hearth-dash 1.1.0 → 1.1.1

package/README.md

@@ -1,142 +1,146 @@
-<div align="center">
-
-# Hearth
-
-**A cozy personal dashboard on Cloudflare Workers**
-
-[![Cloudflare Workers](https://img.shields.io/badge/Cloudflare%20Workers-F38020?style=for-the-badge&logo=cloudflare&logoColor=white)](#)
-[![D1](https://img.shields.io/badge/D1-SQLite-22D3EE?style=for-the-badge&logo=cloudflare&logoColor=white)](#)
-[![license Non-Commercial](https://img.shields.io/badge/license-Non--Commercial-A855F7?style=for-the-badge)](LICENSE)
-
-</div>
-
-Hearth is a small personal dashboard for two people. It runs as a Cloudflare Worker with D1 storage and an optional R2 photo bucket. The same private data is available through a standards-compliant, OAuth-protected MCP Streamable HTTP endpoint so Claude and other compatible clients can discover and use Hearth's tools.
-
-## Features
-
-- Dashboard overview, moods, shared notes, moments, important dates and shopping list
-- Food and water diary with private R2 photos and daily reviews
-- Weather, barometric pressure history and pressure-shift alerts
-- Configurable partner names
-- Password-protected web dashboard with signed, expiring sessions
-- Streamable HTTP MCP with JSON-RPC `initialize`, `ping`, `tools/list` and `tools/call`
-- OAuth 2.1 authorization with PKCE, protected-resource discovery, CIMD and Dynamic Client Registration
-- Separate `hearth:read` and `hearth:write` permissions
-- Deployment and connector-configuration CLI
-
-The MCP server exposes `hearth_status`, `hearth_mood`, `hearth_note`, `hearth_moment`, `hearth_date`, `hearth_shopping_list`, `hearth_shopping_add`, `hearth_pressure`, `hearth_food_diary_today`, `hearth_food_diary_history`, `hearth_food_review`, and `hearth_water_status`.
-
-## Deploy
-
-### Bundled CLI
-
-```bash
-npx hearth-dash deploy
-npx hearth-dash mcp
-```
-
-The deploy command creates the D1 database, R2 bucket and OAuth KV namespace; installs the pinned runtime dependency; prompts for configuration; generates a session-signing secret; applies the schema; and deploys the Worker. It does not save the dashboard password locally.
-
-### Manual deployment
-
-```bash
-npm install
-
-# Create storage and put the returned IDs in wrangler.toml
-npx wrangler d1 create hearth-dash-db
-npx wrangler r2 bucket create hearth-dash-photos
-npx wrangler kv namespace create hearth-dash-oauth
-
-# Generate a SESSION_SECRET
-node -e "console.log(require('node:crypto').randomBytes(32).toString('base64url'))"
-
-# Optional weather integration
-# (set WEATHER_API_KEY after provisioning if wanted)
-
-# Provision the Worker first, then initialize storage and set secrets
-npm run deploy
-npm run db:init:remote
-npx wrangler secret put DASHBOARD_PASSWORD
-npx wrangler secret put SESSION_SECRET
-npx wrangler secret put WEATHER_API_KEY  # optional
-
-# Activate the fully configured Worker
-npm run deploy
-```
-
-Configuration lives in `wrangler.toml`: partner names under `[vars]`, the D1 binding, OAuth KV binding, R2 bucket binding and optional `WEATHER_LAT` / `WEATHER_LON`. Keep the `global_fetch_strictly_public` compatibility flag: it lets the OAuth provider resolve Claude's Client ID Metadata Document with Cloudflare's SSRF protections. OpenWeatherMap is required only for weather and pressure features.
-
-## Connect Claude
-
-After deployment, run `npx hearth-dash mcp`. The connector URL is:
-
-```text
-https://your-worker.example/mcp
-```
-
-There is no secret in that URL.
-
-### Claude.ai, Claude Desktop and Claude mobile
-
-1. Open **Customize → Connectors → Add custom connector**.
-2. Enter the printed `/mcp` URL.
-3. Choose **Sign in now** if Claude asks for an authentication mode.
