trade="";S.client={};S.tab="ask";S.area="client";save();draw()}
+/** Save into the chosen account through Command OS on this computer: the same
+ *  write the save_assessment tool makes, nothing else. */
+function saveToGhl(){
+  var box=document.getElementById("savemsg");
+  var loc=S.saveTo;try{if(!loc)loc=localStorage.getItem(K+":saveTo")||""}catch(e){}
+  if(!loc){if(box)box.innerHTML='<div class="note warn"><b>Which account?</b>Pick it on The client step first. <button class="mini" onclick="goBiz()">Take me there</button></div>';return}
+  if(!S.biz||!S.biz.trim()){if(box)box.innerHTML='<div class="note warn"><b>No business name yet</b><button class="mini" onclick="goBiz()">Take me to it</button></div>';return}
+  if(box)box.innerHTML='<div class="note"><b>Saving\u2026</b>The prospect as a contact, the answers as a note, the deal on your Assessments board.</div>';
+  var c=S.client||{};
+  fetch("/api/assessment-save",{method:"POST",headers:{"Content-Type":"application/json","x-command-os-seat":window.COMMAND_OS_SEAT||""},
+    body:JSON.stringify({locationId:loc,assessment:{biz:S.biz,trade:S.trade,ans:S.ans,skip:S.skip,asm:S.asm,client:c},contactName:c.name||"",email:c.email||"",phone:c.phone||""})})
+  .then(function(r){return r.json()}).then(function(j){
+    if(!box)return;
+    if(!j.ok||j.saved===false){box.innerHTML='<div class="note stop"><b>Not saved</b>'+String(j.error||"unknown").replace(/</g,"&lt;")+'</div>';return}
+    box.innerHTML='<div class="note go"><b>Saved</b>'+String(j.whereItLives||"").replace(/</g,"&lt;")+' Stage: '+String(j.stage||"")+'. '+String(j.opportunityNote||"").replace(/</g,"&lt;")+(j.warning?' '+String(j.warning).replace(/</g,"&lt;"):'')+'</div>'})
+  .catch(function(e){if(box)box.innerHTML='<div class="note stop"><b>Not saved</b>Command OS is not answering on this computer.</div>'})}
 
 Array.prototype.forEach.call(document.querySelectorAll(".tabs button"),function(b){
   b.onclick=function(){tab(b.dataset.t)}});
@@ -42350,7 +43065,8 @@ function brandCardHtml(d, opts = {}) {
   const sw = (label, t) => `<tr><td><span class="sw" style="margin:0"><span style="background:${t.hex}"></span></span></td><td>${esc4(label)}</td><td class="hex">${esc4(t.hex)}</td><td class="small">${esc4(t.source)}</td></tr>`;
   const face = (label, f) => `<tr><td>${esc4(label)}</td><td><b>${esc4(f.family)}</b></td><td>${f.renderIntent === "google" ? `<span class="pill ok">Google Fonts</span>` : `<span class="pill warn">${f.renderIntent === "licensed-webfont" ? "licensed" : "system"}</span> renders as <b>${esc4(renderedFamily(f))}</b>`}</td><td class="small">${esc4(f.source)}</td></tr>`;
   const pairs = d.contrast.pairs.map((p) => `<tr><td class="hex">${esc4(p.fg)} on ${esc4(p.bg)}</td><td>${p.ratio}:1 ${p.ratio >= 4.5 ? `<span class="pill ok">AA</span>` : `<span class="pill warn">under 4.5</span>`}</td><td class="small">${p.correctedFg ? `text shade corrected to <span class="hex">${esc4(p.correctedFg)}</span> (${p.correctedRatio}:1)` : ""}</td></tr>`).join("");
-  const logo = d.logo?.inlineSvg ? d.logo.inlineSvg : d.logo?.dataUri ? `<img src="${d.logo.dataUri}" alt="">` : `<span class="small">no logo stored</span>`;
+  const cleanSvg = d.logo?.inlineSvg ? sanitizeSvgOrDrop(d.logo.inlineSvg) : void 0;
+  const logo = cleanSvg ? `<img src="data:image/svg+xml;base64,${Buffer.from(cleanSvg.replace(/currentColor/g, c.fg.hex)).toString("base64")}" alt="">` : d.logo?.inlineSvg ? `<span class="small">the stored logo is not a plain drawing, so it is not shown</span>` : isRasterDataUri(d.logo?.dataUri) ? `<img src="${esc4(d.logo.dataUri)}" alt="">` : d.logo?.dataUri ? `<span class="small">the stored logo image is not a plain picture, so it is not shown</span>` : `<span class="small">no logo stored</span>`;
   return `${head2(`${d.name} \xB7 brand`)}
 <h1>${esc4(d.name)}</h1>
 <p class="muted">${esc4(d.website ?? "")} \xB7 <span class="pill">${esc4(d.provenance.extractedVia)}</span><span class="pill ${d.provenance.confidence >= 0.7 ? "ok" : "warn"}">confidence ${Math.round(d.provenance.confidence * 100)}%</span> ${esc4(d.scheme)} scheme \xB7 ${esc4(d.provenance.extractedAt.slice(0, 10))}</p>
@@ -42401,7 +43117,7 @@ document.getElementById("make").addEventListener("submit",async function(e){
   var g=function(id){return document.getElementById(id).value.trim()};
   var pts=g("mk-points").split("|").map(function(x){return x.trim()}).filter(Boolean);
   if(!g("mk-headline")||!pts.length){say("mk-status","A headline and at least one point, please.","err");return}
-  var body={brand:${JSON.stringify(d.slug)},medium:g("mk-medium"),headline:g("mk-headline"),points:pts};
+  var body={brand:${scriptJson(d.slug)},medium:g("mk-medium"),headline:g("mk-headline"),points:pts};
   if(g("mk-audience"))body.audience=g("mk-audience");
   if(g("mk-cta"))body.cta=g("mk-cta");
   if(g("mk-grade"))body.gradeCopyFor=g("mk-grade");
@@ -42431,7 +43147,7 @@ document.getElementById("mk-cancel").addEventListener("click",async function(){
   try{await post("/api/design/cancel",{id:runId});stopPolling();say("mk-status","Stopped.");document.getElementById("mk-go").disabled=false;this.hidden=true}catch(e){say("mk-status",e.message,"err")}
 });
 })();
-document.getElementById("override").addEventListener("submit",async(e)=>{e.preventDefault();const g=(id)=>document.getElementById(id).value.trim();const body={slug:${JSON.stringify(d.slug)}};if(g("accent"))body.accent=g("accent");if(g("displayFont"))body.displayFont=g("displayFont");if(g("bodyFont"))body.bodyFont=g("bodyFont");if(g("brandName"))body.name=g("brandName");if(g("logoSvg"))body.logoSvg=g("logoSvg");if(Object.keys(body).length===1){say("save-status","Nothing to change.");return}const b=document.getElementById("save");b.disabled=true;try{await post("/api/brand/set",body);say("save-status","Saved.","ok");location.reload()}catch(err){say("save-status",err.message,"err");b.disabled=false}});
+document.getElementById("override").addEventListener("submit",async(e)=>{e.preventDefault();const g=(id)=>document.getElementById(id).value.trim();const body={slug:${scriptJson(d.slug)}};if(g("accent"))body.accent=g("accent");if(g("displayFont"))body.displayFont=g("displayFont");if(g("bodyFont"))body.bodyFont=g("bodyFont");if(g("brandName"))body.name=g("brandName");if(g("logoSvg"))body.logoSvg=g("logoSvg");if(Object.keys(body).length===1){say("save-status","Nothing to change.");return}const b=document.getElementById("save");b.disabled=true;try{await post("/api/brand/set",body);say("save-status","Saved.","ok");location.reload()}catch(err){say("save-status",err.message,"err");b.disabled=false}});
 `)}`;
 }
 var esc4, STYLE, SHELL_JS, foot;
@@ -42440,6 +43156,8 @@ var init_brand_page = __esm({
     "use strict";
     init_fonts();
     init_cockpit_shell();
+    init_script_json();
+    init_svg_sanitize();
     esc4 = (s) => String(s ?? "").replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
     STYLE = `
 main{max-width:1080px;margin:0 auto;padding:28px 24px 80px}
@@ -42467,13 +43185,13 @@ td.hex{font-family:ui-monospace,Menlo,monospace}
 .shot{max-width:100%;border:1px solid var(--line);border-radius:var(--radius-sm)}
 `;
     SHELL_JS = (seatToken) => `
-const SERVED=${JSON.stringify(seatToken)};
+const SERVED=${scriptJson(seatToken)};
 const KEY=SERVED||new URLSearchParams(location.search).get("seat")||localStorage.getItem("cockpit_seat")||"";
 try{if(SERVED)localStorage.setItem("cockpit_seat",SERVED)}catch(e){}
 async function post(url,body){const r=await fetch(url,{method:"POST",headers:{"Content-Type":"application/json","x-command-os-seat":KEY},body:JSON.stringify(body)});let j={};try{j=await r.json()}catch(e){}if(!r.ok||j.ok===false)throw new Error(j.error||("Request failed ("+r.status+")"));return j}
 function say(id,msg,cls){const el=document.getElementById(id);if(!el)return;el.textContent=msg;el.style.color=cls==="err"?"#A63D3D":cls==="ok"?"#2F7A5A":""}
 `;
-    foot = (js) => `</main><script>${js}</script><script>${COCKPIT_TYPE_JS}</script></body></html>`;
+    foot = (js) => `</main>${cockpitShellClose()}<script>${js}</script><script>${COCKPIT_TYPE_JS}</script></body></html>`;
   }
 });
 
@@ -42761,7 +43479,7 @@ function renderClientStatusHtml(input) {
   </div>
 </div></div>
 <div class="page"><div class="sheet">
-${agency || input.logoDataUri ? `<div class="brand">${input.logoDataUri ? `<img src="${esc5(input.logoDataUri)}" alt="${esc5(agency ?? "")}">` : ""}${agency ? `<span class="agency">${esc5(agency)}</span>` : ""}<span class="for">Prepared for<br><b>${esc5(input.accountName)}</b></span></div>` : ""}
+${agency || isRasterDataUri(input.logoDataUri) ? `<div class="brand">${isRasterDataUri(input.logoDataUri) ? `<img src="${esc5(input.logoDataUri)}" alt="${esc5(agency ?? "")}">` : ""}${agency ? `<span class="agency">${esc5(agency)}</span>` : ""}<span class="for">Prepared for<br><b>${esc5(input.accountName)}</b></span></div>` : ""}
 <p class="eyebrow">What is live in your account</p>
 <h1>${esc5(input.accountName)}</h1>
 <p class="stamp">${esc5(revLine)}</p>
@@ -42810,6 +43528,7 @@ var init_client_status = __esm({
     "use strict";
     init_handoff_pack();
     init_branding();
+    init_svg_sanitize();
     CLIENT_STATE_LABEL = {
       "in-place": "Live in your account",
       "not-yet": "Not confirmed yet",
@@ -43473,6 +44192,76 @@ var init_blueprint_review = __esm({
   }
 });
 
+// src/command-os/capability-runs.ts
+function capabilitySentence(cap, clientName) {
+  return cap.says.replace(/\{client\}/g, clientName);
+}
+function capabilitySpec(cap, clientName) {
+  const tools = CAPABILITY_TOOLS[cap.key] ?? [];
+  if (!tools.length) throw new Error(`${cap.label} is not built from a button. Run it from your own Claude, watching.`);
+  return {
+    stage: -1,
+    name: cap.label,
+    allowedTools: T([...ALWAYS, ...tools]),
+    maxTurns: 30,
+    timeoutMs: 15 * 6e4,
+    prompt: (locationId2, locationName) => `You are Command OS, working inside ONE GoHighLevel sub-account for a client: ${locationName} (${locationId2}).
+1. Call switch_location with locationId ${locationId2}.
+2. Call get_current_location and STOP with a line "RESULT: {\\"ok\\":false,\\"error\\":\\"wrong location\\"}" if it is not ${locationId2}.
+3. Do exactly this, and nothing beyond it: ${capabilitySentence(cap, clientName)}
+Rules that are not negotiable:
+- Read what the account already has BEFORE you create anything, and reuse what is there instead of duplicating it.
+- Any workflow you create or change stays a DRAFT. Never publish. Never delete anything. Never send a message to a real contact.
+- Every id you use (calendar, pipeline, stage, field, user, workflow) comes from a read of THIS account in this run, never from memory or another account.
+- If a step needs a human (a number to buy, a Stripe connection, a staff member to add, a decision), do not guess: list it as an issue.
+- Say what you did in the owner's words, not tool names.
