@fourier-labs/harbour 0.1.28 → 0.1.29

package/dist/packages/harbour-cli/src/check.js

@@ -182,7 +182,7 @@ async function ensureSession(root, runtime, bundle, output) {
     await runtime.writeFiles(bundle, ports);
     output("harbour dev is not running; starting the local Harbour services for the gate (stopped again afterwards).");
     await runtime.pull(bundle);
-    await runtime.up();
+    await runtime.up(output);
     await runtime.sessionEnv();
     return true;
 }

package/dist/packages/harbour-cli/src/cli.js

@@ -12,6 +12,7 @@ import { initKit } from "./starter.js";
 import { agentPaths, agentSetup, cliVersionLines } from "./agent-setup.js";
 import { startDev } from "./dev.js";
 import { ensureSdk, LocalRuntime, readDevLock, releaseDevLock, runCommand } from "./local-runtime.js";
+import { stopAllHarbourProjects } from "./docker-networks.js";
 import { runChecks } from "./check.js";
 import { GovernanceClient, integrationsStatus, requestIntegrations } from "./integrations.js";
 const args = process.argv.slice(2);
@@ -30,6 +31,8 @@ const valueStdin = args.includes("--value-stdin");
 const subcommand = args[1] && !args[1].startsWith("--") ? args[1] : undefined;
 const wait = args.includes("--wait");
 const reset = args.includes("--reset");
+const stopAll = args.includes("--all");
+const force = args.includes("--force");
 const upgrade = args.includes("--upgrade");
 const testIntegrations = args.includes("--integrations");
 const reason = optionValue("--reason");
@@ -67,7 +70,8 @@ const usage = [
     "  harbour agent-setup [--json]                               install the plain-English Isomorph guide for Claude Code (~/.claude/skills/isomorph) and Codex (~/.codex/AGENTS.md)",
     "  harbour init --app-root <path> [--upgrade]                 create the starter or add the kit files; --upgrade re-pins the kit bundle (also runs agent-setup)",
     "  harbour dev --app-root <path> [--reset]                    run the app locally on one loopback origin (--reset deletes this app's local data)",
-    "  harbour stop --app-root <path>                             stop this app's local services, keeping data",
+    "  harbour stop --app-root <path>                             stop this app's local services (containers and network removed), keeping data",
+    "  harbour stop --all [--force]                               bring down every stopped Harbour app's local services on this machine (frees Docker's network pool); --force includes running ones",
     "  harbour check --app-root <path> [--integrations] [--json]  types, build, then the pipeline's kit gate in the local session: declaration, migrations + database gate, write probe with cross-user denial, journeys, operation coverage (+ authorised real reads)",
     "  harbour integrations request <connection> --reason <text> --app-root <path> [--environment <env>] [--operations a,b] [--expires-at <UTC>] [--json]",
     "  harbour integrations status --app-root <path> [--json]",
@@ -105,7 +109,7 @@ else if (command === "agent-setup") {
 else if (!["connect", "login", "logout", "productionise", "integrations", ...LOCAL_COMMANDS, ...OPERATION_COMMANDS].includes(command)
     || (command === "connect" && (!connectUrl || connectUrl.startsWith("--")))
     || (command === "productionise" && (optionError || !root))
-    || (LOCAL_COMMANDS.includes(command) && !root)
+    || (LOCAL_COMMANDS.includes(command) && !root && !(command === "stop" && stopAll))
     || (command === "integrations" && (!root || !subcommand || !["request", "status"].includes(subcommand) || (subcommand === "request" && (!args[2] || args[2].startsWith("--") || !reason))))
     || (OPERATION_COMMANDS.includes(command) && !operationRef)
     || (command === "secrets" && (!subcommand || !["list", "set", "dismiss"].includes(subcommand) || (subcommand !== "list" && !secretName)))) {
@@ -121,6 +125,15 @@ else {
             process.stdout.write(`Harbour is connected for ${saved.tenantId}.\n`);
             process.exitCode = 0;
         }
+        else if (command === "stop" && stopAll) {
+            // Every Harbour project on this machine, no app root needed: the complete remedy for a full Docker address pool.
+            const result = await stopAllHarbourProjects(runCommand, { force });
+            for (const project of result.stopped)
+                progress(`Brought down ${project.root ?? project.project} (data kept).`);
+            for (const project of result.running)
+                progress(`Left ${project.root ?? project.project} running; \`harbour stop --app-root ${project.root ?? "<path>"}\` or \`--force\` stops it.`);
+            emit(summaryEnvelope({ stopped: result.stopped.map(project => project.root ?? project.project), running: result.running.map(project => project.root ?? project.project), volumesRetained: true }));
+        }
         else if (LOCAL_COMMANDS.includes(command)) {
             // Local commands run before the company config/login requirement: the base app needs neither.
             const bundle = EMBEDDED_KIT_BUNDLE;