-4. Choose **Use Claude's published identity** (recommended) or **Register automatically**. Hearth supports both CIMD and DCR. Do not enter a client secret.
-5. Claude opens Hearth's consent page. Enter the dashboard password, review the read/write permissions and approve.
-6. Claude returns through `https://claude.ai/api/mcp/auth_callback` and stores revocable OAuth tokens. The dashboard password is never sent as an MCP credential.
-
-Claude connects from Anthropic's cloud, so the Worker must be publicly reachable.
-
-### Claude Code
-
-```bash
-claude mcp add --transport http hearth-dash https://your-worker.example/mcp
-```
-
-Then open `/mcp` inside Claude Code and complete authentication. Claude Code uses a loopback callback rather than Claude.ai's hosted callback; DCR handles its varying local port.
-
+<div align="center">
+
+# Hearth
+
+**A cozy personal dashboard on Cloudflare Workers**
+
+[![Cloudflare Workers](https://img.shields.io/badge/Cloudflare%20Workers-F38020?style=for-the-badge&logo=cloudflare&logoColor=white)](#)
+[![D1](https://img.shields.io/badge/D1-SQLite-22D3EE?style=for-the-badge&logo=cloudflare&logoColor=white)](#)
+[![license Non-Commercial](https://img.shields.io/badge/license-Non--Commercial-A855F7?style=for-the-badge)](LICENSE)
+
+</div>
+
+Hearth is a small personal dashboard for two people. It runs as a Cloudflare Worker with D1 storage and an optional R2 photo bucket. The same private data is available through a standards-compliant, OAuth-protected MCP Streamable HTTP endpoint so Claude and other compatible clients can discover and use Hearth's tools.
+
+## Features
+
+- Dashboard overview, moods, shared notes, moments, important dates and shopping list
+- Food and water diary with private R2 photos and daily reviews
+- Weather, barometric pressure history and pressure-shift alerts
+- Configurable partner names
+- Password-protected web dashboard with signed, expiring sessions
+- Streamable HTTP MCP with JSON-RPC `initialize`, `ping`, `tools/list` and `tools/call`
+- OAuth 2.1 authorization with PKCE, protected-resource discovery, CIMD and Dynamic Client Registration
+- Separate `hearth:read` and `hearth:write` permissions
+- Deployment and connector-configuration CLI
+
+The MCP server exposes `hearth_status`, `hearth_mood`, `hearth_note`, `hearth_moment`, `hearth_date`, `hearth_shopping_list`, `hearth_shopping_add`, `hearth_pressure`, `hearth_food_diary_today`, `hearth_food_diary_history`, `hearth_food_review`, and `hearth_water_status`.
+
+## Deploy
+
+### Bundled CLI
+
+```bash
+npx hearth-dash deploy
+npx hearth-dash mcp
+```
+
+The deploy command creates the D1 database, R2 bucket and OAuth KV namespace; installs the pinned runtime dependency; prompts for configuration; generates a session-signing secret; applies the schema; and deploys the Worker. It does not save the dashboard password locally.
+
+### Manual deployment
+
+```bash
+npm install
+
+# Create storage and put the returned IDs in wrangler.toml
+npx wrangler d1 create hearth-dash-db
+npx wrangler r2 bucket create hearth-dash-photos
+npx wrangler kv namespace create hearth-dash-oauth
+
+# Generate a SESSION_SECRET
+node -e "console.log(require('node:crypto').randomBytes(32).toString('base64url'))"
+
+# Optional weather integration
+# (set WEATHER_API_KEY after provisioning if wanted)
+
+# Provision the Worker first, then initialize storage and set secrets
+npm run deploy
+npm run db:init:remote
+npx wrangler secret put DASHBOARD_PASSWORD
+npx wrangler secret put SESSION_SECRET
+npx wrangler secret put WEATHER_API_KEY  # optional
+
+# Activate the fully configured Worker
+npm run deploy
+```
+
