@kikimoradev/kcloud 0.15.0 → 0.16.0

package/dist/main.js

@@ -13,6 +13,24 @@ import createClient from "openapi-fetch";
 import { finished } from "node:stream/promises";
 import { StdioServerTransport, serveStdio } from "@modelcontextprotocol/server/stdio";
 import { McpServer } from "@modelcontextprotocol/server";
+//#region ../../packages/cli-kit/src/bytes.ts
+const units = [
+	"B",
+	"KiB",
+	"MiB",
+	"GiB",
+	"TiB"
+];
+const bytesOf = (bytes) => {
+	let value = bytes;
+	let unit = 0;
+	while (value >= 1024 && unit < units.length - 1) {
+		value /= 1024;
+		unit += 1;
+	}
+	return unit === 0 ? `${bytes} B` : `${value.toFixed(1)} ${units[unit] ?? ""}`;
+};
+//#endregion
 //#region ../../packages/cli-kit/src/errors.ts
 const exitCodes = {
 	ok: 0,
@@ -91,12 +109,13 @@ const commandFactoryOf = (spec) => (definition) => {
 		}
 	};
 };
-const defineGroup$1 = ({ name, summary, usage, subcommands }) => ({
+const defineGroup$1 = ({ name, summary, usage, subcommands, fallback }) => ({
 	name,
 	summary,
 	usage,
 	optionsUsage: [],
 	subcommands,
+	...fallback === void 0 ? {} : { fallback },
 	execute: () => {
 		throw new Error(`${name} is a group of commands and runs none of its own`);
 	}
@@ -334,23 +353,27 @@ const report = (error, terminal, environment, program, debugVariable) => {
 };
 const dispatcherOf = (spec) => {
 	const rendering = spec;
-	const walk = async (commands, args, trail, context) => {
+	const executed = (command, args, help, context) => {
+		if (!help) return command.execute(args, context);
+		context.terminal.line(commandUsageOf(rendering, command));
+		return Promise.resolve(exitCodes.ok);
+	};
+	const walk = async (commands, args, trail, context, fallback) => {
 		const located = locateCommand(args, spec.globalOptions);
+		const command = located.name === null ? void 0 : commands.find(({ name }) => name === located.name);
+		const listsHelp = located.name === null && located.help;
+		if (command === void 0 && fallback !== void 0 && !listsHelp) return executed(fallback, args, located.help, context);
+		const listed = fallback === void 0 ? commands : [fallback, ...commands];
 		if (located.name === null) {
 			if (located.help) {
-				context.terminal.line(commandsUsageOf(rendering, commands, trail));
+				context.terminal.line(commandsUsageOf(rendering, listed, trail));
 				return exitCodes.ok;
 			}
-			throw new UsageError(trail.length === 0 ? "Name a command." : `${pathOf(trail)}needs a subcommand.`, commandsUsageOf(rendering, commands, trail));
-		}
-		const command = commands.find(({ name }) => name === located.name);
-		if (command === void 0) throw new UsageError(`There is no command ${pathOf(trail)}${located.name}.`, commandsUsageOf(rendering, commands, trail));
-		if (command.subcommands.length > 0) return walk(command.subcommands, located.args, [...trail, command.name], context);
-		if (located.help) {
-			context.terminal.line(commandUsageOf(rendering, command));
-			return exitCodes.ok;
+			throw new UsageError(trail.length === 0 ? "Name a command." : `${pathOf(trail)}needs a subcommand.`, commandsUsageOf(rendering, listed, trail));
 		}
-		return command.execute(located.args, context);
+		if (command === void 0) throw new UsageError(`There is no command ${pathOf(trail)}${located.name}.`, commandsUsageOf(rendering, listed, trail));
+		if (command.subcommands.length > 0) return walk(command.subcommands, located.args, [...trail, command.name], context, command.fallback);
+		return executed(command, located.args, located.help, context);
 	};
 	return async ({ argv, commands, context }) => {
 		try {
@@ -972,6 +995,7 @@ const errorCodes = Object.keys({
 	"agent.tool_duplicate": "rule_violation",
 	"agent.context_too_long": "rule_violation",
 	"agent.docker_unavailable": "rule_violation",
+	"agent.node_unsuitable": "rule_violation",
 	"agent.storage_exhausted": "rule_violation",
 	"agent.invalid_transition": "rule_violation",
 	"agent.busy": "conflict",
@@ -995,6 +1019,8 @@ const errorCodes = Object.keys({
 	"node.registration_invalid": "unauthenticated",
 	"node.registration_used": "conflict",
 	"node.in_use": "conflict",
+	"node.host_unknown": "rule_violation",
+	"node.split_exceeds_host": "rule_violation",
 	"project.last_admin": "conflict",
 	"agent.node_unassigned": "rule_violation",
 	"stream.too_many": "rate_limited",
@@ -1244,6 +1270,7 @@ const agentSessionSchema = z.object({
 	endedAt: z.iso.datetime().nullable(),
 	ok: z.boolean().nullable(),
 	killedReason: z.string().nullable(),
+	failureReason: z.string().nullable(),
 	error: z.string().nullable(),
 	costUsd: z.number().nullable(),
 	durationMs: z.int().nullable(),
@@ -1402,6 +1429,43 @@ pageSchema(z.object({
 	finishedAt: z.iso.datetime().nullable()
 }).meta({ id: "TaskCost" })).meta({ id: "TaskCostPage" });
 costQuerySchema.extend({ cursor: cursorSchema.optional() });
+z.enum(["monitor", "executor"]);
+const sessionSlotCountSchema = z.int().min(1).max(64);
+const sessionQueueEntrySchema = z.object({
+	agentId: idSchema,
+	agentName: z.string().nullable(),
+	projectId: idSchema.nullable(),
+	projectName: z.string().nullable(),
+	position: z.int().positive(),
+	since: z.iso.datetime(),
+	taskId: z.string().nullable()
+}).meta({ id: "SessionQueueEntry" });
+const sessionPoolSchema = z.object({
+	slots: sessionSlotCountSchema.nullable(),
+	effective: z.int().nonnegative(),
+	inUse: z.int().nonnegative(),
+	waiting: z.array(sessionQueueEntrySchema)
+}).meta({ id: "SessionPool" });
+z.object({
+	version: z.int().nonnegative(),
+	ready: z.boolean(),
+	monitor: sessionPoolSchema,
+	executor: sessionPoolSchema
+}).meta({ id: "SessionSlots" });
+z.object({
+	version: z.int().nonnegative(),
+	monitor: sessionSlotCountSchema.nullable(),
+	executor: sessionSlotCountSchema.nullable()
+}).meta({ id: "UpdateSessionSlotsBody" });
+const agentAdmissionStateSchema = z.discriminatedUnion("state", [z.object({
+	state: z.literal("waiting"),
+	since: z.iso.datetime(),
+	position: z.int().positive()
+}), z.object({ state: z.literal("holding") })]).meta({ id: "AgentAdmissionState" });
+const agentAdmissionSchema = z.object({
+	monitor: agentAdmissionStateSchema.nullable(),
+	executor: agentAdmissionStateSchema.nullable()
+}).meta({ id: "AgentAdmission" });
 const nodeStateSchema = z.enum([
 	"pending",
 	"online",
@@ -1415,10 +1479,73 @@ const nodeHostSchema = z.object({
 	dataRoot: z.string(),
 	serverVersion: z.string()
 }).meta({ id: "NodeHost" });
+const nodeCapabilityNames = [
+	"linux",
+	"windows",
+	"docker",
+	"isolation",
+	"gpu",
+	"desktop"
+];
+const nodeCapabilitySchema = z.enum(nodeCapabilityNames).meta({ id: "NodeCapability" });
 const nodeCapabilitiesSchema = z.object({
 	sandbox: z.boolean(),
-	uidIsolation: z.boolean()
+	uidIsolation: z.boolean(),
+	offered: z.array(nodeCapabilitySchema).optional()
 }).meta({ id: "NodeCapabilities" });
+const minPoolCpus = .1;
+const maxSplitCpus = 1024;
+const maxSplitMemoryMb = 16777216;
+const hundredths = (value) => Math.abs(Math.round(value * 100) - value * 100) < 1e-9;
+const splitCpusSchema = (min) => z.number().min(min).max(maxSplitCpus).refine(hundredths, { message: "expected at most two decimal places" });
+const splitMemorySchema = (min) => z.int().min(min).max(maxSplitMemoryMb);
+const nodeReserveSchema = z.object({
+	cpus: splitCpusSchema(0),
+	memoryMb: splitMemorySchema(0)
+}).meta({ id: "NodeReserve" });
+const nodePoolSplitSchema = z.object({
+	cpus: splitCpusSchema(minPoolCpus),
+	memoryMb: splitMemorySchema(256),
+	slots: z.int().min(1).max(64)
+}).meta({ id: "NodePoolSplit" });
+const nodeSplitSchema = z.object({
