# L Harness: the software is free, and Cloudflare D1's free tier errors instead of billing

> A self-hosted CRM for LINE Official Accounts on Cloudflare Workers and D1, MIT licensed, with a bundled MCP server for Claude Code. Its own README is three minor versions behind the repository, its stated Node floor and its package manifest disagree, and its research sites are described as the developer's own primary information rather than third-party review.

**Shudesu/line-harness-oss** — L Harness — open-source CRM for LINE Official Accounts. Self-hosted step delivery, broadcasts, forms, rich menus, scoring, automation, and more.

- Repository: https://github.com/Shudesu/line-harness-oss
- Website: https://the-harness.com/line-harness/
- Stars: 605 · Forks: 404
- Language: TypeScript
- License: MIT
- Published: 2026-08-27 · Updated: 2026-08-27 · Language: en
- Canonical page: https://hysenlabs.com/projects/shudesu-line-harness-oss

## The README says v0.21.0 and the repository is on v0.24.1

The version line in the visible documentation reads v0.21.0, while the newest release is v0.24.1 published on 2026-09-11 and the package manifest also reads 0.24.1. So the number a reader takes away from the front page is three minor releases out of date, and the release names themselves are in Japanese, which adds a second layer of distance for an English reader. That same page carries a rebranding note: from 2026-08-19 the product display name was unified as L Harness, and to avoid breaking existing installations the repository URL, the `create-line-harness` command and the `@line-harness/*` package scope were all kept as compatibility identifiers, with the reasoning written up separately in `BRAND.md`. That is three naming systems for one product, and a reader arriving at the repository name has no way to guess the product name without reading that note.

## Node 22 in the documentation and Node 20 in the package manifest

The prerequisites list asks for Node.js 22 or newer with pnpm, and the comment on the plugin scaffold command repeats 22 as a requirement. The package manifest's engines field says node 20 or newer. Two different floors for the same tool, one in prose and one in the file a package manager reads, and the lower of the two is the one that governs an install. The plugin marketplace is in beta, and scaffolding a plugin is one command from the repository root:

```bash
# 本体リポジトリのルートで実行（Node.js 22以上）
pnpm plugin:create ../my-plugin
```

The beta works by letting you cut delivery rules, automation and external service integrations out into separate repositories and Workers behind an SDK, so core updates do not overwrite your own code. The author is careful about the limit of that promise: not being overwritten and API compatibility are separate things, and when updating the core or the SDK you are told to verify the connection in a test environment first.

## D1's free plan errors at the daily limit instead of charging

The headline is that the software fee is zero, and the page is careful to say what that does not cover: LINE Official Account messaging fees, the Cloudflare contract and usage, your own domain, setup and maintenance, and any external AI service you connect. The most useful line is the one about the free Cloudflare D1 plan, which says that reaching the daily read and write limit makes queries error, and that this behaves differently from overage charges on a paid plan. That is the real cost boundary for a self-hosted deployment, and it is the opposite shape from the usual one: instead of a surprise invoice you get a hard failure at a predictable point in the day. The external AI cost is called out separately with a link to Claude's own pricing, noted as checked on 2026-09-06, and the migration scripts in the manifest still carry a literal `your-database` placeholder that a custom deployment has to replace.

## The research sites are the developer's own, and the README says so

A ten-row table lists the official sources, and one sentence above it is worth more than the table. It states that each Research site is primary information operated by the developer and is not an independent third-party review. Given what the research pages claim to verify, that sentence is load-bearing: they cover delivery, webhooks, D1, permissions and the update mechanism against a pinned git commit, publish a machine-readable Schema.org DataCatalog, and offer a full-text index for AI that includes sources, verification steps and the range that cannot be proven. The table also separates the products cleanly, listing two alias domains that permanently redirect to the canonical page and a managed L Harness Cloud service as an entity distinct from the open source project, alongside the operating company and the developer's profile.

## Ban detection moves friends to the next account in the pool

The multi-account section is the one to read before deploying. Several LINE Official Accounts are managed from one dashboard, with scenarios, tags and delivery scoped per account, and a traffic pool distributing across them automatically. The feature that distinguishes it from the competitors in the comparison table is ban detection: when an account is detected as banned, friends are migrated automatically to the next account in the pool. The comparison table lists the same capability as absent from both named incumbents, alongside duplicate friend detection and full API exposure. Worth noting that the same `picture_url` token mechanism used to deduplicate friends across accounts also surfaces a flag in the affiliate approval flow, where attributed conversions are approved or rejected and the flag is used to make reward inflation visible. One detection primitive serving both CRM hygiene and anti-fraud is good engineering; the ban migration is a deliberate platform-avoidance capability, not an oversight.