+Configuration lives in `wrangler.toml`: partner names under `[vars]`, the D1 binding, OAuth KV binding, R2 bucket binding and optional `WEATHER_LAT` / `WEATHER_LON`. Keep the `global_fetch_strictly_public` compatibility flag: it lets the OAuth provider resolve Claude's Client ID Metadata Document with Cloudflare's SSRF protections. OpenWeatherMap is required only for weather and pressure features.
+
+## Connect Claude
+
+After deployment, run `npx hearth-dash mcp`. The connector URL is:
+
+```text
+https://your-worker.example/mcp
+```
+
+There is no secret in that URL.
+
+### Claude.ai, Claude Desktop and Claude mobile
+
+1. Open **Customize → Connectors → Add custom connector**.
+2. Enter the printed `/mcp` URL.
+3. Choose **Sign in now** if Claude asks for an authentication mode.
+4. Choose **Use Claude's published identity** (recommended) or **Register automatically**. Hearth supports both CIMD and DCR. Do not enter a client secret.
+5. Claude opens Hearth's consent page. Enter the dashboard password, review the read/write permissions and approve.
+6. Claude returns through `https://claude.ai/api/mcp/auth_callback` and stores revocable OAuth tokens. The dashboard password is never sent as an MCP credential.
+
+Claude connects from Anthropic's cloud, so the Worker must be publicly reachable.
+
+### Claude Code
+
+```bash
+claude mcp add --transport http hearth-dash https://your-worker.example/mcp
+```
+
+Then open `/mcp` inside Claude Code and complete authentication. Claude Code uses a loopback callback rather than Claude.ai's hosted callback; DCR handles its varying local port.
+
 ## Upgrading from 1.0.1
-
-Version 1.0.1 labelled a custom `{ "tool": ..., "params": ... }` HTTP handler as MCP. It did not implement MCP JSON-RPC or tool discovery and could not work as a Claude.ai custom connector. Version 1.1.0 replaces it with Streamable HTTP MCP and OAuth 2.1. The old payload and secret-bearing URL formats are intentionally rejected.
-
-Existing deployments must:
-
-1. Install dependencies with `npm install`.
-2. Create an OAuth KV namespace and add its ID as the `OAUTH_KV` binding in `wrangler.toml`.
-3. Keep `compatibility_flags = ["global_fetch_strictly_public"]`.
-4. Set a new `SESSION_SECRET` Worker secret.
-5. Re-run `schema.sql` remotely to add the rate-limit table.
-6. Deploy `oauth-entry.js` as the Worker entrypoint.
-7. Remove and re-add the custom connector using `https://your-worker.example/mcp`.
-8. Delete the obsolete secret with `npx wrangler secret delete MCP_SECRET` after the new deployment works.
-
+
+Version 1.0.1 labelled a custom `{ "tool": ..., "params": ... }` HTTP handler as MCP. It did not implement MCP JSON-RPC or tool discovery and could not work as a Claude.ai custom connector. Version 1.1.0 replaces it with Streamable HTTP MCP and OAuth 2.1. The old payload and secret-bearing URL formats are intentionally rejected.
+
+Existing deployments must:
+
+1. Install dependencies with `npm install`.
+2. Create an OAuth KV namespace and add its ID as the `OAUTH_KV` binding in `wrangler.toml`.
+3. Keep `compatibility_flags = ["global_fetch_strictly_public"]`.
+4. Set a new `SESSION_SECRET` Worker secret.
+5. Re-run `schema.sql` remotely to add the rate-limit table.
+6. Deploy `oauth-entry.js` as the Worker entrypoint.
+7. Remove and re-add the custom connector using `https://your-worker.example/mcp`.
+8. Delete the obsolete secret with `npx wrangler secret delete MCP_SECRET` after the new deployment works.
+
 The first-visit password setup page has also been removed. A public, unclaimed setup page allowed the first visitor—not necessarily the owner—to take control of a new deployment. Configure `DASHBOARD_PASSWORD` as a Worker secret instead.
 
