@elitedcs/ghl-mcp 3.83.2 → 3.83.3

package/CHANGELOG.md

@@ -2,6 +2,34 @@
 
 ## Unreleased
 
+## 3.83.3 — an account you marked protected is now actually protected
+
+**Marking a client account protected did not stop fourteen write paths from writing to it.**
+The guard was real and it was in the right place for the public API, but this product also
+writes to GoHighLevel through its own builder connection, and those calls never passed it.
+So a build could create a pipeline and a form on an account you had explicitly told it never
+to touch, and nothing would say so. Pipelines and forms are the first two things a build
+creates. Every one of those paths now goes through the same check, including the template
+installer, which writes a funnel and its pages — the case that matters most, because
+GoHighLevel keeps only the first content save on a page.
+
+**Verify no longer needs your own Anthropic key before it will let you start.** A new client
+with no key met a disabled Run button, while the same screen said most people do not need to
+paste anything there. Both were true at once: runs use whatever you are signed in to Claude
+with and cost nothing extra, and the readiness check demanded a key anyway. The key is
+reported now, not required. If you have one saved, runs bill it; if you do not, they use your
+Claude sign-in.
+
+**The Verify tile stopped promising something it could not do.** It said it submits a test
+lead and deletes it. Since funnels left the build, no plan it creates has anywhere to send
+one, and the report a screen later said so. It now says what it actually does for every plan,
+and still discloses the test lead for the accounts that can take one.
+
+**An older install can no longer roll your skills backwards.** The installer refreshed any
+skill file it had written before, without checking whether the version doing the writing was
+older than the one that wrote it. Running an older copy alongside a newer one quietly reverted
+your skills. It refuses now and tells you it kept the newer ones.
+
 ## 3.83.2 — the static design-rule harness and its fixtures leave the package
 
 A development harness and its four HTML fixtures were in the published package in

package/README.md

@@ -897,7 +897,7 @@ Built by **[Elite DCs, LLC](https://elitedcs.com)** — a digital marketing and
 
 **Tech stack:** TypeScript, Node.js, esbuild, MCP SDK, Zod, GHL API v2, Firebase Auth
 
-**Version:** 3.83.2
+**Version:** 3.83.3
 
 ---
 

package/dist/index.js

@@ -7437,6 +7437,7 @@ function registerEmailBuilderInternalTools(server2, builderClient, publicClient)
   const client = builderClient;
   async function builderRequest(method, path39, body) {
     const headers = await client.buildHeaders();
+    assertWriteAllowed(method, `${EMAIL_BUILDER_BASE}${path39}`, { defaultLocationId: client.locationId });
     const response = await fetch(`${EMAIL_BUILDER_BASE}${path39}`, {
       method,
       headers,
@@ -7542,6 +7543,7 @@ var init_emails = __esm({
     init_account_reads();
     import_zod28 = require("zod");
     init_tool_helpers();
+    init_account_rules();
     EMAIL_BUILDER_BASE = "https://backend.leadconnectorhq.com/emails/builder";
     SNIPPETS_BASE = "https://services.leadconnectorhq.com/snippets";
     TEMPLATE_TYPES = ["html", "folder", "import", "builder", "blank", "ai_template", "vibe-editor"];
@@ -10289,12 +10291,15 @@ function readId(workflow) {
   const id = workflow._id ?? record.id;
   return typeof id === "string" ? id : "";
 }
+function attributeBag(attributes) {
+  return attributes ? Object.fromEntries(Object.entries(attributes)) : {};
+}
 function summarizeWebhookWorkflow(workflow) {
   const templates = workflow.workflowData?.templates ?? [];
   const webhookActions = templates.filter((action) => action.type === "webhook");
   if (!webhookActions.length) return null;
   const actions = webhookActions.map((action) => {
-    const attributes = action.attributes ?? {};
+    const attributes = attributeBag(action.attributes);
     return {
       actionId: action.id,
       name: action.name,
@@ -10451,7 +10456,7 @@ function registerWebhookTools(server2, builderClient) {
         }
         const target = actionId ? webhookActions.find((a) => a.id === actionId) : webhookActions[0];
         if (!target) throw new Error(`No webhook action with id ${actionId} on workflow ${webhookId}.`);
-        const attributes = target.attributes ?? {};
+        const attributes = attributeBag(target.attributes);
         const validated = buildWebhookAction({
           id: target.id,
           name: target.name,
@@ -11507,6 +11512,7 @@ ${text2}`);
     headers.Origin = "https://page-builder.leadconnectorhq.com";
     headers.Referer = "https://page-builder.leadconnectorhq.com/";
     const url = `https://backend.leadconnectorhq.com/funnels/builder/autosave/${pageId}`;
+    assertWriteAllowed("POST", url, { defaultLocationId: client.locationId });
     const response = await fetch(url, { method: "POST", headers, body: JSON.stringify(body) });
     if (!response.ok) {
       throw new Error(`Funnel API Error ${response.status}: POST /builder/autosave/${pageId}
@@ -11615,6 +11621,7 @@ var init_funnel_builder = __esm({
     import_zod41 = require("zod");
     init_tool_helpers();
     init_page_reads();
+    init_account_rules();
   }
 });
 