package/dist/packages/harbour-cli/src/dev.js

@@ -7,7 +7,7 @@ import { CliError } from "./output.js";
 /**
  * Starts the project's Compose services, applies migrations, starts Vite and the
  * loopback origin. Resolves when the runtime is up; the returned `stop` runs
- * `docker compose stop` (volumes retained) and is what Ctrl-C calls.
+ * `docker compose down` without `-v` (volumes retained, network freed) and is what Ctrl-C calls.
  */
 export async function startDev(root, options) {
     const run = options.run ?? runCommand;
@@ -33,7 +33,7 @@ export async function startDev(root, options) {
         options.output("Pulling the kit images by digest (public registry, no login).");
         await runtime.pull(options.bundle);
         options.output("Starting local Harbour services (postgres, storage, one Harbour gateway with the session identities, fixtures and realtime relay).");
-        await runtime.up();
+        await runtime.up(options.output);
         // The gateway writes the session env and the app's realtime outbox
         // migration together once it is serving, so waiting for the session also
         // waits for the SQL and for the gateway.

package/dist/packages/harbour-cli/src/docker-networks.js

@@ -0,0 +1,126 @@
+import { dirname } from "node:path";
+/**
+ * Docker's bridge address pool. Every `harbour dev` / `harbour check` project
+ * is a Compose project with its own bridge network, and the engine's default
+ * pool holds only ~31 of them (Docker Desktop and colima: 172.17-172.31/16 plus
+ * 192.168.0.0/16 cut into /20s). Once it is full, `compose up` fails to create
+ * the network before a single container starts — a "Docker could not start"
+ * that has nothing to do with the app. This module names that failure, reclaims
+ * the networks Harbour itself left behind (projects of other app roots with no
+ * running container) and, when that is not enough, says what only the person
+ * can do.
+ */
+/** The network label every Harbour compose project carries (compose puts it on the project's default network). */
+export const HARBOUR_NETWORK_LABEL = "com.harbour.kit";
+/** The engine's wording for an exhausted pool, across versions and the compose wrapper. */
+const POOL_EXHAUSTED = /all predefined address pools have been fully subnetted|could not find an available,? non-overlapping IPv4 address pool|no available IPv4 addresses on this network'?s address pools|could not allocate an IPv4 subnet/i;
+export function isAddressPoolExhausted(stderr) { return POOL_EXHAUSTED.test(stderr); }
+/** The name Harbour gives its compose projects: `harbour-<12 hex>` (+ `-check`) — the recognition rule for projects created before the network label existed. */
+const HARBOUR_PROJECT = /^harbour-[0-9a-f]{12}(?:-check)?$/;
+/**
+ * Every compose project on this machine that Harbour created: networks that
+ * carry the Harbour label or (older CLIs) the Harbour project-name pattern.
+ * Networks without a compose project label are never listed — a network some
+ * other tool made is not Harbour's to touch.
+ */
+export async function listHarbourProjects(run) {
+    const networks = await run("docker", ["network", "ls", "--filter", "label=com.docker.compose.project", "--format", "{{.Name}}\t{{.Labels}}"], { quiet: true });
+    if (networks.code !== 0)
+        return [];
+    const roots = await projectRoots(run);
+    const projects = [];
+    for (const line of networks.stdout.split("\n")) {
+        const [network, labels = ""] = line.trim().split("\t");
+        if (!network)
+            continue;
+        const project = labels.split(",").map(pair => pair.split("=")).find(([key]) => key === "com.docker.compose.project")?.[1];
+        if (!project)
+            continue;
+        const harbour = labels.split(",").some(pair => pair === `${HARBOUR_NETWORK_LABEL}=1`) || HARBOUR_PROJECT.test(project);
+        if (!harbour)
+            continue;
+        const containers = await run("docker", ["ps", "-a", "--filter", `label=com.docker.compose.project=${project}`, "--format", "{{.State}}"], { quiet: true });
+        const states = containers.code === 0 ? containers.stdout.split("\n").map(state => state.trim()).filter(Boolean) : [];
