@elitedcs/ghl-mcp 3.83.2 → 3.83.4

package/CHANGELOG.md

@@ -2,6 +2,60 @@
 
 ## Unreleased
 
+## 3.83.4 — one door for every write, so "protected" cannot quietly stop meaning protected
+
+3.83.3 fixed the holes. This closes the shape that kept making them.
+
+Marking a client account protected is checked in one place for the public API. But
+this product also writes to GoHighLevel through its own builder connection, and
+eleven tool modules had each grown their own copy of that request — their own
+headers, their own timeout, their own fetch. Every copy was a separate door into
+your account, and a check added to one of them told you nothing about the other
+ten. That is why the last release had to find fourteen of them.
+
+They now share one door. It builds the headers, applies the thirty-second timeout
+and runs the protected-account check once, for all of them. A tool written next
+year gets the check without its author having to remember, and a test refuses any
+new code that tries to go around it.
+
+Nothing about what the tools do has changed. The same requests go to the same
+places with the same bodies and the same headers, including the two different
+builder origins GoHighLevel requires for page saves and for everything else. If
+you cannot tell the difference from the outside, that is the intended result.
+
+Also in this release: `update_form` now tells you what a field needs in order to
+RENDER rather than only how to send one. A custom question needs the real custom
+field's id, key and data type from your account; a field written without them is
+stored and shows as raw data instead of a rendered field.
+
+## 3.83.3 — an account you marked protected is now actually protected
+
+**Marking a client account protected did not stop fourteen write paths from writing to it.**
+The guard was real and it was in the right place for the public API, but this product also
+writes to GoHighLevel through its own builder connection, and those calls never passed it.
+So a build could create a pipeline and a form on an account you had explicitly told it never
+to touch, and nothing would say so. Pipelines and forms are the first two things a build
+creates. Every one of those paths now goes through the same check, including the template
+installer, which writes a funnel and its pages — the case that matters most, because
+GoHighLevel keeps only the first content save on a page.
+
+**Verify no longer needs your own Anthropic key before it will let you start.** A new client
+with no key met a disabled Run button, while the same screen said most people do not need to
+paste anything there. Both were true at once: runs use whatever you are signed in to Claude
+with and cost nothing extra, and the readiness check demanded a key anyway. The key is
+reported now, not required. If you have one saved, runs bill it; if you do not, they use your
+Claude sign-in.
+
+**The Verify tile stopped promising something it could not do.** It said it submits a test
+lead and deletes it. Since funnels left the build, no plan it creates has anywhere to send
+one, and the report a screen later said so. It now says what it actually does for every plan,
+and still discloses the test lead for the accounts that can take one.
+
+**An older install can no longer roll your skills backwards.** The installer refreshed any
+skill file it had written before, without checking whether the version doing the writing was
+older than the one that wrote it. Running an older copy alongside a newer one quietly reverted
+your skills. It refuses now and tells you it kept the newer ones.
+
 ## 3.83.2 — the static design-rule harness and its fixtures leave the package
 
 A development harness and its four HTML fixtures were in the published package in

package/README.md

@@ -897,7 +897,7 @@ Built by **[Elite DCs, LLC](https://elitedcs.com)** — a digital marketing and
 