@@ -11815,6 +11822,9 @@ function requireCompany(api) {
 }
 async function call(api, path39, init) {
   const headers = { ...await api.headers(), Origin: "https://app.gohighlevel.com", Referer: "https://app.gohighlevel.com/" };
+  if (MUTATING_PATHS.some((mutating) => path39.startsWith(mutating))) {
+    assertWriteAllowed("POST", SVC + path39, { defaultLocationId: api.locationId() });
+  }
   const doFetch = api.fetch ?? fetch;
   const response = await doFetch(SVC + path39, { ...init, headers });
   const text = await response.text();
@@ -11908,12 +11918,14 @@ function rankForBrand(rows, brand) {
     return { ...t, why: parts.join("; ") };
   });
 }
-var SVC, GHL_ID;
+var SVC, MUTATING_PATHS, GHL_ID;
 var init_ghl_templates = __esm({
   "src/command-os/design/ghl-templates.ts"() {
     "use strict";
     init_color();
+    init_account_rules();
     SVC = "https://services.leadconnectorhq.com";
+    MUTATING_PATHS = ["/templates/template/load"];
     GHL_ID = /^[A-Za-z0-9]{15,40}$/;
   }
 });
@@ -16488,7 +16500,9 @@ ${await response.text()}`);
     const headers = await client.buildHeaders();
     headers.Origin = "https://page-builder.leadconnectorhq.com";
     headers.Referer = "https://page-builder.leadconnectorhq.com/";
-    const response = await fetch(`https://backend.leadconnectorhq.com/funnels/builder/autosave/${pageId}`, {
+    const autosaveUrl = `https://backend.leadconnectorhq.com/funnels/builder/autosave/${pageId}`;
+    assertWriteAllowed("POST", autosaveUrl, { defaultLocationId: client.locationId });
+    const response = await fetch(autosaveUrl, {
       method: "POST",
       headers,
       body: JSON.stringify(body)
@@ -16985,6 +16999,7 @@ var init_page_studio = __esm({
     init_tool_helpers();
     init_compose();
     init_website();
+    init_account_rules();
     valueCardSchema = import_zod43.z.object({
       title: import_zod43.z.string().describe("Card title (short, uppercase reads best)."),
       bodyHtml: import_zod43.z.string().describe("Card body as HTML (<p>\u2026</p>). May use {{location.*}} merge fields."),
@@ -17075,6 +17090,7 @@ function cleanFormDataForSave(formData) {
 async function formApiRequest(client, method, path39, body) {
   const headers = await client.buildHeaders();
   const url = `https://backend.leadconnectorhq.com/forms${path39}`;
+  assertWriteAllowed(method, url, { defaultLocationId: client.locationId });
   const options = { method, headers };
   if (body && (method === "POST" || method === "PUT")) {
     options.body = JSON.stringify(body);
@@ -17277,6 +17293,7 @@ var init_form_builder = __esm({
     "use strict";
     import_zod44 = require("zod");
     init_tool_helpers();
+    init_account_rules();
   }
 });
 
