@kikimoradev/kcloud 0.7.4 → 0.8.0

package/dist/main.js

@@ -10,6 +10,9 @@ import { z } from "zod";
 import { spawn } from "node:child_process";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import createClient from "openapi-fetch";
+import { finished } from "node:stream/promises";
+import { StdioServerTransport, serveStdio } from "@modelcontextprotocol/server/stdio";
+import { McpServer } from "@modelcontextprotocol/server";
 //#region ../../packages/cli-kit/src/errors.ts
 const exitCodes = {
 	ok: 0,
@@ -207,6 +210,16 @@ const createClackPrompter = ({ input, output }) => {
 		}
 	};
 };
+const unanswerableWithoutTerminal = (message) => new UsageError(`"${message}" needs an answer, and stdin is not a terminal.`, "Run the command in a terminal, or pass --yes to take the default answers.");
+const withoutQuestions = (prompter) => ({
+	...prompter,
+	text: ({ message }) => Promise.reject(unanswerableWithoutTerminal(message)),
+	password: ({ message }) => Promise.reject(unanswerableWithoutTerminal(message)),
+	select: ({ message }) => Promise.reject(unanswerableWithoutTerminal(message)),
+	confirm: ({ message }) => Promise.reject(unanswerableWithoutTerminal(message))
+});
+const isTerminal$3 = (stream) => stream.isTTY === true;
+const terminalPrompterOf = (streams) => isTerminal$3(streams.input) ? createClackPrompter(streams) : withoutQuestions(createClackPrompter(streams));
 const unanswerable = (message) => new UsageError(`"${message}" needs an answer, and --yes asks no questions.`, "Pass the value as a flag or an environment variable, or run without --yes.");
 const createUnattendedPrompter = (write) => ({
 	intro: write,
@@ -2432,11 +2445,12 @@ const metricsRangeSchema = z.enum([
 	"7d",
 	"90d"
 ]);
-const agentMetricsRangeSchema = z.enum([
+const agentMetricsRanges = [
 	"1h",
 	"24h",
 	"7d"
-]);
+];
+const agentMetricsRangeSchema = z.enum(agentMetricsRanges);
 const metricsResolutionSchema = z.enum(["minute", "hour"]);
 const instantSchema = z.iso.datetime();
 const byteCountSchema = z.int().nonnegative();
@@ -2741,7 +2755,7 @@ const createAdapters = (context) => ({
 	prompter: (settings) => {
 		const asked = settings.yes ? createUnattendedPrompter((text) => {
 			context.terminal.error(text);
-		}) : createClackPrompter({
+		}) : terminalPrompterOf({
 			input: context.io.stdin,
 			output: context.io.stderr
 		});
@@ -3306,13 +3320,36 @@ const agentPlanOf = (agent) => ({
 });
 //#endregion
 //#region src/commands/agents/config.ts
-const listedProjects = async (run, project) => project === void 0 ? (await projectsOf(run.api)).map(({ id, slug }) => ({
-	id,
-	slug
-})) : [{
-	id: await resolveProjectId(run.api, project),
-	slug: project
-}];
+const agentsOf = async (api, project) => {
+	const projects = project === void 0 ? (await projectsOf(api)).map(({ id, slug }) => ({
+		id,
+		slug
+	})) : [{
+		id: await resolveProjectId(api, project),
+		slug: project
+	}];
+	const listed = [];
+	for (const { id, slug } of projects) {
+		const { items } = dataOf("list the agents of the project", await api.GET("/projects/{id}/agents", { params: { path: { id } } }), agentHints);
+		for (const agent of items) listed.push({
+			project: slug,
+			...agent
+		});
+	}
+	return listed;
+};
+const changedAgent = async (api, agentId, document) => {
+	const current = dataOf("describe the agent", await api.GET("/agents/{id}", { params: { path: { id: agentId } } }), agentHints);
+	const change = typeof document === "object" && document !== null && "version" in document ? document : {
+		...document,
+		version: current.version
+	};
+	validated(updateAgentBodySchema, change, "a change to an agent");
+	return dataOf("change the agent", await api.PATCH("/agents/{id}", {
+		params: { path: { id: agentId } },
+		body: change
+	}), agentHints);
+};
 const configCommands = (adaptersOf) => [
 	defineCommand({
 		name: "list",
@@ -3326,15 +3363,7 @@ const configCommands = (adaptersOf) => [
 		},
 		run: async (invocation) => {
 			const run = await runOf(adaptersOf, invocation);
-			const projects = await listedProjects(run, invocation.values.project);
-			const listed = [];
-			for (const project of projects) {
-				const { items } = dataOf("list the agents of the project", await run.api.GET("/projects/{id}/agents", { params: { path: { id: project.id } } }), agentHints);
-				for (const agent of items) listed.push({
-					project: project.slug,
-					...agent
-				});
-			}
+			const listed = await agentsOf(run.api, invocation.values.project);
 			return printed(run, listed, (items) => items.length === 0 ? "There is no agent here yet; kcloud agents create makes one." : renderTable([
 				{ header: "PROJECT" },
 				{ header: "AGENT" },
@@ -3399,18 +3428,7 @@ const configCommands = (adaptersOf) => [
 			const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
 			const file = invocation.values.file;
 			if (file === void 0) throw new UsageError("agents set needs --file <path>.", "The file holds the sections to change; kcloud agents show <agent> --json shows the current ones.");
-			const current = dataOf("describe the agent", await run.api.GET("/agents/{id}", { params: { path: { id: agentId } } }), agentHints);
-			const document = await documentOf(run, file);
-			const change = typeof document === "object" && document !== null && "version" in document ? document : {
-				...document,
-				version: current.version
-			};
-			validated(updateAgentBodySchema, change, "a change to an agent");
-			const body = change;
-			const agent = dataOf("change the agent", await run.api.PATCH("/agents/{id}", {
-				params: { path: { id: agentId } },
-				body
-			}), agentHints);
+			const agent = await changedAgent(run.api, agentId, await documentOf(run, file));
 			return printed(run, agent, (changed) => changed.restartRequired ? `Changed ${changed.name}; it needs kcloud agents update to take the change.` : `Changed ${changed.name}.`);
 		}
 	}),
@@ -3768,16 +3786,39 @@ const pageOptions = {
 		default: false
 	}
 };
-const pageUsage = [["--limit <n>", `how many rows (default: 50)`], ["--all", "follow the cursor to the end instead of one page"]];
+const allUsage = ["--all", "follow the cursor to the end instead of one page"];
+const pageUsage = [["--limit <n>", `how many rows (default: 50)`], allUsage];
 const dayOf = (date) => date.toISOString().slice(0, 10);
+const costWindowOf = (days, now) => ({
+	from: dayOf(/* @__PURE__ */ new Date(now.getTime() - (days - 1) * 24 * 60 * 6e4)),
+	to: dayOf(now)
+});
 const windowFrom = (days, now) => {
 	const span = days === void 0 ? 7 : Number(days);
 	if (days !== void 0 && (!/^[0-9]+$/u.test(days) || span < 1 || span > 365)) throw new UsageError(`--days ${days} is not a whole number of days from 1 to 365.`);
+	return costWindowOf(span, now);
+};
+const transcriptHints = {
+	...agentHints,
+	"session.not_found": "kcloud agents sessions <agent> shows the sessions and their ids.",
+	"transcript.unreadable": "The transcript of that session cannot be read."
+};
+const transcriptOf = async (api, agentId, sessionId, all) => collect(async (cursor) => {
+	const answer = dataOf("read the transcript", await api.GET("/agents/{id}/sessions/{sessionId}/transcript", { params: {
+		path: {
+			id: agentId,
+			sessionId
+		},
+		...cursor === null ? {} : { query: { cursor } }
+	} }), transcriptHints);
 	return {
-		from: dayOf(/* @__PURE__ */ new Date(now.getTime() - (span - 1) * 24 * 60 * 6e4)),
-		to: dayOf(now)
+		items: answer.entries,
+		nextCursor: answer.nextCursor
 	};
-};
+}, {
+	limit: 200,
+	all
+});
 const observabilityCommands = (adaptersOf) => [
 	defineCommand({
 		name: "sessions",
@@ -3838,10 +3879,10 @@ const observabilityCommands = (adaptersOf) => [
 		name: "transcript",
 		summary: "Print the transcript of one session of an agent.",
 		usage: "agents transcript <agent> <session> [--project <name>] [--all]",
-		optionsUsage: [...agentUsage, ...pageUsage],
+		optionsUsage: [...agentUsage, allUsage],
 		options: {
 			...agentOption,
-			...pageOptions
+			all: pageOptions.all
 		},
 		positionals: {
 			min: 2,
@@ -3850,27 +3891,7 @@ const observabilityCommands = (adaptersOf) => [
 		run: async (invocation) => {
 			const run = await runOf(adaptersOf, invocation);
 			const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
-			const sessionId = invocation.positionals[1] ?? "";
-			const page = await collect(async (cursor, limit) => {
-				const answer = dataOf("read the transcript", await run.api.GET("/agents/{id}/sessions/{sessionId}/transcript", { params: {
-					path: {
-						id: agentId,
-						sessionId
-					},
-					query: {
-						limit,
-						...cursor === null ? {} : { cursor }
-					}
-				} }), {
-					...agentHints,
-					"session.not_found": "kcloud agents sessions <agent> shows the sessions and their ids.",
-					"transcript.unreadable": "The transcript of that session cannot be read."