+	reserve: nodeReserveSchema,
+	monitor: nodePoolSplitSchema,
+	executor: nodePoolSplitSchema
+}).meta({ id: "NodeSplit" });
+const poolLimitSchema = z.object({
+	enforced: z.boolean(),
+	reason: z.enum([
+		"release",
+		"restart",
+		"node"
+	]).nullable()
+}).meta({ id: "PoolLimit" });
+const poolEnforcementSchema = z.object({
+	state: z.enum([
+		"enforced",
+		"unsplit",
+		"unsupported"
+	]),
+	reason: z.string().nullable()
+}).meta({ id: "PoolEnforcement" });
+const poolUsageSchema = z.object({
+	memoryBytes: z.int().nonnegative(),
+	memoryMaxBytes: z.int().nonnegative().nullable(),
+	cpus: z.number().nonnegative().nullable(),
+	memoryKills: z.int().nonnegative()
+}).meta({ id: "PoolUsage" });
+const nodePoolSchema = z.object({
+	slots: z.int().nonnegative(),
+	inUse: z.int().nonnegative(),
+	waiting: z.array(sessionQueueEntrySchema),
+	usage: poolUsageSchema.nullable()
+}).meta({ id: "NodePool" });
+const nodePoolsSchema = z.object({
+	enforcement: poolEnforcementSchema,
+	monitor: nodePoolSchema,
+	executor: nodePoolSchema
+}).meta({ id: "NodePools" });
 const nodeSchema = z.object({
 	id: idSchema,
 	name: nodeNameSchema,
@@ -1428,6 +1555,9 @@ const nodeSchema = z.object({
 	version: z.string().nullable(),
 	host: nodeHostSchema.nullable(),
 	capabilities: nodeCapabilitiesSchema.nullable(),
+	offered: z.array(nodeCapabilitySchema),
+	split: nodeSplitSchema.nullable(),
+	revision: z.int().nonnegative(),
 	agentCount: z.int().nonnegative(),
 	connectedAt: z.iso.datetime().nullable(),
 	lastSeenAt: z.iso.datetime().nullable(),
@@ -1440,7 +1570,8 @@ const nodeAgentSchema = z.object({
 	slug: z.string(),
 	projectId: idSchema,
 	projectName: z.string(),
-	state: agentStateSchema
+	state: agentStateSchema,
+	poolLimit: poolLimitSchema.nullable()
 }).meta({ id: "NodeAgent" });
 const nodeRuntimeSchema = z.object({
 	reportedAt: z.iso.datetime(),
@@ -1473,7 +1604,8 @@ const nodeRuntimeSchema = z.object({
 			effective: z.int().nonnegative(),
 			inUse: z.int().nonnegative()
 		})
-	})
+	}),
+	pools: nodePoolsSchema
 }).meta({ id: "NodeRuntime" });
 nodeSchema.extend({
 	agents: z.array(nodeAgentSchema),
@@ -1485,6 +1617,10 @@ z.object({
 	organizationId: idSchema,
 	nodeId: idSchema
 });
+z.object({
+	revision: z.int().nonnegative(),
+	split: nodeSplitSchema.nullable()
+}).meta({ id: "UpdateNodeSplitBody" });
 const createNodeBodySchema = z.object({ name: nodeNameSchema }).meta({ id: "CreateNodeBody" });
 const nodeRegistrationSchema = z.object({
 	token: z.string(),
@@ -1505,6 +1641,21 @@ z.object({
 	nodeId: idSchema,
 	credential: z.string()
 }).meta({ id: "RegisteredNode" });
+const bytesPerMegabyte = 1048576;
+const inHundredths = (value) => Math.round(value * 100);
+const hostMemoryMbOf = (host) => Math.floor(host.memoryBytes / bytesPerMegabyte);
+const splitOverflowOf = (split, host) => {
+	const cpus = inHundredths(split.reserve.cpus) + inHundredths(split.monitor.cpus) + inHundredths(split.executor.cpus) - inHundredths(host.cpus);
+	const memoryMb = split.reserve.memoryMb + split.monitor.memoryMb + split.executor.memoryMb - hostMemoryMbOf(host);
+	return {
+		cpus: cpus / 100,
+		memoryMb
+	};
+};
+const splitFits = (split, host) => {
+	const overflow = splitOverflowOf(split, host);
+	return overflow.cpus <= 0 && overflow.memoryMb <= 0;
+};
 //#endregion
 //#region ../../packages/contracts/src/identity.ts
 const emailSchema = z.email().max(254);
@@ -1692,6 +1843,7 @@ const auditActionSchema = z.enum([
 	"node.registered",
 	"node.registration_renewed",
 	"node.deleted",
+	"node.split_changed",
 	"master_key.reencrypted",
 	"dead_letter.retried",
 	"dead_letter.discarded"
@@ -1785,43 +1937,6 @@ z.object({
 	id: idSchema,
 	userId: idSchema
 });
-z.enum(["monitor", "executor"]);
-const sessionSlotCountSchema = z.int().min(1).max(64);
-const sessionQueueEntrySchema = z.object({
-	agentId: idSchema,
-	agentName: z.string().nullable(),
-	projectId: idSchema.nullable(),
-	projectName: z.string().nullable(),
-	position: z.int().positive(),
-	since: z.iso.datetime(),
-	taskId: z.string().nullable()
-}).meta({ id: "SessionQueueEntry" });
-const sessionPoolSchema = z.object({
-	slots: sessionSlotCountSchema.nullable(),
-	effective: z.int().nonnegative(),
-	inUse: z.int().nonnegative(),
-	waiting: z.array(sessionQueueEntrySchema)
-}).meta({ id: "SessionPool" });
-z.object({
-	version: z.int().nonnegative(),
-	ready: z.boolean(),
-	monitor: sessionPoolSchema,
-	executor: sessionPoolSchema
-}).meta({ id: "SessionSlots" });
-z.object({
-	version: z.int().nonnegative(),
-	monitor: sessionSlotCountSchema.nullable(),
-	executor: sessionSlotCountSchema.nullable()
-}).meta({ id: "UpdateSessionSlotsBody" });
-const agentAdmissionStateSchema = z.discriminatedUnion("state", [z.object({
-	state: z.literal("waiting"),
-	since: z.iso.datetime(),
-	position: z.int().positive()
-}), z.object({ state: z.literal("holding") })]).meta({ id: "AgentAdmissionState" });
-const agentAdmissionSchema = z.object({
-	monitor: agentAdmissionStateSchema.nullable(),
-	executor: agentAdmissionStateSchema.nullable()
-}).meta({ id: "AgentAdmission" });
 //#endregion
 //#region ../../packages/contracts/src/releases.ts
 const kikimoraVersionSchema = z.string().regex(versionTagPattern);
@@ -2215,7 +2330,8 @@ const agentRuntimeSchema = z.object({
 	provision: agentProvisionSchema.nullable(),
 	stopMode: agentStopModeSchema.nullable(),
 	stopDeadlineAt: z.iso.datetime().nullable(),
-	admission: agentAdmissionSchema.nullable()
+	admission: agentAdmissionSchema.nullable(),
+	poolLimit: poolLimitSchema.nullable()
 }).meta({ id: "AgentRuntime" });
 const agentListItemSchema = z.object({
 	id: idSchema,
@@ -2254,6 +2370,7 @@ agentListItemSchema.extend({
 	release: releaseSummarySchema.nullable(),
 	runtime: agentRuntimeSchema,
 	node: agentNodeSchema.nullable(),
+	requiredCapabilities: z.array(nodeCapabilitySchema),
 	runtimeUid: z.int().positive().nullable(),
 	sandbox: agentSandboxSchema.nullable(),
 	createdAt: z.iso.datetime()
@@ -2271,12 +2388,15 @@ const distinctCredentials = {
 const hasUniqueTools = (assignments) => new Set(assignments.map((assignment) => assignment.toolId)).size === assignments.length;
 const agentRepositoryLinksSchema = z.array(agentRepositoryLinkSchema).min(1).max(32);
 const agentToolAssignmentsSchema = z.array(toolAssignmentSchema).max(32).refine(hasUniqueTools, { message: "expected every tool to be assigned once" });
+const hasUniqueCapabilities = (names) => new Set(names).size === names.length;
+const requiredCapabilitiesSchema = z.array(nodeCapabilitySchema).max(nodeCapabilityNames.length).refine(hasUniqueCapabilities, { message: "expected every capability once" });
 const createAgentBodySchema = z.object({
 	name: agentNameSchema,
 	slug: slugSchema.optional(),
 	description: agentDescriptionSchema,
 	kikimoraVersion: kikimoraVersionSchema,
 	nodeId: idSchema,
+	requiredCapabilities: requiredCapabilitiesSchema.optional(),
 	claudeCredentialId: idSchema,
 	githubCredentialId: idSchema,
 	repositories: agentRepositoryLinksSchema,
@@ -3554,6 +3674,7 @@ const agentHints = {
 	"agent.invalid_transition": "kcloud agents show <agent> lists the actions it takes now.",
 	"agent.busy": "The agent is working on another action; try again in a moment.",
 	"concurrency.conflict": "Someone changed the agent meanwhile; read it again and retry.",
+	"agent.node_unsuitable": "The node lacks a capability the agent requires; kcloud nodes show <node> lists what it offers.",
 	"node.offline": "The node of the agent is not connected; kcloud nodes show <node> tells when it was last seen."