@@ -17671,6 +17688,7 @@ function registerPipelineBuilderTools(server2, builderClient) {
   async function pipelineRequest(method, path39, body) {
     const headers = await client.buildHeaders();
     const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path39}`;
+    assertWriteAllowed(method, url, { defaultLocationId: client.locationId });
     const options = { method, headers };
     if (body && (method === "POST" || method === "PUT" || method === "PATCH")) {
       options.body = JSON.stringify(body);
@@ -17853,6 +17871,7 @@ var init_pipeline_builder = __esm({
   "src/tools/pipeline-builder.ts"() {
     "use strict";
     import_zod46 = require("zod");
+    init_account_rules();
   }
 });
 
@@ -26972,8 +26991,13 @@ async function clientPreflight(registry2, locationId2) {
     }
   } catch {
   }
-  lines.push({ key: "authentication", ok: authenticated, text: authenticated ? "The Anthropic key authenticates." : key ? "The Anthropic key did not authenticate. Paste a working key in Your agency and press Check and save this key." : "Paste your Anthropic key in Your agency and press Check and save this key." });
-  return { ok: lines.every((l) => l.ok), lines };
+  lines.push({
+    key: "authentication",
+    ok: authenticated,
+    text: authenticated ? "Your Anthropic key authenticates, so powered runs will bill it." : key ? "The saved Anthropic key did not authenticate, so powered runs will fall back to your Claude sign-in on this computer. Replace it in Your agency, or remove it." : "No Anthropic key saved. Powered runs use your Claude sign-in on this computer and cost you nothing extra."
+  });
+  const blocking = lines.filter((l) => l.key !== "authentication");
+  return { ok: blocking.every((l) => l.ok), lines };
 }
 async function agencyConnectionReady(registry2, companyId) {
   const key = registry2.getAgencyKey();
@@ -28557,7 +28581,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.83.2",
+      version: "3.83.3",
       mcpName: "io.github.drjerryrelth/ghl-command",
       description: "GoHighLevel MCP Server for Claude. 250 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
@@ -35206,7 +35230,7 @@ function card(c,state,run){const st=(state.clients[c.locationId]||{stages:STAGES
    el.appendChild(box)}
   // One short line here; the button's confirmation carries the full wording. At 135
   // characters this sentence made every stage box 677 px tall (auditor, 2026-09-07).
-  if(i===4){const disclosure=document.createElement("small");disclosure.textContent="Submits one test lead, then deletes it.";el.appendChild(disclosure)}
+  if(i===4){const disclosure=document.createElement("small");disclosure.textContent="Reads every planned item back. May submit and delete one test lead.";el.appendChild(disclosure)}
   if(gate)el.title=gate;
   if(stale&&!live){const reason=document.createElement("small");reason.textContent=stale.reason;el.appendChild(reason)}
   const oc=(state.outcomes||{})[c.locationId+":"+i];
@@ -39194,6 +39218,7 @@ function registerSmartListTools(server2, builderClient) {
   async function smartListRequest(method, path39, body) {
     const headers = await client.buildHeaders();
     const url = `${SMARTLIST_BASE}${path39}`;
+    assertWriteAllowed(method, url, { defaultLocationId: client.locationId });
     const options = { method, headers };
     if (body && (method === "POST" || method === "PUT")) {
       options.body = JSON.stringify(body);
@@ -39263,6 +39288,7 @@ ${await res.text()}`);
         ];
         const body = buildContactSmartListBody({ listName: name, locationId: loc, filters });
         const headers = await client.buildHeaders();
+        assertWriteAllowed("POST", CONTACT_SMARTLIST_BASE, { defaultLocationId: client.locationId });