-## Security notes
-
-- There are no functional default credentials, bearer tokens or secret-bearing connector URLs.
-- OAuth uses authorization-code flow, S256 PKCE, RFC 9728 protected-resource metadata, RFC 8414 authorization-server metadata, resource-bound access tokens and refresh-token rotation from Cloudflare's maintained `workers-oauth-provider` library.
-- Access tokens expire after one hour. Rotating refresh tokens have a 30-day TTL. Dynamically registered clients expire after 90 days.
-- Consent requires either a valid signed dashboard session or the dashboard password. Consent POSTs use a short-lived CSRF cookie, same-origin checks and rate limiting.
-- `hearth:read` and `hearth:write` are enforced at tool-call time. Read-only tokens cannot invoke write actions hidden inside mixed read/write tools.
-- Session cookies are signed, expire after seven days and use the `__Host-` prefix plus `Secure`, `HttpOnly` and `SameSite=Strict`.
-- Browser origins, JSON body size and tool arguments are validated. MCP, login, consent and dynamic-registration paths are rate-limited.
-- Private R2 photos are served only through authenticated dashboard routes and use `private, no-store`. MCP results do not expose photo URLs.
-- Compatible clients can revoke their grant through Hearth's OAuth revocation endpoint. Removing a connector always removes its locally stored token, but not every client promises server-side revocation. For emergency revocation of every OAuth grant, replace the `OAUTH_KV` binding with a fresh namespace (or delete all keys in the existing namespace) and redeploy.
-- Hearth's bundled authorization screen represents one dashboard owner, not a multi-tenant identity system. Separate households should use separate deployments.
-
-## Development
-
-```bash
-npm test
-npx wrangler deploy --dry-run
-npm run dev
-```
-
-The unit suite tests MCP protocol behavior, tool validation, scope enforcement and dashboard sessions. OAuth discovery and the full PKCE flow should also be exercised through a local HTTPS Wrangler server or a disposable deployment before release.
-
-Requires Node.js 22 or newer. Hearth pins the tested Wrangler release used by its deployment CLI.
-
-## License
-
+### 1.1.1 dashboard-login fix
+
+Version 1.1.1 keeps ordinary dashboard, login and API requests outside the OAuth provider and makes same-origin form validation resilient when a trusted Cloudflare wrapper reconstructs the internal request URL. Cross-site browser submissions remain rejected. Upgrade with `npx hearth-dash@latest deploy` if a 1.1.0 deployment returns plain `Forbidden` after submitting `/login`.
+
+## Security notes
+
+- There are no functional default credentials, bearer tokens or secret-bearing connector URLs.
+- OAuth uses authorization-code flow, S256 PKCE, RFC 9728 protected-resource metadata, RFC 8414 authorization-server metadata, resource-bound access tokens and refresh-token rotation from Cloudflare's maintained `workers-oauth-provider` library.
+- Access tokens expire after one hour. Rotating refresh tokens have a 30-day TTL. Dynamically registered clients expire after 90 days.
+- Consent requires either a valid signed dashboard session or the dashboard password. Consent POSTs use a short-lived CSRF cookie, same-origin checks and rate limiting.
+- `hearth:read` and `hearth:write` are enforced at tool-call time. Read-only tokens cannot invoke write actions hidden inside mixed read/write tools.
+- Session cookies are signed, expire after seven days and use the `__Host-` prefix plus `Secure`, `HttpOnly` and `SameSite=Strict`.
+- Browser origins, JSON body size and tool arguments are validated. MCP, login, consent and dynamic-registration paths are rate-limited.
+- Private R2 photos are served only through authenticated dashboard routes and use `private, no-store`. MCP results do not expose photo URLs.
+- Compatible clients can revoke their grant through Hearth's OAuth revocation endpoint. Removing a connector always removes its locally stored token, but not every client promises server-side revocation. For emergency revocation of every OAuth grant, replace the `OAUTH_KV` binding with a fresh namespace (or delete all keys in the existing namespace) and redeploy.
+- Hearth's bundled authorization screen represents one dashboard owner, not a multi-tenant identity system. Separate households should use separate deployments.
+
+## Development
+
+```bash
+npm test
+npx wrangler deploy --dry-run
+npm run dev
+```
+
+The unit suite tests MCP protocol behavior, tool validation, scope enforcement and dashboard sessions. OAuth discovery and the full PKCE flow should also be exercised through a local HTTPS Wrangler server or a disposable deployment before release.
+
+Requires Node.js 22 or newer. Hearth pins the tested Wrangler release used by its deployment CLI.
+
+## License
+
 Non-Commercial. Free for personal, educational and non-commercial use. See [LICENSE](LICENSE).

