@elitedcs/ghl-mcp 3.91.0 → 3.91.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 3.91.1: Step 7, Staff, says what is true, and one rule decides who gets an admin login
+
+This release is everything in 3.91.0, plus the changes below.
+
+**One rule for who gets an admin login.** Anyone whose job says owner, founder, admin, administrator, CEO, principal or director gets an admin login. If nobody on the team has a job like that, the first person listed gets one, so someone can run the account. Build and Add them for me now follow the same rule, and both mark that person with Admin login before anything is made. Someone who already has a login keeps the level they have.
+
+**Step 7, Staff, says only what it checked.** It says Build waits for the staff, not Intake, it no longer says calendars and lead alerts will use the people it found, and when it cannot add people it says why: the agency key is not connected yet, your plan does not allow it, or GoHighLevel refused it. The board's staff panel now says when someone is in the account at a different login level, as step 7 does. Blueprint Review says the staff are not checked yet, rather than not in the account, when it could not read them.
+
+**A one-time password stays on the page you are on.** When GoHighLevel sets a password for someone it has not listed yet, the page keeps it and shows it the first time a check finds them; Check again and a second Add them for me keep it too. Reloading the page still clears it, so copy it when it appears. Someone taken off the team while their login was being made is shown as still being set up, never as could not be added. When a Build in the cockpit makes someone and GoHighLevel requires a password, the cockpit never shows or keeps it: reset that person's password in GoHighLevel.
+
+**Known limits.** Other programs on this computer, or other people signed in to it, can read what the cockpit shows, including a one-time password while it is on step 7, Staff. Keep the computer to yourself. If two people on the team share a name, their password lines look the same; check the email in GoHighLevel. If you take someone off the team while their login is still being set up, their password is not shown; reset it in GoHighLevel if you add them back.
+
 ## 3.91.0: The board and the brief open much faster
 
 This release is everything in 3.90.1, plus the change below.
@@ -26,8 +38,6 @@ This release is everything in 3.90.0, plus the fix below. It fixes behavior that
 
 **A new login is never made twice while GoHighLevel catches up.** GoHighLevel can take a minute to list a login it has just made. Until it does, step 7 and the board say the person "is still being set up in GoHighLevel", and Add them for me does not send them again, from any page or window, for up to 10 minutes. If GoHighLevel insisted on a password, step 7 now shows the one-time password, as the board does.
 
-**Known limits, fixed in the next release.** The board's staff panel does not show when someone's login level differs from the list. If someone is taken off the team while their login is being made and the connection drops, step 7 can still say they could not be added. Without an agency key, step 7 says your plan does not let you add people. The staff step says Intake waits for it (only Build does), and says calendars and lead alerts will use the people found, which it does not check. Blueprint Review says staff are not in the account when it could not read them. When nobody's job says owner, Build makes the first person listed an admin, while Add them for me makes them a user; Build's confirmation shows it before anything is made.
-
 After Add them for me or Confirm and build, check the client's GoHighLevel Users list.
 
 ## 3.90.0: the cockpit never acts on the wrong client, and refuses a change made from an old page
@@ -860,7 +870,6 @@ website, and that pages are a separate job after the account exists, on hosting
 member owns. A test pins the skill and the plan format together so they cannot
 disagree again.
 
-
 ## 3.83.0 — a build you can check, and no funnel at the end of it
 
 **Blueprint no longer builds a funnel, a page, or a website of any kind.** GoHighLevel's own page
@@ -889,14 +898,12 @@ retried into a duplicate; and read-backs retry a timeout but never retry a genui
 running GHL Command, the stages use the plan you already pay for. Saving a key switches every stage to
 usage billing, which the cockpit and the member hub now say plainly.
 
-
 - Brief checks the intake and writes the review; the build plan is prepared when Build runs.
 - Changed intake answers require a fresh review, changed build plans require verification, and live workflow repairs need approval of the listed changes.
 - Client pages keep the selected client, open the shared intake answers, separate existing inventory from build evidence, and keep generated drafts for review.
 - Verify prepares the client handoff. Local files are shown as prepared, not published, and handoff email delivery requires a reviewed recipient and explicit confirmation.
 - Your agency now has a creation-only switch for sub-accounts from chat. Package preparation creates catalog products and leaves pricing and payment links as a visible manual task.
 
-
 - Register an existing sub-account on either plan path, replace a saved account key, and see chat registrations in the cockpit without restarting. Creation checks the agency connection first and keeps an account visible when its key could not be saved.
 - Intake keeps Interview answers, loads submitted answers, asks before replacing corrections, and identifies missing respondent details. Source uploads are limited to supported text formats and show the 60,000-character limit. Prepared forms and client documents have clickable links.
 - Client Builds checks account access and setup before running, explains Intake’s writes, and uses the same practice-account rules everywhere. Failed verification blocks sign-off, and manual obligations remain visible until checked.
@@ -910,7 +917,6 @@ usage billing, which the cockpit and the member hub now say plainly.
 - **Build a client account guidance corrected.** Existing clients are behind “Work on a client already registered →” and are never pre-selected. Registration confirms the sub-account name and id, never a key hint.
 - **Deletion is separate from registration.** Removing a saved key does not delete the GoHighLevel account. Deletion requires separate authorization; no claim is made that the account's creation method determines whether it can be deleted.
 
-
 ## 3.82.0 — the cockpit laid out like the hub, for Command OS subscribers
 
 The Command OS cockpit was built for one job, the Blueprint build, and that one section
@@ -1502,7 +1508,6 @@ It caught two files that a careful pass by hand had already missed.
 
 Counts unchanged: 247 tools, 51 modules, free tier 111. No tool behaviour changed.
 
-
 ## 3.72.0 — an audit that counts your workflows once
 
 A member ran the account audit on a large agency account. The report came back claiming
@@ -2088,7 +2093,6 @@ them were visible until a guide was written against them and run for real.
   supported). Documented so nobody builds a "send to a third party" node that
   silently mails the contact.
 
-
 ## 3.62.0 — The user guide ships inside the product
 
 - **New tool `get_user_guide`** (free tier included): opens the full GHL Command
@@ -2487,7 +2491,6 @@ builds inside it and verify_funnel proves it.
   a temp dir AND writeCredentials refuses to run under vitest without an
   override.
 
-
 ## 3.50.0 — FREE read-only tier
 
 A free license (`ghlcommand.com/free`, key by email, no card) now runs the same
@@ -2541,7 +2544,6 @@ No behavior changes; text only.
 - `enable_workflow_builder` and `auto_capture_firebase_script` tool descriptions
   point to `capture_firebase_interactive` first.
 
-
 ## 3.49.0 — One-click Workflow Builder unlock (`capture_firebase_interactive`)
 
 The buyer's whole job is now: log into GHL in a Chrome window the tool opens.
@@ -2566,7 +2568,6 @@ No DevTools, no console paste, no JSON shuttling.
   console-paste path, unchanged).
 - Tool count: 228 → 229 (177 without Firebase).
 
-
 ## 3.48.2 — Docs patch: tool-count claims corrected (the real number is 228)
 
 No behavior changes; text only, plus one new test.
@@ -2581,7 +2582,6 @@ No behavior changes; text only, plus one new test.
   `registerAllTools` and fails the suite if package.json, README, or setup-tool copy
   ever disagrees again.
 
-
 ## 3.48.1 — Docs patch: Firebase capture friction + live pricing copy
 
 No behavior changes; text only.
@@ -2597,7 +2597,6 @@ No behavior changes; text only.
   7-step IndexedDB walk is demoted to a collapsed fallback for locked-down browsers;
   multi-tenant instructions reference the script instead of the manual steps.
 
-
 ## 3.48.0 — Blueprint: complete workflow-building (opportunities, branching, appointment timers, opt-in publish)
 
 Completes the `apply_build_plan` executor so a Blueprint build produces workflows that

package/README.md

@@ -899,7 +899,7 @@ Built by **[Elite DCs, LLC](https://elitedcs.com)** — a digital marketing and
 
 **Tech stack:** TypeScript, Node.js, esbuild, MCP SDK, Zod, GHL API v2, Firebase Auth
 
-**Version:** 3.91.0
+**Version:** 3.91.1
 
 ---
 

package/dist/index.js

@@ -8298,19 +8298,24 @@ async function createOrBindUserWith(args, deps) {
   let generatedPassword;
   let raw;
   let lastError = "";
+  const hide = (t) => password ? t.split(password).join("[hidden]") : t;
   for (let attempt = 1; attempt <= 3; attempt++) {
     try {
       raw = await deps.postUser(buildCreateUserBody(args, { includePermissions, password }));
       lastError = "";
       break;
     } catch (e) {
-      lastError = msg(e);
+      lastError = hide(msg(e));
       if (inBuildRequestScope() && isRetryableAccountError(e)) break;
       if (classifyCreateUserError(lastError) === "feature_unavailable") break;
       if (!isDefinitiveRefusal(lastError)) break;
       if (/password/i.test(lastError) && !password) {
         password = generateTemporaryPassword();
         generatedPassword = password;
+        try {
+          await deps.onPassword?.(password);
+        } catch {
+        }
         continue;
       }
       if (/permission/i.test(lastError) && includePermissions) {
@@ -8321,7 +8326,7 @@ async function createOrBindUserWith(args, deps) {
       break;
     }
   }
-  if (lastError) return { ok: false, stage: "create", error: lastError, errorKind: classifyCreateUserError(lastError) };
+  if (lastError) return { ok: false, stage: "create", error: lastError, errorKind: classifyCreateUserError(lastError), ...generatedPassword && !isDefinitiveRefusal(lastError) ? { generatedPassword } : {} };
   const beforeIds = new Set(before.map((u) => u.id));
   let found;
   for (let attempt = 1; attempt <= retries; attempt++) {
@@ -8329,7 +8334,7 @@ async function createOrBindUserWith(args, deps) {
       const now = await deps.listUsers();
       found = findUserByEmail(now, args.email) ?? now.find((u) => !beforeIds.has(u.id) && !u.email);
     } catch (error) {
-      if (inBuildRequestScope()) return { ok: false, stage: "verify", error: msg(error) };
+      if (inBuildRequestScope()) return { ok: false, stage: "verify", error: hide(msg(error)), ...generatedPassword ? { generatedPassword } : {} };
       found = void 0;
     }
     if (found) break;
@@ -8341,11 +8346,9 @@ async function createOrBindUserWith(args, deps) {
       warnings.push("the user was created but did not appear on this location's user list yet (read-after-write lag) \u2014 the id comes from the create response; re-run get_users to confirm.");
       return { ok: true, userId: fromResponse, status: "created", email: args.email, generatedPassword, warnings, rawResponse: raw };
     }
-    return { ok: false, stage: "verify", error: "POST /users/ succeeded but the user never appeared on this location's user list and the response carried no id \u2014 check " + GHL_STAFF_PAGE + " in GHL before re-running.", rawResponse: raw };
-  }
-  if (generatedPassword) {
-    warnings.push("GoHighLevel required a password, so one was generated. It is returned ONCE here (generatedPassword) \u2014 hand it to the staff member over a secure channel and have them change it at first login. It is not stored anywhere.");
+    return { ok: false, stage: "verify", error: "POST /users/ succeeded but the user never appeared on this location's user list and the response carried no id \u2014 check " + GHL_STAFF_PAGE + " in GHL before re-running.", rawResponse: raw, ...generatedPassword ? { generatedPassword } : {} };
   }
+  if (generatedPassword) warnings.push(PASSWORD_HANDOVER_WARNING);
   return { ok: true, userId: found.id, status: "created", email: args.email, generatedPassword, warnings, rawResponse: raw };
 }
 function extractUserId(raw) {
@@ -8361,7 +8364,7 @@ function extractUserId(raw) {
   }
   return void 0;
 }
-async function createOrBindUser(client, registry2, args) {
+async function createOrBindUser(client, registry2, args, onPassword) {
   const agencyKey = registry2?.getAgencyKey();
   if (!agencyKey) {
     return {
@@ -8381,14 +8384,15 @@ async function createOrBindUser(client, registry2, args) {
       listUsers: async () => pickUsers(await client.get("/users/", { params: { locationId: args.locationId } })),
       // noRetry: an invite is not idempotent — a retry after a lost-but-successful
       // response would create a second user / send a second invite.
-      postUser: (body) => agencyClient.post("/users/", { body, noRetry: true })
+      postUser: (body) => agencyClient.post("/users/", { body, noRetry: true }),
+      ...onPassword ? { onPassword } : {}
     }
   );
 }
 function msg(e) {
   return e instanceof Error ? e.message : String(e);
 }
-var import_node_crypto4, normEmail, FEATURE_UNAVAILABLE_TEXT, sleep2;
+var import_node_crypto4, normEmail, FEATURE_UNAVAILABLE_TEXT, sleep2, PASSWORD_HANDOVER_WARNING;
 var init_user_provisioning = __esm({
   "src/user-provisioning.ts"() {
     "use strict";
@@ -8399,6 +8403,7 @@ var init_user_provisioning = __esm({
     normEmail = (e) => e.trim().toLowerCase();
     FEATURE_UNAVAILABLE_TEXT = "does not have access to this feature";
     sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+    PASSWORD_HANDOVER_WARNING = "GoHighLevel required a password, so one was generated. It is returned ONCE here (generatedPassword) \u2014 hand it to the staff member over a secure channel and have them change it at first login.";
   }
 });
 