-				});
-				return {
-					items: answer.entries,
-					nextCursor: answer.nextCursor
-				};
-			}, windowOf(invocation.values.limit, invocation.values.all, 200));
+			const page = await transcriptOf(run.api, agentId, invocation.positionals[1] ?? "", invocation.values.all);
 			return printed(run, page.items, (entries) => entries.length === 0 ? "The session left no transcript." : entries.map((entry) => JSON.stringify(entry)).join("\n"));
 		}
 	}),
@@ -4110,10 +4131,18 @@ const readBody = async (response, request, onId) => {
 			reader.cancel();
 		}, request.idleMs ?? 1e3);
 	};
+	const stop = () => {
+		reader.cancel().catch(() => void 0);
+	};
+	request.signal?.addEventListener("abort", stop, { once: true });
+	if (request.signal?.aborted === true) stop();
 	armIdle();
 	try {
 		for (;;) {
-			const chunk = await reader.read();
+			const chunk = await reader.read().catch((error) => {
+				if (request.signal?.aborted === true) return { done: true };
+				throw error;
+			});
 			if (chunk.done) break;
 			buffer += decoder.decode(chunk.value, { stream: true });
 			let boundary = buffer.indexOf("\n\n");
@@ -4137,6 +4166,7 @@ const readBody = async (response, request, onId) => {
 		}
 	} finally {
 		if (timer.current !== null) clearTimeout(timer.current);
+		request.signal?.removeEventListener("abort", stop);
 	}
 	return {
 		closed,
@@ -4156,7 +4186,9 @@ const streamFrames = async (request) => {
 	const url = `${request.origin}/api/v1${request.path}${query.size === 0 ? "" : `?${query.toString()}`}`;
 	const resume = { lastEventId: null };
 	let backoff = 0;
+	const aborted = () => request.signal?.aborted === true;
 	for (;;) {
+		if (aborted()) return;
 		let response;
 		try {
 			response = await fetching(url, {
@@ -4165,9 +4197,11 @@ const streamFrames = async (request) => {
 					authorization: `Bearer ${request.token}`,
 					...request.resumable === true && resume.lastEventId !== null ? { "last-event-id": resume.lastEventId } : {}
 				},
-				redirect: "error"
+				redirect: "error",
+				...request.signal === void 0 ? {} : { signal: request.signal }
 			});
 		} catch (error) {
+			if (aborted()) return;
 			throw unreachable(request.origin, error);
 		}
 		if (!response.ok) {
@@ -4184,7 +4218,7 @@ const streamFrames = async (request) => {
 			resume.lastEventId = id;
 		});
 		if (closed !== null && fatalReasons.has(closed)) throw new CliError(`The instance closed the stream: ${closed}.`, closed === "session.expired" ? "The token is no longer valid; run kcloud login again." : "You are no longer a member of that project.");
-		if (!request.follow) return;
+		if (!request.follow || aborted()) return;
 		request.onNotice?.(closed === null ? "The stream ended; opening it again." : `The instance closed the stream: ${closed}. Opening it again.`);
 		backoff = nextBackoff(backoff);
 		await request.wait(jittered(backoff));
@@ -4278,8 +4312,7 @@ const streamCommands = (adaptersOf) => [{
 			},
 			onFrame: (frame) => {
 				if (frame.event === "agent.state") return;
-				if (settings.json) context.terminal.json(frame.data);
-				else context.terminal.line(lineOf(frame));
+				context.terminal.line(settings.json ? JSON.stringify(frame.data) : lineOf(frame));
 			}
 		});
 		return exitCodes.ok;
@@ -4495,7 +4528,7 @@ const secretUsage = [
 //#region src/commands/credentials.ts
 const projectOption$2 = { project: { type: "string" } };
 const projectUsage$2 = [["--project <name>", "the project the credential belongs to, by slug, name or id"]];
-const hints$2 = {
+const credentialHints = {
 	"project.not_found": "kcloud projects list shows the projects you are a member of.",
 	"credential.not_found": "kcloud credentials list --project <name> shows them.",
 	"credential.label_taken": "Another credential of the project already has that label.",
@@ -4505,7 +4538,7 @@ const projectFrom$2 = async (run, given) => {
 	if (given === void 0) throw new UsageError("This command needs a project.", "Pass --project <name>; kcloud projects list shows them.");
 	return resolveProjectId(run.api, given);
 };
-const credentialsOf = async (api, projectId) => dataOf("list the credentials of the project", await api.GET("/projects/{id}/credentials", { params: { path: { id: projectId } } }), hints$2).items;
+const credentialsOf = async (api, projectId) => dataOf("list the credentials of the project", await api.GET("/projects/{id}/credentials", { params: { path: { id: projectId } } }), credentialHints).items;
 const resolveCredentialId = async (api, projectId, reference) => {
 	const credentials = await credentialsOf(api, projectId);
 	const found = credentials.filter((credential) => credential.id === reference || credential.label === reference);
@@ -4591,7 +4624,7 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 						label,
 						secret
 					}
-				}), hints$2);
+				}), credentialHints);
 				return printed(run, credential, (stored) => `Stored ${stored.label} (${stored.fingerprint}) as ${stored.id}.`);
 			}
 		}),
@@ -4621,7 +4654,7 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 						credentialId
 					} },
 					body: { label }
-				}), hints$2);
+				}), credentialHints);
 				return printed(run, credential, (renamed) => `The credential is ${renamed.label} now.`);
 			}
 		}),
@@ -4666,7 +4699,7 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 						secret,
 						restartAgents: values["restart-agents"]
 					}
-				}), hints$2);
+				}), credentialHints);
 				return printed(run, credential, (rotated) => `Rotated ${rotated.label} to ${rotated.fingerprint}${values["restart-agents"] ? "; its agents restart" : ""}.`);
 			}
 		}),
@@ -4687,7 +4720,7 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 				doneWith("verify the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/verify", { params: { path: {
 					id: projectId,
 					credentialId
-				} } }), hints$2);
+				} } }), credentialHints);
 				return said(run, `The instance is verifying ${credentialId}; kcloud credentials list shows the answer.`);
 			}
 		}),
@@ -4714,14 +4747,430 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 				doneWith("delete the credential", await run.api.DELETE("/projects/{id}/credentials/{credentialId}", { params: { path: {
 					id: projectId,
 					credentialId
-				} } }), hints$2);
+				} } }), credentialHints);
 				return said(run, `Deleted the credential ${reference}.`);
 			}
 		})
 	]
 });
 //#endregion
+//#region src/mcp/tool.ts
+const defineTool = (definition) => ({
+	...definition,
+	idempotent: definition.idempotent ?? definition.safety === "read",
+	run: (input, run) => definition.run(definition.input.parse(input), run)
+});
+const annotationsOf = (tool) => ({
+	title: tool.title,
+	readOnlyHint: tool.safety === "read",
+	destructiveHint: tool.safety === "destructive",
+	idempotentHint: tool.idempotent,
+	openWorldHint: false
+});
+const textOf = (text, isError) => ({
+	content: [{
+		type: "text",
+		text
+	}],
+	...isError ? { isError } : {}
+});
+const apiErrorOf = (error) => {
+	if (error instanceof ApiError) return error;
+	return error instanceof Error ? apiErrorOf(error.cause) : null;
+};
+const refusalOf = (error) => {
+	const details = apiErrorOf(error)?.details ?? {};
+	return [
+		error.message,
+		...error.hint === null ? [] : [error.hint],
+		...Object.keys(details).length === 0 ? [] : [`Details: ${JSON.stringify(details)}`]
+	].join("\n");
+};
+const resultOf = async (answer) => {
+	try {
+		return textOf(JSON.stringify(await answer()), false);
+	} catch (error) {
+		if (error instanceof z.ZodError) return textOf(z.prettifyError(error), true);
+		if (error instanceof CliError) return textOf(refusalOf(error), true);
+		throw error;
+	}
+};
+//#endregion
+//#region src/commands/tokens.ts
+const lifetimeOf = (given) => {
+	if (given === void 0) return null;
+	const days = Number(given);
+	if (!/^[0-9]+$/u.test(given) || days < 1 || days > 365) throw new UsageError(`--expires-in ${given} is not a whole number of days from 1 to 365.`);
+	return days;
+};
+const tokenHints = { "token.not_found": "kcloud tokens list shows the tokens and their ids." };
+const createTokensCommand = (adaptersOf) => defineGroup({
+	name: "tokens",
+	summary: "The access tokens of your account on this instance.",
+	usage: "tokens <command>",
+	subcommands: [
+		defineCommand({
+			name: "list",
+			summary: "List the access tokens of your account.",
+			usage: "tokens list",
+			options: {},
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async ({ settings, context }) => {
+				const adapters = adaptersOf(context);
+				const session = await openSession({
+					settings,
+					context,
+					api: adapters.api
+				});
+				const { items } = dataOf("list the access tokens", await session.api.GET("/auth/me/tokens"));
+				if (settings.json) {
+					context.terminal.json(items);
+					return exitCodes.ok;
+				}
+				context.terminal.line(items.length === 0 ? "Your account holds no access token on this instance." : renderTable([
+					{ header: "ID" },
+					{ header: "NAME" },
+					{ header: "LAST USED" },
+					{ header: "EXPIRES" }
+				], items.map((token) => [
+					token.id,
+					token.name,
+					token.lastUsedAt ?? "never",
+					token.expiresAt ?? "never"
+				])));
+				return exitCodes.ok;
+			}
+		}),
+		defineCommand({
+			name: "create",
+			summary: "Create an access token and print its secret once.",
+			usage: "tokens create <name> [--expires-in <days>]",
+			optionsUsage: [["--expires-in <days>", `how long the token lives, from 1 to 365 days (default: forever)`]],
+			options: { "expires-in": { type: "string" } },
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async ({ values, positionals, settings, context }) => {
+				const adapters = adaptersOf(context);
+				const expiresInDays = lifetimeOf(values["expires-in"]);
+				const session = await openSession({
+					settings,
+					context,
+					api: adapters.api
+				});
+				const created = dataOf("create an access token", await session.api.POST("/auth/me/tokens", { body: {
+					name: positionals[0] ?? "",
+					expiresInDays
+				} }));
+				if (settings.json) {
+					context.terminal.json(created);
+					return exitCodes.ok;
+				}
+				context.terminal.line(created.secret);
+				context.terminal.error(`The token ${created.accessToken.name} is shown only here; the instance keeps its hash.`);
+				return exitCodes.ok;
+			}
+		}),
+		defineCommand({
+			name: "revoke",
+			summary: "Revoke one access token of your account.",
+			usage: "tokens revoke <id>",
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async ({ positionals, settings, context }) => {
+				const adapters = adaptersOf(context);
+				const id = positionals[0] ?? "";
+				const session = await openSession({
+					settings,
+					context,
+					api: adapters.api
+				});
+				await confirmed({
+					prompt: adapters.prompter(settings),
+					settings,
+					question: `Revoke the token ${id}? Everything using it stops working.`
+				});
+				doneWith(`revoke the token ${id}`, await session.api.DELETE("/auth/me/tokens/{id}", { params: { path: { id } } }), tokenHints);
+				context.terminal.line(`Revoked the token ${id}.`);
+				return exitCodes.ok;
+			}
+		})
+	]
+});
+//#endregion
+//#region src/mcp/tools/account.ts
+const accountTools = [
+	defineTool({
+		name: "whoami",
+		title: "Who am I",
+		description: "Say which instance and which account this server acts as, and whether the version of kcloud matches the version of the instance.",
+		operations: ["getMe", "getPlatformVersion"],
+		safety: "read",
+		input: z.object({}),
+		run: async (_, run) => {
+			const me = dataOf("say who the token belongs to", await run.api.GET("/auth/me"));
+			const platform = dataOf("say which version it runs", await run.api.GET("/version"));
+			return {
+				origin: run.origin,
+				profile: run.profileName,
+				user: me,
+				kcloud: run.kcloudVersion,
+				instance: platform.version,
+				matched: platform.version === run.kcloudVersion
+			};
+		}
+	}),
+	defineTool({
+		name: "tokens_list",
+		title: "List access tokens",
+		description: "List the access tokens of your account, without their secrets.",
+		operations: ["listAccessTokens"],
+		safety: "read",
+		input: z.object({}),
+		run: async (_, run) => dataOf("list the access tokens", await run.api.GET("/auth/me/tokens")).items
+	}),
+	defineTool({
+		name: "token_revoke",
+		title: "Revoke an access token",
+		description: "Revoke one access token of your account. Everything that uses it stops working, this server too when it is the token of this server.",
+		operations: ["revokeAccessToken"],
+		safety: "destructive",
+		input: z.object({ id: idSchema.describe("The id of the token, from tokens_list.") }),
+		run: async ({ id }, run) => {
+			doneWith(`revoke the token ${id}`, await run.api.DELETE("/auth/me/tokens/{id}", { params: { path: { id } } }), tokenHints);
+			return { revoked: id };
+		}
+	}),
+	defineTool({
+		name: "locale_set",
+		title: "Set the language of the panel",
+		description: "Set the language the panel and its messages use for your account.",
+		operations: ["changeOwnLocale"],
+		safety: "write",
+		idempotent: true,
+		input: z.object({ locale: localeSchema }),
+		run: async ({ locale }, run) => dataOf("set the language", await run.api.PATCH("/auth/me/locale", { body: { locale } }))
+	})
+];
+//#endregion
+//#region src/mcp/fields.ts
+const projectField = z.string().trim().min(1).describe("The project, by its slug, its name or its id.");
+const agentFields = {
+	agent: z.string().trim().min(1).describe("The agent, as <project>/<agent>, as its slug or name together with project, or by its id."),
+	project: z.string().trim().min(1).optional().describe("The project of the agent, when agent names the agent alone.")
