@kikimoradev/kcloud 0.14.0 → 0.16.0

package/dist/main.js

@@ -13,6 +13,24 @@ import createClient from "openapi-fetch";
 import { finished } from "node:stream/promises";
 import { StdioServerTransport, serveStdio } from "@modelcontextprotocol/server/stdio";
 import { McpServer } from "@modelcontextprotocol/server";
+//#region ../../packages/cli-kit/src/bytes.ts
+const units = [
+	"B",
+	"KiB",
+	"MiB",
+	"GiB",
+	"TiB"
+];
+const bytesOf = (bytes) => {
+	let value = bytes;
+	let unit = 0;
+	while (value >= 1024 && unit < units.length - 1) {
+		value /= 1024;
+		unit += 1;
+	}
+	return unit === 0 ? `${bytes} B` : `${value.toFixed(1)} ${units[unit] ?? ""}`;
+};
+//#endregion
 //#region ../../packages/cli-kit/src/errors.ts
 const exitCodes = {
 	ok: 0,
@@ -91,12 +109,13 @@ const commandFactoryOf = (spec) => (definition) => {
 		}
 	};
 };
-const defineGroup$1 = ({ name, summary, usage, subcommands }) => ({
+const defineGroup$1 = ({ name, summary, usage, subcommands, fallback }) => ({
 	name,
 	summary,
 	usage,
 	optionsUsage: [],
 	subcommands,
+	...fallback === void 0 ? {} : { fallback },
 	execute: () => {
 		throw new Error(`${name} is a group of commands and runs none of its own`);
 	}
@@ -334,23 +353,27 @@ const report = (error, terminal, environment, program, debugVariable) => {
 };
 const dispatcherOf = (spec) => {
 	const rendering = spec;
-	const walk = async (commands, args, trail, context) => {
+	const executed = (command, args, help, context) => {
+		if (!help) return command.execute(args, context);
+		context.terminal.line(commandUsageOf(rendering, command));
+		return Promise.resolve(exitCodes.ok);
+	};
+	const walk = async (commands, args, trail, context, fallback) => {
 		const located = locateCommand(args, spec.globalOptions);
+		const command = located.name === null ? void 0 : commands.find(({ name }) => name === located.name);
+		const listsHelp = located.name === null && located.help;
+		if (command === void 0 && fallback !== void 0 && !listsHelp) return executed(fallback, args, located.help, context);
+		const listed = fallback === void 0 ? commands : [fallback, ...commands];
 		if (located.name === null) {
 			if (located.help) {
-				context.terminal.line(commandsUsageOf(rendering, commands, trail));
+				context.terminal.line(commandsUsageOf(rendering, listed, trail));
 				return exitCodes.ok;
 			}
-			throw new UsageError(trail.length === 0 ? "Name a command." : `${pathOf(trail)}needs a subcommand.`, commandsUsageOf(rendering, commands, trail));
-		}
-		const command = commands.find(({ name }) => name === located.name);
-		if (command === void 0) throw new UsageError(`There is no command ${pathOf(trail)}${located.name}.`, commandsUsageOf(rendering, commands, trail));
-		if (command.subcommands.length > 0) return walk(command.subcommands, located.args, [...trail, command.name], context);
-		if (located.help) {
-			context.terminal.line(commandUsageOf(rendering, command));
-			return exitCodes.ok;
+			throw new UsageError(trail.length === 0 ? "Name a command." : `${pathOf(trail)}needs a subcommand.`, commandsUsageOf(rendering, listed, trail));
 		}
-		return command.execute(located.args, context);
+		if (command === void 0) throw new UsageError(`There is no command ${pathOf(trail)}${located.name}.`, commandsUsageOf(rendering, listed, trail));
+		if (command.subcommands.length > 0) return walk(command.subcommands, located.args, [...trail, command.name], context, command.fallback);
+		return executed(command, located.args, located.help, context);
 	};
 	return async ({ argv, commands, context }) => {
 		try {
@@ -972,6 +995,7 @@ const errorCodes = Object.keys({
 	"agent.tool_duplicate": "rule_violation",
 	"agent.context_too_long": "rule_violation",
 	"agent.docker_unavailable": "rule_violation",
+	"agent.node_unsuitable": "rule_violation",
 	"agent.storage_exhausted": "rule_violation",
 	"agent.invalid_transition": "rule_violation",
 	"agent.busy": "conflict",
@@ -988,6 +1012,17 @@ const errorCodes = Object.keys({
 	"runtime.monitor_draining": "conflict",
 	"runtime.monitor_limited": "conflict",
 	"runtime.monitor_check_unsupported": "rule_violation",
+	"node.not_found": "not_found",
+	"node.name_taken": "conflict",
+	"node.offline": "rule_violation",
+	"node.not_registered": "rule_violation",
+	"node.registration_invalid": "unauthenticated",
+	"node.registration_used": "conflict",
+	"node.in_use": "conflict",
+	"node.host_unknown": "rule_violation",
+	"node.split_exceeds_host": "rule_violation",
+	"project.last_admin": "conflict",
+	"agent.node_unassigned": "rule_violation",
 	"stream.too_many": "rate_limited",
 	"infrastructure.not_configured": "rule_violation",
 	"infrastructure.provider_error": "internal",
@@ -1235,6 +1270,7 @@ const agentSessionSchema = z.object({
 	endedAt: z.iso.datetime().nullable(),
 	ok: z.boolean().nullable(),
 	killedReason: z.string().nullable(),
+	failureReason: z.string().nullable(),
 	error: z.string().nullable(),
 	costUsd: z.number().nullable(),
 	durationMs: z.int().nullable(),
@@ -1329,7 +1365,8 @@ z.object({
 	unavailableReason: z.enum([
 		"not_found",
 		"tampered",
-		"too_large"
+		"too_large",
+		"node_offline"
 	]).nullable(),
 	truncated: z.boolean()
 }).meta({ id: "TranscriptPage" });
@@ -1392,6 +1429,233 @@ pageSchema(z.object({
 	finishedAt: z.iso.datetime().nullable()
 }).meta({ id: "TaskCost" })).meta({ id: "TaskCostPage" });
 costQuerySchema.extend({ cursor: cursorSchema.optional() });
+z.enum(["monitor", "executor"]);
+const sessionSlotCountSchema = z.int().min(1).max(64);
+const sessionQueueEntrySchema = z.object({
+	agentId: idSchema,
+	agentName: z.string().nullable(),
+	projectId: idSchema.nullable(),
+	projectName: z.string().nullable(),
+	position: z.int().positive(),
+	since: z.iso.datetime(),
+	taskId: z.string().nullable()
+}).meta({ id: "SessionQueueEntry" });
+const sessionPoolSchema = z.object({
+	slots: sessionSlotCountSchema.nullable(),
+	effective: z.int().nonnegative(),
+	inUse: z.int().nonnegative(),
+	waiting: z.array(sessionQueueEntrySchema)
+}).meta({ id: "SessionPool" });
+z.object({
+	version: z.int().nonnegative(),
+	ready: z.boolean(),
+	monitor: sessionPoolSchema,
+	executor: sessionPoolSchema
+}).meta({ id: "SessionSlots" });
+z.object({
+	version: z.int().nonnegative(),
+	monitor: sessionSlotCountSchema.nullable(),
+	executor: sessionSlotCountSchema.nullable()
+}).meta({ id: "UpdateSessionSlotsBody" });
+const agentAdmissionStateSchema = z.discriminatedUnion("state", [z.object({
+	state: z.literal("waiting"),
+	since: z.iso.datetime(),
+	position: z.int().positive()
+}), z.object({ state: z.literal("holding") })]).meta({ id: "AgentAdmissionState" });
