@kikimoradev/kcloud 1.10.0 → 1.11.0

package/dist/main.js

@@ -282,14 +282,14 @@ const quietPrompter = (prompter, warn) => ({
 //#region ../../packages/cli-kit/src/table.ts
 const columnGap = "  ";
 const visibleWidth = (text) => stripVTControlCharacters(text).length;
-const pad = (text, width, align) => {
+const pad$1 = (text, width, align) => {
 	const padding = " ".repeat(Math.max(0, width - visibleWidth(text)));
 	return align === "right" ? `${padding}${text}` : `${text}${padding}`;
 };
 const alignRows = (rows, alignments = []) => {
 	const columnCount = Math.max(0, ...rows.map((row) => row.length));
 	const widths = Array.from({ length: columnCount }, (_, index) => Math.max(0, ...rows.map((row) => visibleWidth(row[index] ?? ""))));
-	return rows.map((row) => widths.map((width, index) => pad(row[index] ?? "", width, alignments[index] ?? "left")).join(columnGap).trimEnd()).join("\n");
+	return rows.map((row) => widths.map((width, index) => pad$1(row[index] ?? "", width, alignments[index] ?? "left")).join(columnGap).trimEnd()).join("\n");
 };
 const renderTable = (columns, rows) => alignRows([columns.map(({ header }) => header), ...rows], columns.map(({ align }) => align ?? "left"));
 //#endregion
@@ -635,10 +635,60 @@ const pageSchema = (itemSchema) => z.object({
 const credentialKinds = [
 	"anthropic_api_key",
 	"claude_oauth_token",
-	"github_pat"
+	"github_pat",
+	"gitlab_token",
+	"bitbucket_token"
 ];
 const credentialKindSchema = z.enum(credentialKinds);
-z.enum(["anthropic_api_key", "claude_oauth_token"]);
+const claudeCredentialKinds = ["anthropic_api_key", "claude_oauth_token"];
+const claudeCredentialKindSchema = z.enum(claudeCredentialKinds);
+const gitProviders = [
+	"github",
+	"gitlab",
+	"bitbucket"
+];
+const gitProviderSchema = z.enum(gitProviders);
+const gitCredentialKinds = [
+	"github_pat",
+	"gitlab_token",
+	"bitbucket_token"
+];
+z.enum(gitCredentialKinds);
+const gitCredentialKindOf = {
+	github: "github_pat",
+	gitlab: "gitlab_token",
+	bitbucket: "bitbucket_token"
+};
+const defaultServerUrls = {
+	github: "https://github.com",
+	gitlab: "https://gitlab.com",
+	bitbucket: "https://bitbucket.org"
+};
+const isGitCredentialKind = (kind) => gitCredentialKinds.includes(kind);
+const providerOfKind = (kind) => gitProviders.find((provider) => gitCredentialKindOf[provider] === kind) ?? null;
+const maxServerUrlLength = 2048;
+const parsedServerUrl = (value) => {
+	try {
+		return new URL(value);
+	} catch {
+		return null;
+	}
+};
+const isWellFormedServerUrl = (value) => {
+	const url = parsedServerUrl(value);
+	return url !== null && (url.protocol === "https:" || url.protocol === "http:") && url.hostname !== "" && url.username === "" && url.password === "" && url.search === "" && url.hash === "" && !value.includes("?") && !value.includes("#");
+};
+const gitServerUrlSchema = z.string().trim().min(1).max(maxServerUrlLength).refine(isWellFormedServerUrl, { message: "expected an http or https address without credentials, query or fragment" });
+const providerTokenKindSchema = z.enum([
+	"gitlab_personal",
+	"gitlab_group",
+	"gitlab_project",
+	"bitbucket_api_token",
+	"bitbucket_access_token",
+	"bitbucket_http_token"
+]);
+const providerFailureSchema = z.enum(["rejected", "unreachable"]);
+const identitySourceSchema = z.enum(["provider", "user"]);
 const verificationStatusSchema = z.enum([
 	"pending",
 	"valid",
@@ -661,7 +711,14 @@ const credentialMetadataSchema = z.object({
 	commitEmail: z.string().optional(),
 	scopes: z.array(z.string()).optional(),
 	checkedAt: z.iso.datetime().optional(),
-	failureReason: z.string().optional()
+	failureReason: z.string().optional(),
+	serverUrl: z.string().optional(),
+	accountName: z.string().optional(),
+	accountUrl: z.string().optional(),
+	accountEmail: z.string().optional(),
+	providerTokenKind: providerTokenKindSchema.optional(),
+	providerFailure: providerFailureSchema.optional(),
+	identitySource: identitySourceSchema.optional()
 }).meta({ id: "CredentialMetadata" });
 const usageWindowStatusSchema = z.enum([
 	"allowed",
@@ -679,9 +736,14 @@ const subscriptionUsageSchema = z.object({
 	readAt: z.iso.datetime(),
 	stale: z.boolean()
 }).meta({ id: "SubscriptionUsage" });
+const claudeAccountQueuePlaceSchema = z.object({
+	projectId: idSchema,
+	projectName: z.string(),
+	position: z.int().positive()
+}).meta({ id: "ClaudeAccountQueuePlace" });
 const credentialSchema = z.object({
 	id: idSchema,
-	projectId: idSchema,
+	projectId: idSchema.nullable(),
 	version: z.int().nonnegative(),
 	kind: credentialKindSchema,
 	label: z.string(),
@@ -691,23 +753,54 @@ const credentialSchema = z.object({
 	expiresAt: z.iso.datetime().nullable(),
 	expiresAtComputed: z.boolean(),
 	usage: subscriptionUsageSchema.nullable(),
+	queues: z.array(claudeAccountQueuePlaceSchema),
+	creditsExhaustedAt: z.iso.datetime().nullable(),
+	limitedUntil: z.iso.datetime().nullable(),
 	createdAt: z.iso.datetime(),
 	updatedAt: z.iso.datetime()
 }).meta({ id: "Credential" });
 z.object({ items: z.array(credentialSchema) }).meta({ id: "CredentialList" });
 const credentialSummarySchema = z.object({
 	id: idSchema,
-	projectId: idSchema,
+	projectId: idSchema.nullable(),
 	kind: credentialKindSchema,
 	label: z.string(),
 	commitName: z.string().nullable(),
-	commitEmail: z.string().nullable()
+	commitEmail: z.string().nullable(),
+	provider: gitProviderSchema.nullable(),
+	serverUrl: z.string().nullable()
 }).meta({ id: "CredentialSummary" });
+const gitCredentialSummarySchema = credentialSummarySchema.extend({
+	provider: gitProviderSchema,
+	serverUrl: z.string()