         const res = await fetch(CONTACT_SMARTLIST_BASE, { method: "POST", headers, body: JSON.stringify(body) });
         if (!res.ok) throw new Error(`Smart Lists API Error ${res.status}: POST /contacts/smartlist
 ${await res.text()}`);
@@ -39300,6 +39326,7 @@ ${await res.text()}`);
     async ({ listId }) => {
       try {
         const headers = await client.buildHeaders();
+        assertWriteAllowed("POST", CONTACT_SMARTLIST_DELETE, { defaultLocationId: client.locationId });
         const res = await fetch(CONTACT_SMARTLIST_DELETE, {
           method: "POST",
           headers,
@@ -39413,6 +39440,7 @@ var init_smart_lists = __esm({
     "use strict";
     import_zod57 = require("zod");
     init_tool_helpers();
+    init_account_rules();
     SMARTLIST_BASE = "https://backend.leadconnectorhq.com/lists/dynamic";
     OBJECT_KEYS = ["contacts", "opportunity"];
     CONTACT_SMARTLIST_BASE = "https://services.leadconnectorhq.com/contacts/smartlist";
@@ -39434,6 +39462,7 @@ function registerReputationTools(server2, builderClient) {
   if (!builderClient) return;
   const client = builderClient;
   async function reputationRequest(method, path39) {
+    assertWriteAllowed(method, `${REPUTATION_BASE}${path39}`, { defaultLocationId: client.locationId });
     const headers = await client.buildHeaders();
     const response = await fetch(`${REPUTATION_BASE}${path39}`, { method, headers });
     if (!response.ok) {
@@ -39512,6 +39541,7 @@ var init_reputation = __esm({
     "use strict";
     import_zod58 = require("zod");
     init_tool_helpers();
+    init_account_rules();
     REPUTATION_BASE = "https://backend.leadconnectorhq.com/reputation";
   }
 });
@@ -39546,6 +39576,7 @@ function registerEmailCampaignTools(server2, builderClient) {
       if (enableResendToUnopened !== void 0) body.enableResendToUnopened = enableResendToUnopened;
       if (hasUtmTracking !== void 0) body.hasUtmTracking = hasUtmTracking;
       const headers = await client.buildHeaders();
+      assertWriteAllowed("POST", `${SVC_BASE}/emails/schedule`, { defaultLocationId: client.locationId });
       const response = await fetch(`${SVC_BASE}/emails/schedule`, {
         method: "POST",
         headers,
@@ -39571,6 +39602,7 @@ var init_email_campaigns = __esm({
     "use strict";
     import_zod59 = require("zod");
     init_tool_helpers();
+    init_account_rules();
     SVC_BASE = "https://services.leadconnectorhq.com";
   }
 });
@@ -39580,6 +39612,7 @@ function registerMembershipTools(server2, builderClient) {
   if (!builderClient) return;
   const client = builderClient;
   async function membershipRequest(path39, method = "GET", body) {
+    assertWriteAllowed(method, `${MEMBERSHIP_BASE2}${path39}`, { defaultLocationId: client.locationId });
     const headers = await client.buildHeaders();
     const response = await fetch(`${MEMBERSHIP_BASE2}${path39}`, {
       method,
@@ -39767,6 +39800,7 @@ var init_memberships = __esm({
     "use strict";
     import_zod60 = require("zod");
     init_tool_helpers();
+    init_account_rules();
     MEMBERSHIP_BASE2 = "https://backend.leadconnectorhq.com/membership";
   }
 });
@@ -40115,6 +40149,7 @@ Pipelines: ${template.pipelines.length} to create`);
             } else {
               try {
                 const headers = await builderClient.buildHeaders();
+                assertWriteAllowed("POST", "https://backend.leadconnectorhq.com/opportunities/pipelines", { defaultLocationId: locId });
                 const res = await fetch("https://backend.leadconnectorhq.com/opportunities/pipelines", {
                   method: "POST",
                   headers,
@@ -40289,6 +40324,7 @@ var init_template_deployer = __esm({
     init_tool_helpers();
     fs28 = __toESM(require("fs"));