package/cli/commands/config.js

@@ -20,7 +20,7 @@ export default async function configCommand(args) {
   console.log(`  ${bold("Partner 1:")}      ${config.partner1 || "not set"}`);
   console.log(`  ${bold("Partner 2:")}      ${config.partner2 || "not set"}`);
   console.log(`  ${bold("Database ID:")}    ${config.dbId ? config.dbId.substring(0, 8) + "..." : "not set"}`);
-  console.log(`  ${bold("MCP Auth:")}       OAuth 2.1`);
+  console.log(`  ${bold("MCP Auth:")}       OAuth 2.1`);
   console.log(`  ${bold("Deployed:")}       ${config.deployedAt || "never"}`);
   console.log(`\n  ${dim("Config file: " + CONFIG_PATH)}\n`);
 }

package/cli/commands/deploy.js

@@ -1,11 +1,11 @@
-import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { getPackageRoot, getNodeMajor } from "../lib/platform.js";
 import { ask, confirm, password } from "../lib/prompts.js";
 import {
-  execWrangler, execCommand, parseD1CreateOutput, parseDeployOutput, parseKvCreateOutput,
-  checkWranglerAuth, wranglerLogin, setSecret, executeSchema, listD1Databases, listKvNamespaces,
+  execWrangler, execCommand, parseD1CreateOutput, parseDeployOutput, parseKvCreateOutput,
+  checkWranglerAuth, wranglerLogin, setSecret, executeSchema, listD1Databases, listKvNamespaces,
 } from "../lib/wrangler.js";
 import { banner, step, bold, dim, cyan, green, yellow, red, success, fail, warn, info, spinner } from "../lib/ui.js";
 
@@ -13,20 +13,20 @@ const TOTAL_STEPS = 6;
 const CONFIG_DIR = join(homedir(), ".hearth-dash");
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
 
-function saveConfig(data) {
-  mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+function saveConfig(data) {
+  mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
   let existing = {};
   if (existsSync(CONFIG_PATH)) {
     try { existing = JSON.parse(readFileSync(CONFIG_PATH, "utf-8")); } catch {}
-  }
-  const merged = { ...existing, ...data };
-  delete merged.mcpSecret;
-  writeFileSync(CONFIG_PATH, JSON.stringify(merged, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
-  try { chmodSync(CONFIG_PATH, 0o600); } catch {}
+  }
+  const merged = { ...existing, ...data };
+  delete merged.mcpSecret;
+  writeFileSync(CONFIG_PATH, JSON.stringify(merged, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
+  try { chmodSync(CONFIG_PATH, 0o600); } catch {}
   return merged;
 }
 
-async function createD1OrReuse(dbName, cwd) {
+async function createD1OrReuse(dbName, cwd) {
   const result = await execWrangler(["d1", "create", dbName], cwd);
   if (result.code === 0) return parseD1CreateOutput(result);
   const combined = result.stdout + result.stderr;
@@ -40,17 +40,17 @@ async function createD1OrReuse(dbName, cwd) {
   }
   fail(`Failed to create database: ${combined}`);
   return null;
-}
-
-async function createKvOrReuse(title, cwd) {
-  const existing = await listKvNamespaces(cwd);
-  const match = existing.find(namespace => namespace.title === title);
-  if (match) { info(`Found OAuth namespace: ${match.id}`); return match.id; }
-  const result = await execWrangler(["kv", "namespace", "create", title], cwd);
-  if (result.code === 0) return parseKvCreateOutput(result);
-  fail(`Failed to create OAuth KV namespace: ${result.stderr || result.stdout}`);
-  return null;
-}
+}
+
+async function createKvOrReuse(title, cwd) {
+  const existing = await listKvNamespaces(cwd);
+  const match = existing.find(namespace => namespace.title === title);
+  if (match) { info(`Found OAuth namespace: ${match.id}`); return match.id; }
+  const result = await execWrangler(["kv", "namespace", "create", title], cwd);
+  if (result.code === 0) return parseKvCreateOutput(result);
+  fail(`Failed to create OAuth KV namespace: ${result.stderr || result.stdout}`);
+  return null;
+}
 
 export default async function deployCommand(args) {
   banner();
@@ -61,7 +61,7 @@ export default async function deployCommand(args) {
   step(1, TOTAL_STEPS, "Preflight checks");
 
   const nodeMajor = getNodeMajor();
-  if (nodeMajor < 22) { fail(`Node.js ${nodeMajor} detected. Need >= 22.`); process.exit(1); }
+  if (nodeMajor < 22) { fail(`Node.js ${nodeMajor} detected. Need >= 22.`); process.exit(1); }
   success(`Node.js ${process.version}`);
 
   const wranglerCheck = await execWrangler(["--version"], ".");
@@ -83,14 +83,14 @@ export default async function deployCommand(args) {
 
   step(2, TOTAL_STEPS, "Configuration");
 