+}).meta({ id: "GitCredentialSummary" });
+const commitNameSchema = z.string().trim().min(1).max(255);
+const commitEmailSchema = z.email().max(255);
+const accountEmailSchema = z.email().max(255);
+const hasWholeIdentity = (body) => body.commitName === void 0 === (body.commitEmail === void 0);
+const carriesGitFields = (body) => body.serverUrl !== void 0 || body.accountEmail !== void 0 || body.commitName !== void 0 || body.commitEmail !== void 0;
 z.object({
 	kind: credentialKindSchema,
 	label: credentialLabelSchema,
-	secret: credentialSecretSchema
+	secret: credentialSecretSchema,
+	serverUrl: gitServerUrlSchema.optional(),
+	accountEmail: accountEmailSchema.optional(),
+	commitName: commitNameSchema.optional(),
+	commitEmail: commitEmailSchema.optional()
+}).refine(hasWholeIdentity, {
+	message: "expected both the commit name and the commit email, or neither",
+	path: ["commitEmail"]
+}).refine((body) => isGitCredentialKind(body.kind) || !carriesGitFields(body), {
+	message: "expected no server, account or commit identity for a Claude credential",
+	path: ["kind"]
+}).refine((body) => body.kind !== "github_pat" || body.serverUrl === void 0, {
+	message: "expected no server address for a GitHub token",
+	path: ["serverUrl"]
 }).meta({ id: "CreateCredentialBody" });
+z.object({
+	commitName: commitNameSchema,
+	commitEmail: commitEmailSchema
+}).meta({ id: "SetCredentialCommitIdentityBody" });
 z.object({ label: credentialLabelSchema }).meta({ id: "RenameCredentialBody" });
 z.object({
 	secret: credentialSecretSchema,
@@ -717,6 +810,57 @@ z.object({
 	id: idSchema,
 	credentialId: idSchema
 });
+const switchThresholdSchema = z.int().min(1).max(100);
+z.object({ items: z.array(credentialSchema) }).meta({ id: "ClaudeAccountList" });
+z.object({
+	kind: claudeCredentialKindSchema,
+	label: credentialLabelSchema,
+	secret: credentialSecretSchema
+}).meta({ id: "CreateClaudeAccountBody" });
+z.object({
+	organizationId: idSchema,
+	credentialId: idSchema
+});
+const projectClaudeAccountStateSchema = z.enum([
+	"inUse",
+	"available",
+	"exhausted",
+	"noCredits",
+	"invalid"
+]);
+const claudeAccountWaitReasonSchema = z.enum([
+	"exhausted",
+	"blocked",
+	"empty"
+]);
+z.enum([
+	"queue",
+	"threshold",
+	"limit",
+	"reset",
+	"credits",
+	"invalid",
+	"removed"
+]);
+const projectClaudeAccountEntrySchema = z.object({
+	credential: credentialSchema,
+	position: z.int().positive(),
+	state: projectClaudeAccountStateSchema,
+	until: z.iso.datetime().nullable(),
+	agents: z.int().nonnegative()
+}).meta({ id: "ProjectClaudeAccountEntry" });
+z.object({
+	entries: z.array(projectClaudeAccountEntrySchema),
+	activeCredentialId: idSchema.nullable(),
+	nearestResetAt: z.iso.datetime().nullable(),
+	waitReason: claudeAccountWaitReasonSchema.nullable(),
+	version: z.int().nonnegative()
+}).meta({ id: "ProjectClaudeAccounts" });
+const hasUniqueCredentials = (ids) => new Set(ids).size === ids.length;
+z.object({
+	credentialIds: z.array(idSchema).max(50).refine(hasUniqueCredentials, { message: "expected every account once" }),
+	version: z.int().nonnegative()
+}).meta({ id: "SetProjectClaudeAccountsBody" });
 const errorCodes = Object.keys({
 	"validation.failed": "validation",
 	"http.route_not_found": "not_found",
@@ -760,10 +904,18 @@ const errorCodes = Object.keys({
 	"credential.kind_mismatch": "rule_violation",
 	"credential.rejected": "rule_violation",
 	"credential.usage_unavailable": "rule_violation",
+	"credential.server_refused": "validation",
+	"credential.server_mismatch": "rule_violation",
+	"account.not_found": "not_found",
+	"account.label_taken": "conflict",
+	"account.in_queue": "conflict",
+	"account.queue_empty": "rule_violation",
+	"account.kind_mismatch": "rule_violation",
 	"repository.not_found": "not_found",
 	"repository.already_registered": "conflict",
 	"repository.in_use": "conflict",
 	"repository.unreachable": "rule_violation",
+	"repository.catalog_unavailable": "rule_violation",
 	"tool.not_found": "not_found",
 	"tool.name_taken": "conflict",
 	"tool.slug_taken": "conflict",
@@ -782,6 +934,8 @@ const errorCodes = Object.keys({
 	"agent.slug_taken": "conflict",
 	"agent.directory_conflict": "rule_violation",
 	"agent.repository_required": "rule_violation",
+	"agent.provider_token_required": "rule_violation",
+	"agent.provider_token_conflict": "rule_violation",
 	"agent.tool_duplicate": "rule_violation",
 	"agent.context_too_long": "rule_violation",
 	"agent.docker_unavailable": "rule_violation",
@@ -1124,7 +1278,8 @@ agentEventSchema.options.map((option) => option.shape.event.value);
 	provisioned: "platform.provisioned",
 	sandboxStarted: "platform.sandboxStarted",
 	sandboxStopped: "platform.sandboxStopped",
-	restartedByNode: "platform.restartedByNode"
+	restartedByNode: "platform.restartedByNode",
+	claudeAccountChanged: "platform.claudeAccountChanged"
 }).rawLog;
 const agentStateSchema = z.enum([
 	"created",
@@ -2052,6 +2207,7 @@ const organizationSchema = z.object({
 	slug: organizationSlugSchema,
 	color: colorSchema,
 	logoHash: logoHashSchema.nullable(),
+	claudeSwitchThreshold: switchThresholdSchema,
 	createdAt: z.iso.datetime()
 }).meta({ id: "Organization" });
 z.object({ items: z.array(organizationSchema) }).meta({ id: "OrganizationList" });
@@ -2112,7 +2268,8 @@ z.object({
 const updateOrganizationBodySchema = z.object({
 	name: organizationNameSchema,
 	slug: organizationSlugSchema,
-	color: colorSchema
+	color: colorSchema,
+	claudeSwitchThreshold: switchThresholdSchema.optional()
 }).meta({ id: "UpdateOrganizationBody" });
 z.object({ temporaryPassword: z.string() }).meta({ id: "TemporaryPassword" });
