@kikimoradev/kcloud 0.15.0 → 0.17.0

package/dist/main.js

@@ -13,6 +13,24 @@ import createClient from "openapi-fetch";
 import { finished } from "node:stream/promises";
 import { StdioServerTransport, serveStdio } from "@modelcontextprotocol/server/stdio";
 import { McpServer } from "@modelcontextprotocol/server";
+//#region ../../packages/cli-kit/src/bytes.ts
+const units = [
+	"B",
+	"KiB",
+	"MiB",
+	"GiB",
+	"TiB"
+];
+const bytesOf = (bytes) => {
+	let value = bytes;
+	let unit = 0;
+	while (value >= 1024 && unit < units.length - 1) {
+		value /= 1024;
+		unit += 1;
+	}
+	return unit === 0 ? `${bytes} B` : `${value.toFixed(1)} ${units[unit] ?? ""}`;
+};
+//#endregion
 //#region ../../packages/cli-kit/src/errors.ts
 const exitCodes = {
 	ok: 0,
@@ -91,12 +109,13 @@ const commandFactoryOf = (spec) => (definition) => {
 		}
 	};
 };
-const defineGroup$1 = ({ name, summary, usage, subcommands }) => ({
+const defineGroup$1 = ({ name, summary, usage, subcommands, fallback }) => ({
 	name,
 	summary,
 	usage,
 	optionsUsage: [],
 	subcommands,
+	...fallback === void 0 ? {} : { fallback },
 	execute: () => {
 		throw new Error(`${name} is a group of commands and runs none of its own`);
 	}
@@ -334,23 +353,27 @@ const report = (error, terminal, environment, program, debugVariable) => {
 };
 const dispatcherOf = (spec) => {
 	const rendering = spec;
-	const walk = async (commands, args, trail, context) => {
+	const executed = (command, args, help, context) => {
+		if (!help) return command.execute(args, context);
+		context.terminal.line(commandUsageOf(rendering, command));
+		return Promise.resolve(exitCodes.ok);
+	};
+	const walk = async (commands, args, trail, context, fallback) => {
 		const located = locateCommand(args, spec.globalOptions);
+		const command = located.name === null ? void 0 : commands.find(({ name }) => name === located.name);
+		const listsHelp = located.name === null && located.help;
+		if (command === void 0 && fallback !== void 0 && !listsHelp) return executed(fallback, args, located.help, context);
+		const listed = fallback === void 0 ? commands : [fallback, ...commands];
 		if (located.name === null) {
 			if (located.help) {
-				context.terminal.line(commandsUsageOf(rendering, commands, trail));
+				context.terminal.line(commandsUsageOf(rendering, listed, trail));
 				return exitCodes.ok;
 			}
-			throw new UsageError(trail.length === 0 ? "Name a command." : `${pathOf(trail)}needs a subcommand.`, commandsUsageOf(rendering, commands, trail));
-		}
-		const command = commands.find(({ name }) => name === located.name);
-		if (command === void 0) throw new UsageError(`There is no command ${pathOf(trail)}${located.name}.`, commandsUsageOf(rendering, commands, trail));
-		if (command.subcommands.length > 0) return walk(command.subcommands, located.args, [...trail, command.name], context);
-		if (located.help) {
-			context.terminal.line(commandUsageOf(rendering, command));
-			return exitCodes.ok;
+			throw new UsageError(trail.length === 0 ? "Name a command." : `${pathOf(trail)}needs a subcommand.`, commandsUsageOf(rendering, listed, trail));
 		}
-		return command.execute(located.args, context);
+		if (command === void 0) throw new UsageError(`There is no command ${pathOf(trail)}${located.name}.`, commandsUsageOf(rendering, listed, trail));
+		if (command.subcommands.length > 0) return walk(command.subcommands, located.args, [...trail, command.name], context, command.fallback);
+		return executed(command, located.args, located.help, context);
 	};
 	return async ({ argv, commands, context }) => {
 		try {
@@ -363,6 +386,12 @@ const dispatcherOf = (spec) => {
 		}
 	};
 };
+//#endregion
+//#region ../../packages/cli-kit/src/list.ts
+const listOf = (items) => {
+	const last = items.at(-1);
+	return items.length < 2 || last === void 0 ? items.join("") : `${items.slice(0, -1).join(", ")} and ${last}`;
+};
 const permissionsOutsideOwner = 63;
 const isMissing = (error) => error instanceof Error && error.code === "ENOENT";
 const ensurePrivateDirectory = async (path) => {
@@ -486,243 +515,6 @@ const spec = {
 const defineCommand = commandFactoryOf(spec);
 const defineGroup = (definition) => defineGroup$1(definition);
 const runCli = dispatcherOf(spec);
-const agentEventLevelSchema = z.enum([
-	"info",
-	"warn",
-	"error"
-]);
-const agentRoles = [
-	"monitor",
-	"executor",
-	"summarizer"
-];
-const agentRoleSchema = z.enum(agentRoles);
-const agentLogStreams = ["stdout", "stderr"];
-z.enum(agentLogStreams);
-const platformStream = "platform";
-const agentEventStreams = [...agentLogStreams, platformStream];
-const agentEventStreamSchema = z.enum(agentEventStreams);
-const authKindSchema = z.enum([
-	"apiKey",
-	"oauth",
-	"claude.ai",
-	"unknown"
-]);
-const agentControlStateSchema = z.enum([
-	"running",
-	"pausing",
-	"paused"
-]);
-z.enum([
-	"session",
-	"diagnostic",
-	"task"
-]);
-const maxCostUsd = 1e3;
-const countSchema = z.int().min(0).max(2147483647);
-const costUsdSchema = z.number().min(0).max(maxCostUsd);
-const instantSchema$2 = z.iso.datetime();
-const workerEnvelope = (event) => ({
-	ts: instantSchema$2,
-	level: agentEventLevelSchema,
-	event: z.literal(event)
-});
-const roleEnvelope = (event) => ({
-	...workerEnvelope(event),
-	agent: agentRoleSchema.optional()
-});
-const agentEventSchema = z.discriminatedUnion("event", [
-	z.looseObject({
-		...workerEnvelope("worker.started"),
-		version: z.string(),
-		claudeVersion: z.string().optional(),
-		nodeVersion: z.string(),
-		authKind: authKindSchema,
-		pid: countSchema,
-		projectDir: z.string(),
-		paused: z.boolean().optional()
-	}),
-	z.looseObject({
-		...workerEnvelope("worker.stopped"),
-		signal: z.string().optional(),
-		drained: z.boolean().optional(),
-		forced: z.boolean().optional()
-	}),
-	z.looseObject({
-		...workerEnvelope("worker.draining"),
-		reason: z.string(),
-		timeoutMs: countSchema.optional()
-	}),
-	z.looseObject({
-		...workerEnvelope("update.available"),
-		from: z.string(),
-		to: z.string(),
-		installError: z.string().optional()
-	}),
-	z.looseObject({
-		...workerEnvelope("update.installed"),
-		from: z.string(),
-		to: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("control.changed"),
-		state: agentControlStateSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("cycle.started"),
-		cycle: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("cycle.finished"),
-		cycle: countSchema,
-		ok: z.boolean(),
-		durationMs: countSchema,
-		costUsd: costUsdSchema.optional(),
-		addedTasks: countSchema,
-		skippedDuplicates: countSchema,
-		sessionId: z.string().optional(),
-		error: z.string().optional()
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.offHours"),
-		resumeAt: instantSchema$2
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.limitWait"),
-		resumeAt: instantSchema$2
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.sleeping"),
-		nextCycleAt: instantSchema$2
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.authBlocked"),
-		reason: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("monitor.admissionWait"),
-		ticket: z.string(),
-		since: instantSchema$2,
-		seq: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("executor.admissionWait"),
-		ticket: z.string(),
-		since: instantSchema$2,
-		seq: countSchema,
-		taskId: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("admission.granted"),
-		ticket: z.string(),
-		seq: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("admission.released"),
-		ticket: z.string(),
-		seq: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("admission.cancelled"),
-		ticket: z.string(),
-		seq: countSchema
-	}),
-	z.looseObject({
-		...roleEnvelope("task.started"),
-		taskId: z.string(),
-		title: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("task.finished"),
-		taskId: z.string(),
-		title: z.string(),
-		ok: z.boolean(),
-		durationMs: countSchema,
-		costUsd: costUsdSchema.optional(),
-		numTurns: countSchema.optional(),
-		willRetry: z.boolean().optional(),
-		attempt: countSchema.optional(),
-		maxAttempts: countSchema.optional(),
-		sessionId: z.string().optional(),
-		error: z.string().optional()
-	}),
-	z.looseObject({
-		...roleEnvelope("task.retryScheduled"),
-		taskId: z.string(),
-		resumeAt: instantSchema$2
-	}),
-	z.looseObject(roleEnvelope("executor.waiting")),
-	z.looseObject({
-		...roleEnvelope("executor.limitWait"),
-		resumeAt: instantSchema$2
-	}),
-	z.looseObject({
-		...roleEnvelope("executor.authBlocked"),
-		reason: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("summary.started"),
-		taskId: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("summary.finished"),
-		taskId: z.string(),
-		ok: z.boolean(),
-		durationMs: countSchema,
-		costUsd: costUsdSchema.optional(),
-		sessionId: z.string().optional(),
-		error: z.string().optional()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.init"),
-		model: z.string(),
-		sessionId: z.string(),
-		taskId: z.string().optional(),
-		cycle: countSchema.optional()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.stderr"),
-		line: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.procError"),
-		message: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.killed"),
-		reason: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.text"),
-		text: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.tool"),
-		tool: z.string(),
-		detail: z.string()
-	}),
-	z.looseObject({
-		...roleEnvelope("session.toolError"),
-		output: z.string()
-	})
-]);
-z.looseObject({
-	ts: instantSchema$2,
-	level: agentEventLevelSchema,
-	agent: agentRoleSchema.optional(),
-	event: z.string().min(1).max(64)
-});
-agentEventSchema.options.map((option) => option.shape.event.value);
-({
-	rawLog: "log.raw",
-	rejectedLog: "log.rejected",
-	throttledLog: "log.throttled",
-	stateChanged: "platform.stateChanged",
-	crashLooping: "platform.crashLooping",
-	provisioned: "platform.provisioned",
-	sandboxStarted: "platform.sandboxStarted",
-	sandboxStopped: "platform.sandboxStopped"
-}).rawLog;
 //#endregion
 //#region ../../packages/contracts/src/patterns.ts
 const slugPattern = /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/;
@@ -972,6 +764,7 @@ const errorCodes = Object.keys({
 	"agent.tool_duplicate": "rule_violation",
 	"agent.context_too_long": "rule_violation",
 	"agent.docker_unavailable": "rule_violation",
+	"agent.node_unsuitable": "rule_violation",
 	"agent.storage_exhausted": "rule_violation",
 	"agent.invalid_transition": "rule_violation",
 	"agent.busy": "conflict",
@@ -995,6 +788,13 @@ const errorCodes = Object.keys({
 	"node.registration_invalid": "unauthenticated",
 	"node.registration_used": "conflict",
 	"node.in_use": "conflict",
+	"node.host_unknown": "rule_violation",
+	"node.split_exceeds_host": "rule_violation",
+	"node.package_unavailable": "not_found",
+	"agent.backup_not_found": "not_found",
+	"agent.backup_unavailable": "rule_violation",
+	"agent.backup_without_export": "rule_violation",
+	"agent.backup_in_progress": "conflict",
 	"project.last_admin": "conflict",
 	"agent.node_unassigned": "rule_violation",
 	"stream.too_many": "rate_limited",
@@ -1031,16 +831,253 @@ const errorBodySchema = z.object({
 		message: z.string()
 	})).optional()
 }).meta({ id: "ErrorBody" });
-const agentStateSchema = z.enum([
-	"created",
-	"provisioning",
-	"stopped",
-	"starting",
-	"running",
-	"pausing",
-	"paused",
-	"stopping",
-	"updating",
+const agentEventLevelSchema = z.enum([
+	"info",
+	"warn",
+	"error"
+]);
+const agentRoles = [
+	"monitor",
+	"executor",
+	"summarizer"
+];
+const agentRoleSchema = z.enum(agentRoles);
+const agentLogStreams = ["stdout", "stderr"];
+z.enum(agentLogStreams);
+const platformStream = "platform";
+const agentEventStreams = [...agentLogStreams, platformStream];
+const agentEventStreamSchema = z.enum(agentEventStreams);
+const authKindSchema = z.enum([
+	"apiKey",
+	"oauth",
+	"claude.ai",
+	"unknown"
+]);
+const agentControlStateSchema = z.enum([
+	"running",
+	"pausing",
+	"paused"
+]);
+z.enum([
+	"session",
+	"diagnostic",
+	"task"
+]);
+const maxCostUsd = 1e3;
+const countSchema = z.int().min(0).max(2147483647);
+const costUsdSchema = z.number().min(0).max(maxCostUsd);
+const instantSchema$2 = z.iso.datetime();
+const workerEnvelope = (event) => ({
+	ts: instantSchema$2,
+	level: agentEventLevelSchema,
+	event: z.literal(event)
+});
+const roleEnvelope = (event) => ({
+	...workerEnvelope(event),
+	agent: agentRoleSchema.optional()
+});
+const agentEventSchema = z.discriminatedUnion("event", [
+	z.looseObject({
+		...workerEnvelope("worker.started"),
+		version: z.string(),
+		claudeVersion: z.string().optional(),
+		nodeVersion: z.string(),
+		authKind: authKindSchema,
+		pid: countSchema,
+		projectDir: z.string(),
+		paused: z.boolean().optional()
+	}),