-  const partner1 = await ask("  Partner 1 name", "Partner 1");
-  const partner2 = await ask("  Partner 2 name (or AI name)", "AI");
-  if (partner1.length > 80 || partner2.length > 80) { fail("Partner names must be 80 characters or fewer."); process.exit(1); }
-  const dashPassword = await password("  Dashboard password");
-  if (!dashPassword || dashPassword.length < 12) { fail("Password must be at least 12 characters."); process.exit(1); }
-  const { randomBytes } = await import('node:crypto');
-  const sessionSecret = randomBytes(32).toString('base64url');
-  success("Secure session key generated");
+  const partner1 = await ask("  Partner 1 name", "Partner 1");
+  const partner2 = await ask("  Partner 2 name (or AI name)", "AI");
+  if (partner1.length > 80 || partner2.length > 80) { fail("Partner names must be 80 characters or fewer."); process.exit(1); }
+  const dashPassword = await password("  Dashboard password");
+  if (!dashPassword || dashPassword.length < 12) { fail("Password must be at least 12 characters."); process.exit(1); }
+  const { randomBytes } = await import('node:crypto');
+  const sessionSecret = randomBytes(32).toString('base64url');
+  success("Secure session key generated");
 
   console.log();
   info("Weather requires a free OpenWeatherMap API key.");
@@ -99,13 +99,13 @@ export default async function deployCommand(args) {
   let weatherLat = "", weatherLon = "";
   if (weatherKey) {
     info("Find your coordinates at: https://www.latlong.net");
-    weatherLat = await ask("  Latitude (e.g. 51.5074)", "51.5074");
-    weatherLon = await ask("  Longitude (e.g. -0.1278)", "-0.1278");
-    const lat = Number(weatherLat), lon = Number(weatherLon);
-    if (!Number.isFinite(lat) || lat < -90 || lat > 90 || !Number.isFinite(lon) || lon < -180 || lon > 180) {
-      fail("Latitude must be -90 to 90 and longitude must be -180 to 180.");
-      process.exit(1);
-    }
+    weatherLat = await ask("  Latitude (e.g. 51.5074)", "51.5074");
+    weatherLon = await ask("  Longitude (e.g. -0.1278)", "-0.1278");
+    const lat = Number(weatherLat), lon = Number(weatherLon);
+    if (!Number.isFinite(lat) || lat < -90 || lat > 90 || !Number.isFinite(lon) || lon < -180 || lon > 180) {
+      fail("Latitude must be -90 to 90 and longitude must be -180 to 180.");
+      process.exit(1);
+    }
   }
 
   // ── Step 3: Create D1 database ───────────────────────────
@@ -118,23 +118,23 @@ export default async function deployCommand(args) {
 
   // Copy worker files to deploy dir
   const s1 = spinner("Copying source files");
-  for (const file of ["worker.js", "oauth-entry.js", "schema.sql", "wrangler.toml", "package.json"]) {
+  for (const file of ["worker.js", "oauth-entry.js", "schema.sql", "wrangler.toml", "package.json"]) {
     const src = join(pkgRoot, file);
     if (!existsSync(src)) { s1.fail(`Missing: ${file}`); process.exit(1); }
     writeFileSync(join(deployDir, file), readFileSync(src, "utf-8"), "utf-8");
   }
-  s1.stop("Source files copied");
-
-  const install = await execCommand('npm', ['install', '--omit=dev', '--ignore-scripts'], deployDir);
-  if (install.code !== 0) { fail(`Dependency install failed: ${install.stderr || install.stdout}`); process.exit(1); }
+  s1.stop("Source files copied");
+
+  const install = await execCommand('npm', ['install', '--omit=dev', '--ignore-scripts'], deployDir);
+  if (install.code !== 0) { fail(`Dependency install failed: ${install.stderr || install.stdout}`); process.exit(1); }
 