+Finish with ONE line, exactly:
+RESULT: {"ok":true,"summary":"<what exists now versus what was already there, with counts>","issues":["<anything skipped or waiting on a person>"]}
+If it cannot be done, finish with: RESULT: {"ok":false,"error":"<short reason>"}`
+  };
+}
+var T, ALWAYS, CAPABILITY_TOOLS;
+var init_capability_runs = __esm({
+  "src/command-os/capability-runs.ts"() {
+    "use strict";
+    T = (names) => names.map((n) => `mcp__ghl__${n}`);
+    ALWAYS = ["switch_location", "get_current_location"];
+    CAPABILITY_TOOLS = {
+      intake: ["get_forms", "get_form_full", "get_form_submissions", "get_intake_question_set"],
+      pipelines: ["get_pipelines", "get_pipeline_full", "create_pipeline", "update_pipeline"],
+      calendars: ["get_calendars", "get_calendar", "get_users", "create_calendar", "update_calendar"],
+      forms: ["get_forms", "get_form_full", "get_form_submissions", "create_form", "update_form", "get_surveys", "get_custom_fields"],
+      pages: ["get_funnels", "get_funnel_pages", "get_page_full", "list_brands", "get_brand", "get_calendars", "find_ghl_template", "install_ghl_template", "create_funnel", "create_funnel_page", "compose_page", "update_page_content", "verify_funnel", "check_page_theme"],
+      fields: ["get_custom_fields", "create_custom_field", "update_custom_field", "get_custom_values", "create_custom_value", "update_custom_value", "get_location_tags", "create_location_tag"],
+      staff: ["get_users", "get_user", "get_calendars"],
+      phone: ["list_phone_numbers", "list_number_pools", "get_location"],
+      workflows: ["get_workflows", "get_workflow_full", "get_trigger_registry", "get_users", "get_calendars", "get_pipelines", "get_pipeline_full", "get_custom_fields", "get_custom_values", "get_location_tags", "list_email_templates", "list_message_templates", "validate_workflow", "create_workflow", "update_workflow_actions", "audit_workflows"],
+      reactivation: ["get_contact_count", "search_contacts", "get_location_tags", "create_location_tag", "get_workflows", "get_workflow_full", "validate_workflow", "create_workflow", "update_workflow_actions", "create_smart_list", "list_smart_lists"],
+      // no bulk tagging: that is a mass write the operator does by hand
+      templates: ["list_email_templates", "create_email_template", "update_email_template", "list_message_templates", "create_sms_template", "get_custom_values"],
+      broadcasts: ["list_email_templates", "create_email_template", "update_email_template", "list_smart_lists", "get_email_campaigns"],
+      // drafts the email as a template; sending or scheduling is the operator's click
+      "conversation-ai": ["list_knowledge_bases", "get_knowledge_base", "create_knowledge_base", "crawl_kb_website", "get_kb_crawl_status", "train_kb_urls", "list_kb_urls", "list_kb_faqs", "create_kb_faq", "list_conversation_agents", "get_conversation_agent", "create_conversation_agent", "list_conversation_actions", "create_conversation_action", "get_agent_generations", "get_calendars", "get_users"],
+      "voice-ai": ["check_voice_ai_readiness", "list_voice_agents", "get_voice_agent", "create_voice_agent", "get_voice_action", "create_voice_action", "update_voice_action", "get_voice_call_logs", "get_calendars", "get_users", "get_workflows", "list_knowledge_bases"],
+      demo: [],
+      // messages a real prospect: never from a button (NO_BUILD_BUTTON)
+      payments: ["list_products", "get_product", "list_product_prices", "create_product", "update_product", "list_invoices", "get_invoice", "create_invoice", "list_coupons"],
+      documents: [],
+      // reads only would be a brochure and a send is not a build: no button (NO_BUILD_BUTTON)
+      memberships: ["get_courses", "create_course", "list_membership_categories", "create_membership_category", "list_membership_lessons", "create_membership_lesson", "list_membership_offers", "create_membership_offer"],
+      reviews: ["list_reviews", "get_review_link_list", "get_workflows", "get_workflow_full", "validate_workflow", "create_workflow", "update_workflow_actions", "get_calendars"],
+      social: [],
+      // a post is a send: no button (NO_BUILD_BUTTON)
+      blogs: ["get_blogs", "get_blog_posts", "get_blog_post", "get_blog_authors", "get_blog_categories", "check_blog_slug"],
+      checkup: ["run_checkup", "audit_workflows", "get_account_health_summary", "audit_my_delivery", "build_audit_report", "get_workflows"],
+      contacts: ["get_contact_count", "search_contacts", "get_contact", "get_location_tags", "create_location_tag", "create_smart_list", "list_smart_lists"],
+      // no bulk writes from a button
+      integrations: ["list_webhooks", "get_webhook", "create_webhook", "get_trigger_links", "create_trigger_link", "list_custom_objects", "get_custom_object"],
+      handoff: ["build_offboarding_kit", "build_audit_report", "list_snapshots", "create_snapshot_share_link", "export_account", "run_checkup"]
+    };
+  }
+});
+
 // src/shared-brain.ts
 function isSharedRecord(x) {
   const r = x;
@@ -43556,32 +44345,47 @@ var init_shared_brain = __esm({
 var dashboard_exports = {};
 __export(dashboard_exports, {
   ACCOUNT_TYPES: () => ACCOUNT_TYPES,
+  INTAKE_OWN_MESSAGES: () => INTAKE_OWN_MESSAGES,
   NOT_SIGNED_IN_MSG: () => NOT_SIGNED_IN_MSG,
+  SEAT_GUARDED_READS: () => SEAT_GUARDED_READS,
   SEAT_TOKEN_HEADER: () => SEAT_TOKEN_HEADER,
   STAGES: () => STAGES2,
   accountTypeOf: () => accountTypeOf,
+  assessmentAgencyTag: () => assessmentAgencyTag,
   checkMutationGuard: () => checkMutationGuard,
   checkSeatToken: () => checkSeatToken,
   clearPending: () => clearPending,
+  clientDocsDir: () => clientDocsDir,
+  cockpitGate: () => cockpitGate,
   cockpitStatePath: () => cockpitStatePath,
   forgetAnthropicKey: () => forgetAnthropicKey,
+  guarded: () => guarded,
+  insideDir: () => insideDir,
   isLoopback: () => isLoopback,
   launcherAlreadyOffered: () => launcherAlreadyOffered,
+  listClientDocs: () => listClientDocs,
+  memberFacingError: () => memberFacingError,
   overlayPath: () => overlayPath,
+  readBody: () => readBody,
   readCockpitState: () => readCockpitState,
+  readFailureText: () => readFailureText,
   readOverlay: () => readOverlay,
+  readableAccount: () => readableAccount,
   recordLauncherOffered: () => recordLauncherOffered,
   recoverStuckStages: () => recoverStuckStages,
   renderCockpitHtml: () => renderCockpitHtml,
   resolvePlan: () => resolvePlan2,
   runDashboard: () => runDashboard,
+  safeDocName: () => safeDocName,
   setAccountIndustry: () => setAccountIndustry,
   setAccountType: () => setAccountType,
   setBuildApproval: () => setBuildApproval,
   setPending: () => setPending,
   setStage: () => setStage,
+  uniqueDocName: () => uniqueDocName,
   withCockpitShell: () => withCockpitShell,
   writeCockpitState: () => writeCockpitState,
+  writeDocAtomically: () => writeDocAtomically,
   writeOverlay: () => writeOverlay
 });
 function recoverStuckStages(state) {
@@ -43675,7 +44479,7 @@ async function resolvePlan2(creds) {
   return { error: "Could not verify the license (offline and no valid cached attestation)." };
 }
 function startRun(locationId2, stage, onDone, meta = {}) {
-  activeRun2 = { locationId: locationId2, stage, running: true, lines: [] };
+  activeRun2 = { locationId: locationId2, stage, running: true, lines: [], ...meta.capability ? { capability: meta.capability } : {} };
   const run = activeRun2;
   const state = readCockpitState();
   const industry = state.accounts?.[locationId2]?.industry;
@@ -43701,7 +44505,7 @@ function startRun(locationId2, stage, onDone, meta = {}) {
     if (run.lines.length > 200) run.lines.shift();
   }, { context, name: meta.name, approvedAt: meta.approvedAt, onProgress: (p) => {
     run.progress = p;
-  } }).then(async (outcome) => {
+  }, spec: meta.spec }).then(async (outcome) => {
     try {
       const at = (/* @__PURE__ */ new Date()).toISOString();
       const shared = { at, locationId: locationId2, stage, engineVersion: outcome.engineVersion, engineModel: outcome.engineModel };
@@ -43753,7 +44557,7 @@ function startRun(locationId2, stage, onDone, meta = {}) {
     }
     run.ok = outcome.ok;
     const before = readCockpitState().clients[locationId2]?.stages;
-    onDone(outcome.ok);
+    onDone(outcome.ok, outcome);
     const after = readCockpitState().clients[locationId2]?.stages;
     if (stage === 4) await refreshAfterVerify(locationId2, meta.name || locationId2, (l) => run.lines.push(l));
     if (meta.writeReview && shouldAutoGenerateReview(before, after, Boolean(readCockpitState().reviews?.[locationId2]?.ok))) {
@@ -43833,16 +44637,164 @@ function recordLauncherOffered() {
   } catch {
   }
 }
-function withCockpitShell(page, screen) {
-  const css2 = `<style>${cockpitTokensCss({ webfont: false })}${cockpitChromeCss()}</style>`;
+function assessmentAgencyTag(ap = readAgencyProfile()) {
+  const forReport = {
+    name: ap.agencyName,
+    accent: ap.accent,
+    contact: [ap.sender?.replyTo, ap.sender?.phone, ap.website].filter(Boolean).join(" \xB7 ") || void 0,
+    method: ap.agencyOs?.method,
+    promise: ap.agencyOs?.offer?.promise,
+    guarantee: ap.agencyOs?.offer?.guarantee
+  };
+  return `<script>window.COMMAND_OS_AGENCY=${scriptJson(forReport)}</script>`;
+}
+function withCockpitShell(page, screen, extraHead = "") {
+  const css2 = `<style>${cockpitTokensCss({ webfont: false })}${cockpitChromeCss()}</style>${extraHead}`;
   const header = `${cockpitHeaderHtml(screen)}<script>${COCKPIT_TYPE_JS}</script>`;
   const withCss = page.includes("<!--COCKPIT_SHELL_CSS-->") ? page.replace("<!--COCKPIT_SHELL_CSS-->", css2) : page.replace("</head>", `${css2}</head>`);
-  return withCss.includes("<!--COCKPIT_HEADER-->") ? withCss.replace("<!--COCKPIT_HEADER-->", header) : withCss.replace(/<body([^>]*)>/, `<body$1>${header}`);
+  const withHeader = withCss.includes("<!--COCKPIT_HEADER-->") ? withCss.replace("<!--COCKPIT_HEADER-->", header) : withCss.replace(/<body([^>]*)>/, `<body$1>${header}`);
+  return withHeader.includes("</body>") ? withHeader.replace("</body>", `${cockpitShellClose()}</body>`) : withHeader + cockpitShellClose();
+}
+function clientDocsDir(locationId2, base = appDataDir()) {
+  const safeLoc = String(locationId2).replace(/[^A-Za-z0-9_-]/g, "");
+  if (!safeLoc) throw new Error("no client");
+  return path31.join(base, "clients", safeLoc, "documents");
+}
+function safeDocName(name) {
+  const cleaned = path31.basename(String(name ?? "")).replace(/[^A-Za-z0-9._ -]/g, "_").replace(/\s+/g, " ").trim();
+  const ext = path31.extname(cleaned).toLowerCase();
+  if (!cleaned || cleaned.startsWith(".") || !DOC_EXTS.has(ext)) throw new Error("Only PDF, Word (.docx/.doc), text, Markdown, RTF and CSV files can be saved here.");
+  const stem = cleaned.slice(0, cleaned.length - ext.length).slice(0, 120 - ext.length).trim();
+  return `${stem || "document"}${ext}`;
+}
+function listClientDocs(locationId2, base = appDataDir()) {
+  const dir = clientDocsDir(locationId2, base);
+  if (!fs32.existsSync(dir)) return [];
+  return fs32.readdirSync(dir).filter((f) => DOC_EXTS.has(path31.extname(f).toLowerCase())).map((f) => {
+    const st = fs32.statSync(path31.join(dir, f));
+    return { name: f, bytes: st.size, savedAt: st.mtime.toISOString() };
+  }).sort((a, b) => b.savedAt.localeCompare(a.savedAt));
+}
+function readFailureText(e) {
+  const m = /GHL API Error (\d{3})/.exec(e instanceof Error ? e.message : String(e));
+  if (m) {
+    const code = m[1];
+    if (code === "401" || code === "403") return "could not read: the key on file for this account is not allowed to";
+    if (code === "404") return "could not read: GoHighLevel has no such list on this account";
+    if (code === "429") return "could not read: GoHighLevel asked us to slow down; try again in a minute";
+    return `could not read (HTTP ${code})`;
+  }
+  return "could not read";
+}
+function logQuietly(message) {
+  try {
+    ensureAppDataDir();
+    fs32.appendFileSync(path31.join(appDataDir(), "cockpit.log"), `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}
+`);
+  } catch {
+  }
+}
+function readBody(req, res, max, onDone, tooLarge = "That request is too large.") {
+  let body = "";
+  let tooBig = false;
+  const fail = (e) => {
+    logQuietly(`request handler: ${e instanceof Error ? e.stack ?? e.message : String(e)}`);
+    try {
+      if (!res.headersSent) res.writeHead(500, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ok: false, error: "That did not finish. The detail is in cockpit.log." }));