 **Tech stack:** TypeScript, Node.js, esbuild, MCP SDK, Zod, GHL API v2, Firebase Auth
 
-**Version:** 3.83.2
+**Version:** 3.83.4
 
 ---
 

package/dist/index.js

@@ -1922,6 +1922,25 @@ function validateActionChain(actions, existingIds) {
     }
   }
 }
+async function builderRequest(client, method, url, opts = {}) {
+  assertWriteAllowed(method, url, { body: opts.body, defaultLocationId: client.locationId });
+  const headers = { ...await client.buildHeaders(), ...opts.headers ?? {} };
+  const init = { method, headers };
+  if (opts.body !== void 0) init.body = JSON.stringify(opts.body);
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 3e4);
+  init.signal = controller.signal;
+  try {
+    return await fetch(url, init);
+  } catch (error) {
+    if (error instanceof Error && error.name === "AbortError") {
+      throw new Error(`Request timeout (30s): ${method} ${url}`);
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
 var fs4, path4, dotenv, import_zod4, BACKEND_BASE, FIREBASE_TOKEN_URL, MAX_RETRIES2, BASE_DELAY_MS2, FirebaseTokenSchema, WorkflowActionSchema, WorkflowFullSchema, CreateWorkflowResponseSchema, ParkedContactsError, UUID_V4, WorkflowBuilderClient;
 var init_workflow_builder_client = __esm({
   "src/workflow-builder-client.ts"() {
@@ -7435,13 +7454,8 @@ function registerEmailTools(server2, client) {
 function registerEmailBuilderInternalTools(server2, builderClient, publicClient) {
   if (!builderClient) return;
   const client = builderClient;
-  async function builderRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
-    const response = await fetch(`${EMAIL_BUILDER_BASE}${path39}`, {
-      method,
-      headers,
-      body: body ? JSON.stringify(body) : void 0
-    });
+  async function builderRequest2(method, path39, body) {
+    const response = await builderRequest(client, method, `${EMAIL_BUILDER_BASE}${path39}`, body ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Email Builder API Error ${response.status}: ${method} /emails/builder${path39}
@@ -7463,7 +7477,7 @@ ${text2}`);
       const loc = locationId2 ?? client.locationId;
       return deleteEmailTemplateThroughDoors({
         publicDelete: () => publicClient.delete(publicEmailTemplateDeletePath(loc, templateId)),
-        internalDelete: () => builderRequest("DELETE", internalEmailTemplateDeletePath(templateId, loc))
+        internalDelete: () => builderRequest2("DELETE", internalEmailTemplateDeletePath(templateId, loc))
       });
     }
   );
@@ -7478,7 +7492,7 @@ ${text2}`);
     },
     async ({ templateId, name, locationId: locationId2 }) => {
       const loc = locationId2 ?? client.locationId;
-      return builderRequest("PATCH", `/${templateId}`, { locationId: loc, name });
+      return builderRequest2("PATCH", `/${templateId}`, { locationId: loc, name });
     }
   );
   safeTool(
@@ -7492,7 +7506,7 @@ ${text2}`);
     },
     async ({ templateId, archived, locationId: locationId2 }) => {
       const loc = locationId2 ?? client.locationId;
-      return builderRequest("PATCH", `/${templateId}`, { locationId: loc, archived: archived ?? true });
+      return builderRequest2("PATCH", `/${templateId}`, { locationId: loc, archived: archived ?? true });
     }
   );
   safeTool(
@@ -7507,11 +7521,8 @@ ${text2}`);
     },
     async ({ name, body, type, locationId: locationId2 }) => {
       const loc = locationId2 ?? client.locationId;
-      const headers = await client.buildHeaders();
-      const response = await fetch(`${SNIPPETS_BASE}/${loc}`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(buildSnippetPayload({ name, body, type }))
+      const response = await builderRequest(client, "POST", `${SNIPPETS_BASE}/${loc}`, {
+        body: buildSnippetPayload({ name, body, type })
       });
       if (!response.ok) {
         const text2 = await response.text();
@@ -7541,6 +7552,7 @@ var init_emails = __esm({
     init_account_read_retry();
     init_account_reads();
     import_zod28 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
     EMAIL_BUILDER_BASE = "https://backend.leadconnectorhq.com/emails/builder";
     SNIPPETS_BASE = "https://services.leadconnectorhq.com/snippets";
@@ -10289,12 +10301,15 @@ function readId(workflow) {
   const id = workflow._id ?? record.id;
   return typeof id === "string" ? id : "";
 }
+function attributeBag(attributes) {
+  return attributes ? Object.fromEntries(Object.entries(attributes)) : {};
+}
 function summarizeWebhookWorkflow(workflow) {
   const templates = workflow.workflowData?.templates ?? [];
   const webhookActions = templates.filter((action) => action.type === "webhook");
   if (!webhookActions.length) return null;
   const actions = webhookActions.map((action) => {
-    const attributes = action.attributes ?? {};
+    const attributes = attributeBag(action.attributes);
     return {
       actionId: action.id,
       name: action.name,
@@ -10451,7 +10466,7 @@ function registerWebhookTools(server2, builderClient) {
         }