@@ -8434,7 +8439,7 @@ function registerUserTools(server2, client, registry2) {
   safeTool(
     server2,
     "create_user",
-    "Add a staff member (user) to the current sub-account. AGENCY-level write: GoHighLevel creates users through POST /users/ with an agency Private Integration key (users.write), so this needs register_agency_key first \u2014 the sub-account key cannot do it. IDEMPOTENT: if a user with that email already exists on the location (get_users) the tool binds to them and creates nothing. No password is invented: the first attempt omits it so GoHighLevel sends the staff member an invite email [UNVERIFIED live \u2014 if GHL insists on a password, one is generated, the create is retried once, and the password is returned ONCE as `generatedPassword`; hand it over securely, it is not stored]. Permissions default to a sane per-role set (documented UserPermissions booleans, [UNVERIFIED] key-for-key; if GHL rejects the object the create retries without it and GHL's own defaults apply \u2014 a warning says so). The new user is verified by re-reading get_users before its id is returned. On failure GHL's error text is returned verbatim. Used by apply_build_plan to build the staff a Blueprint plan lists; workflow notification / task steps then target these real user ids instead of a placeholder.",
+    "Add a staff member (user) to the current sub-account. AGENCY-level write: GoHighLevel creates users through POST /users/ with an agency Private Integration key (users.write), so this needs register_agency_key first \u2014 the sub-account key cannot do it. IDEMPOTENT: if a user with that email already exists on the location (get_users) the tool binds to them and creates nothing. No password is invented: the first attempt omits it so GoHighLevel sends the staff member an invite email [UNVERIFIED live \u2014 if GHL insists on a password, one is generated, the create is retried once, and the password is returned ONCE as `generatedPassword`; hand it over securely]. Permissions default to a sane per-role set (documented UserPermissions booleans, [UNVERIFIED] key-for-key; if GHL rejects the object the create retries without it and GHL's own defaults apply \u2014 a warning says so). The new user is verified by re-reading get_users before its id is returned. On failure GHL's error text is returned verbatim. Used by apply_build_plan to build the staff a Blueprint plan lists; workflow notification / task steps then target these real user ids instead of a placeholder.",
     {
       firstName: import_zod22.z.string().min(1).describe("Staff member's first name."),
       lastName: import_zod22.z.string().describe("Staff member's last name (GHL requires it as a string; pass '' only if you truly have none)."),
@@ -32228,7 +32233,7 @@ function runStage(locationId2, stage, onEvent, opts = {}) {
       const cmd = claudeCommand(bin, buildClaudeArgs(spec, locationId2, locationName, opts.context));
       const child = (0, import_child_process3.spawn)(cmd.command, cmd.args, {
         stdio: ["ignore", "pipe", "pipe"],
-        env: { ...process.env, ...stageFirebaseEnv(), ...progressDir ? { [PROGRESS_DIR_ENV]: progressDir } : {}, GHL_COMMAND_STAGE: String(stage), GHL_COMMAND_INTAKE_HASH: opts.context?.inputHash ?? "", GHL_COMMAND_INTAKE_FACTS: intakeFactsEnv(opts.context?.normalizedAnswers), GHL_COMMAND_TEXT_SNIPPETS: opts.context?.textSnippets ? "1" : "", GHL_COMMAND_INTAKE_BRIEF: opts.context?.intakeBrief ? JSON.stringify(opts.context.intakeBrief) : "", [EXPECT_BUILD_ENV]: ownBuildId(), MCP_CONNECTION_NONBLOCKING: "false", ...opts.clientKey ? { [CLIENT_KEY_ENV]: opts.clientKey } : {} }
+        env: { ...process.env, ...stageFirebaseEnv(), ...opts.secretEnv ?? {}, ...progressDir ? { [PROGRESS_DIR_ENV]: progressDir } : {}, GHL_COMMAND_STAGE: String(stage), GHL_COMMAND_INTAKE_HASH: opts.context?.inputHash ?? "", GHL_COMMAND_INTAKE_FACTS: intakeFactsEnv(opts.context?.normalizedAnswers), GHL_COMMAND_TEXT_SNIPPETS: opts.context?.textSnippets ? "1" : "", GHL_COMMAND_INTAKE_BRIEF: opts.context?.intakeBrief ? JSON.stringify(opts.context.intakeBrief) : "", [EXPECT_BUILD_ENV]: ownBuildId(), MCP_CONNECTION_NONBLOCKING: "false", ...opts.clientKey ? { [CLIENT_KEY_ENV]: opts.clientKey } : {} }
       });
       let lastProgressStamp = "";
       let inventoryError;
@@ -36499,7 +36504,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@elitedcs/ghl-mcp",
-      version: "3.91.0",
+      version: "3.91.1",
       mcpName: "io.github.drjerryrelth/ghl-command",
       description: "GoHighLevel MCP Server for Claude. 250 tools \u2014 full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
       main: "dist/index.js",
@@ -37117,6 +37122,39 @@ function removeCacheFileAtRest(file3) {
   } catch {
   }
 }
+function deadlineClock(ms, now, expire) {
+  let timer;
+  let left = ms;
+  let since = now();
+  let holds = 0;
+  let fired = false;
+  const arm = () => {
+    since = now();
+    timer = setTimeout(() => {
+      timer = void 0;
+      fired = true;
+      expire();
+    }, Math.max(0, left));
+    timer.unref?.();
+  };
+  arm();
+  return {
+    hold: () => {
+      if (holds++ === 0 && timer) {
+        clearTimeout(timer);
+        timer = void 0;
+        left -= now() - since;
+      }
+    },
+    go: () => {
+      if (holds > 0 && --holds === 0 && !fired && !timer) arm();
+    },
+    stop: () => {
+      if (timer) clearTimeout(timer);
+      timer = void 0;
+    }
+  };
+}
 function isSlowDown(e) {
   return e instanceof Error && /GHL API Error 429\b/.test(e.message);
 }
@@ -37669,6 +37707,7 @@ var init_cockpit_cache = __esm({
       gateFor(locationId2, deadline2, expired, clock2) {
         return {
           deadline: deadline2,
+          expired,
           take: async () => {
             for (; ; ) {
               if (expired()) throw new PacerDeadlineError();
@@ -37733,9 +37772,6 @@ var init_cockpit_cache = __esm({
           this.busyLocations.set(j.locationId, (this.busyLocations.get(j.locationId) ?? 0) + 1);
           this.maxInFlightLocations = Math.max(this.maxInFlightLocations, this.busyLocations.size);
           let expired = false;
-          let timer;
-          let left = this.limits.taskDeadlineMs;
-          let since = this.now();
           let expire;
           const deadline2 = new Promise((_, reject) => {
             expire = () => {
@@ -37745,24 +37781,10 @@ var init_cockpit_cache = __esm({
           });
           deadline2.catch(() => {
           });
-          const arm = () => {
-            since = this.now();
-            timer = setTimeout(expire, Math.max(0, left));
-            timer.unref?.();
-          };
-          const clock2 = { hold: () => {
-            if (timer) {
-              clearTimeout(timer);
-              timer = void 0;
-              left -= this.now() - since;
-            }
-          }, go: () => {
-            if (!expired && !timer) arm();
-          } };
-          arm();
+          const clock2 = deadlineClock(this.limits.taskDeadlineMs, this.now, () => expire());
           void Promise.race([j.task(this.gateFor(j.locationId, deadline2, () => expired, clock2)), deadline2]).catch(() => {
           }).finally(() => {
-            if (timer) clearTimeout(timer);
+            clock2.stop();
             this.running.delete(j.key);
             const n = (this.busyLocations.get(j.locationId) ?? 1) - 1;
             if (n <= 0) this.busyLocations.delete(j.locationId);
@@ -37872,7 +37894,7 @@ var init_cockpit_cache = __esm({
             const started = this.now();
             let late = false;
             try {
-              const data = await Promise.race([opts.read((client) => pacedClient(client, gate2, count2), (fn) => !late && this.cache.commitIfCurrent(ticket, fn)), gate2.deadline ?? NEVER]);
+              const data = await Promise.race([opts.read((client) => pacedClient(client, gate2, count2), (fn) => !late && !gate2.expired?.() && this.cache.commitIfCurrent(ticket, fn)), gate2.deadline ?? NEVER]);
               const kept = this.cache.putFor(ticket, data, { reach: opts.reach, calls: count2.calls, ghlMs: this.now() - started, holdSave: opts.holdSave });
               if (kept === null) {
                 resolve13({ ok: false, error: new StaleReadError() });
@@ -37907,7 +37929,7 @@ var init_cockpit_cache = __esm({
           let ok = false;
           let late = false;
           try {
-            const data = await Promise.race([opts.read((client) => pacedClient(client, gate2, count2), (fn) => !late && this.cache.commitIfCurrent(ticket, fn)), gate2.deadline ?? NEVER]);
+            const data = await Promise.race([opts.read((client) => pacedClient(client, gate2, count2), (fn) => !late && !gate2.expired?.() && this.cache.commitIfCurrent(ticket, fn)), gate2.deadline ?? NEVER]);
             const kept = this.cache.putFor(ticket, data, { reach: opts.reach, calls: count2.calls, ghlMs: this.now() - started, holdSave: opts.holdSave });
             ok = kept !== null;
             if (kept?.changed) opts.onChange?.(data);
@@ -45412,6 +45434,20 @@ var init_normalizer = __esm({
   }
 });
 