+    } catch {
+    }
+  };
+  req.on("data", (chunk) => {
+    if (tooBig) return;
+    body += chunk;
+    if (body.length > max) {
+      tooBig = true;
+      body = "";
+      res.writeHead(413, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ok: false, error: tooLarge }));
+      req.resume?.();
+    }
+  });
+  req.on("end", () => {
+    if (tooBig) return;
+    try {
+      const r = onDone(body);
+      if (r && typeof r.catch === "function") r.catch(fail);
+    } catch (e) {
+      fail(e);
+    }
+  });
+}
+function memberFacingError(e, own = []) {
+  const raw = e instanceof Error ? e.message : String(e);
+  return own.includes(raw) ? raw : readFailureText(e);
+}
+function insideDir(dir, p) {
+  try {
+    const real = fs32.realpathSync(p);
+    const base = fs32.realpathSync(dir);
+    return real === base || real.startsWith(base + path31.sep);
+  } catch {
+    return false;
+  }
 }
-function html(roster, seatToken) {
-  return `${cockpitHeadHtml("Command OS \u2014 GHL Command", { extraCss: `
+function uniqueDocName(dir, name) {
+  const ext = path31.extname(name), stem = name.slice(0, name.length - ext.length);
+  let candidate = name;
+  for (let n = 2; fs32.existsSync(path31.join(dir, candidate)); n++) candidate = `${stem} (${n})${ext}`;
+  return candidate;
+}
+function writeDocAtomically(dir, name, bytes) {
+  fs32.mkdirSync(dir, { recursive: true, mode: 448 });
+  const finalName = uniqueDocName(dir, name);
+  const tmp = path31.join(dir, `.${finalName}.${process.pid}.tmp`);
+  const fd = fs32.openSync(tmp, fs32.constants.O_WRONLY | fs32.constants.O_CREAT | fs32.constants.O_EXCL | (fs32.constants.O_NOFOLLOW ?? 0), 384);
+  try {
+    fs32.writeSync(fd, bytes);
+    fs32.fsyncSync(fd);
+  } finally {
+    fs32.closeSync(fd);
+  }
+  const dest = path31.join(dir, finalName);
+  try {
+    if (fs32.lstatSync(dest).isSymbolicLink()) {
+      fs32.unlinkSync(tmp);
+      throw new Error("that name is taken by a link");
+    }
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+  }
+  fs32.renameSync(tmp, dest);
+  return finalName;
+}
+function readableAccount(locationId2, roster = currentRosterRef(), state = readCockpitState()) {
+  if (!locationId2 || !roster.some((r) => r.locationId === locationId2)) return false;
+  const t = state.accounts?.[locationId2]?.type;
+  return t !== "hidden" && t !== "template";
+}
+function html(roster, seatToken, screen = "board", cap) {
+  const capForPage = cap ? { ...cap, groupLabel: CAPABILITY_GROUPS.find((g) => g.key === cap.group)?.label ?? cap.group, noBuild: NO_BUILD_BUTTON.has(cap.key) } : null;
+  return `${cockpitHeadHtml(cap ? `${cap.label} \u2014 Command OS` : BOARD_TITLES[screen] ?? BOARD_TITLES.board, { extraCss: `
 
   main{max-width:56rem;margin:1.4rem auto 4rem;padding:0 1rem}
+  .screen-head{margin:0 0 1.2rem}.screen-head h1{font-family:var(--font-display);font-weight:500;font-size:1.6rem;color:var(--heading);margin:0 0 .3rem}
+  .screen-head .lead{color:var(--ink-2);font-size:var(--fs-body);margin:0;max-width:40rem}
+  .home{display:grid;grid-template-columns:repeat(auto-fit,minmax(14rem,1fr));gap:1rem}
+  .home .tile{display:block;padding:1rem 1.1rem;color:inherit;text-decoration:none}
+  .home .tile:hover{border-color:var(--gold);text-decoration:none}
+  .home .big{font-family:var(--font-display);font-size:2.1rem;line-height:1.1;color:var(--heading);margin:.25rem 0 .35rem}
+  .home .tile p{color:var(--ink-2);font-size:var(--fs-sm);margin:0}
+  .home .go{display:inline-block;margin-top:.7rem;font-weight:600;font-size:var(--fs-sm);color:var(--gold-light)}
+  a.newbtn{display:inline-flex;align-items:center;text-decoration:none}
+  .capsel{font:inherit;font-size:var(--fs-body);padding:.45rem .7rem;border-radius:var(--radius-sm);border:1px solid var(--line);background:var(--surface);color:var(--heading);min-width:16rem}
+  .cap-reads .cap-row{padding:.35rem 0;border-bottom:1px solid var(--line);font-size:var(--fs-body)}.cap-reads .cap-row:last-of-type{border-bottom:0}
+  .cap-words{margin:0;padding:.8rem 1rem;border-left:3px solid var(--gold);background:var(--bg-2);border-radius:var(--radius-sm);font-size:var(--fs-lg);line-height:1.5;color:var(--heading)}
+  .cap-log{margin:.8rem 0 0;padding:.8rem 1rem;background:var(--bg-2);border-radius:var(--radius-sm);font-size:var(--fs-sm);line-height:1.5;white-space:pre-wrap;max-height:22rem;overflow:auto}
+  a.intakebtn{text-decoration:none;display:inline-flex;align-items:center}
+  .muted{color:var(--ink-2)}.small{font-size:var(--fs-sm)}
+  .idrop{border:1px dashed var(--line);border-radius:var(--radius-sm);padding:.9rem 1rem;color:var(--ink-2);font-size:var(--fs-sm);background:var(--surface)}
+  .idocs{margin-top:.6rem}.idoc{display:flex;align-items:center;justify-content:space-between;gap:.6rem;padding:.45rem 0;border-bottom:1px solid var(--line);font-size:var(--fs-sm)}.idoc:last-child{border-bottom:0}
   footer{color:var(--ink-3);font-size:var(--fs-sm);text-align:center;margin:2rem 0;padding:0 1rem}
 
   /* \u2500\u2500 Building blocks (hub) \u2500\u2500 */
@@ -43975,7 +44927,7 @@ function html(roster, seatToken) {
   .ifield label{display:block;font-size:var(--fs-sm);color:var(--ink-2);margin-bottom:.2rem}
   .ifield input,.ifield textarea,.ifield select{width:100%;box-sizing:border-box;padding:.5rem .65rem;border:1px solid var(--line);border-radius:var(--radius-sm);font-size:var(--fs-sm);font-family:inherit;background:var(--surface)}
   .ifield.prefilled input,.ifield.prefilled textarea{border-color:var(--ok);background:var(--ok-soft)}
-  .ifield.prefilled label:after{content:" \xB7 from your call";color:var(--ok);font-weight:600}
+  .ifield.prefilled label:after{content:" \xB7 from " attr(data-src);color:var(--ok);font-weight:600}
   .istatus{font-size:var(--fs-label);font-weight:700;letter-spacing:.04em;padding:.14rem .5rem;border-radius:999px;background:var(--bg-2);color:var(--ink-2);vertical-align:middle}
   .istatus.received{background:var(--ok-soft);color:var(--ok)}.istatus.sent{background:var(--gold-soft);color:var(--gold-ink)}
   .iq{font-size:1.05rem;color:var(--heading);font-weight:600;margin:.3rem 0 .1rem}
@@ -44002,10 +44954,11 @@ function html(roster, seatToken) {
     .stage{min-width:4.2rem}
   }
   @media (prefers-reduced-motion: reduce){*{transition:none !important}}
-` })}<body>
-${cockpitHeaderHtml("board")}
+` })}<body data-screen="${screen}"${cap ? ` data-capability="${cap.key}"` : ""}>
+${cockpitHeaderHtml(screen, { capability: cap?.key })}
 <main id="main">Loading\u2026</main>
-<footer>Command OS runs only on this computer \u2014 your client accounts and their logins never leave it.<br>Steps marked "your call" are yours to mark, and your name goes on them. The steps Command OS runs are settled by the run, never by a click.</footer>
+<footer>Command OS runs on this computer, and your client accounts' logins stay on it. What Claude reads or writes for you goes through your own Claude account and to GoHighLevel. A pre-fill from a web address or a call recorder also fetches from that site or that recorder. No copy comes to us.<br>Steps marked "your call" are yours to mark, and your name goes on them. The steps Command OS runs are settled by the run, never by a click.</footer>
+${cockpitShellClose()}
 <script>
 /* \u2500\u2500 Seat key bootstrap (PRD row 0) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
    This page was handed out by the copy of Command OS running on this computer,
@@ -44017,7 +44970,7 @@ ${cockpitHeaderHtml("board")}
    every call on the page is covered, including ones added later. Same-origin
    only: an absolute or protocol-relative URL goes out untouched, so the key can
    never ride along to somebody else's server. */
-const SEAT_HEADER=${JSON.stringify(SEAT_TOKEN_HEADER)};const SEAT=${JSON.stringify(seatToken)};
+const SEAT_HEADER=${scriptJson(SEAT_TOKEN_HEADER)};const SEAT=${scriptJson(seatToken)};
 (function(){var raw=window.fetch.bind(window);
  window.fetch=function(input,init){
   var u=String(typeof input==="string"?input:(input&&input.url)||"");
@@ -44026,17 +44979,20 @@ const SEAT_HEADER=${JSON.stringify(SEAT_TOKEN_HEADER)};const SEAT=${JSON.stringi
   var opts={};for(var k in (init||{}))opts[k]=init[k];
   var h=new Headers((init&&init.headers)||{});h.set(SEAT_HEADER,SEAT);opts.headers=h;
   return raw(input,opts)};})();
-const STAGES=${JSON.stringify(STAGES2)};const ROSTER=${JSON.stringify(roster)};
-const SANDBOX=${JSON.stringify(Object.keys(SANDBOX_ALLOWLIST))};const POWERED=${JSON.stringify(Object.keys(STAGE_SPECS).map(Number))};
-const GATES=${JSON.stringify(HUMAN_GATE_STAGES)};let PROTECTED=${JSON.stringify(PROTECTED_LOCATIONS)};
+const STAGES=${scriptJson(STAGES2)};const ROSTER=${scriptJson(roster)};
+const SANDBOX=${scriptJson(Object.keys(SANDBOX_ALLOWLIST))};const POWERED=${scriptJson(Object.keys(STAGE_SPECS).map(Number))};
+const GATES=${scriptJson(HUMAN_GATE_STAGES)};let PROTECTED=${scriptJson(PROTECTED_LOCATIONS)};
 const TYPES=["client","sandbox","template","hidden"];
 const TYPE_LABELS={client:"Client",sandbox:"Practice sandbox",template:"Template",hidden:"Hidden"};
 const LABELS=["Intake","Brief","Approve","Build","Verify","Manual tasks","Go-live"];
 const STATUS_TEXT={pending:"not started",in_progress:"in progress",done:"done"};
 const NEXT={pending:"in_progress",in_progress:"done",done:"pending"};
 let polling=false,query="",showParked=false,showNew=false,snapshots=null;
+/* Which of the board's four screens this page is: board (overview), new, queue, clients. */
+const SCREEN=document.body.getAttribute("data-screen")||"board";
+const CAP=${scriptJson(capForPage)};const HUB=${scriptJson(HUB_URL)};
 const INDUSTRIES=["Med spa","Clinic / practice","Coach / consultant","Local service","Ecommerce","Agency","Other"];
-const INDUSTRIES2=${JSON.stringify(INDUSTRY_PACKS.map((p) => ({ slug: p.slug, label: p.label })))};
+const INDUSTRIES2=${scriptJson(INDUSTRY_PACKS.map((p) => ({ slug: p.slug, label: p.label })))};
 /* One account at a time (Jerry, 2026-08-26: "way too busy\u2026 tempting to work on multiple
    accounts at once"). One card is ever expanded; every other account is a one-line row. */
 let activeId=null;try{activeId=localStorage.getItem("cmdos-active")||null}catch(e){}
@@ -44044,7 +45000,7 @@ function setActive(id){activeId=id;try{localStorage.setItem("cmdos-active",id)}c
 function initials(name){const p=String(name||"").trim().split(/\\s+/);return ((p[0]||"?")[0]+(p[1]?p[1][0]:"")).toUpperCase()}
 function typeOf(state,id){return (state.accounts&&state.accounts[id]&&state.accounts[id].type)||(SANDBOX.includes(id)?"sandbox":"client")}
 function activityScore(state,id){const c=state.clients[id];if(!c)return 0;return c.stages.some(s=>s!=="pending")?1:0}
-async function load(){const s=await(await fetch("/api/state")).json();const r=await(await fetch("/api/run/status")).json();await loadQueue();render(s,r);
+async function load(){const s=await(await fetch("/api/state")).json();const r=await(await fetch("/api/run/status")).json();await loadQueue();if(SCREEN==="new"&&!snapshots){try{const sr=await(await fetch("/api/snapshots")).json();snapshots=sr.ok?sr.snapshots:[]}catch(e){snapshots=[]}}render(s,r);
  if(r.running&&!polling){polling=true;const t=setInterval(async()=>{if(userIsBusy())return;const rr=await(await fetch("/api/run/status")).json();const ss=await(await fetch("/api/state")).json();await loadQueue();render(ss,rr);if(!rr.running){clearInterval(t);polling=false}},1500)}}
 // Heartbeat (2026-08-25): the fast poller above only starts for a run THIS page saw begin. A page that was
 // already open, or opened mid-run, or a run kicked off from another seat/the API, showed "pending" until a
@@ -44092,7 +45048,8 @@ function intakePanel(){const d=document.createElement("div");d.className="ncform
  reset.onclick=()=>{if(confirm("Remove all your customizations and go back to the base question set?"))saveOverlay({})};
  d.appendChild(reset);
  return d}
-let iOpen={},iData={},iMode={},iAnswers={},iIdx={},iPre={},iSub={},oOpen={};
+let iOpen={},iData={},iMode={},iAnswers={},iIdx={},iPre={},iSub={},oOpen={},iDocs={},iPreSrc={};
+async function iDocsLoad(id){try{const r=await(await fetch("/api/intake-documents?locationId="+encodeURIComponent(id))).json();iDocs[id]=(r&&r.files)||[]}catch(e){iDocs[id]=[]}render(lastState,lastRun)}
 // What came back, written for the operator (oc.plain). The raw report the stage produced stays
 // behind "Details for the operator" (2026-08-26: "The Verify report was written for you, not them").