+	z.looseObject({
+		...workerEnvelope("worker.stopped"),
+		signal: z.string().optional(),
+		drained: z.boolean().optional(),
+		forced: z.boolean().optional()
+	}),
+	z.looseObject({
+		...workerEnvelope("worker.draining"),
+		reason: z.string(),
+		timeoutMs: countSchema.optional()
+	}),
+	z.looseObject({
+		...workerEnvelope("update.available"),
+		from: z.string(),
+		to: z.string(),
+		installError: z.string().optional()
+	}),
+	z.looseObject({
+		...workerEnvelope("update.installed"),
+		from: z.string(),
+		to: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("control.changed"),
+		state: agentControlStateSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("cycle.started"),
+		cycle: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("cycle.finished"),
+		cycle: countSchema,
+		ok: z.boolean(),
+		durationMs: countSchema,
+		costUsd: costUsdSchema.optional(),
+		addedTasks: countSchema,
+		skippedDuplicates: countSchema,
+		sessionId: z.string().optional(),
+		error: z.string().optional()
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.offHours"),
+		resumeAt: instantSchema$2
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.limitWait"),
+		resumeAt: instantSchema$2
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.sleeping"),
+		nextCycleAt: instantSchema$2
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.authBlocked"),
+		reason: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("monitor.admissionWait"),
+		ticket: z.string(),
+		since: instantSchema$2,
+		seq: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("executor.admissionWait"),
+		ticket: z.string(),
+		since: instantSchema$2,
+		seq: countSchema,
+		taskId: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("admission.granted"),
+		ticket: z.string(),
+		seq: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("admission.released"),
+		ticket: z.string(),
+		seq: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("admission.cancelled"),
+		ticket: z.string(),
+		seq: countSchema
+	}),
+	z.looseObject({
+		...roleEnvelope("task.started"),
+		taskId: z.string(),
+		title: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("task.finished"),
+		taskId: z.string(),
+		title: z.string(),
+		ok: z.boolean(),
+		durationMs: countSchema,
+		costUsd: costUsdSchema.optional(),
+		numTurns: countSchema.optional(),
+		willRetry: z.boolean().optional(),
+		attempt: countSchema.optional(),
+		maxAttempts: countSchema.optional(),
+		sessionId: z.string().optional(),
+		error: z.string().optional()
+	}),
+	z.looseObject({
+		...roleEnvelope("task.retryScheduled"),
+		taskId: z.string(),
+		resumeAt: instantSchema$2
+	}),
+	z.looseObject(roleEnvelope("executor.waiting")),
+	z.looseObject({
+		...roleEnvelope("executor.limitWait"),
+		resumeAt: instantSchema$2
+	}),
+	z.looseObject({
+		...roleEnvelope("executor.authBlocked"),
+		reason: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("summary.started"),
+		taskId: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("summary.finished"),
+		taskId: z.string(),
+		ok: z.boolean(),
+		durationMs: countSchema,
+		costUsd: costUsdSchema.optional(),
+		sessionId: z.string().optional(),
+		error: z.string().optional()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.init"),
+		model: z.string(),
+		sessionId: z.string(),
+		taskId: z.string().optional(),
+		cycle: countSchema.optional()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.stderr"),
+		line: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.procError"),
+		message: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.killed"),
+		reason: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.text"),
+		text: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.tool"),
+		tool: z.string(),
+		detail: z.string()
+	}),
+	z.looseObject({
+		...roleEnvelope("session.toolError"),
+		output: z.string()
+	})
+]);
+z.looseObject({
+	ts: instantSchema$2,
+	level: agentEventLevelSchema,
+	agent: agentRoleSchema.optional(),
+	event: z.string().min(1).max(64)
+});
+agentEventSchema.options.map((option) => option.shape.event.value);
+({
+	rawLog: "log.raw",
+	rejectedLog: "log.rejected",
+	throttledLog: "log.throttled",
+	stateChanged: "platform.stateChanged",
+	crashLooping: "platform.crashLooping",
+	provisioned: "platform.provisioned",
+	sandboxStarted: "platform.sandboxStarted",
+	sandboxStopped: "platform.sandboxStopped"
+}).rawLog;
+const agentStateSchema = z.enum([
+	"created",
+	"provisioning",
+	"stopped",
+	"starting",
+	"running",
+	"pausing",
+	"paused",
+	"stopping",
+	"updating",
 	"resetting",
 	"deleting",
 	"error"
@@ -1244,6 +1281,7 @@ const agentSessionSchema = z.object({
 	endedAt: z.iso.datetime().nullable(),
 	ok: z.boolean().nullable(),
 	killedReason: z.string().nullable(),
+	failureReason: z.string().nullable(),
 	error: z.string().nullable(),
 	costUsd: z.number().nullable(),
 	durationMs: z.int().nullable(),
@@ -1402,23 +1440,123 @@ pageSchema(z.object({
 	finishedAt: z.iso.datetime().nullable()
 }).meta({ id: "TaskCost" })).meta({ id: "TaskCostPage" });
 costQuerySchema.extend({ cursor: cursorSchema.optional() });
-const nodeStateSchema = z.enum([
-	"pending",
-	"online",
-	"offline"
-]);
-const nodeProviderSchema = z.enum(["self_hosted"]);
-const nodeNameSchema = z.string().trim().regex(slugPattern);
-const nodeHostSchema = z.object({
+z.enum(["monitor", "executor"]);
+const sessionSlotCountSchema = z.int().min(1).max(64);
+const sessionQueueEntrySchema = z.object({
+	agentId: idSchema,
+	agentName: z.string().nullable(),
+	projectId: idSchema.nullable(),
+	projectName: z.string().nullable(),
+	position: z.int().positive(),
+	since: z.iso.datetime(),
+	taskId: z.string().nullable()
+}).meta({ id: "SessionQueueEntry" });
+const sessionPoolSchema = z.object({
+	slots: sessionSlotCountSchema.nullable(),
+	effective: z.int().nonnegative(),
+	inUse: z.int().nonnegative(),
+	waiting: z.array(sessionQueueEntrySchema)
+}).meta({ id: "SessionPool" });
+z.object({
+	version: z.int().nonnegative(),
+	ready: z.boolean(),
+	monitor: sessionPoolSchema,
+	executor: sessionPoolSchema
+}).meta({ id: "SessionSlots" });
+z.object({
+	version: z.int().nonnegative(),
+	monitor: sessionSlotCountSchema.nullable(),
+	executor: sessionSlotCountSchema.nullable()
+}).meta({ id: "UpdateSessionSlotsBody" });
+const agentAdmissionStateSchema = z.discriminatedUnion("state", [z.object({
+	state: z.literal("waiting"),
+	since: z.iso.datetime(),
+	position: z.int().positive()
+}), z.object({ state: z.literal("holding") })]).meta({ id: "AgentAdmissionState" });
+const agentAdmissionSchema = z.object({
+	monitor: agentAdmissionStateSchema.nullable(),
+	executor: agentAdmissionStateSchema.nullable()
+}).meta({ id: "AgentAdmission" });
+const nodeStateSchema = z.enum([
+	"pending",
+	"online",
+	"offline"
+]);
+const nodeProviderSchema = z.enum(["self_hosted"]);
+const nodeNameSchema = z.string().trim().regex(slugPattern);
+const nodeHostSchema = z.object({
 	cpus: z.number().nonnegative(),
 	memoryBytes: z.number().nonnegative(),
 	dataRoot: z.string(),
 	serverVersion: z.string()
 }).meta({ id: "NodeHost" });
+const nodeCapabilityNames = [
+	"linux",
+	"windows",
+	"docker",
+	"isolation",
+	"gpu",
+	"desktop"
+];
+const nodeCapabilitySchema = z.enum(nodeCapabilityNames).meta({ id: "NodeCapability" });
 const nodeCapabilitiesSchema = z.object({
 	sandbox: z.boolean(),
-	uidIsolation: z.boolean()
+	uidIsolation: z.boolean(),
+	offered: z.array(nodeCapabilitySchema).optional()
 }).meta({ id: "NodeCapabilities" });
+const minPoolCpus = .1;
+const maxSplitCpus = 1024;
+const maxSplitMemoryMb = 16777216;
+const hundredths = (value) => Math.abs(Math.round(value * 100) - value * 100) < 1e-9;
+const splitCpusSchema = (min) => z.number().min(min).max(maxSplitCpus).refine(hundredths, { message: "expected at most two decimal places" });
+const splitMemorySchema = (min) => z.int().min(min).max(maxSplitMemoryMb);
+const nodeReserveSchema = z.object({
+	cpus: splitCpusSchema(0),
+	memoryMb: splitMemorySchema(0)
+}).meta({ id: "NodeReserve" });
+const nodePoolSplitSchema = z.object({
+	cpus: splitCpusSchema(minPoolCpus),
+	memoryMb: splitMemorySchema(256),
+	slots: z.int().min(1).max(64)
+}).meta({ id: "NodePoolSplit" });
+const nodeSplitSchema = z.object({
+	reserve: nodeReserveSchema,
+	monitor: nodePoolSplitSchema,
+	executor: nodePoolSplitSchema
+}).meta({ id: "NodeSplit" });
+const poolLimitSchema = z.object({
+	enforced: z.boolean(),
+	reason: z.enum([
+		"release",
+		"restart",
+		"node"
+	]).nullable()
+}).meta({ id: "PoolLimit" });
+const poolEnforcementSchema = z.object({
+	state: z.enum([
+		"enforced",
+		"unsplit",
+		"unsupported"
+	]),
+	reason: z.string().nullable()
+}).meta({ id: "PoolEnforcement" });
+const poolUsageSchema = z.object({
+	memoryBytes: z.int().nonnegative(),
+	memoryMaxBytes: z.int().nonnegative().nullable(),
+	cpus: z.number().nonnegative().nullable(),
+	memoryKills: z.int().nonnegative()
+}).meta({ id: "PoolUsage" });
+const nodePoolSchema = z.object({
+	slots: z.int().nonnegative(),
+	inUse: z.int().nonnegative(),
+	waiting: z.array(sessionQueueEntrySchema),
+	usage: poolUsageSchema.nullable()
+}).meta({ id: "NodePool" });
+const nodePoolsSchema = z.object({
+	enforcement: poolEnforcementSchema,
+	monitor: nodePoolSchema,
+	executor: nodePoolSchema
+}).meta({ id: "NodePools" });
 const nodeSchema = z.object({
 	id: idSchema,
 	name: nodeNameSchema,
@@ -1428,19 +1566,46 @@ const nodeSchema = z.object({
 	version: z.string().nullable(),
 	host: nodeHostSchema.nullable(),
 	capabilities: nodeCapabilitiesSchema.nullable(),
+	offered: z.array(nodeCapabilitySchema),
+	split: nodeSplitSchema.nullable(),
+	revision: z.int().nonnegative(),
 	agentCount: z.int().nonnegative(),
 	connectedAt: z.iso.datetime().nullable(),
 	lastSeenAt: z.iso.datetime().nullable(),
+	offlineSince: z.iso.datetime().nullable(),
 	registrationExpiresAt: z.iso.datetime().nullable(),
 	createdAt: z.iso.datetime()
 }).meta({ id: "Node" });
+const nodeUpdateSchema = z.object({
+	state: z.enum([
+		"current",
+		"waiting",
+		"updating",
+		"failed",
+		"unmanaged"
+	]),
+	target: z.string().nullable(),
+	sessions: z.int().nonnegative(),
+	since: z.iso.datetime().nullable(),
+	last: z.object({
+		outcome: z.enum([
+			"updated",
+			"rolledBack",
+			"failed"
+		]),
+		version: z.string().nullable(),
+		reason: z.string().nullable(),
+		at: z.iso.datetime()
+	}).nullable()
+}).meta({ id: "NodeUpdate" });
 const nodeAgentSchema = z.object({
 	id: idSchema,
 	name: z.string(),
 	slug: z.string(),
 	projectId: idSchema,
 	projectName: z.string(),
-	state: agentStateSchema
+	state: agentStateSchema,
+	poolLimit: poolLimitSchema.nullable()
 }).meta({ id: "NodeAgent" });
 const nodeRuntimeSchema = z.object({
 	reportedAt: z.iso.datetime(),
@@ -1473,11 +1638,13 @@ const nodeRuntimeSchema = z.object({
 			effective: z.int().nonnegative(),
 			inUse: z.int().nonnegative()
 		})
-	})
+	}),
+	pools: nodePoolsSchema
 }).meta({ id: "NodeRuntime" });
 nodeSchema.extend({
 	agents: z.array(nodeAgentSchema),
-	runtime: nodeRuntimeSchema.nullable()
+	runtime: nodeRuntimeSchema.nullable(),
+	update: nodeUpdateSchema.nullable()
 }).meta({ id: "NodeDetail" });
 z.object({ items: z.array(nodeSchema) }).meta({ id: "NodeList" });
 z.object({ nodeId: idSchema });
@@ -1485,6 +1652,10 @@ z.object({
 	organizationId: idSchema,
 	nodeId: idSchema
 });
+z.object({
+	revision: z.int().nonnegative(),
+	split: nodeSplitSchema.nullable()
+}).meta({ id: "UpdateNodeSplitBody" });
 const createNodeBodySchema = z.object({ name: nodeNameSchema }).meta({ id: "CreateNodeBody" });
 const nodeRegistrationSchema = z.object({
 	token: z.string(),
@@ -1505,6 +1676,21 @@ z.object({
 	nodeId: idSchema,
 	credential: z.string()
 }).meta({ id: "RegisteredNode" });
+const bytesPerMegabyte = 1048576;
+const inHundredths = (value) => Math.round(value * 100);
+const hostMemoryMbOf = (host) => Math.floor(host.memoryBytes / bytesPerMegabyte);
+const splitOverflowOf = (split, host) => {
+	const cpus = inHundredths(split.reserve.cpus) + inHundredths(split.monitor.cpus) + inHundredths(split.executor.cpus) - inHundredths(host.cpus);
+	const memoryMb = split.reserve.memoryMb + split.monitor.memoryMb + split.executor.memoryMb - hostMemoryMbOf(host);
+	return {
+		cpus: cpus / 100,
+		memoryMb
+	};
+};
+const splitFits = (split, host) => {
+	const overflow = splitOverflowOf(split, host);
+	return overflow.cpus <= 0 && overflow.memoryMb <= 0;
+};
 //#endregion
 //#region ../../packages/contracts/src/identity.ts
 const emailSchema = z.email().max(254);
@@ -1674,6 +1860,8 @@ const auditActionSchema = z.enum([
 	"agent.updated",
 	"agent.deleted",
 	"agent.action",
+	"agent.backup_requested",
+	"agent.restored",
 	"platform.settings_updated",
 	"runtime.sessions_updated",