+const agentAdmissionSchema = z.object({
+	monitor: agentAdmissionStateSchema.nullable(),
+	executor: agentAdmissionStateSchema.nullable()
+}).meta({ id: "AgentAdmission" });
+const nodeStateSchema = z.enum([
+	"pending",
+	"online",
+	"offline"
+]);
+const nodeProviderSchema = z.enum(["self_hosted"]);
+const nodeNameSchema = z.string().trim().regex(slugPattern);
+const nodeHostSchema = z.object({
+	cpus: z.number().nonnegative(),
+	memoryBytes: z.number().nonnegative(),
+	dataRoot: z.string(),
+	serverVersion: z.string()
+}).meta({ id: "NodeHost" });
+const nodeCapabilityNames = [
+	"linux",
+	"windows",
+	"docker",
+	"isolation",
+	"gpu",
+	"desktop"
+];
+const nodeCapabilitySchema = z.enum(nodeCapabilityNames).meta({ id: "NodeCapability" });
+const nodeCapabilitiesSchema = z.object({
+	sandbox: z.boolean(),
+	uidIsolation: z.boolean(),
+	offered: z.array(nodeCapabilitySchema).optional()
+}).meta({ id: "NodeCapabilities" });
+const minPoolCpus = .1;
+const maxSplitCpus = 1024;
+const maxSplitMemoryMb = 16777216;
+const hundredths = (value) => Math.abs(Math.round(value * 100) - value * 100) < 1e-9;
+const splitCpusSchema = (min) => z.number().min(min).max(maxSplitCpus).refine(hundredths, { message: "expected at most two decimal places" });
+const splitMemorySchema = (min) => z.int().min(min).max(maxSplitMemoryMb);
+const nodeReserveSchema = z.object({
+	cpus: splitCpusSchema(0),
+	memoryMb: splitMemorySchema(0)
+}).meta({ id: "NodeReserve" });
+const nodePoolSplitSchema = z.object({
+	cpus: splitCpusSchema(minPoolCpus),
+	memoryMb: splitMemorySchema(256),
+	slots: z.int().min(1).max(64)
+}).meta({ id: "NodePoolSplit" });
+const nodeSplitSchema = z.object({
+	reserve: nodeReserveSchema,
+	monitor: nodePoolSplitSchema,
+	executor: nodePoolSplitSchema
+}).meta({ id: "NodeSplit" });
+const poolLimitSchema = z.object({
+	enforced: z.boolean(),
+	reason: z.enum([
+		"release",
+		"restart",
+		"node"
+	]).nullable()
+}).meta({ id: "PoolLimit" });
+const poolEnforcementSchema = z.object({
+	state: z.enum([
+		"enforced",
+		"unsplit",
+		"unsupported"
+	]),
+	reason: z.string().nullable()
+}).meta({ id: "PoolEnforcement" });
+const poolUsageSchema = z.object({
+	memoryBytes: z.int().nonnegative(),
+	memoryMaxBytes: z.int().nonnegative().nullable(),
+	cpus: z.number().nonnegative().nullable(),
+	memoryKills: z.int().nonnegative()
+}).meta({ id: "PoolUsage" });
+const nodePoolSchema = z.object({
+	slots: z.int().nonnegative(),
+	inUse: z.int().nonnegative(),
+	waiting: z.array(sessionQueueEntrySchema),
+	usage: poolUsageSchema.nullable()
+}).meta({ id: "NodePool" });
+const nodePoolsSchema = z.object({
+	enforcement: poolEnforcementSchema,
+	monitor: nodePoolSchema,
+	executor: nodePoolSchema
+}).meta({ id: "NodePools" });
+const nodeSchema = z.object({
+	id: idSchema,
+	name: nodeNameSchema,
+	provider: nodeProviderSchema,
+	state: nodeStateSchema,
+	engine: z.enum(runtimeEngineKinds).nullable(),
+	version: z.string().nullable(),
+	host: nodeHostSchema.nullable(),
+	capabilities: nodeCapabilitiesSchema.nullable(),
+	offered: z.array(nodeCapabilitySchema),
+	split: nodeSplitSchema.nullable(),
+	revision: z.int().nonnegative(),
+	agentCount: z.int().nonnegative(),
+	connectedAt: z.iso.datetime().nullable(),
+	lastSeenAt: z.iso.datetime().nullable(),
+	registrationExpiresAt: z.iso.datetime().nullable(),
+	createdAt: z.iso.datetime()
+}).meta({ id: "Node" });
+const nodeAgentSchema = z.object({
+	id: idSchema,
+	name: z.string(),
+	slug: z.string(),
+	projectId: idSchema,
+	projectName: z.string(),
+	state: agentStateSchema,
+	poolLimit: poolLimitSchema.nullable()
+}).meta({ id: "NodeAgent" });
+const nodeRuntimeSchema = z.object({
+	reportedAt: z.iso.datetime(),
+	docker: z.object({
+		state: z.enum([
+			"ok",
+			"unavailable",
+			"disabled",
+			"adopting"
+		]),
+		lastError: z.string().nullable()
+	}),
+	storage: z.object({
+		data: storageStateSchema,
+		engine: storageStateSchema
+	}),
+	reconcile: z.object({
+		lastTickAt: z.iso.datetime().nullable(),
+		lastTickError: z.string().nullable(),
+		agentsQueued: z.int().nonnegative(),
+		agentsActive: z.int().nonnegative()
+	}),
+	ingest: z.object({ readers: z.int().nonnegative() }),
+	sessions: z.object({
+		monitor: z.object({
+			effective: z.int().nonnegative(),
+			inUse: z.int().nonnegative()
+		}),
+		executor: z.object({
+			effective: z.int().nonnegative(),
+			inUse: z.int().nonnegative()
+		})
+	}),
+	pools: nodePoolsSchema
+}).meta({ id: "NodeRuntime" });
+nodeSchema.extend({
+	agents: z.array(nodeAgentSchema),
+	runtime: nodeRuntimeSchema.nullable()
+}).meta({ id: "NodeDetail" });
+z.object({ items: z.array(nodeSchema) }).meta({ id: "NodeList" });
+z.object({ nodeId: idSchema });
+z.object({
+	organizationId: idSchema,
+	nodeId: idSchema
+});
+z.object({
+	revision: z.int().nonnegative(),
+	split: nodeSplitSchema.nullable()
+}).meta({ id: "UpdateNodeSplitBody" });
+const createNodeBodySchema = z.object({ name: nodeNameSchema }).meta({ id: "CreateNodeBody" });
+const nodeRegistrationSchema = z.object({
+	token: z.string(),
+	expiresAt: z.iso.datetime()
+}).meta({ id: "NodeRegistration" });
+z.object({
+	node: nodeSchema,
+	registration: nodeRegistrationSchema
+}).meta({ id: "CreatedNode" }).meta({ id: "RenewedNodeRegistration" });
+z.object({
+	token: z.string().min(1).max(256),
+	version: z.string().min(1).max(128),
+	engine: z.enum(runtimeEngineKinds),
+	host: nodeHostSchema.nullable(),
+	capabilities: nodeCapabilitiesSchema
+}).meta({ id: "RegisterNodeBody" });
+z.object({
+	nodeId: idSchema,
+	credential: z.string()
+}).meta({ id: "RegisteredNode" });
+const bytesPerMegabyte = 1048576;
+const inHundredths = (value) => Math.round(value * 100);
+const hostMemoryMbOf = (host) => Math.floor(host.memoryBytes / bytesPerMegabyte);
+const splitOverflowOf = (split, host) => {
+	const cpus = inHundredths(split.reserve.cpus) + inHundredths(split.monitor.cpus) + inHundredths(split.executor.cpus) - inHundredths(host.cpus);
+	const memoryMb = split.reserve.memoryMb + split.monitor.memoryMb + split.executor.memoryMb - hostMemoryMbOf(host);
+	return {
+		cpus: cpus / 100,
+		memoryMb
+	};
+};
+const splitFits = (split, host) => {
+	const overflow = splitOverflowOf(split, host);
+	return overflow.cpus <= 0 && overflow.memoryMb <= 0;
+};
 //#endregion
 //#region ../../packages/contracts/src/identity.ts
 const emailSchema = z.email().max(254);
@@ -1575,6 +1839,11 @@ const auditActionSchema = z.enum([
 	"node.volume_resized",
 	"node.quiesced",
 	"node.resumed",
+	"node.created",
+	"node.registered",
+	"node.registration_renewed",
+	"node.deleted",