+// src/login-level.ts
+function teamLoginLevels(jobs2) {
+  const levels = jobs2.map((j) => j && ADMIN_ROLE_RE.test(j) ? "admin" : "user");
+  if (levels.length && !levels.includes("admin")) levels[0] = "admin";
+  return levels;
+}
+var ADMIN_ROLE_RE;
+var init_login_level = __esm({
+  "src/login-level.ts"() {
+    "use strict";
+    ADMIN_ROLE_RE = /\b(owner|founder|admin|administrator|ceo|principal|director)\b/i;
+  }
+});
+
 // src/staff-first.ts
 function staffWaitingLine(name) {
   return `${name} is still being set up in GoHighLevel. Add them for me will not add them again for up to 10 minutes.`;
@@ -45433,11 +45469,16 @@ function settleResults(results, check) {
   const onTeam = new Set(check.listed.map((m) => normEmail(m.email)));
   for (const r of results) {
     const e = normEmail(r.email);
-    if (!unreadable && !onTeam.has(e)) continue;
+    if (!unreadable && !onTeam.has(e)) {
+      if (!r.ok && !r.refused) r.said = staffWaitingLine(r.name);
+      continue;
+    }
     if (unreadable && r.status === "existing") continue;
     if (!unreadable && listed.has(e)) {
       r.ok = true;
-      if (r.status !== "existing") r.status = "created";
+      if (r.refused) r.status = "existing";
+      else if (r.status !== "existing") r.status = "created";
+      delete r.passwordUnconfirmed;
       r.said = r.status === "existing" ? `${r.name} already had a login. Nothing was created.` : `${r.name} was added. GoHighLevel should email them an invitation.`;
     } else if (r.refused) {
       r.ok = false;
@@ -45446,6 +45487,7 @@ function settleResults(results, check) {
     } else {
       r.ok = false;
       r.said = staffWaitingLine(r.name);
+      if (r.generatedPassword) r.passwordUnconfirmed = true;
     }
   }
   return results;
@@ -45499,9 +45541,13 @@ function listedStaff(roster, ...intakeStaffTexts) {
   return { people, skipped };
 }
 function staffCreateOffered(opts) {
-  if (!opts.hasAgencyKey || opts.profile.canCreateSubAccounts === false) return false;
-  if (!opts.refusedAt) return true;
-  return opts.profile.canCreateSubAccounts === true && !!opts.profile.updated_at && opts.profile.updated_at > opts.refusedAt;
+  return staffAddBlocker(opts) === void 0;
+}
+function staffAddBlocker(opts) {
+  if (!opts.hasAgencyKey) return "no_key";
+  if (opts.profile.canCreateSubAccounts === false) return "plan";
+  if (!opts.refusedAt) return void 0;
+  return opts.profile.canCreateSubAccounts === true && !!opts.profile.updated_at && opts.profile.updated_at > opts.refusedAt ? void 0 : "refused";
 }
 function intakeAnswer(answers, key2, label2) {
   if (!answers) return void 0;
@@ -45526,7 +45572,7 @@ function teamAnswersFromRoster(answers, roster, questions) {
 }
 function checkStaff(listed, users, opts = { canAddForYou: false }) {
   const checkedAt = (opts.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
-  const base = { listed: listed.people, skipped: listed.skipped, canAddForYou: opts.canAddForYou, checkedAt };
+  const base = { listed: listed.people, skipped: listed.skipped, canAddForYou: opts.canAddForYou, checkedAt, ...!opts.canAddForYou && opts.addBlocked ? { addBlocked: opts.addBlocked } : {} };
   if (!Array.isArray(users)) {
     return {
       ...base,
@@ -45557,7 +45603,7 @@ function checkStaff(listed, users, opts = { canAddForYou: false }) {
     const u = findUserByEmail(users, p.email);
     if (u) {
       matched.push({ ...p, userId: u.id });
-      const listedRole = personToCreateInput(p).role;
+      const listedRole = personToCreateInput(p, listed.people).role;
       if (u.role && u.role !== listedRole) {
         const d = { name: p.name, email: p.email, ...p.role ? { job: p.role } : {}, listed: listedRole, account: u.role };
         levelDiffs.push({ ...d, line: staffLevelDiffLine(d) });
@@ -45565,7 +45611,7 @@ function checkStaff(listed, users, opts = { canAddForYou: false }) {
     } else missing.push(p);
   }
   if (levelDiffs.length) Object.assign(base, { levelDiffs });
-  Object.assign(base, { creations: creationsFor(missing) });
+  Object.assign(base, { creations: creationsFor(missing, listed.people) });
   if (missing.length === 0) {
     return {
       ...base,
@@ -45574,7 +45620,7 @@ function checkStaff(listed, users, opts = { canAddForYou: false }) {
       missing,
       accountUserCount: users.length,
       headline: "Your staff are in place",
-      body: `We found ${matched.length === 1 ? "the 1 person" : `all ${matched.length} people`} you listed in this client's account: ${listSentence(matched.map((m) => m.name))}. Calendars will be given to them and lead alerts will go to them.`,
+      body: `We found ${matched.length === 1 ? "the 1 person" : `all ${matched.length} people`} you listed in this client's account: ${listSentence(matched.map((m) => m.name))}.`,
       steps: []
     };
   }
@@ -45588,7 +45634,7 @@ function checkStaff(listed, users, opts = { canAddForYou: false }) {
     missing,
     accountUserCount: users.length,
     headline: missing.length === 1 ? "1 person is not in this account yet" : `${missing.length} people are not in this account yet`,
-    body: `${matched.length ? `We found ${listSentence(matched.map((m) => m.name))}. ` : ""}Intake and Build wait until everyone you listed is in the account, so no calendar or alert is built with a blank name.`,
+    body: `${matched.length ? `We found ${listSentence(matched.map((m) => m.name))}. ` : ""}Build waits until everyone you listed is in the account.`,
     steps,
     ...opts.canAddForYou ? {} : { howToAdd: STAFF_HOW_TO_ADD }
   };
@@ -45603,10 +45649,10 @@ function staffGateReason(check, stageName) {
   }
   return `${stageName} is waiting: ${listSentence(check.missing.map(personLabel))} ${check.missing.length === 1 ? "is" : "are"} not in this client's GoHighLevel account yet. Add ${check.missing.length === 1 ? "them" : "everyone"} in step 7, Staff. Nothing is built with a blank name.`;
 }
-function staffPreflightLine(check, waiting = "Intake") {
+function staffPreflightLine(check) {
   if (!check) return { key: "staff", ok: false, text: "We could not check this client's staff. Use Check again in step 7, Staff." };
   if (check.status === "ready") return { key: "staff", ok: true, text: `Staff in this account: ${listSentence(check.matched.map((m) => m.name))}.` };
-  return { key: "staff", ok: false, text: `${check.headline}. Finish step 7, Staff, before ${waiting}.` };
+  return { key: "staff", ok: false, text: `${check.headline}. Finish step 7, Staff, before Build.` };
 }
 async function readStaffCheck(deps, listed, now) {
   let users;
@@ -45615,15 +45661,21 @@ async function readStaffCheck(deps, listed, now) {
   } catch (e) {
     users = { error: e instanceof Error ? e.message : String(e) };
   }
-  return checkStaff(listed, users, { canAddForYou: deps.canCreateUsers(), now });
+  return checkStaff(listed, users, { canAddForYou: deps.canCreateUsers(), addBlocked: deps.addBlocked?.(), now });
+}
+function teamLevels(people) {
+  const levels = teamLoginLevels(people.map((p) => p.role));
+  return new Map(people.map((p, i) => [normEmail(p.email), levels[i]]));
 }
-function personToCreateInput(p) {
+function personToCreateInput(p, team) {
   const words2 = p.name.trim().split(/\s+/);
+  const role = teamLevels(team).get(normEmail(p.email));
+  if (!role) throw new Error(`${p.name} is not on the team this login was worked out from.`);
   return {
     firstName: words2[0],
     lastName: words2.length > 1 ? words2.slice(1).join(" ") : "-",
     email: p.email.trim(),
-    role: p.role && ADMIN_ROLE_RE.test(p.role) ? "admin" : "user",
+    role,
     ...p.mobile ? { phone: p.mobile } : {}
   };
 }
@@ -45648,7 +45700,7 @@ async function addMissingStaff(deps, listed, now, compared) {
     }
     let outcome;
     try {
-      outcome = await deps.createUser(personToCreateInput(p));
+      outcome = await deps.createUser(personToCreateInput(p, listed.people));
     } catch (e) {
       outcome = { ok: false, stage: "create", error: e instanceof Error ? e.message : String(e) };
     }
@@ -45669,11 +45721,17 @@ async function addMissingStaff(deps, listed, now, compared) {
         email: p.email,
         ok: false,
         ...createMadeNothing(outcome) ? { refused: true, refusedSaid: said } : {},
+        ...outcome.generatedPassword ? { generatedPassword: outcome.generatedPassword, passwordUnconfirmed: true } : {},
         said
       });
     }
   }
-  const after = await readStaffCheck(refused ? { listUsers: () => deps.listUsers(), canCreateUsers: () => false } : deps, listed, now);
+  let after;
+  try {
+    after = await readStaffCheck(refused ? { listUsers: () => deps.listUsers(), canCreateUsers: () => false, addBlocked: () => "refused" } : deps, listed, now);
+  } catch (e) {
+    after = checkStaff(listed, { error: e instanceof Error ? e.message : String(e) }, { canAddForYou: false, now });
+  }
   if (refused) after.createRefused = true;
   return { results: settleResults(results, after), check: after };
 }
@@ -45683,9 +45741,9 @@ function effectiveStaffList(roster, intake, draftText) {
   if (draftText && draftText.trim()) return { ...listedStaff(void 0, draftText), source: "draft" };
   return { people: [], skipped: [] };
 }
-function creationsFor(people) {
+function creationsFor(people, team) {
   return people.map((p) => {
-    const c = personToCreateInput(p);
+    const c = personToCreateInput(p, team);
     return { email: normEmail(c.email), firstName: c.firstName, lastName: c.lastName, role: c.role, ...p.role ? { job: p.role } : {} };
   });
 }
@@ -45729,12 +45787,13 @@ function planTeamMatches(planUsers2, people) {
   const b = [...new Set(people.map((p) => normEmail(p.email)))].sort();
   return a.length === b.length && a.every((x, i) => x === b[i]);
 }
-var STAFF_PENDING_MS, STAFF_INTAKE_KEYS, STAFF_STEP_ABOUT, STAFF_LIST_HELP, STAFF_HOW_TO_ADD, STAFF_REVIEW_WARNING, STAFF_REVIEW_UNCHECKED, STAFF_GATED_STAGES, ADMIN_ROLE_RE, fullName, STAFF_ADMIN_MARK, STAFF_SOURCE_WORDS;
+var STAFF_PENDING_MS, STAFF_INTAKE_KEYS, STAFF_STEP_ABOUT, STAFF_LIST_HELP, STAFF_HOW_TO_ADD, STAFF_REVIEW_WARNING, STAFF_REVIEW_UNCHECKED, STAFF_GATED_STAGES, fullName, STAFF_ADMIN_MARK, STAFF_SOURCE_WORDS;
 var init_staff_first = __esm({
   "src/staff-first.ts"() {
     "use strict";
     init_normalizer();
     init_user_provisioning();
+    init_login_level();
     init_ghl_click_paths();
     STAFF_PENDING_MS = 10 * 60 * 1e3;
     STAFF_INTAKE_KEYS = { staff: "staff_members", notify: "notify_name", calls: "calls_name" };
@@ -45744,7 +45803,6 @@ var init_staff_first = __esm({
     STAFF_REVIEW_WARNING = "Your staff are not all in this client's account yet. Build will not start until they are: without them the calendars cannot be built, and the workflows that start from a booking would be left as drafts with no calendar chosen. Finish step 7, Staff, first.";
     STAFF_REVIEW_UNCHECKED = "We have not checked this client's staff yet. Build will not start until everyone who takes appointments is in the account. Step 7, Staff, checks them.";
     STAFF_GATED_STAGES = /* @__PURE__ */ new Set([3]);
-    ADMIN_ROLE_RE = /\b(owner|founder|admin|administrator|ceo|principal|director)\b/i;
     fullName = (c) => [c.firstName, c.lastName === "-" ? "" : c.lastName].filter(Boolean).join(" ");
     STAFF_ADMIN_MARK = "Admin login";
     STAFF_SOURCE_WORDS = {
@@ -47147,6 +47205,8 @@ var init_cockpit_routes = __esm({
       get("/api/intake-documents", "client", BOTH),
       get("/api/review", "client", BOTH),
       via(get("/api/run/status", "client", BOTH), { optional: true }),
+      via(get("/api/run/secrets", "client", BOTH), { optional: true }),
+      // seat-guarded: a Build's one-time passwords (S2)
       get("/api/staff", "client", BOTH),
       post("/api/staff/check", "client", BOTH),
       // the same check as GET /api/staff, and keeps it (safety R7)
@@ -48558,6 +48618,43 @@ var init_jobs = __esm({
   }
 });
 