 	"platform.upgrade_requested",
@@ -1692,6 +1880,7 @@ const auditActionSchema = z.enum([
 	"node.registered",
 	"node.registration_renewed",
 	"node.deleted",
+	"node.split_changed",
 	"master_key.reencrypted",
 	"dead_letter.retried",
 	"dead_letter.discarded"
@@ -1785,43 +1974,6 @@ z.object({
 	id: idSchema,
 	userId: idSchema
 });
-z.enum(["monitor", "executor"]);
-const sessionSlotCountSchema = z.int().min(1).max(64);
-const sessionQueueEntrySchema = z.object({
-	agentId: idSchema,
-	agentName: z.string().nullable(),
-	projectId: idSchema.nullable(),
-	projectName: z.string().nullable(),
-	position: z.int().positive(),
-	since: z.iso.datetime(),
-	taskId: z.string().nullable()
-}).meta({ id: "SessionQueueEntry" });
-const sessionPoolSchema = z.object({
-	slots: sessionSlotCountSchema.nullable(),
-	effective: z.int().nonnegative(),
-	inUse: z.int().nonnegative(),
-	waiting: z.array(sessionQueueEntrySchema)
-}).meta({ id: "SessionPool" });
-z.object({
-	version: z.int().nonnegative(),
-	ready: z.boolean(),
-	monitor: sessionPoolSchema,
-	executor: sessionPoolSchema
-}).meta({ id: "SessionSlots" });
-z.object({
-	version: z.int().nonnegative(),
-	monitor: sessionSlotCountSchema.nullable(),
-	executor: sessionSlotCountSchema.nullable()
-}).meta({ id: "UpdateSessionSlotsBody" });
-const agentAdmissionStateSchema = z.discriminatedUnion("state", [z.object({
-	state: z.literal("waiting"),
-	since: z.iso.datetime(),
-	position: z.int().positive()
-}), z.object({ state: z.literal("holding") })]).meta({ id: "AgentAdmissionState" });
-const agentAdmissionSchema = z.object({
-	monitor: agentAdmissionStateSchema.nullable(),
-	executor: agentAdmissionStateSchema.nullable()
-}).meta({ id: "AgentAdmission" });
 //#endregion
 //#region ../../packages/contracts/src/releases.ts
 const kikimoraVersionSchema = z.string().regex(versionTagPattern);
@@ -2215,7 +2367,8 @@ const agentRuntimeSchema = z.object({
 	provision: agentProvisionSchema.nullable(),
 	stopMode: agentStopModeSchema.nullable(),
 	stopDeadlineAt: z.iso.datetime().nullable(),
-	admission: agentAdmissionSchema.nullable()
+	admission: agentAdmissionSchema.nullable(),
+	poolLimit: poolLimitSchema.nullable()
 }).meta({ id: "AgentRuntime" });
 const agentListItemSchema = z.object({
 	id: idSchema,
@@ -2254,6 +2407,7 @@ agentListItemSchema.extend({
 	release: releaseSummarySchema.nullable(),
 	runtime: agentRuntimeSchema,
 	node: agentNodeSchema.nullable(),
+	requiredCapabilities: z.array(nodeCapabilitySchema),
 	runtimeUid: z.int().positive().nullable(),
 	sandbox: agentSandboxSchema.nullable(),
 	createdAt: z.iso.datetime()
@@ -2271,12 +2425,15 @@ const distinctCredentials = {
 const hasUniqueTools = (assignments) => new Set(assignments.map((assignment) => assignment.toolId)).size === assignments.length;
 const agentRepositoryLinksSchema = z.array(agentRepositoryLinkSchema).min(1).max(32);
 const agentToolAssignmentsSchema = z.array(toolAssignmentSchema).max(32).refine(hasUniqueTools, { message: "expected every tool to be assigned once" });
+const hasUniqueCapabilities = (names) => new Set(names).size === names.length;
+const requiredCapabilitiesSchema = z.array(nodeCapabilitySchema).max(nodeCapabilityNames.length).refine(hasUniqueCapabilities, { message: "expected every capability once" });
 const createAgentBodySchema = z.object({
 	name: agentNameSchema,
 	slug: slugSchema.optional(),
 	description: agentDescriptionSchema,
 	kikimoraVersion: kikimoraVersionSchema,
 	nodeId: idSchema,
+	requiredCapabilities: requiredCapabilitiesSchema.optional(),
 	claudeCredentialId: idSchema,
 	githubCredentialId: idSchema,
 	repositories: agentRepositoryLinksSchema,
@@ -2344,6 +2501,43 @@ z.object({
 		z.object({ code: errorCodeSchema })
 	])
 }).meta({ id: "AgentEventFrame" });
+//#endregion
+//#region ../../packages/contracts/src/agent-backups.ts
+const agentBackupTriggers = ["nightly", "manual"];
+const agentBackupSchema = z.object({
+	id: idSchema,
+	agentId: idSchema,
+	nodeId: idSchema,
+	nodeName: z.string().nullable(),
+	trigger: z.enum(agentBackupTriggers),
+	kikimoraVersion: z.string(),
+	entries: z.int().nonnegative(),
+	sizeBytes: z.int().nonnegative(),
+	createdAt: z.iso.datetime(),
+	expiresAt: z.iso.datetime()
+}).meta({ id: "AgentBackup" });
+z.object({
+	items: z.array(agentBackupSchema),
+	retentionDays: z.int().positive()
+}).meta({ id: "AgentBackupList" });
+z.object({ state: z.literal("requested") }).meta({ id: "AgentBackupRequested" });
+z.object({
+	id: idSchema,
+	backupId: idSchema
+});
+z.object({
+	name: agentNameSchema,
+	slug: slugSchema.optional(),
+	nodeId: idSchema
+}).meta({ id: "RestoreAgentBody" });
+z.object({ agentId: idSchema }).meta({ id: "RestoredAgent" });
+z.object({
+	agentId: idSchema,
+	trigger: z.enum(agentBackupTriggers),
+	kikimoraVersion: z.string().min(1).max(64),
+	entries: z.coerce.number().int().nonnegative()
+});
+z.object({ backupId: idSchema });
 [
 	"application/vnd.oci.image.index.v1+json",
 	"application/vnd.oci.image.manifest.v1+json",
@@ -3524,6 +3718,116 @@ const createWhoamiCommand = (adaptersOf) => defineCommand({
 	}
 });
 //#endregion
+//#region src/render/body.ts
+const isTerminal$1 = (stream) => stream.isTTY === true;
+const pipedText$1 = async (stream) => {
+	const chunks = [];
+	for await (const chunk of stream) chunks.push(Buffer.from(chunk));
+	return Buffer.concat(chunks).toString("utf8");
+};
+const fileOptions = { file: { type: "string" } };
+const fileUsage = (what) => [["--file <path>", `read ${what} from a JSON file, or from stdin with -`]];
+const documentOf = async (run, file) => {
+	const text = file === "-" ? isTerminal$1(run.context.io.stdin) ? "" : await pipedText$1(run.context.io.stdin) : await readFileOrRefuse(resolve(run.context.workingDirectory, file));
+	if (text.trim() === "") throw new UsageError(file === "-" ? "Nothing is piped on stdin." : `${file} is empty.`);
+	try {
+		return JSON.parse(text);
+	} catch {
+		throw new CliError(`${file === "-" ? "stdin" : file} is not JSON.`);
+	}
+};
+const readFileOrRefuse = async (path) => {
+	try {
+		return await readFile(path, "utf8");
+	} catch {
+		throw new CliError(`${path} could not be read.`);
+	}
+};
+const validated = (schema, document, what) => {
+	const parsed = schema.safeParse(document);
+	if (!parsed.success) throw new CliError(`That is not ${what}.`, z.prettifyError(parsed.error));
+};
+//#endregion
+//#region src/commands/nodes/shared.ts
+const nodeHints = {
+	...organizationHints,
+	"node.not_found": "kcloud nodes list shows the nodes of the organization.",
+	"node.name_taken": "Another node of the organization has that name.",
+	"node.in_use": "Delete the agents placed on it first; kcloud nodes show <node> lists them.",
+	"node.registration_used": "The node has joined and holds its own credential; it needs no token."
+};
+const splitHints = {
+	...nodeHints,
+	"auth.forbidden": "Splitting a node takes an admin of its organization.",
+	"node.host_unknown": "The node reports its CPUs and memory once its service runs; kcloud nodes show <node> shows its state.",
+	"node.split_exceeds_host": "The split asks for more than the host has; kcloud nodes split <node> shows the host.",
+	"concurrency.conflict": "Someone changed the node meanwhile; run the command again."
+};
+const nodesOf = async (api, organizationId) => dataOf("list the nodes", await api.GET("/organizations/{organizationId}/nodes", { params: { path: { organizationId } } }), nodeHints).items;
+const namesOf = (nodes) => nodes.map(({ name }) => name).join(", ");
+const nodeIn = (nodes, reference, organization) => {
+	const found = nodes.find((node) => node.id === reference.toLowerCase() || node.name === reference);
+	if (found === void 0) throw new CliError(`There is no node ${reference} in ${organization}.`, nodes.length === 0 ? "kcloud nodes create <name> creates one." : `kcloud nodes list shows ${namesOf(nodes)}.`);
+	return found;
+};
+const resolveNode = async (scope, reference) => {
+	const organization = await scope.organization();
+	if (isId(reference)) return {
+		organizationId: organization.id,
+		nodeId: reference
+	};
+	const node = nodeIn(await nodesOf(scope.api, organization.id), reference, organization.slug);
+	return {
+		organizationId: organization.id,
+		nodeId: node.id
+	};
+};
+const nodeDetailOf = async (api, { organizationId, nodeId }) => dataOf("describe the node", await api.GET("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
+	organizationId,
+	nodeId
+} } }), nodeHints);
+const createdNode = async (api, organizationId, name) => {
+	const body = { name };
+	validated(createNodeBodySchema, body, "a node");
+	return dataOf("create the node", await api.POST("/organizations/{organizationId}/nodes", {
+		params: { path: { organizationId } },
+		body
+	}), nodeHints);
+};
+const renewedRegistration = async (api, { organizationId, nodeId }) => dataOf("issue a registration token for the node", await api.POST("/organizations/{organizationId}/nodes/{nodeId}/registration", { params: { path: {
+	organizationId,
+	nodeId
+} } }), nodeHints);
+const deleteNode = async (api, { organizationId, nodeId }) => {
+	doneWith("delete the node", await api.DELETE("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
+		organizationId,
+		nodeId
+	} } }), nodeHints);
+};
+const splitNode = async (api, { organizationId, nodeId }, revision, split) => dataOf(split === null ? "clear the split of the node" : "split the node", await api.PUT("/organizations/{organizationId}/nodes/{nodeId}/split", {
+	params: { path: {
+		organizationId,
+		nodeId
+	} },
+	body: {
+		revision,
+		split
+	}
+}), splitHints);
+const nodeUsage = [["", "a node is named by its name or its id"]];
+//#endregion
+//#region src/commands/projects/shared.ts
+const defaultProjectColor = "#7c86ff";
+const projectHint = {
+	"project.not_found": "kcloud projects list shows the projects you are a member of.",
+	"project.slug_taken": "Another project of the organization has that slug.",
+	"project.invalid_slug": "A slug holds lowercase letters, digits and hyphens.",
+	"project.not_empty": "Delete its agents, credentials, repositories and tools first.",
+	"project.member_not_found": "kcloud projects members list <project> shows them.",
+	"project.member_must_be_active": "kcloud orgs members enable <member> enables the account first."
+};
+const projectOf = async (api, id) => dataOf("describe the project", await api.GET("/projects/{id}", { params: { path: { id } } }), projectHint);
+//#endregion
 //#region src/commands/run.ts
 const runOf = async (adaptersOf, { settings, context }) => {
 	const adapters = adaptersOf(context);
@@ -3554,6 +3858,7 @@ const agentHints = {
 	"agent.invalid_transition": "kcloud agents show <agent> lists the actions it takes now.",
 	"agent.busy": "The agent is working on another action; try again in a moment.",
 	"concurrency.conflict": "Someone changed the agent meanwhile; read it again and retry.",
+	"agent.node_unsuitable": "The node lacks a capability the agent requires; kcloud nodes show <node> lists what it offers.",
 	"node.offline": "The node of the agent is not connected; kcloud nodes show <node> tells when it was last seen."
 };
 const agentFrom = async (run, reference, project) => {
@@ -3561,62 +3866,187 @@ const agentFrom = async (run, reference, project) => {
 	return resolveAgentId(run, reference, project);
 };
 //#endregion
-//#region src/commands/agents/check.ts
-const checkHints = {
+//#region src/commands/agents/backups.ts
+const backupsListHint = "kcloud agents backups list <agent> shows the backups of the agent and their ids.";
+const backupHints = {
 	...agentHints,
-	"runtime.control_unreachable": "The worker is not answering; kcloud agents show <agent> tells whether it runs.",
-	"runtime.monitor_paused": "kcloud agents resume <agent> lets the agent work again.",
-	"runtime.monitor_draining": "The agent stops after its current session; start it again to run a cycle.",
-	"runtime.monitor_limited": "The Claude usage limit holds; the monitor runs its next cycle once it resets.",
-	"runtime.monitor_check_unsupported": "Move the agent to Kikimora 0.10.0 or newer with kcloud agents set, then kcloud agents update."
+	"agent.backup_unavailable": "Backups need the Spaces of the platform and a node that can make them. An administrator of the platform configures the Spaces.",
+	"agent.backup_without_export": "The Kikimora release of the agent cannot export its memory. Move it to 0.12.0 or newer with kcloud agents set, then kcloud agents update.",
+	"agent.backup_in_progress": "A backup of the agent is running already. kcloud agents backups list <agent> shows it once the node has sent it.",
+	"node.offline": "The node of the agent is not connected, so it cannot make a backup. kcloud nodes show <node> tells when it was last seen."