+        const running = states.filter(state => state === "running" || state === "restarting" || state === "paused").length;
+        projects.push({ project, network, root: roots.get(project), running, total: states.length });
+    }
+    return projects;
+}
+/** Project name -> app root, from the compose files compose still remembers (`<root>/.harbour/local/<compose>.yml`). */
+async function projectRoots(run) {
+    const roots = new Map();
+    const result = await run("docker", ["compose", "ls", "-a", "--format", "json"], { quiet: true });
+    if (result.code !== 0)
+        return roots;
+    let entries = [];
+    try {
+        entries = JSON.parse(result.stdout || "[]");
+    }
+    catch {
+        return roots;
+    }
+    for (const entry of entries) {
+        const file = entry.ConfigFiles?.split(",")[0]?.trim();
+        if (entry.Name && file && /[\\/]\.harbour[\\/]local[\\/][^\\/]+\.yml$/.test(file))
+            roots.set(entry.Name, dirname(dirname(dirname(file))));
+    }
+    return roots;
+}
+/**
+ * Removes the containers and network of one Harbour project, keeping its
+ * named volumes (the app's local data) unless `volumes` is set. `compose down`
+ * needs no compose file for this — it works from the labels — and the network
+ * is removed by name afterwards in case compose found no container to anchor on.
+ */
+export async function downHarbourProject(run, project, volumes = false) {
+    const result = await run("docker", ["compose", "-p", project.project, "down", "--remove-orphans", ...(volumes ? ["-v"] : [])], { quiet: true });
+    const network = await run("docker", ["network", "rm", project.network], { quiet: true });
+    return result.code === 0 || network.code === 0;
+}
+/**
+ * Self-heal: brings down every Harbour project other than `keep` whose
+ * containers are all stopped (or gone), which frees their networks. A project
+ * with a running container is another app someone is using — it is left alone
+ * and named in the returned `running` list. Never touches non-Harbour networks.
+ */
+export async function reclaimStaleHarbourProjects(run, keep, output) {
+    const reclaimed = [];
+    const running = [];
+    for (const project of await listHarbourProjects(run)) {
+        if (project.project === keep)
+            continue;
+        if (project.running > 0) {
+            running.push(project);
+            continue;
+        }
+        if (await downHarbourProject(run, project))
+            reclaimed.push(project);
+    }
+    if (reclaimed.length)
+        output?.(`Docker's network address pool was full; removed the stopped local services of ${reclaimed.length} other Harbour app${reclaimed.length === 1 ? "" : "s"} (their data volumes are kept) and retrying.`);
+    return { reclaimed, running };
+}
+/** The one sentence for a pool that is still full after the self-heal: the two remedies only the person can apply. */
+export function poolExhaustedMessage(running) {
+    const stops = running.map(project => `\`harbour stop --app-root ${project.root ?? `<app of compose project ${project.project}>`}\``);
+    const others = stops.length ? `stop the ${stops.length === 1 ? "other Harbour app that is" : `${stops.length} other Harbour apps that are`} still running (${stops.join(", ")}) or ` : "";
+    return `Docker has no network address left for this app's local services (every subnet in its default address pool is taken, none by a stopped Harbour app): ${others}free the pool with \`docker network prune\` (removes networks no container uses) or a wider \`default-address-pools\` in Docker's daemon settings, then rerun.`;
+}
+/**
+ * `harbour stop --all`: brings down every Harbour project on this machine whose
+ * containers are all stopped (data volumes kept); with `force`, the running
+ * ones too. The complete remedy for a full pool when no single app is at fault.
+ */
+export async function stopAllHarbourProjects(run, options = {}) {
+    const stopped = [];
+    const running = [];
+    for (const project of await listHarbourProjects(run)) {
+        if (project.running > 0 && !options.force) {
+            running.push(project);
+            continue;
+        }
+        if (await downHarbourProject(run, project))
+            stopped.push(project);
+    }
+    return { stopped, running };
+}