 function outcomePanel(id,i,state){const oc=(state.outcomes||{})[id+":"+i];if(!oc)return null;
@@ -44115,7 +45072,7 @@ function outcomePanel(id,i,state){const oc=(state.outcomes||{})[id+":"+i];if(!oc
 async function iLoad(id){const r=await(await fetch("/api/client-intake?locationId="+id)).json();iData[id]=r;
  if(r.ok&&!iAnswers[id]){iAnswers[id]={}}render(lastState,lastRun)}
 function iField(id,q,val,prefilled){const w=document.createElement("div");w.className="ifield"+(prefilled?" prefilled":"");
- const l=document.createElement("label");l.textContent=q.label+(q.required?" *":"");w.appendChild(l);
+ const l=document.createElement("label");l.textContent=q.label+(q.required?" *":"");if(prefilled)l.setAttribute("data-src",iPreSrc[id]||"your call");w.appendChild(l);
  let inp;
  if(q.multi&&q.options&&q.options.length){
   // Several answers allowed (the GHL field is multi-choice) \u2014 checkboxes, stored as a list. (2026-08-25, finding 8)
@@ -44135,13 +45092,13 @@ function iField(id,q,val,prefilled){const w=document.createElement("div");w.clas
  w.appendChild(inp);return w}
 function intakeWorkspace(id,name){const d=iData[id];const box=document.createElement("div");box.className="ipanel";
  if(!d){box.textContent="Loading intake\u2026";return box}
- if(!d.ok){box.innerHTML="<h3>Intake</h3><p style='font-size:var(--fs-sm);color:var(--warn)'>"+d.error+"</p>";return box}
- box.innerHTML="<h3>Intake for "+name+"</h3>";
+ if(!d.ok){box.innerHTML="<h3>Intake</h3><p style='font-size:var(--fs-sm);color:var(--warn)'>"+escT(d.error)+"</p>";return box}
+ box.innerHTML="<h3>Intake for "+escT(name)+"</h3>";
  const sub=document.createElement("p");sub.className="small muted";sub.style.margin=".1rem 0 .2rem";
  sub.textContent=d.status==="received"?((d.channel==="form"?"Submitted through the GHL form":"Saved from Command OS")+(d.answeredAt?" \xB7 "+new Date(d.answeredAt).toLocaleString():"")):d.status==="sent"?"Link sent \u2014 waiting on the client":"Ready to complete";
  box.appendChild(sub);
  const ch=document.createElement("div");ch.className="ichoice";
- const modes=[["fill","Fill it here"],["interview","Interview mode"],["transcript","From a call"],["send","Send to client"],["link","Copy link"]];
+ const modes=[["fill","Fill it here"],["interview","Interview mode"],["transcript","From a call or a document"],["send","Send to client"],["link","Copy link"]];
  for(const [k,label] of modes){const b=document.createElement("button");b.textContent=label;if(iMode[id]===k)b.className="on";
   b.onclick=async()=>{if(k==="link"){try{await navigator.clipboard.writeText(d.formUrl);b.textContent="Copied \u2713";setTimeout(()=>render(lastState,lastRun),1200)}catch(e){prompt("Copy this link:",d.formUrl)}return}
    iMode[id]=iMode[id]===k?null:k;iIdx[id]=0;render(lastState,lastRun)};
@@ -44162,7 +45119,7 @@ function intakeWorkspace(id,name){const d=iData[id];const box=document.createEle
  if(mode==="transcript"){const w=document.createElement("div");
   const tabs=document.createElement("div");tabs.className="ichoice";tabs.style.margin=".2rem 0 .6rem";
   iSub[id]=iSub[id]||"paste";
-  for(const [k,lab] of [["paste","Paste / drop file"],["url","From a link"],["recorder","From my recorder"]]){
+  for(const [k,lab] of [["paste","Paste a transcript"],["doc","A document (PDF, Word, text)"],["url","From a link"],["recorder","From my recorder"]]){
    const tb=document.createElement("button");tb.textContent=lab;if(iSub[id]===k)tb.className="on";
    tb.onclick=()=>{iSub[id]=k;render(lastState,lastRun)};tabs.appendChild(tb)}
   w.appendChild(tabs);
@@ -44179,13 +45136,13 @@ function intakeWorkspace(id,name){const d=iData[id];const box=document.createEle
    else if(sub==="recorder"){if(!recIn.value.trim())return alert("Tell it which recording to grab");payload.instruction=recIn.value.trim()}
    else {if(!ta.value.trim())return alert("Paste or drop the transcript first");payload.transcript=ta.value}
    b.disabled=true;b.textContent="Reading the call\u2026";
-   st.textContent=sub==="paste"?"Your own Claude is reading this locally \u2014 nothing is uploaded anywhere."
-    :sub==="url"?"Your own Claude is fetching that link \u2014 it can read the web but nothing else."
-    :"Your own Claude is searching your connected recorder (Plaud, Otter, Fireflies\u2026) for that call.";
+   st.textContent=sub==="paste"?"This text goes to your own Claude account to be read, and nowhere else."
+    :sub==="url"?"Your own Claude fetches that link, so that site sees the request; the page text then goes to your Claude account and nowhere else."
+    :"Your own Claude asks the recorder you connected (Plaud, Otter, Fireflies\u2026) for that call; the transcript then goes to your Claude account and nowhere else.";
    const r=await(await fetch("/api/intake-prefill",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(payload)})).json();
    b.disabled=false;b.textContent="Fill the intake from this";
    if(!r.ok){st.textContent="Could not read that: "+(r.error||"unknown");return}
-   iAnswers[id]=Object.assign({},iAnswers[id],r.answers);iPre[id]=Object.keys(r.answers);
+   iAnswers[id]=Object.assign({},iAnswers[id],r.answers);iPre[id]=Object.keys(r.answers);iPreSrc[id]=sub==="url"?"the link":"your call";
    iMode[id]="fill";render(lastState,lastRun)};
   const urlIn=document.createElement("input");urlIn.placeholder="https://\u2026 a shared transcript or recording page";
   urlIn.style.cssText="width:100%;box-sizing:border-box;padding:.6rem;border:1px solid var(--line);border-radius:7px;font-size:var(--fs-sm);background:var(--surface)";
@@ -44193,13 +45150,45 @@ function intakeWorkspace(id,name){const d=iData[id];const box=document.createEle
   recIn.style.cssText=urlIn.style.cssText;
   const hint=document.createElement("p");hint.className="small muted";hint.style.margin=".4rem 0 0";
   if(iSub[id]==="paste"){w.appendChild(ta)}
+  else if(iSub[id]==="doc"){
+   /* A document the client sent: PDF, Word or text. Stored with the client on this
+      computer; your own Claude reads it here and fills the intake from it. */
+   const docs=iDocs[id];
+   if(docs===undefined){iDocs[id]=[];iDocsLoad(id)}
+   const drop=document.createElement("div");drop.className="idrop";
+   drop.textContent="Drop a PDF, Word or text file here, or choose one";
+   const fi=document.createElement("input");fi.type="file";fi.accept=".pdf,.docx,.doc,.md,.txt,.rtf,.csv";fi.style.display="block";fi.style.marginTop=".5rem";
+   const up=async(f)=>{if(!f)return;if(f.size>20*1024*1024){alert("That file is over 20 MB. Split it or export the part that matters.");return}
+    drop.textContent="Saving "+f.name+"\u2026";
+    const b64=await new Promise((res,rej)=>{const rd=new FileReader();rd.onload=()=>res(String(rd.result).split(",")[1]||"");rd.onerror=rej;rd.readAsDataURL(f)});
+    const r=await(await fetch("/api/intake-document",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({locationId:id,name:f.name,base64:b64})})).json();
+    if(!r.ok){alert(r.error||"Could not save that file");drop.textContent="Drop a PDF, Word or text file here, or choose one";return}
+    iDocs[id]=r.files||[];render(lastState,lastRun)};
+   drop.ondragover=(e)=>{e.preventDefault();drop.style.borderColor="var(--gold)"};
+   drop.ondragleave=()=>{drop.style.borderColor="var(--line)"};
+   drop.ondrop=(e)=>{e.preventDefault();drop.style.borderColor="var(--line)";up(e.dataTransfer.files[0])};
+   fi.onchange=()=>up(fi.files[0]);
+   drop.appendChild(fi);w.appendChild(drop);
+   const list=document.createElement("div");list.className="idocs";
+   if(!docs||!docs.length){const p=document.createElement("p");p.className="small muted";p.style.margin=".5rem 0 0";p.textContent="No documents saved for this client yet.";list.appendChild(p)}
+   for(const f of (docs||[])){const row=document.createElement("div");row.className="idoc";
+    const nm=document.createElement("span");nm.textContent=f.name+" \xB7 "+Math.max(1,Math.round(f.bytes/1024))+" KB";row.appendChild(nm);
+    const rb=document.createElement("button");rb.className="intakebtn";rb.textContent="Fill the intake from this";
+    rb.onclick=async()=>{rb.disabled=true;rb.textContent="Reading it\u2026";st.textContent="The text of "+f.name+" goes to your own Claude account to be read, and nowhere else.";
+     const r=await(await fetch("/api/intake-prefill",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({locationId:id,labels:d.questions.map(q=>q.label),file:f.name})})).json();
+     rb.disabled=false;rb.textContent="Fill the intake from this";
+     if(!r.ok){st.textContent="Could not read that: "+(r.error||"unknown");return}
+     iAnswers[id]=Object.assign({},iAnswers[id],r.answers);iPre[id]=Object.keys(r.answers);iPreSrc[id]="the document";iMode[id]="fill";render(lastState,lastRun)};
+    row.appendChild(rb);list.appendChild(row)}
+   w.appendChild(list);
+   hint.textContent="Stored with this client on this computer. When you press the button, the document's text goes to your own Claude account to be read, and nowhere else. Only what it does not answer is left for you.";w.appendChild(hint);w.appendChild(st)}
   else if(iSub[id]==="url"){w.appendChild(urlIn);hint.textContent="Works for links that don't need a login. Behind a login? Use \\u201cFrom my recorder\\u201d.";w.appendChild(hint)}
   else {w.appendChild(recIn);hint.textContent="Uses the recorder you already have connected to Claude (Plaud, Otter, Fireflies, Zoom). Nothing new to set up if it's already there.";w.appendChild(hint)}
-  w.appendChild(b);w.appendChild(st);box.appendChild(w)}
+  if(iSub[id]!=="doc"){w.appendChild(b);w.appendChild(st)}box.appendChild(w)}
  if(mode==="fill"||mode==="interview"){
   const qs=d.questions;const ans=iAnswers[id]||{};const pre=iPre[id]||[];
   if(pre.length&&mode==="fill"){const banner=document.createElement("div");banner.className="pendpanel";
-   banner.textContent="\u2713 "+pre.length+" answers pre-filled from your call. Correct anything wrong; "+(qs.length-pre.length)+" still need you.";box.appendChild(banner)}
+   banner.textContent="\u2713 "+pre.length+" answers pre-filled from "+(iPreSrc[id]||"your call")+". Correct anything wrong; "+(qs.length-pre.length)+" still need you.";box.appendChild(banner)}
   if(mode==="interview"){const i=Math.min(iIdx[id]||0,qs.length-1);const q=qs[i];
    const prog=document.createElement("p");prog.className="small muted";prog.style.margin=".2rem 0";prog.textContent="Question "+(i+1)+" of "+qs.length+" \xB7 "+q.sectionLabel;
    const qq=document.createElement("div");qq.className="iq";qq.textContent=q.label;
@@ -44250,8 +45239,10 @@ async function rLoad(id){const r=await(await fetch("/api/review?locationId="+id)
 // which wiped the button's "Thinking it through\u2026" \u2014 a click looked like nothing happened. The in-flight flag
 // lives outside the card so re-renders keep it; a failure is shown in the panel instead of vanishing.