 z.object({ items: z.array(userSchema) }).meta({ id: "UserList" });
@@ -2212,6 +2369,8 @@ const auditActionSchema = z.enum([
 	"credential.rotated",
 	"credential.deleted",
 	"credential.verified",
+	"credential.identity_set",
+	"project.claude_accounts_changed",
 	"repository.registered",
 	"repository.deleted",
 	"tool.created",
@@ -2389,14 +2548,21 @@ const repositoryStatusSchema = z.enum([
 const repositoryNamePattern = /^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,98}[A-Za-z0-9])?$/;
 const forbiddenBranchCharacters = /[\s\\~^:?*[\p{Cc}]/u;
 const isSafeBranchName = (value) => value.length > 0 && value.length <= 255 && !value.startsWith("-") && !forbiddenBranchCharacters.test(value);
-const repositoryOwnerSchema = z.string().regex(repositoryNamePattern);
+const isRepositoryOwner = (value) => {
+	const segments = value.split("/");
+	return value.length <= 255 && segments.length <= 20 && segments.every((segment) => repositoryNamePattern.test(segment));
+};
+const repositoryOwnerSchema = z.string().refine(isRepositoryOwner, { message: "expected one to twenty names separated by a slash" });
 const repositoryNameSchema = z.string().regex(repositoryNamePattern);
 const defaultBranchSchema = z.string().refine(isSafeBranchName, { message: "expected a branch name git and the TSV accept" });
 const repositorySchema = z.object({
 	id: idSchema,
 	projectId: idSchema,
 	version: z.int().nonnegative(),
-	githubId: z.int().positive(),
+	githubId: z.int().positive().nullable(),
+	provider: gitProviderSchema,
+	serverUrl: z.string(),
+	providerRepositoryId: z.string(),
 	owner: repositoryOwnerSchema,
 	name: repositoryNameSchema,
 	defaultBranch: defaultBranchSchema,
@@ -2418,16 +2584,18 @@ z.object({
 	id: idSchema,
 	repositoryId: idSchema
 });
-const gitHubRepositorySchema = z.object({
+const availableRepositorySchema = z.object({
 	owner: repositoryOwnerSchema,
 	name: repositoryNameSchema,
-	defaultBranch: defaultBranchSchema,
+	defaultBranch: defaultBranchSchema.nullable(),
 	isPrivate: z.boolean()
-}).meta({ id: "GitHubRepository" });
+}).meta({ id: "AvailableRepository" });
 z.object({
-	items: z.array(gitHubRepositorySchema),
-	truncated: z.boolean()
-}).meta({ id: "GitHubRepositoryList" });
+	items: z.array(availableRepositorySchema),
+	truncated: z.boolean(),
+	provider: gitProviderSchema,
+	serverUrl: z.string()
+}).meta({ id: "AvailableRepositoryList" });
 z.object({ credentialId: idSchema });
 const toolKindSchema = z.enum([
 	"http_api",
@@ -2462,7 +2630,8 @@ const reservedEnvironmentPrefixes = [
 	"ANTHROPIC_",
 	"GH_",
 	"DOCKER_",
-	"BC_"
+	"BC_",
+	"KC_GIT_"
 ];
 const reservedEnvironmentNames = /* @__PURE__ */ new Set([
 	"PATH",
@@ -2742,7 +2911,9 @@ const agentRepositorySchema = z.object({
 	owner: repositoryOwnerSchema,
 	name: repositoryNameSchema,
 	defaultBranch: defaultBranchSchema,
-	status: repositoryStatusSchema
+	status: repositoryStatusSchema,
+	provider: gitProviderSchema,
+	serverUrl: z.string()
 }).meta({ id: "AgentRepository" });
 const agentRuntimeSchema = z.object({
 	available: z.boolean(),
@@ -2786,6 +2957,17 @@ const agentNodeSchema = z.object({
 	name: nodeNameSchema,
 	state: nodeStateSchema
 }).meta({ id: "AgentNode" });
+const agentClaudeAccountSchema = z.object({
+	current: z.object({
+		id: idSchema,
+		label: z.string(),
+		kind: claudeCredentialKindSchema,
+		position: z.int().positive().nullable()
+	}).nullable(),
+	queueSize: z.int().nonnegative(),
+	waitReason: claudeAccountWaitReasonSchema.nullable(),
+	waitUntil: z.iso.datetime().nullable()
+}).meta({ id: "AgentClaudeAccount" });
 agentListItemSchema.extend({
 	version: z.int().nonnegative(),
 	description: z.string(),
@@ -2794,8 +2976,10 @@ agentListItemSchema.extend({
 	settings: kikimoraSettingsSchema,
 	effectiveSettings: workerSettingsSchema,
 	prompts: agentPromptsSchema,
-	claudeCredential: credentialSummarySchema,
-	githubCredential: credentialSummarySchema,
+	claudeCredential: credentialSummarySchema.nullable(),
+	claudeAccount: agentClaudeAccountSchema,
+	githubCredential: credentialSummarySchema.nullable(),
+	gitCredentials: z.array(gitCredentialSummarySchema),
 	repositories: z.array(agentRepositorySchema),
 	toolAssignments: z.array(agentToolSchema),
 	release: releaseSummarySchema.nullable(),
@@ -2812,10 +2996,7 @@ const uniqueDirectories = {
 	message: "expected every repository to use its own directory",
 	path: ["repositories"]
 };
-const distinctCredentials = {
-	message: "expected the Claude and the GitHub credential to be two credentials",
-	path: ["githubCredentialId"]
-};
+const agentGitCredentialIdsSchema = z.array(idSchema).max(8).refine((ids) => new Set(ids).size === ids.length, { message: "expected every credential once" });
 const hasUniqueTools = (assignments) => new Set(assignments.map((assignment) => assignment.toolId)).size === assignments.length;
 const agentRepositoryLinksSchema = z.array(agentRepositoryLinkSchema).min(1).max(32);
 const agentToolAssignmentsSchema = z.array(toolAssignmentSchema).max(32).refine(hasUniqueTools, { message: "expected every tool to be assigned once" });
@@ -2828,15 +3009,16 @@ const createAgentBodySchema = z.object({
 	kikimoraVersion: kikimoraVersionSchema,
 	nodeId: idSchema,
 	requiredCapabilities: requiredCapabilitiesSchema.optional(),
-	claudeCredentialId: idSchema,
-	githubCredentialId: idSchema,
+	claudeCredentialId: idSchema.optional(),
+	githubCredentialId: idSchema.optional(),
+	gitCredentialIds: agentGitCredentialIdsSchema.default([]),
 	repositories: agentRepositoryLinksSchema,