 };
 const agentFrom = async (run, reference, project) => {
@@ -3627,6 +3748,86 @@ const confirmed = async ({ prompt, settings, question }) => {
 	})) throw new CancelledError("Nothing was changed.");
 };
 //#endregion
+//#region src/commands/nodes/pools.ts
+const poolLimitReasons = {
+	release: "its Kikimora release predates pool limits",
+	restart: "it started before the limits applied; kcloud agents restart applies them",
+	node: "its node holds no pool to a limit"
+};
+const poolLimitText = (limit) => {
+	if (limit === null) return "-";
+	if (limit.enforced) return "enforced";
+	return limit.reason === null ? "none" : `none: ${poolLimitReasons[limit.reason]}`;
+};
+const sessionFailures = {
+	poolMemoryLimit: "killed by the pool memory limit",
+	launcherRefused: "refused by the session starter"
+};
+const sessionFailureText = (reason) => reason === null ? "-" : sessionFailures[reason] ?? reason;
+const unsupportedReasons = { node_outdated: "the node runs a version that reports no pools" };
+const enforcementText = ({ state, reason }) => {
+	switch (state) {
+		case "enforced": return "The node holds each pool to the CPU and memory of its split.";
+		case "unsplit": return "The node has no split, so no pool has a hard limit on CPU or memory.";
+		case "unsupported": return `The node holds no pool to a limit: ${reason === null ? "it cannot" : unsupportedReasons[reason] ?? reason}.`;
+	}
+};
+const memoryOf = (pool) => {
+	if (pool.usage === null) return "-";
+	const { memoryBytes, memoryMaxBytes } = pool.usage;
+	return memoryMaxBytes === null ? bytesOf(memoryBytes) : `${bytesOf(memoryBytes)} of ${bytesOf(memoryMaxBytes)}`;
+};
+const roles = ["monitor", "executor"];
+const queueOf = (pools) => {
+	const waiting = roles.flatMap((role) => pools[role].waiting.map((entry) => [
+		role,
+		String(entry.position),
+		entry.projectName ?? "-",
+		entry.agentName ?? entry.agentId,
+		entry.since,
+		entry.taskId ?? "-"
+	]));
+	return waiting.length === 0 ? "No session waits for a slot." : renderTable([
+		{ header: "WAITS FOR" },
+		{
+			header: "PLACE",
+			align: "right"
+		},
+		{ header: "PROJECT" },
+		{ header: "AGENT" },
+		{ header: "SINCE" },
+		{ header: "TASK" }
+	], waiting);
+};
+const poolsText = (pools) => [
+	enforcementText(pools.enforcement),
+	renderTable([
+		{ header: "POOL" },
+		{ header: "SLOTS IN USE" },
+		{
+			header: "CPU IN USE",
+			align: "right"
+		},
+		{ header: "MEMORY IN USE" },
+		{
+			header: "MEMORY KILLS",
+			align: "right"
+		}
+	], roles.map((role) => {
+		const pool = pools[role];
+		const cpus = pool.usage?.cpus ?? null;
+		return [
+			role,
+			`${pool.inUse} of ${pool.slots}`,
+			cpus === null ? "-" : cpus.toFixed(2),
+			memoryOf(pool),
+			pool.usage === null ? "-" : String(pool.usage.memoryKills)
+		];
+	})),
+	"",
+	queueOf(pools)
+].join("\n");
+//#endregion
 //#region src/commands/agents/plan.ts
 const agentPlanOf = (agent) => ({
 	name: agent.name,
@@ -3634,6 +3835,7 @@ const agentPlanOf = (agent) => ({
 	description: agent.description,
 	kikimoraVersion: agent.kikimoraVersion,
 	...agent.node === null ? {} : { nodeId: agent.node.id },
+	requiredCapabilities: agent.requiredCapabilities,
 	claudeCredentialId: agent.claudeCredential.id,
 	githubCredentialId: agent.githubCredential.id,
 	repositories: agent.repositories.map(({ repositoryId, directory }) => ({
@@ -3804,6 +4006,7 @@ const admissionRowsOf = (agent) => {
 	const { admission } = agent.runtime;
 	return admission === null ? [] : [["monitor slot", slotOf(admission.monitor)], ["executor slot", slotOf(admission.executor)]];
 };
+const poolLimitRowsOf = ({ runtime }) => runtime.poolLimit === null ? [] : [["pool limit", poolLimitText(runtime.poolLimit)]];
 const detailsOf = (agent) => [
 	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
 		["name", agent.name],
@@ -3813,6 +4016,7 @@ const detailsOf = (agent) => [
 		["observed", agent.observedState],
 		["release", agent.kikimoraVersion],
 		["node", agent.node === null ? "none" : `${agent.node.name} (${agent.node.state})`],
+		["requires", agent.requiredCapabilities.length === 0 ? "nothing" : agent.requiredCapabilities.join(", ")],
 		["timezone", agent.timezone],
 		["machine", `${agent.machine.cpus} vCPU, ${agent.machine.memoryMb} MB`],
 		["docker", agent.machine.docker ? "yes" : "no"],
@@ -3820,6 +4024,7 @@ const detailsOf = (agent) => [
 		["container", agent.runtime.containerId ?? "none"],
 		["health", agent.runtime.health],
 		...admissionRowsOf(agent),
+		...poolLimitRowsOf(agent),
 		["pending", agent.restartRequired ? agent.restartReasons.join(", ") : "-"],
 		["actions", agent.availableActions.join(", ")],
 		["version", String(agent.version)],
@@ -3837,7 +4042,7 @@ const detailsOf = (agent) => [
 	]))
 ].join("\n");
 //#endregion
-//#region src/commands/nodes.ts
+//#region src/commands/nodes/shared.ts
 const nodeHints = {
 	...organizationHints,
 	"node.not_found": "kcloud nodes list shows the nodes of the organization.",
@@ -3845,6 +4050,13 @@ const nodeHints = {
 	"node.in_use": "Delete the agents placed on it first; kcloud nodes show <node> lists them.",
 	"node.registration_used": "The node has joined and holds its own credential; it needs no token."
 };
+const splitHints = {
+	...nodeHints,
+	"auth.forbidden": "Splitting a node takes an admin of its organization.",
+	"node.host_unknown": "The node reports its CPUs and memory once its service runs; kcloud nodes show <node> shows its state.",
+	"node.split_exceeds_host": "The split asks for more than the host has; kcloud nodes split <node> shows the host.",
+	"concurrency.conflict": "Someone changed the node meanwhile; run the command again."