+};
+const pageFields = {
+	limit: z.int().min(1).max(200).optional().describe(`How many items one page holds, up to ${String(200)}.`),
+	all: z.boolean().default(false).describe("Follow the cursor to the end instead of returning one page.")
+};
+const windowOfPage = ({ limit, all }, fallback = 50) => ({
+	limit: limit ?? fallback,
+	all
+});
+const projectIdOf = (run, project) => resolveProjectId(run.api, project);
+const agentIdOf = (run, { agent, project }) => resolveAgentId(run.api, agent, project);
+//#endregion
+//#region src/mcp/tools/agents.ts
+const actionOn = async (run, agentId, action, force) => dataOf(`${action} the agent`, await run.api.POST("/agents/{id}/actions/{action}", {
+	params: { path: {
+		id: agentId,
+		action
+	} },
+	body: force ? { force: true } : {}
+}), agentHints);
+const agentTools = [
+	defineTool({
+		name: "agents_list",
+		title: "List agents",
+		description: "List the agents of one project, or of every project you can see.",
+		operations: ["listAgents"],
+		safety: "read",
+		input: z.object({ project: projectField.optional().describe("One project instead of all of them.") }),
+		run: async ({ project }, run) => agentsOf(run.api, project)
+	}),
+	defineTool({
+		name: "agent_show",
+		title: "Show an agent",
+		description: "Show one agent with its state, runtime, repositories and the actions it takes now. asPlan returns what agent_create takes instead, to copy an agent.",
+		operations: ["getAgent"],
+		safety: "read",
+		input: z.object({
+			...agentFields,
+			asPlan: z.boolean().default(false)
+		}),
+		run: async ({ asPlan, ...reference }, run) => {
+			const agent = dataOf("describe the agent", await run.api.GET("/agents/{id}", { params: { path: { id: await agentIdOf(run, reference) } } }), agentHints);
+			return asPlan ? agentPlanOf(agent) : agent;
+		}
+	}),
+	defineTool({
+		name: "agent_create",
+		title: "Create an agent",
+		description: "Create an agent in a project. The credentials, repositories and tools are named by the ids that credentials_list, repositories_list and tools_list return; agent_show with asPlan shows a complete example. The agent stays stopped until agent_action starts it.",
+		operations: ["createAgent"],
+		safety: "write",
+		input: z.object({
+			project: projectField,
+			agent: createAgentBodySchema
+		}),
+		run: async ({ project, agent }, run) => dataOf("create the agent", await run.api.POST("/projects/{id}/agents", {
+			params: { path: { id: await projectIdOf(run, project) } },
+			body: agent
+		}), agentHints)
+	}),
+	defineTool({
+		name: "agent_update",
+		title: "Change an agent",
+		description: "Change sections of an agent. Without version the change applies to the version read just before it. When restartRequired comes back true, agent_action update applies the change.",
+		operations: ["updateAgent"],
+		safety: "write",
+		input: z.object({
+			...agentFields,
+			version: z.int().nonnegative().optional().describe("The version the change is based on, to refuse a change made meanwhile."),
+			sections: updateAgentSectionsSchema
+		}),
+		run: async ({ version, sections, ...reference }, run) => changedAgent(run.api, await agentIdOf(run, reference), {
+			sections,
+			...version === void 0 ? {} : { version }
+		})
+	}),
+	defineTool({
+		name: "agent_delete",
+		title: "Delete an agent",
+		description: "Delete an agent with its container, its workspace and its history, after its current session, or at once with now.",
+		operations: ["deleteAgent"],
+		safety: "destructive",
+		input: z.object({
+			...agentFields,
+			now: z.boolean().default(false)
+		}),
+		run: async ({ now, ...reference }, run) => {
+			const agentId = await agentIdOf(run, reference);
+			doneWith("delete the agent", await run.api.DELETE("/agents/{id}", { params: {
+				path: { id: agentId },
+				...now ? { query: { force: "true" } } : {}
+			} }), agentHints);
+			return {
+				deleted: agentId,
+				now
+			};
+		}
+	}),
+	defineTool({
+		name: "agent_action",
+		title: "Start, pause, resume, restart or update an agent",
+		description: "start lets the agent work, pause holds it between sessions, resume lets a paused agent work again, restart restarts its container, update replaces the container to apply pending changes. The agent returns with the actions it takes next.",
+		operations: ["runAgentAction"],
+		safety: "write",
+		input: z.object({
+			...agentFields,
+			action: z.enum([
+				"start",
+				"pause",
+				"resume",
+				"restart",
+				"update"
+			])
+		}),
+		run: async ({ action, ...reference }, run) => actionOn(run, await agentIdOf(run, reference), action, false)
+	}),
+	defineTool({
+		name: "agent_interrupt",
+		title: "Stop, reset or cancel an agent",
+		description: "stop stops the agent after its current session, or at once with now; reset throws its workspace away and provisions it again; cancel cancels what it is doing.",
+		operations: ["runAgentAction"],
+		safety: "destructive",
+		input: z.object({
+			...agentFields,
+			action: z.enum([
+				"stop",
+				"reset",
+				"cancel"
+			]),
+			now: z.boolean().default(false).describe("For stop: stop the container at once.")
+		}),
+		run: async ({ action, now, ...reference }, run) => actionOn(run, await agentIdOf(run, reference), action, action === "stop" && now)
+	})
+];
+//#endregion
+//#region src/mcp/tools/credentials.ts
+const credentialField$1 = z.string().trim().min(1).describe("The credential, by its label or its id.");
+const credentialTools = [
+	defineTool({
+		name: "credentials_list",
+		title: "List credentials",
+		description: "List the Claude and GitHub credentials of a project, with their fingerprints and verification, never their secrets.",
+		operations: ["listCredentials"],
+		safety: "read",
+		input: z.object({ project: projectField }),
+		run: async ({ project }, run) => credentialsOf(run.api, await projectIdOf(run, project))
+	}),
+	defineTool({
+		name: "credential_update",
+		title: "Rename or verify a credential",
+		description: "rename gives a credential a new label; verify asks the instance to check it against its service, and credentials_list shows the answer.",
+		operations: ["renameCredential", "verifyCredential"],
+		safety: "write",
+		input: z.object({
+			project: projectField,
+			credential: credentialField$1,
+			action: z.enum(["rename", "verify"]),
+			label: z.string().trim().min(1).optional().describe("The new label, for rename.")
+		}),
+		run: async ({ project, credential, action, label }, run) => {
+			const projectId = await projectIdOf(run, project);
+			const credentialId = await resolveCredentialId(run.api, projectId, credential);
+			if (action === "verify") {
+				doneWith("verify the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/verify", { params: { path: {
+					id: projectId,
+					credentialId
+				} } }), credentialHints);
+				return {
+					id: credentialId,
+					verifying: true
+				};
+			}
+			if (label === void 0) throw new UsageError("rename needs a label.");
+			return dataOf("rename the credential", await run.api.PATCH("/projects/{id}/credentials/{credentialId}", {
+				params: { path: {
+					id: projectId,
+					credentialId
+				} },
+				body: { label }
+			}), credentialHints);
+		}
+	}),
+	defineTool({
+		name: "credential_delete",
+		title: "Delete a credential",
+		description: "Delete a credential of a project that no agent and no repository uses.",
+		operations: ["deleteCredential"],
+		safety: "destructive",
+		input: z.object({
+			project: projectField,
+			credential: credentialField$1
+		}),
+		run: async ({ project, credential }, run) => {
+			const projectId = await projectIdOf(run, project);
+			const credentialId = await resolveCredentialId(run.api, projectId, credential);
+			doneWith("delete the credential", await run.api.DELETE("/projects/{id}/credentials/{credentialId}", { params: { path: {
+				id: projectId,
+				credentialId
+			} } }), credentialHints);
+			return { deleted: credentialId };
+		}
+	})
+];
+//#endregion
 //#region src/commands/notifications.ts
+const notificationHints = { "notification.not_found": "kcloud notifications list shows them." };
 const createNotificationsCommand = (adaptersOf) => defineGroup({
 	name: "notifications",
 	summary: "What the instance wants you to look at.",
@@ -4785,7 +5234,7 @@ const createNotificationsCommand = (adaptersOf) => defineGroup({
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
 				const id = invocation.positionals[0] ?? "";
-				const counted = dataOf("mark the notification as read", await run.api.POST("/notifications/{id}/read", { params: { path: { id } } }), { "notification.not_found": "kcloud notifications list shows them." });
+				const counted = dataOf("mark the notification as read", await run.api.POST("/notifications/{id}/read", { params: { path: { id } } }), notificationHints);
 				return printed(run, counted, (shown) => `Read it; ${shown.unreadCount} are left unread.`);
 			}
 		}),
@@ -4836,8 +5285,7 @@ const createNotificationsCommand = (adaptersOf) => defineGroup({
 					},
 					onFrame: (frame) => {
 						if (frame.event !== "notification") return;
-						if (settings.json) context.terminal.json(frame.data);
-						else context.terminal.line(JSON.stringify(frame.data));
+						context.terminal.line(JSON.stringify(frame.data));
 					}
 				});
 				return exitCodes.ok;
@@ -4845,97 +5293,522 @@ const createNotificationsCommand = (adaptersOf) => defineGroup({
 		})
 	]
 });
+const notificationTools = [
+	defineTool({
+		name: "notifications_list",
+		title: "List notifications",
+		description: "List your notifications, newest first.",
+		operations: ["listNotifications"],
+		safety: "read",
+		input: z.object({
+			...pageFields,
+			unread: z.boolean().default(false)
+		}),
+		run: async ({ unread, limit, all }, run) => collect(async (cursor, size) => dataOf("list the notifications", await run.api.GET("/notifications", { params: { query: {
+			limit: size,
+			...cursor === null ? {} : { cursor },
+			...unread ? { unread: "true" } : {}
+		} } })), windowOfPage({
+			limit,