   const s2 = spinner("Creating D1 database");
-  const dbId = await createD1OrReuse("hearth-dash-db", deployDir);
+  const dbId = await createD1OrReuse("hearth-dash-db", deployDir);
   if (!dbId) { s2.fail("D1 creation failed"); process.exit(1); }
-  s2.stop(`D1 database ready: ${dbId.substring(0, 8)}...`);
-
-  const oauthKvId = await createKvOrReuse('hearth-dash-oauth', deployDir);
-  if (!oauthKvId) { fail('OAuth storage creation failed'); process.exit(1); }
+  s2.stop(`D1 database ready: ${dbId.substring(0, 8)}...`);
+
+  const oauthKvId = await createKvOrReuse('hearth-dash-oauth', deployDir);
+  if (!oauthKvId) { fail('OAuth storage creation failed'); process.exit(1); }
 
   // ── Step 4: Create R2 bucket ─────────────────────────────
 
@@ -156,10 +156,10 @@ export default async function deployCommand(args) {
 
   // Patch wrangler.toml with real values
   let toml = readFileSync(join(deployDir, "wrangler.toml"), "utf-8");
-  toml = toml.replace("YOUR_D1_DATABASE_ID", dbId);
-  toml = toml.replace("YOUR_OAUTH_KV_ID", oauthKvId);
-  toml = toml.replace('PARTNER_1 = "Partner 1"', `PARTNER_1 = ${JSON.stringify(partner1)}`);
-  toml = toml.replace('PARTNER_2 = "Partner 2"', `PARTNER_2 = ${JSON.stringify(partner2)}`);
+  toml = toml.replace("YOUR_D1_DATABASE_ID", dbId);
+  toml = toml.replace("YOUR_OAUTH_KV_ID", oauthKvId);
+  toml = toml.replace('PARTNER_1 = "Partner 1"', `PARTNER_1 = ${JSON.stringify(partner1)}`);
+  toml = toml.replace('PARTNER_2 = "Partner 2"', `PARTNER_2 = ${JSON.stringify(partner2)}`);
   if (weatherLat) {
     toml = toml.replace('# WEATHER_LAT = "52.5726"', `WEATHER_LAT = "${weatherLat}"`);
     toml = toml.replace('# WEATHER_LON = "-0.2405"', `WEATHER_LON = "${weatherLon}"`);
@@ -168,73 +168,73 @@ export default async function deployCommand(args) {
 