package/dist/packages/harbour-cli/src/kit-bundle.manifest.js

@@ -1,6 +1,6 @@
 export const PUBLISHED_KIT_BUNDLE = {
     "schema": "harbour.kit-bundle/1.0",
-    "kitVersion": "0.1.28",
+    "kitVersion": "0.1.29",
     "sdk": {
         "package": "@harbour/app-sdk",
         "version": "1.1.0",
@@ -8,11 +8,11 @@ export const PUBLISHED_KIT_BUNDLE = {
         "url": "https://public.ecr.aws/v2/y6t4p3i8/harbour-kit-bundle/blobs/sha256:998102545ba9b0eec3687d8ded2609a16dbb1d3254b006401155106bf8b80355"
     },
     "images": {
-        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:1effa54091b76c5668193618f1a781be7157fdd5ad49da831ded354b9e4162ac",
-        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:47b305a2a3234c66702aebccfe53d3929d91556dde29b3c27128e2d18e3f1977"
+        "appGateway": "public.ecr.aws/y6t4p3i8/harbour-app-gateway@sha256:0fae5eda4278d1a13e3575efc24aa279e601f932bc8d3b3ac41e65fda147d4df",
+        "sessionFixture": "public.ecr.aws/y6t4p3i8/harbour-session-fixture@sha256:5d09b312cedea249e642d64931fa7cd41ad517b05dc0412a4845f7abe6da3a11"
     },
     "brief": {
-        "fingerprint": "2efee82148238282a9aae255d071395dfdba69b68b398208cc0b8ea1d5b9a3b0"
+        "fingerprint": "14e3cd99236da47263e430084e470d75f648223320f16a0d9917054d7dbc296d"
     },
     "declarationSchema": "harbour.app-integrations/2.0"
 };

package/dist/packages/harbour-cli/src/local-runtime.js

@@ -6,6 +6,7 @@ import { join, relative } from "node:path";
 import { LOCAL_SERVICE_IMAGES } from "./kit-bundle.js";
 import { kitPaths, projectName } from "./kit.js";
 import { CliError } from "./output.js";
+import { HARBOUR_NETWORK_LABEL, isAddressPoolExhausted, poolExhaustedMessage, reclaimStaleHarbourProjects } from "./docker-networks.js";
 export const runCommand = (command, args, options = {}) => new Promise(resolve => {
     const child = spawn(command, args, { cwd: options.cwd, env: { ...process.env, ...options.env }, stdio: [options.stdin === undefined ? "ignore" : "pipe", "pipe", "pipe"] });
     let stdout = "";
@@ -83,6 +84,7 @@ export function composeFile(project, bundle, ports, stateDir) {
         "volumes:",
         `  postgres-data: { name: ${project}-postgres }`,
         `  minio-data: { name: ${project}-minio }`,
+        ...networkLabelLines(),
         `# Browser origin: ${originUrl}`,
         ""
     ].join("\n");
@@ -123,6 +125,8 @@ export function gatewayConfig(project, ports, stateDir) {
 async function migrationNames(root) {
     return (await readdir(join(root, "migrations")).catch(() => [])).filter(name => name.endsWith(".sql")).sort();
 }
+/** Marks the project's default network as Harbour's, so a full address pool can be healed by removing only what Harbour left behind (docker-networks.ts). */
+export function networkLabelLines() { return ["networks:", `  default: { labels: { ${HARBOUR_NETWORK_LABEL}: "1" } }`]; }
 export function internalDatabaseUrl(user = LOCAL.dbUser) { return `postgresql://${user}:${LOCAL.dbPassword}@postgres:5432/${LOCAL.database}?sslmode=disable`; }
 function uploadKey(project) { return createHash("sha256").update(`upload-key:${project}`).digest("base64"); }
 // ---- Ports and lock ------------------------------------------------------------------
@@ -209,16 +213,32 @@ export class LocalRuntime {
         if (result.code !== 0)
             throw new CliError("KIT_IMAGES_UNAVAILABLE", `Docker could not pull the kit images (${bundle.images.appGateway}): ${result.stderr.trim().split("\n").at(-1) ?? "docker error"}. They are public and pinned by digest; \`docker compose\` (Compose v2) must be installed and Docker running with access to the registry.`);
     }
-    async up() {
-        const result = await this.compose(["up", "-d", "--wait"]);
+    /**
+     * `compose up`. When Docker's bridge address pool is full (each Harbour
+     * project holds one network), the stopped projects of other app roots are
+     * brought down — networks freed, data volumes kept — and `up` is retried
+     * once; a pool still full after that is reported with the remedies only the
+     * person can apply, never as a generic "could not start".
+     */
+    async up(output) {
+        let result = await this.compose(["up", "-d", "--wait"]);
+        if (result.code !== 0 && isAddressPoolExhausted(result.stderr)) {
+            const { reclaimed, running } = await reclaimStaleHarbourProjects(this.run, this.project, output);
+            if (reclaimed.length)
+                result = await this.compose(["up", "-d", "--wait"]);
+            if (result.code !== 0 && isAddressPoolExhausted(result.stderr))
+                throw new CliError("DOCKER_NETWORK_POOL_EXHAUSTED", poolExhaustedMessage(running));
+        }
         if (result.code !== 0)
             throw new CliError("LOCAL_RUNTIME_FAILED", "Docker could not start the local Harbour services. Is Docker running and are the kit images available (see .harbour/kit.lock.json)?");
     }
-    /** Stops containers and keeps volumes; safe to repeat. */
-    async stop() {
-        const result = await this.compose(["stop"], { quiet: true });
-        return { stopped: result.code === 0 };
-    }
+    /**
+     * `harbour stop` and Ctrl-C: the project's containers and network go, its
+     * volumes (the app's local data) stay; safe to repeat. `compose stop` alone
+     * kept the network, and ~31 stopped apps then exhausted Docker's address
+     * pool for every later `harbour dev` and `harbour check`.
+     */
+    async stop() { return { stopped: await this.down() }; }
     /**
      * Removes this project's containers and network, keeping its named volumes
      * (the app's local data). What the kit gate uses for a session it started
@@ -226,7 +246,7 @@ export class LocalRuntime {
      * and Docker's address pools run out after a dozen or so ("all predefined
      * address pools have been fully subnetted").
      */
-    async down() { await this.compose(["down", "--remove-orphans"], { quiet: true }); }
+    async down() { return (await this.compose(["down", "--remove-orphans"], { quiet: true })).code === 0; }
     /** Removes this project's containers and named volumes only. */
     async reset(output) {
         output(`Deleting local data for this app only: compose project ${this.project}, volumes ${this.project}-postgres and ${this.project}-minio.`);