+// src/build-secrets.ts
+function cockpitBuildMarker() {
+  return { [COCKPIT_BUILD_ENV]: "1" };
+}
+function closeAllSecretChannels() {
+  for (const c of [...openChannels]) c();
+}
+function withheldNote(name) {
+  return `GoHighLevel set a password for ${name}. It is not shown anywhere. Reset their password in GoHighLevel.`;
+}
+function withholdOneTimePasswords(staff) {
+  for (const s of staff) {
+    if (!s.generatedPassword) continue;
+    delete s.generatedPassword;
+    delete s.passwordLine;
+    if (s.warnings) {
+      s.warnings = s.warnings.filter((w) => w !== PASSWORD_HANDOVER_WARNING);
+      if (!s.warnings.length) delete s.warnings;
+    }
+    s.passwordNote = withheldNote(s.name);
+  }
+}
+function inCockpitBuild(env2 = process.env) {
+  return env2[COCKPIT_BUILD_ENV] === "1" || Boolean(env2[SECRET_SOCKET_ENV] && env2[SECRET_TOKEN_ENV]);
+}
+var SECRET_SOCKET_ENV, SECRET_TOKEN_ENV, COCKPIT_BUILD_ENV, openChannels;
+var init_build_secrets = __esm({
+  "src/build-secrets.ts"() {
+    "use strict";
+    init_user_provisioning();
+    SECRET_SOCKET_ENV = "GHL_COMMAND_SECRET_SOCKET";
+    SECRET_TOKEN_ENV = "GHL_COMMAND_SECRET_TOKEN";
+    COCKPIT_BUILD_ENV = "GHL_COMMAND_COCKPIT_BUILD";
+    openChannels = /* @__PURE__ */ new Set();
+  }
+});
+
 // src/intake-to-build/customization.ts
 var customization_exports = {};
 __export(customization_exports, {
@@ -49285,6 +49382,7 @@ function asText(v) {
 }
 function usersFromStaff(staff, warnings) {
   const users = [];
+  const jobs2 = [];
   const userRefByName = /* @__PURE__ */ new Map();
   const seenSlugs = /* @__PURE__ */ new Set();
   const EMAIL_RE3 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
@@ -49306,16 +49404,19 @@ function usersFromStaff(staff, warnings) {
     if (words2.length === 1) {
       warnings.push(`Staff member "${s.name}" gave only one name \u2014 the account login shows "-" as the last name until it is edited.`);
     }
-    const role = s.role && ADMIN_ROLE_RE2.test(s.role) ? "admin" : "user";
-    const user = { ref, firstName, lastName, email, role };
+    const user = { ref, firstName, lastName, email, role: "user" };
+    jobs2.push(s.role);
     if (s.mobile && s.mobile.trim()) user.phone = s.mobile.trim();
     users.push(user);
     userRefByName.set(normName(s.name), ref);
   }
-  let firstAdminRef = users.find((u) => u.role === "admin")?.ref;
-  if (!firstAdminRef && users.length > 0) {
-    users[0].role = "admin";
-    firstAdminRef = users[0].ref;
+  const levels = teamLoginLevels(jobs2);
+  const byJob = jobs2.some((j) => Boolean(j && ADMIN_ROLE_RE.test(j)));
+  users.forEach((u, i) => {
+    u.role = levels[i];
+  });
+  const firstAdminRef = users.find((u) => u.role === "admin")?.ref;
+  if (!byJob && users.length > 0) {
     warnings.push(
       `No staff member was described as the owner or admin, so ${users[0].firstName} (listed first) gets the admin login. Change it on the review screen if that is wrong.`
     );
@@ -50608,13 +50709,14 @@ function loadPresetChoice(requested, briefPreset) {
   if (generic) return { ok: true, preset: generic, file: "generic-client.preset.json", note: "Using the generic preset." };
   return { ok: false, error: "No usable preset file was found in the library." };
 }
-var fs38, path36, PRESET_TOKEN_ROOTS, GSM7_REPLACEMENTS, FLAG_ALIASES, INLINE_TOKEN_RE, ADMIN_ROLE_RE2, TERMINAL_STAGE_WORDS, BRIEF_CALENDAR_TYPE_MAP, CALENDAR_NUMBER_FIELDS, CUSTOM_VALUE_TOKEN_RE;
+var fs38, path36, PRESET_TOKEN_ROOTS, GSM7_REPLACEMENTS, FLAG_ALIASES, INLINE_TOKEN_RE, TERMINAL_STAGE_WORDS, BRIEF_CALENDAR_TYPE_MAP, CALENDAR_NUMBER_FIELDS, CUSTOM_VALUE_TOKEN_RE;
 var init_plan_from_preset = __esm({
   "src/intake-to-build/plan-from-preset.ts"() {
     "use strict";
     fs38 = __toESM(require("fs"));
     path36 = __toESM(require("path"));
     init_plan();
+    init_login_level();
     init_brief2();
     init_normalizer();
     init_features();
@@ -50636,7 +50738,6 @@ var init_plan_from_preset = __esm({
       email_domain_needed: ["email_not_ready"]
     };
     INLINE_TOKEN_RE = /\{\{\s*([a-zA-Z_][a-zA-Z0-9_]*(?:\.[a-zA-Z0-9_]+|\[\d+\])*)\s*(?:\|\|([^}]*))?\}\}/g;
-    ADMIN_ROLE_RE2 = /\b(owner|founder|admin|administrator|ceo|principal|director)\b/i;
     TERMINAL_STAGE_WORDS = [
       "lost",
       "closed",
@@ -51843,7 +51944,28 @@ var init_build_steps = __esm({
       "Command OS has built and checked the account. You sign off here. The list below says what you can switch on now and what waits until its approval comes through."
     ];
     BUILD_STEPS_SCRIPT = String.raw`
-let bsStaffSaid={},bsChange={},bsErr={},bsBusy={},bsStaff={},bsSeen={},bsDraft={},bsNote={},bsInSteps=false,bsMoreOpen={},bsInfo={},bsAgeAsked={};
+let bsStaffSaid={},bsChange={},bsErr={},bsBusy={},bsStaff={},bsSeen={},bsDraft={},bsNote={},bsInSteps=false,bsMoreOpen={},bsInfo={},bsAgeAsked={},bsPwHeld={};
+/* Check again keeps the one-time password lines (they are shown once) and drops the rest (3.90.2). */
+function bsKeepPasswords(id){const keep=(bsStaffSaid[id]||[]).filter(l=>l.includes(" Their one-time password is "));if(keep.length)bsStaffSaid[id]=keep;else delete bsStaffSaid[id]}
+/* This account's one-time password lines from its last Builds (S1). A second client in the same sub-account (the same
+   member's) has no card of its own, so its lines show here too, each naming that client (Codex on 50acb7eb). */
+function bsOneTime(run,c){return ((run&&run.oneTime)||[]).filter(x=>x.locationId===c.locationId&&(!c.clientKey||x.clientKey===c.clientKey)).flatMap(x=>x.clientKey&&!c.clientKey?(x.lines||[]).map(l=>"For "+(x.clientName||x.clientKey)+": "+l):(x.lines||[]))}
+/* Why step 7 cannot add them, above the how-to list (3.91.1, Jerry's G words): no agency key wins over the plan answer. */
+function bsHowToAddLead(sc){const b=sc.addBlocked;
+ if(b==="no_key")return "To add people from here, the agency key must be connected first. Until then, do this once for each person marked Not added yet:";
+ if(b==="plan")return "GoHighLevel only lets you add people in its own screens on your plan. Do this once for each person marked Not added yet:";
+ if(b==="refused"||sc.createRefused)return "GoHighLevel does not let this agency add people from outside GoHighLevel. Do this once for each person marked Not added yet:";
+ return "GoHighLevel only lets you add people in its own screens on your plan. Do this once for each person marked Not added yet:"}
+/* A one-time password whose create never showed up (passwordUnconfirmed) is held in this page only, never sent or
+   saved, and shown the first time a check lists that person, in place of their waiting line (3.91.1). */
+/* A newer password for someone replaces any older one, held or shown: after a retry only the latest is a credential
+   (3.91.1, Codex on 6560441d). A shown password line starts "<name> was added. ", so "John Smith" never matches
+   "John Smith Jr." (Codex on 610e9378). */
+function bsSupersede(id,results){for(const x of results||[])if(x.generatedPassword){const e=String(x.email).trim().toLowerCase();if(bsPwHeld[id])bsPwHeld[id]=bsPwHeld[id].filter(h=>h.email!==e);if(bsStaffSaid[id])bsStaffSaid[id]=bsStaffSaid[id].filter(l=>!(l.includes(" Their one-time password is ")&&l.startsWith(x.name+" was added. ")))}}
+function bsHoldPasswords(id,results){for(const x of results||[])if(x.generatedPassword&&x.passwordUnconfirmed){const e=String(x.email).trim().toLowerCase();bsPwHeld[id]=(bsPwHeld[id]||[]).filter(h=>h.email!==e);bsPwHeld[id].push({email:e,name:x.name,said:x.said,pw:x.generatedPassword})}}
+function bsRevealPasswords(id,sc){const held=bsPwHeld[id];if(!held||!sc||!sc.matched)return;const inAcct=new Set(sc.matched.map(m=>String(m.email).trim().toLowerCase()));const left=[];
+ for(const h of held){if(!inAcct.has(h.email)){left.push(h);continue}const lines=(bsStaffSaid[id]||[]).filter(l=>l!==h.said);lines.push(h.name+" was added. GoHighLevel should email them an invitation. Their one-time password is "+h.pw+". Give it to them privately.");bsStaffSaid[id]=lines}
+ if(left.length)bsPwHeld[id]=left;else delete bsPwHeld[id]}
 /* A link with ?client=<id>&reconnect=1 (or the older #client=<id>&reconnect=1) opens that client's reconnect box (round-6 review). */
 try{for(const hp of [new URLSearchParams(location.search),new URLSearchParams(location.hash.slice(1))])if(hp.get("reconnect")==="1"&&hp.get("client"))bsMoreOpen[hp.get("client")]=true}catch(e){}
 async function bsPost(url,body){let r,j=null;try{r=await fetch(url,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(body)})}catch(e){return {ok:false,error:"Command OS did not answer. Check it is still running, then try again."}}
@@ -51887,6 +52009,7 @@ function bsRadios(name,items,cur,onpick){const g=mk("div","bs-choices");g.setAtt
  return g}
 /* A step run (Brief, Build, Verify): one button, the live progress while it runs, the reason under it when refused. */
 function bsRun(c,state,run,stage,label,box,ghost){const id=c.locationId;const key="run:"+id+":"+stage;
+ /* A password GoHighLevel set during this Build: from the run's own channel, in memory only, never in the report (S1). */
  const live=run&&run.running&&run.locationId===id&&run.stage===stage;const busyElse=run&&run.running&&!live;
  if(live){box.appendChild(bsLive(run,stage));return}
  const b=bsBtn(bsBusy[key]?"Starting…":label,async()=>{bsBusy[key]=true;delete bsErr[key];render(lastState,lastRun);
@@ -52129,7 +52252,7 @@ function bsReconnect(c,pr){const id=c.locationId;const key="reconnect:"+id;const
  bsErrLine(key,box);return box}
 function bsOpenReconnect(id){bsMoreOpen[id]=true;render(lastState,lastRun);const el=document.getElementById("bs-more-"+id);if(el)try{el.scrollIntoView({block:"start"})}catch(e){}}
 /* Step 7: everyone from step 5 must be a user in the client's GoHighLevel account. */
-function bsStaffStep(c,state,box){const id=c.locationId;const sc=(state.staffChecks||{})[id]||bsStaff[id];const key="staff:"+id;
+function bsStaffStep(c,state,box){const id=c.locationId;const sc=(state.staffChecks||{})[id]||bsStaff[id];const key="staff:"+id;bsRevealPasswords(id,sc);
  /* What the last Add them for me did (3.90.1): who was added, who already had a login, any login made for someone
     no longer on the team. Shown in every staff state (Codex on 516081d8); the list below is the team as it is now. */
  if((bsStaffSaid[id]||[]).length){const said=mk("div","cds-callout info cds-stack bs-staffsaid");said.setAttribute("role","status");for(const line of bsStaffSaid[id])said.appendChild(mk("p","",line));box.appendChild(said)}
@@ -52149,9 +52272,9 @@ function bsStaffStep(c,state,box){const id=c.locationId;const sc=(state.staffChe
 