+	"node.split_changed",
 	"master_key.reencrypted",
 	"dead_letter.retried",
 	"dead_letter.discarded"
@@ -1594,7 +1863,8 @@ const auditTargetTypeSchema = z.enum([
 	"backup",
 	"host_operation",
 	"volume",
-	"queue"
+	"queue",
+	"node"
 ]);
 const auditEntrySchema = z.object({
 	id: idSchema,
@@ -1667,43 +1937,6 @@ z.object({
 	id: idSchema,
 	userId: idSchema
 });
-z.enum(["monitor", "executor"]);
-const sessionSlotCountSchema = z.int().min(1).max(64);
-const sessionQueueEntrySchema = z.object({
-	agentId: idSchema,
-	agentName: z.string().nullable(),
-	projectId: idSchema.nullable(),
-	projectName: z.string().nullable(),
-	position: z.int().positive(),
-	since: z.iso.datetime(),
-	taskId: z.string().nullable()
-}).meta({ id: "SessionQueueEntry" });
-const sessionPoolSchema = z.object({
-	slots: sessionSlotCountSchema.nullable(),
-	effective: z.int().nonnegative(),
-	inUse: z.int().nonnegative(),
-	waiting: z.array(sessionQueueEntrySchema)
-}).meta({ id: "SessionPool" });
-z.object({
-	version: z.int().nonnegative(),
-	ready: z.boolean(),
-	monitor: sessionPoolSchema,
-	executor: sessionPoolSchema
-}).meta({ id: "SessionSlots" });
-z.object({
-	version: z.int().nonnegative(),
-	monitor: sessionSlotCountSchema.nullable(),
-	executor: sessionSlotCountSchema.nullable()
-}).meta({ id: "UpdateSessionSlotsBody" });
-const agentAdmissionStateSchema = z.discriminatedUnion("state", [z.object({
-	state: z.literal("waiting"),
-	since: z.iso.datetime(),
-	position: z.int().positive()
-}), z.object({ state: z.literal("holding") })]).meta({ id: "AgentAdmissionState" });
-const agentAdmissionSchema = z.object({
-	monitor: agentAdmissionStateSchema.nullable(),
-	executor: agentAdmissionStateSchema.nullable()
-}).meta({ id: "AgentAdmission" });
 //#endregion
 //#region ../../packages/contracts/src/releases.ts
 const kikimoraVersionSchema = z.string().regex(versionTagPattern);
@@ -2097,7 +2330,8 @@ const agentRuntimeSchema = z.object({
 	provision: agentProvisionSchema.nullable(),
 	stopMode: agentStopModeSchema.nullable(),
 	stopDeadlineAt: z.iso.datetime().nullable(),
-	admission: agentAdmissionSchema.nullable()
+	admission: agentAdmissionSchema.nullable(),
+	poolLimit: poolLimitSchema.nullable()
 }).meta({ id: "AgentRuntime" });
 const agentListItemSchema = z.object({
 	id: idSchema,
@@ -2116,6 +2350,11 @@ const agentListItemSchema = z.object({
 	availableActions: z.array(agentActionSchema),
 	updatedAt: z.iso.datetime()
 }).meta({ id: "AgentListItem" });
+const agentNodeSchema = z.object({
+	id: idSchema,
+	name: nodeNameSchema,
+	state: nodeStateSchema
+}).meta({ id: "AgentNode" });
 agentListItemSchema.extend({
 	version: z.int().nonnegative(),
 	description: z.string(),
@@ -2130,6 +2369,8 @@ agentListItemSchema.extend({
 	toolAssignments: z.array(agentToolSchema),
 	release: releaseSummarySchema.nullable(),
 	runtime: agentRuntimeSchema,
+	node: agentNodeSchema.nullable(),
+	requiredCapabilities: z.array(nodeCapabilitySchema),
 	runtimeUid: z.int().positive().nullable(),
 	sandbox: agentSandboxSchema.nullable(),
 	createdAt: z.iso.datetime()
@@ -2147,11 +2388,15 @@ const distinctCredentials = {
 const hasUniqueTools = (assignments) => new Set(assignments.map((assignment) => assignment.toolId)).size === assignments.length;
 const agentRepositoryLinksSchema = z.array(agentRepositoryLinkSchema).min(1).max(32);
 const agentToolAssignmentsSchema = z.array(toolAssignmentSchema).max(32).refine(hasUniqueTools, { message: "expected every tool to be assigned once" });
+const hasUniqueCapabilities = (names) => new Set(names).size === names.length;
+const requiredCapabilitiesSchema = z.array(nodeCapabilitySchema).max(nodeCapabilityNames.length).refine(hasUniqueCapabilities, { message: "expected every capability once" });
 const createAgentBodySchema = z.object({
 	name: agentNameSchema,
 	slug: slugSchema.optional(),
 	description: agentDescriptionSchema,
 	kikimoraVersion: kikimoraVersionSchema,
+	nodeId: idSchema,
+	requiredCapabilities: requiredCapabilitiesSchema.optional(),
 	claudeCredentialId: idSchema,
 	githubCredentialId: idSchema,
 	repositories: agentRepositoryLinksSchema,
@@ -2423,7 +2668,7 @@ z.object({
 		pending: z.array(idSchema)
 	}),
 	capacity: capacityForecastSchema
-}).meta({ id: "Node" });
+}).meta({ id: "PlatformNode" });
 z.object({ role: volumeRoleSchema });
 z.object({ sizeGb: z.int().positive() }).meta({ id: "ResizeVolumeBody" });
 z.object({ agents: z.int().nonnegative() }).meta({ id: "QuiesceResult" });
@@ -2529,6 +2774,7 @@ z.object({
 	version: z.string(),
 	apiImage: installedImageSchema,
 	webImage: installedImageSchema,
+	nodeImage: installedImageSchema,
 	latest: z.string().nullable(),
 	latestError: registryUnavailableSchema.nullable(),
 	versions: z.array(z.string()),
@@ -2619,11 +2865,16 @@ const agentUsageSchema = z.object({
 	blockReadBytes: byteCountSchema,
 	blockWriteBytes: byteCountSchema
 }).meta({ id: "AgentUsage" });
+const nodeHostSeriesSchema = z.object({
+	nodeId: idSchema,
+	nodeName: z.string(),
+	points: z.array(hostPointSchema)
+}).meta({ id: "NodeHostSeries" });
 z.object({
 	resolution: metricsResolutionSchema,
 	from: instantSchema,
 	to: instantSchema,
-	host: z.array(hostPointSchema),
+	nodes: z.array(nodeHostSeriesSchema),
 	agents: z.array(agentUsageSchema)
 }).meta({ id: "HostMetrics" });
 z.object({
@@ -2712,7 +2963,11 @@ z.strictObject({ label: textParam }), z.strictObject({
 }), z.strictObject({
 	agentName: textParam,
 	failureCount: countParam
-}), z.strictObject({ agentName: textParam }), z.strictObject({ ratio: ratioParam }), z.strictObject({
+}), z.strictObject({ agentName: textParam }), z.strictObject({
+	node: textParam,
+	ratio: ratioParam
+}), z.strictObject({
+	node: textParam,
 	filesystem: filesystemNameSchema,
 	ratio: ratioParam
 }), z.strictObject({ backupKind: backupKindSchema }), z.strictObject({ hours: z.int().positive() }), z.strictObject({
@@ -3418,7 +3673,9 @@ const agentHints = {
 	"project.not_found": "kcloud projects list shows the projects you are a member of.",
 	"agent.invalid_transition": "kcloud agents show <agent> lists the actions it takes now.",
 	"agent.busy": "The agent is working on another action; try again in a moment.",
-	"concurrency.conflict": "Someone changed the agent meanwhile; read it again and retry."
+	"concurrency.conflict": "Someone changed the agent meanwhile; read it again and retry.",
+	"agent.node_unsuitable": "The node lacks a capability the agent requires; kcloud nodes show <node> lists what it offers.",
+	"node.offline": "The node of the agent is not connected; kcloud nodes show <node> tells when it was last seen."