package/dist/packages/harbour-cli/src/starter.js

@@ -95,6 +95,7 @@ export function managedBlock() {
         "- `.harbour/integrations.json` starts with `\"connections\": {}` and stays that way until the app really calls a company system. Adding one is two steps: declare the connection with only the operations the app calls, then `harbour integrations request <connection> --reason \"<why>\" --app-root .` (and the same command with `--environment preview` before shipping). Every declared connection blocks the deploy until IT grants it, so a connection the app does not call is a deploy that never happens; a connection that is not declared cannot be requested at all (`CONNECTION_NOT_DECLARED`), so it never gets a grant. The file is strict JSON and cannot hold comments; the worked Slack and warehouse examples are in README.md and in the comment in `src/App.tsx`.",
         "- A Slack message is sent only after the person presses an explicit Send control; pass a fresh UUID `idempotencyKey` per send action and reuse the same key when retrying that action. Never send from an effect, a timer or a background queue, and never send during checks.",
         "- Consent is a user action: call `harbour.integrations.connect(connection)` and, when it returns `consent_required`, open `authorizationUrl`. Missing consent never falls back to another account.",
+        "- A retained check that calls `harbour.integrations.execute` is answered, under `harbour check` and in the deployment pipeline alike, by the gate's fixture: the contract's result shape for a connection, operation and resource the app declared (one canned Slack message, one canned Gmail thread, a warehouse view with no rows), a refusal with the platform's own code for anything undeclared, and nothing is ever sent or read. The passed check says so in the report; real access is exercised only by `harbour check --integrations` (reads) and the preview's own smoke test.",
         "- AI goes through `harbour.ai` only — `ai().chat({ messages, maxTokens })` from `src/harbour.client.ts` — behind an explicit control the person presses (never on load, in an effect or a timer). Never add an OpenAI/Anthropic/Gemini key, SDK or URL: the platform's governed AI gateway holds the key and IT sees every call. The starter calls no AI; add the one call when the person asks for it (README.md has the \"Summarise my notes\" example) and `harbour check` writes `.harbour/checks/ai-journey.mjs` for it. A refusal with code `AI_NOT_ENABLED` means IT has not enabled an AI provider yet; the app must still work without AI.",
         "- Authentication is owned by Harbour SSO. Do not add login forms, JWT handling, or trust a role, owner id or tenant id supplied by the browser. Row ownership is decided in SQL through `current_setting('harbour.user_id', true)` and `current_setting('harbour.user_email', true)`.",
         "- Every route needs a signed-in human by default; do not add public routes or wildcard exceptions to make something work.",
@@ -117,7 +118,7 @@ Follow the "Harbour development kit" block in CLAUDE.md / AGENTS.md. Workflow:
 1. \`harbour dev --app-root .\` starts Postgres, storage and one Harbour gateway (session identities, fixtures, realtime) plus Vite behind one loopback origin printed in the banner.
 2. Edit \`src/\` and \`migrations/\`. Use the SDK only. \`.harbour/integrations.json\` starts with no connections and gains one only when the app really calls a company system: declare it with only the operations the app calls, then request access (step 5). A declared connection the app does not call blocks every deploy until IT grants it; an undeclared one cannot be requested, so it never gets a grant. README.md has the worked Slack and warehouse examples — the file itself is strict JSON and cannot hold comments.