+			all
+		}))
+	}),
+	defineTool({
+		name: "notifications_mark_read",
+		title: "Mark notifications as read",
+		description: "Mark one notification as read with id, or every notification with all.",
+		operations: ["markNotificationRead", "markAllNotificationsRead"],
+		safety: "write",
+		idempotent: true,
+		input: z.object({
+			id: idSchema.optional().describe("The notification, from notifications_list."),
+			all: z.boolean().default(false)
+		}),
+		run: async ({ id, all }, run) => {
+			if (all === (id !== void 0)) throw new UsageError("Pass either id or all.");
+			return id === void 0 ? dataOf("mark every notification as read", await run.api.POST("/notifications/read-all")) : dataOf("mark the notification as read", await run.api.POST("/notifications/{id}/read", { params: { path: { id } } }), notificationHints);
+		}
+	}),
+	defineTool({
+		name: "notifications_wait",
+		title: "Wait for notifications",
+		description: "Wait until the instance raises a notification, or until the seconds run out, and return what it raised meanwhile. notifications_list shows the older ones.",
+		operations: ["streamNotifications"],
+		safety: "read",
+		input: z.object({ seconds: z.int().min(1).max(50).default(30) }),
+		run: async ({ seconds }, run) => {
+			const raised = [];
+			const settled = new AbortController();
+			const settling = { timer: null };
+			await streamFrames({
+				origin: run.origin,
+				token: await run.token(),
+				path: "/notifications/stream",
+				follow: true,
+				action: "wait for notifications",
+				wait: run.wait,
+				signal: AbortSignal.any([AbortSignal.timeout(seconds * 1e3), settled.signal]),
+				onFrame: (frame) => {
+					if (frame.event !== "notification") return;
+					settling.timer ??= setTimeout(() => {
+						settled.abort();
+					}, defaultIdleMs);
+					raised.push(frame.data);
+				}
+			});
+			if (settling.timer !== null) clearTimeout(settling.timer);
+			return raised;
+		}
+	})
+];
 //#endregion
-//#region src/commands/profiles.ts
-const rowsOf = (store) => Object.entries(store.profiles).map(([name, profile]) => [
-	name === store.current ? `${name} *` : name,
-	profile.origin,
-	profile.email ?? "unknown"
-]);
-const namedProfile = (store, name) => {
-	if (store.profiles[name] === void 0) {
-		const known = Object.keys(store.profiles);
-		throw new CliError(`There is no profile ${name} here.`, known.length === 0 ? "Run kcloud login --url <origin> to make one." : `kcloud profiles list shows ${known.join(", ")}.`);
+//#region src/mcp/tools/observability.ts
+const snapshotMs = 1e4;
+const sources = {
+	live: {
+		path: "/agents/{id}/live",
+		resumable: false
+	},
+	stored: {
+		path: "/agents/{id}/events",
+		resumable: true
 	}
 };
-const createProfilesCommand = () => defineGroup({
-	name: "profiles",
-	summary: "The instances this machine is signed in to.",
-	usage: "profiles <command>",
-	subcommands: [
-		defineCommand({
-			name: "list",
-			summary: "List the saved profiles, marking the current one.",
-			usage: "profiles list",
-			options: {},
-			positionals: {
-				min: 0,
-				max: 0
-			},
-			run: async ({ settings, context }) => {
-				const store = await readProfileStore(context.homeDirectory);
-				if (settings.json) {
-					context.terminal.json({
-						current: store.current,
-						profiles: Object.entries(store.profiles).map(([name, profile]) => ({
-							name,
-							origin: profile.origin,
-							email: profile.email
-						}))
-					});
-					return exitCodes.ok;
-				}
-				const rows = rowsOf(store);
-				context.terminal.line(rows.length === 0 ? "No instance is signed in here; kcloud login --url <origin> signs in." : renderTable([
-					{ header: "PROFILE" },
-					{ header: "INSTANCE" },
-					{ header: "ACCOUNT" }
-				], rows));
-				return exitCodes.ok;
+const observabilityTools = [
+	defineTool({
+		name: "agent_sessions",
+		title: "List the sessions of an agent",
+		description: "List the Claude sessions of an agent, newest first, with their role, model, outcome and cost.",
+		operations: ["listAgentSessions"],
+		safety: "read",
+		input: z.object({
+			...agentFields,
+			...pageFields,
+			role: z.enum(agentRoles).optional(),
+			task: z.string().trim().min(1).optional().describe("Only the sessions of this task id.")
+		}),
+		run: async ({ role, task, limit, all, ...reference }, run) => {
+			const agentId = await agentIdOf(run, reference);
+			return collect(async (cursor, size) => dataOf("list the sessions of the agent", await run.api.GET("/agents/{id}/sessions", { params: {
+				path: { id: agentId },
+				query: {
+					limit: size,
+					...cursor === null ? {} : { cursor },
+					...role === void 0 ? {} : { role },
+					...task === void 0 ? {} : { taskId: task }
+				}
+			} }), agentHints), windowOfPage({
+				limit,
+				all
+			}));
+		}
+	}),
+	defineTool({
+		name: "agent_transcript",
+		title: "Read a session transcript",
+		description: "Read the transcript of one session of an agent, one page of entries as the instance cuts it, or every entry with all.",
+		operations: ["getAgentSessionTranscript"],
+		safety: "read",
+		input: z.object({
+			...agentFields,
+			session: z.string().trim().min(1).describe("The session id, from agent_sessions."),
+			all: pageFields.all
+		}),
+		run: async ({ session, all, ...reference }, run) => transcriptOf(run.api, await agentIdOf(run, reference), session, all)
+	}),
+	defineTool({
+		name: "agent_costs",
+		title: "Show what an agent spent",
+		description: "Show what an agent spent over the last days, by day with totals, or by task with byTask.",
+		operations: ["getAgentCosts", "listAgentTaskCosts"],
+		safety: "read",
+		input: z.object({
+			...agentFields,
+			...pageFields,
+			days: z.int().min(1).max(365).default(7),
+			byTask: z.boolean().default(false)
+		}),
+		run: async ({ days, byTask, limit, all, ...reference }, run) => {
+			const agentId = await agentIdOf(run, reference);
+			const { from, to } = costWindowOf(days, run.now());
+			if (!byTask) return dataOf("show what the agent spent", await run.api.GET("/agents/{id}/costs", { params: {
+				path: { id: agentId },
+				query: {
+					from,
+					to
+				}
+			} }), agentHints);
+			return collect(async (cursor, size) => dataOf("list what the tasks cost", await run.api.GET("/agents/{id}/costs/tasks", { params: {
+				path: { id: agentId },
+				query: {
+					from,
+					to,
+					limit: size,
+					...cursor === null ? {} : { cursor }
+				}
+			} }), agentHints), windowOfPage({
+				limit,
+				all
+			}));
+		}
+	}),
+	defineTool({
+		name: "agent_metrics",
+		title: "Show what the container of an agent used",
+		description: "Show the CPU and memory the container of an agent used over a range.",
+		operations: ["getAgentMetrics"],
+		safety: "read",
+		input: z.object({
+			...agentFields,
+			range: z.enum(agentMetricsRanges).default("1h")
+		}),
+		run: async ({ range, ...reference }, run) => dataOf("show what the agent used", await run.api.GET("/agents/{id}/metrics", { params: {
+			path: { id: await agentIdOf(run, reference) },
+			query: { range }
+		} }), agentHints)
+	}),
+	defineTool({
+		name: "agent_memory_search",
+		title: "Search the memory of an agent",
+		description: "Search what an agent remembers of the tasks it finished.",
+		operations: ["searchAgentMemory"],
+		safety: "read",
+		input: z.object({
+			...agentFields,
+			query: z.string().max(200).optional(),
+			limit: z.int().min(1).max(100).default(20)
+		}),
+		run: async ({ query, limit, ...reference }, run) => dataOf("search what the agent remembers", await run.api.GET("/agents/{id}/memory", { params: {
+			path: { id: await agentIdOf(run, reference) },
+			query: {
+				limit,
+				...query === void 0 ? {} : { q: query }
+			}
+		} }), agentHints)
+	}),
+	defineTool({
+		name: "agent_events",
+		title: "Read the events of an agent",
+		description: "Read what an agent wrote: live is what it is writing now, stored is its stored history. The answer holds the events up to now and lastEventId; pass that as since to read only newer events next time.",
+		operations: ["streamAgentLive", "streamAgentEvents"],
+		safety: "read",
+		input: z.object({
+			...agentFields,
+			source: z.enum(["live", "stored"]).default("stored"),
+			since: z.string().trim().min(1).max(64).optional().describe("Start after this event id."),
+			limit: z.int().min(1).max(500).optional().describe("How many events to replay.")
+		}),
+		run: async ({ source, since, limit, ...reference }, run) => {
+			const agentId = await agentIdOf(run, reference);
+			const { path, resumable } = sources[source];
+			const events = [];
+			let lastEventId = since ?? null;
+			await streamFrames({
+				origin: run.origin,
+				token: await run.token(),
+				path: path.replace("{id}", encodeURIComponent(agentId)),
+				query: {
+					...since === void 0 ? {} : { since },
+					...limit === void 0 ? {} : { limit: String(limit) }
+				},
+				follow: false,
+				resumable,
+				idleMs: defaultIdleMs,
+				action: `read the ${source} events of the agent`,
+				wait: run.wait,
+				signal: AbortSignal.timeout(snapshotMs),
+				onFrame: (frame) => {
+					if (frame.id !== null) lastEventId = frame.id;
+					if (frame.event !== "agent.state") events.push(frame.data);
+				}
+			});
+			return {
+				events,
+				lastEventId
+			};
+		}
+	})
+];
+//#endregion
+//#region src/commands/tools.ts
+const projectOption$1 = { project: { type: "string" } };
+const projectUsage$1 = [["--project <name>", "the project the tool belongs to, by slug, name or id"]];
+const toolHints = {
+	"project.not_found": "kcloud projects list shows the projects you are a member of.",
+	"tool.not_found": "kcloud tools list --project <name> shows them.",
+	"tool.name_taken": "Another tool of the project has that name.",
+	"tool.slug_taken": "Another tool of the project has that slug.",
+	"tool.in_use": "Take it off its agents first.",
+	"tool.incomplete": "Every secret of the tool needs a value.",
+	"concurrency.conflict": "Someone changed the tool meanwhile; read it again and retry."