+};
 const nodesOf = async (api, organizationId) => dataOf("list the nodes", await api.GET("/organizations/{organizationId}/nodes", { params: { path: { organizationId } } }), nodeHints).items;
 const namesOf = (nodes) => nodes.map(({ name }) => name).join(", ");
 const nodeIn = (nodes, reference, organization) => {
@@ -3886,221 +4098,51 @@ const deleteNode = async (api, { organizationId, nodeId }) => {
 		nodeId
 	} } }), nodeHints);
 };
-const gibibytes = (bytes) => `${(bytes / 1024 ** 3).toFixed(1)} GiB`;
-const hostOf = (node) => node.host === null ? "-" : `${node.host.cpus} CPU, ${gibibytes(node.host.memoryBytes)} of memory`;
-const capabilitiesOf = (node) => {
-	if (node.capabilities === null) return "-";
-	const { sandbox, uidIsolation } = node.capabilities;
-	return `sandbox ${sandbox ? "yes" : "no"}, uid isolation ${uidIsolation ? "yes" : "no"}`;
+const splitNode = async (api, { organizationId, nodeId }, revision, split) => dataOf(split === null ? "clear the split of the node" : "split the node", await api.PUT("/organizations/{organizationId}/nodes/{nodeId}/split", {
+	params: { path: {
+		organizationId,
+		nodeId
+	} },
+	body: {
+		revision,
+		split
+	}
+}), splitHints);
+const nodeUsage = [["", "a node is named by its name or its id"]];
+//#endregion
+//#region src/commands/projects/shared.ts
+const defaultProjectColor = "#7c86ff";
+const projectHint = {
+	"project.not_found": "kcloud projects list shows the projects you are a member of.",
+	"project.slug_taken": "Another project of the organization has that slug.",
+	"project.invalid_slug": "A slug holds lowercase letters, digits and hyphens.",
+	"project.not_empty": "Delete its agents, credentials, repositories and tools first.",
+	"project.member_not_found": "kcloud projects members list <project> shows them.",
+	"project.member_must_be_active": "kcloud orgs members enable <member> enables the account first."
 };
-const registrationOf = (node) => node.registrationExpiresAt === null ? "-" : `a token waits until ${node.registrationExpiresAt}`;
-const storageOf = ({ state, freeBytes, totalBytes, path }) => `${state}, ${gibibytes(freeBytes)} free of ${gibibytes(totalBytes)} at ${path}`;
-const runtimeRowsOf = (runtime) => [
-	["reported", runtime.reportedAt],
-	["docker", runtime.docker.lastError === null ? runtime.docker.state : `${runtime.docker.state}: ${runtime.docker.lastError}`],
-	["data storage", storageOf(runtime.storage.data)],
-	["engine storage", storageOf(runtime.storage.engine)],
-	["last reconcile", runtime.reconcile.lastTickError === null ? runtime.reconcile.lastTickAt ?? "never" : `${runtime.reconcile.lastTickAt ?? "never"}: ${runtime.reconcile.lastTickError}`],
-	["agents", `${runtime.reconcile.agentsActive} active, ${runtime.reconcile.agentsQueued} queued`],
-	["monitor slots", `${runtime.sessions.monitor.inUse} of ${runtime.sessions.monitor.effective} in use`],
-	["executor slots", `${runtime.sessions.executor.inUse} of ${runtime.sessions.executor.effective} in use`],
-	["log readers", String(runtime.ingest.readers)]
-];
-const nodeDetailsText = (node) => [
-	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
-		["name", node.name],
-		["state", node.state],
-		["provider", node.provider],
-		["engine", node.engine ?? "-"],
-		["version", node.version ?? "-"],
-		["host", hostOf(node)],
-		["server", node.host?.serverVersion ?? "-"],
-		["data root", node.host?.dataRoot ?? "-"],
-		["capabilities", capabilitiesOf(node)],
-		["registration", registrationOf(node)],
-		["connected", node.connectedAt ?? "never"],
-		["last seen", node.lastSeenAt ?? "never"],
-		["created", node.createdAt],
-		["id", node.id]
-	]),
-	"",
-	node.agents.length === 0 ? "No agent is placed on the node." : renderTable([
-		{ header: "PROJECT" },
-		{ header: "AGENT" },
-		{ header: "STATE" },
-		{ header: "ID" }
-	], node.agents.map((agent) => [
-		agent.projectName,
-		agent.slug,
-		agent.state,
-		agent.id
-	])),
-	"",
-	node.runtime === null ? "The node has reported no runtime yet." : renderTable([{ header: "RUNTIME" }, { header: "VALUE" }], runtimeRowsOf(node.runtime))
-].join("\n");
-const startHintOf = (origin) => [
-	"Start the node with it as docs/install.md of kikimora-cloud describes. On a Linux host, after read -rs token:",
-	`  printf '%s\\n' "$token" | /opt/kikimora-cloud/infra/node/install.sh --platform-url ${origin} --image ghcr.io/kikimoradev/kikimora-cloud/node:<version> --registration-token -`,
-	"On a Windows PC:",
-	`  C:\\kikimora-cloud\\src\\infra\\windows\\install.ps1 -PlatformUrl ${origin} -RegistrationToken <token>`
-].join("\n");
-const printedRegistration = (run, created) => {
-	if (run.settings.json) {
-		run.context.terminal.json(created);
-		return exitCodes.ok;
+const projectOf = async (api, id) => dataOf("describe the project", await api.GET("/projects/{id}", { params: { path: { id } } }), projectHint);
+//#endregion
+//#region src/commands/agents/placement.ts
+const placedNodeId = async (run, { projectId, given, ask }) => {
+	const project = await projectOf(run.api, projectId);
+	const organization = `the organization of ${project.slug}`;
+	const nodes = await nodesOf(run.api, project.organizationId);
+	if (given !== void 0) return nodeIn(nodes, given, organization).id;
+	const [only, ...others] = nodes;
+	if (only === void 0) throw new CliError(`The organization of ${project.slug} has no node to run the agent on.`, "kcloud nodes create <name> creates one, and its host joins with the token it prints.");
+	if (others.length === 0) {
+		run.context.terminal.error(`The agent runs on ${only.name}, the only node of ${organization}.`);
+		return only.id;
 	}
-	run.context.terminal.line(created.registration.token);
-	run.context.terminal.error([`The registration token of ${created.node.name} is shown only here and works once, until ${created.registration.expiresAt}.`, startHintOf(run.origin)].join("\n"));
-	return exitCodes.ok;
-};
-const nodeUsage = [["", "a node is named by its name or its id"]];
-const createNodesCommand = (adaptersOf) => defineGroup({
-	name: "nodes",
-	summary: "The nodes of the organization, the hosts its agents run on.",
-	usage: "nodes <command>",
-	subcommands: [
-		defineCommand({
-			name: "list",
-			summary: "List the nodes of the organization.",
-			usage: "nodes list",
-			options: {},
-			positionals: {
-				min: 0,
-				max: 0
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const organization = await run.organization();
-				const items = await nodesOf(run.api, organization.id);
-				return printed(run, items, (nodes) => nodes.length === 0 ? `${organization.slug} has no node yet; kcloud nodes create <name> creates one.` : renderTable([
-					{ header: "NAME" },
-					{ header: "STATE" },
-					{ header: "ENGINE" },
-					{ header: "VERSION" },
-					{
-						header: "AGENTS",
-						align: "right"
-					},
-					{ header: "LAST SEEN" },
-					{ header: "ID" }
-				], nodes.map((node) => [
-					node.name,
-					node.state,
-					node.engine ?? "-",
-					node.version ?? "-",
-					String(node.agentCount),
-					node.lastSeenAt ?? "never",
-					node.id
-				])));
-			}
-		}),
-		defineCommand({
-			name: "show",
-			summary: "Show a node with its host, the agents placed on it and its runtime.",
-			usage: "nodes show <node>",
-			optionsUsage: nodeUsage,
-			options: {},
-			positionals: {
-				min: 1,
-				max: 1
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const reference = await resolveNode(run, invocation.positionals[0] ?? "");
-				return printed(run, await nodeDetailOf(run.api, reference), nodeDetailsText);
-			}
-		}),
-		defineCommand({
-			name: "create",
-			summary: "Create a node and print its one-time registration token.",
-			usage: "nodes create <name>",
-			optionsUsage: [["", "the name holds lowercase letters, digits and hyphens"], ["", "the token goes to stdout alone, how to start the node to stderr"]],
-			options: {},
-			positionals: {
-				min: 1,
-				max: 1
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const organization = await run.organization();
-				return printedRegistration(run, await createdNode(run.api, organization.id, invocation.positionals[0] ?? ""));
-			}
-		}),
-		defineCommand({
-			name: "token",
-			summary: "Issue a new registration token for a node that has not joined yet.",
-			usage: "nodes token <node>",
-			optionsUsage: [...nodeUsage, ["", "the token replaces the one issued before, which stops working"]],
-			options: {},
-			positionals: {
-				min: 1,
-				max: 1
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const reference = await resolveNode(run, invocation.positionals[0] ?? "");
-				return printedRegistration(run, await renewedRegistration(run.api, reference));
-			}
-		}),
-		defineCommand({
-			name: "delete",
-			summary: "Delete a node that runs no agent.",
-			usage: "nodes delete <node>",
-			optionsUsage: nodeUsage,
-			options: {},
-			positionals: {
-				min: 1,
-				max: 1
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const given = invocation.positionals[0] ?? "";
-				const reference = await resolveNode(run, given);
-				await confirmed({
-					prompt: run.prompt,
-					settings: run.settings,
-					question: `Delete the node ${given}? Its host can no longer reach the platform.`
-				});
-				await deleteNode(run.api, reference);
-				return said(run, `Deleted the node ${given}.`);
-			}
-		})
-	]
-});
-//#endregion
-//#region src/commands/projects/shared.ts
-const defaultProjectColor = "#7c86ff";
-const projectHint = {
-	"project.not_found": "kcloud projects list shows the projects you are a member of.",
-	"project.slug_taken": "Another project of the organization has that slug.",
-	"project.invalid_slug": "A slug holds lowercase letters, digits and hyphens.",
-	"project.not_empty": "Delete its agents, credentials, repositories and tools first.",
-	"project.member_not_found": "kcloud projects members list <project> shows them.",
-	"project.member_must_be_active": "kcloud orgs members enable <member> enables the account first."