 };
-const checkCommand = (adaptersOf) => defineCommand({
-	name: "check",
-	summary: "Run a monitor cycle now instead of waiting for the interval.",
-	usage: "agents check <agent> [--project <name>]",
-	optionsUsage: agentUsage,
-	options: agentOption,
-	positionals: {
-		min: 1,
-		max: 1
+const restoreHints = {
+	...agentHints,
+	"node.not_found": "kcloud nodes list shows the nodes of the organization.",
+	"node.offline": "The node is not connected. kcloud nodes show <node> tells when it was last seen.",
+	"agent.backup_not_found": `The backup does not exist or has expired. ${backupsListHint}`,
+	"agent.slug_taken": "Another agent of the project has that slug. Pass another with --slug.",
+	"agent.invalid_slug": "A slug holds lowercase letters, digits and hyphens."
+};
+const backupsOf = async (api, agentId) => dataOf("list the backups of the agent", await api.GET("/agents/{id}/backups", { params: { path: { id: agentId } } }), backupHints);
+const requestedBackup = async (api, agentId) => dataOf("back the agent up", await api.POST("/agents/{id}/backups", { params: { path: { id: agentId } } }), backupHints);
+const nodeIdFor = async (api, agentId, node) => {
+	if (isId(node)) return node;
+	const agent = dataOf("describe the agent", await api.GET("/agents/{id}", { params: { path: { id: agentId } } }), agentHints);
+	const project = await projectOf(api, agent.projectId);
+	const nodes = await nodesOf(api, project.organizationId);
+	return nodeIn(nodes, node, `the organization of ${project.slug}`).id;
+};
+const restoredAgent = async (api, agentId, { backupId, name, node, slug }) => {
+	const nodeId = await nodeIdFor(api, agentId, node);
+	return dataOf("restore the agent from the backup", await api.POST("/agents/{id}/backups/{backupId}/restore", {
+		params: { path: {
+			id: agentId,
+			backupId
+		} },
+		body: {
+			name,
+			nodeId,
+			...slug === void 0 ? {} : { slug }
+		}
+	}), restoreHints);
+};
+const keptFor = (days) => `A backup is kept for ${String(days)} ${days === 1 ? "day" : "days"}.`;
+const backupsTable = ({ items, retentionDays }) => items.length === 0 ? `The agent has no backup yet. ${keptFor(retentionDays)}` : [renderTable([
+	{ header: "CREATED" },
+	{ header: "TRIGGER" },
+	{ header: "NODE" },
+	{ header: "KIKIMORA" },
+	{
+		header: "ENTRIES",
+		align: "right"
 	},
-	run: async (invocation) => {
-		const run = await runOf(adaptersOf, invocation);
-		const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
-		const check = dataOf("check the monitor", await run.api.POST("/agents/{id}/monitor/check", { params: { path: { id: agentId } } }), checkHints);
-		return printed(run, check, (answer) => answer.state === "running" ? `Monitor cycle ${String(answer.cycle)} is already running.` : "Monitor cycle requested; it starts now, also outside the active hours.");
+	{
+		header: "SIZE",
+		align: "right"
+	},
+	{ header: "EXPIRES" },
+	{ header: "ID" }
+], items.map((backup) => [
+	backup.createdAt,
+	backup.trigger,
+	backup.nodeName ?? backup.nodeId,
+	backup.kikimoraVersion,
+	String(backup.entries),
+	bytesOf(backup.sizeBytes),
+	backup.expiresAt,
+	backup.id
+])), keptFor(retentionDays)].join("\n");
+const restoreRequestOf = ({ backup, name, node, slug }) => {
+	if (backup === void 0 || name === void 0 || node === void 0 || node.trim() === "") {
+		const missing = [
+			...backup === void 0 ? ["--backup <id>"] : [],
+			...name === void 0 ? ["--name <name>"] : [],
+			...node === void 0 || node.trim() === "" ? ["--node <node>"] : []
+		];
+		throw new UsageError(`agents restore needs ${listOf(missing)}.`, backupsListHint);
 	}
-});
-//#endregion
-//#region src/render/body.ts
-const isTerminal$1 = (stream) => stream.isTTY === true;
-const pipedText$1 = async (stream) => {
-	const chunks = [];
-	for await (const chunk of stream) chunks.push(Buffer.from(chunk));
-	return Buffer.concat(chunks).toString("utf8");
+	if (!isId(backup)) throw new UsageError(`--backup ${backup} is not the id of a backup.`, backupsListHint);
+	const named = agentNameSchema.safeParse(name);
+	if (!named.success) throw new UsageError(`--name needs from 1 to ${String(80)} characters.`);
+	if (slug !== void 0 && !slugSchema.safeParse(slug).success) throw new UsageError(`--slug ${slug} is not a slug.`, "A slug holds lowercase letters, digits and hyphens, at most 40 of them.");
+	return {
+		backupId: backup,
+		name: named.data,
+		node: node.trim(),
+		slug
+	};
 };
-const fileOptions = { file: { type: "string" } };
-const fileUsage = (what) => [["--file <path>", `read ${what} from a JSON file, or from stdin with -`]];
-const documentOf = async (run, file) => {
-	const text = file === "-" ? isTerminal$1(run.context.io.stdin) ? "" : await pipedText$1(run.context.io.stdin) : await readFileOrRefuse(resolve(run.context.workingDirectory, file));
-	if (text.trim() === "") throw new UsageError(file === "-" ? "Nothing is piped on stdin." : `${file} is empty.`);
-	try {
-		return JSON.parse(text);
-	} catch {
-		throw new CliError(`${file === "-" ? "stdin" : file} is not JSON.`);
+const backupsCommand = (adaptersOf) => defineGroup({
+	name: "backups",
+	summary: "The backups of the memory of an agent.",
+	usage: "agents backups <command>",
+	subcommands: [defineCommand({
+		name: "list",
+		summary: "List the backups of an agent, the newest first.",
+		usage: "agents backups list <agent> [--project <name>]",
+		optionsUsage: agentUsage,
+		options: agentOption,
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const run = await runOf(adaptersOf, invocation);
+			const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
+			return printed(run, await backupsOf(run.api, agentId), backupsTable);
+		}
+	}), defineCommand({
+		name: "create",
+		summary: "Ask the node of an agent for a backup now.",
+		usage: "agents backups create <agent> [--project <name>]",
+		optionsUsage: agentUsage,
+		options: agentOption,
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const run = await runOf(adaptersOf, invocation);
+			const reference = invocation.positionals[0] ?? "";
+			const agentId = await agentFrom(run, reference, invocation.values.project);
+			return printed(run, await requestedBackup(run.api, agentId), () => `Backup of ${reference} requested. kcloud agents backups list ${reference} shows it once the node has sent it.`);
+		}
+	})]
+});
+const restoreCommand = (adaptersOf) => defineCommand({
+	name: "restore",
+	summary: "Create a new agent from a backup of an agent.",
+	usage: "agents restore <agent> --backup <id> --name <name> --node <node> [--slug <slug>] [--project <name>]",
+	optionsUsage: [
+		...agentUsage,
+		["--backup <id>", "the backup, by its id from kcloud agents backups list"],
+		["--name <name>", "the name of the new agent"],
+		["--node <node>", "the node the new agent runs on, by name or id"],
+		["--slug <slug>", "the slug of the new agent (default: one made from its name)"],
+		["", "the new agent joins the project of the agent with its configuration and the memory of the backup"]
+	],
+	options: {
+		...agentOption,
+		backup: { type: "string" },
+		name: { type: "string" },
+		node: { type: "string" },
+		slug: { type: "string" }
+	},
+	positionals: {
+		min: 1,
+		max: 1
+	},
+	run: async (invocation) => {
+		const request = restoreRequestOf(invocation.values);
+		const run = await runOf(adaptersOf, invocation);
+		const reference = invocation.positionals[0] ?? "";
+		const agentId = await agentFrom(run, reference, invocation.values.project);
+		return printed(run, await restoredAgent(run.api, agentId, request), (restored) => [`Restored ${request.name} as ${restored.agentId} from backup ${request.backupId} of ${reference}.`, `kcloud agents start ${restored.agentId} starts it once it is provisioned.`].join("\n"));
 	}
+});
+//#endregion
+//#region src/commands/agents/check.ts
+const checkHints = {
+	...agentHints,
+	"runtime.control_unreachable": "The worker is not answering; kcloud agents show <agent> tells whether it runs.",
+	"runtime.monitor_paused": "kcloud agents resume <agent> lets the agent work again.",
+	"runtime.monitor_draining": "The agent stops after its current session; start it again to run a cycle.",
+	"runtime.monitor_limited": "The Claude usage limit holds; the monitor runs its next cycle once it resets.",
+	"runtime.monitor_check_unsupported": "Move the agent to Kikimora 0.10.0 or newer with kcloud agents set, then kcloud agents update."
 };
-const readFileOrRefuse = async (path) => {
-	try {
-		return await readFile(path, "utf8");
-	} catch {
-		throw new CliError(`${path} could not be read.`);
+const checkCommand = (adaptersOf) => defineCommand({
+	name: "check",
+	summary: "Run a monitor cycle now instead of waiting for the interval.",
+	usage: "agents check <agent> [--project <name>]",
+	optionsUsage: agentUsage,
+	options: agentOption,
+	positionals: {
+		min: 1,
+		max: 1
+	},
+	run: async (invocation) => {
+		const run = await runOf(adaptersOf, invocation);
+		const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
+		const check = dataOf("check the monitor", await run.api.POST("/agents/{id}/monitor/check", { params: { path: { id: agentId } } }), checkHints);
+		return printed(run, check, (answer) => answer.state === "running" ? `Monitor cycle ${String(answer.cycle)} is already running.` : "Monitor cycle requested; it starts now, also outside the active hours.");
 	}
-};
-const validated = (schema, document, what) => {
-	const parsed = schema.safeParse(document);
-	if (!parsed.success) throw new CliError(`That is not ${what}.`, z.prettifyError(parsed.error));
-};
+});
 //#endregion
 //#region src/render/confirm.ts
 const confirmed = async ({ prompt, settings, question }) => {
@@ -3627,6 +4057,86 @@ const confirmed = async ({ prompt, settings, question }) => {
 	})) throw new CancelledError("Nothing was changed.");
 };
 //#endregion
+//#region src/commands/nodes/pools.ts
+const poolLimitReasons = {
+	release: "its Kikimora release predates pool limits",
+	restart: "it started before the limits applied; kcloud agents restart applies them",
+	node: "its node holds no pool to a limit"
+};
+const poolLimitText = (limit) => {
+	if (limit === null) return "-";
+	if (limit.enforced) return "enforced";
+	return limit.reason === null ? "none" : `none: ${poolLimitReasons[limit.reason]}`;
+};
+const sessionFailures = {
+	poolMemoryLimit: "killed by the pool memory limit",
+	launcherRefused: "refused by the session starter"
+};
+const sessionFailureText = (reason) => reason === null ? "-" : sessionFailures[reason] ?? reason;
+const unsupportedReasons = { node_outdated: "the node runs a version that reports no pools" };
+const enforcementText = ({ state, reason }) => {
+	switch (state) {
+		case "enforced": return "The node holds each pool to the CPU and memory of its split.";
+		case "unsplit": return "The node has no split, so no pool has a hard limit on CPU or memory.";
+		case "unsupported": return `The node holds no pool to a limit: ${reason === null ? "it cannot" : unsupportedReasons[reason] ?? reason}.`;
+	}
+};
+const memoryOf = (pool) => {
+	if (pool.usage === null) return "-";
+	const { memoryBytes, memoryMaxBytes } = pool.usage;
+	return memoryMaxBytes === null ? bytesOf(memoryBytes) : `${bytesOf(memoryBytes)} of ${bytesOf(memoryMaxBytes)}`;
+};
+const roles = ["monitor", "executor"];
+const queueOf = (pools) => {
+	const waiting = roles.flatMap((role) => pools[role].waiting.map((entry) => [
+		role,
+		String(entry.position),
+		entry.projectName ?? "-",
+		entry.agentName ?? entry.agentId,
+		entry.since,
+		entry.taskId ?? "-"
+	]));
+	return waiting.length === 0 ? "No session waits for a slot." : renderTable([
+		{ header: "WAITS FOR" },
+		{
+			header: "PLACE",
+			align: "right"
+		},
+		{ header: "PROJECT" },
+		{ header: "AGENT" },
+		{ header: "SINCE" },
+		{ header: "TASK" }
+	], waiting);
+};
+const poolsText = (pools) => [
+	enforcementText(pools.enforcement),
+	renderTable([
+		{ header: "POOL" },
+		{ header: "SLOTS IN USE" },
+		{
+			header: "CPU IN USE",
+			align: "right"
+		},
+		{ header: "MEMORY IN USE" },
+		{
+			header: "MEMORY KILLS",
+			align: "right"
+		}
+	], roles.map((role) => {
+		const pool = pools[role];
+		const cpus = pool.usage?.cpus ?? null;
+		return [
+			role,
+			`${pool.inUse} of ${pool.slots}`,
+			cpus === null ? "-" : cpus.toFixed(2),
+			memoryOf(pool),
+			pool.usage === null ? "-" : String(pool.usage.memoryKills)
+		];
+	})),
+	"",
+	queueOf(pools)
+].join("\n");
+//#endregion
 //#region src/commands/agents/plan.ts
 const agentPlanOf = (agent) => ({
 	name: agent.name,
@@ -3634,6 +4144,7 @@ const agentPlanOf = (agent) => ({
 	description: agent.description,
 	kikimoraVersion: agent.kikimoraVersion,
 	...agent.node === null ? {} : { nodeId: agent.node.id },
+	requiredCapabilities: agent.requiredCapabilities,
 	claudeCredentialId: agent.claudeCredential.id,
 	githubCredentialId: agent.githubCredential.id,
 	repositories: agent.repositories.map(({ repositoryId, directory }) => ({
@@ -3757,328 +4268,88 @@ const configCommands = (adaptersOf) => [
 		run: async (invocation) => {
 			const run = await runOf(adaptersOf, invocation);
 			const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
-			const file = invocation.values.file;
-			if (file === void 0) throw new UsageError("agents set needs --file <path>.", "The file holds the sections to change; kcloud agents show <agent> --json shows the current ones.");
-			const agent = await changedAgent(run.api, agentId, await documentOf(run, file));
-			return printed(run, agent, (changed) => changed.restartRequired ? `Changed ${changed.name}; it needs kcloud agents update to take the change.` : `Changed ${changed.name}.`);
-		}
-	}),
-	defineCommand({
-		name: "delete",
-		summary: "Delete an agent and its container.",
-		usage: "agents delete <agent> [--project <name>] [--now]",
-		optionsUsage: [...agentUsage, ["--now", "delete it at once instead of after its current session"]],
-		options: {
-			...agentOption,
-			now: {
-				type: "boolean",
-				default: false
-			}
-		},
-		positionals: {
-			min: 1,
-			max: 1
-		},
-		run: async (invocation) => {
-			const run = await runOf(adaptersOf, invocation);
-			const reference = invocation.positionals[0] ?? "";
-			const agentId = await agentFrom(run, reference, invocation.values.project);
-			await confirmed({
-				prompt: run.prompt,
-				settings: run.settings,
-				question: `Delete ${reference}? Its workspace and its history go with it.`
-			});
-			doneWith("delete the agent", await run.api.DELETE("/agents/{id}", { params: {
-				path: { id: agentId },
-				...invocation.values.now ? { query: { force: "true" } } : {}
-			} }), agentHints);
-			return said(run, invocation.values.now ? `Deleting ${reference} now.` : `${reference} is deleted after its current session.`);
-		}
-	})
-];
-const slotOf = (state) => {
-	if (state === null) return "-";
-	return state.state === "holding" ? "holding a slot" : `place ${String(state.position)} in the queue since ${state.since}`;
-};
-const admissionRowsOf = (agent) => {
-	const { admission } = agent.runtime;
-	return admission === null ? [] : [["monitor slot", slotOf(admission.monitor)], ["executor slot", slotOf(admission.executor)]];
-};
-const detailsOf = (agent) => [
-	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
-		["name", agent.name],
-		["slug", agent.slug],
-		["state", agent.state],
-		["wanted", agent.desiredState],
-		["observed", agent.observedState],
-		["release", agent.kikimoraVersion],
-		["node", agent.node === null ? "none" : `${agent.node.name} (${agent.node.state})`],
-		["timezone", agent.timezone],
-		["machine", `${agent.machine.cpus} vCPU, ${agent.machine.memoryMb} MB`],
-		["docker", agent.machine.docker ? "yes" : "no"],
-		["browser", agent.machine.browser ? "yes" : "no"],
-		["container", agent.runtime.containerId ?? "none"],
-		["health", agent.runtime.health],
-		...admissionRowsOf(agent),
-		["pending", agent.restartRequired ? agent.restartReasons.join(", ") : "-"],
-		["actions", agent.availableActions.join(", ")],
-		["version", String(agent.version)],
-		["id", agent.id]
-	]),
-	"",
-	agent.repositories.length === 0 ? "No repository is cloned into the workspace." : renderTable([
-		{ header: "REPOSITORY" },
-		{ header: "DIRECTORY" },
-		{ header: "STATUS" }
-	], agent.repositories.map((repository) => [
-		`${repository.owner}/${repository.name}`,
-		repository.directory,
-		repository.status
-	]))
-].join("\n");
-//#endregion
-//#region src/commands/nodes.ts
-const nodeHints = {
-	...organizationHints,
-	"node.not_found": "kcloud nodes list shows the nodes of the organization.",
-	"node.name_taken": "Another node of the organization has that name.",
-	"node.in_use": "Delete the agents placed on it first; kcloud nodes show <node> lists them.",
-	"node.registration_used": "The node has joined and holds its own credential; it needs no token."