   // ── Step 5: Deploy worker + set secrets ──────────────────
 
-  step(5, TOTAL_STEPS, "Deploying worker");
-
-  // A Worker must exist before Wrangler can set secrets non-interactively.
-  // This first deployment is inert: application and consent routes return 503
-  // until the required secrets are present.
-  const provision = spinner("Provisioning Cloudflare Worker");
-  const provisionResult = await execWrangler(["deploy"], deployDir);
-  if (provisionResult.code !== 0) {
-    provision.fail("Worker provisioning failed");
-    console.error(provisionResult.stderr || provisionResult.stdout);
-    process.exit(1);
-  }
-  const workerUrl = parseDeployOutput(provisionResult);
-  if (!workerUrl) {
-    provision.fail("Provisioned Worker, but could not determine its workers.dev URL.");
-    console.error(provisionResult.stdout || provisionResult.stderr);
-    process.exit(1);
-  }
-  provision.stop(`Worker provisioned: ${workerUrl}`);
-
-  const s6 = spinner("Initializing database schema");
-  const schemaResult = await executeSchema("hearth-dash-db", join(deployDir, "schema.sql"), deployDir);
-  if (!schemaResult.ok) {
-    s6.fail("Schema init failed: " + (schemaResult.error || "unknown error"));
-    console.error("Deployment is incomplete; no success configuration was saved.");
-    process.exit(1);
-  }
-  s6.stop("Database schema initialized");
-
-  const s4 = spinner("Setting secrets");
-  const secrets = [
-    ["DASHBOARD_PASSWORD", dashPassword],
-    ["SESSION_SECRET", sessionSecret],
-  ];
-  if (weatherKey) secrets.push(["WEATHER_API_KEY", weatherKey]);
-  for (const [name, value] of secrets) {
-    const result = await setSecret(name, value, deployDir);
-    if (result.code !== 0) {
-      s4.fail(`Could not set ${name}`);
-      console.error(result.stderr || result.stdout);
-      process.exit(1);
-    }
-  }
-  s4.stop("Secrets configured");
-
-  const s5 = spinner("Activating configured Worker");
-  const deployResult = await execWrangler(["deploy"], deployDir);
+  step(5, TOTAL_STEPS, "Deploying worker");
+
+  // A Worker must exist before Wrangler can set secrets non-interactively.
+  // This first deployment is inert: application and consent routes return 503
+  // until the required secrets are present.
+  const provision = spinner("Provisioning Cloudflare Worker");
+  const provisionResult = await execWrangler(["deploy"], deployDir);
+  if (provisionResult.code !== 0) {
+    provision.fail("Worker provisioning failed");
+    console.error(provisionResult.stderr || provisionResult.stdout);
+    process.exit(1);
+  }
+  const workerUrl = parseDeployOutput(provisionResult);
+  if (!workerUrl) {
+    provision.fail("Provisioned Worker, but could not determine its workers.dev URL.");
+    console.error(provisionResult.stdout || provisionResult.stderr);
+    process.exit(1);
+  }
+  provision.stop(`Worker provisioned: ${workerUrl}`);
+
+  const s6 = spinner("Initializing database schema");
+  const schemaResult = await executeSchema("hearth-dash-db", join(deployDir, "schema.sql"), deployDir);
+  if (!schemaResult.ok) {
+    s6.fail("Schema init failed: " + (schemaResult.error || "unknown error"));
+    console.error("Deployment is incomplete; no success configuration was saved.");
+    process.exit(1);
+  }
+  s6.stop("Database schema initialized");
+
+  const s4 = spinner("Setting secrets");
+  const secrets = [
+    ["DASHBOARD_PASSWORD", dashPassword],
+    ["SESSION_SECRET", sessionSecret],
+  ];
+  if (weatherKey) secrets.push(["WEATHER_API_KEY", weatherKey]);
+  for (const [name, value] of secrets) {
+    const result = await setSecret(name, value, deployDir);
+    if (result.code !== 0) {
+      s4.fail(`Could not set ${name}`);
+      console.error(result.stderr || result.stdout);
+      process.exit(1);
+    }
+  }
+  s4.stop("Secrets configured");
+
+  const s5 = spinner("Activating configured Worker");
+  const deployResult = await execWrangler(["deploy"], deployDir);
   if (deployResult.code !== 0) {
     s5.fail("Deploy failed");
     console.error(deployResult.stderr || deployResult.stdout);
     process.exit(1);
   }
-  s5.stop(`Deployed: ${workerUrl}`);
+  s5.stop(`Deployed: ${workerUrl}`);
 
   // ── Step 6: Save config + print results ──────────────────
 
   step(6, TOTAL_STEPS, "Finishing up");
 
-  const config = saveConfig({
-    workerUrl,
-    partner1,
+  const config = saveConfig({
+    workerUrl,
+    partner1,
     partner2,
     dbId,
     deployedAt: new Date().toISOString(),
   });
 
-  const mcpUrl = workerUrl + "/mcp";
+  const mcpUrl = workerUrl + "/mcp";
 
   console.log(`
 ${green(bold("  Done!"))} Your dashboard is live.
@@ -242,8 +242,8 @@ ${green(bold("  Done!"))} Your dashboard is live.
   ${bold("Dashboard:")}  ${cyan(workerUrl)}
   ${bold("Password:")}   ${dim("(the one you just set)")}
 
-  ${bold("OAuth MCP Endpoint:")}
-  ${dim(mcpUrl)}
+  ${bold("OAuth MCP Endpoint:")}
+  ${dim(mcpUrl)}
 
   ${bold("MCP Config")} (add to Claude Code ${dim("~/.claude.json")} or Claude Desktop):
 ${dim("  {")}
@@ -254,7 +254,7 @@ ${dim("      }")}
 ${dim("    }")}
 ${dim("  }")}
 
-  ${bold("Connector URL")} (Claude will open a dashboard-password consent screen):
+  ${bold("Connector URL")} (Claude will open a dashboard-password consent screen):
   ${cyan(mcpUrl)}
 
   ${dim("Config saved to: " + CONFIG_PATH)}