 };
 const agentFrom = async (run, reference, project) => {
 	if (reference === void 0 || reference === "") throw new UsageError("This command needs an agent.", "Name it as <project>/<agent>, or pass --project.");
@@ -3491,12 +3748,94 @@ const confirmed = async ({ prompt, settings, question }) => {
 	})) throw new CancelledError("Nothing was changed.");
 };
 //#endregion
+//#region src/commands/nodes/pools.ts
+const poolLimitReasons = {
+	release: "its Kikimora release predates pool limits",
+	restart: "it started before the limits applied; kcloud agents restart applies them",
+	node: "its node holds no pool to a limit"
+};
+const poolLimitText = (limit) => {
+	if (limit === null) return "-";
+	if (limit.enforced) return "enforced";
+	return limit.reason === null ? "none" : `none: ${poolLimitReasons[limit.reason]}`;
+};
+const sessionFailures = {
+	poolMemoryLimit: "killed by the pool memory limit",
+	launcherRefused: "refused by the session starter"
+};
+const sessionFailureText = (reason) => reason === null ? "-" : sessionFailures[reason] ?? reason;
+const unsupportedReasons = { node_outdated: "the node runs a version that reports no pools" };
+const enforcementText = ({ state, reason }) => {
+	switch (state) {
+		case "enforced": return "The node holds each pool to the CPU and memory of its split.";
+		case "unsplit": return "The node has no split, so no pool has a hard limit on CPU or memory.";
+		case "unsupported": return `The node holds no pool to a limit: ${reason === null ? "it cannot" : unsupportedReasons[reason] ?? reason}.`;
+	}
+};
+const memoryOf = (pool) => {
+	if (pool.usage === null) return "-";
+	const { memoryBytes, memoryMaxBytes } = pool.usage;
+	return memoryMaxBytes === null ? bytesOf(memoryBytes) : `${bytesOf(memoryBytes)} of ${bytesOf(memoryMaxBytes)}`;
+};
+const roles = ["monitor", "executor"];
+const queueOf = (pools) => {
+	const waiting = roles.flatMap((role) => pools[role].waiting.map((entry) => [
+		role,
+		String(entry.position),
+		entry.projectName ?? "-",
+		entry.agentName ?? entry.agentId,
+		entry.since,
+		entry.taskId ?? "-"
+	]));
+	return waiting.length === 0 ? "No session waits for a slot." : renderTable([
+		{ header: "WAITS FOR" },
+		{
+			header: "PLACE",
+			align: "right"
+		},
+		{ header: "PROJECT" },
+		{ header: "AGENT" },
+		{ header: "SINCE" },
+		{ header: "TASK" }
+	], waiting);
+};
+const poolsText = (pools) => [
+	enforcementText(pools.enforcement),
+	renderTable([
+		{ header: "POOL" },
+		{ header: "SLOTS IN USE" },
+		{
+			header: "CPU IN USE",
+			align: "right"
+		},
+		{ header: "MEMORY IN USE" },
+		{
+			header: "MEMORY KILLS",
+			align: "right"
+		}
+	], roles.map((role) => {
+		const pool = pools[role];
+		const cpus = pool.usage?.cpus ?? null;
+		return [
+			role,
+			`${pool.inUse} of ${pool.slots}`,
+			cpus === null ? "-" : cpus.toFixed(2),
+			memoryOf(pool),
+			pool.usage === null ? "-" : String(pool.usage.memoryKills)
+		];
+	})),
+	"",
+	queueOf(pools)
+].join("\n");
+//#endregion
 //#region src/commands/agents/plan.ts
 const agentPlanOf = (agent) => ({
 	name: agent.name,
 	slug: agent.slug,
 	description: agent.description,
 	kikimoraVersion: agent.kikimoraVersion,
+	...agent.node === null ? {} : { nodeId: agent.node.id },
+	requiredCapabilities: agent.requiredCapabilities,
 	claudeCredentialId: agent.claudeCredential.id,
 	githubCredentialId: agent.githubCredential.id,
 	repositories: agent.repositories.map(({ repositoryId, directory }) => ({
@@ -3667,6 +4006,7 @@ const admissionRowsOf = (agent) => {
 	const { admission } = agent.runtime;
 	return admission === null ? [] : [["monitor slot", slotOf(admission.monitor)], ["executor slot", slotOf(admission.executor)]];
 };
+const poolLimitRowsOf = ({ runtime }) => runtime.poolLimit === null ? [] : [["pool limit", poolLimitText(runtime.poolLimit)]];
 const detailsOf = (agent) => [
 	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
 		["name", agent.name],
@@ -3675,6 +4015,8 @@ const detailsOf = (agent) => [
 		["wanted", agent.desiredState],
 		["observed", agent.observedState],
 		["release", agent.kikimoraVersion],
+		["node", agent.node === null ? "none" : `${agent.node.name} (${agent.node.state})`],
+		["requires", agent.requiredCapabilities.length === 0 ? "nothing" : agent.requiredCapabilities.join(", ")],
 		["timezone", agent.timezone],
 		["machine", `${agent.machine.cpus} vCPU, ${agent.machine.memoryMb} MB`],
 		["docker", agent.machine.docker ? "yes" : "no"],
@@ -3682,6 +4024,7 @@ const detailsOf = (agent) => [
 		["container", agent.runtime.containerId ?? "none"],
 		["health", agent.runtime.health],
 		...admissionRowsOf(agent),
+		...poolLimitRowsOf(agent),
 		["pending", agent.restartRequired ? agent.restartReasons.join(", ") : "-"],
 		["actions", agent.availableActions.join(", ")],
 		["version", String(agent.version)],
@@ -3699,6 +4042,109 @@ const detailsOf = (agent) => [
 	]))
 ].join("\n");
 //#endregion
+//#region src/commands/nodes/shared.ts
+const nodeHints = {
+	...organizationHints,
+	"node.not_found": "kcloud nodes list shows the nodes of the organization.",
+	"node.name_taken": "Another node of the organization has that name.",
+	"node.in_use": "Delete the agents placed on it first; kcloud nodes show <node> lists them.",
+	"node.registration_used": "The node has joined and holds its own credential; it needs no token."
+};
+const splitHints = {
+	...nodeHints,
+	"auth.forbidden": "Splitting a node takes an admin of its organization.",
+	"node.host_unknown": "The node reports its CPUs and memory once its service runs; kcloud nodes show <node> shows its state.",
+	"node.split_exceeds_host": "The split asks for more than the host has; kcloud nodes split <node> shows the host.",
+	"concurrency.conflict": "Someone changed the node meanwhile; run the command again."
+};
+const nodesOf = async (api, organizationId) => dataOf("list the nodes", await api.GET("/organizations/{organizationId}/nodes", { params: { path: { organizationId } } }), nodeHints).items;
+const namesOf = (nodes) => nodes.map(({ name }) => name).join(", ");
+const nodeIn = (nodes, reference, organization) => {
+	const found = nodes.find((node) => node.id === reference.toLowerCase() || node.name === reference);
+	if (found === void 0) throw new CliError(`There is no node ${reference} in ${organization}.`, nodes.length === 0 ? "kcloud nodes create <name> creates one." : `kcloud nodes list shows ${namesOf(nodes)}.`);
+	return found;
+};
+const resolveNode = async (scope, reference) => {
+	const organization = await scope.organization();
+	if (isId(reference)) return {
+		organizationId: organization.id,
+		nodeId: reference
+	};
+	const node = nodeIn(await nodesOf(scope.api, organization.id), reference, organization.slug);
+	return {
+		organizationId: organization.id,
+		nodeId: node.id
+	};
+};
+const nodeDetailOf = async (api, { organizationId, nodeId }) => dataOf("describe the node", await api.GET("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
+	organizationId,
+	nodeId
+} } }), nodeHints);
+const createdNode = async (api, organizationId, name) => {
+	const body = { name };
+	validated(createNodeBodySchema, body, "a node");
+	return dataOf("create the node", await api.POST("/organizations/{organizationId}/nodes", {
+		params: { path: { organizationId } },
+		body
+	}), nodeHints);
+};
+const renewedRegistration = async (api, { organizationId, nodeId }) => dataOf("issue a registration token for the node", await api.POST("/organizations/{organizationId}/nodes/{nodeId}/registration", { params: { path: {
+	organizationId,
+	nodeId
+} } }), nodeHints);
+const deleteNode = async (api, { organizationId, nodeId }) => {
+	doneWith("delete the node", await api.DELETE("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
+		organizationId,
+		nodeId
+	} } }), nodeHints);
+};
+const splitNode = async (api, { organizationId, nodeId }, revision, split) => dataOf(split === null ? "clear the split of the node" : "split the node", await api.PUT("/organizations/{organizationId}/nodes/{nodeId}/split", {
+	params: { path: {
+		organizationId,
+		nodeId
+	} },
+	body: {
+		revision,
+		split
+	}
+}), splitHints);
+const nodeUsage = [["", "a node is named by its name or its id"]];
+//#endregion
+//#region src/commands/projects/shared.ts
+const defaultProjectColor = "#7c86ff";
+const projectHint = {
+	"project.not_found": "kcloud projects list shows the projects you are a member of.",
+	"project.slug_taken": "Another project of the organization has that slug.",
+	"project.invalid_slug": "A slug holds lowercase letters, digits and hyphens.",
+	"project.not_empty": "Delete its agents, credentials, repositories and tools first.",
+	"project.member_not_found": "kcloud projects members list <project> shows them.",
+	"project.member_must_be_active": "kcloud orgs members enable <member> enables the account first."