-};
-const nodesOf = async (api, organizationId) => dataOf("list the nodes", await api.GET("/organizations/{organizationId}/nodes", { params: { path: { organizationId } } }), nodeHints).items;
-const namesOf = (nodes) => nodes.map(({ name }) => name).join(", ");
-const nodeIn = (nodes, reference, organization) => {
-	const found = nodes.find((node) => node.id === reference.toLowerCase() || node.name === reference);
-	if (found === void 0) throw new CliError(`There is no node ${reference} in ${organization}.`, nodes.length === 0 ? "kcloud nodes create <name> creates one." : `kcloud nodes list shows ${namesOf(nodes)}.`);
-	return found;
-};
-const resolveNode = async (scope, reference) => {
-	const organization = await scope.organization();
-	if (isId(reference)) return {
-		organizationId: organization.id,
-		nodeId: reference
-	};
-	const node = nodeIn(await nodesOf(scope.api, organization.id), reference, organization.slug);
-	return {
-		organizationId: organization.id,
-		nodeId: node.id
-	};
-};
-const nodeDetailOf = async (api, { organizationId, nodeId }) => dataOf("describe the node", await api.GET("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
-	organizationId,
-	nodeId
-} } }), nodeHints);
-const createdNode = async (api, organizationId, name) => {
-	const body = { name };
-	validated(createNodeBodySchema, body, "a node");
-	return dataOf("create the node", await api.POST("/organizations/{organizationId}/nodes", {
-		params: { path: { organizationId } },
-		body
-	}), nodeHints);
-};
-const renewedRegistration = async (api, { organizationId, nodeId }) => dataOf("issue a registration token for the node", await api.POST("/organizations/{organizationId}/nodes/{nodeId}/registration", { params: { path: {
-	organizationId,
-	nodeId
-} } }), nodeHints);
-const deleteNode = async (api, { organizationId, nodeId }) => {
-	doneWith("delete the node", await api.DELETE("/organizations/{organizationId}/nodes/{nodeId}", { params: { path: {
-		organizationId,
-		nodeId
-	} } }), nodeHints);
-};
-const gibibytes = (bytes) => `${(bytes / 1024 ** 3).toFixed(1)} GiB`;
-const hostOf = (node) => node.host === null ? "-" : `${node.host.cpus} CPU, ${gibibytes(node.host.memoryBytes)} of memory`;
-const capabilitiesOf = (node) => {
-	if (node.capabilities === null) return "-";
-	const { sandbox, uidIsolation } = node.capabilities;
-	return `sandbox ${sandbox ? "yes" : "no"}, uid isolation ${uidIsolation ? "yes" : "no"}`;
-};
-const registrationOf = (node) => node.registrationExpiresAt === null ? "-" : `a token waits until ${node.registrationExpiresAt}`;
-const storageOf = ({ state, freeBytes, totalBytes, path }) => `${state}, ${gibibytes(freeBytes)} free of ${gibibytes(totalBytes)} at ${path}`;
-const runtimeRowsOf = (runtime) => [
-	["reported", runtime.reportedAt],
-	["docker", runtime.docker.lastError === null ? runtime.docker.state : `${runtime.docker.state}: ${runtime.docker.lastError}`],
-	["data storage", storageOf(runtime.storage.data)],
-	["engine storage", storageOf(runtime.storage.engine)],
-	["last reconcile", runtime.reconcile.lastTickError === null ? runtime.reconcile.lastTickAt ?? "never" : `${runtime.reconcile.lastTickAt ?? "never"}: ${runtime.reconcile.lastTickError}`],
-	["agents", `${runtime.reconcile.agentsActive} active, ${runtime.reconcile.agentsQueued} queued`],
-	["monitor slots", `${runtime.sessions.monitor.inUse} of ${runtime.sessions.monitor.effective} in use`],
-	["executor slots", `${runtime.sessions.executor.inUse} of ${runtime.sessions.executor.effective} in use`],
-	["log readers", String(runtime.ingest.readers)]
-];
-const nodeDetailsText = (node) => [
-	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
-		["name", node.name],
-		["state", node.state],
-		["provider", node.provider],
-		["engine", node.engine ?? "-"],
-		["version", node.version ?? "-"],
-		["host", hostOf(node)],
-		["server", node.host?.serverVersion ?? "-"],
-		["data root", node.host?.dataRoot ?? "-"],
-		["capabilities", capabilitiesOf(node)],
-		["registration", registrationOf(node)],
-		["connected", node.connectedAt ?? "never"],
-		["last seen", node.lastSeenAt ?? "never"],
-		["created", node.createdAt],
-		["id", node.id]
-	]),
-	"",
-	node.agents.length === 0 ? "No agent is placed on the node." : renderTable([
-		{ header: "PROJECT" },
-		{ header: "AGENT" },
-		{ header: "STATE" },
-		{ header: "ID" }
-	], node.agents.map((agent) => [
-		agent.projectName,
-		agent.slug,
-		agent.state,
-		agent.id
-	])),
-	"",
-	node.runtime === null ? "The node has reported no runtime yet." : renderTable([{ header: "RUNTIME" }, { header: "VALUE" }], runtimeRowsOf(node.runtime))
-].join("\n");
-const startHintOf = (origin) => [
-	"Start the node with it as docs/install.md of kikimora-cloud describes. On a Linux host, after read -rs token:",
-	`  printf '%s\\n' "$token" | /opt/kikimora-cloud/infra/node/install.sh --platform-url ${origin} --image ghcr.io/kikimoradev/kikimora-cloud/node:<version> --registration-token -`,
-	"On a Windows PC:",
-	`  C:\\kikimora-cloud\\src\\infra\\windows\\install.ps1 -PlatformUrl ${origin} -RegistrationToken <token>`
-].join("\n");
-const printedRegistration = (run, created) => {
-	if (run.settings.json) {
-		run.context.terminal.json(created);
-		return exitCodes.ok;
-	}
-	run.context.terminal.line(created.registration.token);
-	run.context.terminal.error([`The registration token of ${created.node.name} is shown only here and works once, until ${created.registration.expiresAt}.`, startHintOf(run.origin)].join("\n"));
-	return exitCodes.ok;
-};
-const nodeUsage = [["", "a node is named by its name or its id"]];
-const createNodesCommand = (adaptersOf) => defineGroup({
-	name: "nodes",
-	summary: "The nodes of the organization, the hosts its agents run on.",
-	usage: "nodes <command>",
-	subcommands: [
-		defineCommand({
-			name: "list",
-			summary: "List the nodes of the organization.",
-			usage: "nodes list",
-			options: {},
-			positionals: {
-				min: 0,
-				max: 0
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const organization = await run.organization();
-				const items = await nodesOf(run.api, organization.id);
-				return printed(run, items, (nodes) => nodes.length === 0 ? `${organization.slug} has no node yet; kcloud nodes create <name> creates one.` : renderTable([
-					{ header: "NAME" },
-					{ header: "STATE" },
-					{ header: "ENGINE" },
-					{ header: "VERSION" },
-					{
-						header: "AGENTS",
-						align: "right"
-					},
-					{ header: "LAST SEEN" },
-					{ header: "ID" }
-				], nodes.map((node) => [
-					node.name,
-					node.state,
-					node.engine ?? "-",
-					node.version ?? "-",
-					String(node.agentCount),
-					node.lastSeenAt ?? "never",
-					node.id
-				])));
-			}
-		}),
-		defineCommand({
-			name: "show",
-			summary: "Show a node with its host, the agents placed on it and its runtime.",
-			usage: "nodes show <node>",
-			optionsUsage: nodeUsage,
-			options: {},
-			positionals: {
-				min: 1,
-				max: 1
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const reference = await resolveNode(run, invocation.positionals[0] ?? "");
-				return printed(run, await nodeDetailOf(run.api, reference), nodeDetailsText);
-			}
-		}),
-		defineCommand({
-			name: "create",
-			summary: "Create a node and print its one-time registration token.",
-			usage: "nodes create <name>",
-			optionsUsage: [["", "the name holds lowercase letters, digits and hyphens"], ["", "the token goes to stdout alone, how to start the node to stderr"]],
-			options: {},
-			positionals: {
-				min: 1,
-				max: 1
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const organization = await run.organization();
-				return printedRegistration(run, await createdNode(run.api, organization.id, invocation.positionals[0] ?? ""));
-			}
-		}),
-		defineCommand({
-			name: "token",
-			summary: "Issue a new registration token for a node that has not joined yet.",
-			usage: "nodes token <node>",
-			optionsUsage: [...nodeUsage, ["", "the token replaces the one issued before, which stops working"]],
-			options: {},
-			positionals: {
-				min: 1,
-				max: 1
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const reference = await resolveNode(run, invocation.positionals[0] ?? "");
-				return printedRegistration(run, await renewedRegistration(run.api, reference));
-			}
-		}),
-		defineCommand({
-			name: "delete",
-			summary: "Delete a node that runs no agent.",
-			usage: "nodes delete <node>",
-			optionsUsage: nodeUsage,
-			options: {},
-			positionals: {
-				min: 1,
-				max: 1
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const given = invocation.positionals[0] ?? "";
-				const reference = await resolveNode(run, given);
-				await confirmed({
-					prompt: run.prompt,
-					settings: run.settings,
-					question: `Delete the node ${given}? Its host can no longer reach the platform.`
-				});
-				await deleteNode(run.api, reference);
-				return said(run, `Deleted the node ${given}.`);
+			const file = invocation.values.file;
+			if (file === void 0) throw new UsageError("agents set needs --file <path>.", "The file holds the sections to change; kcloud agents show <agent> --json shows the current ones.");
+			const agent = await changedAgent(run.api, agentId, await documentOf(run, file));
+			return printed(run, agent, (changed) => changed.restartRequired ? `Changed ${changed.name}; it needs kcloud agents update to take the change.` : `Changed ${changed.name}.`);
+		}
+	}),
+	defineCommand({
+		name: "delete",
+		summary: "Delete an agent and its container.",
+		usage: "agents delete <agent> [--project <name>] [--now]",
+		optionsUsage: [...agentUsage, ["--now", "delete it at once instead of after its current session"]],
+		options: {
+			...agentOption,
+			now: {
+				type: "boolean",
+				default: false
 			}
-		})
-	]
-});
-//#endregion
-//#region src/commands/projects/shared.ts
-const defaultProjectColor = "#7c86ff";
-const projectHint = {
-	"project.not_found": "kcloud projects list shows the projects you are a member of.",
-	"project.slug_taken": "Another project of the organization has that slug.",
-	"project.invalid_slug": "A slug holds lowercase letters, digits and hyphens.",
-	"project.not_empty": "Delete its agents, credentials, repositories and tools first.",
-	"project.member_not_found": "kcloud projects members list <project> shows them.",
-	"project.member_must_be_active": "kcloud orgs members enable <member> enables the account first."