 	toolAssignments: agentToolAssignmentsSchema,
 	prompts: agentPromptsSchema,
 	settings: kikimoraSettingsSchema,
 	timezone: timezoneSchema,
 	machine: agentMachineInputSchema
-}).refine((body) => hasUniqueDirectories(body.repositories), uniqueDirectories).refine((body) => body.claudeCredentialId !== body.githubCredentialId, distinctCredentials).meta({ id: "CreateAgentBody" });
+}).refine((body) => hasUniqueDirectories(body.repositories), uniqueDirectories).meta({ id: "CreateAgentBody" });
 const updateAgentSectionsSchema = z.object({
 	general: z.object({
 		name: agentNameSchema,
@@ -2845,9 +3027,10 @@ const updateAgentSectionsSchema = z.object({
 	}).optional(),
 	version: kikimoraVersionSchema.optional(),
 	credentials: z.object({
-		claudeCredentialId: idSchema,
-		githubCredentialId: idSchema
-	}).refine((section) => section.claudeCredentialId !== section.githubCredentialId, distinctCredentials).optional(),
+		claudeCredentialId: idSchema.optional(),
+		githubCredentialId: idSchema.optional(),
+		gitCredentialIds: agentGitCredentialIdsSchema.default([])
+	}).optional(),
 	repositories: agentRepositoryLinksSchema.optional(),
 	tools: agentToolAssignmentsSchema.optional(),
 	prompts: agentPromptsSchema.optional(),
@@ -3410,7 +3593,8 @@ const notificationKindSchema = z.enum([
 	"backup.overdue",
 	"host_operation.finished",
 	"dead_letter.queued",
-	"node.resumed"
+	"node.resumed",
+	"project.claude_accounts_exhausted"
 ]);
 const notificationSeveritySchema = z.enum([
 	"info",
@@ -3424,7 +3608,8 @@ const notificationTargetTypeSchema = z.enum([
 	"queue",
 	"volume",
 	"platform",
-	"node"
+	"node",
+	"project"
 ]);
 const hostOperationOutcomes = [
 	"succeeded",
@@ -3458,7 +3643,10 @@ z.discriminatedUnion("operation", [
 		role: volumeRoleSchema
 	})
 ]);
-z.strictObject({ label: textParam }), z.strictObject({
+z.strictObject({
+	label: textParam,
+	kind: credentialKindSchema
+}), z.strictObject({
 	label: textParam,
 	expiresAt: instantParam
 }), z.strictObject({
@@ -3491,7 +3679,10 @@ z.strictObject({ label: textParam }), z.strictObject({
 }).refine((params) => params.pausedAgents === 0 === (params.pausedAgentNames === ""), {
 	message: "expected the names of the paused agents exactly when there are some",
 	path: ["pausedAgentNames"]
-});
+}), z.union([z.strictObject({
+	blocked: z.literal(false),
+	nearestResetAt: instantParam
+}), z.strictObject({ blocked: z.literal(true) })]);
 const notificationParamsSchema = z.record(z.string(), z.union([
 	z.string(),
 	z.number(),
@@ -4434,6 +4625,22 @@ const runOf = async (adaptersOf, { settings, context }) => {
 	};
 };
 //#endregion
+//#region src/git-providers.ts
+const providerNames = {
+	github: "GitHub",
+	gitlab: "GitLab",
+	bitbucket: "Bitbucket"
+};
+const isGitProvider = (value) => gitProviders.some((provider) => provider === value);
+const providerNameOf = (provider) => isGitProvider(provider) ? providerNames[provider] : "the provider";
+const gitProviderOf = (credential) => providerOfKind(credential.kind);
+const credentialServerOf = (credential) => {
+	const provider = gitProviderOf(credential);
+	if (provider === null) return null;
+	return credential.metadata.serverUrl ?? defaultServerUrls[provider];
+};
+const kindOfProvider = (provider) => isGitProvider(provider) ? gitCredentialKindOf[provider] : "<kind>";
+//#endregion
 //#region src/commands/agents/shared.ts
 const agentOption = { project: { type: "string" } };
 const agentUsage = [["--project <name>", "the project of the agent, when the agent is named alone"]];
@@ -4442,7 +4649,11 @@ const actionsAfterPause = /* @__PURE__ */ new Set([
 	"restart",
 	"resume"
 ]);
+const serverOf = (serverUrl) => typeof serverUrl === "string" ? serverUrl : "its server";
 const agentHints = {
+	"agent.provider_token_required": ({ provider, serverUrl }) => `The project needs a ${providerNameOf(provider)} token for ${serverOf(serverUrl)}: kcloud credentials add --project <name> --kind ${kindOfProvider(provider)}${provider === "github" ? "" : ` --server-url ${serverOf(serverUrl)}`} --secret-file <path> stores one, and gitCredentialIds names it.`,
+	"agent.provider_token_conflict": ({ provider, serverUrl }) => `Two credentials of the agent are for ${providerNameOf(provider)} at ${serverOf(serverUrl)}; gitCredentialIds takes one for each server.`,
+	"credential.kind_mismatch": "claudeCredentialId takes a Claude credential, and gitCredentialIds the github_pat, gitlab_token or bitbucket_token credentials of the project.",
 	"agent.not_found": "kcloud agents list --project <name> shows the agents.",
 	"project.not_found": "kcloud projects list shows the projects you are a member of.",
 	"agent.invalid_transition": ({ state, action }) => state === "pausing" && actionsAfterPause.has(String(action)) ? "The agent finishes its current session before it pauses; the action goes through once kcloud agents show <agent> says paused." : "kcloud agents show <agent> lists the actions it takes now.",
@@ -4450,6 +4661,7 @@ const agentHints = {
 	"concurrency.conflict": "Someone changed the agent meanwhile; read it again and retry.",
 	"agent.node_unsuitable": "The node lacks a capability the agent requires; kcloud nodes show <node> lists what it offers.",
 	"node.offline": "The node of the agent is not connected; kcloud nodes show <node> tells when it was last seen.",
+	"account.queue_empty": "The queue of Claude accounts of the project is empty; kcloud projects accounts add <account> --project <name> puts one in it.",
 	"node.outdated": "The node of the agent runs an older release; kcloud nodes show <node> names the release it runs and its update."
