harnery 0.30.0 → 0.31.1

package/dist/commands/sync.js

@@ -3,7 +3,7 @@
  * via rclone (typically a Google Drive remote, but any rclone remote works).
  *
  * Scope: a deliberately small set of file types: durable identities,
- * archived scratchpads, council manifests. The high-churn machine-local
+ * archived journals, council manifests. The high-churn machine-local
  * stuff (events.ndjson, .pid-map/, active/, .last-intent.*) stays put.
  *
  * Subcommands:
@@ -25,7 +25,7 @@ import path from "node:path";
 import { syncJsoncConfig } from "../core/config.js";
 // What we sync. Anything matching one of these (relative to .harnery/) is
 // considered part of the sync set. Everything else stays local-only.
-const SYNC_PATHS = ["identities/", "scratch/archived/", "councils/"];
+const SYNC_PATHS = ["identities/", "journal/archived/", "councils/"];
 function configPath() {
     return path.join(os.homedir(), ".config", "harnery", "sync.json");
 }
@@ -119,7 +119,7 @@ export function registerSyncCommand(program, emit) {
     const sync = program
         .command("sync")
         .description("Cross-machine sync of curated .harnery/ subset (identities, archived " +
-        "scratchpads, council manifests) via rclone. Google Drive is the " +
+        "journals, council manifests) via rclone. Google Drive is the " +
         "expected remote; any rclone backend works.");
     sync
         .command("init")

package/dist/commands/tunnel.d.ts

@@ -1,4 +1,20 @@
 import type { Command } from "commander";
 import type { EmitContext, HarneryProgramContext } from "../commander.js";
+import { type TunnelState } from "../lib/tunnel/state.js";
+/**
+ * Restart ONE instance's gate in place, deliberately leaving the provider
+ * process running.
+ *
+ * That asymmetry is the whole point. A Cloudflare quick tunnel's hostname is
+ * minted by cloudflared at startup, so a full `down`/`up` hands back a NEW
+ * random *.trycloudflare.com URL and breaks every link already shared — a
+ * miserable trade for adding one IP. cloudflared only ever forwards to
+ * `localhost:<gate_port>`, so the gate beneath it can be swapped out and the
+ * edge reconnects without noticing.
+ */
+export declare function reloadOne(state: TunnelState): Promise<{
+    ok: boolean;
+    message: string;
+}>;
 export declare function registerTunnelCommand(program: Command, emitParam: EmitContext, contextParam?: HarneryProgramContext): void;
 //# sourceMappingURL=tunnel.d.ts.map

package/dist/commands/tunnel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/commands/tunnel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AA2yB1E,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,WAAW,EACtB,YAAY,CAAC,EAAE,qBAAqB,GACnC,IAAI,CAmEN"}
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../src/commands/tunnel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAa1E,OAAO,EAYL,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AA+rBhC;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAsE7F;AAgND,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,WAAW,EACtB,YAAY,CAAC,EAAE,qBAAqB,GACnC,IAAI,CA4EN"}