         const target = actionId ? webhookActions.find((a) => a.id === actionId) : webhookActions[0];
         if (!target) throw new Error(`No webhook action with id ${actionId} on workflow ${webhookId}.`);
-        const attributes = target.attributes ?? {};
+        const attributes = attributeBag(target.attributes);
         const validated = buildWebhookAction({
           id: target.id,
           name: target.name,
@@ -11233,15 +11248,17 @@ function registerFunnelBuilderTools(server2, builderClient) {
     return client.request("DELETE", path39);
   }
   async function funnelRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
-    headers.Origin = "https://app.gohighlevel.com";
-    headers.Referer = "https://app.gohighlevel.com/";
     const url = `https://backend.leadconnectorhq.com/funnels${path39}`;
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT")) {
-      options.body = JSON.stringify(body);
-    }
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+    const response = await builderRequest(client, method, url, {
+      ...sendsBody ? { body } : {},
+      headers: {
+        // Internal-API calls require the app origin (autosave needs the
+        // page-builder one instead; see the autosave call).
+        Origin: "https://app.gohighlevel.com",
+        Referer: "https://app.gohighlevel.com/"
+      }
+    });
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Funnel API Error ${response.status}: ${method} ${path39}
@@ -11503,11 +11520,17 @@ ${text2}`);
     };
   }
   async function autosaveRequest(pageId, body) {
-    const headers = await client.buildHeaders();
-    headers.Origin = "https://page-builder.leadconnectorhq.com";
-    headers.Referer = "https://page-builder.leadconnectorhq.com/";
     const url = `https://backend.leadconnectorhq.com/funnels/builder/autosave/${pageId}`;
-    const response = await fetch(url, { method: "POST", headers, body: JSON.stringify(body) });
+    const response = await builderRequest(client, "POST", url, {
+      body,
+      headers: {
+        // The autosave endpoint's IAM check requires the builder origin (verified
+        // live — app.gohighlevel.com was not tested and page-builder is what the
+        // real builder sends).
+        Origin: "https://page-builder.leadconnectorhq.com",
+        Referer: "https://page-builder.leadconnectorhq.com/"
+      }
+    });
     if (!response.ok) {
       throw new Error(`Funnel API Error ${response.status}: POST /builder/autosave/${pageId}
 ${await response.text()}`);
@@ -11613,6 +11636,7 @@ var init_funnel_builder = __esm({
   "src/tools/funnel-builder.ts"() {
     "use strict";
     import_zod41 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
     init_page_reads();
   }
@@ -11815,6 +11839,9 @@ function requireCompany(api) {
 }
 async function call(api, path39, init) {
   const headers = { ...await api.headers(), Origin: "https://app.gohighlevel.com", Referer: "https://app.gohighlevel.com/" };
+  if (MUTATING_PATHS.some((mutating) => path39.startsWith(mutating))) {
+    assertWriteAllowed("POST", SVC + path39, { defaultLocationId: api.locationId() });
+  }
   const doFetch = api.fetch ?? fetch;
   const response = await doFetch(SVC + path39, { ...init, headers });
   const text = await response.text();
@@ -11908,12 +11935,14 @@ function rankForBrand(rows, brand) {
     return { ...t, why: parts.join("; ") };
   });
 }
-var SVC, GHL_ID;
+var SVC, MUTATING_PATHS, GHL_ID;
 var init_ghl_templates = __esm({
   "src/command-os/design/ghl-templates.ts"() {
     "use strict";
     init_color();
+    init_account_rules();
     SVC = "https://services.leadconnectorhq.com";
+    MUTATING_PATHS = ["/templates/template/load"];
     GHL_ID = /^[A-Za-z0-9]{15,40}$/;
   }
 });
@@ -16465,10 +16494,15 @@ function registerPageStudioTools(server2, builderClient) {
     return { map: out, truncated };
   }
   async function funnelRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
-    headers.Origin = "https://app.gohighlevel.com";
-    headers.Referer = "https://app.gohighlevel.com/";
-    const response = await fetch(`https://backend.leadconnectorhq.com/funnels${path39}`, { method, headers, ...body && { body: JSON.stringify(body) } });
+    const response = await builderRequest(client, method, `https://backend.leadconnectorhq.com/funnels${path39}`, {
+      ...body ? { body } : {},
+      headers: {
+        // Internal-API calls require the app origin (autosave needs the
+        // page-builder one instead; see the autosave call).
+        Origin: "https://app.gohighlevel.com",
+        Referer: "https://app.gohighlevel.com/"
+      }
+    });
     if (!response.ok) throw new Error(`Funnel API Error ${response.status}: ${method} ${path39}
 ${await response.text()}`);
     const text = await response.text();
@@ -16485,13 +16519,13 @@ ${await response.text()}`);
     }
   }
   async function autosaveRequest(pageId, body) {
-    const headers = await client.buildHeaders();
-    headers.Origin = "https://page-builder.leadconnectorhq.com";