 function reviewBusy(id,run){return Boolean(rBusy[id])||Boolean(run&&run.running&&run.reviewing&&run.locationId===id)}
+/* The review is written by the model from the client's intake answers, so every value in it is untrusted text (Codex, round 2). */
+function escT(s){return String(s==null?"":s).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;")}
 function reviewPanel(id,name,state,run){const r=rData[id];const d=document.createElement("div");d.className="review";
- d.innerHTML="<h3>Blueprint Review \u2014 "+name+"</h3>";
+ d.innerHTML="<h3>Blueprint Review \u2014 "+escT(name)+"</h3>";
  const busy=reviewBusy(id,run);
  const gen=document.createElement("button");gen.className="runbtn";gen.style.marginTop=".4rem";
  gen.textContent=busy?"Thinking it through\u2026":(r&&r.ok)?"Regenerate":"Generate the review";gen.disabled=busy;
@@ -44268,24 +45259,24 @@ function reviewPanel(id,name,state,run){const r=rData[id];const d=document.creat
  if(r.headline){const h=document.createElement("div");h.className="headline";h.textContent=r.headline;d.appendChild(h)}
  if(r.ica){const s1=document.createElement("div");s1.innerHTML="<h4>Who they actually sell to</h4>";
   const p1=document.createElement("p");p1.textContent=r.ica.who||"";s1.appendChild(p1);
-  if((r.ica.painPoints||[]).length){const p2=document.createElement("p");p2.innerHTML="<b>Pain:</b> "+r.ica.painPoints.join(" \xB7 ");s1.appendChild(p2)}
-  if((r.ica.objections||[]).length){const p3=document.createElement("p");p3.innerHTML="<b>Objections:</b> "+r.ica.objections.join(" \xB7 ");s1.appendChild(p3)}
-  if(r.ica.buyingTrigger){const p4=document.createElement("p");p4.innerHTML="<b>Buys when:</b> "+r.ica.buyingTrigger;s1.appendChild(p4)}
-  if(r.ica.whereTheyAre){const p5=document.createElement("p");p5.innerHTML="<b>Found at:</b> "+r.ica.whereTheyAre;s1.appendChild(p5)}
+  if((r.ica.painPoints||[]).length){const p2=document.createElement("p");p2.innerHTML="<b>Pain:</b> "+r.ica.painPoints.map(escT).join(" \xB7 ");s1.appendChild(p2)}
+  if((r.ica.objections||[]).length){const p3=document.createElement("p");p3.innerHTML="<b>Objections:</b> "+r.ica.objections.map(escT).join(" \xB7 ");s1.appendChild(p3)}
+  if(r.ica.buyingTrigger){const p4=document.createElement("p");p4.innerHTML="<b>Buys when:</b> "+escT(r.ica.buyingTrigger);s1.appendChild(p4)}
+  if(r.ica.whereTheyAre){const p5=document.createElement("p");p5.innerHTML="<b>Found at:</b> "+escT(r.ica.whereTheyAre);s1.appendChild(p5)}
   d.appendChild(s1)}
- if(r.offer){const s2=document.createElement("div");s2.innerHTML='<h4>The offer <span class="score">'+(r.offer.score||0)+'/10</span></h4>';
+ if(r.offer){const s2=document.createElement("div");s2.innerHTML='<h4>The offer <span class="score">'+(Number(r.offer.score)||0)+'/10</span></h4>';
   for(const [k,lab] of [["dreamOutcome","Worth wanting"],["believability","Believable"],["speed","Speed to result"],["effort","Effort asked"]]){
-   if(r.offer[k]){const p=document.createElement("p");p.innerHTML="<b>"+lab+":</b> "+r.offer[k];s2.appendChild(p)}}
-  if(r.offer.biggestLever){const p=document.createElement("p");p.innerHTML="<b>Biggest lever:</b> "+r.offer.biggestLever;s2.appendChild(p)}
+   if(r.offer[k]){const p=document.createElement("p");p.innerHTML="<b>"+escT(lab)+":</b> "+escT(r.offer[k]);s2.appendChild(p)}}
+  if(r.offer.biggestLever){const p=document.createElement("p");p.innerHTML="<b>Biggest lever:</b> "+escT(r.offer.biggestLever);s2.appendChild(p)}
   if(r.offer.recommendedOffer){const p=document.createElement("p");p.className="headline";p.textContent="Run this instead: "+r.offer.recommendedOffer;s2.appendChild(p)}
   d.appendChild(s2)}
- if((r.gaps||[]).length){const s3=document.createElement("div");s3.innerHTML="<h4>What's missing ("+r.gaps.length+")</h4>";
+ if((r.gaps||[]).length){const s3=document.createElement("div");s3.innerHTML="<h4>What's missing ("+(Number(r.gaps.length)||0)+")</h4>";
   for(const g of r.gaps){const gg=document.createElement("div");gg.className="gap "+(g.priority||"soon");
-   gg.innerHTML="<b>"+g.title+"</b><span>"+(g.cost?g.cost+" \u2014 ":"")+(g.fix||"")+"</span>";s3.appendChild(gg)}
+   gg.innerHTML="<b>"+escT(g.title)+"</b><span>"+(g.cost?escT(g.cost)+" \u2014 ":"")+escT(g.fix||"")+"</span>";s3.appendChild(gg)}
   d.appendChild(s3)}
  if((r.build||[]).length){const s4=document.createElement("div");s4.innerHTML="<h4>What we build</h4>";
   for(const b of r.build){const bb=document.createElement("div");bb.className="buildline";
-   bb.innerHTML=b.item+"<em>"+(b.because||"")+"</em>";s4.appendChild(bb)}
+   bb.innerHTML=escT(b.item)+"<em>"+escT(b.because||"")+"</em>";s4.appendChild(bb)}
   d.appendChild(s4)}
  if((r.unknowns||[]).length){const s5=document.createElement("div");s5.innerHTML="<h4>Ask them next</h4>";
   const p=document.createElement("p");p.textContent=r.unknowns.join(" \xB7 ");s5.appendChild(p);d.appendChild(s5)}
@@ -44318,7 +45309,7 @@ function pendingCard(c,state){const div=document.createElement("div");div.classN
  div.appendChild(head);
  const p=document.createElement("div");p.className="pendpanel";
  p.innerHTML="<strong>Account created \u2014 one 2-minute step left.</strong> GHL requires a key made inside the new sub-account:"+
-  "<ol><li>Open the new sub-account in GHL (switch into <em>"+c.name+"</em>)</li>"+
+  "<ol><li>Open the new sub-account in GHL (switch into <em>"+escT(c.name)+"</em>)</li>"+
   "<li>Settings \u2192 Private Integrations \u2192 Create New Integration \u2192 name it anything \u2192 Scopes: <strong>Select all</strong> \u2192 Create \u2192 Confirm</li>"+
   "<li>Copy the <code>pit-</code> key and paste it below</li></ol>";
  const inp=document.createElement("input");inp.placeholder="pit-\u2026";p.appendChild(inp);
@@ -44578,7 +45569,7 @@ function proofLine(p){const d=document.createElement("div");
  const when=new Date(p.at).toLocaleDateString(undefined,{month:"short",day:"numeric"});
  d.textContent=p.step+" \u2014 "+(bad?(p.issues.length+" to sort out: "+shorten(p.issues[0],120)):shorten(p.summary,150))+" \xB7 "+when;
  return d}
-function queueOpen(id){setActive(id);try{window.scrollTo({top:0,behavior:"smooth"})}catch(e){}}
+function queueOpen(id){activeId=id;try{localStorage.setItem("cmdos-active",id)}catch(e){};if(SCREEN!=="clients"){location.href="/clients";return}setActive(id);try{window.scrollTo({top:0,behavior:"smooth"})}catch(e){}}
 function queueRow(it){const row=document.createElement("div");row.className="q-row";
  row.setAttribute("role","button");row.tabIndex=0;
  const pill=document.createElement("span");pill.className=it.needs==="you"?"state warn":"state live";
@@ -44621,7 +45612,8 @@ function queueBlock(match){const q=queueData;if(!q||!q.ok)return null;
  const live=items.filter(i=>i.rank<6),later=items.filter(i=>i.rank>=6);
  const fin=(q.finished||[]).filter(f=>match({name:f.clientName,locationId:f.locationId}));
  const head=document.createElement("div");head.className="q-head";
- const eb=document.createElement("div");eb.className="eyebrow";eb.textContent="What needs doing";head.appendChild(eb);
+ head.id="queue";
+ const eb=document.createElement("div");eb.className="eyebrow";eb.textContent="Waiting on you";head.appendChild(eb);
  if(q.counts&&q.counts.you){const c=document.createElement("span");c.className="chip space";
   c.textContent=q.counts.you+" waiting on you";head.appendChild(c)}
  const who=document.createElement("span");who.className="q-who";
@@ -44657,31 +45649,114 @@ function syncReviews(state){const revs=(state&&state.reviews)||{};
   rData[id]=rv;
   if(!lastState){rSeen[id]=true}
   else if(rv&&rv.ok&&!had&&briefDone&&!rSeen[id]){rOpen[id]=true;rSeen[id]=true}}}
+/* \u2500\u2500 One capability, for the open client (Jerry, 2026-09-05) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */
+let capReads=null,capReadsFor="",capRun=null,capPoll=null;
+function capClients(state){return ROSTER.filter(c=>["client","sandbox"].includes(typeOf(state,c.locationId)))}
+function capActive(state){const cs=capClients(state);let act=(activeId&&cs.some(c=>c.locationId===activeId))?activeId:null;if(!act&&cs.length)act=cs[0].locationId;return cs.find(c=>c.locationId===act)||null}
+async function loadCapReads(id){capReadsFor=id;capReads=null;try{capReads=await(await fetch("/api/capability?key="+encodeURIComponent(CAP.key)+"&locationId="+encodeURIComponent(id))).json()}catch(e){capReads={ok:false,error:String(e)}}if(lastState)render(lastState,lastRun)}
+function renderCapability(m,state,run){
+ const c=capActive(state);
+ const head=document.createElement("div");head.className="eyebrow";head.textContent=CAP.groupLabel;m.appendChild(head);
+ m.appendChild(screenHead(CAP.label,CAP.what));
+ if(!c){const d=document.createElement("div");d.className="client";d.innerHTML="<h2>No client account is open</h2><p style='margin-top:.4rem'>Register one in GHL Command or <a href='/new'>build a client account</a>, then come back here.</p>";m.appendChild(d);return}
+ /* Who this is for */
+ const who=document.createElement("div");who.className="toolbar";
+ const lbl=document.createElement("span");lbl.className="q-who";lbl.textContent="For ";who.appendChild(lbl);
+ const sel=document.createElement("select");sel.className="capsel";for(const cl of capClients(state)){const o=document.createElement("option");o.value=cl.locationId;o.textContent=cl.name;if(cl.locationId===c.locationId)o.selected=true;sel.appendChild(o)}
+ sel.onchange=()=>{capReads=null;capReadsFor="";setActive(sel.value)};who.appendChild(sel);m.appendChild(who);
+ const sc=document.getElementById("side-client");if(sc)sc.textContent=c.name;
+ /* Already in this account */
+ const eb=document.createElement("div");eb.className="eyebrow";eb.textContent="Already in this account";m.appendChild(eb);
+ const card=document.createElement("div");card.className="card pad cap-reads";
+ if(!CAP.reads.length){card.innerHTML="<p class='muted'>Nothing here is read back yet; the page cannot tell you what this account already has for this job. Ask Claude with the words below and it reads it live.</p>"}
+ else if(capReadsFor!==c.locationId){card.innerHTML="<p class='muted'>Reading this account\u2026</p>";loadCapReads(c.locationId)}
+ else if(!capReads||!capReads.ok){card.innerHTML="<p class='muted'></p>";card.querySelector("p").textContent=(capReads&&capReads.error)?capReads.error:"Could not read this account."}
+ else{for(const r of capReads.reads){const row=document.createElement("div");row.className="cap-row";
+   const n=document.createElement("b");n.textContent=r.status==="ok"?(r.count+" "+r.label):r.label;row.appendChild(n);
+   const t=document.createElement("span");t.className="muted";t.textContent=r.status==="ok"?(r.names.length?": "+r.names.slice(0,8).join(" \xB7 ")+(r.names.length>8?" \u2026":""):(r.count?"":": none yet")):(" \u2014 could not read: "+(r.reason||"unavailable"));row.appendChild(t);card.appendChild(row)}
+   if(CAP.blueprint){const bp=document.createElement("p");bp.className="muted";bp.style.marginTop=".6rem";bp.textContent="A full Blueprint build sets up: "+CAP.blueprint;card.appendChild(bp)}}
+ m.appendChild(card);
+ /* Do it now */
+ const eb2=document.createElement("div");eb2.className="eyebrow";eb2.textContent="Do it now";m.appendChild(eb2);
+ const doc=document.createElement("div");doc.className="card pad";
+ const words=CAP.says.split("{client}").join(c.name);
+ const q=document.createElement("blockquote");q.className="cap-words";q.textContent=words;doc.appendChild(q);
+ const row=document.createElement("div");row.className="row wrap";row.style.gap=".6rem";row.style.marginTop=".7rem";
+ const bb=document.createElement("button");bb.className="runbtn";bb.textContent="Build this for "+c.name;
+ const busy=run&&run.running;if(busy)bb.disabled=true;
+ if(CAP.noBuild){bb.disabled=true;bb.title="This one messages a real person, so it runs from your own Claude with you watching."}
+ bb.onclick=async()=>{bb.disabled=true;bb.textContent="Starting\u2026";
+  const r=await(await fetch("/api/run-capability",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({locationId:c.locationId,key:CAP.key})})).json();
+  if(!r.ok){alert(r.error||"Could not start");bb.disabled=false;bb.textContent="Build this for "+c.name;return}
+  capRun={locationId:c.locationId};pollCap()};
+ row.appendChild(bb);
+ const cp=document.createElement("button");cp.className="intakebtn";cp.textContent="Copy the words";cp.onclick=async()=>{try{await navigator.clipboard.writeText(words);cp.textContent="Copied"}catch(e){cp.textContent="Select and copy the text above"}setTimeout(()=>{cp.textContent="Copy the words"},2000)};row.appendChild(cp);
+ if(CAP.hub){const h=document.createElement("a");h.className="intakebtn";h.href=HUB+CAP.hub;h.target="_blank";h.rel="noopener";h.textContent="Step by step in the hub \u2197";row.appendChild(h)}
+ doc.appendChild(row);
+ const note=document.createElement("p");note.className="muted small";note.style.marginTop=".6rem";