  if((sc.missing||[]).length){
   if(sc.canAddForYou&&!sc.createRefused){if((sc.creations||[]).length){box.appendChild(mk("p","","We can add them to this client's GoHighLevel account for you. GoHighLevel should email each new person an invitation. Let your client know, and check with them that it arrived."));
-   box.appendChild(bsBtn(bsBusy[key+":add"]?"Adding…":"Add them for me",async()=>{bsBusy[key+":add"]=true;delete bsErr[key];render(lastState,lastRun);const j=await bsPost("/api/staff/add",{locationId:id,shown:sc.creations||[]});bsBusy[key+":add"]=false;bsStaffSaid[id]=[...(j.ok?(j.said||[]):[]),...(j.results||[]).filter(x=>x.generatedPassword).map(x=>x.said+" Their one-time password is "+x.generatedPassword+". Give it to them privately; it is not saved anywhere.")];if(!j.ok){bsErr[key]=j.error;if(j.check)bsStaff[id]=j.check}else bsStaff[id]=j.check;load(true)}))}}
-  else{const how=mk("ol","bs-how");for(const t of BS_HOW_TO_ADD)how.appendChild(mk("li","",t));box.appendChild(mk("p","","GoHighLevel only lets you add people in its own screens on your plan. Do this once for each person marked Not added yet:"));box.appendChild(how)}}
- const again=bsBtn(bsBusy[key]?"Checking…":"Check again",()=>{bsBusy[key]=true;delete bsStaffSaid[id];bsCheckStaff(id);render(lastState,lastRun)},sc.status==="ready");box.appendChild(again);
+   box.appendChild(bsBtn(bsBusy[key+":add"]?"Adding…":"Add them for me",async()=>{bsBusy[key+":add"]=true;delete bsErr[key];render(lastState,lastRun);const j=await bsPost("/api/staff/add",{locationId:id,shown:sc.creations||[]});bsBusy[key+":add"]=false;bsSupersede(id,j.results);bsStaffSaid[id]=[...(bsStaffSaid[id]||[]).filter(l=>l.includes(" Their one-time password is ")),...(j.ok?(j.said||[]):[]),...(j.results||[]).filter(x=>x.generatedPassword&&!x.passwordUnconfirmed).map(x=>x.said+" Their one-time password is "+x.generatedPassword+". Give it to them privately.")];bsHoldPasswords(id,j.results);if(!j.ok){bsErr[key]=j.error;if(j.check)bsStaff[id]=j.check}else bsStaff[id]=j.check;load(true)}))}}
+  else{const how=mk("ol","bs-how");for(const t of BS_HOW_TO_ADD)how.appendChild(mk("li","",t));box.appendChild(mk("p","",bsHowToAddLead(sc)));box.appendChild(how)}}
+ const again=bsBtn(bsBusy[key]?"Checking…":"Check again",()=>{bsBusy[key]=true;bsKeepPasswords(id);bsCheckStaff(id);render(lastState,lastRun)},sc.status==="ready");box.appendChild(again);
  bsErrLine(key,box)}
 async function bsCheckStaff(id){const key="staff:"+id;let j=null;try{j=await(await fetch("/api/staff/check",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({locationId:id})})).json()}catch(e){}
  bsBusy[key]=false;if(j&&j.ok){bsStaff[id]=j.check;delete bsErr[key]}else bsErr[key]=(j&&j.error)||"We could not check this client's staff. Try Check again.";load(true)}
@@ -52249,11 +52372,16 @@ function stepsPage(c,state,run){const id=c.locationId;const inp=bsInputs(c,state
  {const forced=Boolean(bsMoreOpen[id]);const more=mk("details","cds-details bs-more");more.id="bs-more-"+id;more.setAttribute("data-key","more:"+id+(forced?":open":""));if(forced)more.open=true;
   more.appendChild(mk("summary","","Reconnect this client, or check this computer is ready"));
   more.appendChild(bsReconnect(c,pr));more.appendChild(unnest(preflightCard(c)));page.appendChild(more)}
+ /* A password GoHighLevel set during this client's last Build: from the run's own channel, in memory only, never in the
+    report (S1). At the top of the page, outside every step, so Verify running or a locked or parked account never hides
+    it (Codex sweep M3). */
+ {const otl=bsOneTime(run,c);if(otl.length){const ot=mk("div","cds-callout warn cds-stack bs-onetime");ot.setAttribute("role","status");for(const l of otl)ot.appendChild(mk("p","",l));page.appendChild(ot)}}
  const list=mk("ol","bs-steps");
  for(let i=0;i<n;i++){const ck=id+":"+i;
   /* A Change closes itself once that step is done with a different answer (review of 64da59d, LOW 15). */
   if(bsChange[ck]&&pr.done[i]&&typeof bsChange[ck]==="string"&&bsSummary(i,c,state)!==bsChange[ck])delete bsChange[ck];
   /* Step 7 stays open while what the last Add them for me said, or its refusal, is there to read (3.90.1). */
+  if(i===6)bsRevealPasswords(id,(state.staffChecks||{})[id]||bsStaff[id]);
   const staffNews=i===6&&(((bsStaffSaid[id]||[]).length>0)||Boolean(bsErr["staff:"+id]));
   const li=mk("li","bs-step");li.id="step-"+(i+1);const open=(i===pr.current)||Boolean(bsChange[ck])||staffNews;
   const num=mk("span","bs-num",String(i+1));num.setAttribute("aria-hidden","true");li.appendChild(num);const main=mk("div","bs-main");li.appendChild(main);
@@ -58264,6 +58392,7 @@ __export(dashboard_exports, {
   stateSaveFs: () => stateSaveFs,
   statusFromThisRun: () => statusFromThisRun,
   syncVerifyVerdict: () => syncVerifyVerdict,
+  takeOneTimeLine: () => takeOneTimeLine,
   teamAnswersFromRoster: () => teamAnswersFromRoster,
   uniqueDocName: () => uniqueDocName,
   unknownCapabilityHtml: () => unknownCapabilityHtml,
@@ -58663,6 +58792,13 @@ function assertCockpitLicenseHolds(now = Date.now()) {
   const refusal2 = licenseSessionRefusal(now, "cockpit");
   if (refusal2) throw new Error(refusal2);
 }
+function takeOneTimeLine(entry, runLocationId, l) {
+  if (l.locationId !== runLocationId) return false;
+  const k = l.email.trim().toLowerCase();
+  delete entry.byEmail[k];
+  entry.byEmail[k] = l.line;
+  return true;
+}
 function unverifiedStaffNames(check) {
   return (check?.missing ?? []).map((m) => String(m.name ?? "").trim()).filter(Boolean);
 }
@@ -58736,12 +58872,15 @@ function startRun(locationId2, stage, onDone, meta = {}) {
         context2.readback = plannedReadbacks(verificationPlan).map(({ ref, type, name }) => ({ ref, type, name, status: "unreadable", detail: e instanceof Error ? e.message : String(e) }));
       }
     }
+    const channel = stage === 3 && !meta.spec ? { env: cockpitBuildMarker(), close: () => {
+    } } : void 0;
+    if (channel) buildOneTime.delete(rk);
     return runStage(locationId2, stage, (e) => {
       run.lines.push(e.line);
       if (run.lines.length > 200) run.lines.shift();
     }, { context: context2, name: meta.name, approvedAt: meta.approvedAt, onProgress: (p) => {
       run.progress = p;
-    }, spec: meta.spec, ...secondClient ? { clientKey: meta.clientKey } : {} }).catch((error) => {
+    }, spec: meta.spec, ...channel ? { secretEnv: channel.env } : {}, ...secondClient ? { clientKey: meta.clientKey } : {} }).finally(() => channel?.close()).catch((error) => {
       if (stage !== 4) throw error;
       return { ok: false, error: error instanceof Error ? error.message : String(error) };
     });
@@ -59820,6 +59959,8 @@ async function load(quiet,freshQueue){const my=++loadSeq,q=clientQ(),tok=clientT
     on the scan of every client: the GET answers from the saved board and queues the stale reads behind it. */
  const paintFirst=quiet!==true;
  await loadQueue(quiet===true?(freshQueue===true?"pending":"get"):paintFirst?"get":undefined);const get=async u=>quiet===true?(await bgJSON(u)).j:await(await fetch(u)).json();const s=await get("/api/state"+q);const r=await get("/api/run/status"+q);
+ /* A reload keeps a Build's one-time lines on screen: they come from the seat-guarded read (S2; Codex on a375520b). */
+ try{const s2=await get("/api/run/secrets"+q);if(r&&s2&&Array.isArray(s2.oneTime)&&s2.oneTime.length)r.oneTime=s2.oneTime}catch(e){}
  /* One client for the whole load (Codex, 2026-10-20): both reads asked for q, and nothing is drawn once another client is open. */
  if(my<loadDrawn||!stillFor(tok))return;loadDrawn=my;lastStatusOkAt=Date.now();if(SCREEN==="new"&&!snapshots){try{const sr=await(await fetch("/api/snapshots")).json();snapshots=sr.ok?sr.snapshots:[];if(sr.ok&&sr.cache){ageViews.snapshots=sr.cache;forClient(tok,()=>setTimeout(()=>askStale("snapshots"),0))}snapshotError=sr.ok?"":clientPageError(sr.error,"Check the agency key in GoHighLevel, then refresh the snapshot list.")}catch(e){snapshots=[];snapshotError="Could not load snapshots; check the connection and refresh this page."}}/* A background refresh (quiet) draws only when the data changed (2026-09-29: an unchanged redraw closed what Jerry had open). */
  /* Checked again after the snapshot read: no draw, no finish-note change and no poller for a client no longer open. */
@@ -59873,7 +60014,10 @@ function buildClientOpen(){return Boolean(newClientId&&ROSTER.some(r=>r.location
 function keyTyped(){try{return [...document.querySelectorAll('input[type="password"]')].some(i=>i.value&&!i.closest("details:not([open])"))}catch(e){return false}}
 function userIsBusy(){if(SCREEN==="new"&&!buildClientOpen())return true;return inputFocused()||intakeWorkBusy()||icBusy()||keyTyped()}
 function intakeIsOpen(){try{return Object.values(iOpen||{}).some(Boolean)}catch(e){return false}}
-async function fetchRunStatus(q,tok){const asked=q===undefined?clientQ():q,t0=tok===undefined?clientToken():tok;const rr=await(await fetch("/api/run/status"+asked)).json();if(stillFor(t0))lastStatusOkAt=Date.now();return rr}
+async function fetchRunStatus(q,tok){const asked=q===undefined?clientQ():q,t0=tok===undefined?clientToken():tok;const rr=await(await fetch("/api/run/status"+asked)).json();if(stillFor(t0))lastStatusOkAt=Date.now();
+ /* A Build's one-time password lines come from the seat-guarded read, never the run status (S2). */
+ try{const s=await(await fetch("/api/run/secrets"+asked)).json();if(s&&Array.isArray(s.oneTime)&&s.oneTime.length)rr.oneTime=s.oneTime}catch(e){}
+ return rr}
 function statusIsStale(){return !lastStatusOkAt||Date.now()-lastStatusOkAt>15000}
 function runKey(r){return r?[r.running?1:0,r.locationId||"",r.stage==null?"":r.stage,r.capability||"",r.startedAt||"",r.reviewing?1:0,r.ok==null?"":r.ok?1:0].join("|"):""}
 function runJustFinished(prev,next){return Boolean(prev&&prev.running&&next&&!next.running)}
@@ -60422,7 +60566,7 @@ function escT(s){return String(s==null?"":s).replace(/&/g,"&amp;").replace(/</g,
 function reviewPanel(id,name,state,run){const r=rData[id];const d=document.createElement("div");d.className="cds-panel review";
  const h3=document.createElement("h3");h3.className="cds-panel-title";h3.textContent="Blueprint Review for "+name;d.appendChild(h3);
  /* Staff first: before Approve, say plainly that Build waits for the staff (the run gate enforces it). */
- {const sc=(state.staffChecks||{})[id];if(!sc||sc.status!=="ready"){const w=document.createElement("p");w.className="cds-callout warn";w.setAttribute("role","alert");w.textContent=sc?STAFF_REVIEW_WARNING:STAFF_REVIEW_UNCHECKED;d.appendChild(w)}}
+ {const sc=(state.staffChecks||{})[id];if(!sc||sc.status!=="ready"){const w=document.createElement("p");w.className="cds-callout warn";w.setAttribute("role","alert");w.textContent=sc&&sc.status!=="unreadable"?STAFF_REVIEW_WARNING:STAFF_REVIEW_UNCHECKED;d.appendChild(w)}}
  /* Codex F1 (2026-09-06): the review is the model's output and the names are other businesses' records; both are TEXT. */
  const bt=(el,label,text)=>{const b=document.createElement("b");b.textContent=label;el.appendChild(b);el.appendChild(document.createTextNode(moneyText(text)))};
  const busy=reviewBusy(id,run);
@@ -60676,11 +60820,23 @@ a.textContent="Open Your agency";box.appendChild(a);return box}
    connected and before Intake and Build, and Intake and Build refuse to start until every
    person listed here is found in the account by email. The server reads the account every
    time; nothing on this panel is taken as proof on its own. */
-let staffBusy={},staffSaid={},staffErr={};
+let staffBusy={},staffSaid={},staffErr={},staffPwHeld={};
+/* This account's one-time password lines from its last Builds (S1). A second client in the same sub-account (the same