+};
+const projectFrom$1 = async (run, given) => {
+	if (given === void 0) throw new UsageError("This command needs a project.", "Pass --project <name>; kcloud projects list shows them.");
+	return resolveProjectId(run.api, given);
+};
+const toolsOf = async (api, projectId) => dataOf("list the tools of the project", await api.GET("/projects/{id}/tools", { params: { path: { id: projectId } } }), toolHints).items;
+const resolveTool = async (api, projectId, reference) => {
+	const tools = await toolsOf(api, projectId);
+	const found = tools.filter((tool) => tool.id === reference || tool.slug === reference || tool.name === reference);
+	const [first] = found;
+	if (first === void 0) throw new CliError(`The project has no tool ${reference}.`, tools.length === 0 ? "kcloud tools create --file <path> makes one." : `Its tools are ${tools.map(({ slug }) => slug).join(", ")}.`);
+	if (found.length > 1) throw new CliError(`${reference} names ${found.length} tools of the project.`, "Name it by its slug or its id instead.");
+	return first;
+};
+const changedTool = async (api, projectId, tool, document) => {
+	const change = typeof document === "object" && document !== null && "version" in document ? document : {
+		...document,
+		version: tool.version
+	};
+	validated(updateToolBodySchema, change, "a change to a tool");
+	return dataOf("change the tool", await api.PATCH("/projects/{id}/tools/{toolId}", {
+		params: { path: {
+			id: projectId,
+			toolId: tool.id
+		} },
+		body: change
+	}), toolHints);
+};
+const createToolsCommand = (adaptersOf) => defineGroup({
+	name: "tools",
+	summary: "The HTTP APIs and MCP servers a project offers its agents.",
+	usage: "tools <command>",
+	subcommands: [
+		defineCommand({
+			name: "list",
+			summary: "List the tools of a project.",
+			usage: "tools list --project <name>",
+			optionsUsage: projectUsage$1,
+			options: projectOption$1,
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const projectId = await projectFrom$1(run, invocation.values.project);
+				const items = await toolsOf(run.api, projectId);
+				return printed(run, items, (tools) => tools.length === 0 ? "The project offers no tool yet." : renderTable([
+					{ header: "SLUG" },
+					{ header: "NAME" },
+					{ header: "KIND" },
+					{ header: "SECRETS" },
+					{
+						header: "AGENTS",
+						align: "right"
+					},
+					{ header: "ID" }
+				], tools.map((tool) => [
+					tool.slug,
+					tool.name,
+					tool.kind,
+					tool.complete ? "complete" : "incomplete",
+					String(tool.agentsUsing),
+					tool.id
+				])));
 			}
 		}),
 		defineCommand({
-			name: "use",
-			summary: "Make one of the saved profiles the current one.",
-			usage: "profiles use <name>",
-			options: {},
+			name: "show",
+			summary: "Show one tool with its configuration.",
+			usage: "tools show <tool> --project <name>",
+			optionsUsage: projectUsage$1,
+			options: projectOption$1,
 			positionals: {
 				min: 1,
 				max: 1
 			},
-			run: async ({ positionals, context }) => {
-				const [name = ""] = positionals;
-				const store = await readProfileStore(context.homeDirectory);
-				namedProfile(store, name);
-				await writeProfileStore(context.homeDirectory, {
-					...store,
-					current: name
-				});
-				context.terminal.line(`${name} is the current profile.`);
-				return exitCodes.ok;
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const projectId = await projectFrom$1(run, invocation.values.project);
+				const tool = await resolveTool(run.api, projectId, invocation.positionals[0] ?? "");
+				return printed(run, tool, (shown) => [
+					renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
+						["name", shown.name],
+						["slug", shown.slug],
+						["kind", shown.kind],
+						["version", String(shown.version)],
+						["complete", shown.complete ? "yes" : "no"],
+						["agents", String(shown.agentsUsing)],
+						["id", shown.id]
+					]),
+					"",
+					JSON.stringify(shown.config, null, 2)
+				].join("\n"));
 			}
 		}),
 		defineCommand({
-			name: "remove",
-			summary: "Forget a saved profile without revoking its token.",
-			usage: "profiles remove <name>",
-			options: {},
+			name: "create",
+			summary: "Create a tool from a JSON description of it.",
+			usage: "tools create --project <name> --file <path>",
+			optionsUsage: [...projectUsage$1, ...fileUsage("the tool")],
+			options: {
+				...projectOption$1,
+				...fileOptions
+			},
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const projectId = await projectFrom$1(run, invocation.values.project);
+				const file = invocation.values.file;
+				if (file === void 0) throw new UsageError("tools create needs --file <path>.", "kcloud tools show <tool> --json prints the shape of a tool.");
+				const document = await documentOf(run, file);
+				validated(createToolBodySchema, document, "a tool");
+				const body = document;
+				const tool = dataOf("create the tool", await run.api.POST("/projects/{id}/tools", {
+					params: { path: { id: projectId } },
+					body
+				}), toolHints);
+				return printed(run, tool, (created) => `Created ${created.name} (${created.slug}) as ${created.id}.`);
+			}
+		}),
+		defineCommand({
+			name: "update",
+			summary: "Change a tool from a JSON description of the change.",
+			usage: "tools update <tool> --project <name> --file <path>",
+			optionsUsage: [...projectUsage$1, ...fileUsage("the change")],
+			options: {
+				...projectOption$1,
+				...fileOptions
+			},
 			positionals: {
 				min: 1,
 				max: 1
 			},
-			run: async ({ positionals, context }) => {
-				const [name = ""] = positionals;
-				const store = await readProfileStore(context.homeDirectory);
-				namedProfile(store, name);
-				await writeProfileStore(context.homeDirectory, withoutProfile(store, name));
-				context.terminal.line(`Forgot ${name}; its token stays usable until it is revoked.`);
-				return exitCodes.ok;
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const projectId = await projectFrom$1(run, invocation.values.project);
+				const tool = await resolveTool(run.api, projectId, invocation.positionals[0] ?? "");
+				const file = invocation.values.file;
+				if (file === void 0) throw new UsageError("tools update needs --file <path>.", "The file holds the sections to change, and the version it is based on.");
+				const updated = await changedTool(run.api, projectId, tool, await documentOf(run, file));
+				return printed(run, updated, (shown) => `Changed ${shown.name}.`);
+			}
+		}),
+		defineCommand({
+			name: "delete",
+			summary: "Delete a tool no agent uses.",
+			usage: "tools delete <tool> --project <name>",
+			optionsUsage: projectUsage$1,
+			options: projectOption$1,
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const projectId = await projectFrom$1(run, invocation.values.project);
+				const reference = invocation.positionals[0] ?? "";
+				const tool = await resolveTool(run.api, projectId, reference);
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: `Delete the tool ${tool.name}?`
+				});
+				doneWith("delete the tool", await run.api.DELETE("/projects/{id}/tools/{toolId}", { params: { path: {
+					id: projectId,
+					toolId: tool.id
+				} } }), toolHints);
+				return said(run, `Deleted the tool ${tool.name}.`);
 			}
 		})
 	]
 });
 //#endregion
+//#region src/mcp/tools/project-tools.ts
+const toolField = z.string().trim().min(1).describe("The tool, by its slug, its name or its id.");
+const withoutSecrets = "Secrets never pass through this server: a tool made here holds none and stays incomplete until someone sets them in the panel or with kcloud tools update --file.";
+const projectToolTools = [
+	defineTool({
+		name: "tools_list",
+		title: "List tools",
+		description: "List the HTTP APIs and MCP servers a project can give its agents, or show one of them with tool.",
+		operations: ["listTools"],
+		safety: "read",
+		input: z.object({
+			project: projectField,
+			tool: toolField.optional()
+		}),
+		run: async ({ project, tool }, run) => {
+			const projectId = await projectIdOf(run, project);
+			return tool === void 0 ? toolsOf(run.api, projectId) : resolveTool(run.api, projectId, tool);
+		}
+	}),
+	defineTool({
+		name: "tool_create",
+		title: "Create a tool",
+		description: `Create an HTTP API or an MCP server tool in a project. ${withoutSecrets}`,
+		operations: ["createTool"],
+		safety: "write",
+		input: z.object({
+			project: projectField,
+			tool: z.strictObject({
+				kind: toolKindSchema,
+				name: toolNameSchema,
+				slug: toolSlugSchema.optional(),
+				description: toolDescriptionSchema,
+				config: toolConfigSchema
+			})
+		}),
+		run: async ({ project, tool }, run) => {
+			const projectId = await projectIdOf(run, project);
+			const body = {
+				...tool,
+				secrets: {}
+			};
+			validated(createToolBodySchema, body, "a tool");
+			return dataOf("create the tool", await run.api.POST("/projects/{id}/tools", {
+				params: { path: { id: projectId } },
+				body
+			}), toolHints);
+		}
+	}),
+	defineTool({
+		name: "tool_update",
+		title: "Change a tool",
+		description: `Change sections of a tool. Without version the change applies to the version read just before it. ${withoutSecrets}`,
+		operations: ["updateTool"],
+		safety: "write",
+		input: z.object({
+			project: projectField,
+			tool: toolField,
+			version: z.int().nonnegative().optional().describe("The version the change is based on, to refuse a change made meanwhile."),
+			sections: updateToolSectionsSchema.omit({ secrets: true }).strict()
+		}),
+		run: async ({ project, tool, version, sections }, run) => {
+			const projectId = await projectIdOf(run, project);
+			const current = await resolveTool(run.api, projectId, tool);
+			return changedTool(run.api, projectId, current, {
+				sections,
+				...version === void 0 ? {} : { version }
+			});
+		}
+	}),
+	defineTool({
+		name: "tool_delete",
+		title: "Delete a tool",
+		description: "Delete a tool no agent uses.",
+		operations: ["deleteTool"],
+		safety: "destructive",
+		input: z.object({
+			project: projectField,
+			tool: toolField
+		}),
+		run: async ({ project, tool }, run) => {
+			const projectId = await projectIdOf(run, project);
+			const found = await resolveTool(run.api, projectId, tool);
+			doneWith("delete the tool", await run.api.DELETE("/projects/{id}/tools/{toolId}", { params: { path: {
+				id: projectId,
+				toolId: found.id
+			} } }), toolHints);
+			return { deleted: found.id };
+		}
+	})
+];
+//#endregion
 //#region src/commands/projects.ts
 const projectHint = { "project.not_found": "kcloud projects list shows the projects you are a member of." };
 const createProjectsCommand = (adaptersOf) => defineGroup({
@@ -5026,42 +5899,48 @@ const createProjectsCommand = (adaptersOf) => defineGroup({
 	]
 });
 //#endregion
-//#region src/commands/releases.ts
-const createReleasesCommand = (adaptersOf) => defineGroup({
-	name: "releases",
-	summary: "The Kikimora releases an agent can run.",
-	usage: "releases <command>",
-	subcommands: [defineCommand({
-		name: "list",
-		summary: "List the releases you can give an agent.",
-		usage: "releases list",
-		options: {},
-		positionals: {
-			min: 0,
-			max: 0
-		},
-		run: async (invocation) => {
-			const run = await runOf(adaptersOf, invocation);
-			const releases = dataOf("list the releases", await run.api.GET("/releases"));
-			return printed(run, releases, (listed) => listed.items.length === 0 ? "The catalogue holds no release an agent can run." : renderTable([
-				{ header: "VERSION" },
-				{ header: "CLAUDE CODE" },
-				{ header: "PLAYWRIGHT MCP" },
-				{ header: "PUBLISHED" }
-			], listed.items.map((release) => [
-				release.version,
-				release.claudeCodeVersion ?? "-",
-				release.playwrightMcpVersion ?? "-",
-				release.imageCreatedAt ?? "-"
-			])));
-		}
-	})]
-});
+//#region src/mcp/tools/projects.ts
+const projectTools = [defineTool({
+	name: "projects_list",
+	title: "List projects",
+	description: "List the projects you are a member of.",
+	operations: ["listProjects"],
+	safety: "read",
+	input: z.object({}),
+	run: async (_, run) => dataOf("list the projects", await run.api.GET("/projects")).items
+}), defineTool({
+	name: "project_show",
+	title: "Show a project",
+	description: "Show one project together with its members.",
+	operations: ["getProject", "listProjectMembers"],
+	safety: "read",
+	input: z.object({ project: projectField }),
+	run: async ({ project }, run) => {
+		const id = await projectIdOf(run, project);
+		const shown = dataOf("describe the project", await run.api.GET("/projects/{id}", { params: { path: { id } } }), projectHint);
+		const { items } = dataOf("list the members of the project", await run.api.GET("/projects/{id}/members", { params: { path: { id } } }), projectHint);
+		return {
+			...shown,
+			members: items
+		};
+	}
+})];
+//#endregion
+//#region src/mcp/tools/releases.ts
+const releaseTools = [defineTool({
+	name: "releases_list",
+	title: "List releases",
+	description: "List the Kikimora releases an agent can run, with the Claude Code and Playwright MCP versions each one ships.",
+	operations: ["listReleases"],
+	safety: "read",
+	input: z.object({}),
+	run: async (_, run) => dataOf("list the releases", await run.api.GET("/releases")).items
+})];
 //#endregion
 //#region src/commands/repositories.ts
-const projectOption$1 = { project: { type: "string" } };
-const projectUsage$1 = [["--project <name>", "the project the repository belongs to, by slug, name or id"]];
-const hints$1 = {
+const projectOption = { project: { type: "string" } };
+const projectUsage = [["--project <name>", "the project the repository belongs to, by slug, name or id"]];
+const repositoryHints = {
 	"project.not_found": "kcloud projects list shows the projects you are a member of.",
 	"repository.not_found": "kcloud repositories list --project <name> shows them.",
 	"repository.already_registered": "The project already has that repository.",
@@ -5071,11 +5950,11 @@ const hints$1 = {
 	"credential.rejected": "GitHub refused that credential; kcloud credentials rotate <credential> --project <name> replaces it.",
 	"credential.not_found": "kcloud credentials list --project <name> shows them."