package/dist/commands/tunnel.js

@@ -6,6 +6,7 @@ function cachePath(tool, filename) {
 import { spawn, spawnSync } from "node:child_process";
 import { existsSync, openSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { resolveBinName } from "../core/config.js";
 import { clearState, DEFAULT_INSTANCE, ensureCloudflared, gateLogFile, isProcessAlive, listStates, providerLogFile, readConfig, readState, writeConfig, writeState, } from "../lib/tunnel/state.js";
 /**
  * `tunnel`: provider-backed tunnel in front of a local upstream.
@@ -145,12 +146,28 @@ function sweepStrays(gatePort, alreadyKilled) {
     return (killByPattern(`gate\\.ts.*--port ${gatePort}( |$)`, alreadyKilled) +
         killByPattern(`--url http://localhost:${gatePort}( |$)`, alreadyKilled));
 }
-/** Ports currently bound by a LISTEN socket (best-effort via `ss`). */
+/**
+ * Ports currently bound by a LISTEN socket (best-effort, platform-dependent).
+ *
+ * `ss` (iproute2) is Linux-only. Without the lsof fallback this returns an empty
+ * set on macOS/BSD. That does not fail loudly. It reports every port as free, so
+ * `allocateGatePort` can hand out an occupied port and the reload port-release
+ * check becomes inert.
+ */
 function listeningPorts() {
     const ports = new Set();
-    const r = spawnSync("ss", ["-tlnH"], { encoding: "utf-8" });
-    if (r.status === 0 && typeof r.stdout === "string") {
-        for (const m of r.stdout.matchAll(/:(\d+)\s/g))
+    const ss = spawnSync("ss", ["-tlnH"], { encoding: "utf-8" });
+    if (ss.status === 0 && typeof ss.stdout === "string") {
+        for (const m of ss.stdout.matchAll(/:(\d+)\s/g))
+            ports.add(Number(m[1]));
+        return ports;
+    }
+    // Rows look like: `bun 123 user 4u IPv4 0x… 0t0 TCP 127.0.0.1:58055 (LISTEN)`.
+    // Status can be nonzero while stdout still holds usable rows (lsof reports a
+    // failure when any single process is unreadable), so judge it on the output.
+    const lsof = spawnSync("lsof", ["-nP", "-iTCP", "-sTCP:LISTEN"], { encoding: "utf-8" });
+    if (typeof lsof.stdout === "string") {
+        for (const m of lsof.stdout.matchAll(/:(\d+) \(LISTEN\)$/gm))
             ports.add(Number(m[1]));
     }
     return ports;
@@ -313,6 +330,33 @@ function providerIsAlive(state) {
 function tunnelIsAlive(state) {
     return isProcessAlive(state.gate_pid) && providerIsAlive(state);
 }
+/**
+ * Spawn the detached gate worker.
+ *
+ * Shared by `up` (fresh start) and `reload` (in-place restart) so both hand the
+ * gate an identical environment and record the same kind of PID. The allowlist
+ * is passed as an env var, which the gate snapshots at module load and never
+ * re-reads — that snapshot is precisely why `reload` has to exist.
+ */
+function spawnGate(o) {
+    const gateFd = openSync(o.gateLogPath, "a");
+    // `--name`/`--port` on argv mirror the env vars; they're what makes the gate
+    // process distinguishable per-instance in `pgrep -f` (see sweepStrays).
+    const gateProc = spawn("bun", ["run", gateScriptPath(), "--name", o.name, "--port", String(o.gatePort)], {
+        detached: true,
+        stdio: ["ignore", gateFd, gateFd],
+        env: {
+            ...process.env,
+            HARNERY_TUNNEL_ALLOW: o.allowedIps.join(","),
+            HARNERY_TUNNEL_ACCESS: o.provider === "cloudflare" ? "cloudflare-allowlist" : "trusted-local-proxy",
+            HARNERY_TUNNEL_TARGET: o.target,
+            HARNERY_TUNNEL_VHOST: o.vhost,
+            HARNERY_TUNNEL_PORT: String(o.gatePort),
+        },
+    });
+    gateProc.unref();
+    return gateProc;
+}
 async function up(opts) {
     if (!bunAvailable()) {
         emit.error({
@@ -374,22 +418,15 @@ async function up(opts) {
     const providerLogPath = cachePath("tunnel", providerLogFile(name, provider));
     writeFileSync(gateLogPath, "");
     writeFileSync(providerLogPath, "");
-    const gateFd = openSync(gateLogPath, "a");
-    // `--name`/`--port` on argv mirror the env vars; they're what makes the gate
-    // process distinguishable per-instance in `pgrep -f` (see sweepStrays).
-    const gateProc = spawn("bun", ["run", gateScriptPath(), "--name", name, "--port", String(gatePort)], {
-        detached: true,
-        stdio: ["ignore", gateFd, gateFd],
-        env: {
-            ...process.env,