+};
+const projectOf = async (api, id) => dataOf("describe the project", await api.GET("/projects/{id}", { params: { path: { id } } }), projectHint);
+//#endregion
+//#region src/commands/agents/placement.ts
+const placedNodeId = async (run, { projectId, given, ask }) => {
+	const project = await projectOf(run.api, projectId);
+	const organization = `the organization of ${project.slug}`;
+	const nodes = await nodesOf(run.api, project.organizationId);
+	if (given !== void 0) return nodeIn(nodes, given, organization).id;
+	const [only, ...others] = nodes;
+	if (only === void 0) throw new CliError(`The organization of ${project.slug} has no node to run the agent on.`, "kcloud nodes create <name> creates one, and its host joins with the token it prints.");
+	if (others.length === 0) {
+		run.context.terminal.error(`The agent runs on ${only.name}, the only node of ${organization}.`);
+		return only.id;
+	}
+	if (ask) return run.prompt.select({
+		message: "The node it runs on",
+		choices: nodes.map((node) => ({
+			value: node.id,
+			label: node.name,
+			hint: node.state
+		}))
+	});
+	throw new UsageError(`agents create needs --node <name>, because ${organization} has ${nodes.length} nodes.`, `The nodes are ${nodes.map(({ name }) => name).join(", ")}.`);
+};
+//#endregion
 //#region src/commands/agents/create.ts
 const claudeKinds = /* @__PURE__ */ new Set(["anthropic_api_key", "claude_oauth_token"]);
 const catalogueOf = async (api, projectId) => {
@@ -3800,8 +4246,21 @@ const promptText = async (run, file, question) => {
 		validate: (value) => value.trim() === "" ? "cannot be empty" : void 0
 	});
 };
+const isCapability = (name) => nodeCapabilityNames.some((capability) => capability === name);
+const requiredCapabilitiesOf = (given) => {
+	const names = given.flatMap((value) => value.split(",")).map((name) => name.trim()).filter((name) => name !== "");
+	const unknown = names.filter((name) => !isCapability(name));
+	if (unknown.length > 0) throw new UsageError(`--require ${unknown.join(", ")} ${unknown.length === 1 ? "is not a capability" : "are not capabilities"} of a node.`, `The capabilities are ${nodeCapabilityNames.join(", ")}.`);
+	return [...new Set(names.filter(isCapability))];
+};
+const requirementOf = (required) => required === void 0 ? {} : { requiredCapabilities: [...required] };
 const localTimezone = () => Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
-const askedPlan = async (run, projectId, values) => {
+const askedPlan = async (run, projectId, values, required) => {
+	const nodeId = await placedNodeId(run, {
+		projectId,
+		given: values.node,
+		ask: !run.settings.yes
+	});
 	const catalogue = await catalogueOf(run.api, projectId);
 	const name = values.name ?? await run.prompt.text({
 		message: "The name of the agent",
@@ -3819,6 +4278,8 @@ const askedPlan = async (run, projectId, values) => {
 		name,
 		description: "",
 		kikimoraVersion: release,
+		nodeId,
+		...requirementOf(required),
 		claudeCredentialId: await chosenCredential(run.prompt, catalogue, (kind) => claudeKinds.has(kind), "The Claude credential it works with"),
 		githubCredentialId: await chosenCredential(run.prompt, catalogue, (kind) => kind === "github_pat", "The GitHub credential it clones with"),
 		repositories: [...await chosenRepositories(run.prompt, catalogue)],
@@ -3837,17 +4298,32 @@ const askedPlan = async (run, projectId, values) => {
 		}
 	};
 };
-const fileOf = async (run, file) => {
+const isObject = (document) => typeof document === "object" && document !== null && !Array.isArray(document);
+const fileOf = async (run, projectId, { file, node }, required) => {
 	const document = await documentOf(run, file);
-	validated(createAgentBodySchema, document, "an agent");
-	return document;
+	const placed = !isObject(document) || node === void 0 && "nodeId" in document ? document : {
+		...document,
+		nodeId: await placedNodeId(run, {
+			projectId,
+			given: node,
+			ask: false
+		})
+	};
+	const plan = isObject(placed) ? {
+		...placed,
+		...requirementOf(required)
+	} : placed;
+	validated(createAgentBodySchema, plan, "an agent");
+	return plan;
 };
 const createCommand = (adaptersOf) => defineCommand({
 	name: "create",
 	summary: "Create an agent from a file, from flags, or by asking step by step.",
-	usage: "agents create --project <name> [--file <path>] [--name <name>]",
+	usage: "agents create --project <name> [--node <node>] [--require <capability,...>] [--file <path>] [--name <name>]",
 	optionsUsage: [
 		["--project <name>", "the project that owns the agent"],
+		["--node <node>", "the node it runs on, by name or id; needed when the organization has several"],
+		["--require <capability,...>", `what its node has to offer: ${nodeCapabilityNames.join(", ")}`],
 		["--file <path>", "the whole agent as JSON, or - to read stdin"],
 		["--name <name>", "the name of the agent, instead of asking"],
 		["--release <x.y.z>", "the Kikimora release it runs, instead of asking"],
@@ -3856,11 +4332,17 @@ const createCommand = (adaptersOf) => defineCommand({
 		["--timezone <zone>", "the timezone of the agent (default: this machine's)"],
 		["--docker", "give the agent a Docker sidecar, when the project allows it"],
 		["--browser", "give the agent a browser"],
-		["", "kcloud agents show <agent> --as-file prints what --file takes"]
+		["", "kcloud agents show <agent> --as-file prints what --file takes"],
+		["", "--node and --require replace the nodeId and requiredCapabilities of the file"]
 	],
 	options: {
 		...fileOptions,
 		project: { type: "string" },
+		node: { type: "string" },
+		require: {
+			type: "string",
+			multiple: true
+		},
 		name: { type: "string" },
 		release: { type: "string" },
 		"monitor-prompt-file": { type: "string" },
@@ -3881,10 +4363,14 @@ const createCommand = (adaptersOf) => defineCommand({
 	},
 	run: async (invocation) => {
 		const { values } = invocation;
+		const required = values.require === void 0 ? void 0 : requiredCapabilitiesOf(values.require);
 		const run = await runOf(adaptersOf, invocation);
 		if (values.project === void 0) throw new UsageError("agents create needs --project <name>.", "kcloud projects list shows the projects you are a member of.");
 		const projectId = await resolveProjectId(run, values.project);
-		const body = values.file === void 0 ? await askedPlan(run, projectId, values) : await fileOf(run, values.file);
+		const body = values.file === void 0 ? await askedPlan(run, projectId, values, required) : await fileOf(run, projectId, {
+			file: values.file,
+			node: values.node
+		}, required);
 		const agent = dataOf("create the agent", await run.api.POST("/projects/{id}/agents", {
 			params: { path: { id: projectId } },
 			body
@@ -4063,6 +4549,7 @@ const observabilityCommands = (adaptersOf) => [
 				{ header: "ROLE" },
 				{ header: "MODEL" },
 				{ header: "OUTCOME" },
+				{ header: "FAILURE" },
 				{
 					header: "COST",
 					align: "right"
@@ -4073,6 +4560,7 @@ const observabilityCommands = (adaptersOf) => [
 				session.agentRole ?? "-",
 				session.model ?? "-",
 				session.ok === null ? "running" : session.ok ? "ok" : "failed",
+				sessionFailureText(session.failureReason),
 				session.costUsd === null ? "-" : session.costUsd.toFixed(2),
 				session.sessionId
 			])));
@@ -5204,7 +5692,7 @@ const agentTools = [
 	defineTool({
 		name: "agent_create",
 		title: "Create an agent",
-		description: "Create an agent in a project. The credentials, repositories and tools are named by the ids that credentials_list, repositories_list and tools_list return; agent_show with asPlan shows a complete example. The agent stays stopped until agent_action starts it.",
+		description: "Create an agent in a project. The node it runs on, the credentials, repositories and tools are named by the ids that nodes_list, credentials_list, repositories_list and tools_list return; agent_show with asPlan shows a complete example. requiredCapabilities names what the node has to offer, from the offered list of nodes_list; the instance refuses a node that lacks one. The agent stays stopped until agent_action starts it.",