 };
-const projectFrom$1 = async (run, given) => {
+const projectFrom = async (run, given) => {
 	if (given === void 0) throw new UsageError("This command needs a project.", "Pass --project <name>; kcloud projects list shows them.");
 	return resolveProjectId(run.api, given);
 };
-const repositoriesOf = async (api, projectId) => dataOf("list the repositories of the project", await api.GET("/projects/{id}/repositories", { params: { path: { id: projectId } } }), hints$1).items;
+const repositoriesOf = async (api, projectId) => dataOf("list the repositories of the project", await api.GET("/projects/{id}/repositories", { params: { path: { id: projectId } } }), repositoryHints).items;
 const resolveRepositoryId = async (api, projectId, reference) => {
 	const repositories = await repositoriesOf(api, projectId);
 	const found = repositories.filter((repository) => repository.id === reference || repository.name === reference || `${repository.owner}/${repository.name}` === reference);
@@ -5098,15 +5977,15 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 			name: "list",
 			summary: "List the repositories registered in a project.",
 			usage: "repositories list --project <name>",
-			optionsUsage: projectUsage$1,
-			options: projectOption$1,
+			optionsUsage: projectUsage,
+			options: projectOption,
 			positionals: {
 				min: 0,
 				max: 0
 			},
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom$1(run, invocation.values.project);
+				const projectId = await projectFrom(run, invocation.values.project);
 				const items = await repositoriesOf(run.api, projectId);
 				return printed(run, items, (repositories) => repositories.length === 0 ? "The project has no repository yet." : renderTable([
 					{ header: "REPOSITORY" },
@@ -5129,9 +6008,9 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 			name: "available",
 			summary: "List the GitHub repositories one credential can see.",
 			usage: "repositories available --project <name> --credential <label>",
-			optionsUsage: [...projectUsage$1, ["--credential <label>", "the github_pat credential to look through"]],
+			optionsUsage: [...projectUsage, ["--credential <label>", "the github_pat credential to look through"]],
 			options: {
-				...projectOption$1,
+				...projectOption,
 				credential: { type: "string" }
 			},
 			positionals: {
@@ -5140,14 +6019,14 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 			},
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom$1(run, invocation.values.project);
+				const projectId = await projectFrom(run, invocation.values.project);
 				const credential = invocation.values.credential;
 				if (credential === void 0) throw new UsageError("repositories available needs --credential <label>.", "kcloud credentials list --project <name> shows them.");
 				const credentialId = await resolveCredentialId(run.api, projectId, credential);
 				const listed = dataOf("list the repositories of the credential", await run.api.GET("/projects/{id}/repositories/github", { params: {
 					path: { id: projectId },
 					query: { credentialId }
-				} }), hints$1);
+				} }), repositoryHints);
 				return printed(run, listed, (page) => [page.items.length === 0 ? "The credential sees no repository." : renderTable([
 					{ header: "REPOSITORY" },
 					{ header: "BRANCH" },
@@ -5163,9 +6042,9 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 			name: "add",
 			summary: "Register a GitHub repository in a project.",
 			usage: "repositories add <owner/name> --project <name> --credential <label>",
-			optionsUsage: [...projectUsage$1, ["--credential <label>", "the github_pat credential that can see it"]],
+			optionsUsage: [...projectUsage, ["--credential <label>", "the github_pat credential that can see it"]],
 			options: {
-				...projectOption$1,
+				...projectOption,
 				credential: { type: "string" }
 			},
 			positionals: {
@@ -5174,7 +6053,7 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 			},
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom$1(run, invocation.values.project);
+				const projectId = await projectFrom(run, invocation.values.project);
 				const [owner, name] = ownerAndName(invocation.positionals[0] ?? "");
 				const credential = invocation.values.credential;
 				if (credential === void 0) throw new UsageError("repositories add needs --credential <label>.", "kcloud credentials list --project <name> shows them.");
@@ -5186,7 +6065,7 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 						name,
 						credentialId
 					}
-				}), hints$1);
+				}), repositoryHints);
 				return printed(run, repository, (added) => `Registered ${added.owner}/${added.name} on ${added.defaultBranch} as ${added.id}.`);
 			}
 		}),
@@ -5194,9 +6073,9 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 			name: "set-credential",
 			summary: "Point a repository at another credential.",
 			usage: "repositories set-credential <owner/name> --project <name> --credential <label>",
-			optionsUsage: [...projectUsage$1, ["--credential <label>", "the github_pat credential to use from now on"]],
+			optionsUsage: [...projectUsage, ["--credential <label>", "the github_pat credential to use from now on"]],
 			options: {
-				...projectOption$1,
+				...projectOption,
 				credential: { type: "string" }
 			},
 			positionals: {
@@ -5205,7 +6084,7 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 			},
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom$1(run, invocation.values.project);
+				const projectId = await projectFrom(run, invocation.values.project);
 				const repositoryId = await resolveRepositoryId(run.api, projectId, invocation.positionals[0] ?? "");
 				const credential = invocation.values.credential;
 				if (credential === void 0) throw new UsageError("repositories set-credential needs --credential <label>.");
@@ -5216,7 +6095,7 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 						repositoryId
 					} },
 					body: { credentialId }
-				}), hints$1);
+				}), repositoryHints);
 				return printed(run, repository, (changed) => `${changed.owner}/${changed.name} uses ${credential} now.`);
 			}
 		}),
@@ -5224,20 +6103,20 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 			name: "refresh",
 			summary: "Check a repository against GitHub again.",
 			usage: "repositories refresh <owner/name> --project <name>",
-			optionsUsage: projectUsage$1,
-			options: projectOption$1,
+			optionsUsage: projectUsage,
+			options: projectOption,
 			positionals: {
 				min: 1,
 				max: 1
 			},
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom$1(run, invocation.values.project);
+				const projectId = await projectFrom(run, invocation.values.project);
 				const repositoryId = await resolveRepositoryId(run.api, projectId, invocation.positionals[0] ?? "");
 				const repository = dataOf("check the repository", await run.api.POST("/projects/{id}/repositories/{repositoryId}/refresh", { params: { path: {
 					id: projectId,
 					repositoryId
-				} } }), hints$1);
+				} } }), repositoryHints);
 				return printed(run, repository, (checked) => `${checked.owner}/${checked.name} is ${checked.status} on ${checked.defaultBranch}.`);
 			}
 		}),
@@ -5245,15 +6124,15 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 			name: "delete",
 			summary: "Take a repository out of a project.",
 			usage: "repositories delete <owner/name> --project <name>",
-			optionsUsage: projectUsage$1,
-			options: projectOption$1,
+			optionsUsage: projectUsage,
+			options: projectOption,
 			positionals: {
 				min: 1,
 				max: 1
 			},
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom$1(run, invocation.values.project);
+				const projectId = await projectFrom(run, invocation.values.project);
 				const reference = invocation.positionals[0] ?? "";
 				const repositoryId = await resolveRepositoryId(run.api, projectId, reference);
 				await confirmed({
@@ -5264,307 +6143,392 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 				doneWith("delete the repository", await run.api.DELETE("/projects/{id}/repositories/{repositoryId}", { params: { path: {
 					id: projectId,
 					repositoryId
-				} } }), hints$1);
+				} } }), repositoryHints);
 				return said(run, `Took ${reference} out of the project.`);
 			}
 		})
 	]
 });
 //#endregion
-//#region src/commands/tools.ts
-const projectOption = { project: { type: "string" } };
-const projectUsage = [["--project <name>", "the project the tool belongs to, by slug, name or id"]];
-const hints = {
-	"project.not_found": "kcloud projects list shows the projects you are a member of.",
-	"tool.not_found": "kcloud tools list --project <name> shows them.",
-	"tool.name_taken": "Another tool of the project has that name.",
-	"tool.slug_taken": "Another tool of the project has that slug.",
-	"tool.in_use": "Take it off its agents first.",
-	"tool.incomplete": "Every secret of the tool needs a value.",
-	"concurrency.conflict": "Someone changed the tool meanwhile; read it again and retry."
-};
-const projectFrom = async (run, given) => {
-	if (given === void 0) throw new UsageError("This command needs a project.", "Pass --project <name>; kcloud projects list shows them.");
-	return resolveProjectId(run.api, given);
-};
-const toolsOf = async (api, projectId) => dataOf("list the tools of the project", await api.GET("/projects/{id}/tools", { params: { path: { id: projectId } } }), hints).items;
-const resolveTool = async (api, projectId, reference) => {
-	const tools = await toolsOf(api, projectId);
-	const found = tools.filter((tool) => tool.id === reference || tool.slug === reference || tool.name === reference);
-	const [first] = found;
-	if (first === void 0) throw new CliError(`The project has no tool ${reference}.`, tools.length === 0 ? "kcloud tools create --file <path> makes one." : `Its tools are ${tools.map(({ slug }) => slug).join(", ")}.`);
-	if (found.length > 1) throw new CliError(`${reference} names ${found.length} tools of the project.`, "Name it by its slug or its id instead.");
-	return first;
+//#region src/mcp/tools/repositories.ts
+const repositoryField = z.string().trim().min(1).describe("The repository, as owner/name, by its name or by its id.");
+const credentialField = z.string().trim().min(1).describe("A github_pat credential of the project, by its label or its id.");
+const repositoryTools = [
+	defineTool({
+		name: "repositories_list",
+		title: "List repositories",
+		description: "registered lists the GitHub repositories of a project; github lists what one github_pat credential can see on GitHub, to pick one for repository_add.",
+		operations: ["listRepositories", "listGitHubRepositories"],
+		safety: "read",
+		input: z.object({
+			project: projectField,
+			source: z.enum(["registered", "github"]).default("registered"),
+			credential: credentialField.optional().describe("The credential to look through, for github.")