-            HARNERY_TUNNEL_ALLOW: cfg.allowed_ips.join(","),
-            HARNERY_TUNNEL_ACCESS: provider === "cloudflare" ? "cloudflare-allowlist" : "trusted-local-proxy",
-            HARNERY_TUNNEL_TARGET: target,
-            HARNERY_TUNNEL_VHOST: vhost,
-            HARNERY_TUNNEL_PORT: String(gatePort),
-        },
+    const gateProc = spawnGate({
+        name,
+        gatePort,
+        target,
+        vhost,
+        provider,
+        allowedIps: cfg.allowed_ips,
+        gateLogPath,
     });
-    gateProc.unref();
     await sleep(800);
     if (!isProcessAlive(gateProc.pid)) {
         emit.error({
@@ -538,6 +575,140 @@ function down(opts) {
         ? `No tunnel processes found for [${name}]. Nothing to stop.\n`
         : `Stopped ${killed.size} process(es). Tunnel [${name}] down.\n`);
 }
+/** Poll until `port` has no LISTEN socket (or the deadline passes). */
+async function waitForPortFree(port, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (!listeningPorts().has(port))
+            return true;
+        await sleep(100);
+    }
+    return !listeningPorts().has(port);
+}
+/** Poll until `port` has a LISTEN socket (or the deadline passes). */
+async function waitForPortBound(port, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (listeningPorts().has(port))
+            return true;
+        await sleep(100);
+    }
+    return listeningPorts().has(port);
+}
+/**
+ * Restart ONE instance's gate in place, deliberately leaving the provider
+ * process running.
+ *
+ * That asymmetry is the whole point. A Cloudflare quick tunnel's hostname is
+ * minted by cloudflared at startup, so a full `down`/`up` hands back a NEW
+ * random *.trycloudflare.com URL and breaks every link already shared — a
+ * miserable trade for adding one IP. cloudflared only ever forwards to
+ * `localhost:<gate_port>`, so the gate beneath it can be swapped out and the
+ * edge reconnects without noticing.
+ */
+export async function reloadOne(state) {
+    const bin = resolveBinName();
+    const name = state.name;
+    const gatePort = state.gate_port;
+    if (!providerIsAlive(state)) {
+        return {
+            ok: false,
+            message: `[${name}] the provider process is gone, so the public URL is already dead. ` +
+                `Reloading the gate can't bring it back — run \`${bin} tunnel up --name ${name}\`.`,
+        };
+    }
+    if (!bunAvailable()) {
+        return { ok: false, message: `[${name}] bun is not on PATH, so the gate can't be respawned.` };
+    }
+    // Kill ONLY the gate. sweepStrays() is deliberately avoided here: it also
+    // matches `--url http://localhost:<port>`, which is the provider process we
+    // are going out of our way to keep alive.
+    const killed = new Set();
+    if (isProcessAlive(state.gate_pid)) {
+        try {
+            process.kill(state.gate_pid);
+            killed.add(state.gate_pid);
+        }
+        catch {
+            /* race: already gone */
+        }
+    }
+    killByPattern(`gate\\.ts.*--port ${gatePort}( |$)`, killed);
+    if (!(await waitForPortFree(gatePort, 5_000))) {
+        return {
+            ok: false,
+            message: `[${name}] port ${gatePort} never released, so the old gate looks wedged. ` +
+                `Tunnel is down; check \`${bin} tunnel status\`.`,
+        };
+    }
+    const cfg = readConfig();
+    const gateProc = spawnGate({
+        name,
+        gatePort,
+        target: state.target,
+        vhost: state.vhost,
+        provider: state.provider,
+        allowedIps: cfg.allowed_ips,
+        gateLogPath: cachePath("tunnel", gateLogFile(name)),
+    });
+    await sleep(800);
+    const pid = gateProc.pid;
+    if (typeof pid !== "number" ||
+        !isProcessAlive(pid) ||
+        !(await waitForPortBound(gatePort, 5_000))) {
+        return {
+            ok: false,
+            message: `[${name}] the gate did not come back on port ${gatePort}. ` +
+                `Tunnel is down; check \`${bin} tunnel logs --name ${name}\`.`,
+        };
+    }
+    writeState({ ...state, gate_pid: pid });
+    const allowNote = state.provider === "cloudflare" ? ` Allowlist: ${cfg.allowed_ips.length} IP(s).` : "";
+    return { ok: true, message: `[${name}] gate reloaded, URL unchanged: ${state.url}.${allowNote}` };