+ note.textContent=CAP.noBuild?"No button for this one on purpose: it messages a real person. Paste the words into your own Claude and watch it work.":busy?"Another run is in progress. This button wakes up when it finishes.":"Build this runs through your own Claude account, with only the tools this job needs: the words above and what it reads from this account go to Claude, and nowhere else. Workflows are left as drafts; nothing is sent, posted or deleted; every id is read from this account first. Or paste the words into your own Claude and watch it work.";
+ doc.appendChild(note);
+ /* The run, live */
+ if(run&&run.capability===CAP.key&&run.locationId===c.locationId){const pre=document.createElement("pre");pre.className="cap-log";pre.textContent=(run.lines||[]).slice(-40).join(String.fromCharCode(10))||"Starting\u2026";doc.appendChild(pre);
+  if(run.running&&!capPoll)pollCap()}
+ const last=(state.capabilityRuns||{})[c.locationId+":"+CAP.key];
+ if(last){const l=document.createElement("p");l.className="muted small";l.style.marginTop=".5rem";l.textContent=(last.ok?"Last built ":"Last attempt ")+new Date(last.at).toLocaleString()+": "+(last.ok?"done. ":"did not finish. "+(last.error||"")+" ")+(last.summary||"")+(last.issues&&last.issues.length?" Waiting on a person: "+last.issues.join("; "):"");doc.appendChild(l)}
+ m.appendChild(doc)}
+function pollCap(){if(capPoll)return;capPoll=setInterval(async()=>{try{const r=await(await fetch("/api/run/status")).json();const s=await(await fetch("/api/state")).json();if(!r.running){clearInterval(capPoll);capPoll=null;capRun=null;capReads=null;capReadsFor=""}render(s,r)}catch(e){}},2000)}
+
+function screenHead(title,sub){const d=document.createElement("div");d.className="screen-head";d.innerHTML="<h1></h1><p class='lead'></p>";d.querySelector("h1").textContent=title;d.querySelector("p").textContent=sub;return d}
+/* The board's overview: where the work is waiting, in numbers, each one a door to its own page. */
+function homeBlock(state,run){const wrap=document.createElement("div");
+ wrap.appendChild(screenHead("Command OS","Everything here runs on this computer. Pick up where the work is waiting."));
+ const grid=document.createElement("div");grid.className="home";
+ const q=queueData&&queueData.ok?queueData:null;const you=q&&q.counts?(q.counts.you||0):0;const total=q?(q.items||[]).length:0;
+ const clients=ROSTER.filter(c=>["client","sandbox"].includes(typeOf(state,c.locationId)));
+ let act=(activeId&&clients.some(c=>c.locationId===activeId))?activeId:null;
+ if(!act&&run&&run.running&&clients.some(c=>c.locationId===run.locationId))act=run.locationId;if(!act&&clients.length)act=clients[0].locationId;
+ const actC=clients.find(c=>c.locationId===act);
+ let stage="";if(actC){const st=((state.clients||{})[actC.locationId]||{}).stages||[];const i=st.findIndex(s=>s!=="done");
+  stage=i<0?"Every stage is done":((run&&run.running&&run.locationId===actC.locationId)?"Building now: ":"Next: ")+(LABELS[i]||"")}
+ const tile=(eyebrow,big,text,href,cta)=>{const c=document.createElement("a");c.className="card tile";c.href=href;
+  c.innerHTML="<div class='eyebrow'></div><div class='big'></div><p></p><span class='go'></span>";
+  c.querySelector(".eyebrow").textContent=eyebrow;c.querySelector(".big").textContent=big;c.querySelector("p").textContent=text;c.querySelector(".go").textContent=cta;return c};
+ grid.appendChild(tile("Waiting on you",String(you),total?(total+" step"+(total===1?"":"s")+" in the queue, "+you+" need"+(you===1?"s":"")+" your hand"):"Nothing is waiting on you","/queue","Open the work queue \u2192"));
+ grid.appendChild(tile("Working on now",actC?actC.name:"\u2014",actC?stage:"No client account is open","/clients","Open client builds \u2192"));
+ grid.appendChild(tile("Client accounts",String(clients.length),clients.length===1?"One account on the board":"Accounts on the board, templates and hidden ones aside","/clients","See every account \u2192"));
+ grid.appendChild(tile("New client","+","Register the sub-account, then answer the intake","/new","Build a client account \u2192"));
+ wrap.appendChild(grid);return wrap}
 function render(state,run){syncReviews(state);lastState=state;lastRun=run;
  if(state&&state.protectedAccounts)PROTECTED=state.protectedAccounts;const m=document.getElementById("main");m.innerHTML="";
+ /* Four screens share this page's data and differ only in what they show. */
+ if(SCREEN==="new"){m.appendChild(screenHead("Build a client account","Register the sub-account, then answer the intake. The seven stages run from Client Builds."));
+  m.appendChild(newClientForm());
+  /* Step 2 on the same page: the intake for the client that is open, with the
+     document, link, transcript and recorder ways in (Jerry, 2026-09-05). */
+  const c0=capActive(state);
+  if(c0){const eb2=document.createElement("div");eb2.className="eyebrow";eb2.style.marginTop="1.4rem";eb2.textContent="Step 2 \u2014 the intake for "+c0.name;m.appendChild(eb2);
+   const pick=document.createElement("p");pick.className="small muted";pick.style.margin="0 0 .6rem";pick.textContent="A different client? Open it under Client Builds first.";m.appendChild(pick);
+   if(!iData[c0.locationId])iLoad(c0.locationId);
+   m.appendChild(intakeWorkspace(c0.locationId,c0.name))}
+  const ib=document.createElement("button");ib.className="intakebtn";ib.style.marginTop="1rem";ib.textContent=intakeOpen?"\xD7 Close the intake questions":"Intake questions";
+  ib.onclick=async()=>{intakeOpen=!intakeOpen;if(intakeOpen&&!intakeData)await loadIntake();else render(state,run)};m.appendChild(ib);
+  if(intakeOpen)m.appendChild(intakePanel());return}
+ if(SCREEN==="for"&&CAP){renderCapability(m,state,run);return}
  if(!ROSTER.length){const d=document.createElement("div");d.className="client";
-  d.innerHTML="<h2>No clients yet</h2><p style='margin-top:.4rem'>Register a sub-account in GHL Command and it appears here.</p>";m.appendChild(d);return}
+  d.innerHTML="<h2>No clients yet</h2><p style='margin-top:.4rem'>Register a sub-account in GHL Command and it appears here, or <a href='/new'>build a client account</a>.</p>";m.appendChild(d);return}
+ if(SCREEN==="board"){m.appendChild(homeBlock(state,run));return}
  const bar=document.createElement("div");bar.className="toolbar";
  const inp=document.createElement("input");inp.placeholder="Find a client\u2026";inp.value=query;
  inp.oninput=()=>{query=inp.value;render(state,run);const i2=document.querySelector(".toolbar input");i2.focus();i2.setSelectionRange(query.length,query.length)};
  bar.appendChild(inp);
- const nb=document.createElement("button");nb.className="newbtn";nb.textContent=showNew?"\xD7 Close":"\uFF0B New Client";
- nb.onclick=async()=>{showNew=!showNew;
-  if(showNew&&!snapshots){const r=await(await fetch("/api/snapshots")).json();snapshots=r.ok?r.snapshots:[]}
-  render(state,run)};
- bar.appendChild(nb);
- const sy=document.createElement("button");sy.className="intakebtn";sy.textContent="\u27F3 Sync";sy.title="Pull teammate updates from your GHL";
- sy.onclick=async()=>{sy.textContent="Syncing\u2026";const r=await(await fetch("/api/sync",{method:"POST",headers:{"Content-Type":"application/json"}})).json();
-  sy.textContent=r.adopted?("\u27F3 "+r.adopted+" updated"):"\u27F3 Up to date";setTimeout(()=>{sy.textContent="\u27F3 Sync"},2500);load()};
- bar.appendChild(sy);
- const ib=document.createElement("button");ib.className="intakebtn";ib.textContent=intakeOpen?"\xD7 Intake":"Intake questions";
- ib.onclick=async()=>{intakeOpen=!intakeOpen;if(intakeOpen&&!intakeData)await loadIntake();else render(state,run)};
- bar.appendChild(ib);m.appendChild(bar);
- if(showNew)m.appendChild(newClientForm());
- if(intakeOpen)m.appendChild(intakePanel());
+ if(SCREEN==="clients"){
+  const nb=document.createElement("a");nb.className="newbtn";nb.href="/new";nb.textContent="\uFF0B New Client";bar.appendChild(nb);
+  const sy=document.createElement("button");sy.className="intakebtn";sy.textContent="\u27F3 Sync";sy.title="Pull teammate updates from your GHL";
+  sy.onclick=async()=>{sy.textContent="Syncing\u2026";const r=await(await fetch("/api/sync",{method:"POST",headers:{"Content-Type":"application/json"}})).json();
+   sy.textContent=r.adopted?("\u27F3 "+r.adopted+" updated"):"\u27F3 Up to date";setTimeout(()=>{sy.textContent="\u27F3 Sync"},2500);load()};
+  bar.appendChild(sy)}
+ m.appendChild(bar);
  const q=query.trim().toLowerCase();
  const match=(c)=>!q||c.name.toLowerCase().includes(q)||c.locationId.toLowerCase().includes(q);
- const qb=queueBlock(match);if(qb)m.appendChild(qb);
+ if(SCREEN==="queue"){const qb=queueBlock(match);if(qb)m.appendChild(qb);else{const d=document.createElement("div");d.className="client";d.innerHTML="<h2>Nothing is waiting on you</h2>";m.appendChild(d)}return}
  const sorted=[...ROSTER].sort((a,b)=>activityScore(state,b.locationId)-activityScore(state,a.locationId)||a.name.localeCompare(b.name));
  const board=sorted.filter(c=>match(c)&&["client","sandbox"].includes(typeOf(state,c.locationId)));
  const parked=sorted.filter(c=>match(c)&&["template","hidden"].includes(typeOf(state,c.locationId)));
@@ -44698,10 +45773,10 @@ function render(state,run){syncReviews(state);lastState=state;lastRun=run;
    const tx=document.createElement("span");tx.style.fontSize="var(--fs-sm)";tx.textContent=other.name+" \u2014 "+(LABELS[run.stage]||"")+" is running.";ban.appendChild(tx);
    const go2=document.createElement("button");go2.className="intakebtn";go2.style.marginLeft="auto";go2.textContent="Watch it";
    go2.onclick=()=>setActive(other.locationId);ban.appendChild(go2);m.appendChild(ban)}}
- if(actC){const eb=document.createElement("div");eb.className="eyebrow";eb.textContent="Working on now";m.appendChild(eb);
+ if(actC){const eb=document.createElement("div");eb.className="eyebrow";eb.id="clients";eb.textContent="Working on now";m.appendChild(eb);
   m.appendChild(actC.pending?pendingCard(actC,state):card(actC,state,run))}
  const rest=board.filter(c=>c.locationId!==act);
- if(rest.length){const eb2=document.createElement("div");eb2.className="eyebrow";eb2.textContent="Your other accounts";m.appendChild(eb2);
+ if(rest.length){const eb2=document.createElement("div");eb2.className="eyebrow";if(!actC)eb2.id="clients";eb2.textContent=actC?"Your other client accounts":"Your client accounts";m.appendChild(eb2);
   const list=document.createElement("div");list.className="card acct-list";
   for(const c of rest)list.appendChild(acctRow(c,state,run));
   m.appendChild(list);
@@ -44761,6 +45836,24 @@ function checkMutationGuard(req, port) {
   }
   return null;
 }
+function cockpitGate(req, seatToken, port) {
+  const denied = checkMutationGuard(req, port) ?? checkSeatToken(req, seatToken);
+  if (denied) return denied;
+  const pathname = (req.url ?? "/").split("?")[0];
+  if (SEAT_GUARDED_READS.includes(pathname)) return checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
+  return null;
+}
+function guarded(seatToken, port, routes) {
+  return (req, res) => {
+    const denied = cockpitGate(req, seatToken, port);
+    if (denied) {
+      res.writeHead(denied.status, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ ok: false, error: denied.error }));
+      return;
+    }
+    routes(req, res);
+  };
+}
 async function runDashboard(argv) {
   const portArg = argv.find((a) => a.startsWith("--port="));
   const port = portArg ? Number(portArg.split("=")[1]) : 7300;
@@ -44812,6 +45905,7 @@ async function runDashboard(argv) {
     }
     return process.env.GHL_COMPANY_ID;
   };
+  currentRosterRef = () => currentRoster();
   const clientFor = (locationId2) => {
     const tok = registry2.getToken(locationId2);
     return tok?.apiKey ? new GHLClient({ apiKey: tok.apiKey, locationId: locationId2 }) : void 0;
@@ -44870,17 +45964,175 @@ async function runDashboard(argv) {
     const pend = Object.entries(readCockpitState().pending ?? {}).filter(([id]) => !ids.has(id)).map(([locationId2, p]) => ({ locationId: locationId2, name: p.name, pending: true }));
     return [...registered, ...pend];
   };
-  const server2 = http.createServer((req, res) => {
+  const server2 = http.createServer(guarded(seatToken, port, (req, res) => {
     const url = req.url || "/";
-    const denied = checkMutationGuard(req, port) ?? checkSeatToken(req, seatToken);
-    if (denied) {
-      res.writeHead(denied.status, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ ok: false, error: denied.error }));
+    if (req.method === "GET" && url.startsWith("/for/")) {
+      const cap = capabilityByKey(url.slice("/for/".length).replace(/\/$/, ""));
+      if (!cap) {
+        res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+        res.end("No such page. The sidebar lists every one.");
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+      res.end(html(currentRoster(), isLoopback(req) ? seatToken : "", "for", cap));
+      return;
+    }
+    if (req.method === "GET" && url.startsWith("/api/capability")) {
+      const u = new URL(req.url ?? "/", "http://127.0.0.1");
+      const cap = capabilityByKey(u.searchParams.get("key") ?? "");
+      const locationId2 = u.searchParams.get("locationId") ?? "";