+		}),
+		run: async ({ project, source, credential }, run) => {
+			const projectId = await projectIdOf(run, project);
+			if (source === "registered") return repositoriesOf(run.api, projectId);
+			if (credential === void 0) throw new UsageError("github needs a credential.");
+			const credentialId = await resolveCredentialId(run.api, projectId, credential);
+			return dataOf("list the repositories of the credential", await run.api.GET("/projects/{id}/repositories/github", { params: {
+				path: { id: projectId },
+				query: { credentialId }
+			} }), repositoryHints);
+		}
+	}),
+	defineTool({
+		name: "repository_add",
+		title: "Register a repository",
+		description: "Register a GitHub repository in a project, so agents can clone it.",
+		operations: ["registerRepository"],
+		safety: "write",
+		input: z.object({
+			project: projectField,
+			repository: z.string().trim().min(1).describe("The GitHub repository, as owner/name."),
+			credential: credentialField
+		}),
+		run: async ({ project, repository, credential }, run) => {
+			const projectId = await projectIdOf(run, project);
+			const [owner, name] = ownerAndName(repository);
+			const credentialId = await resolveCredentialId(run.api, projectId, credential);
+			return dataOf("register the repository", await run.api.POST("/projects/{id}/repositories", {
+				params: { path: { id: projectId } },
+				body: {
+					owner,
+					name,
+					credentialId
+				}
+			}), repositoryHints);
+		}
+	}),
+	defineTool({
+		name: "repository_update",
+		title: "Change or refresh a repository",
+		description: "set_credential points a repository at another github_pat credential; refresh checks it on GitHub again.",
+		operations: ["updateRepository", "refreshRepository"],
+		safety: "write",
+		input: z.object({
+			project: projectField,
+			repository: repositoryField,
+			action: z.enum(["set_credential", "refresh"]),
+			credential: credentialField.optional().describe("The new credential, for set_credential.")
+		}),
+		run: async ({ project, repository, action, credential }, run) => {
+			const projectId = await projectIdOf(run, project);
+			const repositoryId = await resolveRepositoryId(run.api, projectId, repository);
+			if (action === "refresh") return dataOf("check the repository", await run.api.POST("/projects/{id}/repositories/{repositoryId}/refresh", { params: { path: {
+				id: projectId,
+				repositoryId
+			} } }), repositoryHints);
+			if (credential === void 0) throw new UsageError("set_credential needs a credential.");
+			const credentialId = await resolveCredentialId(run.api, projectId, credential);
+			return dataOf("change the credential of the repository", await run.api.PATCH("/projects/{id}/repositories/{repositoryId}", {
+				params: { path: {
+					id: projectId,
+					repositoryId
+				} },
+				body: { credentialId }
+			}), repositoryHints);
+		}
+	}),
+	defineTool({
+		name: "repository_delete",
+		title: "Remove a repository",
+		description: "Take a repository no agent uses out of a project.",
+		operations: ["deleteRepository"],
+		safety: "destructive",
+		input: z.object({
+			project: projectField,
+			repository: repositoryField
+		}),
+		run: async ({ project, repository }, run) => {
+			const projectId = await projectIdOf(run, project);
+			const repositoryId = await resolveRepositoryId(run.api, projectId, repository);
+			doneWith("delete the repository", await run.api.DELETE("/projects/{id}/repositories/{repositoryId}", { params: { path: {
+				id: projectId,
+				repositoryId
+			} } }), repositoryHints);
+			return { deleted: repositoryId };
+		}
+	})
+];
+//#endregion
+//#region src/mcp/tools/tasks.ts
+const taskFields = {
+	...agentFields,
+	task: z.string().trim().min(1).describe("The id of the task, from agent_tasks_list.")
 };
-const createToolsCommand = (adaptersOf) => defineGroup({
-	name: "tools",
-	summary: "The HTTP APIs and MCP servers a project offers its agents.",
-	usage: "tools <command>",
-	subcommands: [
-		defineCommand({
-			name: "list",
-			summary: "List the tools of a project.",
-			usage: "tools list --project <name>",
-			optionsUsage: projectUsage,
-			options: projectOption,
-			positionals: {
-				min: 0,
-				max: 0
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom(run, invocation.values.project);
-				const items = await toolsOf(run.api, projectId);
-				return printed(run, items, (tools) => tools.length === 0 ? "The project offers no tool yet." : renderTable([
-					{ header: "SLUG" },
-					{ header: "NAME" },
-					{ header: "KIND" },
-					{ header: "SECRETS" },
-					{
-						header: "AGENTS",
-						align: "right"
-					},
-					{ header: "ID" }
-				], tools.map((tool) => [
-					tool.slug,
-					tool.name,
-					tool.kind,
-					tool.complete ? "complete" : "incomplete",
-					String(tool.agentsUsing),
-					tool.id
-				])));
-			}
+const taskTools = [
+	defineTool({
+		name: "agent_tasks_list",
+		title: "List the tasks of an agent",
+		description: "List the task queue of an agent, with the status, attempts and cost of each task.",
+		operations: ["listAgentTasks"],
+		safety: "read",
+		input: z.object({
+			...agentFields,
+			status: z.enum(taskStatuses).optional()
 		}),
-		defineCommand({
-			name: "show",
-			summary: "Show one tool with its configuration.",
-			usage: "tools show <tool> --project <name>",
-			optionsUsage: projectUsage,
-			options: projectOption,
-			positionals: {
-				min: 1,
-				max: 1
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom(run, invocation.values.project);
-				const tool = await resolveTool(run.api, projectId, invocation.positionals[0] ?? "");
-				return printed(run, tool, (shown) => [
-					renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
-						["name", shown.name],
-						["slug", shown.slug],
-						["kind", shown.kind],
-						["version", String(shown.version)],
-						["complete", shown.complete ? "yes" : "no"],
-						["agents", String(shown.agentsUsing)],
-						["id", shown.id]
-					]),
-					"",
-					JSON.stringify(shown.config, null, 2)
-				].join("\n"));
-			}
+		run: async ({ status, ...reference }, run) => dataOf("list the tasks of the agent", await run.api.GET("/agents/{id}/tasks", { params: {
+			path: { id: await agentIdOf(run, reference) },
+			...status === void 0 ? {} : { query: { status } }
+		} }), taskHints)
+	}),
+	defineTool({
+		name: "agent_task_add",
+		title: "Queue a task",
+		description: "Put a task in the queue of an agent.",
+		operations: ["addAgentTask"],
+		safety: "write",
+		input: z.object({
+			...agentFields,
+			title: z.string().trim().min(1).optional().describe("A short name for the task."),
+			description: z.string().trim().min(1).describe("What the agent should do.")
 		}),
-		defineCommand({
-			name: "create",
-			summary: "Create a tool from a JSON description of it.",
-			usage: "tools create --project <name> --file <path>",
-			optionsUsage: [...projectUsage, ...fileUsage("the tool")],
-			options: {
-				...projectOption,
-				...fileOptions
-			},
-			positionals: {
-				min: 0,
-				max: 0
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom(run, invocation.values.project);
-				const file = invocation.values.file;
-				if (file === void 0) throw new UsageError("tools create needs --file <path>.", "kcloud tools show <tool> --json prints the shape of a tool.");
-				const document = await documentOf(run, file);
-				validated(createToolBodySchema, document, "a tool");
-				const body = document;
-				const tool = dataOf("create the tool", await run.api.POST("/projects/{id}/tools", {
-					params: { path: { id: projectId } },
-					body
-				}), hints);
-				return printed(run, tool, (created) => `Created ${created.name} (${created.slug}) as ${created.id}.`);
+		run: async ({ title, description, ...reference }, run) => dataOf("add the task", await run.api.POST("/agents/{id}/tasks", {
+			params: { path: { id: await agentIdOf(run, reference) } },
+			body: {
+				description,
+				...title === void 0 ? {} : { title }
 			}
-		}),
-		defineCommand({
-			name: "update",
-			summary: "Change a tool from a JSON description of the change.",
-			usage: "tools update <tool> --project <name> --file <path>",
-			optionsUsage: [...projectUsage, ...fileUsage("the change")],
-			options: {
-				...projectOption,
-				...fileOptions
-			},
-			positionals: {
-				min: 1,
-				max: 1
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom(run, invocation.values.project);
-				const tool = await resolveTool(run.api, projectId, invocation.positionals[0] ?? "");
-				const file = invocation.values.file;
-				if (file === void 0) throw new UsageError("tools update needs --file <path>.", "The file holds the sections to change, and the version it is based on.");
-				const document = await documentOf(run, file);
-				const change = typeof document === "object" && document !== null && "version" in document ? document : {
-					...document,
-					version: tool.version
+		}), taskHints)
+	}),
+	defineTool({
+		name: "agent_task_retry",
+		title: "Retry a task",
+		description: "Queue a failed task of an agent again.",
+		operations: ["retryAgentTask"],
+		safety: "write",
+		input: z.object(taskFields),
+		run: async ({ task, ...reference }, run) => {
+			doneWith("retry the task", await run.api.POST("/agents/{id}/tasks/{taskId}/retry", { params: { path: {
+				id: await agentIdOf(run, reference),
+				taskId: task
+			} } }), taskHints);
+			return { queued: task };
+		}
+	}),
+	defineTool({
+		name: "agent_task_cancel",
+		title: "Cancel a task",
+		description: "Cancel a task of an agent that has not started.",
+		operations: ["cancelAgentTask"],
+		safety: "destructive",
+		input: z.object(taskFields),
+		run: async ({ task, ...reference }, run) => {
+			doneWith("cancel the task", await run.api.POST("/agents/{id}/tasks/{taskId}/cancel", { params: { path: {
+				id: await agentIdOf(run, reference),
+				taskId: task
+			} } }), taskHints);
+			return { cancelled: task };
+		}
+	})
+];
+//#endregion
+//#region src/mcp/tools/index.ts
+const kcloudTools = [
+	...accountTools,
+	...projectTools,
+	...credentialTools,
+	...repositoryTools,
+	...projectToolTools,
+	...agentTools,
+	...taskTools,
+	...observabilityTools,
+	...notificationTools,
+	...releaseTools
+];
+//#endregion
+//#region src/mcp/server.ts
+const instructions = [
+	"These tools act on one Kikimora Cloud instance as the account kcloud is signed in with; whoami names both.",
+	"Name a project by its slug, its name or its id. Name an agent as <project>/<agent>, as its slug or name together with project, or by its id.",
+	"A refusal quotes the error code of the instance. Its hint may name a kcloud command, such as kcloud agents list; the tool for the same resource and verb, agents_list, does that work here.",
+	"Secrets never pass through these tools. For them the person at the terminal runs kcloud credentials add, kcloud credentials rotate, kcloud tokens create, kcloud auth password, or sets the secrets of a tool in the panel."