 3. \`.harbour/checks/\` is generated, not written by hand: \`harbour check\` reads \`migrations/\` and \`src/\` and writes one retained journey per capability the app's own code uses (plus a cross-user denial per owner-scoped table), deleting the ones the app no longer needs — so run it in the same edit that changes the app instead of adding or deleting these files yourself. It reports anything it cannot generate (\`actions\`, \`realtime\`, a table with no migration) for you to write. Edit a generated check and it becomes yours: Harbour keeps it, stops managing it and never removes it, so deleting it when the feature goes is then your job. \`harbour check\` and the deployment pipeline replay these checks against a real App Gateway and refuse the app (\`flow.check-failed\`) in both directions — a capability no check exercises, and a check that exercises something the code no longer does.
-4. \`harbour check --app-root .\` before every hand-off; read \`.harbour/local/check-report.json\`. Real integrations are reported as not tested unless \`--integrations\` is passed (read operations only). A governed AI call (\`harbour.ai.chat\`) is exercised for real through the development route while \`harbour dev\` is up; the pipeline answers it with a canned completion and reports it as not tested.
+4. \`harbour check --app-root .\` before every hand-off; read \`.harbour/local/check-report.json\`. Real integrations are reported as not tested unless \`--integrations\` is passed (read operations only); a retained check that calls \`harbour.integrations.execute\` is answered by the gate's fixture (the contract's shape for what the app declared, nothing sent or read) and the passed check says so. A governed AI call (\`harbour.ai.chat\`) is exercised for real through the development route while \`harbour dev\` is up; the pipeline answers it with a canned completion and reports it as not tested.
 5. \`harbour integrations request <connection> --reason "<why>" --app-root .\` asks IT for development access; pending is not ready.
 6. \`harbour productionise --app-root .\` saves and deploys the preview; \`harbour promote\` after the person has tested it.
 `;
@@ -245,7 +246,7 @@ const report = await integrations().execute<{ rows: Array<{ week: string; total:
 });
 \`\`\`
 
-A send (\`slack.message.post\`, \`gmail.message.send\`) runs only when the person presses an explicit Send control, with a fresh UUID \`idempotencyKey\` per press — never from an effect, a timer or a check. Consent is a user action: \`integrations().connect(connection)\`, and open its \`authorizationUrl\` when it answers \`consent_required\`. Anything the app calls needs its own retained check under \`.harbour/checks/\`, and anything it stops calling loses its check in the same edit.
+A send (\`slack.message.post\`, \`gmail.message.send\`) runs only when the person presses an explicit Send control, with a fresh UUID \`idempotencyKey\` per press — never from an effect, a timer or a check. Consent is a user action: \`integrations().connect(connection)\`, and open its \`authorizationUrl\` when it answers \`consent_required\`. Anything the app calls needs its own retained check under \`.harbour/checks/\`, and anything it stops calling loses its check in the same edit. A check that calls \`integrations().execute\` is answered by the gate's fixture — the contract's result shape for the declared connection, operation and resource, nothing sent or read, and the report says so; \`harbour check --integrations\` is what exercises real access.
 `;
 const VITE_CONFIG = `import { defineConfig } from "vite";
 import react from "@vitejs/plugin-react";

package/dist/packages/harbour-cli/src/version.js

@@ -1 +1 @@
-export const CLI_VERSION = "0.1.28";
+export const CLI_VERSION = "0.1.29";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "description": "Harbour productionisation helper",
   "type": "module",
   "bin": {
@@ -34,7 +34,7 @@
   "harbour": {
     "kitBundle": {
       "repository": "public.ecr.aws/y6t4p3i8/harbour-kit-bundle",
-      "version": "0.1.28"
+      "version": "0.1.29"
     }
   }
 }