-    headers.Referer = "https://page-builder.leadconnectorhq.com/";
-    const response = await fetch(`https://backend.leadconnectorhq.com/funnels/builder/autosave/${pageId}`, {
-      method: "POST",
-      headers,
-      body: JSON.stringify(body)
+    const autosaveUrl = `https://backend.leadconnectorhq.com/funnels/builder/autosave/${pageId}`;
+    const response = await builderRequest(client, "POST", autosaveUrl, {
+      body,
+      headers: {
+        Origin: "https://page-builder.leadconnectorhq.com",
+        Referer: "https://page-builder.leadconnectorhq.com/"
+      }
     });
     if (!response.ok) throw new Error(`Funnel API Error ${response.status}: POST /builder/autosave/${pageId}
 ${await response.text()}`);
@@ -16977,6 +17011,7 @@ var init_page_studio = __esm({
     "use strict";
     import_zod43 = require("zod");
     crypto4 = __toESM(require("node:crypto"));
+    init_workflow_builder_client();
     init_ghl_templates();
     init_retheme();
     init_ghl_page();
@@ -17073,13 +17108,9 @@ function cleanFormDataForSave(formData) {
   return isJsonObject(cleaned) ? cleaned : formData;
 }
 async function formApiRequest(client, method, path39, body) {
-  const headers = await client.buildHeaders();
   const url = `https://backend.leadconnectorhq.com/forms${path39}`;
-  const options = { method, headers };
-  if (body && (method === "POST" || method === "PUT")) {
-    options.body = JSON.stringify(body);
-  }
-  const response = await fetch(url, options);
+  const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+  const response = await builderRequest(client, method, url, sendsBody ? { body } : {});
   if (!response.ok) {
     const text2 = await response.text();
     throw new Error(`Form API Error ${response.status}: ${method} ${path39}
@@ -17146,10 +17177,10 @@ function registerFormBuilderTools(server2, builderClient, publicClient) {
   );
   server2.tool(
     "update_form",
-    "Update a form's structure \u2014 fields, labels, conditional logic, auto-responder, email notifications, styling. Use get_form_full first to read the current form, modify the formData object, then pass it here. If name is omitted, the current name is preserved (one extra GET).",
+    "Update a form's structure \u2014 fields, labels, conditional logic, auto-responder, email notifications, styling. Use get_form_full first to read the current form, modify the formData object, then pass it here. If name is omitted, the current name is preserved (one extra GET). IMPORTANT \u2014 a NEW field will not render in GoHighLevel's form editor unless it carries the binding GHL needs: a custom-question field must include the real custom field's `id`, `fieldKey` and `dataType` from THIS account (read them with get_custom_fields first; do not invent them), and a standard field (first_name, last_name, email, phone) needs `standard: true` with its `tag`. A field written without that binding is stored but shows as raw data instead of a rendered field. These shapes were reverse-engineered from live UI-built forms; copy an existing field from get_form_full rather than composing one from memory.",
     {
       formId: import_zod44.z.string().describe("The form ID to update."),
-      formData: import_zod44.z.record(import_zod44.z.string(), import_zod44.z.unknown()).describe("The updated formData object containing form fields, settings, autoResponder config, etc."),
+      formData: import_zod44.z.record(import_zod44.z.string(), import_zod44.z.unknown()).describe("The updated formData object containing form fields, settings, autoResponder config, etc. Fields live at formData.form.fields; each one needs the binding described above or the editor cannot render it."),
       name: import_zod44.z.string().optional().describe("Updated form name. If omitted, the current name is preserved.")
     },
     async ({ formId, formData, name }) => {
@@ -17276,6 +17307,7 @@ var init_form_builder = __esm({
   "src/tools/form-builder.ts"() {
     "use strict";
     import_zod44 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
   }
 });
@@ -17669,13 +17701,9 @@ function registerPipelineBuilderTools(server2, builderClient) {
   if (!builderClient) return;
   const client = builderClient;
   async function pipelineRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
     const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path39}`;
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT" || method === "PATCH")) {
-      options.body = JSON.stringify(body);
-    }
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT" || method === "PATCH");
+    const response = await builderRequest(client, method, url, sendsBody ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Pipeline API Error ${response.status}: ${method} ${path39}
@@ -17853,6 +17881,7 @@ var init_pipeline_builder = __esm({
   "src/tools/pipeline-builder.ts"() {
     "use strict";
     import_zod46 = require("zod");
+    init_workflow_builder_client();
   }
 });
 