+}
+async function reload(opts) {
+    const bin = resolveBinName();
+    if (opts.all) {
+        const all = listStates();
+        // Only live tunnels are reloadable, and a box commonly accumulates stale
+        // state files from long-dead runs. Reporting those as failures would make
+        // the common post-`allow add` path exit non-zero for no real reason.
+        const live = all.filter((s) => providerIsAlive(s));
+        const stale = all.length - live.length;
+        if (live.length === 0) {
+            emit.text(all.length === 0
+                ? "No tunnels up. Nothing to reload.\n"
+                : `No live tunnels to reload (${all.length} stale). Start one with \`${bin} tunnel up\`.\n`);
+            return;
+        }
+        let failed = 0;
+        for (const s of live) {
+            const r = await reloadOne(s);
+            emit.text(`${r.ok ? "ok  " : "FAIL"} ${r.message}\n`);
+            if (!r.ok)
+                failed++;
+        }
+        emit.text(`Reloaded ${live.length - failed} of ${live.length} live tunnel(s)` +
+            (stale > 0 ? `; skipped ${stale} stale.\n` : ".\n"));
+        if (failed > 0)
+            process.exitCode = 1;
+        return;
+    }
+    const name = resolveName(opts.name);
+    const state = readState(name);
+    if (!state) {
+        emit.error({
+            code: "tunnel_not_found",
+            message: `No tunnel state for [${name}]. Start it with \`${bin} tunnel up --name ${name}\`.`,
+        });
+        process.exit(1);
+        return;
+    }
+    const r = await reloadOne(state);
+    emit.text(`${r.message}\n`);
+    if (!r.ok)
+        process.exit(1);
+}
 function instanceState(state) {
     return tunnelIsAlive(state) ? "up" : "stale";
 }
@@ -643,6 +814,21 @@ function allowList() {
     for (const ip of cfg.allowed_ips)
         emit.text(`${ip}\n`);
 }
+/**
+ * Trailer for `allow add`/`allow rm`. Each gate snapshots the allowlist at
+ * spawn, so a config edit alone changes nothing until the gates restart.
+ * Only LIVE tunnels are listed — stale state files pile up on a long-running
+ * box, and naming nine dead instances made the old hint read like nine
+ * restarts were owed.
+ */
+function allowChangedHint() {
+    const live = listStates().filter((s) => s.provider === "cloudflare" && providerIsAlive(s));
+    if (live.length === 0)
+        return;
+    emit.text(`Each gate reads the allowlist once at start, so this applies on reload ` +
+        `(${live.map((s) => s.name).join(", ")}):\n` +
+        `  ${resolveBinName()} tunnel reload --all\n`);
+}
 function allowAdd(ip) {
     const cfg = readConfig();
     if (cfg.allowed_ips.includes(ip)) {
@@ -652,10 +838,7 @@ function allowAdd(ip) {
     cfg.allowed_ips.push(ip);
     writeConfig(cfg);
     emit.text(`Added ${ip}.\n`);
-    const up = listStates().filter((s) => s.provider === "cloudflare");
-    if (up.length > 0) {
-        emit.text(`Cloudflare allowlist is shared across Cloudflare tunnels; restart each to apply (${up.map((s) => s.name).join(", ")}).\n`);
-    }
+    allowChangedHint();
 }
 function allowRm(ip) {
     const cfg = readConfig();
@@ -667,10 +850,7 @@ function allowRm(ip) {
     cfg.allowed_ips.splice(idx, 1);
     writeConfig(cfg);
     emit.text(`Removed ${ip}.\n`);
-    const up = listStates().filter((s) => s.provider === "cloudflare");
-    if (up.length > 0) {
-        emit.text(`Cloudflare allowlist is shared across Cloudflare tunnels; restart each to apply (${up.map((s) => s.name).join(", ")}).\n`);
-    }
+    allowChangedHint();
 }
 let emit;
 let context;
@@ -700,6 +880,12 @@ export function registerTunnelCommand(program, emitParam, contextParam) {
         .option("--name <name>", "instance to stop", DEFAULT_INSTANCE)
         .option("--all", "stop every running tunnel")
         .action(down);
+    cmd
+        .command("reload")
+        .description("Restart an instance's gate in place to pick up allowlist changes, keeping the public URL")
+        .option("--name <name>", "instance to reload", DEFAULT_INSTANCE)
+        .option("--all", "reload every live tunnel")
+        .action(reload);
     cmd
         .command("status")
         .description("Show tunnel state: a table of all instances, or detail for one via --name")