 };
 const agentFrom = async (run, reference, project) => {
@@ -4802,8 +5014,7 @@ const agentPlanOf = (agent) => ({
 	kikimoraVersion: agent.kikimoraVersion,
 	...agent.node === null ? {} : { nodeId: agent.node.id },
 	requiredCapabilities: agent.requiredCapabilities,
-	claudeCredentialId: agent.claudeCredential.id,
-	githubCredentialId: agent.githubCredential.id,
+	gitCredentialIds: agent.gitCredentials.map(({ id }) => id),
 	repositories: agent.repositories.map(({ repositoryId, directory }) => ({
 		repositoryId,
 		directory
@@ -4823,9 +5034,12 @@ const agentPlanOf = (agent) => ({
 });
 const machineLimitKeys = /* @__PURE__ */ new Set(["cpus", "memoryMb"]);
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const warnIgnored = ({ context }, keys) => {
+const warned = ({ context }, text) => {
+	context.terminal.error(context.terminal.errorStyles.warning(`warning ${text}`));
+};
+const warnIgnored = (run, keys) => {
 	const named = keys.map((key) => `machine.${key}`).join(" and ");
-	context.terminal.error(context.terminal.errorStyles.warning(`warning ${named} ${keys.length === 1 ? "is" : "are"} ignored: an agent has no limits of its own, and the pools of its node limit its sessions.`));
+	warned(run, `${named} ${keys.length === 1 ? "is" : "are"} ignored: an agent has no limits of its own, and the pools of its node limit its sessions.`);
 };
 const machineWithoutLimits = (run, machine) => {
 	if (!isRecord(machine)) return machine;
@@ -4834,17 +5048,40 @@ const machineWithoutLimits = (run, machine) => {
 	warnIgnored(run, ignored);
 	return Object.fromEntries(Object.entries(machine).filter(([key]) => !machineLimitKeys.has(key)));
 };
-const agentFileWithoutLimits = (run, document) => isRecord(document) && "machine" in document ? {
-	...document,
-	machine: machineWithoutLimits(run, document.machine)
-} : document;
-const agentChangeWithoutLimits = (run, document) => isRecord(document) && isRecord(document.sections) && "machine" in document.sections ? {
-	...document,
-	sections: {
-		...document.sections,
-		machine: machineWithoutLimits(run, document.sections.machine)
-	}
-} : document;
+const claudeCredentialKey = "claudeCredentialId";
+const withoutClaudeCredential = (run, fields) => {
+	if (!(claudeCredentialKey in fields)) return fields;
+	warned(run, `${claudeCredentialKey} is ignored: an agent works on the queue of Claude accounts of its project, which kcloud projects accounts list shows.`);
+	return Object.fromEntries(Object.entries(fields).filter(([key]) => key !== claudeCredentialKey));
+};
+const acceptedAgentFile = (run, document) => {
+	if (!isRecord(document)) return document;
+	const kept = withoutClaudeCredential(run, document);
+	return "machine" in kept ? {
+		...kept,
+		machine: machineWithoutLimits(run, kept.machine)
+	} : kept;
+};
+const credentialsSectionOf = (run, sections) => {
+	if (!isRecord(sections.credentials)) return sections;
+	const credentials = withoutClaudeCredential(run, sections.credentials);
+	if (Object.keys(credentials).length > 0) return {
+		...sections,
+		credentials
+	};
+	return Object.fromEntries(Object.entries(sections).filter(([key]) => key !== "credentials"));
+};
+const acceptedAgentChange = (run, document) => {
+	if (!isRecord(document) || !isRecord(document.sections)) return document;
+	const sections = credentialsSectionOf(run, document.sections);
+	return {
+		...document,
+		sections: "machine" in sections ? {
+			...sections,
+			machine: machineWithoutLimits(run, sections.machine)
+		} : sections
+	};
+};
 //#endregion
 //#region src/commands/agents/config.ts
 const agentsOf = async (scope, project) => {
@@ -4960,7 +5197,7 @@ const configCommands = (adaptersOf) => [
 			const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
 			const file = invocation.values.file;
 			if (file === void 0) throw new UsageError("agents set needs --file <path>.", "The file holds the sections to change; kcloud agents show <agent> --json shows the current ones.");
-			const agent = await changedAgent(run.api, agentId, agentChangeWithoutLimits(run, await documentOf(run, file)));
+			const agent = await changedAgent(run.api, agentId, acceptedAgentChange(run, await documentOf(run, file)));
 			return printed(run, agent, (changed) => changed.restartRequired ? `Changed ${changed.name}; it needs ${changeTakerOf(changed)} to take the change.` : `Changed ${changed.name}.`);
 		}
 	}),
@@ -5013,13 +5250,13 @@ const waitTexts = {
 };
 const reasonOf$1 = ({ reason }) => reason ?? "slot";
 const isKnownReason = (reason) => Object.hasOwn(waitTexts, reason);
-const waitTextOf = (reason) => isKnownReason(reason) ? waitTexts[reason] : `held by the node (${reason})`;
+const waitTextOf$1 = (reason) => isKnownReason(reason) ? waitTexts[reason] : `held by the node (${reason})`;
 const waitRowsOf = ({ runtime }) => {
 	const { admission } = runtime;
 	if (admission === null) return [];
 	const waits = ["monitor", "executor"].flatMap((role) => {
 		const state = admission[role];
-		return state?.state === "waiting" ? [`${role} ${waitTextOf(reasonOf$1(state))}`] : [];
+		return state?.state === "waiting" ? [`${role} ${waitTextOf$1(reasonOf$1(state))}`] : [];
 	});
 	return waits.length === 0 ? [] : [["admissions", waits.join("; ")]];
 };
@@ -5038,10 +5275,33 @@ const claudeCodeOf = ({ runtime, release }) => {
 	if (running?.source === "host") return "host";
 	return running?.version ?? release?.claudeCodeVersion ?? "unknown";
 };
+const claudeAccountWaitOf = ({ waitReason, waitUntil }) => {
+	switch (waitReason) {
+		case "exhausted": return waitUntil === null ? "every account is exhausted" : `every account is exhausted until ${waitUntil}`;
+		case "blocked": return "no account of the queue can work";
+		case "empty": return "the queue of the project is empty";
+		default: return null;