@@ -26972,8 +27001,13 @@ async function clientPreflight(registry2, locationId2) {
     }
   } catch {
   }
-  lines.push({ key: "authentication", ok: authenticated, text: authenticated ? "The Anthropic key authenticates." : key ? "The Anthropic key did not authenticate. Paste a working key in Your agency and press Check and save this key." : "Paste your Anthropic key in Your agency and press Check and save this key." });
-  return { ok: lines.every((l) => l.ok), lines };
+  lines.push({
+    key: "authentication",
+    ok: authenticated,
+    text: authenticated ? "Your Anthropic key authenticates, so powered runs will bill it." : key ? "The saved Anthropic key did not authenticate, so powered runs will fall back to your Claude sign-in on this computer. Replace it in Your agency, or remove it." : "No Anthropic key saved. Powered runs use your Claude sign-in on this computer and cost you nothing extra."
+  });
+  const blocking = lines.filter((l) => l.key !== "authentication");
+  return { ok: blocking.every((l) => l.ok), lines };
 }
 async function agencyConnectionReady(registry2, companyId) {
   const key = registry2.getAgencyKey();
@@ -28557,7 +28591,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.83.2",
+      version: "3.83.4",
       mcpName: "io.github.drjerryrelth/ghl-command",
       description: "GoHighLevel MCP Server for Claude. 250 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
@@ -35206,7 +35240,7 @@ function card(c,state,run){const st=(state.clients[c.locationId]||{stages:STAGES
    el.appendChild(box)}
   // One short line here; the button's confirmation carries the full wording. At 135
   // characters this sentence made every stage box 677 px tall (auditor, 2026-09-07).
-  if(i===4){const disclosure=document.createElement("small");disclosure.textContent="Submits one test lead, then deletes it.";el.appendChild(disclosure)}
+  if(i===4){const disclosure=document.createElement("small");disclosure.textContent="Reads every planned item back. May submit and delete one test lead.";el.appendChild(disclosure)}
   if(gate)el.title=gate;
   if(stale&&!live){const reason=document.createElement("small");reason.textContent=stale.reason;el.appendChild(reason)}
   const oc=(state.outcomes||{})[c.locationId+":"+i];
@@ -39192,13 +39226,9 @@ function registerSmartListTools(server2, builderClient) {
   if (!builderClient) return;
   const client = builderClient;
   async function smartListRequest(method, path39, body) {
-    const headers = await client.buildHeaders();
     const url = `${SMARTLIST_BASE}${path39}`;
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT")) {
-      options.body = JSON.stringify(body);
-    }
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+    const response = await builderRequest(client, method, url, sendsBody ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Smart Lists API Error ${response.status}: ${method} ${path39}
@@ -39263,7 +39293,7 @@ ${await res.text()}`);
         ];
         const body = buildContactSmartListBody({ listName: name, locationId: loc, filters });
         const headers = await client.buildHeaders();
-        const res = await fetch(CONTACT_SMARTLIST_BASE, { method: "POST", headers, body: JSON.stringify(body) });
+        const res = await builderRequest(client, "POST", CONTACT_SMARTLIST_BASE, { body });
         if (!res.ok) throw new Error(`Smart Lists API Error ${res.status}: POST /contacts/smartlist
 ${await res.text()}`);
         return jsonResponse(JSON.parse(await res.text() || "{}"));
@@ -39300,11 +39330,7 @@ ${await res.text()}`);
     async ({ listId }) => {
       try {
         const headers = await client.buildHeaders();
-        const res = await fetch(CONTACT_SMARTLIST_DELETE, {
-          method: "POST",
-          headers,
-          body: JSON.stringify({ smartlist_id: listId })
-        });
+        const res = await builderRequest(client, "POST", CONTACT_SMARTLIST_DELETE, { body: { smartlist_id: listId } });
         if (!res.ok) throw new Error(`Smart Lists API Error ${res.status}: POST /smartlist/delete
 ${await res.text()}`);
         return jsonResponse(JSON.parse(await res.text() || "{}"));
@@ -39412,6 +39438,7 @@ var init_smart_lists = __esm({
   "src/tools/smart-lists.ts"() {
     "use strict";
     import_zod57 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
     SMARTLIST_BASE = "https://backend.leadconnectorhq.com/lists/dynamic";
     OBJECT_KEYS = ["contacts", "opportunity"];
@@ -39434,8 +39461,7 @@ function registerReputationTools(server2, builderClient) {
   if (!builderClient) return;
   const client = builderClient;
   async function reputationRequest(method, path39) {