-};
-const projectOf = async (api, id) => dataOf("describe the project", await api.GET("/projects/{id}", { params: { path: { id } } }), projectHint);
-//#endregion
-//#region src/commands/agents/placement.ts
-const placedNodeId = async (run, { projectId, given, ask }) => {
-	const project = await projectOf(run.api, projectId);
-	const organization = `the organization of ${project.slug}`;
-	const nodes = await nodesOf(run.api, project.organizationId);
-	if (given !== void 0) return nodeIn(nodes, given, organization).id;
-	const [only, ...others] = nodes;
-	if (only === void 0) throw new CliError(`The organization of ${project.slug} has no node to run the agent on.`, "kcloud nodes create <name> creates one, and its host joins with the token it prints.");
-	if (others.length === 0) {
-		run.context.terminal.error(`The agent runs on ${only.name}, the only node of ${organization}.`);
-		return only.id;
-	}
-	if (ask) return run.prompt.select({
-		message: "The node it runs on",
-		choices: nodes.map((node) => ({
-			value: node.id,
-			label: node.name,
-			hint: node.state
-		}))
-	});
-	throw new UsageError(`agents create needs --node <name>, because ${organization} has ${nodes.length} nodes.`, `The nodes are ${nodes.map(({ name }) => name).join(", ")}.`);
+	if (ask) return run.prompt.select({
+		message: "The node it runs on",
+		choices: nodes.map((node) => ({
+			value: node.id,
+			label: node.name,
+			hint: node.state
+		}))
+	});
+	throw new UsageError(`agents create needs --node <name>, because ${organization} has ${nodes.length} nodes.`, `The nodes are ${nodes.map(({ name }) => name).join(", ")}.`);
 };
 //#endregion
 //#region src/commands/agents/create.ts
@@ -4204,8 +4246,16 @@ const promptText = async (run, file, question) => {
 		validate: (value) => value.trim() === "" ? "cannot be empty" : void 0
 	});
 };
+const isCapability = (name) => nodeCapabilityNames.some((capability) => capability === name);
+const requiredCapabilitiesOf = (given) => {
+	const names = given.flatMap((value) => value.split(",")).map((name) => name.trim()).filter((name) => name !== "");
+	const unknown = names.filter((name) => !isCapability(name));
+	if (unknown.length > 0) throw new UsageError(`--require ${unknown.join(", ")} ${unknown.length === 1 ? "is not a capability" : "are not capabilities"} of a node.`, `The capabilities are ${nodeCapabilityNames.join(", ")}.`);
+	return [...new Set(names.filter(isCapability))];
+};
+const requirementOf = (required) => required === void 0 ? {} : { requiredCapabilities: [...required] };
 const localTimezone = () => Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
-const askedPlan = async (run, projectId, values) => {
+const askedPlan = async (run, projectId, values, required) => {
 	const nodeId = await placedNodeId(run, {
 		projectId,
 		given: values.node,
@@ -4229,6 +4279,7 @@ const askedPlan = async (run, projectId, values) => {
 		description: "",
 		kikimoraVersion: release,
 		nodeId,
+		...requirementOf(required),
 		claudeCredentialId: await chosenCredential(run.prompt, catalogue, (kind) => claudeKinds.has(kind), "The Claude credential it works with"),
 		githubCredentialId: await chosenCredential(run.prompt, catalogue, (kind) => kind === "github_pat", "The GitHub credential it clones with"),
 		repositories: [...await chosenRepositories(run.prompt, catalogue)],
@@ -4248,7 +4299,7 @@ const askedPlan = async (run, projectId, values) => {
 	};
 };
 const isObject = (document) => typeof document === "object" && document !== null && !Array.isArray(document);
-const fileOf = async (run, projectId, { file, node }) => {
+const fileOf = async (run, projectId, { file, node }, required) => {
 	const document = await documentOf(run, file);
 	const placed = !isObject(document) || node === void 0 && "nodeId" in document ? document : {
 		...document,
@@ -4258,16 +4309,21 @@ const fileOf = async (run, projectId, { file, node }) => {
 			ask: false
 		})
 	};
-	validated(createAgentBodySchema, placed, "an agent");
-	return placed;
+	const plan = isObject(placed) ? {
+		...placed,
+		...requirementOf(required)
+	} : placed;
+	validated(createAgentBodySchema, plan, "an agent");
+	return plan;
 };
 const createCommand = (adaptersOf) => defineCommand({
 	name: "create",
 	summary: "Create an agent from a file, from flags, or by asking step by step.",
-	usage: "agents create --project <name> [--node <node>] [--file <path>] [--name <name>]",
+	usage: "agents create --project <name> [--node <node>] [--require <capability,...>] [--file <path>] [--name <name>]",
 	optionsUsage: [
 		["--project <name>", "the project that owns the agent"],
 		["--node <node>", "the node it runs on, by name or id; needed when the organization has several"],
+		["--require <capability,...>", `what its node has to offer: ${nodeCapabilityNames.join(", ")}`],
 		["--file <path>", "the whole agent as JSON, or - to read stdin"],
 		["--name <name>", "the name of the agent, instead of asking"],
 		["--release <x.y.z>", "the Kikimora release it runs, instead of asking"],
@@ -4277,12 +4333,16 @@ const createCommand = (adaptersOf) => defineCommand({
 		["--docker", "give the agent a Docker sidecar, when the project allows it"],
 		["--browser", "give the agent a browser"],
 		["", "kcloud agents show <agent> --as-file prints what --file takes"],
-		["", "--node replaces the nodeId of the file"]
+		["", "--node and --require replace the nodeId and requiredCapabilities of the file"]
 	],
 	options: {
 		...fileOptions,
 		project: { type: "string" },
 		node: { type: "string" },
+		require: {
+			type: "string",
+			multiple: true
+		},
 		name: { type: "string" },
 		release: { type: "string" },
 		"monitor-prompt-file": { type: "string" },
@@ -4303,13 +4363,14 @@ const createCommand = (adaptersOf) => defineCommand({
 	},
 	run: async (invocation) => {
 		const { values } = invocation;
+		const required = values.require === void 0 ? void 0 : requiredCapabilitiesOf(values.require);
 		const run = await runOf(adaptersOf, invocation);
 		if (values.project === void 0) throw new UsageError("agents create needs --project <name>.", "kcloud projects list shows the projects you are a member of.");
 		const projectId = await resolveProjectId(run, values.project);
-		const body = values.file === void 0 ? await askedPlan(run, projectId, values) : await fileOf(run, projectId, {
+		const body = values.file === void 0 ? await askedPlan(run, projectId, values, required) : await fileOf(run, projectId, {
 			file: values.file,
 			node: values.node
-		});
+		}, required);
 		const agent = dataOf("create the agent", await run.api.POST("/projects/{id}/agents", {
 			params: { path: { id: projectId } },
 			body
@@ -4488,6 +4549,7 @@ const observabilityCommands = (adaptersOf) => [
 				{ header: "ROLE" },
 				{ header: "MODEL" },
 				{ header: "OUTCOME" },
+				{ header: "FAILURE" },
 				{
 					header: "COST",
 					align: "right"
@@ -4498,6 +4560,7 @@ const observabilityCommands = (adaptersOf) => [
 				session.agentRole ?? "-",
 				session.model ?? "-",
 				session.ok === null ? "running" : session.ok ? "ok" : "failed",
+				sessionFailureText(session.failureReason),
 				session.costUsd === null ? "-" : session.costUsd.toFixed(2),
 				session.sessionId
 			])));
@@ -5629,7 +5692,7 @@ const agentTools = [
 	defineTool({
 		name: "agent_create",
 		title: "Create an agent",