+].join("\n");
+const createKcloudServer = ({ version, open }) => {
+	const server = new McpServer({
+		name: "kcloud",
+		title: "Kikimora Cloud",
+		version
+	}, { instructions });
+	for (const tool of kcloudTools) server.registerTool(tool.name, {
+		title: tool.title,
+		description: tool.description,
+		inputSchema: tool.input,
+		annotations: annotationsOf(tool)
+	}, (input) => resultOf(async () => tool.run(input, await open())));
+	return server;
+};
+//#endregion
+//#region src/commands/mcp.ts
+const createMcpCommand = (adaptersOf, cliVersion) => defineCommand({
+	name: "mcp",
+	summary: "Serve the work of kcloud to an MCP client over stdio.",
+	usage: "mcp [--profile <name>] [--url <origin>]",
+	optionsUsage: [["", "an MCP client starts it, as in: claude mcp add kcloud -- kcloud mcp"], ["", "each tool call uses the profile or KIKIMORA_CLOUD_TOKEN of that moment"]],
+	options: {},
+	positionals: {
+		min: 0,
+		max: 0
+	},
+	run: async ({ settings, context }) => {
+		const adapters = adaptersOf(context);
+		const { stdin, stdout } = context.io;
+		const connection = serveStdio(() => createKcloudServer({
+			version: cliVersion,
+			open: async () => {
+				const session = await openSession({
+					settings,
+					context,
+					api: adapters.api
+				});
+				return {
+					api: session.api,
+					origin: session.origin,
+					profileName: session.profileName,
+					kcloudVersion: cliVersion,
+					token: () => tokenOf({
+						settings,
+						context
+					}),
+					wait: adapters.wait,
+					now: adapters.now
 				};
-				validated(updateToolBodySchema, change, "a change to a tool");
-				const body = change;
-				const updated = dataOf("change the tool", await run.api.PATCH("/projects/{id}/tools/{toolId}", {
-					params: { path: {
-						id: projectId,
-						toolId: tool.id
-					} },
-					body
-				}), hints);
-				return printed(run, updated, (shown) => `Changed ${shown.name}.`);
 			}
-		}),
-		defineCommand({
-			name: "delete",
-			summary: "Delete a tool no agent uses.",
-			usage: "tools delete <tool> --project <name>",
-			optionsUsage: projectUsage,
-			options: projectOption,
-			positionals: {
-				min: 1,
-				max: 1
-			},
-			run: async (invocation) => {
-				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom(run, invocation.values.project);
-				const reference = invocation.positionals[0] ?? "";
-				const tool = await resolveTool(run.api, projectId, reference);
-				await confirmed({
-					prompt: run.prompt,
-					settings: run.settings,
-					question: `Delete the tool ${tool.name}?`
-				});
-				doneWith("delete the tool", await run.api.DELETE("/projects/{id}/tools/{toolId}", { params: { path: {
-					id: projectId,
-					toolId: tool.id
-				} } }), hints);
-				return said(run, `Deleted the tool ${tool.name}.`);
+		}), {
+			transport: new StdioServerTransport(stdin, stdout),
+			onerror: (error) => {
+				context.terminal.error(context.terminal.errorStyles.dim(error.message));
 			}
-		})
-	]
+		});
+		await finished(stdin, { writable: false }).catch(() => void 0);
+		await connection.close();
+		return exitCodes.ok;
+	}
 });
 //#endregion
-//#region src/commands/tokens.ts
-const lifetimeOf = (given) => {
-	if (given === void 0) return null;
-	const days = Number(given);
-	if (!/^[0-9]+$/u.test(given) || days < 1 || days > 365) throw new UsageError(`--expires-in ${given} is not a whole number of days from 1 to 365.`);
-	return days;
+//#region src/commands/profiles.ts
+const rowsOf = (store) => Object.entries(store.profiles).map(([name, profile]) => [
+	name === store.current ? `${name} *` : name,
+	profile.origin,
+	profile.email ?? "unknown"
+]);
+const namedProfile = (store, name) => {
+	if (store.profiles[name] === void 0) {
+		const known = Object.keys(store.profiles);
+		throw new CliError(`There is no profile ${name} here.`, known.length === 0 ? "Run kcloud login --url <origin> to make one." : `kcloud profiles list shows ${known.join(", ")}.`);
+	}
 };
-const createTokensCommand = (adaptersOf) => defineGroup({
-	name: "tokens",
-	summary: "The access tokens of your account on this instance.",
-	usage: "tokens <command>",
+const createProfilesCommand = () => defineGroup({
+	name: "profiles",
+	summary: "The instances this machine is signed in to.",
+	usage: "profiles <command>",
 	subcommands: [
 		defineCommand({
 			name: "list",
-			summary: "List the access tokens of your account.",
-			usage: "tokens list",
+			summary: "List the saved profiles, marking the current one.",
+			usage: "profiles list",
 			options: {},
 			positionals: {
 				min: 0,
 				max: 0
 			},
 			run: async ({ settings, context }) => {
-				const adapters = adaptersOf(context);
-				const session = await openSession({
-					settings,
-					context,
-					api: adapters.api
-				});
-				const { items } = dataOf("list the access tokens", await session.api.GET("/auth/me/tokens"));
+				const store = await readProfileStore(context.homeDirectory);
 				if (settings.json) {
-					context.terminal.json(items);
+					context.terminal.json({
+						current: store.current,
+						profiles: Object.entries(store.profiles).map(([name, profile]) => ({
+							name,
+							origin: profile.origin,
+							email: profile.email
+						}))
+					});
 					return exitCodes.ok;
 				}
-				context.terminal.line(items.length === 0 ? "Your account holds no access token on this instance." : renderTable([
-					{ header: "ID" },
-					{ header: "NAME" },
-					{ header: "LAST USED" },
-					{ header: "EXPIRES" }
-				], items.map((token) => [
-					token.id,
-					token.name,
-					token.lastUsedAt ?? "never",
-					token.expiresAt ?? "never"
-				])));
+				const rows = rowsOf(store);
+				context.terminal.line(rows.length === 0 ? "No instance is signed in here; kcloud login --url <origin> signs in." : renderTable([
+					{ header: "PROFILE" },
+					{ header: "INSTANCE" },
+					{ header: "ACCOUNT" }
+				], rows));
 				return exitCodes.ok;
 			}
 		}),
 		defineCommand({
-			name: "create",
-			summary: "Create an access token and print its secret once.",
-			usage: "tokens create <name> [--expires-in <days>]",
-			optionsUsage: [["--expires-in <days>", `how long the token lives, from 1 to 365 days (default: forever)`]],
-			options: { "expires-in": { type: "string" } },
+			name: "use",
+			summary: "Make one of the saved profiles the current one.",
+			usage: "profiles use <name>",
+			options: {},
 			positionals: {
 				min: 1,
 				max: 1
 			},
-			run: async ({ values, positionals, settings, context }) => {
-				const adapters = adaptersOf(context);
-				const expiresInDays = lifetimeOf(values["expires-in"]);
-				const session = await openSession({
-					settings,
-					context,
-					api: adapters.api
+			run: async ({ positionals, context }) => {
+				const [name = ""] = positionals;
+				const store = await readProfileStore(context.homeDirectory);
+				namedProfile(store, name);
+				await writeProfileStore(context.homeDirectory, {
+					...store,
+					current: name
 				});
-				const created = dataOf("create an access token", await session.api.POST("/auth/me/tokens", { body: {
-					name: positionals[0] ?? "",
-					expiresInDays
-				} }));
-				if (settings.json) {
-					context.terminal.json(created);
-					return exitCodes.ok;
-				}
-				context.terminal.line(created.secret);
-				context.terminal.error(`The token ${created.accessToken.name} is shown only here; the instance keeps its hash.`);
+				context.terminal.line(`${name} is the current profile.`);
 				return exitCodes.ok;
 			}
 		}),
 		defineCommand({
-			name: "revoke",
-			summary: "Revoke one access token of your account.",
-			usage: "tokens revoke <id>",
+			name: "remove",
+			summary: "Forget a saved profile without revoking its token.",
+			usage: "profiles remove <name>",
 			options: {},
 			positionals: {
 				min: 1,
 				max: 1
 			},
-			run: async ({ positionals, settings, context }) => {
-				const adapters = adaptersOf(context);
-				const id = positionals[0] ?? "";
-				const session = await openSession({
-					settings,
-					context,
-					api: adapters.api
-				});
-				await confirmed({
-					prompt: adapters.prompter(settings),
-					settings,
-					question: `Revoke the token ${id}? Everything using it stops working.`
-				});
-				doneWith(`revoke the token ${id}`, await session.api.DELETE("/auth/me/tokens/{id}", { params: { path: { id } } }), { "token.not_found": "kcloud tokens list shows the tokens and their ids." });
-				context.terminal.line(`Revoked the token ${id}.`);
+			run: async ({ positionals, context }) => {
+				const [name = ""] = positionals;
+				const store = await readProfileStore(context.homeDirectory);
+				namedProfile(store, name);
+				await writeProfileStore(context.homeDirectory, withoutProfile(store, name));
+				context.terminal.line(`Forgot ${name}; its token stays usable until it is revoked.`);
 				return exitCodes.ok;
 			}
 		})
 	]
 });
+//#endregion
+//#region src/commands/releases.ts
+const createReleasesCommand = (adaptersOf) => defineGroup({
+	name: "releases",
+	summary: "The Kikimora releases an agent can run.",
+	usage: "releases <command>",
+	subcommands: [defineCommand({
+		name: "list",
+		summary: "List the releases you can give an agent.",
+		usage: "releases list",
+		options: {},
+		positionals: {
+			min: 0,
+			max: 0
+		},
+		run: async (invocation) => {
+			const run = await runOf(adaptersOf, invocation);
+			const releases = dataOf("list the releases", await run.api.GET("/releases"));
+			return printed(run, releases, (listed) => listed.items.length === 0 ? "The catalogue holds no release an agent can run." : renderTable([
+				{ header: "VERSION" },
+				{ header: "CLAUDE CODE" },
+				{ header: "PLAYWRIGHT MCP" },
+				{ header: "PUBLISHED" }
+			], listed.items.map((release) => [
+				release.version,
+				release.claudeCodeVersion ?? "-",
+				release.playwrightMcpVersion ?? "-",
+				release.imageCreatedAt ?? "-"
+			])));
+		}
+	})]
+});
 const cliVersion = createRequire(import.meta.url)("../package.json").version;
 //#endregion
 //#region src/commands.ts
@@ -5582,7 +6546,8 @@ const kcloudCommands = () => [
 	createToolsCommand(createAdapters),
 	createAgentsCommand(createAdapters),
 	createNotificationsCommand(createAdapters),
-	createReleasesCommand(createAdapters)
+	createReleasesCommand(createAdapters),
+	createMcpCommand(createAdapters, cliVersion)
 ];
 //#endregion
 //#region src/main.ts