+      const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
+      if (seat) {
+        res.writeHead(seat.status, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: seat.error }));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "application/json" });
+      if (!cap) {
+        res.end(JSON.stringify({ ok: false, error: "no such capability" }));
+        return;
+      }
+      if (!readableAccount(locationId2)) {
+        res.end(JSON.stringify({ ok: false, error: "That account is not on the board." }));
+        return;
+      }
+      const c = clientFor(locationId2);
+      if (!c) {
+        res.end(JSON.stringify({ ok: false, error: "No key on file for this account. Register it in GHL Command first." }));
+        return;
+      }
+      void (async () => {
+        const reads = await Promise.all(cap.reads.map(async (r) => {
+          const p = r.path.replace(/\{loc\}/g, locationId2);
+          const params = r.params ? Object.fromEntries(Object.entries(r.params).map(([k, v]) => [k, v.replace(/\{loc\}/g, locationId2)])) : void 0;
+          try {
+            const raw = await c.get(p, { ...params ? { params } : {}, ...r.version ? { version: r.version } : {} });
+            const items = findArray(raw, r.key);
+            if (!items) {
+              logQuietly(`capability read ${cap.key}/${r.label}: unrecognised shape from ${p}`);
+              return { label: r.label, status: "unavailable", count: 0, names: [], reason: "could not read: the answer had a shape this page does not know" };
+            }
+            return { label: r.label, status: "ok", count: items.length, names: items.map((i) => nameOf(i, r.nameField)).filter(Boolean) };
+          } catch (e) {
+            logQuietly(`capability read ${cap.key}/${r.label} on ${locationId2}: ${e instanceof Error ? e.message : String(e)}`);
+            return { label: r.label, status: "unavailable", count: 0, names: [], reason: readFailureText(e) };
+          }
+        }));
+        res.end(JSON.stringify({ ok: true, key: cap.key, locationId: locationId2, reads }));
+      })();
+      return;
+    }
+    if (req.method === "POST" && url === "/api/run-capability") {
+      readBody(req, res, 1e4, (body) => {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        try {
+          const { locationId: locationId2, key } = JSON.parse(body || "{}");
+          const cap = capabilityByKey(String(key ?? ""));
+          if (!cap) throw new Error("no such capability");
+          if (activeRun2?.running) throw new Error("a run is already in progress");
+          const st = readCockpitState();
+          const client = currentRoster().find((r) => r.locationId === locationId2);
+          if (!client) throw new Error("that account is not on the board");
+          const approvedAt = st.buildApproved?.[locationId2];
+          startRun(locationId2, -1, (ok, outcome) => {
+            try {
+              const now = readCockpitState();
+              const last = activeRun2;
+              const runs = { ...now.capabilityRuns ?? {} };
+              const done = (last?.lines ?? []).filter((l) => /^Done[:.]/.test(l)).pop() ?? "";
+              runs[`${locationId2}:${cap.key}`] = {
+                at: (/* @__PURE__ */ new Date()).toISOString(),
+                ok,
+                summary: outcome?.plain?.summary ?? outcome?.summary ?? done.replace(/^Done[:.]\s*/, ""),
+                issues: outcome?.plain?.issues ?? outcome?.issues ?? [],
+                error: ok ? void 0 : outcome?.error ?? "the run did not finish"
+              };
+              writeCockpitState({ ...now, capabilityRuns: runs });
+            } catch {
+            }
+          }, { name: client.name, approvedAt, spec: capabilitySpec(cap, client.name), capability: cap.key });
+          res.end(JSON.stringify({ ok: true }));
+        } catch (e) {
+          res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : String(e) }));
+        }
+      });
+      return;
+    }
+    if (req.method === "POST" && url === "/api/assessment-save") {
+      readBody(req, res, 2e6, (body) => {
+        void (async () => {
+          res.writeHead(200, { "Content-Type": "application/json" });
+          try {
+            const args = JSON.parse(body || "{}");
+            const locationId2 = String(args.locationId ?? "");
+            if (!currentRoster().some((r) => r.locationId === locationId2)) throw new Error("Pick which account this assessment belongs to first.");
+            const c = clientFor(locationId2);
+            if (!c) throw new Error("No key on file for that account. Register it in GHL Command first.");
+            const assessment = StateSchema.parse(args.assessment);
+            const out = await saveAssessment(c, locationId2, {
+              assessment,
+              contactName: args.contactName || void 0,
+              email: args.email || void 0,
+              phone: args.phone || void 0,
+              createPipeline: args.createPipeline === true
+            });
+            res.end(JSON.stringify({ ok: true, ...out }));
+          } catch (e) {
+            res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : String(e) }));
+          }
+        })();
+      });
+      return;
+    }
+    if (req.method === "GET" && url.startsWith("/api/intake-documents")) {
+      const u = new URL(req.url ?? "/", "http://127.0.0.1");
+      const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
+      if (seat) {
+        res.writeHead(seat.status, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: seat.error }));
+        return;
+      }
+      res.writeHead(200, { "Content-Type": "application/json" });
+      const loc = u.searchParams.get("locationId") ?? "";
+      if (!readableAccount(loc)) {
+        res.end(JSON.stringify({ ok: false, error: "That account is not on the board." }));
+        return;
+      }
+      try {
+        res.end(JSON.stringify({ ok: true, files: listClientDocs(loc) }));
+      } catch (e) {
+        logQuietly(`list documents ${loc}: ${e instanceof Error ? e.message : String(e)}`);
+        res.end(JSON.stringify({ ok: false, error: "Could not list this client's documents." }));
+      }
       return;
     }
-    if (req.method === "GET" && url === "/") {
+    if (req.method === "POST" && url === "/api/intake-document") {
+      readBody(req, res, Math.ceil(DOC_MAX_BYTES * 1.4), (body) => {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        try {
+          const args = JSON.parse(body || "{}");
+          if (!readableAccount(String(args.locationId ?? ""))) throw new Error("That account is not on the board.");
+          const name = safeDocName(args.name);
+          const bytes = Buffer.from(String(args.base64 ?? ""), "base64");
+          if (!bytes.length) throw new Error("that file is empty");
+          if (bytes.length > DOC_MAX_BYTES) throw new Error("that file is over 20 MB");
+          const dir = clientDocsDir(args.locationId);
+          fs32.mkdirSync(dir, { recursive: true, mode: 448 });
+          if (!insideDir(path31.join(appDataDir(), "clients"), dir)) throw new Error("This client's documents folder is not where it should be, so nothing was saved.");
+          const saved = writeDocAtomically(dir, name, bytes);
+          res.end(JSON.stringify({ ok: true, name: saved, files: listClientDocs(args.locationId) }));
+        } catch (e) {
+          logQuietly(`save document: ${e instanceof Error ? e.message : String(e)}`);
+          const msg3 = e instanceof Error ? e.message : String(e);
+          res.end(JSON.stringify({ ok: false, error: /\/|\\/.test(msg3) ? "That file could not be saved." : msg3 }));
+        }
+      });
+      return;
+    }
+    const boardScreen = BOARD_ROUTES[url];
+    if (req.method === "GET" && boardScreen) {
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-      res.end(html(currentRoster(), isLoopback(req) ? seatToken : ""));
+      res.end(html(currentRoster(), isLoopback(req) ? seatToken : "", boardScreen));
       return;
     }
     if ((req.method === "GET" || req.method === "HEAD") && (url === "/assessment" || url === "/assessment.html")) {
@@ -44891,23 +46143,33 @@ async function runDashboard(argv) {
         "Cache-Control": "no-store",
         "X-Robots-Tag": "noindex, nofollow"
       });
-      res.end(req.method === "HEAD" ? void 0 : withCockpitShell(ASSESSMENT_HTML, "assessment"));
+      const roster2 = currentRoster().map((r) => ({ locationId: r.locationId, name: r.name }));
+      const clientsTag = `<script>window.COMMAND_OS_CLIENTS=${scriptJson(roster2)};window.COMMAND_OS_SEAT=${scriptJson(isLoopback(req) ? seatToken : "")};</script>`;
+      res.end(req.method === "HEAD" ? void 0 : withCockpitShell(ASSESSMENT_HTML, "assessment", assessmentAgencyTag() + clientsTag));
       return;
     }
     if (req.method === "GET" && url === "/api/snapshots") {
+      const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
+      if (seat) {
+        res.writeHead(seat.status, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ ok: false, error: seat.error }));
+        return;
+      }
       (async () => {
         try {
           const agencyKey = registry2.getAgencyKey();
           const companyId = agencyCompanyId();
-          if (!agencyKey || !companyId) throw new Error("agency key or company id missing \u2014 run register_agency_key");
+          if (!agencyKey || !companyId) throw new Error(NEEDS_AGENCY_KEY);
           const agencyClient = new GHLClient({ apiKey: agencyKey });
           const raw = await agencyClient.get("/snapshots/", { params: { companyId } });
           const snaps = (raw.snapshots ?? []).sort((a, b) => (a.type === "own" ? 0 : 1) - (b.type === "own" ? 0 : 1) || a.name.localeCompare(b.name));
           res.writeHead(200, { "Content-Type": "application/json" });
           res.end(JSON.stringify({ ok: true, snapshots: snaps }));
         } catch (e) {
-          res.writeHead(500, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : "snapshot list failed" }));
+          const shown = memberFacingError(e, [NEEDS_AGENCY_KEY]);
+          logQuietly(`snapshot list: ${e instanceof Error ? e.message : String(e)}`);
+          res.writeHead(shown === NEEDS_AGENCY_KEY ? 400 : 500, { "Content-Type": "application/json" });
+          res.end(JSON.stringify({ ok: false, error: shown === NEEDS_AGENCY_KEY ? shown : `Could not list your snapshots: ${shown}.` }));
         }
       })();
       return;
@@ -44935,12 +46197,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/run") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 1e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 1e4, (body) => {
         try {
           const { locationId: locationId2, stage } = JSON.parse(body);
           if (activeRun2?.running) throw new Error("a run is already in progress");
@@ -44986,12 +46243,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/overlay") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 1e5) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 1e5, (body) => {
         try {
           const layer = JSON.parse(body);
           if (typeof layer !== "object" || layer === null) throw new Error("bad overlay");
@@ -45009,6 +46261,13 @@ async function runDashboard(argv) {
       (async () => {
         try {
           const locationId2 = new URL(url, "http://x").searchParams.get("locationId") || "";
+          const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
+          if (seat) {
+            res.writeHead(seat.status, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: seat.error }));
+            return;
+          }
+          if (!readableAccount(locationId2)) throw new Error("That account is not on the board.");
           const c = clientFor(locationId2);
           if (!c) throw new Error("this client isn't connected yet \u2014 paste its key first");
           const st = readCockpitState();
@@ -45019,18 +46278,14 @@ async function runDashboard(argv) {
           res.end(JSON.stringify({ ok: true, ...snap, questions }));
         } catch (e) {
           res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : "failed" }));
+          logQuietly(`client-intake ${new URL(url, "http://x").searchParams.get("locationId") || ""}: ${e instanceof Error ? e.message : String(e)}`);
+          res.end(JSON.stringify({ ok: false, error: memberFacingError(e, INTAKE_OWN_MESSAGES) }));
         }
       })();
       return;
     }
     if (req.method === "POST" && url === "/api/intake-prefill-url") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 2e5) req.destroy();
-      });
-      req.on("end", async () => {
+      readBody(req, res, 2e5, async (body) => {
         try {
           const args = JSON.parse(body);
           const c = clientFor(args.locationId);
@@ -45048,18 +46303,22 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && (url === "/api/intake-submit" || url === "/api/intake-send" || url === "/api/intake-prefill")) {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 4e5) req.destroy();
-      });