-		description: "Create an agent in a project. The node it runs on, the credentials, repositories and tools are named by the ids that nodes_list, credentials_list, repositories_list and tools_list return; agent_show with asPlan shows a complete example. The agent stays stopped until agent_action starts it.",
+		description: "Create an agent in a project. The node it runs on, the credentials, repositories and tools are named by the ids that nodes_list, credentials_list, repositories_list and tools_list return; agent_show with asPlan shows a complete example. requiredCapabilities names what the node has to offer, from the offered list of nodes_list; the instance refuses a node that lacks one. The agent stays stopped until agent_action starts it.",
 		operations: ["createAgent"],
 		safety: "write",
 		input: z.object({
@@ -5794,13 +5857,325 @@ const credentialTools = [
 	})
 ];
 //#endregion
+//#region src/commands/nodes/split.ts
+const splitFields = [
+	"reserve.cpus",
+	"reserve.memoryMb",
+	"monitor.cpus",
+	"monitor.memoryMb",
+	"monitor.slots",
+	"executor.cpus",
+	"executor.memoryMb",
+	"executor.slots"
+];
+const valuesOf = (split) => ({
+	"reserve.cpus": split.reserve.cpus,
+	"reserve.memoryMb": split.reserve.memoryMb,
+	"monitor.cpus": split.monitor.cpus,
+	"monitor.memoryMb": split.monitor.memoryMb,
+	"monitor.slots": split.monitor.slots,
+	"executor.cpus": split.executor.cpus,
+	"executor.memoryMb": split.executor.memoryMb,
+	"executor.slots": split.executor.slots
+});
+const splitOf = (values) => ({
+	reserve: {
+		cpus: values["reserve.cpus"],
+		memoryMb: values["reserve.memoryMb"]
+	},
+	monitor: {
+		cpus: values["monitor.cpus"],
+		memoryMb: values["monitor.memoryMb"],
+		slots: values["monitor.slots"]
+	},
+	executor: {
+		cpus: values["executor.cpus"],
+		memoryMb: values["executor.memoryMb"],
+		slots: values["executor.slots"]
+	}
+});
+const isComplete = (values) => splitFields.every((field) => values[field] !== void 0);
+const changeOfParts = ({ reserve, monitor, executor }) => {
+	const given = {
+		"reserve.cpus": reserve?.cpus,
+		"reserve.memoryMb": reserve?.memoryMb,
+		"monitor.cpus": monitor?.cpus,
+		"monitor.memoryMb": monitor?.memoryMb,
+		"monitor.slots": monitor?.slots,
+		"executor.cpus": executor?.cpus,
+		"executor.memoryMb": executor?.memoryMb,
+		"executor.slots": executor?.slots
+	};
+	return Object.fromEntries(Object.entries(given).filter((entry) => entry[1] !== void 0));
+};
+const cpusText = (cpus) => String(Math.round(cpus * 100) / 100);
+const hostText = (host) => `${cpusText(host.cpus)} CPU and ${hostMemoryMbOf(host)} MB`;
+const excessText = ({ cpus, memoryMb }) => [...cpus > 0 ? [`${cpusText(cpus)} CPU`] : [], ...memoryMb > 0 ? [`${memoryMb} MB`] : []].join(" and ");
+const fittingSplit = (node, change, nameOf) => {
+	const merged = {
+		...node.split === null ? {} : valuesOf(node.split),
+		...change
+	};
+	if (!isComplete(merged)) {
+		const missing = splitFields.filter((field) => merged[field] === void 0);
+		throw new UsageError(`${node.name} has no split yet, so a split needs every part; ${missing.map(nameOf).join(", ")} ${missing.length === 1 ? "is" : "are"} missing.`, "Once the node has a split, a part left out keeps its value.");
+	}
+	const split = splitOf(merged);
+	validated(nodeSplitSchema, split, "a split of a node");
+	if (node.host === null) throw new CliError(`${node.name} has not reported its CPUs and memory yet, so it cannot be split.`, "The node reports them once its service runs; kcloud nodes show <node> shows its state.");
+	if (!splitFits(split, node.host)) throw new CliError(`The split asks for ${excessText(splitOverflowOf(split, node.host))} more than ${node.name} has.`, `${node.name} has ${hostText(node.host)}; shrink a pool or the reserve.`);
+	return split;
+};
+const splitViewOf = (node) => {
+	const overflow = node.split === null || node.host === null ? null : splitOverflowOf(node.split, node.host);
+	return {
+		id: node.id,
+		name: node.name,
+		revision: node.revision,
+		host: node.host === null ? null : {
+			cpus: node.host.cpus,
+			memoryMb: hostMemoryMbOf(node.host)
+		},
+		split: node.split,
+		free: overflow === null ? null : {
+			cpus: -overflow.cpus,
+			memoryMb: -overflow.memoryMb
+		}
+	};
+};
+const resourceCells = ({ cpus, memoryMb }) => [cpusText(cpus), `${memoryMb} MB`];
+const oneSlotOf = ({ cpus, memoryMb, slots }) => `${cpusText(cpus / slots)} CPU, ${Math.floor(memoryMb / slots)} MB`;
+const hostLineOf = (view) => view.host === null ? `${view.name} has not reported its CPUs and memory yet.` : `The host has ${cpusText(view.host.cpus)} CPU and ${view.host.memoryMb} MB.`;
+const splitTableOf = (view, split) => {
+	const poolRow = (role) => [
+		role,
+		...resourceCells(split[role]),
+		String(split[role].slots),
+		oneSlotOf(split[role])
+	];
+	const rows = [
+		[
+			"reserve",
+			...resourceCells(split.reserve),
+			"-",
+			"-"
+		],
+		poolRow("monitor"),
+		poolRow("executor"),
+		...view.free === null ? [] : [[
+			"free",
+			...resourceCells(view.free),
+			"-",
+			"-"
+		]],
+		...view.host === null ? [] : [[
+			"host",
+			...resourceCells(view.host),
+			"-",
+			"-"
+		]]
+	];
+	const over = view.free === null ? "" : excessText({
+		cpus: -view.free.cpus,
+		memoryMb: -view.free.memoryMb
+	});
+	return [
+		renderTable([
+			{ header: "PART" },
+			{
+				header: "CPU",
+				align: "right"
+			},
+			{
+				header: "MEMORY",
+				align: "right"
+			},
+			{
+				header: "SLOTS",
+				align: "right"
+			},
+			{ header: "ONE SLOT" }
+		], rows),
+		...view.host === null ? ["", hostLineOf(view)] : [],
+		...over === "" ? [] : ["", `The split asks for ${over} more than the host has.`]
+	].join("\n");
+};
+const splitText = (view) => view.split === null ? [
+	`${view.name} has no split, so its slots are counted from its host and no pool has a hard limit on CPU or memory.`,
+	hostLineOf(view),
+	`kcloud nodes split set ${view.name} with every part splits it.`
+].join("\n") : splitTableOf(view, view.split);
+const splitSummaryOf = (split) => {
+	if (split === null) return "none, slots counted from the host without hard limits";
+	const { reserve, monitor, executor } = split;
+	const pool = (role, { cpus, memoryMb, slots }) => `${role} ${cpusText(cpus)} CPU, ${memoryMb} MB, ${slots} slots`;
+	return [
+		`reserve ${cpusText(reserve.cpus)} CPU, ${reserve.memoryMb} MB`,
+		pool("monitor", monitor),
+		pool("executor", executor)
+	].join("; ");
+};
+const cpusPattern = /^\d+(?:\.\d+)?$/u;
+const slotsPattern = /^\d+$/u;
+const memoryPattern = /^(\d+(?:\.\d+)?)\s*(m|mb|mib|g|gb|gib)?$/iu;
+const megabytesPerGigabyte = 1024;
+const memoryMbOf = (given) => {
+	const match = memoryPattern.exec(given.trim());
+	if (match === null) return null;
+	const [, amount = "", unit = "m"] = match;
+	const megabytes = Number(amount) * (unit.toLowerCase().startsWith("g") ? megabytesPerGigabyte : 1);
+	return Number.isSafeInteger(megabytes) ? megabytes : null;
+};
+const readCpus = (flag, given) => {
+	if (!cpusPattern.test(given)) throw new UsageError(`--${flag} ${given} is not a number of CPUs.`, "Give a decimal number, as in 2 or 0.5.");
+	return Number(given);
+};
+const readMemory = (flag, given) => {
+	const megabytes = memoryMbOf(given);
+	if (megabytes === null) throw new UsageError(`--${flag} ${given} is not a whole number of megabytes.`, "Give megabytes, or a number with M or G, as in 2048, 2048M or 2G; G is 1024 MB.");