 		operations: ["createAgent"],
 		safety: "write",
 		input: z.object({
@@ -5369,6 +5857,391 @@ const credentialTools = [
 	})
 ];
 //#endregion
+//#region src/commands/nodes/split.ts
+const splitFields = [
+	"reserve.cpus",
+	"reserve.memoryMb",
+	"monitor.cpus",
+	"monitor.memoryMb",
+	"monitor.slots",
+	"executor.cpus",
+	"executor.memoryMb",
+	"executor.slots"
+];
+const valuesOf = (split) => ({
+	"reserve.cpus": split.reserve.cpus,
+	"reserve.memoryMb": split.reserve.memoryMb,
+	"monitor.cpus": split.monitor.cpus,
+	"monitor.memoryMb": split.monitor.memoryMb,
+	"monitor.slots": split.monitor.slots,
+	"executor.cpus": split.executor.cpus,
+	"executor.memoryMb": split.executor.memoryMb,
+	"executor.slots": split.executor.slots
+});
+const splitOf = (values) => ({
+	reserve: {
+		cpus: values["reserve.cpus"],
+		memoryMb: values["reserve.memoryMb"]
+	},
+	monitor: {
+		cpus: values["monitor.cpus"],
+		memoryMb: values["monitor.memoryMb"],
+		slots: values["monitor.slots"]
+	},
+	executor: {
+		cpus: values["executor.cpus"],
+		memoryMb: values["executor.memoryMb"],
+		slots: values["executor.slots"]
+	}
+});
+const isComplete = (values) => splitFields.every((field) => values[field] !== void 0);
+const changeOfParts = ({ reserve, monitor, executor }) => {
+	const given = {
+		"reserve.cpus": reserve?.cpus,
+		"reserve.memoryMb": reserve?.memoryMb,
+		"monitor.cpus": monitor?.cpus,
+		"monitor.memoryMb": monitor?.memoryMb,
+		"monitor.slots": monitor?.slots,
+		"executor.cpus": executor?.cpus,
+		"executor.memoryMb": executor?.memoryMb,
+		"executor.slots": executor?.slots
+	};
+	return Object.fromEntries(Object.entries(given).filter((entry) => entry[1] !== void 0));
+};
+const cpusText = (cpus) => String(Math.round(cpus * 100) / 100);
+const hostText = (host) => `${cpusText(host.cpus)} CPU and ${hostMemoryMbOf(host)} MB`;
+const excessText = ({ cpus, memoryMb }) => [...cpus > 0 ? [`${cpusText(cpus)} CPU`] : [], ...memoryMb > 0 ? [`${memoryMb} MB`] : []].join(" and ");
+const fittingSplit = (node, change, nameOf) => {
+	const merged = {
+		...node.split === null ? {} : valuesOf(node.split),
+		...change
+	};
+	if (!isComplete(merged)) {
+		const missing = splitFields.filter((field) => merged[field] === void 0);
+		throw new UsageError(`${node.name} has no split yet, so a split needs every part; ${missing.map(nameOf).join(", ")} ${missing.length === 1 ? "is" : "are"} missing.`, "Once the node has a split, a part left out keeps its value.");
+	}
+	const split = splitOf(merged);
+	validated(nodeSplitSchema, split, "a split of a node");
+	if (node.host === null) throw new CliError(`${node.name} has not reported its CPUs and memory yet, so it cannot be split.`, "The node reports them once its service runs; kcloud nodes show <node> shows its state.");
+	if (!splitFits(split, node.host)) throw new CliError(`The split asks for ${excessText(splitOverflowOf(split, node.host))} more than ${node.name} has.`, `${node.name} has ${hostText(node.host)}; shrink a pool or the reserve.`);
+	return split;
+};
+const splitViewOf = (node) => {
+	const overflow = node.split === null || node.host === null ? null : splitOverflowOf(node.split, node.host);
+	return {
+		id: node.id,
+		name: node.name,
+		revision: node.revision,
+		host: node.host === null ? null : {
+			cpus: node.host.cpus,
+			memoryMb: hostMemoryMbOf(node.host)
+		},
+		split: node.split,
+		free: overflow === null ? null : {
+			cpus: -overflow.cpus,
+			memoryMb: -overflow.memoryMb
+		}
+	};
+};
+const resourceCells = ({ cpus, memoryMb }) => [cpusText(cpus), `${memoryMb} MB`];
+const oneSlotOf = ({ cpus, memoryMb, slots }) => `${cpusText(cpus / slots)} CPU, ${Math.floor(memoryMb / slots)} MB`;
+const hostLineOf = (view) => view.host === null ? `${view.name} has not reported its CPUs and memory yet.` : `The host has ${cpusText(view.host.cpus)} CPU and ${view.host.memoryMb} MB.`;
+const splitTableOf = (view, split) => {
+	const poolRow = (role) => [
+		role,
+		...resourceCells(split[role]),
+		String(split[role].slots),
+		oneSlotOf(split[role])
+	];
+	const rows = [
+		[
+			"reserve",
+			...resourceCells(split.reserve),
+			"-",
+			"-"
+		],
+		poolRow("monitor"),
+		poolRow("executor"),
+		...view.free === null ? [] : [[
+			"free",
+			...resourceCells(view.free),
+			"-",
+			"-"
+		]],
+		...view.host === null ? [] : [[
+			"host",
+			...resourceCells(view.host),
+			"-",
+			"-"
+		]]
+	];
+	const over = view.free === null ? "" : excessText({
+		cpus: -view.free.cpus,
+		memoryMb: -view.free.memoryMb
+	});
+	return [
+		renderTable([
+			{ header: "PART" },
+			{
+				header: "CPU",
+				align: "right"
+			},
+			{
+				header: "MEMORY",
+				align: "right"
+			},
+			{
+				header: "SLOTS",
+				align: "right"
+			},
+			{ header: "ONE SLOT" }
+		], rows),
+		...view.host === null ? ["", hostLineOf(view)] : [],
+		...over === "" ? [] : ["", `The split asks for ${over} more than the host has.`]
+	].join("\n");
+};
+const splitText = (view) => view.split === null ? [
+	`${view.name} has no split, so its slots are counted from its host and no pool has a hard limit on CPU or memory.`,
+	hostLineOf(view),
+	`kcloud nodes split set ${view.name} with every part splits it.`
+].join("\n") : splitTableOf(view, view.split);
+const splitSummaryOf = (split) => {
+	if (split === null) return "none, slots counted from the host without hard limits";
+	const { reserve, monitor, executor } = split;
+	const pool = (role, { cpus, memoryMb, slots }) => `${role} ${cpusText(cpus)} CPU, ${memoryMb} MB, ${slots} slots`;
+	return [
+		`reserve ${cpusText(reserve.cpus)} CPU, ${reserve.memoryMb} MB`,
+		pool("monitor", monitor),
+		pool("executor", executor)
+	].join("; ");
+};
+const cpusPattern = /^\d+(?:\.\d+)?$/u;
+const slotsPattern = /^\d+$/u;
+const memoryPattern = /^(\d+(?:\.\d+)?)\s*(m|mb|mib|g|gb|gib)?$/iu;
+const megabytesPerGigabyte = 1024;
+const memoryMbOf = (given) => {
+	const match = memoryPattern.exec(given.trim());
+	if (match === null) return null;
+	const [, amount = "", unit = "m"] = match;
+	const megabytes = Number(amount) * (unit.toLowerCase().startsWith("g") ? megabytesPerGigabyte : 1);
+	return Number.isSafeInteger(megabytes) ? megabytes : null;
+};
+const readCpus = (flag, given) => {
+	if (!cpusPattern.test(given)) throw new UsageError(`--${flag} ${given} is not a number of CPUs.`, "Give a decimal number, as in 2 or 0.5.");
+	return Number(given);
+};
+const readMemory = (flag, given) => {
+	const megabytes = memoryMbOf(given);
+	if (megabytes === null) throw new UsageError(`--${flag} ${given} is not a whole number of megabytes.`, "Give megabytes, or a number with M or G, as in 2048, 2048M or 2G; G is 1024 MB.");
+	return megabytes;
+};
+const readSlots = (flag, given) => {
+	if (!slotsPattern.test(given)) throw new UsageError(`--${flag} ${given} is not a whole number of slots.`);
+	return Number(given);
+};
+const splitOptions = {
+	"reserve-cpus": { type: "string" },
+	"reserve-memory": { type: "string" },
+	"monitor-cpus": { type: "string" },
+	"monitor-memory": { type: "string" },
+	"monitor-slots": { type: "string" },
+	"executor-cpus": { type: "string" },
+	"executor-memory": { type: "string" },
+	"executor-slots": { type: "string" }
+};
+const splitOptionOf = {
+	"reserve.cpus": {
+		flag: "reserve-cpus",
+		read: readCpus
+	},
+	"reserve.memoryMb": {
+		flag: "reserve-memory",
+		read: readMemory
+	},
+	"monitor.cpus": {
+		flag: "monitor-cpus",
+		read: readCpus
+	},
+	"monitor.memoryMb": {
+		flag: "monitor-memory",
+		read: readMemory
+	},
+	"monitor.slots": {
+		flag: "monitor-slots",
+		read: readSlots
+	},
+	"executor.cpus": {
+		flag: "executor-cpus",
+		read: readCpus
+	},
+	"executor.memoryMb": {
+		flag: "executor-memory",
+		read: readMemory
+	},
+	"executor.slots": {
+		flag: "executor-slots",
+		read: readSlots
+	}
+};
+const flagOf = (field) => `--${splitOptionOf[field].flag}`;