-      req.on("end", async () => {
+      readBody(req, res, 4e5, async (body) => {
         try {
           const args = JSON.parse(body);
           const c = clientFor(args.locationId);
           if (!c) throw new Error("this client isn't connected yet");
           if (url === "/api/intake-prefill") {
-            const source = args.url ? { kind: "url", url: String(args.url) } : args.instruction ? { kind: "recorder", instruction: String(args.instruction) } : { kind: "text", text: String(args.transcript ?? "") };
+            let fileSource = null;
+            if (args.file) {
+              const name = safeDocName(args.file);
+              const dir = clientDocsDir(args.locationId);
+              const p = path31.join(dir, name);
+              if (!fs32.existsSync(p)) throw new Error("that document is not saved for this client");
+              if (fs32.lstatSync(p).isSymbolicLink() || !insideDir(dir, p)) throw new Error("that document is not saved for this client");
+              fileSource = { kind: "file", path: p, name };
+            }
+            const source = fileSource ? fileSource : args.url ? { kind: "url", url: String(args.url) } : args.instruction ? { kind: "recorder", instruction: String(args.instruction) } : { kind: "text", text: String(args.transcript ?? "") };
             let recorderPatterns = [];
             if (source.kind === "recorder") {
               recorderPatterns = await new Promise((resolve11) => {
@@ -45167,12 +46426,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/design/run") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 6e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 6e4, (body) => {
         try {
           const checked = validateRunRequest(JSON.parse(body || "{}"));
           if (!checked.ok) {
@@ -45198,12 +46452,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/design/cancel") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 4e3) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 4e3, (body) => {
         const id = (() => {
           try {
             return String(JSON.parse(body || "{}").id ?? "");
@@ -45218,12 +46467,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && (url === "/api/brand/extract" || url === "/api/brand/import-look" || url === "/api/brand/set")) {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 12e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 12e4, (body) => {
         void (async () => {
           try {
             const a = JSON.parse(body || "{}");
@@ -45282,8 +46526,11 @@ async function runDashboard(argv) {
             }
             let logoSvg;
             if (typeof a.logoSvg === "string" && a.logoSvg.trim()) {
-              if (!/^\s*<svg[\s\S]*<\/svg>\s*$/i.test(a.logoSvg) || a.logoSvg.length > 6e4) throw new Error("The logo must be one <svg>\u2026</svg> under 60 KB. Nothing was changed.");
-              logoSvg = a.logoSvg.trim();
+              try {
+                logoSvg = sanitizeSvg(a.logoSvg);
+              } catch (e) {
+                throw new Error(`${e.message} Nothing was changed.`);
+              }
               d.logo = { inlineSvg: logoSvg, whiteFillFixed: false, source: `set by ${stamp}`, rights: "declared" };
               d.provenance.evidence["logo"] = `set by ${stamp}`;
             }
@@ -45308,12 +46555,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/client-engagement") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 2e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 2e4, (body) => {
         try {
           const { locationId: locationId2, ...patch } = JSON.parse(body);
           const savedAll = writeClientEngagement(String(locationId2 ?? ""), patch);
@@ -45351,12 +46593,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/build-approval") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 5e3) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 5e3, (body) => {
         try {
           const { locationId: locationId2, confirmName, revoke } = JSON.parse(body);
           const entry = currentRoster().find((r) => r.locationId === locationId2);
@@ -45376,12 +46613,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/protect") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 5e3) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 5e3, (body) => {
         try {
           const { locationId: locationId2, protect, confirmName } = JSON.parse(body);
           const entry = currentRoster().find((r) => r.locationId === locationId2);
@@ -45405,12 +46637,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/manual-task") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 5e3) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 5e3, (body) => {
         try {
           const { locationId: locationId2, id, claimed } = JSON.parse(body);
           if (!currentRoster().some((r) => r.locationId === locationId2)) throw new Error("unknown client");
@@ -45441,12 +46668,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/anthropic-key") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 8e3) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 8e3, (body) => {
         anthropicKeyWrites = anthropicKeyWrites.then(async () => {
           try {
             let parsed;
@@ -45510,12 +46732,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/agency-profile") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 4e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 4e4, (body) => {
         try {
           const saved = writeAgencyProfile(JSON.parse(body));
           const st = readCockpitState();
@@ -45530,12 +46747,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/branding") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 5e3) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 5e3, (body) => {
         try {
           const { agencyName, agencyAccent } = JSON.parse(body);
           const st = readCockpitState();
@@ -45551,12 +46763,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/review") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 2e4) req.destroy();
-      });
-      req.on("end", async () => {
+      readBody(req, res, 2e4, async (body) => {
         try {
           const { locationId: locationId2, clientName } = JSON.parse(body);
           const review = await writeReviewFor(locationId2, clientName || locationId2);
@@ -45572,12 +46779,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/new-client") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 2e4) req.destroy();
-      });
-      req.on("end", async () => {
+      readBody(req, res, 2e4, async (body) => {
         try {
           const args = JSON.parse(body);
           if (!args.name || typeof args.name !== "string") throw new Error("business name is required");
@@ -45609,12 +46811,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/register-location") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 1e4) req.destroy();
-      });
-      req.on("end", async () => {
+      readBody(req, res, 1e4, async (body) => {
         try {
           const { locationId: locationId2, apiKey: apiKey2 } = JSON.parse(body);
           const pendingEntry = readCockpitState().pending?.[locationId2];
@@ -45634,12 +46831,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/pending-remove") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 1e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 1e4, (body) => {
         try {
           const { locationId: locationId2 } = JSON.parse(body);
           writeCockpitState(clearPending(readCockpitState(), locationId2));
@@ -45661,12 +46853,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/industry") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 1e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 1e4, (body) => {
         try {
           const { locationId: locationId2, industry } = JSON.parse(body);
           if (!currentRoster().some((r) => r.locationId === locationId2)) throw new Error("unknown client");
@@ -45681,12 +46868,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/account") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 1e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 1e4, (body) => {
         try {
           const { locationId: locationId2, type } = JSON.parse(body);
           if (!currentRoster().some((r) => r.locationId === locationId2)) throw new Error("unknown client");
@@ -45701,12 +46883,7 @@ async function runDashboard(argv) {
       return;
     }
     if (req.method === "POST" && url === "/api/stage") {
-      let body = "";
-      req.on("data", (c) => {
-        body += c;
-        if (body.length > 1e4) req.destroy();
-      });
-      req.on("end", () => {
+      readBody(req, res, 1e4, (body) => {
         try {
           const { locationId: locationId2, stage, status, by } = JSON.parse(body);
           if (!currentRoster().some((r) => r.locationId === locationId2)) throw new Error("unknown client");
@@ -45745,7 +46922,7 @@ async function runDashboard(argv) {
     }
     res.writeHead(404);
     res.end();
-  });
+  }));
   try {
     await new Promise((resolve11, reject) => {
       server2.once("error", reject);
@@ -45781,7 +46958,7 @@ async function runDashboard(argv) {
     process.on("SIGTERM", stop);
   });
 }
-var fs32, path31, http, import_child_process5, import_child_process6, osmod, STAGES2, ACCOUNT_TYPES, activeRun2, UPGRADE_MSG, anthropicKeyWrites, SEAT_TOKEN_HEADER, NOT_SIGNED_IN_MSG;
+var fs32, path31, http, import_child_process5, import_child_process6, osmod, STAGES2, ACCOUNT_TYPES, activeRun2, UPGRADE_MSG, DOC_EXTS, DOC_MAX_BYTES, NEEDS_AGENCY_KEY, INTAKE_OWN_MESSAGES, currentRosterRef, BOARD_ROUTES, BOARD_TITLES, anthropicKeyWrites, SEAT_TOKEN_HEADER, NOT_SIGNED_IN_MSG, SEAT_GUARDED_READS;
 var init_dashboard = __esm({
   "src/dashboard.ts"() {
     "use strict";
@@ -45828,9 +47005,14 @@ var init_dashboard = __esm({
     init_stage_runner();
     import_child_process6 = require("child_process");
     init_ghl_client();
+    init_client_capabilities();
+    init_capability_runs();
+    init_assessment();
     init_shared_brain();
     init_work_queue();
     osmod = __toESM(require("os"));
+    init_script_json();
+    init_svg_sanitize();
     STAGES2 = [
       "Intake",
       "Brief",
@@ -45843,9 +47025,22 @@ var init_dashboard = __esm({
     ACCOUNT_TYPES = ["client", "sandbox", "template", "hidden"];
     activeRun2 = null;
     UPGRADE_MSG = "\n  The cockpit is not included in this licence, so it did not start.\n  Nothing was changed.\n\n";
+    DOC_EXTS = /* @__PURE__ */ new Set([".pdf", ".docx", ".doc", ".md", ".txt", ".rtf", ".csv"]);
+    DOC_MAX_BYTES = 20 * 1024 * 1024;
+    NEEDS_AGENCY_KEY = "No agency key on file. Run register_agency_key in GHL Command first.";
+    INTAKE_OWN_MESSAGES = ["That account is not on the board.", "this client isn't connected yet \u2014 paste its key first"];
+    currentRosterRef = () => [];
+    BOARD_ROUTES = { "/": "board", "/new": "new", "/queue": "queue", "/clients": "clients" };
+    BOARD_TITLES = {
+      board: "Command OS \u2014 GHL Command",
+      new: "Build a Client Account \u2014 Command OS",
+      queue: "Work Queue \u2014 Command OS",
+      clients: "Client Builds \u2014 Command OS"
+    };
     anthropicKeyWrites = Promise.resolve();
     SEAT_TOKEN_HEADER = "x-command-os-seat";
     NOT_SIGNED_IN_MSG = "This browser isn't signed in to Command OS on this computer. Open Command OS on the machine it runs on, and use the page it opens for you.";
+    SEAT_GUARDED_READS = ["/api/capability", "/api/client-intake", "/api/intake-documents", "/api/snapshots"];
   }
 });
 
@@ -46723,7 +47918,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.81.1",
+      version: "3.82.0",
       mcpName: "io.github.drjerryrelth/ghl-command",
       description: "GoHighLevel MCP Server for Claude. 250 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
@@ -46801,6 +47996,7 @@ var require_package = __commonJS({
         "@clack/prompts": "^1.1.0",
         "@types/node": "^26.2.0",
         esbuild: "^0.28.1",
+        "happy-dom": "^20.14.0",
         open: "^11.0.0",
         typescript: "^7.0.2",
         vitest: "^4.1.6"
@@ -47191,6 +48387,11 @@ function agencyPrimer(p) {
   if (staff.length) lines.push(`Their team: ${staff.join("; ")}.`);
   const sops = (p.delivery?.sops ?? []).filter(Boolean);
   if (sops.length) lines.push(`How they deliver, in their words: ${sops.map((s) => `"${s}"`).join(" ")}`);
+  const os7 = p.agencyOs;
+  if (os7?.method) lines.push(`Their method: ${os7.method}`);
+  if (os7?.voice) lines.push(`How they sound, and how you should sound for them: ${os7.voice}`);
+  if (os7?.ica?.who) lines.push(`Who they serve: ${os7.ica.who}`);
+  if (os7?.offer?.name || os7?.offer?.promise) lines.push(`Their core offer: ${[os7.offer?.name, os7.offer?.promise].filter(Boolean).join(" \u2014 ")}`);
   if (!lines.length) return void 0;
   lines.push("These are the agency's own details, not any client's. Client-by-client records are a tool call away, not in here.");
   const text = lines.join("\n");