+		},
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const run = await runOf(adaptersOf, invocation);
+			const reference = invocation.positionals[0] ?? "";
+			const agentId = await agentFrom(run, reference, invocation.values.project);
+			await confirmed({
+				prompt: run.prompt,
+				settings: run.settings,
+				question: `Delete ${reference}? Its workspace and its history go with it.`
+			});
+			doneWith("delete the agent", await run.api.DELETE("/agents/{id}", { params: {
+				path: { id: agentId },
+				...invocation.values.now ? { query: { force: "true" } } : {}
+			} }), agentHints);
+			return said(run, invocation.values.now ? `Deleting ${reference} now.` : `${reference} is deleted after its current session.`);
+		}
+	})
+];
+const slotOf = (state) => {
+	if (state === null) return "-";
+	return state.state === "holding" ? "holding a slot" : `place ${String(state.position)} in the queue since ${state.since}`;
 };
-const projectOf = async (api, id) => dataOf("describe the project", await api.GET("/projects/{id}", { params: { path: { id } } }), projectHint);
+const admissionRowsOf = (agent) => {
+	const { admission } = agent.runtime;
+	return admission === null ? [] : [["monitor slot", slotOf(admission.monitor)], ["executor slot", slotOf(admission.executor)]];
+};
+const poolLimitRowsOf = ({ runtime }) => runtime.poolLimit === null ? [] : [["pool limit", poolLimitText(runtime.poolLimit)]];
+const detailsOf = (agent) => [
+	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
+		["name", agent.name],
+		["slug", agent.slug],
+		["state", agent.state],
+		["wanted", agent.desiredState],
+		["observed", agent.observedState],
+		["release", agent.kikimoraVersion],
+		["node", agent.node === null ? "none" : `${agent.node.name} (${agent.node.state})`],
+		["requires", agent.requiredCapabilities.length === 0 ? "nothing" : agent.requiredCapabilities.join(", ")],
+		["timezone", agent.timezone],
+		["machine", `${agent.machine.cpus} vCPU, ${agent.machine.memoryMb} MB`],
+		["docker", agent.machine.docker ? "yes" : "no"],
+		["browser", agent.machine.browser ? "yes" : "no"],
+		["container", agent.runtime.containerId ?? "none"],
+		["health", agent.runtime.health],
+		...admissionRowsOf(agent),
+		...poolLimitRowsOf(agent),
+		["pending", agent.restartRequired ? agent.restartReasons.join(", ") : "-"],
+		["actions", agent.availableActions.join(", ")],
+		["version", String(agent.version)],
+		["id", agent.id]
+	]),
+	"",
+	agent.repositories.length === 0 ? "No repository is cloned into the workspace." : renderTable([
+		{ header: "REPOSITORY" },
+		{ header: "DIRECTORY" },
+		{ header: "STATUS" }
+	], agent.repositories.map((repository) => [
+		`${repository.owner}/${repository.name}`,
+		repository.directory,
+		repository.status
+	]))
+].join("\n");
 //#endregion
 //#region src/commands/agents/placement.ts
 const placedNodeId = async (run, { projectId, given, ask }) => {
@@ -4204,8 +4475,16 @@ const promptText = async (run, file, question) => {
 		validate: (value) => value.trim() === "" ? "cannot be empty" : void 0
 	});
 };
+const isCapability = (name) => nodeCapabilityNames.some((capability) => capability === name);
+const requiredCapabilitiesOf = (given) => {
+	const names = given.flatMap((value) => value.split(",")).map((name) => name.trim()).filter((name) => name !== "");
+	const unknown = names.filter((name) => !isCapability(name));
+	if (unknown.length > 0) throw new UsageError(`--require ${unknown.join(", ")} ${unknown.length === 1 ? "is not a capability" : "are not capabilities"} of a node.`, `The capabilities are ${nodeCapabilityNames.join(", ")}.`);
+	return [...new Set(names.filter(isCapability))];
+};
+const requirementOf = (required) => required === void 0 ? {} : { requiredCapabilities: [...required] };
 const localTimezone = () => Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
-const askedPlan = async (run, projectId, values) => {
+const askedPlan = async (run, projectId, values, required) => {
 	const nodeId = await placedNodeId(run, {
 		projectId,
 		given: values.node,
@@ -4229,6 +4508,7 @@ const askedPlan = async (run, projectId, values) => {
 		description: "",
 		kikimoraVersion: release,
 		nodeId,
+		...requirementOf(required),
 		claudeCredentialId: await chosenCredential(run.prompt, catalogue, (kind) => claudeKinds.has(kind), "The Claude credential it works with"),
 		githubCredentialId: await chosenCredential(run.prompt, catalogue, (kind) => kind === "github_pat", "The GitHub credential it clones with"),
 		repositories: [...await chosenRepositories(run.prompt, catalogue)],
@@ -4248,7 +4528,7 @@ const askedPlan = async (run, projectId, values) => {
 	};
 };
 const isObject = (document) => typeof document === "object" && document !== null && !Array.isArray(document);
-const fileOf = async (run, projectId, { file, node }) => {
+const fileOf = async (run, projectId, { file, node }, required) => {
 	const document = await documentOf(run, file);
 	const placed = !isObject(document) || node === void 0 && "nodeId" in document ? document : {
 		...document,
@@ -4258,16 +4538,21 @@ const fileOf = async (run, projectId, { file, node }) => {
 			ask: false
 		})
 	};
-	validated(createAgentBodySchema, placed, "an agent");
-	return placed;
+	const plan = isObject(placed) ? {
+		...placed,
+		...requirementOf(required)
+	} : placed;
+	validated(createAgentBodySchema, plan, "an agent");
+	return plan;
 };
 const createCommand = (adaptersOf) => defineCommand({
 	name: "create",
 	summary: "Create an agent from a file, from flags, or by asking step by step.",
-	usage: "agents create --project <name> [--node <node>] [--file <path>] [--name <name>]",
+	usage: "agents create --project <name> [--node <node>] [--require <capability,...>] [--file <path>] [--name <name>]",
 	optionsUsage: [
 		["--project <name>", "the project that owns the agent"],
 		["--node <node>", "the node it runs on, by name or id; needed when the organization has several"],
+		["--require <capability,...>", `what its node has to offer: ${nodeCapabilityNames.join(", ")}`],
 		["--file <path>", "the whole agent as JSON, or - to read stdin"],
 		["--name <name>", "the name of the agent, instead of asking"],
 		["--release <x.y.z>", "the Kikimora release it runs, instead of asking"],
@@ -4277,12 +4562,16 @@ const createCommand = (adaptersOf) => defineCommand({
 		["--docker", "give the agent a Docker sidecar, when the project allows it"],
 		["--browser", "give the agent a browser"],
 		["", "kcloud agents show <agent> --as-file prints what --file takes"],
-		["", "--node replaces the nodeId of the file"]
+		["", "--node and --require replace the nodeId and requiredCapabilities of the file"]
 	],
 	options: {
 		...fileOptions,
 		project: { type: "string" },
 		node: { type: "string" },
+		require: {
+			type: "string",
+			multiple: true
+		},
 		name: { type: "string" },
 		release: { type: "string" },
 		"monitor-prompt-file": { type: "string" },
@@ -4303,13 +4592,14 @@ const createCommand = (adaptersOf) => defineCommand({
 	},
 	run: async (invocation) => {
 		const { values } = invocation;
+		const required = values.require === void 0 ? void 0 : requiredCapabilitiesOf(values.require);
 		const run = await runOf(adaptersOf, invocation);
 		if (values.project === void 0) throw new UsageError("agents create needs --project <name>.", "kcloud projects list shows the projects you are a member of.");
 		const projectId = await resolveProjectId(run, values.project);
-		const body = values.file === void 0 ? await askedPlan(run, projectId, values) : await fileOf(run, projectId, {
+		const body = values.file === void 0 ? await askedPlan(run, projectId, values, required) : await fileOf(run, projectId, {
 			file: values.file,
 			node: values.node
-		});
+		}, required);
 		const agent = dataOf("create the agent", await run.api.POST("/projects/{id}/agents", {
 			params: { path: { id: projectId } },
 			body
@@ -4488,6 +4778,7 @@ const observabilityCommands = (adaptersOf) => [
 				{ header: "ROLE" },
 				{ header: "MODEL" },
 				{ header: "OUTCOME" },
+				{ header: "FAILURE" },
 				{
 					header: "COST",
 					align: "right"
@@ -4498,6 +4789,7 @@ const observabilityCommands = (adaptersOf) => [
 				session.agentRole ?? "-",
 				session.model ?? "-",
 				session.ok === null ? "running" : session.ok ? "ok" : "failed",
+				sessionFailureText(session.failureReason),
 				session.costUsd === null ? "-" : session.costUsd.toFixed(2),
 				session.sessionId
 			])));
@@ -5093,6 +5385,8 @@ const createAgentsCommand = (adaptersOf) => defineGroup({
 		...lifecycleCommands(adaptersOf),
 		checkCommand(adaptersOf),
 		tasksCommand(adaptersOf),
+		backupsCommand(adaptersOf),
+		restoreCommand(adaptersOf),
 		...observabilityCommands(adaptersOf),
 		...streamCommands(adaptersOf)
 	]
@@ -5629,7 +5923,7 @@ const agentTools = [
 	defineTool({
 		name: "agent_create",
 		title: "Create an agent",
-		description: "Create an agent in a project. The node it runs on, the credentials, repositories and tools are named by the ids that nodes_list, credentials_list, repositories_list and tools_list return; agent_show with asPlan shows a complete example. The agent stays stopped until agent_action starts it.",
+		description: "Create an agent in a project. The node it runs on, the credentials, repositories and tools are named by the ids that nodes_list, credentials_list, repositories_list and tools_list return; agent_show with asPlan shows a complete example. requiredCapabilities names what the node has to offer, from the offered list of nodes_list; the instance refuses a node that lacks one. The agent stays stopped until agent_action starts it.",
 		operations: ["createAgent"],
 		safety: "write",
 		input: z.object({
@@ -5680,48 +5974,475 @@ const agentTools = [
 		}
 	}),
 	defineTool({
-		name: "agent_action",
-		title: "Start, pause, resume, restart or update an agent",
-		description: "start lets the agent work, pause holds it between sessions, resume lets a paused agent work again, restart restarts its container, update replaces the container to apply pending changes. The agent returns with the actions it takes next.",
-		operations: ["runAgentAction"],
-		safety: "write",
-		input: z.object({
-			...agentFields,
-			action: z.enum([
-				"start",
-				"pause",
-				"resume",
-				"restart",
-				"update"
-			])
-		}),
-		run: async ({ action, ...reference }, run) => actionOn(run, await agentIdOf(run, reference), action, false)
+		name: "agent_action",
+		title: "Start, pause, resume, restart or update an agent",
+		description: "start lets the agent work, pause holds it between sessions, resume lets a paused agent work again, restart restarts its container, update replaces the container to apply pending changes. The agent returns with the actions it takes next.",
+		operations: ["runAgentAction"],
+		safety: "write",
+		input: z.object({
+			...agentFields,
+			action: z.enum([
+				"start",
+				"pause",
+				"resume",
+				"restart",
+				"update"
+			])
+		}),
+		run: async ({ action, ...reference }, run) => actionOn(run, await agentIdOf(run, reference), action, false)
+	}),
+	defineTool({
+		name: "agent_check",
+		title: "Run a monitor cycle now",
+		description: "Ask the monitor of an agent to look for work now instead of waiting for its interval, also outside its active hours. state requested means a cycle starts at once; running names the cycle already in progress. A paused, stopping or usage-limited monitor refuses with an error.",
+		operations: ["checkAgentMonitor"],
+		safety: "write",
+		input: z.object(agentFields),
+		run: async (reference, run) => dataOf("check the monitor", await run.api.POST("/agents/{id}/monitor/check", { params: { path: { id: await agentIdOf(run, reference) } } }), checkHints)
+	}),
+	defineTool({
+		name: "agent_interrupt",
+		title: "Stop, reset or cancel an agent",
+		description: "stop stops the agent after its current session, or at once with now; reset throws its workspace away and provisions it again; cancel cancels what it is doing.",
+		operations: ["runAgentAction"],
+		safety: "destructive",
+		input: z.object({
+			...agentFields,
+			action: z.enum([
+				"stop",
+				"reset",
+				"cancel"
+			]),
+			now: z.boolean().default(false).describe("For stop: stop the container at once.")