+	}
+};
+const claudeAccountOf = ({ claudeAccount }) => {
+	const { current, queueSize } = claudeAccount;
+	const account = current === null ? "none" : `${current.label} (${current.kind}), ${current.position === null ? "outside the queue" : `${String(current.position)} of ${String(queueSize)}`}`;
+	const wait = claudeAccountWaitOf(claudeAccount);
+	return wait === null ? account : `${account}; ${wait}`;
+};
 const failureRowsOf = ({ failureReason, retryAt }) => {
 	if (failureReason === null) return [];
 	return [["failure", retryAt === null ? failureReason : `${failureReason}, retry at ${retryAt}`]];
 };
+const gitCredentialLinesOf = ({ gitCredentials }) => gitCredentials.length === 0 ? ["No git credential is set."] : ["GIT CREDENTIALS", renderTable([
+	{ header: "PROVIDER" },
+	{ header: "SERVER" },
+	{ header: "LABEL" }
+], gitCredentials.map(({ provider, serverUrl, label }) => [
+	provider,
+	serverUrl,
+	label
+]))];
 const detailsOf = (agent) => [
 	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
 		["name", agent.name],
@@ -5051,6 +5311,7 @@ const detailsOf = (agent) => [
 		["observed", agent.observedState],
 		["release", agent.kikimoraVersion],
 		["claude code", claudeCodeOf(agent)],
+		["claude account", claudeAccountOf(agent)],
 		["node", agent.node === null ? "none" : `${agent.node.name} (${agent.node.state})`],
 		["requires", agent.requiredCapabilities.length === 0 ? "nothing" : agent.requiredCapabilities.join(", ")],
 		["timezone", agent.timezone],
@@ -5071,13 +5332,19 @@ const detailsOf = (agent) => [
 	"",
 	agent.repositories.length === 0 ? "No repository is cloned into the workspace." : renderTable([
 		{ header: "REPOSITORY" },
+		{ header: "PROVIDER" },
+		{ header: "SERVER" },
 		{ header: "DIRECTORY" },
 		{ header: "STATUS" }
 	], agent.repositories.map((repository) => [
 		`${repository.owner}/${repository.name}`,
+		repository.provider,
+		repository.serverUrl,
 		repository.directory,
 		repository.status
-	]))
+	])),
+	"",
+	...gitCredentialLinesOf(agent)
 ].join("\n");
 //#endregion
 //#region src/commands/agents/placement.ts
@@ -5104,7 +5371,6 @@ const placedNodeId = async (run, { projectId, given, ask }) => {
 };
 //#endregion
 //#region src/commands/agents/create.ts
-const claudeKinds = /* @__PURE__ */ new Set(["anthropic_api_key", "claude_oauth_token"]);
 const catalogueOf = async (api, projectId) => {
 	const path = { params: { path: { id: projectId } } };
 	return {
@@ -5114,17 +5380,35 @@ const catalogueOf = async (api, projectId) => {
 		releases: dataOf("list the releases", await api.GET("/releases")).items.map(({ version }) => version)
 	};
 };
-const chosenCredential = async (prompt, catalogue, kinds, question) => {
-	const choices = catalogue.credentials.filter((credential) => kinds(credential.kind)).map((credential) => ({
-		value: credential.id,
-		label: credential.label,
-		hint: credential.kind
-	}));
-	if (choices.length === 0) throw new CliError(`The project holds no credential for ${question}.`, "kcloud credentials add --project <name> stores one.");
-	return prompt.select({
-		message: question,
-		choices
-	});
+const serversOf = (catalogue, chosen) => {
+	const servers = /* @__PURE__ */ new Map();
+	for (const { repositoryId } of chosen) {
+		const repository = catalogue.repositories.find(({ id }) => id === repositoryId);
+		if (repository === void 0) continue;
+		const { provider, serverUrl } = repository;
+		servers.set(`${provider} ${serverUrl}`, {
+			provider,
+			serverUrl
+		});
+	}
+	return [...servers.values()].sort((first, second) => gitProviders.indexOf(first.provider) - gitProviders.indexOf(second.provider) || first.serverUrl.localeCompare(second.serverUrl));
+};
+const gitCredentialQuestionOf = ({ provider, serverUrl }) => provider === "github" ? "The GitHub credential it clones with" : `The ${providerNameOf(provider)} credential for ${serverUrl} it clones with`;
+const chosenGitCredentials = async (prompt, catalogue, chosen) => {
+	const ids = [];
+	for (const server of serversOf(catalogue, chosen)) {
+		const choices = catalogue.credentials.filter((credential) => gitProviderOf(credential) === server.provider && credentialServerOf(credential) === server.serverUrl).map((credential) => ({
+			value: credential.id,
+			label: credential.label,
+			hint: credential.kind
+		}));
+		if (choices.length === 0) throw new CliError(`The project holds no ${providerNameOf(server.provider)} credential for ${server.serverUrl}.`, `kcloud credentials add --project <name> --kind ${kindOfProvider(server.provider)}${server.provider === "github" ? "" : ` --server-url ${server.serverUrl}`} stores one.`);
+		ids.push(await prompt.select({
+			message: gitCredentialQuestionOf(server),
+			choices
+		}));
+	}
+	return ids;
 };
 const chosenRepositories = async (prompt, catalogue) => {
 	if (catalogue.repositories.length === 0) throw new CliError("The project has no repository to clone.", "kcloud repositories add <owner/name> --project <name> registers one.");
@@ -5137,7 +5421,7 @@ const chosenRepositories = async (prompt, catalogue) => {
 			choices: [...left.map((repository) => ({
 				value: repository.id,
 				label: `${repository.owner}/${repository.name}`,
-				hint: repository.defaultBranch
+				hint: `${repository.provider} ${repository.defaultBranch}`
 			})), ...chosen.length === 0 ? [] : [{
 				value: "",
 				label: "no more repositories",
@@ -5232,15 +5516,16 @@ const askedPlan = async (run, projectId, values, required) => {
 		}))
 	});
 	if (!catalogue.releases.includes(release)) throw new CliError(`${release} is not a release an agent can run.`, catalogue.releases.length === 0 ? "The catalogue holds no release yet; an administrator syncs it under Releases in the panel." : `kcloud releases list shows ${catalogue.releases.join(", ")}.`);