package/dist/commands/web-fetch.js

@@ -14,7 +14,7 @@ import { fileURLToPath } from "node:url";
  * harnery repo at the *matching version tag* into a cache dir and install the
  * web app's deps. Subsequent runs reuse the cache.
  *
- * The only thing `web/` pulls from `src/` is `harnery/core/scratch` (a single,
+ * The only thing `web/` pulls from `src/` is `harnery/core/journal` (a single,
  * dependency-free module), so the install is `web/` deps only: no root install,
  * no Playwright browser download.
  */

package/dist/commands/web.d.ts

@@ -1,4 +1,23 @@
 import type { Command } from "commander";
 import type { EmitContext } from "../commander.js";
+/**
+ * Resolve the V8 old-space ceiling for the dashboard process.
+ *
+ * Next sizes `--max-old-space-size` to roughly half of system RAM when the
+ * flag is absent, which on a large machine hands a long-lived dashboard a
+ * ceiling it will never approach — so V8 never feels enough pressure to run a
+ * major GC and the process settles at a multi-gigabyte working set made mostly
+ * of collectable garbage. Pinning a modest ceiling restores that pressure.
+ *
+ * Precedence: explicit flag → `HARNERY_WEB_MAX_OLD_SPACE` → the default.
+ * `0` (or any non-positive value) opts out and restores Next's own sizing.
+ */
+export declare function resolveMaxOldSpaceMb(flag?: string): number;
+/**
+ * Append the heap ceiling to any inherited `NODE_OPTIONS`. Next only supplies
+ * its own `--max-old-space-size` when the flag is absent, so appending here
+ * wins without clobbering flags the caller set (source maps, inspector, …).
+ */
+export declare function nodeOptionsWithHeapCap(mb: number): string | undefined;
 export declare function registerWebCommand(program: Command, emit: EmitContext): void;
 //# sourceMappingURL=web.d.ts.map

package/dist/commands/web.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../../src/commands/web.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAwDnD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAwI5E"}
+{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../../src/commands/web.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAgCnD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAM1D;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKrE;AA8BD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA2J5E"}