+const changeOf = (values) => Object.fromEntries(splitFields.flatMap((field) => {
+	const { flag, read } = splitOptionOf[field];
+	const given = values[flag];
+	return given === void 0 ? [] : [[field, read(flag, given)]];
+}));
+const createSplitCommand = (adaptersOf) => defineGroup({
+	name: "split",
+	summary: "How a node is split into a reserve and two pools, and changing it.",
+	usage: "nodes split [set|clear] <node>",
+	fallback: defineCommand({
+		name: "split",
+		summary: "Show the split of a node, its host and what one slot of each pool gets.",
+		usage: "nodes split <node>",
+		optionsUsage: nodeUsage,
+		options: {},
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const run = await runOf(adaptersOf, invocation);
+			const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+			return printed(run, splitViewOf(await nodeDetailOf(run.api, reference)), splitText);
+		}
+	}),
+	subcommands: [defineCommand({
+		name: "set",
+		summary: "Split a node into a reserve and two pools, or change parts of its split.",
+		usage: "nodes split set <node> [--<part>-cpus <n>] [--<part>-memory <size>] [--<pool>-slots <n>]",
+		optionsUsage: [
+			...nodeUsage,
+			["--reserve-cpus <n>", "the CPUs kept for the host itself"],
+			["--reserve-memory <size>", "the memory kept for the host itself"],
+			["--monitor-cpus <n>", "the CPUs the monitor sessions share"],
+			["--monitor-memory <size>", "the memory the monitor sessions share"],
+			["--monitor-slots <n>", "how many monitor sessions run at once"],
+			["--executor-cpus <n>", "the CPUs the executor sessions share"],
+			["--executor-memory <size>", "the memory the executor sessions share"],
+			["--executor-slots <n>", "how many executor sessions run at once"],
+			["", "a size is megabytes, or a number with M or G, as in 2048 or 2G"],
+			["", "a part left out keeps its value; a node without a split needs all eight"]
+		],
+		options: splitOptions,
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const change = changeOf(invocation.values);
+			if (Object.keys(change).length === 0) throw new UsageError("nodes split set needs at least one part of the split.", "kcloud nodes split set --help lists the parts.");
+			const run = await runOf(adaptersOf, invocation);
+			const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+			const node = await nodeDetailOf(run.api, reference);
+			const split = fittingSplit(node, change, flagOf);
+			const changed = await splitNode(run.api, reference, node.revision, split);
+			return printed(run, splitViewOf(changed), splitText);
+		}
+	}), defineCommand({
+		name: "clear",
+		summary: "Remove the split of a node, so its slots are counted from its host.",
+		usage: "nodes split clear <node>",
+		optionsUsage: nodeUsage,
+		options: {},
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const run = await runOf(adaptersOf, invocation);
+			const given = invocation.positionals[0] ?? "";
+			const reference = await resolveNode(run, given);
+			const node = await nodeDetailOf(run.api, reference);
+			if (node.split === null) return printed(run, splitViewOf(node), () => `${node.name} has no split; nothing was changed.`);
+			await confirmed({
+				prompt: run.prompt,
+				settings: run.settings,
+				question: `Clear the split of ${given}? Its pools lose their limits on CPU and memory.`
+			});
+			const cleared = await splitNode(run.api, reference, node.revision, null);
+			return printed(run, splitViewOf(cleared), splitText);
+		}
+	})]
+});
+//#endregion
+//#region src/mcp/tools/nodes.ts
+const nodeField = z.string().trim().min(1).describe("The node, by its name or its id, from nodes_list.");
+const poolPart = (role) => nodePoolSplitSchema.partial().optional().describe(`The CPUs, the memory in MB and the slots the ${role} sessions share; a field left out keeps its value.`);
+const nodeTools = [
+	defineTool({
+		name: "nodes_list",
+		title: "List nodes",
+		description: "List the nodes of the organization this server acts in, the hosts its agents run on, with their state, engine, version, capabilities, split and agent count.",
+		operations: ["listNodes"],
+		safety: "read",
+		input: z.object({}),
+		run: async (_, run) => nodesOf(run.api, (await run.organization()).id)
+	}),
+	defineTool({
+		name: "node_show",
+		title: "Show a node",
+		description: "Show one node with its host, its capabilities, its split, the agents placed on it with their pool limits, and the runtime and pools it reported last.",
+		operations: ["getNode"],
+		safety: "read",
+		input: z.object({ node: nodeField }),
+		run: async ({ node }, run) => nodeDetailOf(run.api, await resolveNode(run, node))
+	}),
+	defineTool({
+		name: "node_split_set",
+		title: "Split a node into pools",
+		description: "Split a node into a reserve kept for the host, a monitor pool and an executor pool, each with CPUs and memory in MB, the pools also with slots. A part left out keeps its value; a node without a split needs every part. The split has to fit the host. Returns the split with the host and what is left free. Takes an admin of the organization.",
+		operations: ["getNode", "updateNodeSplit"],
+		safety: "write",
+		idempotent: true,
+		input: z.object({
+			node: nodeField,
+			reserve: nodeReserveSchema.partial().optional().describe("The CPUs and the memory in MB kept for the host itself; a field left out keeps its value."),
+			monitor: poolPart("monitor"),
+			executor: poolPart("executor")
+		}),
+		run: async ({ node, ...parts }, run) => {
+			const change = changeOfParts(parts);
+			if (Object.keys(change).length === 0) throw new CliError("Name at least one part of the split to change.");
+			const reference = await resolveNode(run, node);
+			const detail = await nodeDetailOf(run.api, reference);
+			const split = fittingSplit(detail, change, (field) => field);
+			return splitViewOf(await splitNode(run.api, reference, detail.revision, split));
+		}
+	}),
+	defineTool({
+		name: "node_split_clear",
+		title: "Clear the split of a node",
+		description: "Remove the split of a node, so its slots are counted from its host again and its pools lose their limits on CPU and memory. Takes an admin of the organization.",
+		operations: ["getNode", "updateNodeSplit"],
+		safety: "destructive",
+		idempotent: true,
+		input: z.object({ node: nodeField }),
+		run: async ({ node }, run) => {
+			const reference = await resolveNode(run, node);
+			const detail = await nodeDetailOf(run.api, reference);
+			if (detail.split === null) return splitViewOf(detail);
+			return splitViewOf(await splitNode(run.api, reference, detail.revision, null));
+		}
+	}),
+	defineTool({
+		name: "node_delete",
+		title: "Delete a node",
+		description: "Delete a node, after which its host can no longer reach the platform. The instance refuses while agents are placed on it.",
+		operations: ["deleteNode"],
+		safety: "destructive",
+		input: z.object({ node: nodeField }),
+		run: async ({ node }, run) => {
+			const reference = await resolveNode(run, node);
+			await deleteNode(run.api, reference);
+			return { deleted: reference.nodeId };
+		}
+	})
+];
+//#endregion
 //#region src/commands/notifications.ts
 const notificationHints = { "notification.not_found": "kcloud notifications list shows them." };
 const createNotificationsCommand = (adaptersOf) => defineGroup({
@@ -6583,18 +7456,6 @@ const projectToolTools = [
 	})
 ];
 //#endregion
-//#region src/commands/projects/shared.ts
-const defaultProjectColor = "#7c86ff";
-const projectHint = {
-	"project.not_found": "kcloud projects list shows the projects you are a member of.",
-	"project.slug_taken": "Another project of the organization has that slug.",
-	"project.invalid_slug": "A slug holds lowercase letters, digits and hyphens.",
-	"project.not_empty": "Delete its agents, credentials, repositories and tools first.",
-	"project.member_not_found": "kcloud projects members list <project> shows them.",
-	"project.member_must_be_active": "kcloud orgs members enable <member> enables the account first."