-    const headers = await client.buildHeaders();
-    const response = await fetch(`${REPUTATION_BASE}${path39}`, { method, headers });
+    const response = await builderRequest(client, method, `${REPUTATION_BASE}${path39}`);
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Reputation API Error ${response.status}: ${method} ${path39}
@@ -39511,6 +39537,7 @@ var init_reputation = __esm({
   "src/tools/reputation.ts"() {
     "use strict";
     import_zod58 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
     REPUTATION_BASE = "https://backend.leadconnectorhq.com/reputation";
   }
@@ -39545,12 +39572,7 @@ function registerEmailCampaignTools(server2, builderClient) {
       if (isPlainText !== void 0) body.isPlainText = isPlainText;
       if (enableResendToUnopened !== void 0) body.enableResendToUnopened = enableResendToUnopened;
       if (hasUtmTracking !== void 0) body.hasUtmTracking = hasUtmTracking;
-      const headers = await client.buildHeaders();
-      const response = await fetch(`${SVC_BASE}/emails/schedule`, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(body)
-      });
+      const response = await builderRequest(client, "POST", `${SVC_BASE}/emails/schedule`, { body });
       if (!response.ok) {
         const text2 = await response.text();
         throw new Error(`Email Campaign API Error ${response.status}: POST /emails/schedule
@@ -39570,6 +39592,7 @@ var init_email_campaigns = __esm({
   "src/tools/email-campaigns.ts"() {
     "use strict";
     import_zod59 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
     SVC_BASE = "https://services.leadconnectorhq.com";
   }
@@ -39580,12 +39603,7 @@ function registerMembershipTools(server2, builderClient) {
   if (!builderClient) return;
   const client = builderClient;
   async function membershipRequest(path39, method = "GET", body) {
-    const headers = await client.buildHeaders();
-    const response = await fetch(`${MEMBERSHIP_BASE2}${path39}`, {
-      method,
-      headers,
-      body: body ? JSON.stringify(body) : void 0
-    });
+    const response = await builderRequest(client, method, `${MEMBERSHIP_BASE2}${path39}`, body ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Membership API Error ${response.status}: ${method} ${path39}
@@ -39766,6 +39784,7 @@ var init_memberships = __esm({
   "src/tools/memberships.ts"() {
     "use strict";
     import_zod60 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
     MEMBERSHIP_BASE2 = "https://backend.leadconnectorhq.com/membership";
   }
@@ -40114,11 +40133,8 @@ Pipelines: ${template.pipelines.length} to create`);
               }
             } else {
               try {
-                const headers = await builderClient.buildHeaders();
-                const res = await fetch("https://backend.leadconnectorhq.com/opportunities/pipelines", {
-                  method: "POST",
-                  headers,
-                  body: JSON.stringify({
+                const res = await builderRequest(builderClient, "POST", "https://backend.leadconnectorhq.com/opportunities/pipelines", {
+                  body: {
                     name: resolved2.name,
                     stages: (resolved2.stages || []).map((s) => ({
                       ...s,
@@ -40128,7 +40144,7 @@ Pipelines: ${template.pipelines.length} to create`);
                     locationId: locId,
                     showInFunnel: true,
                     showInPieChart: true
-                  })
+                  }
                 });
                 if (res.ok) {
                   counts.pipelines.created++;
@@ -40289,6 +40305,7 @@ var init_template_deployer = __esm({
     init_tool_helpers();
     fs28 = __toESM(require("fs"));
     path27 = __toESM(require("path"));
+    init_workflow_builder_client();
     TemplateSchema = import_zod61.z.object({
       templateName: import_zod61.z.string(),
       templateVersion: import_zod61.z.string().optional(),
@@ -50950,8 +50967,7 @@ function pickCalendarPins(workflow) {
 }
 function makeFirebaseRequest(builderClient) {
   return async (url, method, body) => {
-    const headers = await builderClient.buildHeaders();
-    const response = await fetch(url, { method, headers, body: body ? JSON.stringify(body) : void 0 });
+    const response = await builderRequest(builderClient, method, url, body ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`API ${response.status}: ${method} ${url.replace(/^https:\/\/[^/]+/, "")}
@@ -50963,11 +50979,9 @@ ${text2}`);
 }
 function makePipelineApi(builderClient) {
   return async (method, path39, body) => {
-    const headers = await builderClient.buildHeaders();
     const url = `https://backend.leadconnectorhq.com/opportunities/pipelines${path39}`;