package/dist/commands/web.js

@@ -27,6 +27,42 @@ function webRoot() {
     const here = path.dirname(fileURLToPath(import.meta.url));
     return path.resolve(here, "..", "..", "web");
 }
+/** Default V8 old-space ceiling (MB) for the dashboard server. */
+const DEFAULT_MAX_OLD_SPACE_MB = 2048;
+/**
+ * Resolve the V8 old-space ceiling for the dashboard process.
+ *
+ * Next sizes `--max-old-space-size` to roughly half of system RAM when the
+ * flag is absent, which on a large machine hands a long-lived dashboard a
+ * ceiling it will never approach — so V8 never feels enough pressure to run a
+ * major GC and the process settles at a multi-gigabyte working set made mostly
+ * of collectable garbage. Pinning a modest ceiling restores that pressure.
+ *
+ * Precedence: explicit flag → `HARNERY_WEB_MAX_OLD_SPACE` → the default.
+ * `0` (or any non-positive value) opts out and restores Next's own sizing.
+ */
+export function resolveMaxOldSpaceMb(flag) {
+    const raw = flag ?? process.env.HARNERY_WEB_MAX_OLD_SPACE;
+    if (raw === undefined || raw === "")
+        return DEFAULT_MAX_OLD_SPACE_MB;
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n <= 0)
+        return 0;
+    return Math.floor(n);
+}
+/**
+ * Append the heap ceiling to any inherited `NODE_OPTIONS`. Next only supplies
+ * its own `--max-old-space-size` when the flag is absent, so appending here
+ * wins without clobbering flags the caller set (source maps, inspector, …).
+ */
+export function nodeOptionsWithHeapCap(mb) {
+    const inherited = process.env.NODE_OPTIONS ?? "";
+    if (mb <= 0)
+        return inherited || undefined;
+    if (/--max-old-space-size[=\s]/.test(inherited))
+        return inherited;
+    return `${inherited} --max-old-space-size=${mb}`.trim();
+}
 /**
  * Resolve the web app root. A local `web/` (source checkout / submodule) wins.
  * Otherwise, on an npm install, lazy-fetch it (clone + install) unless the
@@ -59,6 +95,7 @@ export function registerWebCommand(program, emit) {
         .option("--coord-root <dir>", "Override the coord root (default: cwd; web walks up looking for .harnery/)")
         .option("--prod", "Use next start instead of next dev (requires prior build)")
         .option("--no-fetch", "Don't auto-fetch the dashboard if it's missing (npm installs)")
+        .option("--max-old-space <mb>", `V8 old-space ceiling in MB; 0 restores Next's own sizing (default ${DEFAULT_MAX_OLD_SPACE_MB}, env HARNERY_WEB_MAX_OLD_SPACE)`)
         .action(async (opts) => {
         const root = resolveWebRoot(emit, opts.fetch !== false);
         if (!root) {
@@ -80,14 +117,21 @@ export function registerWebCommand(program, emit) {
                 return;
             }
         }
+        const heapMb = resolveMaxOldSpaceMb(opts.maxOldSpace);
         emit.log(`harn web · http://localhost:${port} (${mode})`, "info");
+        emit.log(`files origin · http://harnery-files.localhost:${port}`, "info");
         emit.log(`reading .harnery/ from: ${coordRoot}`, "info");
+        if (heapMb > 0)
+            emit.log(`heap ceiling · ${heapMb} MB`, "info");
         const child = spawn(webRunner(), ["run", mode], {
             cwd: root,
             env: {
                 ...process.env,
                 HARNERY_COORD_ROOT: coordRoot,
                 HARNERY_WEB_PORT: port,
+                ...(nodeOptionsWithHeapCap(heapMb)
+                    ? { NODE_OPTIONS: nodeOptionsWithHeapCap(heapMb) }
+                    : {}),
             },
             stdio: "inherit",
         });
@@ -130,6 +174,7 @@ export function registerWebCommand(program, emit) {
         .option("-p, --port <port>", "Listen port", "9000")
         .option("--coord-root <dir>", "Override the coord root")
         .option("--no-fetch", "Don't auto-fetch the dashboard if it's missing (npm installs)")
+        .option("--max-old-space <mb>", `V8 old-space ceiling in MB; 0 restores Next's own sizing (default ${DEFAULT_MAX_OLD_SPACE_MB}, env HARNERY_WEB_MAX_OLD_SPACE)`)
         .action((opts) => {
         const root = resolveWebRoot(emit, opts.fetch !== false);
         if (!root) {
@@ -148,14 +193,20 @@ export function registerWebCommand(program, emit) {
         }
         const coordRoot = opts.coordRoot ?? process.cwd();
         const port = String(opts.port);
+        const heapMb = resolveMaxOldSpaceMb(opts.maxOldSpace);
         emit.log(`harn web · http://localhost:${port} (start)`, "info");
         emit.log(`reading .harnery/ from: ${coordRoot}`, "info");
+        if (heapMb > 0)
+            emit.log(`heap ceiling · ${heapMb} MB`, "info");
         const child = spawn(webRunner(), ["run", "start"], {
             cwd: root,
             env: {
                 ...process.env,
                 HARNERY_COORD_ROOT: coordRoot,
                 HARNERY_WEB_PORT: port,
+                ...(nodeOptionsWithHeapCap(heapMb)
+                    ? { NODE_OPTIONS: nodeOptionsWithHeapCap(heapMb) }
+                    : {}),
             },
             stdio: "inherit",
         });

package/dist/commands/work.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"work.d.ts","sourceRoot":"","sources":["../../src/commands/work.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAUnD,OAAO,EAUL,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,uBAAuB,CAAC;AAwC/B,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAqG7E;AA0OD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAM7D;AAkBD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAK9D"}
+{"version":3,"file":"work.d.ts","sourceRoot":"","sources":["../../src/commands/work.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAWnD,OAAO,EAUL,KAAK,WAAW,EAChB,KAAK,UAAU,EAChB,MAAM,uBAAuB,CAAC;AAwC/B,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAqG7E;AAwPD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAM7D;AAkBD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAK9D"}