+		}),
+		run: async ({ action, now, ...reference }, run) => actionOn(run, await agentIdOf(run, reference), action, action === "stop" && now)
+	})
+];
+//#endregion
+//#region src/commands/nodes/split.ts
+const splitFields = [
+	"reserve.cpus",
+	"reserve.memoryMb",
+	"monitor.cpus",
+	"monitor.memoryMb",
+	"monitor.slots",
+	"executor.cpus",
+	"executor.memoryMb",
+	"executor.slots"
+];
+const valuesOf = (split) => ({
+	"reserve.cpus": split.reserve.cpus,
+	"reserve.memoryMb": split.reserve.memoryMb,
+	"monitor.cpus": split.monitor.cpus,
+	"monitor.memoryMb": split.monitor.memoryMb,
+	"monitor.slots": split.monitor.slots,
+	"executor.cpus": split.executor.cpus,
+	"executor.memoryMb": split.executor.memoryMb,
+	"executor.slots": split.executor.slots
+});
+const splitOf = (values) => ({
+	reserve: {
+		cpus: values["reserve.cpus"],
+		memoryMb: values["reserve.memoryMb"]
+	},
+	monitor: {
+		cpus: values["monitor.cpus"],
+		memoryMb: values["monitor.memoryMb"],
+		slots: values["monitor.slots"]
+	},
+	executor: {
+		cpus: values["executor.cpus"],
+		memoryMb: values["executor.memoryMb"],
+		slots: values["executor.slots"]
+	}
+});
+const isComplete = (values) => splitFields.every((field) => values[field] !== void 0);
+const changeOfParts = ({ reserve, monitor, executor }) => {
+	const given = {
+		"reserve.cpus": reserve?.cpus,
+		"reserve.memoryMb": reserve?.memoryMb,
+		"monitor.cpus": monitor?.cpus,
+		"monitor.memoryMb": monitor?.memoryMb,
+		"monitor.slots": monitor?.slots,
+		"executor.cpus": executor?.cpus,
+		"executor.memoryMb": executor?.memoryMb,
+		"executor.slots": executor?.slots
+	};
+	return Object.fromEntries(Object.entries(given).filter((entry) => entry[1] !== void 0));
+};
+const cpusText = (cpus) => String(Math.round(cpus * 100) / 100);
+const hostText = (host) => `${cpusText(host.cpus)} CPU and ${hostMemoryMbOf(host)} MB`;
+const excessText = ({ cpus, memoryMb }) => [...cpus > 0 ? [`${cpusText(cpus)} CPU`] : [], ...memoryMb > 0 ? [`${memoryMb} MB`] : []].join(" and ");
+const fittingSplit = (node, change, nameOf) => {
+	const merged = {
+		...node.split === null ? {} : valuesOf(node.split),
+		...change
+	};
+	if (!isComplete(merged)) {
+		const missing = splitFields.filter((field) => merged[field] === void 0);
+		throw new UsageError(`${node.name} has no split yet, so a split needs every part; ${missing.map(nameOf).join(", ")} ${missing.length === 1 ? "is" : "are"} missing.`, "Once the node has a split, a part left out keeps its value.");
+	}
+	const split = splitOf(merged);
+	validated(nodeSplitSchema, split, "a split of a node");
+	if (node.host === null) throw new CliError(`${node.name} has not reported its CPUs and memory yet, so it cannot be split.`, "The node reports them once its service runs; kcloud nodes show <node> shows its state.");
+	if (!splitFits(split, node.host)) throw new CliError(`The split asks for ${excessText(splitOverflowOf(split, node.host))} more than ${node.name} has.`, `${node.name} has ${hostText(node.host)}; shrink a pool or the reserve.`);
+	return split;
+};
+const splitViewOf = (node) => {
+	const overflow = node.split === null || node.host === null ? null : splitOverflowOf(node.split, node.host);
+	return {
+		id: node.id,
+		name: node.name,
+		revision: node.revision,
+		host: node.host === null ? null : {
+			cpus: node.host.cpus,
+			memoryMb: hostMemoryMbOf(node.host)
+		},
+		split: node.split,
+		free: overflow === null ? null : {
+			cpus: -overflow.cpus,
+			memoryMb: -overflow.memoryMb
+		}
+	};
+};
+const resourceCells = ({ cpus, memoryMb }) => [cpusText(cpus), `${memoryMb} MB`];
+const oneSlotOf = ({ cpus, memoryMb, slots }) => `${cpusText(cpus / slots)} CPU, ${Math.floor(memoryMb / slots)} MB`;
+const hostLineOf = (view) => view.host === null ? `${view.name} has not reported its CPUs and memory yet.` : `The host has ${cpusText(view.host.cpus)} CPU and ${view.host.memoryMb} MB.`;
+const splitTableOf = (view, split) => {
+	const poolRow = (role) => [
+		role,
+		...resourceCells(split[role]),
+		String(split[role].slots),
+		oneSlotOf(split[role])
+	];
+	const rows = [
+		[
+			"reserve",
+			...resourceCells(split.reserve),
+			"-",
+			"-"
+		],
+		poolRow("monitor"),
+		poolRow("executor"),
+		...view.free === null ? [] : [[
+			"free",
+			...resourceCells(view.free),
+			"-",
+			"-"
+		]],
+		...view.host === null ? [] : [[
+			"host",
+			...resourceCells(view.host),
+			"-",
+			"-"
+		]]
+	];
+	const over = view.free === null ? "" : excessText({
+		cpus: -view.free.cpus,
+		memoryMb: -view.free.memoryMb
+	});
+	return [
+		renderTable([
+			{ header: "PART" },
+			{
+				header: "CPU",
+				align: "right"
+			},
+			{
+				header: "MEMORY",
+				align: "right"
+			},
+			{
+				header: "SLOTS",
+				align: "right"
+			},
+			{ header: "ONE SLOT" }
+		], rows),
+		...view.host === null ? ["", hostLineOf(view)] : [],
+		...over === "" ? [] : ["", `The split asks for ${over} more than the host has.`]
+	].join("\n");
+};
+const splitText = (view) => view.split === null ? [
+	`${view.name} has no split, so its slots are counted from its host and no pool has a hard limit on CPU or memory.`,
+	hostLineOf(view),
+	`kcloud nodes split set ${view.name} with every part splits it.`
+].join("\n") : splitTableOf(view, view.split);
+const splitSummaryOf = (split) => {
+	if (split === null) return "none, slots counted from the host without hard limits";
+	const { reserve, monitor, executor } = split;
+	const pool = (role, { cpus, memoryMb, slots }) => `${role} ${cpusText(cpus)} CPU, ${memoryMb} MB, ${slots} slots`;
+	return [
+		`reserve ${cpusText(reserve.cpus)} CPU, ${reserve.memoryMb} MB`,
+		pool("monitor", monitor),
+		pool("executor", executor)
+	].join("; ");
+};
+const cpusPattern = /^\d+(?:\.\d+)?$/u;
+const slotsPattern = /^\d+$/u;
+const memoryPattern = /^(\d+(?:\.\d+)?)\s*(m|mb|mib|g|gb|gib)?$/iu;
+const megabytesPerGigabyte = 1024;
+const memoryMbOf = (given) => {
+	const match = memoryPattern.exec(given.trim());
+	if (match === null) return null;
+	const [, amount = "", unit = "m"] = match;
+	const megabytes = Number(amount) * (unit.toLowerCase().startsWith("g") ? megabytesPerGigabyte : 1);
+	return Number.isSafeInteger(megabytes) ? megabytes : null;
+};
+const readCpus = (flag, given) => {
+	if (!cpusPattern.test(given)) throw new UsageError(`--${flag} ${given} is not a number of CPUs.`, "Give a decimal number, as in 2 or 0.5.");
+	return Number(given);
+};
+const readMemory = (flag, given) => {
+	const megabytes = memoryMbOf(given);
+	if (megabytes === null) throw new UsageError(`--${flag} ${given} is not a whole number of megabytes.`, "Give megabytes, or a number with M or G, as in 2048, 2048M or 2G; G is 1024 MB.");
+	return megabytes;
+};
+const readSlots = (flag, given) => {
+	if (!slotsPattern.test(given)) throw new UsageError(`--${flag} ${given} is not a whole number of slots.`);
+	return Number(given);
+};
+const splitOptions = {
+	"reserve-cpus": { type: "string" },
+	"reserve-memory": { type: "string" },
+	"monitor-cpus": { type: "string" },
+	"monitor-memory": { type: "string" },
+	"monitor-slots": { type: "string" },
+	"executor-cpus": { type: "string" },
+	"executor-memory": { type: "string" },
+	"executor-slots": { type: "string" }
+};
+const splitOptionOf = {
+	"reserve.cpus": {
+		flag: "reserve-cpus",
+		read: readCpus
+	},
+	"reserve.memoryMb": {
+		flag: "reserve-memory",
+		read: readMemory
+	},
+	"monitor.cpus": {
+		flag: "monitor-cpus",
+		read: readCpus
+	},
+	"monitor.memoryMb": {
+		flag: "monitor-memory",
+		read: readMemory
+	},
+	"monitor.slots": {
+		flag: "monitor-slots",
+		read: readSlots
+	},
+	"executor.cpus": {
+		flag: "executor-cpus",
+		read: readCpus
+	},
+	"executor.memoryMb": {
+		flag: "executor-memory",
+		read: readMemory
+	},
+	"executor.slots": {
+		flag: "executor-slots",
+		read: readSlots
+	}
+};
+const flagOf = (field) => `--${splitOptionOf[field].flag}`;
+const changeOf = (values) => Object.fromEntries(splitFields.flatMap((field) => {
+	const { flag, read } = splitOptionOf[field];
+	const given = values[flag];
+	return given === void 0 ? [] : [[field, read(flag, given)]];
+}));
+const createSplitCommand = (adaptersOf) => defineGroup({
+	name: "split",
+	summary: "How a node is split into a reserve and two pools, and changing it.",
+	usage: "nodes split [set|clear] <node>",
+	fallback: defineCommand({
+		name: "split",
+		summary: "Show the split of a node, its host and what one slot of each pool gets.",
+		usage: "nodes split <node>",
+		optionsUsage: nodeUsage,
+		options: {},
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const run = await runOf(adaptersOf, invocation);
+			const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+			return printed(run, splitViewOf(await nodeDetailOf(run.api, reference)), splitText);
+		}
+	}),
+	subcommands: [defineCommand({
+		name: "set",
+		summary: "Split a node into a reserve and two pools, or change parts of its split.",
+		usage: "nodes split set <node> [--<part>-cpus <n>] [--<part>-memory <size>] [--<pool>-slots <n>]",
+		optionsUsage: [
+			...nodeUsage,
+			["--reserve-cpus <n>", "the CPUs kept for the host itself"],
+			["--reserve-memory <size>", "the memory kept for the host itself"],
+			["--monitor-cpus <n>", "the CPUs the monitor sessions share"],
+			["--monitor-memory <size>", "the memory the monitor sessions share"],
+			["--monitor-slots <n>", "how many monitor sessions run at once"],
+			["--executor-cpus <n>", "the CPUs the executor sessions share"],
+			["--executor-memory <size>", "the memory the executor sessions share"],
+			["--executor-slots <n>", "how many executor sessions run at once"],
+			["", "a size is megabytes, or a number with M or G, as in 2048 or 2G"],
+			["", "a part left out keeps its value; a node without a split needs all eight"]
+		],
+		options: splitOptions,
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const change = changeOf(invocation.values);
+			if (Object.keys(change).length === 0) throw new UsageError("nodes split set needs at least one part of the split.", "kcloud nodes split set --help lists the parts.");
+			const run = await runOf(adaptersOf, invocation);
+			const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+			const node = await nodeDetailOf(run.api, reference);
+			const split = fittingSplit(node, change, flagOf);
+			const changed = await splitNode(run.api, reference, node.revision, split);
+			return printed(run, splitViewOf(changed), splitText);
+		}
+	}), defineCommand({
+		name: "clear",
+		summary: "Remove the split of a node, so its slots are counted from its host.",
+		usage: "nodes split clear <node>",
+		optionsUsage: nodeUsage,
+		options: {},
+		positionals: {
+			min: 1,
+			max: 1
+		},
+		run: async (invocation) => {
+			const run = await runOf(adaptersOf, invocation);
+			const given = invocation.positionals[0] ?? "";
+			const reference = await resolveNode(run, given);
+			const node = await nodeDetailOf(run.api, reference);
+			if (node.split === null) return printed(run, splitViewOf(node), () => `${node.name} has no split; nothing was changed.`);
+			await confirmed({
+				prompt: run.prompt,
+				settings: run.settings,
+				question: `Clear the split of ${given}? Its pools lose their limits on CPU and memory.`
+			});
+			const cleared = await splitNode(run.api, reference, node.revision, null);
+			return printed(run, splitViewOf(cleared), splitText);
+		}
+	})]
+});
+//#endregion
+//#region src/mcp/tools/nodes.ts
+const nodeField = z.string().trim().min(1).describe("The node, by its name or its id, from nodes_list.");
+const poolPart = (role) => nodePoolSplitSchema.partial().optional().describe(`The CPUs, the memory in MB and the slots the ${role} sessions share; a field left out keeps its value.`);
+const nodeTools = [
+	defineTool({
+		name: "nodes_list",
+		title: "List nodes",
+		description: "List the nodes of the organization this server acts in, the hosts its agents run on, with their state, engine, version, capabilities, split and agent count.",
+		operations: ["listNodes"],
+		safety: "read",
+		input: z.object({}),
+		run: async (_, run) => nodesOf(run.api, (await run.organization()).id)
+	}),
+	defineTool({
+		name: "node_show",
+		title: "Show a node",
+		description: "Show one node with its host, its capabilities, its split, the agents placed on it with their pool limits, and the runtime and pools it reported last.",
+		operations: ["getNode"],
+		safety: "read",
+		input: z.object({ node: nodeField }),
+		run: async ({ node }, run) => nodeDetailOf(run.api, await resolveNode(run, node))
+	}),
+	defineTool({
+		name: "node_split_set",
+		title: "Split a node into pools",
+		description: "Split a node into a reserve kept for the host, a monitor pool and an executor pool, each with CPUs and memory in MB, the pools also with slots. A part left out keeps its value; a node without a split needs every part. The split has to fit the host. Returns the split with the host and what is left free. Takes an admin of the organization.",
+		operations: ["getNode", "updateNodeSplit"],
+		safety: "write",
+		idempotent: true,
+		input: z.object({
+			node: nodeField,
+			reserve: nodeReserveSchema.partial().optional().describe("The CPUs and the memory in MB kept for the host itself; a field left out keeps its value."),
+			monitor: poolPart("monitor"),
+			executor: poolPart("executor")
+		}),
+		run: async ({ node, ...parts }, run) => {
+			const change = changeOfParts(parts);
+			if (Object.keys(change).length === 0) throw new CliError("Name at least one part of the split to change.");
+			const reference = await resolveNode(run, node);
+			const detail = await nodeDetailOf(run.api, reference);
+			const split = fittingSplit(detail, change, (field) => field);
+			return splitViewOf(await splitNode(run.api, reference, detail.revision, split));
+		}
+	}),
+	defineTool({
+		name: "node_split_clear",
+		title: "Clear the split of a node",
+		description: "Remove the split of a node, so its slots are counted from its host again and its pools lose their limits on CPU and memory. Takes an admin of the organization.",
+		operations: ["getNode", "updateNodeSplit"],
+		safety: "destructive",
+		idempotent: true,
+		input: z.object({ node: nodeField }),
+		run: async ({ node }, run) => {
+			const reference = await resolveNode(run, node);
+			const detail = await nodeDetailOf(run.api, reference);
+			if (detail.split === null) return splitViewOf(detail);
+			return splitViewOf(await splitNode(run.api, reference, detail.revision, null));
+		}
+	}),
+	defineTool({
+		name: "node_delete",
+		title: "Delete a node",
+		description: "Delete a node, after which its host can no longer reach the platform. The instance refuses while agents are placed on it.",
+		operations: ["deleteNode"],
+		safety: "destructive",
+		input: z.object({ node: nodeField }),
+		run: async ({ node }, run) => {
+			const reference = await resolveNode(run, node);
+			await deleteNode(run.api, reference);
+			return { deleted: reference.nodeId };
+		}
+	})
+];
+//#endregion
+//#region src/mcp/tools/backups.ts
+const agentBackupTools = [
+	defineTool({
+		name: "agent_backups_list",
+		title: "List the backups of an agent",
+		description: "List the backups of the memory of an agent, the newest first, with their trigger, node, Kikimora release, entries, size and expiry, and the days a backup is kept.",
+		operations: ["listAgentBackups"],
+		safety: "read",
+		input: z.object(agentFields),
+		run: async (reference, run) => backupsOf(run.api, await agentIdOf(run, reference))
 	}),
 	defineTool({
-		name: "agent_check",
-		title: "Run a monitor cycle now",
-		description: "Ask the monitor of an agent to look for work now instead of waiting for its interval, also outside its active hours. state requested means a cycle starts at once; running names the cycle already in progress. A paused, stopping or usage-limited monitor refuses with an error.",
-		operations: ["checkAgentMonitor"],
+		name: "agent_backup_request",
+		title: "Back an agent up now",
+		description: "Ask the node of an agent for a backup of its memory now. state requested means the node makes it, and agent_backups_list shows it once the node has sent it.",
+		operations: ["requestAgentBackup"],
 		safety: "write",
 		input: z.object(agentFields),
-		run: async (reference, run) => dataOf("check the monitor", await run.api.POST("/agents/{id}/monitor/check", { params: { path: { id: await agentIdOf(run, reference) } } }), checkHints)
+		run: async (reference, run) => requestedBackup(run.api, await agentIdOf(run, reference))
 	}),
 	defineTool({
-		name: "agent_interrupt",
-		title: "Stop, reset or cancel an agent",
-		description: "stop stops the agent after its current session, or at once with now; reset throws its workspace away and provisions it again; cancel cancels what it is doing.",
-		operations: ["runAgentAction"],
-		safety: "destructive",
+		name: "agent_restore",
+		title: "Restore an agent from a backup",
+		description: "Create a new agent in the project of an agent, with its configuration and the memory of one of its backups, on the node named. Returns the id of the new agent, which stays stopped until agent_action starts it.",
+		operations: ["restoreAgentFromBackup"],
+		safety: "write",
 		input: z.object({
 			...agentFields,
-			action: z.enum([
-				"stop",
-				"reset",
-				"cancel"
-			]),
-			now: z.boolean().default(false).describe("For stop: stop the container at once.")