-};
-const projectOf = async (api, id) => dataOf("describe the project", await api.GET("/projects/{id}", { params: { path: { id } } }), projectHint);
-//#endregion
 //#region src/commands/projects/members.ts
 const projectMembersOf = async (api, projectId) => dataOf("list the members of the project", await api.GET("/projects/{id}/members", { params: { path: { id: projectId } } }), projectHint).items;
 const resolveProjectMember = async (api, projectId, reference) => {
@@ -7400,6 +8261,7 @@ const kcloudTools = [
 	...credentialTools,
 	...repositoryTools,
 	...projectToolTools,
+	...nodeTools,
 	...agentTools,
 	...taskTools,
 	...observabilityTools,
@@ -7407,6 +8269,7 @@ const kcloudTools = [
 	...releaseTools
 ];
 const passwordPrinted = (what) => `a secret never passes through the context of a model, and kcloud prints ${what}`;
+passwordPrinted("the one-time registration token of the node");
 passwordPrinted("the temporary password of the new member"), passwordPrinted("the new temporary password");
 //#endregion
 //#region src/mcp/server.ts
@@ -7477,6 +8340,195 @@ const createMcpCommand = (adaptersOf, cliVersion) => defineCommand({
 	}
 });
 //#endregion
+//#region src/commands/nodes/index.ts
+const gibibytes = (bytes) => `${(bytes / 1024 ** 3).toFixed(1)} GiB`;
+const hostOf = (node) => node.host === null ? "-" : `${node.host.cpus} CPU, ${gibibytes(node.host.memoryBytes)} of memory`;
+const capabilitiesOf = (node) => {
+	if (node.capabilities === null) return "-";
+	const { sandbox, uidIsolation } = node.capabilities;
+	return `sandbox ${sandbox ? "yes" : "no"}, uid isolation ${uidIsolation ? "yes" : "no"}`;
+};
+const registrationOf = (node) => node.registrationExpiresAt === null ? "-" : `a token waits until ${node.registrationExpiresAt}`;
+const storageOf = ({ state, freeBytes, totalBytes, path }) => `${state}, ${gibibytes(freeBytes)} free of ${gibibytes(totalBytes)} at ${path}`;
+const runtimeRowsOf = (runtime) => [
+	["reported", runtime.reportedAt],
+	["docker", runtime.docker.lastError === null ? runtime.docker.state : `${runtime.docker.state}: ${runtime.docker.lastError}`],
+	["data storage", storageOf(runtime.storage.data)],
+	["engine storage", storageOf(runtime.storage.engine)],
+	["last reconcile", runtime.reconcile.lastTickError === null ? runtime.reconcile.lastTickAt ?? "never" : `${runtime.reconcile.lastTickAt ?? "never"}: ${runtime.reconcile.lastTickError}`],
+	["agents", `${runtime.reconcile.agentsActive} active, ${runtime.reconcile.agentsQueued} queued`],
+	["log readers", String(runtime.ingest.readers)]
+];
+const nodeDetailsText = (node) => [
+	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
+		["name", node.name],
+		["state", node.state],
+		["provider", node.provider],
+		["engine", node.engine ?? "-"],
+		["version", node.version ?? "-"],
+		["host", hostOf(node)],
+		["server", node.host?.serverVersion ?? "-"],
+		["data root", node.host?.dataRoot ?? "-"],
+		["capabilities", capabilitiesOf(node)],
+		["offers", node.offered.length === 0 ? "-" : node.offered.join(", ")],
+		["split", splitSummaryOf(node.split)],
+		["registration", registrationOf(node)],
+		["connected", node.connectedAt ?? "never"],
+		["last seen", node.lastSeenAt ?? "never"],
+		["created", node.createdAt],
+		["id", node.id]
+	]),
+	"",
+	node.agents.length === 0 ? "No agent is placed on the node." : renderTable([
+		{ header: "PROJECT" },
+		{ header: "AGENT" },
+		{ header: "STATE" },
+		{ header: "POOL LIMIT" },
+		{ header: "ID" }
+	], node.agents.map((agent) => [
+		agent.projectName,
+		agent.slug,
+		agent.state,
+		poolLimitText(agent.poolLimit),
+		agent.id
+	])),
+	"",
+	...node.runtime === null ? ["The node has reported no runtime yet."] : [
+		renderTable([{ header: "RUNTIME" }, { header: "VALUE" }], runtimeRowsOf(node.runtime)),
+		"",
+		poolsText(node.runtime.pools)
+	]
+].join("\n");
+const startHintOf = (origin) => [
+	"Start the node with it as docs/install.md of kikimora-cloud describes. On a Linux host, after read -rs token:",
+	`  printf '%s\\n' "$token" | /opt/kikimora-cloud/infra/node/install.sh --platform-url ${origin} --image ghcr.io/kikimoradev/kikimora-cloud/node:<version> --registration-token -`,
+	"On a Windows PC:",
+	`  C:\\kikimora-cloud\\src\\infra\\windows\\install.ps1 -PlatformUrl ${origin} -RegistrationToken <token>`
+].join("\n");
+const printedRegistration = (run, created) => {
+	if (run.settings.json) {
+		run.context.terminal.json(created);
+		return exitCodes.ok;
+	}
+	run.context.terminal.line(created.registration.token);
+	run.context.terminal.error([`The registration token of ${created.node.name} is shown only here and works once, until ${created.registration.expiresAt}.`, startHintOf(run.origin)].join("\n"));
+	return exitCodes.ok;
+};
+const createNodesCommand = (adaptersOf) => defineGroup({
+	name: "nodes",
+	summary: "The nodes of the organization, the hosts its agents run on.",
+	usage: "nodes <command>",
+	subcommands: [
+		defineCommand({
+			name: "list",
+			summary: "List the nodes of the organization.",
+			usage: "nodes list",
+			options: {},
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const items = await nodesOf(run.api, organization.id);
+				return printed(run, items, (nodes) => nodes.length === 0 ? `${organization.slug} has no node yet; kcloud nodes create <name> creates one.` : renderTable([
+					{ header: "NAME" },
+					{ header: "STATE" },
+					{ header: "ENGINE" },
+					{ header: "VERSION" },
+					{
+						header: "AGENTS",
+						align: "right"
+					},
+					{ header: "LAST SEEN" },
+					{ header: "ID" }
+				], nodes.map((node) => [
+					node.name,
+					node.state,
+					node.engine ?? "-",
+					node.version ?? "-",
+					String(node.agentCount),
+					node.lastSeenAt ?? "never",
+					node.id
+				])));
+			}
+		}),
+		defineCommand({
+			name: "show",
+			summary: "Show a node with its host, its split, the agents placed on it, its runtime and its pools.",
+			usage: "nodes show <node>",
+			optionsUsage: nodeUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+				return printed(run, await nodeDetailOf(run.api, reference), nodeDetailsText);
+			}
+		}),
+		createSplitCommand(adaptersOf),
+		defineCommand({
+			name: "create",
+			summary: "Create a node and print its one-time registration token.",
+			usage: "nodes create <name>",
+			optionsUsage: [["", "the name holds lowercase letters, digits and hyphens"], ["", "the token goes to stdout alone, how to start the node to stderr"]],
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				return printedRegistration(run, await createdNode(run.api, organization.id, invocation.positionals[0] ?? ""));
+			}
+		}),
+		defineCommand({
+			name: "token",
+			summary: "Issue a new registration token for a node that has not joined yet.",
+			usage: "nodes token <node>",
+			optionsUsage: [...nodeUsage, ["", "the token replaces the one issued before, which stops working"]],
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+				return printedRegistration(run, await renewedRegistration(run.api, reference));
+			}
+		}),
+		defineCommand({
+			name: "delete",
+			summary: "Delete a node that runs no agent.",
+			usage: "nodes delete <node>",
+			optionsUsage: nodeUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const given = invocation.positionals[0] ?? "";
+				const reference = await resolveNode(run, given);
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: `Delete the node ${given}? Its host can no longer reach the platform.`
+				});
+				await deleteNode(run.api, reference);
+				return said(run, `Deleted the node ${given}.`);
+			}
+		})
+	]
+});
+//#endregion
 //#region src/commands/releases.ts
 const createReleasesCommand = (adaptersOf) => defineGroup({
 	name: "releases",
@@ -7523,6 +8575,7 @@ const kcloudCommands = () => [
 	createCredentialsCommand(createAdapters),
 	createRepositoriesCommand(createAdapters),
 	createToolsCommand(createAdapters),
+	createNodesCommand(createAdapters),
 	createAgentsCommand(createAdapters),
 	createNotificationsCommand(createAdapters),
 	createReleasesCommand(createAdapters),