     path27 = __toESM(require("path"));
+    init_account_rules();
     TemplateSchema = import_zod61.z.object({
       templateName: import_zod61.z.string(),
       templateVersion: import_zod61.z.string().optional(),
@@ -50950,6 +50986,7 @@ function pickCalendarPins(workflow) {
 }
 function makeFirebaseRequest(builderClient) {
   return async (url, method, body) => {
+    assertWriteAllowed(method, url, { defaultLocationId: builderClient.locationId });
     const headers = await builderClient.buildHeaders();
     const response = await fetch(url, { method, headers, body: body ? JSON.stringify(body) : void 0 });
     if (!response.ok) {
@@ -52123,6 +52160,7 @@ var init_intake_to_build = __esm({
     init_plan_from_preset();
     init_executor();
     init_execute();
+    init_account_rules();
     customFieldItemSchema = import_zod80.z.object({
       id: import_zod80.z.string(),
       name: import_zod80.z.string(),
@@ -52658,6 +52696,15 @@ var os6 = __toESM(require("node:os"));
 function sha2562(buf) {
   return (0, import_node_crypto12.createHash)("sha256").update(buf).digest("hex");
 }
+function isOlderRelease(candidate, installed) {
+  const parts = (v) => v.trim().split(".").map((n) => Number.parseInt(n, 10));
+  const a = parts(candidate), b = parts(installed);
+  if (a.length !== 3 || b.length !== 3 || [...a, ...b].some(Number.isNaN)) return false;
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] < b[i];
+  }
+  return false;
+}
 function bundledSkillsDir(baseDir) {
   const candidate = path37.resolve(baseDir, "..", "skills");
   try {
@@ -52691,6 +52738,7 @@ function installBundledSkills(opts) {
     installed: [],
     updated: [],
     skippedUserModified: [],
+    skippedOlderPackage: [],
     unchanged: [],
     errors: [],
     targetDir: opts.targetDir ?? path37.join(os6.homedir(), ".claude", "skills"),
@@ -52733,7 +52781,11 @@ function installBundledSkills(opts) {
         continue;
       }
       const lastWritten = marker.files[rel];
-      if (lastWritten && destHash === lastWritten) {
+      if (lastWritten && destHash === lastWritten && isOlderRelease(opts.packageVersion, marker.packageVersion)) {
+        newMarker.files[rel] = destHash;
+        newMarker.packageVersion = marker.packageVersion;
+        result.skippedOlderPackage.push(rel);
+      } else if (lastWritten && destHash === lastWritten) {
         fs38.writeFileSync(dest, src);
         newMarker.files[rel] = srcHash;
         result.updated.push(rel);
@@ -52757,6 +52809,7 @@ function summarizeInstall(r) {
   if (r.installed.length) bits.push(`${r.installed.length} installed`);
   if (r.updated.length) bits.push(`${r.updated.length} updated`);
   if (r.skippedUserModified.length) bits.push(`${r.skippedUserModified.length} kept (your edits)`);
+  if (r.skippedOlderPackage.length) bits.push(`${r.skippedOlderPackage.length} kept (newer than this version)`);
   if (r.errors.length) bits.push(`${r.errors.length} errors`);
   if (bits.length === 0) return "";
   return `Skills: ${bits.join(", ")} \u2192 ${r.targetDir}`;
@@ -52786,6 +52839,9 @@ function registerSkillsTool(server2, packageVersion, baseDir) {
           installed: result.installed,
           updated: result.updated,
           keptYourEdits: result.skippedUserModified,
+          // A member running an older install alongside a newer one would otherwise
+          // have their skills rolled back without a word. BUG-2026-09-10-01.
+          keptNewerThanThisVersion: result.skippedOlderPackage,
           unchanged: result.unchanged.length,
           errors: result.errors,
           next: result.installed.length > 0 || result.updated.length > 0 ? "Fully restart Claude (quit and reopen) so the new/updated skills load." : "Everything already current."