+			backup: idSchema.describe("The id of the backup, from agent_backups_list."),
+			name: agentNameSchema.describe("The name of the new agent."),
+			slug: slugSchema.optional().describe("The slug of the new agent, instead of one made from its name."),
+			node: nodeField
 		}),
-		run: async ({ action, now, ...reference }, run) => actionOn(run, await agentIdOf(run, reference), action, action === "stop" && now)
+		run: async ({ backup, name, slug, node, ...reference }, run) => restoredAgent(run.api, await agentIdOf(run, reference), {
+			backupId: backup,
+			name,
+			node,
+			slug
+		})
 	})
 ];
 //#endregion
@@ -5794,42 +6515,6 @@ const credentialTools = [
 	})
 ];
 //#endregion
-//#region src/mcp/tools/nodes.ts
-const nodeField = z.string().trim().min(1).describe("The node, by its name or its id, from nodes_list.");
-const nodeTools = [
-	defineTool({
-		name: "nodes_list",
-		title: "List nodes",
-		description: "List the nodes of the organization this server acts in, the hosts its agents run on, with their state, engine, version and agent count.",
-		operations: ["listNodes"],
-		safety: "read",
-		input: z.object({}),
-		run: async (_, run) => nodesOf(run.api, (await run.organization()).id)
-	}),
-	defineTool({
-		name: "node_show",
-		title: "Show a node",
-		description: "Show one node with its host, its capabilities, the agents placed on it and the runtime it reported last.",
-		operations: ["getNode"],
-		safety: "read",
-		input: z.object({ node: nodeField }),
-		run: async ({ node }, run) => nodeDetailOf(run.api, await resolveNode(run, node))
-	}),
-	defineTool({
-		name: "node_delete",
-		title: "Delete a node",
-		description: "Delete a node, after which its host can no longer reach the platform. The instance refuses while agents are placed on it.",
-		operations: ["deleteNode"],
-		safety: "destructive",
-		input: z.object({ node: nodeField }),
-		run: async ({ node }, run) => {
-			const reference = await resolveNode(run, node);
-			await deleteNode(run.api, reference);
-			return { deleted: reference.nodeId };
-		}
-	})
-];
-//#endregion
 //#region src/commands/notifications.ts
 const notificationHints = { "notification.not_found": "kcloud notifications list shows them." };
 const createNotificationsCommand = (adaptersOf) => defineGroup({
@@ -7851,6 +8536,7 @@ const kcloudTools = [
 	...projectToolTools,
 	...nodeTools,
 	...agentTools,
+	...agentBackupTools,
 	...taskTools,
 	...observabilityTools,
 	...notificationTools,
@@ -7928,6 +8614,214 @@ const createMcpCommand = (adaptersOf, cliVersion) => defineCommand({
 	}
 });
 //#endregion
+//#region src/commands/nodes/index.ts
+const gibibytes = (bytes) => `${(bytes / 1024 ** 3).toFixed(1)} GiB`;
+const hostOf = (node) => node.host === null ? "-" : `${node.host.cpus} CPU, ${gibibytes(node.host.memoryBytes)} of memory`;
+const capabilitiesOf = (node) => {
+	if (node.capabilities === null) return "-";
+	const { sandbox, uidIsolation } = node.capabilities;
+	return `sandbox ${sandbox ? "yes" : "no"}, uid isolation ${uidIsolation ? "yes" : "no"}`;
+};
+const registrationOf = (node) => node.registrationExpiresAt === null ? "-" : `a token waits until ${node.registrationExpiresAt}`;
+const storageOf = ({ state, freeBytes, totalBytes, path }) => `${state}, ${gibibytes(freeBytes)} free of ${gibibytes(totalBytes)} at ${path}`;
+const runtimeRowsOf = (runtime) => [
+	["reported", runtime.reportedAt],
+	["docker", runtime.docker.lastError === null ? runtime.docker.state : `${runtime.docker.state}: ${runtime.docker.lastError}`],
+	["data storage", storageOf(runtime.storage.data)],
+	["engine storage", storageOf(runtime.storage.engine)],
+	["last reconcile", runtime.reconcile.lastTickError === null ? runtime.reconcile.lastTickAt ?? "never" : `${runtime.reconcile.lastTickAt ?? "never"}: ${runtime.reconcile.lastTickError}`],
+	["agents", `${runtime.reconcile.agentsActive} active, ${runtime.reconcile.agentsQueued} queued`],
+	["log readers", String(runtime.ingest.readers)]
+];
+const updateOf = ({ update }) => {
+	if (update === null) return "not reported";
+	switch (update.state) {
+		case "current": return "current";
+		case "waiting": return `waits for ${String(update.sessions)} ${update.sessions === 1 ? "session" : "sessions"} to end before ${update.target ?? "-"}`;
+		case "updating": return `updating to ${update.target ?? "-"}`;
+		case "failed": return `failed to reach ${update.target ?? "-"}, runs its previous version`;
+		case "unmanaged": return "updated with its platform";
+	}
+};
+const lastUpdateOf = ({ update }) => {
+	const last = update?.last ?? null;
+	if (last === null) return null;
+	const outcome = `${last.outcome} ${last.version ?? "-"} at ${last.at}`;
+	return last.reason === null ? outcome : `${outcome}: ${last.reason}`;
+};
+const nodeDetailsText = (node) => [
+	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
+		["name", node.name],
+		["state", node.state],
+		["provider", node.provider],
+		["engine", node.engine ?? "-"],
+		["version", node.version ?? "-"],
+		["host", hostOf(node)],
+		["server", node.host?.serverVersion ?? "-"],
+		["data root", node.host?.dataRoot ?? "-"],
+		["capabilities", capabilitiesOf(node)],
+		["offers", node.offered.length === 0 ? "-" : node.offered.join(", ")],
+		["split", splitSummaryOf(node.split)],
+		["registration", registrationOf(node)],
+		["connected", node.connectedAt ?? "never"],
+		["last seen", node.lastSeenAt ?? "never"],
+		...node.offlineSince === null ? [] : [["offline since", node.offlineSince]],
+		["update", updateOf(node)],
+		...lastUpdateOf(node) === null ? [] : [["last update", lastUpdateOf(node) ?? ""]],
+		["created", node.createdAt],
+		["id", node.id]
+	]),
+	"",
+	node.agents.length === 0 ? "No agent is placed on the node." : renderTable([
+		{ header: "PROJECT" },
+		{ header: "AGENT" },
+		{ header: "STATE" },
+		{ header: "POOL LIMIT" },
+		{ header: "ID" }
+	], node.agents.map((agent) => [
+		agent.projectName,
+		agent.slug,
+		agent.state,
+		poolLimitText(agent.poolLimit),
+		agent.id
+	])),
+	"",
+	...node.runtime === null ? ["The node has reported no runtime yet."] : [
+		renderTable([{ header: "RUNTIME" }, { header: "VALUE" }], runtimeRowsOf(node.runtime)),
+		"",
+		poolsText(node.runtime.pools)
+	]
+].join("\n");
+const startHintOf = (origin) => [
+	"Start the node with it as docs/install.md of kikimora-cloud describes. On a Linux host, after read -rs token:",
+	`  printf '%s\\n' "$token" | /opt/kikimora-cloud/infra/node/install.sh --platform-url ${origin} --image ghcr.io/kikimoradev/kikimora-cloud/node:<version> --registration-token -`,
+	"On a Windows PC:",
+	`  C:\\kikimora-cloud\\src\\infra\\windows\\install.ps1 -PlatformUrl ${origin} -RegistrationToken <token>`
+].join("\n");
+const printedRegistration = (run, created) => {
+	if (run.settings.json) {
+		run.context.terminal.json(created);
+		return exitCodes.ok;
+	}
+	run.context.terminal.line(created.registration.token);
+	run.context.terminal.error([`The registration token of ${created.node.name} is shown only here and works once, until ${created.registration.expiresAt}.`, startHintOf(run.origin)].join("\n"));
+	return exitCodes.ok;
+};
+const createNodesCommand = (adaptersOf) => defineGroup({
+	name: "nodes",
+	summary: "The nodes of the organization, the hosts its agents run on.",
+	usage: "nodes <command>",
+	subcommands: [
+		defineCommand({
+			name: "list",
+			summary: "List the nodes of the organization.",
+			usage: "nodes list",
+			options: {},
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const items = await nodesOf(run.api, organization.id);
+				return printed(run, items, (nodes) => nodes.length === 0 ? `${organization.slug} has no node yet; kcloud nodes create <name> creates one.` : renderTable([
+					{ header: "NAME" },
+					{ header: "STATE" },
+					{ header: "ENGINE" },
+					{ header: "VERSION" },
+					{
+						header: "AGENTS",
+						align: "right"
+					},
+					{ header: "LAST SEEN" },
+					{ header: "ID" }
+				], nodes.map((node) => [
+					node.name,
+					node.state,
+					node.engine ?? "-",
+					node.version ?? "-",
+					String(node.agentCount),
+					node.lastSeenAt ?? "never",
+					node.id
+				])));
+			}
+		}),
+		defineCommand({
+			name: "show",
+			summary: "Show a node with its host, its split, the agents placed on it, its runtime and its pools.",
+			usage: "nodes show <node>",
+			optionsUsage: nodeUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+				return printed(run, await nodeDetailOf(run.api, reference), nodeDetailsText);
+			}
+		}),
+		createSplitCommand(adaptersOf),
+		defineCommand({
+			name: "create",
+			summary: "Create a node and print its one-time registration token.",
+			usage: "nodes create <name>",
+			optionsUsage: [["", "the name holds lowercase letters, digits and hyphens"], ["", "the token goes to stdout alone, how to start the node to stderr"]],
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				return printedRegistration(run, await createdNode(run.api, organization.id, invocation.positionals[0] ?? ""));
+			}
+		}),
+		defineCommand({
+			name: "token",
+			summary: "Issue a new registration token for a node that has not joined yet.",
+			usage: "nodes token <node>",
+			optionsUsage: [...nodeUsage, ["", "the token replaces the one issued before, which stops working"]],
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+				return printedRegistration(run, await renewedRegistration(run.api, reference));
+			}
+		}),
+		defineCommand({
+			name: "delete",
+			summary: "Delete a node that runs no agent.",
+			usage: "nodes delete <node>",
+			optionsUsage: nodeUsage,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const given = invocation.positionals[0] ?? "";
+				const reference = await resolveNode(run, given);
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: `Delete the node ${given}? Its host can no longer reach the platform.`
+				});
+				await deleteNode(run.api, reference);
+				return said(run, `Deleted the node ${given}.`);
+			}
+		})
+	]
+});
+//#endregion
 //#region src/commands/releases.ts
 const createReleasesCommand = (adaptersOf) => defineGroup({
 	name: "releases",