+	return megabytes;
+};
+const readSlots = (flag, given) => {
+	if (!slotsPattern.test(given)) throw new UsageError(`--${flag} ${given} is not a whole number of slots.`);
+	return Number(given);
+};
+const splitOptions = {
+	"reserve-cpus": { type: "string" },
+	"reserve-memory": { type: "string" },
+	"monitor-cpus": { type: "string" },
+	"monitor-memory": { type: "string" },
+	"monitor-slots": { type: "string" },
+	"executor-cpus": { type: "string" },
+	"executor-memory": { type: "string" },
+	"executor-slots": { type: "string" }
+};
+const splitOptionOf = {
+	"reserve.cpus": {
+		flag: "reserve-cpus",
+		read: readCpus
+	},
+	"reserve.memoryMb": {
+		flag: "reserve-memory",
+		read: readMemory
+	},
+	"monitor.cpus": {
+		flag: "monitor-cpus",
+		read: readCpus
+	},
+	"monitor.memoryMb": {
+		flag: "monitor-memory",
+		read: readMemory
+	},
+	"monitor.slots": {
+		flag: "monitor-slots",
+		read: readSlots
+	},
+	"executor.cpus": {
+		flag: "executor-cpus",
+		read: readCpus
+	},
+	"executor.memoryMb": {
+		flag: "executor-memory",
+		read: readMemory
+	},
+	"executor.slots": {
+		flag: "executor-slots",
+		read: readSlots
+	}
+};
+const flagOf = (field) => `--${splitOptionOf[field].flag}`;
+const changeOf = (values) => Object.fromEntries(splitFields.flatMap((field) => {
+	const { flag, read } = splitOptionOf[field];
+	const given = values[flag];
+	return given === void 0 ? [] : [[field, read(flag, given)]];
+}));
+const createSplitCommand = (adaptersOf) => defineGroup({
+	name: "split",
+	summary: "How a node is split into a reserve and two pools, and changing it.",
+	usage: "nodes split [set|clear] <node>",
+	fallback: defineCommand({
+		name: "split",
+		summary: "Show the split of a node, its host and what one slot of each pool gets.",
+		usage: "nodes split <node>",
+		optionsUsage: nodeUsage,
+		options: {},
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const run = await runOf(adaptersOf, invocation);
+			const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+			return printed(run, splitViewOf(await nodeDetailOf(run.api, reference)), splitText);
+		}
+	}),
+	subcommands: [defineCommand({
+		name: "set",
+		summary: "Split a node into a reserve and two pools, or change parts of its split.",
+		usage: "nodes split set <node> [--<part>-cpus <n>] [--<part>-memory <size>] [--<pool>-slots <n>]",
+		optionsUsage: [
+			...nodeUsage,
+			["--reserve-cpus <n>", "the CPUs kept for the host itself"],
+			["--reserve-memory <size>", "the memory kept for the host itself"],
+			["--monitor-cpus <n>", "the CPUs the monitor sessions share"],
+			["--monitor-memory <size>", "the memory the monitor sessions share"],
+			["--monitor-slots <n>", "how many monitor sessions run at once"],
+			["--executor-cpus <n>", "the CPUs the executor sessions share"],
+			["--executor-memory <size>", "the memory the executor sessions share"],
+			["--executor-slots <n>", "how many executor sessions run at once"],
+			["", "a size is megabytes, or a number with M or G, as in 2048 or 2G"],
+			["", "a part left out keeps its value; a node without a split needs all eight"]
+		],
+		options: splitOptions,
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const change = changeOf(invocation.values);
+			if (Object.keys(change).length === 0) throw new UsageError("nodes split set needs at least one part of the split.", "kcloud nodes split set --help lists the parts.");
+			const run = await runOf(adaptersOf, invocation);
+			const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+			const node = await nodeDetailOf(run.api, reference);
+			const split = fittingSplit(node, change, flagOf);
+			const changed = await splitNode(run.api, reference, node.revision, split);
+			return printed(run, splitViewOf(changed), splitText);
+		}
+	}), defineCommand({
+		name: "clear",
+		summary: "Remove the split of a node, so its slots are counted from its host.",
+		usage: "nodes split clear <node>",
+		optionsUsage: nodeUsage,
+		options: {},
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const run = await runOf(adaptersOf, invocation);
+			const given = invocation.positionals[0] ?? "";
+			const reference = await resolveNode(run, given);
+			const node = await nodeDetailOf(run.api, reference);
+			if (node.split === null) return printed(run, splitViewOf(node), () => `${node.name} has no split; nothing was changed.`);
+			await confirmed({
+				prompt: run.prompt,
+				settings: run.settings,
+				question: `Clear the split of ${given}? Its pools lose their limits on CPU and memory.`
+			});
+			const cleared = await splitNode(run.api, reference, node.revision, null);
+			return printed(run, splitViewOf(cleared), splitText);
+		}
+	})]
+});
+//#endregion
 //#region src/mcp/tools/nodes.ts
 const nodeField = z.string().trim().min(1).describe("The node, by its name or its id, from nodes_list.");
+const poolPart = (role) => nodePoolSplitSchema.partial().optional().describe(`The CPUs, the memory in MB and the slots the ${role} sessions share; a field left out keeps its value.`);
 const nodeTools = [
 	defineTool({
 		name: "nodes_list",
 		title: "List nodes",
-		description: "List the nodes of the organization this server acts in, the hosts its agents run on, with their state, engine, version and agent count.",
+		description: "List the nodes of the organization this server acts in, the hosts its agents run on, with their state, engine, version, capabilities, split and agent count.",
 		operations: ["listNodes"],
 		safety: "read",
 		input: z.object({}),
@@ -5809,12 +6184,49 @@ const nodeTools = [
 	defineTool({
 		name: "node_show",
 		title: "Show a node",
-		description: "Show one node with its host, its capabilities, the agents placed on it and the runtime it reported last.",
+		description: "Show one node with its host, its capabilities, its split, the agents placed on it with their pool limits, and the runtime and pools it reported last.",
 		operations: ["getNode"],
 		safety: "read",
 		input: z.object({ node: nodeField }),
 		run: async ({ node }, run) => nodeDetailOf(run.api, await resolveNode(run, node))
 	}),
+	defineTool({
+		name: "node_split_set",
+		title: "Split a node into pools",
+		description: "Split a node into a reserve kept for the host, a monitor pool and an executor pool, each with CPUs and memory in MB, the pools also with slots. A part left out keeps its value; a node without a split needs every part. The split has to fit the host. Returns the split with the host and what is left free. Takes an admin of the organization.",
+		operations: ["getNode", "updateNodeSplit"],
+		safety: "write",
+		idempotent: true,
+		input: z.object({
+			node: nodeField,
+			reserve: nodeReserveSchema.partial().optional().describe("The CPUs and the memory in MB kept for the host itself; a field left out keeps its value."),
+			monitor: poolPart("monitor"),
+			executor: poolPart("executor")
+		}),
+		run: async ({ node, ...parts }, run) => {
+			const change = changeOfParts(parts);
+			if (Object.keys(change).length === 0) throw new CliError("Name at least one part of the split to change.");
+			const reference = await resolveNode(run, node);
+			const detail = await nodeDetailOf(run.api, reference);
+			const split = fittingSplit(detail, change, (field) => field);
+			return splitViewOf(await splitNode(run.api, reference, detail.revision, split));
+		}
+	}),
+	defineTool({
+		name: "node_split_clear",