+	const repositories = await chosenRepositories(run.prompt, catalogue);
+	const gitCredentialIds = await chosenGitCredentials(run.prompt, catalogue, repositories);
 	return {
 		name,
 		description: "",
 		kikimoraVersion: release,
 		nodeId,
 		...requirementOf(required),
-		claudeCredentialId: await chosenCredential(run.prompt, catalogue, (kind) => claudeKinds.has(kind), "The Claude credential it works with"),
-		githubCredentialId: await chosenCredential(run.prompt, catalogue, (kind) => kind === "github_pat", "The GitHub credential it clones with"),
-		repositories: [...await chosenRepositories(run.prompt, catalogue)],
+		gitCredentialIds: [...gitCredentialIds],
+		repositories: [...repositories],
 		toolAssignments: [...await chosenTools(run.prompt, catalogue)],
 		prompts: {
 			monitor: await promptText(run, values["monitor-prompt-file"], "What the monitor should watch for"),
@@ -5256,7 +5541,7 @@ const askedPlan = async (run, projectId, values, required) => {
 };
 const isObject = (document) => typeof document === "object" && document !== null && !Array.isArray(document);
 const fileOf = async (run, projectId, { file, node }, required) => {
-	const document = agentFileWithoutLimits(run, await documentOf(run, file));
+	const document = acceptedAgentFile(run, await documentOf(run, file));
 	const placed = !isObject(document) || node === void 0 && "nodeId" in document ? document : {
 		...document,
 		nodeId: await placedNodeId(run, {
@@ -5289,6 +5574,7 @@ const createCommand = (adaptersOf) => defineCommand({
 		["--docker", "give the agent a Docker sidecar, when the project allows it"],
 		["--browser", "give the agent a browser"],
 		["", "kcloud agents show <agent> --as-file prints what --file takes"],
+		["", "the file names the git tokens as gitCredentialIds, one for each server of its repositories"],
 		["", "--node and --require replace the nodeId and requiredCapabilities of the file"]
 	],
 	options: {
@@ -5498,7 +5784,7 @@ const workKinds = /* @__PURE__ */ new Set([
 	"summarising"
 ]);
 const organizationDashboardOf = async (api, organizationId) => dataOf("show the dashboard of the organization", await api.GET("/organizations/{organizationId}/dashboard", { params: { path: { organizationId } } }), organizationHints);
-const statusOf = (agent) => agent.status === "transitioning" ? `${agent.status} (${agent.state})` : agent.status;
+const statusOf$1 = (agent) => agent.status === "transitioning" ? `${agent.status} (${agent.state})` : agent.status;
 const taskOf = (agent) => {
 	const { activity } = agent;
 	if (activity === null) return noTask;
@@ -5511,7 +5797,7 @@ const dashboardText = (dashboard) => {
 	const rows = dashboard.projects.flatMap((project) => project.agents.map((agent) => [
 		project.slug,
 		agent.slug,
-		statusOf(agent),
+		statusOf$1(agent),
 		agent.since,
 		taskOf(agent),
 		agent.costTodayUsd.toFixed(2)
@@ -5544,7 +5830,7 @@ const frameLineOf = (names, frame, at) => {
 			slug: agent.slug
 		});
 		const project = names.projects.get(agent.projectId) ?? agent.projectId;
-		return `${at.toISOString()} ${project}/${agent.slug} ${statusOf(agent)} ${taskOf(agent)}`;
+		return `${at.toISOString()} ${project}/${agent.slug} ${statusOf$1(agent)} ${taskOf(agent)}`;
 	}
 	const removed = dashboardRemovalSchema.safeParse(frame.data);
 	if (frame.event === "dashboard.removed" && removed.success) {
@@ -5711,10 +5997,10 @@ const pageOptions = {
 };
 const allUsage = ["--all", "follow the cursor to the end instead of one page"];
 const pageUsage = [["--limit <n>", `how many rows (default: 50)`], allUsage];
-const dayOf$1 = (date) => date.toISOString().slice(0, 10);
+const dayOf$2 = (date) => date.toISOString().slice(0, 10);
 const costWindowOf = (days, now) => ({
-	from: dayOf$1(/* @__PURE__ */ new Date(now.getTime() - (days - 1) * 24 * 60 * 6e4)),
-	to: dayOf$1(now)
+	from: dayOf$2(/* @__PURE__ */ new Date(now.getTime() - (days - 1) * 24 * 60 * 6e4)),
+	to: dayOf$2(now)
 });
 const windowFrom = (days, now) => {
 	const span = days === void 0 ? 7 : Number(days);
@@ -6438,16 +6724,57 @@ const secretUsage = [
 ];
 //#endregion
 //#region src/commands/credentials.ts
-const projectOption$2 = { project: { type: "string" } };
-const projectUsage$2 = [["--project <name>", "the project the credential belongs to, by slug, name or id"]];
-const usageUnavailable = "Only a Claude Code OAuth token reports the usage of a subscription.";
+const projectOption$3 = { project: { type: "string" } };
+const projectUsage$3 = [["--project <name>", "the project the credential belongs to, by slug, name or id"]];
+const usageUnavailable$1 = "Only a Claude Code OAuth token reports the usage of a subscription; kcloud claude-accounts usage shows it.";
+const defaultKind = "github_pat";
+const countOf = (value) => typeof value === "number" ? value : 0;
+const inUseHint = ({ agents, repositories }) => {
+	return `Point the ${[...countOf(agents) > 0 || countOf(repositories) === 0 ? ["agents"] : [], ...countOf(repositories) > 0 ? ["repositories"] : []].join(" and the ")} at another credential first.`;
+};
 const credentialHints = {
 	"project.not_found": "kcloud projects list shows the projects you are a member of.",
 	"credential.not_found": "kcloud credentials list --project <name> shows them.",
 	"credential.label_taken": "Another credential of the project already has that label.",
-	"credential.in_use": "Point the agents at another credential first.",
-	"credential.usage_unavailable": usageUnavailable
+	"credential.in_use": inUseHint,
+	"credential.usage_unavailable": usageUnavailable$1,
+	"credential.kind_mismatch": "A project holds GitHub, GitLab and Bitbucket tokens alone, and only they carry a commit identity; kcloud claude-accounts add stores a Claude subscription or an Anthropic API key in the organization."