package/guide/guide.html

@@ -4,7 +4,7 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>GHL Command — User Guide</title>
-<!-- guides-hash: c6cd1ce6e416eaff -->
+<!-- guides-hash: 85b384b5142e9278 -->
 <style>
 /* Deliberately light in every environment, including a dark-mode OS. This is a
    reference document people read at length, print, and save to PDF, and a page
@@ -677,20 +677,21 @@ Then tell me which ones you can fix safely and which ones need a decision from m
 <div class="pro"><div class="pro-head"><b>The exact ask we run on real client accounts</b><span class="pill full">Proven live</span><button class="copy" type="button">Copy</button></div><p class="pro-body">Run the GHL Command Blueprint for a new client.
 The business: [Radiance Med Spa], a [med spa] in [Austin, Texas]. What they sell: [body contouring and injectables]. Their main goal for the next 90 days: [fill the consult calendar].
 Install the intake form in my [MCP Testing] account, give me the link to send them, and once their answers are in, build the plan from those answers.
-Show me the full plan before anything is created: pipeline and stages, custom fields, tags, calendar, form, funnel, the emails and texts written out, and every workflow. Mark clearly which items you will build and which ones I have to do myself in GHL.
+Show me the full plan before anything is created: pipeline and stages, custom fields, tags, calendar, form, the emails and texts written out, and every workflow. Mark clearly which items you will build and which ones I have to do myself in GHL.
 Build nothing until I say approved.</p></div>
 <p class="gpara">Everything in [brackets] is yours to change. The last line is the gate. The Blueprint is designed to stop there and wait for a human.</p>
 </div>
 <div class="gsec"><h2>What happens when you ask</h2>
 <ol class="steps">
 <li>Claude installs the intake form in the account and gives you the link to send the client.</li>
-<li>When their answers land, it turns them into a build plan: pipeline, fields, tags, calendar, form, funnel, messages, workflows. Every message written out in full. The answers arrive as a <b>contact</b> in the account, tagged <code>blueprint-intake</code>, carrying every question as a field on that contact. That is where Claude reads them from.</li>
+<li>When their answers land, it turns them into a build plan: pipeline, fields, tags, calendar, form, messages, workflows. Every message written out in full. The answers arrive as a <b>contact</b> in the account, tagged <code>blueprint-intake</code>, carrying every question as a field on that contact. That is where Claude reads them from.</li>
 <li>You read it and change anything in plain English. Then you approve, and only then does it start building. Before your approval the plan is a dry run: it resolves every reference and reports what it would do, and writes none of it.</li>
 <li>It builds in order, checks each piece exists after it creates it, and hands you the manual checklist for the parts that need a human in GHL.</li>
 </ol>
 </div>
 <div class="gsec"><h2>Good to know</h2>
 <ul>
+<li><b>The Blueprint does not build a funnel, a page, or a website, and that is deliberate.</b> GoHighLevel's own page builder was never good enough to hand a client, so the build stops at the account: pipeline, fields, tags, calendar, form, messages and workflows. A plan that asks for a funnel is refused rather than half-built. <b>You have not lost funnels.</b> GHL Command still installs one of GoHighLevel's own designed funnels from its library (see *Build a funnel from a template*), still creates funnels and pages directly, and Page Studio still composes pages and whole sites. Pages are simply their own job, after the account exists, on hosting you choose.</li>
 <li>Triggers get scoped to the thing you actually meant. An appointment trigger can be tied to one calendar, so a caregiver interview does not start the family consultation sequence. A reply trigger can be narrowed to a tag or to whether the reply was a yes or a no, instead of firing on every inbound message. Missed calls can be caught by call outcome, and failed phone-number checks by validation state. Say which one you mean in plain English and the plan carries it through.</li>
 <li>If a workflow step moves a deal to a new stage, the plan makes it find the deal first. That pairing is checked before the build runs, because a stage move on its own saves cleanly and then does nothing at all.</li>
 <li>The manual list is short but real: connecting a payment provider, phone and A2P registration, connecting social accounts, and domain settings. Those need a human with account access, and no tool can honestly do them for you.</li>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elitedcs/ghl-mcp",
-  "version": "3.83.2",
+  "version": "3.83.3",
   "mcpName": "io.github.drjerryrelth/ghl-command",
   "description": "GoHighLevel MCP Server for Claude. 250 tools — full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
   "main": "dist/index.js",