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT")) options.body = JSON.stringify(body);
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+    const response = await builderRequest(builderClient, method, url, sendsBody ? { body } : {});
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Pipeline API ${response.status}: ${method} ${path39}
@@ -50984,13 +50998,17 @@ ${text2}`);
 }
 function makeFunnelApi(builderClient) {
   return async (method, path39, body) => {
-    const headers = await builderClient.buildHeaders();
-    headers.Origin = "https://app.gohighlevel.com";
-    headers.Referer = "https://app.gohighlevel.com/";
     const url = `https://backend.leadconnectorhq.com/funnels${path39}`;
-    const options = { method, headers };
-    if (body && (method === "POST" || method === "PUT")) options.body = JSON.stringify(body);
-    const response = await fetch(url, options);
+    const sendsBody = body !== void 0 && (method === "POST" || method === "PUT");
+    const response = await builderRequest(builderClient, method, url, {
+      ...sendsBody ? { body } : {},
+      headers: {
+        // Origin/Referer REQUIRED on internal-API funnel writes (else 401
+        // "Error calling IAM service") — verified in funnel-builder.ts.
+        Origin: "https://app.gohighlevel.com",
+        Referer: "https://app.gohighlevel.com/"
+      }
+    });
     if (!response.ok) {
       const text2 = await response.text();
       throw new Error(`Funnel API ${response.status}: ${method} ${path39}
@@ -52101,6 +52119,7 @@ var init_intake_to_build = __esm({
     init_build_contract();
     init_build_obligations();
     import_zod80 = require("zod");
+    init_workflow_builder_client();
     init_tool_helpers();
     init_form_builder();
     init_calendars();
@@ -52658,6 +52677,15 @@ var os6 = __toESM(require("node:os"));
 function sha2562(buf) {
   return (0, import_node_crypto12.createHash)("sha256").update(buf).digest("hex");
 }
+function isOlderRelease(candidate, installed) {
+  const parts = (v) => v.trim().split(".").map((n) => Number.parseInt(n, 10));
+  const a = parts(candidate), b = parts(installed);
+  if (a.length !== 3 || b.length !== 3 || [...a, ...b].some(Number.isNaN)) return false;
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) return a[i] < b[i];
+  }
+  return false;
+}
 function bundledSkillsDir(baseDir) {
   const candidate = path37.resolve(baseDir, "..", "skills");
   try {
@@ -52691,6 +52719,7 @@ function installBundledSkills(opts) {
     installed: [],
     updated: [],
     skippedUserModified: [],
+    skippedOlderPackage: [],
     unchanged: [],
     errors: [],
     targetDir: opts.targetDir ?? path37.join(os6.homedir(), ".claude", "skills"),
@@ -52733,7 +52762,11 @@ function installBundledSkills(opts) {
         continue;
       }
       const lastWritten = marker.files[rel];
-      if (lastWritten && destHash === lastWritten) {
+      if (lastWritten && destHash === lastWritten && isOlderRelease(opts.packageVersion, marker.packageVersion)) {
+        newMarker.files[rel] = destHash;
+        newMarker.packageVersion = marker.packageVersion;
+        result.skippedOlderPackage.push(rel);
+      } else if (lastWritten && destHash === lastWritten) {
         fs38.writeFileSync(dest, src);
         newMarker.files[rel] = srcHash;
         result.updated.push(rel);
@@ -52757,6 +52790,7 @@ function summarizeInstall(r) {
   if (r.installed.length) bits.push(`${r.installed.length} installed`);
   if (r.updated.length) bits.push(`${r.updated.length} updated`);
   if (r.skippedUserModified.length) bits.push(`${r.skippedUserModified.length} kept (your edits)`);
+  if (r.skippedOlderPackage.length) bits.push(`${r.skippedOlderPackage.length} kept (newer than this version)`);
   if (r.errors.length) bits.push(`${r.errors.length} errors`);
   if (bits.length === 0) return "";
   return `Skills: ${bits.join(", ")} \u2192 ${r.targetDir}`;
@@ -52786,6 +52820,9 @@ function registerSkillsTool(server2, packageVersion, baseDir) {
           installed: result.installed,
           updated: result.updated,
           keptYourEdits: result.skippedUserModified,
+          // A member running an older install alongside a newer one would otherwise
+          // have their skills rolled back without a word. BUG-2026-09-10-01.
+          keptNewerThanThisVersion: result.skippedOlderPackage,
           unchanged: result.unchanged.length,
           errors: result.errors,
           next: result.installed.length > 0 || result.updated.length > 0 ? "Fully restart Claude (quit and reopen) so the new/updated skills load." : "Everything already current."