+		title: "Clear the split of a node",
+		description: "Remove the split of a node, so its slots are counted from its host again and its pools lose their limits on CPU and memory. Takes an admin of the organization.",
+		operations: ["getNode", "updateNodeSplit"],
+		safety: "destructive",
+		idempotent: true,
+		input: z.object({ node: nodeField }),
+		run: async ({ node }, run) => {
+			const reference = await resolveNode(run, node);
+			const detail = await nodeDetailOf(run.api, reference);
+			if (detail.split === null) return splitViewOf(detail);
+			return splitViewOf(await splitNode(run.api, reference, detail.revision, null));
+		}
+	}),
 	defineTool({
 		name: "node_delete",
 		title: "Delete a node",
@@ -7928,6 +8340,195 @@ const createMcpCommand = (adaptersOf, cliVersion) => defineCommand({
 	}
 });
 //#endregion
+//#region src/commands/nodes/index.ts
+const gibibytes = (bytes) => `${(bytes / 1024 ** 3).toFixed(1)} GiB`;
+const hostOf = (node) => node.host === null ? "-" : `${node.host.cpus} CPU, ${gibibytes(node.host.memoryBytes)} of memory`;
+const capabilitiesOf = (node) => {
+	if (node.capabilities === null) return "-";
+	const { sandbox, uidIsolation } = node.capabilities;
+	return `sandbox ${sandbox ? "yes" : "no"}, uid isolation ${uidIsolation ? "yes" : "no"}`;
+};
+const registrationOf = (node) => node.registrationExpiresAt === null ? "-" : `a token waits until ${node.registrationExpiresAt}`;
+const storageOf = ({ state, freeBytes, totalBytes, path }) => `${state}, ${gibibytes(freeBytes)} free of ${gibibytes(totalBytes)} at ${path}`;
+const runtimeRowsOf = (runtime) => [
+	["reported", runtime.reportedAt],
+	["docker", runtime.docker.lastError === null ? runtime.docker.state : `${runtime.docker.state}: ${runtime.docker.lastError}`],
+	["data storage", storageOf(runtime.storage.data)],
+	["engine storage", storageOf(runtime.storage.engine)],
+	["last reconcile", runtime.reconcile.lastTickError === null ? runtime.reconcile.lastTickAt ?? "never" : `${runtime.reconcile.lastTickAt ?? "never"}: ${runtime.reconcile.lastTickError}`],
+	["agents", `${runtime.reconcile.agentsActive} active, ${runtime.reconcile.agentsQueued} queued`],
+	["log readers", String(runtime.ingest.readers)]
+];
+const nodeDetailsText = (node) => [
+	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
+		["name", node.name],
+		["state", node.state],
+		["provider", node.provider],
+		["engine", node.engine ?? "-"],
+		["version", node.version ?? "-"],
+		["host", hostOf(node)],
+		["server", node.host?.serverVersion ?? "-"],
+		["data root", node.host?.dataRoot ?? "-"],
+		["capabilities", capabilitiesOf(node)],
+		["offers", node.offered.length === 0 ? "-" : node.offered.join(", ")],
+		["split", splitSummaryOf(node.split)],
+		["registration", registrationOf(node)],
+		["connected", node.connectedAt ?? "never"],
+		["last seen", node.lastSeenAt ?? "never"],
+		["created", node.createdAt],
+		["id", node.id]
+	]),
+	"",
+	node.agents.length === 0 ? "No agent is placed on the node." : renderTable([
+		{ header: "PROJECT" },
+		{ header: "AGENT" },
+		{ header: "STATE" },
+		{ header: "POOL LIMIT" },
+		{ header: "ID" }
+	], node.agents.map((agent) => [
+		agent.projectName,
+		agent.slug,
+		agent.state,
+		poolLimitText(agent.poolLimit),
+		agent.id
+	])),
+	"",
+	...node.runtime === null ? ["The node has reported no runtime yet."] : [
+		renderTable([{ header: "RUNTIME" }, { header: "VALUE" }], runtimeRowsOf(node.runtime)),
+		"",
+		poolsText(node.runtime.pools)
+	]
+].join("\n");
+const startHintOf = (origin) => [
+	"Start the node with it as docs/install.md of kikimora-cloud describes. On a Linux host, after read -rs token:",
+	`  printf '%s\\n' "$token" | /opt/kikimora-cloud/infra/node/install.sh --platform-url ${origin} --image ghcr.io/kikimoradev/kikimora-cloud/node:<version> --registration-token -`,
+	"On a Windows PC:",
+	`  C:\\kikimora-cloud\\src\\infra\\windows\\install.ps1 -PlatformUrl ${origin} -RegistrationToken <token>`
+].join("\n");
+const printedRegistration = (run, created) => {
+	if (run.settings.json) {
+		run.context.terminal.json(created);
+		return exitCodes.ok;
+	}
+	run.context.terminal.line(created.registration.token);
+	run.context.terminal.error([`The registration token of ${created.node.name} is shown only here and works once, until ${created.registration.expiresAt}.`, startHintOf(run.origin)].join("\n"));
+	return exitCodes.ok;
+};
+const createNodesCommand = (adaptersOf) => defineGroup({
+	name: "nodes",
+	summary: "The nodes of the organization, the hosts its agents run on.",
+	usage: "nodes <command>",
+	subcommands: [
+		defineCommand({
+			name: "list",
+			summary: "List the nodes of the organization.",
+			usage: "nodes list",
+			options: {},
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const items = await nodesOf(run.api, organization.id);
+				return printed(run, items, (nodes) => nodes.length === 0 ? `${organization.slug} has no node yet; kcloud nodes create <name> creates one.` : renderTable([
+					{ header: "NAME" },
+					{ header: "STATE" },
+					{ header: "ENGINE" },
+					{ header: "VERSION" },
+					{
+						header: "AGENTS",
+						align: "right"
+					},
+					{ header: "LAST SEEN" },
+					{ header: "ID" }
+				], nodes.map((node) => [
+					node.name,
+					node.state,
+					node.engine ?? "-",
+					node.version ?? "-",
+					String(node.agentCount),
+					node.lastSeenAt ?? "never",
+					node.id
+				])));
+			}
+		}),
+		defineCommand({
+			name: "show",
+			summary: "Show a node with its host, its split, the agents placed on it, its runtime and its pools.",
+			usage: "nodes show <node>",
+			optionsUsage: nodeUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+				return printed(run, await nodeDetailOf(run.api, reference), nodeDetailsText);
+			}
+		}),
+		createSplitCommand(adaptersOf),
+		defineCommand({
+			name: "create",
+			summary: "Create a node and print its one-time registration token.",
+			usage: "nodes create <name>",
+			optionsUsage: [["", "the name holds lowercase letters, digits and hyphens"], ["", "the token goes to stdout alone, how to start the node to stderr"]],
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				return printedRegistration(run, await createdNode(run.api, organization.id, invocation.positionals[0] ?? ""));
+			}
+		}),
+		defineCommand({
+			name: "token",
+			summary: "Issue a new registration token for a node that has not joined yet.",
+			usage: "nodes token <node>",
+			optionsUsage: [...nodeUsage, ["", "the token replaces the one issued before, which stops working"]],
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+				return printedRegistration(run, await renewedRegistration(run.api, reference));
+			}
+		}),
+		defineCommand({
+			name: "delete",
+			summary: "Delete a node that runs no agent.",
+			usage: "nodes delete <node>",
+			optionsUsage: nodeUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const given = invocation.positionals[0] ?? "";
+				const reference = await resolveNode(run, given);
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: `Delete the node ${given}? Its host can no longer reach the platform.`
+				});
+				await deleteNode(run.api, reference);
+				return said(run, `Deleted the node ${given}.`);
+			}
+		})
+	]
+});
+//#endregion
 //#region src/commands/releases.ts
 const createReleasesCommand = (adaptersOf) => defineGroup({
 	name: "releases",