package/dist/commands/work.js

@@ -1,14 +1,15 @@
 import { resolve } from "node:path";
+import { adapterProofInputs, createBuiltinAdapterRegistry, probeBinaryVersion, } from "../core/adapters/index.js";
 import { workflowSubscriptionOnly } from "../core/config.js";
-import { createBuiltinHarnessRegistry, harnessProofInputs, probeBinaryVersion, } from "../core/harnesses/index.js";
+import { findCompletedMissionGoverning, reopenGovernorMission } from "../core/governor/index.js";
 import { findCoordRoot } from "../core/hooks/resolve/coord-root.js";
 import { loadPolicyFile } from "../core/policy/index.js";
 import { acceptWorkItem, cancelWorkItem, createWorkItem, listWorkItems, readWorkItem, reconcileAllWorkItems, reconcileWorkItem, reopenWorkItem, runWorkItem, } from "../core/work/index.js";
 import { WorkflowParkedError } from "../core/workflow/index.js";
-const MAX_ATTEMPT_JOURNAL_ERROR_RENDER = 240;
+const MAX_ATTEMPT_TRANSCRIPT_ERROR_RENDER = 240;
 export function registerWorkCommand(program, emit) {
-    const registry = createBuiltinHarnessRegistry();
-    const harnesses = registry.ids();
+    const registry = createBuiltinAdapterRegistry();
+    const adapters = registry.ids();
     const work = program
         .command("work")
         .description("Track durable objectives across bounded workflow attempts.");
@@ -96,13 +97,13 @@ export function registerWorkCommand(program, emit) {
             }
         });
     });
-    registerRunCommand(work, "run", false, registry, harnesses, emit);
-    registerRunCommand(work, "retry", true, registry, harnesses, emit);
+    registerRunCommand(work, "run", false, registry, adapters, emit);
+    registerRunCommand(work, "retry", true, registry, adapters, emit);
     registerGovernanceCommand(work, "accept", emit);
     registerGovernanceCommand(work, "cancel", emit);
     registerGovernanceCommand(work, "reopen", emit);
 }
-function registerRunCommand(work, name, retry, registry, harnesses, emit) {
+function registerRunCommand(work, name, retry, registry, adapters, emit) {
     work
         .command(`${name} <work-id>`)
         .description(retry
@@ -111,8 +112,8 @@ function registerRunCommand(work, name, retry, registry, harnesses, emit) {
         .option("--max-agents <n>", "Total-agent ceiling for the workflow")
         .option("--concurrency <n>", "Concurrent-subagent cap")
         .option("--cwd <dir>", "Working directory children spawn in")
-        .option("--harness <name>", `Default harness: ${harnesses.join(" | ")}`)
-        .option("--subscription-only", "Require stored harness-login billing")
+        .option("--adapter <name>", `Default adapter: ${adapters.join(" | ")}`)
+        .option("--subscription-only", "Require stored adapter-login billing")
         .option("--allow-api-billing", "Permit API-key override billing")
         .option("--policy <file>", "Host policy JSON/JSONC")
         .option("--isolation <mode>", "shared | worktree | sandbox | remote")
@@ -122,8 +123,8 @@ function registerRunCommand(work, name, retry, registry, harnesses, emit) {
         .option("--json", "Emit the workflow report or parked result as JSON")
         .action(async (workId, opts) => {
         await withWorkRootAsync(emit, async (coordRoot) => {
-            if (opts.harness && !registry.get(opts.harness)) {
-                throw new Error(`unknown harness ${JSON.stringify(opts.harness)}`);
+            if (opts.adapter && !registry.get(opts.adapter)) {
+                throw new Error(`unknown adapter ${JSON.stringify(opts.adapter)}`);
             }
             if (opts.workspaceRoot && opts.isolation !== "worktree") {
                 throw new Error("--workspace-root requires --isolation worktree");
@@ -147,13 +148,13 @@ function registerRunCommand(work, name, retry, registry, harnesses, emit) {
                     actor: opts.actor,
                     engine: {
                         spawners: registry.spawners(),
-                        defaultHarness: opts.harness,
+                        defaultAdapter: opts.adapter,
                         maxAgents: opts.maxAgents ? Number.parseInt(opts.maxAgents, 10) : undefined,
                         concurrency: opts.concurrency ? Number.parseInt(opts.concurrency, 10) : undefined,