## Sessions use an HttpOnly cookie, and the file explains why not a key

The environment example carries one of the better pieces of security documentation in an open source README. The admin dashboard authenticates with an HttpOnly session cookie and, stated explicitly, with no API key in localStorage. The file then spells out the topology consequence: when the admin on Pages and the API on the Worker are on different sites, the cookie must be SameSite=None with Secure, and the admin origin must be allow-listed for credentialed CORS, with `ADMIN_ORIGIN` taking a comma-separated allowlist and `ADMIN_ALLOW_CROSS_SITE` turning the behaviour on. The alternative is given too: omit it when both share a registrable domain such as admin and api on the same name, where SameSite=Lax is enough, and a `ADMIN_COOKIE_SAMESITE` override exists for the cases where neither derivation is right. `X_HARNESS_URL` is the separate variable for linking another instance's account in.

## Sending through MCP needs confirmation; writing scenarios does not

The bundled MCP server exposes six tools, and the confirmation requirement is placed on the right pair. `list_conversations` and `get_conversation` let an agent watch for unreplied conversations, `create_scenario` and `update_step` let it write scenarios, and `broadcast` and `send_message` are marked as requiring user confirmation. So an agent can draft the whole marketing sequence unattended and still cannot hit a subscriber without a human in the loop. The official SDK is described as typed TypeScript with both ESM and CommonJS output and zero dependencies. Behind them the architecture is a Hono worker on Cloudflare Workers holding the API, LIFF and webhook intake with cron for delivery, a Next.js 15 dashboard of nineteen sections on Cloudflare Pages, and D1 for storage. Seven workspace packages sit under it, and the root tree also carries two `.superpowers-report` files and a `.superpowers/` directory alongside five README languages.

## Conclusion

Use L Harness if you want a self-hosted LINE CRM where the software costs nothing and you already hold a Cloudflare account and a Messaging API channel, because the step delivery, tagging, scoring and affiliate tracking are substantial and the MCP server lets an agent drive them. Two things decide it. The zero figure covers software only: LINE messaging fees, Cloudflare usage, your domain and any external AI service are separate, and on Cloudflare's free D1 plan hitting the daily read/write limit produces query errors rather than overage charges, so a busy account fails differently than a paid one. And read the multi-account section before deploying, because automatic friend migration on ban detection is the one capability a reviewer should weigh rather than inherit.

## FAQ

### Is L Harness free to run?

The software fee is zero. LINE Official Account messaging fees, Cloudflare contract and usage, your own domain, setup and maintenance, and any external AI service are separate costs. On Cloudflare's free D1 plan, reaching the daily read and write limit makes queries error rather than producing overage charges.

### How do I set up L Harness?

With `npx create-line-harness`, which authenticates Cloudflare with wrangler, creates the D1 database and applies the schema, deploys the worker and dashboard, registers LINE credentials, creates the LIFF app and makes the first Owner user. It takes about five minutes and the dashboard lands on a `*.pages.dev` domain.

### Can an AI agent control L Harness?

Yes, through a bundled MCP server usable from Claude Code, with six tools covering unreplied conversation review, scenario creation and step updates, and message sending. Sending by broadcast or message requires user confirmation, while scenario edits do not. There is also a typed TypeScript SDK with ESM and CommonJS output and zero dependencies.

### What does L Harness do about LINE account bans?

It detects a ban and migrates friends automatically to the next account in a traffic pool, across multiple official accounts managed from one dashboard with per-account scoping of scenarios, tags and delivery. The same account pool handles automatic distribution of traffic.

### Which Node.js version does L Harness need?

The documentation and the plugin scaffold command both say Node.js 22 or newer, while the package manifest's engines field says node 20 or newer. The manifest is what governs an install, so the two sources do not agree.

## Sources

- [Official documentation](https://the-harness.com/line-harness/)
- [Official README](https://github.com/Shudesu/line-harness-oss#readme)
- [Project repository](https://github.com/Shudesu/line-harness-oss)
- [Release notes](https://github.com/Shudesu/line-harness-oss/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/shudesu-line-harness-oss