+   member's) has no card of its own, so its lines show here too, each naming that client (Codex on 50acb7eb). */
+function oneTimeFor(run,c){return ((run&&run.oneTime)||[]).filter(x=>x.locationId===c.locationId&&(!c.clientKey||x.clientKey===c.clientKey)).flatMap(x=>x.clientKey&&!c.clientKey?(x.lines||[]).map(l=>"For "+(x.clientName||x.clientKey)+": "+l):(x.lines||[]))}
+/* A one-time password whose create never showed up (passwordUnconfirmed) is held in this page only, never sent or
+   saved, and shown the first time a check lists that person, in place of their waiting line (3.91.1). */
+/* A newer password for someone replaces any older one, held or shown (3.91.1, Codex on 6560441d); a shown password line
+   starts "<name> was added. ", so "John Smith" never matches "John Smith Jr." (Codex on 610e9378). */
+function staffSupersede(id,results){for(const x of results||[])if(x.generatedPassword){const e=String(x.email).trim().toLowerCase();if(staffPwHeld[id])staffPwHeld[id]=staffPwHeld[id].filter(h=>h.email!==e);if(staffSaid[id])staffSaid[id]=staffSaid[id].filter(l=>!(l.includes(" Their one-time password is ")&&l.startsWith(x.name+" was added. ")))}}
+function staffHoldPasswords(id,results){for(const x of results||[])if(x.generatedPassword&&x.passwordUnconfirmed){const e=String(x.email).trim().toLowerCase();staffPwHeld[id]=(staffPwHeld[id]||[]).filter(h=>h.email!==e);staffPwHeld[id].push({email:e,name:x.name,said:x.said,pw:x.generatedPassword})}}
+function staffRevealPasswords(id,check){const held=staffPwHeld[id];if(!held||!check||!check.matched)return;const inAcct=new Set(check.matched.map(m=>String(m.email).trim().toLowerCase()));const left=[];
+ for(const h of held){if(!inAcct.has(h.email)){left.push(h);continue}const lines=(staffSaid[id]||[]).filter(l=>l!==h.said);lines.push(h.name+" was added. GoHighLevel should email them an invitation. Their one-time password is "+h.pw+". Give it to them privately.");staffSaid[id]=lines}
+ if(left.length)staffPwHeld[id]=left;else delete staffPwHeld[id]}
 /* Whether Add them for me would make this person an admin (the check's own creations, never guessed here). */
 function staffAdminFor(check,m){const cr=((check&&check.creations)||[]).find(x=>x.email===String(m.email).trim().toLowerCase());return Boolean(cr&&cr.role==="admin")}
 function staffCard(c,state){const box=document.createElement("section");box.className="cds-panel ipanel staffstep";box.id="staff-"+c.locationId;
- const check=(state.staffChecks||{})[c.locationId];const roster=(state.staffRoster||{})[c.locationId]||{};
+ const check=(state.staffChecks||{})[c.locationId];const roster=(state.staffRoster||{})[c.locationId]||{};staffRevealPasswords(c.locationId,check);
  const h=document.createElement("h3");h.className="cds-panel-title";h.textContent=check&&check.status==="ready"?"Your staff are in place":"Add your staff";box.appendChild(h);
  box.appendChild(mk("p","",check?check.headline+". "+check.body:"Calendars and lead alerts need real people. List everyone who takes appointments and everyone who should hear about new leads. We check this client's account for each email address before anything is built."));
  /* One listing in every state (3.90.1, Codex on 516081d8): where the list came from, then each person with their
@@ -60690,6 +60846,8 @@ function staffCard(c,state){const box=document.createElement("section");box.clas
   for(const m of check.matched||[]){const li=mk("li");li.appendChild(mk("span","ttl",m.name+" ("+m.email+")"+(m.role?" \xB7 "+m.role:"")));const end=mk("span","end");end.appendChild(chip("ok","In the account"));li.appendChild(end);ul.appendChild(li)}
   for(const m of check.missing||[]){const li=mk("li");li.appendChild(mk("span","ttl",m.name+" ("+m.email+")"+(m.role?" \xB7 "+m.role:"")));const end=mk("span","end");const w=(check.waiting||[]).find(x=>x.email===m.email);if(staffAdminFor(check,m))end.appendChild(chip("info",BS_ADMIN_MARK));end.appendChild(w?mk("span","small",w.line):chip("warn","Not in the account yet"));li.appendChild(end);ul.appendChild(li)}
   box.appendChild(ul)}
+ /* A listed person already in the account at another level: said here too, as step 7 does (3.90.2). */
+ for(const d of (check&&check.levelDiffs)||[])box.appendChild(mk("p","cds-callout warn",d.line));
  for(const line of (check&&check.steps)||[])box.appendChild(mk("p","small",line));
  if(check&&check.createRefused)box.appendChild(mk("p","small","GoHighLevel does not let this agency add people from outside GoHighLevel, so please add them yourself."));
  if(check&&check.howToAdd)box.appendChild(mk("p","small",check.howToAdd));
@@ -60713,8 +60871,11 @@ function staffCard(c,state){const box=document.createElement("section");box.clas
    run:async()=>{r=await(await clientPageRequest("/api/staff/add",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({locationId:c.locationId,shown:check.creations||[]})})).json();
     /* Any answer closes this confirmation (it showed the list as it was) and its lines go to the panel's own box,
        which stays through the redraw until Done (3.90.1, Codex on e4734bc4); a refusal's team is drawn at once. */
-    const lines=!r?[clientPageError("That did not go through. Click Check again to see where things stand.")]:[...(r.ok===false?[clientPageError(r.error||"That did not go through. Click Check again to see where things stand.")]:[]),...(r.said||[]),...(r.results||[]).filter(x=>x.generatedPassword).map(x=>x.said+" Their one-time password is "+x.generatedPassword+". Give it to them privately; it is not saved anywhere.")];
-    if(lines.length)staffSaid[c.locationId]=lines;
+    const lines=!r?[clientPageError("That did not go through. Click Check again to see where things stand.")]:[...(r.ok===false?[clientPageError(r.error||"That did not go through. Click Check again to see where things stand.")]:[]),...(r.said||[]),...(r.results||[]).filter(x=>x.generatedPassword&&!x.passwordUnconfirmed).map(x=>x.said+" Their one-time password is "+x.generatedPassword+". Give it to them privately.")];
+    /* A second press keeps the first press's one-time passwords: they are shown once (3.91.1). */
+    staffSupersede(c.locationId,r&&r.results);
+    if(lines.length)staffSaid[c.locationId]=[...(staffSaid[c.locationId]||[]).filter(l=>l.includes(" Their one-time password is ")),...lines];
+    staffHoldPasswords(c.locationId,r&&r.results);
     if(r&&r.check&&lastState)lastState.staffChecks=Object.assign({},lastState.staffChecks,{[c.locationId]:r.check});
     return ""},
    after:async()=>{delete icOpen[addKey];load()}})};
@@ -60778,7 +60939,7 @@ title.textContent="Claude usage for this client";details.appendChild(title);for(
  if(parkedType){const pn=document.createElement("p");pn.className="muted";pn.textContent="This is a "+typeOf(state,c.locationId)+" account, so nothing is built into it from here. You can lock or unlock it below, or change its type to Client to build it.";div.appendChild(pn)}
  else if(!st.some(s=>s==="done"))div.appendChild(unnest(preflightCard(c)));
  /* Kept reachable after a finished Build while a re-run is held for staff (the gate saves its check). */
- {const sc=(state.staffChecks||{})[c.locationId];if(!parkedType&&((st[3]||"pending")!=="done"||(sc&&sc.status!=="ready")||(staffSaid[c.locationId]||[]).length))div.appendChild(unnest(staffCard(c,state)))}
+ {const sc=(state.staffChecks||{})[c.locationId];staffRevealPasswords(c.locationId,sc);if(!parkedType&&((st[3]||"pending")!=="done"||(sc&&sc.status!=="ready")||(staffSaid[c.locationId]||[]).length))div.appendChild(unnest(staffCard(c,state)))}
  // The steps, laid out as the owner approved on 2026-09-25: a progress bar, the next step in
  // full, then one row per step. Only the layout changed. Every button below keeps the condition
  // and the handler it had in the seven-column layout; the next-step panel draws the SAME
@@ -61069,6 +61230,8 @@ title.textContent="Claude usage for this client";details.appendChild(title);for(
   rr.appendChild(rb);div.appendChild(rr);
   if(rOpen[c.locationId])div.appendChild(unnest(reviewPanel(c.locationId,c.name,state,run)))}
  if(st[0]==="done"&&!intakeUp)intakeEntry(c,div,false);
+ /* A password GoHighLevel set during this Build: from the run's own channel, in memory only, never in the report (S1). */
+ {const otl=oneTimeFor(run,c);if(otl.length){const ot=mk("div","cds-callout warn cds-stack buildonetime");ot.setAttribute("role","status");for(const l of otl)ot.appendChild(mk("p","",l));div.appendChild(ot)}}
  if(run&&run.locationId===c.locationId&&(run.running||run.lines&&run.lines.length)){
   const bp=buildPanel(run);
   if(bp){div.appendChild(unnest(bp));
@@ -62450,6 +62613,7 @@ async function runDashboard(argv) {
   };
   const staffDepsFor = (locationId2) => {
     const c = clientFor(locationId2);
+    const offerInputs = () => ({ hasAgencyKey: Boolean(c && registry2.getAgencyKey()), profile: readAgencyProfile(), refusedAt: readCockpitState().staffAddRefused?.[locationId2] });
     return {
       listUsers: async () => {
         if (!c) throw new Error("This client is not connected yet.");
@@ -62458,7 +62622,8 @@ async function runDashboard(argv) {
       // Offered only with an agency key, when the operator has not said their
       // plan cannot create accounts, and until GoHighLevel has refused it here
       // ("The company does not have access to this feature" below Agency Pro).
-      canCreateUsers: () => staffCreateOffered({ hasAgencyKey: Boolean(c && registry2.getAgencyKey()), profile: readAgencyProfile(), refusedAt: readCockpitState().staffAddRefused?.[locationId2] }),
+      canCreateUsers: () => staffCreateOffered(offerInputs()),
+      addBlocked: () => staffAddBlocker(offerInputs()),
       createUser: async (u) => {
         if (!c) throw new Error("This client is not connected yet.");
         return createOrBindUser(c, registry2, { locationId: locationId2, ...u });
@@ -63000,7 +63165,6 @@ async function runDashboard(argv) {
     source: clientFor,
     questions: (id) => composeQuestionSet({ industry: readCockpitState().accounts?.[id]?.industry, agency: readOverlay() })
   };
-  const staffWaitingStage = (id) => readCockpitState().clients[id]?.stages?.[0] === "done" ? "Build" : "Intake";
   const staffAnswer = (req, res, id, save) => {
     const seat = checkSeatToken({ method: "POST", headers: req.headers }, seatToken);
     if (seat) {
@@ -63043,7 +63207,7 @@ async function runDashboard(argv) {
     void clientPreflight(registry2, id, save ? {} : { persist: false, savedBuilder: readCockpitState().preflightBuilder?.[id] }).then(async (result) => {
       const line3 = result.lines.find((l) => l.key === "builder");
       const staffNow = await staffCheckRead(id).catch(() => void 0);
-      result.lines.push(staffPreflightLine(staffNow, staffWaitingStage(id)));
+      result.lines.push(staffPreflightLine(staffNow));
       if (pfTicket && !cockpitCache.commitIfCurrent(pfTicket, () => {
         if (line3) {
           const st = readCockpitState();
@@ -63499,6 +63663,7 @@ ${opportunityNoteFailure?.detail ?? ""}`);
         } catch {
         }
         await oneStaffAddAtATime(queued, async () => {
+          let made;
           try {
             const { locationId: locationId2, shown: shownRaw } = JSON.parse(body);
             if (typeof locationId2 !== "string" || !readableAccount(locationId2)) throw new Error("Choose a registered client.");
@@ -63523,10 +63688,14 @@ ${opportunityNoteFailure?.detail ?? ""}`);
               const name = [u.firstName, u.lastName === "-" ? "" : u.lastName].filter(Boolean).join(" ");
               holdStaff(locationId2, u.email, { name, at, phase: "creating" });
               const outcome = await deps.createUser(u);
-              if (outcome.ok && outcome.status === "created") holdStaff(locationId2, u.email, { name, at, phase: "created" });