                         cwd: opts.cwd,
                         subscriptionOnly: opts.subscriptionOnly === true ? true : workflowSubscriptionOnly(coordRoot),
                         allowApiBilling: opts.allowApiBilling,
-                        ...harnessProofInputs(registry.list().map((adapter) => adapter.profile), { versionProbe: probeBinaryVersion }),
+                        ...adapterProofInputs(registry.list().map((adapter) => adapter.profile), { versionProbe: probeBinaryVersion }),
                         policy: opts.policy ? loadPolicyFile(opts.policy) : undefined,
                         approvalMode: "park",
                         approvalAddressee: opts.approvalTo,
@@ -189,7 +190,7 @@ function registerRunCommand(work, name, retry, registry, harnesses, emit) {
                             workId,
                             runId: error.runId,
                             approvalId: error.approvalId,
-                            journalPath: error.journalPath,
+                            transcriptPath: error.transcriptPath,
                         });
                     }
                     else {
@@ -224,11 +225,26 @@ function registerGovernanceCommand(work, name, emit) {
     command.action((workId, opts) => {
         withWorkRoot(emit, (coordRoot) => {
             const fn = name === "accept" ? acceptWorkItem : name === "cancel" ? cancelWorkItem : reopenWorkItem;
-            emitWork(fn(coordRoot, workId, {
+            // ADR 0050: a reopen under a mission that already succeeded has to reopen the
+            // mission too, or the item lands in ready_work that the governor will never
+            // dispatch. Resolve the goal BEFORE touching the work item so a refusal leaves
+            // nothing half-done.
+            const goalId = name === "reopen" ? findCompletedMissionGoverning(coordRoot, workId) : undefined;
+            const record = fn(coordRoot, workId, {
                 ...opts,
                 ...(opts.finding?.length ? { findings: opts.finding } : {}),
                 ...(opts.dispose?.length ? { dispositions: opts.dispose.map(parseDisposition) } : {}),
-            }), opts.json, emit, true);
+            });
+            if (goalId) {
+                reopenGovernorMission({
+                    coordRoot,
+                    goalId,
+                    actor: opts.actor,
+                    reason: opts.reason?.trim() || `work ${workId} was reopened after mission completion`,
+                });
+                emit.log(`mission ${goalId} had completed; its completion was reopened so ${workId} can be dispatched`, "warn");
+            }
+            emitWork(record, opts.json, emit, true);
         });
     });
 }
@@ -284,17 +300,17 @@ function emitWork(record, json, emit, detail = false) {
     emit.text(`${lines.join("\n")}\n`);
 }
 export function renderAttemptRow(attempt) {
-    const statusDetail = attempt.status === "journal_unreadable"
-        ? `: ${renderAttemptJournalError(attempt.journal_error)}`
+    const statusDetail = attempt.status === "transcript_unreadable"
+        ? `: ${renderAttemptTranscriptError(attempt.transcript_error)}`
         : "";
     return `  ${attempt.number}. ${attempt.run_id}  ${attempt.status}${statusDetail}`;
 }
-function renderAttemptJournalError(error) {
+function renderAttemptTranscriptError(error) {
     const normalized = (error ?? "").replace(/\s+/g, " ").trim();
-    const value = normalized || "unknown journal read error";
-    if (value.length <= MAX_ATTEMPT_JOURNAL_ERROR_RENDER)
+    const value = normalized || "unknown transcript read error";
+    if (value.length <= MAX_ATTEMPT_TRANSCRIPT_ERROR_RENDER)
         return value;
-    return `${value.slice(0, MAX_ATTEMPT_JOURNAL_ERROR_RENDER - 3).trimEnd()}...`;
+    return `${value.slice(0, MAX_ATTEMPT_TRANSCRIPT_ERROR_RENDER - 3).trimEnd()}...`;
 }
 function renderWorkRow(record) {
     const projection = record.projection;

package/dist/commands/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAyEnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAmuBjF"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/commands/workflow.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAyEnD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CA4uBjF"}