package/guide/guide.html

@@ -4,7 +4,7 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>GHL Command — User Guide</title>
-<!-- guides-hash: c6cd1ce6e416eaff -->
+<!-- guides-hash: 85b384b5142e9278 -->
 <style>
 /* Deliberately light in every environment, including a dark-mode OS. This is a
    reference document people read at length, print, and save to PDF, and a page
@@ -677,20 +677,21 @@ Then tell me which ones you can fix safely and which ones need a decision from m
 <div class="pro"><div class="pro-head"><b>The exact ask we run on real client accounts</b><span class="pill full">Proven live</span><button class="copy" type="button">Copy</button></div><p class="pro-body">Run the GHL Command Blueprint for a new client.
 The business: [Radiance Med Spa], a [med spa] in [Austin, Texas]. What they sell: [body contouring and injectables]. Their main goal for the next 90 days: [fill the consult calendar].
 Install the intake form in my [MCP Testing] account, give me the link to send them, and once their answers are in, build the plan from those answers.
-Show me the full plan before anything is created: pipeline and stages, custom fields, tags, calendar, form, funnel, the emails and texts written out, and every workflow. Mark clearly which items you will build and which ones I have to do myself in GHL.
+Show me the full plan before anything is created: pipeline and stages, custom fields, tags, calendar, form, the emails and texts written out, and every workflow. Mark clearly which items you will build and which ones I have to do myself in GHL.
 Build nothing until I say approved.</p></div>
 <p class="gpara">Everything in [brackets] is yours to change. The last line is the gate. The Blueprint is designed to stop there and wait for a human.</p>
 </div>
 <div class="gsec"><h2>What happens when you ask</h2>
 <ol class="steps">
 <li>Claude installs the intake form in the account and gives you the link to send the client.</li>
-<li>When their answers land, it turns them into a build plan: pipeline, fields, tags, calendar, form, funnel, messages, workflows. Every message written out in full. The answers arrive as a <b>contact</b> in the account, tagged <code>blueprint-intake</code>, carrying every question as a field on that contact. That is where Claude reads them from.</li>
+<li>When their answers land, it turns them into a build plan: pipeline, fields, tags, calendar, form, messages, workflows. Every message written out in full. The answers arrive as a <b>contact</b> in the account, tagged <code>blueprint-intake</code>, carrying every question as a field on that contact. That is where Claude reads them from.</li>
 <li>You read it and change anything in plain English. Then you approve, and only then does it start building. Before your approval the plan is a dry run: it resolves every reference and reports what it would do, and writes none of it.</li>
 <li>It builds in order, checks each piece exists after it creates it, and hands you the manual checklist for the parts that need a human in GHL.</li>
 </ol>
 </div>
 <div class="gsec"><h2>Good to know</h2>
 <ul>
+<li><b>The Blueprint does not build a funnel, a page, or a website, and that is deliberate.</b> GoHighLevel's own page builder was never good enough to hand a client, so the build stops at the account: pipeline, fields, tags, calendar, form, messages and workflows. A plan that asks for a funnel is refused rather than half-built. <b>You have not lost funnels.</b> GHL Command still installs one of GoHighLevel's own designed funnels from its library (see *Build a funnel from a template*), still creates funnels and pages directly, and Page Studio still composes pages and whole sites. Pages are simply their own job, after the account exists, on hosting you choose.</li>
 <li>Triggers get scoped to the thing you actually meant. An appointment trigger can be tied to one calendar, so a caregiver interview does not start the family consultation sequence. A reply trigger can be narrowed to a tag or to whether the reply was a yes or a no, instead of firing on every inbound message. Missed calls can be caught by call outcome, and failed phone-number checks by validation state. Say which one you mean in plain English and the plan carries it through.</li>
 <li>If a workflow step moves a deal to a new stage, the plan makes it find the deal first. That pairing is checked before the build runs, because a stage move on its own saves cleanly and then does nothing at all.</li>
 <li>The manual list is short but real: connecting a payment provider, phone and A2P registration, connecting social accounts, and domain settings. Those need a human with account access, and no tool can honestly do them for you.</li>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elitedcs/ghl-mcp",
-  "version": "3.83.2",
+  "version": "3.83.4",
   "mcpName": "io.github.drjerryrelth/ghl-command",
   "description": "GoHighLevel MCP Server for Claude. 250 tools — full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
   "main": "dist/index.js",