-              else if (outcome.ok || createMadeNothing(outcome)) holdStaff(locationId2, u.email, void 0);
+              try {
+                if (outcome.ok && outcome.status === "created") holdStaff(locationId2, u.email, { name, at, phase: "created" });
+                else if (outcome.ok || createMadeNothing(outcome)) holdStaff(locationId2, u.email, void 0);
+              } catch {
+              }
               return outcome;
             } }, listed, void 0, live);
+            made = out.results;
             out.check = applyStaffPending(out.check, readCockpitState().staffPending?.[locationId2], Date.now());
             if (out.check.createRefused) {
               const latest = readCockpitState();
@@ -63563,8 +63732,9 @@ ${opportunityNoteFailure?.detail ?? ""}`);
             for (const r of out.results) if (r.status === "created" && !listedNow.has(normEmail(r.email))) said.push(staffNotOnTeamLine(r.name));
             reply(200, { ok: true, said, results: out.results, created, check: fresh });
           } catch (e) {
-            res.writeHead(400, { "Content-Type": "application/json" });
-            res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : "bad request" }));
+            if (res.writableEnded) return;
+            res.writeHead(made ? 500 : 400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ ok: false, error: e instanceof Error ? e.message : "bad request", ...made ? { said: staffAddSaid(made), results: made } : {} }));
           }
         });
       });
@@ -63782,6 +63952,14 @@ ${opportunityNoteFailure?.detail ?? ""}`);
       res.end(JSON.stringify(mine && activeRun2 ? { ...activeRun2, lines: memberProgress(activeRun2.lines, activeRun2.running, activeRun2.ok) } : activeRun2?.running ? { running: true, elsewhere: true, lines: [] } : { running: false, lines: [] }));
       return;
     }
+    if (req.method === "GET" && url === "/api/run/secrets") {
+      const q3 = new URL(req.url || "/", "http://x").searchParams;
+      const askedLoc = gate2.plan === "pro" ? q3.get("locationId") ?? "" : q3.get("locationId");
+      const askedKey = q3.get("clientKey");
+      res.writeHead(200, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ oneTime: [...buildOneTime.values()].filter((e) => Object.keys(e.byEmail).length && (askedLoc === null || e.locationId === askedLoc) && (askedKey === null || (e.clientKey ?? "") === askedKey)).map(oneTimeView) }));
+      return;
+    }
     if (req.method === "POST" && url === "/api/run") {
       readBody(req, res, 1e4, async (body) => {
         try {
@@ -63899,7 +64077,7 @@ ${opportunityNoteFailure?.detail ?? ""}`);
           startRun(locationId2, stage, (ok) => {
             writeCockpitState(setStage(readCockpitState(), locationId2, stage, ok ? "done" : "pending", who.clientKey));
             if (!who.clientKey) pushShared(locationId2);
-          }, { ...who.clientKey ? { clientKey: who.clientKey } : {}, name: currentRoster().find((r) => r.locationId === locationId2)?.name, approvedAt: stage <= 1 ? (/* @__PURE__ */ new Date()).toISOString() : st0.buildApproved?.[rk], writeReview: writeReviewFor, inputHash, normalizedAnswers, statusWriter: () => approvedStatusWriter(registry2, locationId2), verifyAccount: async (saved) => {
+          }, { ...who.clientKey ? { clientKey: who.clientKey, clientName: who.name } : {}, name: currentRoster().find((r) => r.locationId === locationId2)?.name, approvedAt: stage <= 1 ? (/* @__PURE__ */ new Date()).toISOString() : st0.buildApproved?.[rk], writeReview: writeReviewFor, inputHash, normalizedAnswers, statusWriter: () => approvedStatusWriter(registry2, locationId2), verifyAccount: async (saved) => {
             const client = clientFor(locationId2);
             if (!client || !saved) throw new Error("The saved plan or account read connection is unavailable.");
             return readVerifyAccount(saved, client);
@@ -65304,12 +65482,15 @@ ${opportunityNoteFailure?.detail ?? ""}`);
 `);
   });
   return await new Promise((resolve13) => {
-    const stop2 = () => server2.close(() => resolve13(0));
+    const stop2 = () => {
+      closeAllSecretChannels();
+      server2.close(() => resolve13(0));
+    };
     process.on("SIGINT", stop2);
     process.on("SIGTERM", stop2);
   });
 }
-var import_zod67, import_node_util5, fs47, path45, http2, import_child_process4, import_child_process5, osmod, VIEWER_COCKPIT_MSG, STAGES2, ACCOUNT_TYPES, SECOND_CLIENT_NO_INTAKE, stateRecovery, stateSaveFs, CHOOSE_WHAT_THEY_BOUGHT, CHOOSE_BEFORE_BUILD, TEXT_SNIPPETS_LOCKED, SCOPE_REFUSAL, APPROVAL_WITHDRAWN_FOR_STAFF, APPROVAL_WITHDRAWN_NO_TEAM, NOTHING_BOUGHT, NOTHING_BUILT_FROM_TICKS, ASSESSMENT_CHANGED_SINCE_APPROVAL, APPROVAL_WITHDRAWN_FOR_ASSESSMENT, APPROVE_NEEDS_INTAKE, APPROVE_NEEDS_BRIEF, INDUSTRY_FIRST, NOTHING_TICKED_IN_PLAN, SCOPE_CHANGED_SINCE_APPROVAL, APPROVAL_WITHDRAWN_FOR_SCOPE, INACTIVE, OFF_LICENSE, LICENSE_RECHECK_MS, activeRun2, runForTests, handoffEmailPreviews, UPGRADE_MSG, DOC_EXTS, DOC_MAX_BYTES, queueScanWatch, queueScanOnce, GATE_BODY, GATE_BODY_MAX, DOC_NOT_SAVED, NO_KEY_ON_FILE, PARKED_NOT_BUILT, NEEDS_AGENCY_KEY, INTAKE_UNREADABLE, INTAKE_READ_TRANSIENT, INTAKE_REFRESH_RETRYING, ACCOUNT_CHANGED_DURING_READ, commitWithoutRead, SNAPSHOTS_CHANGED_DURING_READ, IntakeColdError, INTAKE_ANSWERS_MISSING, INTAKE_READ_FAILED, RUN_IN_PROGRESS, BRIEF_NEEDS_INTAKE2, BUSINESS_TYPE_FOR_INDUSTRY, INTAKE_FORM_REQUIRED, INTAKE_CONNECT_REQUIRED, INTAKE_OWN_MESSAGES, currentRosterRef, staffGateRef, BOARD_ROUTES, BOARD_TITLES, SCREEN_HEADS, NO_SUCH_PAGE, CHOOSE_CLIENT, ONE_CLIENT_ONLY, anthropicKeyWrites, SEAT_TOKEN_HEADER, NOT_SIGNED_IN_MSG, SEAT_GUARDED_READS, licenceRefusedHooks, ConnectionRequest, DisconnectRequest, ReportBrandSaveRequest;
+var import_zod67, import_node_util5, fs47, path45, http2, import_child_process4, import_child_process5, osmod, VIEWER_COCKPIT_MSG, STAGES2, ACCOUNT_TYPES, SECOND_CLIENT_NO_INTAKE, stateRecovery, stateSaveFs, CHOOSE_WHAT_THEY_BOUGHT, CHOOSE_BEFORE_BUILD, TEXT_SNIPPETS_LOCKED, SCOPE_REFUSAL, APPROVAL_WITHDRAWN_FOR_STAFF, APPROVAL_WITHDRAWN_NO_TEAM, NOTHING_BOUGHT, NOTHING_BUILT_FROM_TICKS, ASSESSMENT_CHANGED_SINCE_APPROVAL, APPROVAL_WITHDRAWN_FOR_ASSESSMENT, APPROVE_NEEDS_INTAKE, APPROVE_NEEDS_BRIEF, INDUSTRY_FIRST, NOTHING_TICKED_IN_PLAN, SCOPE_CHANGED_SINCE_APPROVAL, APPROVAL_WITHDRAWN_FOR_SCOPE, INACTIVE, OFF_LICENSE, LICENSE_RECHECK_MS, activeRun2, buildOneTime, oneTimeView, runForTests, handoffEmailPreviews, UPGRADE_MSG, DOC_EXTS, DOC_MAX_BYTES, queueScanWatch, queueScanOnce, GATE_BODY, GATE_BODY_MAX, DOC_NOT_SAVED, NO_KEY_ON_FILE, PARKED_NOT_BUILT, NEEDS_AGENCY_KEY, INTAKE_UNREADABLE, INTAKE_READ_TRANSIENT, INTAKE_REFRESH_RETRYING, ACCOUNT_CHANGED_DURING_READ, commitWithoutRead, SNAPSHOTS_CHANGED_DURING_READ, IntakeColdError, INTAKE_ANSWERS_MISSING, INTAKE_READ_FAILED, RUN_IN_PROGRESS, BRIEF_NEEDS_INTAKE2, BUSINESS_TYPE_FOR_INDUSTRY, INTAKE_FORM_REQUIRED, INTAKE_CONNECT_REQUIRED, INTAKE_OWN_MESSAGES, currentRosterRef, staffGateRef, BOARD_ROUTES, BOARD_TITLES, SCREEN_HEADS, NO_SUCH_PAGE, CHOOSE_CLIENT, ONE_CLIENT_ONLY, anthropicKeyWrites, SEAT_TOKEN_HEADER, NOT_SIGNED_IN_MSG, SEAT_GUARDED_READS, licenceRefusedHooks, ConnectionRequest, DisconnectRequest, ReportBrandSaveRequest;
 var init_dashboard = __esm({
   "src/dashboard.ts"() {
     "use strict";
@@ -65375,6 +65556,7 @@ var init_dashboard = __esm({
     init_manual_tasks();
     init_jobs();
     init_go_live();
+    init_build_secrets();
     init_sub_account_errors();
     init_provisioning();
     init_location_switcher();
@@ -65481,9 +65663,21 @@ var init_dashboard = __esm({
     OFF_LICENSE = "This computer is no longer on your license. Free a device on your license, then restart Command OS.";
     LICENSE_RECHECK_MS = 4 * 60 * 60 * 1e3;
     activeRun2 = null;
-    runForTests = { set(r) {
-      activeRun2 = r;
-    } };
+    buildOneTime = /* @__PURE__ */ new Map();
+    oneTimeView = (e) => ({ locationId: e.locationId, ...e.clientKey ? { clientKey: e.clientKey } : {}, ...e.clientName ? { clientName: e.clientName } : {}, lines: Object.values(e.byEmail) });
+    runForTests = {
+      set(r) {
+        activeRun2 = r;
+      },
+      /** A Build's one-time lines for a client, as its channel would have kept them; null clears every client's. */
+      oneTime(locationId2, lines = [], clientKey) {
+        if (locationId2 === null) {
+          buildOneTime.clear();
+          return;
+        }
+        buildOneTime.set(clientRecordKey(locationId2, clientKey), { locationId: locationId2, ...clientKey ? { clientKey } : {}, byEmail: Object.fromEntries(lines.map((l, i) => [`p${i}@test`, l])) });
+      }
+    };
     handoffEmailPreviews = /* @__PURE__ */ new Map();
     UPGRADE_MSG = "\n  The cockpit comes with Command OS, and this license does not include it, so it did not start.\n  Nothing was changed. Your GHL Command tools still work in Claude as usual.\n\n";
     DOC_EXTS = /* @__PURE__ */ new Set([".md", ".txt", ".vtt", ".srt", ".csv"]);
@@ -65497,7 +65691,7 @@ var init_dashboard = __esm({
     PARKED_NOT_BUILT = "Template and hidden accounts are not built from Command OS. Change the account's type to Client first.";
     NEEDS_AGENCY_KEY = "No agency key on file. Run register_agency_key in GHL Command first.";
     INTAKE_UNREADABLE = "Command OS could not read this client's account. Paste its key again under Reconnect this client, at the top of its steps on Build a client account.";
-    INTAKE_READ_TRANSIENT = "Command OS could not reach this client's account just now. Try again in a moment.";
+    INTAKE_READ_TRANSIENT = "We could not reach this client's account just now. Try again in a moment.";
     INTAKE_REFRESH_RETRYING = "Could not refresh just now; retrying.";
     ACCOUNT_CHANGED_DURING_READ = "The account's connection changed while it was being read, so nothing was kept or changed. Try again.";
     commitWithoutRead = (fn) => {
@@ -65556,7 +65750,7 @@ var init_dashboard = __esm({
     anthropicKeyWrites = Promise.resolve();
     SEAT_TOKEN_HEADER = "x-command-os-seat";
     NOT_SIGNED_IN_MSG = "This browser isn't signed in to Command OS on this computer. Open Command OS on the machine it runs on, and use the page it opens for you.";
-    SEAT_GUARDED_READS = ["/api/brief", "/api/brief/panel", "/api/connections", "/api/capability", "/api/client-intake", "/api/intake-documents", "/api/snapshots", "/api/agency-connection", "/api/client-preflight", "/api/staff"];
+    SEAT_GUARDED_READS = ["/api/run/secrets", "/api/brief", "/api/brief/panel", "/api/connections", "/api/capability", "/api/client-intake", "/api/intake-documents", "/api/snapshots", "/api/agency-connection", "/api/client-preflight", "/api/staff"];
     licenceRefusedHooks = /* @__PURE__ */ new Set();
     ConnectionRequest = import_zod67.z.discriminatedUnion("system", [
       import_zod67.z.object({ system: import_zod67.z.literal("stripe"), key: import_zod67.z.string().min(8).max(4096), label: import_zod67.z.string().optional() }).strict(),
@@ -77144,7 +77338,8 @@ var init_build_reply = __esm({
       { name: "staff", apply: (r) => {
         const all = arr(r.staff);
         if (!all.length) return false;
-        r.staff = { counts: templateCounts(all), notReady: all.filter((m) => m.status !== "created" && m.status !== "existing").map((m) => ({ name: m.name, status: m.status })) };
+        const passwordNotes = all.map((m) => m.passwordNote).filter((n) => typeof n === "string");
+        r.staff = { counts: templateCounts(all), notReady: all.filter((m) => m.status !== "created" && m.status !== "existing").map((m) => ({ name: m.name, status: m.status })), ...passwordNotes.length ? { passwordNotes } : {} };
         return true;
       } },
       { name: "composed.warnings", apply: (r) => shrinkWarnings(r) }
@@ -77802,6 +77997,9 @@ var init_text_snippets = __esm({
 });
 
 // src/intake-to-build/execute.ts
+function pendingPasswordLine(name, password) {
+  return `${name} was sent to GoHighLevel but is not on this account's user list yet. If GoHighLevel made the login, the password set for them is ${password}. Give it to them privately and ask them to change it when they sign in.`;
+}
 function staffPauseReason(calendars, people) {
   const list4 = (xs) => xs.length <= 1 ? xs[0] ?? "" : `${xs.slice(0, -1).join(", ")} and ${xs[xs.length - 1]}`;
   const cals = calendars.map((c) => `"${c}"`);
@@ -78030,7 +78228,7 @@ async function executeBackbone(plan, rawDeps, opts = {}) {
     for (const u of userList ?? []) accountUserIds.add(u.id);
     const canCreate = deps.canCreateUsers();
     let deferredUsers = 0;
-    const pendStaff = (u, reason3) => {
+    const pendStaff = (u, reason3, password) => {
       const priorId = idMap[u.ref] || opts.priorIdMap?.[u.ref];
       if (readError && priorId && !priorId.includes("__pending__")) {
         const name = userDisplayName(u);
@@ -78038,11 +78236,11 @@ async function executeBackbone(plan, rawDeps, opts = {}) {
         idMap[u.ref] = priorId;
         accountUserIds.add(priorId);
         built.push({ ref: u.ref, type: "user", name, status: "existing", realId: priorId, warning });
-        staff.push({ ref: u.ref, name, email: u.email, role: u.role, status: "existing", userId: priorId, warnings: [warning] });
+        staff.push({ ref: u.ref, name, email: u.email, role: u.role, status: "existing", userId: priorId, warnings: [warning], ...password ? { generatedPassword: password, passwordLine: pendingPasswordLine(name, password) } : {} });
         return;
       }
       idMap[u.ref] = PENDING_USER_REF;
-      staff.push({ ref: u.ref, name: userDisplayName(u), email: u.email, role: u.role, status: "pending", reason: reason3 });
+      staff.push({ ref: u.ref, name: userDisplayName(u), email: u.email, role: u.role, status: "pending", reason: reason3, ...password ? { generatedPassword: password, passwordLine: pendingPasswordLine(userDisplayName(u), password) } : {} });
       manual.push({ ref: u.ref, type: "staff_pending", name: userDisplayName(u), reason: reason3 });
     };
     for (const u of users) {
@@ -78067,26 +78265,28 @@ async function executeBackbone(plan, rawDeps, opts = {}) {
       }
       let outcome = void 0;
       let recoveredUser;
+      let sentPassword;
       try {
         outcome = await deps.createUser({ firstName: u.firstName, lastName: u.lastName, email: u.email, role: u.role, phone: u.phone });
       } catch (e) {
+        if (e instanceof CreateUserError) sentPassword = e.generatedPassword;
         if (/read failed after \d attempts?\./.test(msg2(e))) {
           readError = msg2(e);
-          pendStaff(u, `Staff creation is unfinished because its account read failed. ${readError}`);
+          pendStaff(u, `Staff creation is unfinished because its account read failed. ${readError}`, sentPassword);
           continue;
         }
         if (isRetryableAccountError(e)) {
           try {
             recoveredUser = findUserByEmail(await deps.listUsers(), u.email);
-            if (recoveredUser) outcome = { status: "uncertain", warnings: [`This person was created or found after a failed create; left in place; check it by hand. This build may have created the person. ${msg2(e)}`] };
+            if (recoveredUser) outcome = { status: "uncertain", ...sentPassword ? { generatedPassword: sentPassword } : {}, warnings: [`This person was created or found after a failed create; left in place; check it by hand. This build may have created the person. ${msg2(e)}`] };
           } catch (readFailure) {
             readError = msg2(readFailure);
-            pendStaff(u, `Staff creation is unfinished. ${msg2(e)} The account could not be re-checked. ${readError}`);
+            pendStaff(u, `Staff creation is unfinished. ${msg2(e)} The account could not be re-checked. ${readError}`, sentPassword);
             continue;
           }
         }
         if (!recoveredUser) {
-          pendStaff(u, explainStaffCreateFailure(name, u.email, msg2(e)));
+          pendStaff(u, explainStaffCreateFailure(name, u.email, msg2(e)), sentPassword);
           continue;
         }
       }
@@ -78106,10 +78306,10 @@ async function executeBackbone(plan, rawDeps, opts = {}) {
       }
       if (!verified) {
         if (readError) {
-          pendStaff(u, `Staff member "${name}" could not be re-checked after creation. ${readError}`);
+          pendStaff(u, `Staff member "${name}" could not be re-checked after creation. ${readError}`, outcome?.generatedPassword);
           continue;
         }
-        pendStaff(u, `Staff member "${name}" (${u.email}) was submitted to GoHighLevel but has not appeared on this account's user list yet (read-after-write lag, or the invite is still pending). Check ${GHL_STAFF_PAGE}, then re-run to bind them by email.`);
+        pendStaff(u, `Staff member "${name}" (${u.email}) was submitted to GoHighLevel but has not appeared on this account's user list yet (read-after-write lag, or the invite is still pending). Check ${GHL_STAFF_PAGE}, then re-run to bind them by email.`, outcome?.generatedPassword);
         continue;
       }
       built.push({ ref: u.ref, type: "user", name, status: outcome?.status ?? "created", realId: verified.id, ...outcome?.status === "uncertain" ? { warning: (outcome.warnings ?? []).join(" ") || "Found after a failed create; confirm this person belongs to the account." } : {} });
@@ -79246,7 +79446,7 @@ function publishVerdict(outcome) {
   const status = typeof c.status_returned === "string" ? c.status_returned : "(GHL returned no status)";
   return { live: false, kind: "not_live", reason: warning || `NOT LIVE. The workflow read back as ${status} rather than "published", so it is not running.` };
 }
-var norm5, sleep6, PREVIEW_SNIPPET_LENGTH, JournalHookError, WRITE_RETRIES, RUN_STOP_AFTER;
+var norm5, sleep6, CreateUserError, PREVIEW_SNIPPET_LENGTH, JournalHookError, WRITE_RETRIES, RUN_STOP_AFTER;
 var init_execute = __esm({
   "src/intake-to-build/execute.ts"() {
     "use strict";
@@ -79258,6 +79458,13 @@ var init_execute = __esm({
     init_build_progress();
     norm5 = (s) => s.trim().toLowerCase();
     sleep6 = (ms) => new Promise((r) => setTimeout(r, ms));
+    CreateUserError = class extends Error {
+      constructor(message, generatedPassword) {
+        super(message);
+        this.generatedPassword = generatedPassword;
+      }
+      generatedPassword;
+    };
     PREVIEW_SNIPPET_LENGTH = 30;
     JournalHookError = class extends Error {
       constructor(cause) {
@@ -79655,7 +79862,7 @@ function makeExecuteDeps(client, builderClient, locationId2, registry2) {
     // the id via listUsers before binding.
     createUser: async (u) => {
       const outcome = await createOrBindUser(client, registry2, { ...u, locationId: locationId2 });
-      if (!outcome.ok) throw new Error(outcome.error);
+      if (!outcome.ok) throw new CreateUserError(outcome.error, outcome.generatedPassword);
       return { userId: outcome.userId, status: outcome.status, warnings: outcome.warnings, generatedPassword: outcome.generatedPassword };
     },
     createCalendar: async (cal) => {
@@ -80212,6 +80419,8 @@ function registerIntakeToBuildTools(server2, client, builderClient, registry2) {
           return jsonResponse({ ok: false, phase: "client", error: "This run was started for a different client in this sub-account, so nothing was built." });
         }
         clientKey = fromEnv.data;
+      } else if (inCockpitBuild() && (clientKeyArg !== void 0 || requestedPrefix)) {
+        return jsonResponse({ ok: false, phase: "client", error: "This run was started for this sub-account's own client, so nothing was built. Start the other client's Build from its own page." });
       } else if (clientKeyArg !== void 0) {
         const parsed2 = clientKeySchema.safeParse(clientKeyArg);
         if (!parsed2.success) return jsonResponse({ ok: false, phase: "client", error: parsed2.error.issues.map((i) => i.message).join(" ") });
@@ -80664,6 +80873,7 @@ function registerIntakeToBuildTools(server2, client, builderClient, registry2) {
           ...result.workflows.flatMap((w) => [...w.manual, ...w.needsContent].map((m) => ({ ref: w.ref, type: "workflow-manual", name: w.name, reason: m.reason }))),
           ...result.handoffs.filter((h) => !h.met).map((h, i) => ({ ref: `handoff:${i}`, type: "handoff", name: h.title, reason: h.instruction }))
         ]);
+        if (inCockpitBuild()) withholdOneTimePasswords(exec.staff);
         const execManualLines = exec.manual.map((m) => `[${m.type}] ${m.reason}`);
         const manualLines = result.workflows.flatMap((w) => [
           ...w.manual.map((m) => `[${w.name}] ${m.reason}`),
@@ -81364,6 +81574,7 @@ var init_intake_to_build = __esm({
     init_features();
     init_executor();
     init_build_confirm();
+    init_build_secrets();
     init_execute();
     init_build_facts();
     init_net_guard();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elitedcs/ghl-mcp",
-  "version": "3.91.0",
+  "version": "3.91.1",
   "mcpName": "io.github.drjerryrelth/ghl-command",
   "description": "GoHighLevel MCP Server for Claude. 250 tools — full CRM, automation, marketing control, account-wide workflow audit, live funnel-capture verification, and the only programmatic GHL workflow builder, now multi-tenant across client accounts.",
   "main": "dist/index.js",