+};
+const addHints = {
+	...credentialHints,
+	"credential.server_refused": "Give the https address of a public host, without credentials, query or fragment, as --server-url.",
+	"validation.failed": "Check the options: --server-url takes an http or https address, and a Bitbucket Cloud API token (ATATT...) needs --account-email."
+};
+const gitOptionsUsage = [
+	["--server-url <url>", "the server of a GitLab or Bitbucket token (default: gitlab.com or bitbucket.org)"],
+	["--account-email <email>", "the Atlassian account of a Bitbucket Cloud API token"],
+	["--commit-name <name>", "the name its commits carry, with --commit-email"],
+	["--commit-email <email>", "the e-mail its commits carry, with --commit-name"]
+];
+const gitOptions = {
+	"server-url": { type: "string" },
+	"account-email": { type: "string" },
+	"commit-name": { type: "string" },
+	"commit-email": { type: "string" }
+};
+const gitFieldsOf = (kind, values) => {
+	const given = Object.entries(values).filter(([name, value]) => name in gitOptions && value !== void 0).map(([name]) => `--${name}`);
+	if (!isGitCredentialKind(kind)) {
+		if (given.length === 0) return {};
+		throw new UsageError(`${given.join(", ")} only suits a ${gitCredentialKinds.join(", ")} credential, not ${kind}.`);
+	}
+	if (kind === "github_pat" && values["server-url"] !== void 0) throw new UsageError("--server-url does not suit a github_pat credential, which always acts on github.com.");
+	if (values["commit-name"] === void 0 !== (values["commit-email"] === void 0)) throw new UsageError("--commit-name and --commit-email go together.", "Pass both, or neither to take the identity the provider reports.");
+	return {
+		...values["server-url"] === void 0 ? {} : { serverUrl: values["server-url"] },
+		...values["account-email"] === void 0 ? {} : { accountEmail: values["account-email"] },
+		...values["commit-name"] === void 0 ? {} : { commitName: values["commit-name"] },
+		...values["commit-email"] === void 0 ? {} : { commitEmail: values["commit-email"] }
+	};
 };
+const missingIdentityNotes = (credentials, project) => credentials.filter(({ kind, verification, metadata }) => (kind === "gitlab_token" || kind === "bitbucket_token") && verification === "valid" && (metadata.commitName === void 0 || metadata.commitEmail === void 0)).map(({ label }) => `${label} has no commit identity yet: kcloud credentials set-identity ${shellWord(label)} --project ${project === void 0 ? "<name>" : shellWord(project)} --commit-name <name> --commit-email <email>`);
+const plainShellWord = /^[A-Za-z0-9_./@:-]+$/;
+const shellWord = (value) => plainShellWord.test(value) ? value : `'${value.replaceAll("'", `'\\''`)}'`;
 const percent = 100;
 const notApplicable = "-";
 const usedOf = (window) => window === null ? notApplicable : `${String(Math.round(window.utilization * percent))}%`;
@@ -6474,12 +6801,13 @@ const usageReportOf = (credential) => {
 		window?.resetsAt ?? notApplicable
 	]))}\n${usage.stale ? `Read at ${usage.readAt}; the latest reading failed.` : `Read at ${usage.readAt}.`}`;
 };
+const accountOf = ({ metadata }) => metadata.accountName ?? metadata.githubLogin ?? notApplicable;
 const isoDateLength = 10;
 const expiryOf = ({ expiresAt, expiresAtComputed }) => {
 	if (expiresAt === null) return "never";
 	return expiresAtComputed ? `about ${expiresAt.slice(0, isoDateLength)}` : expiresAt;
 };
-const projectFrom$2 = async (run, given) => {
+const projectFrom$3 = async (run, given) => {
 	if (given === void 0) throw new UsageError("This command needs a project.", "Pass --project <name>; kcloud projects list shows them.");
 	return resolveProjectId(run, given);
 };
@@ -6495,55 +6823,60 @@ const resolveCredential = async (api, projectId, reference) => {
 const resolveCredentialId = async (api, projectId, reference) => (await resolveCredential(api, projectId, reference)).id;
 const createCredentialsCommand = (adaptersOf) => defineGroup({
 	name: "credentials",
-	summary: "The Claude and GitHub credentials of a project.",
+	summary: "The GitHub, GitLab and Bitbucket tokens of a project.",
 	usage: "credentials <command>",
 	subcommands: [
 		defineCommand({
 			name: "list",
 			summary: "List the credentials of a project.",
 			usage: "credentials list --project <name>",
-			optionsUsage: projectUsage$2,
-			options: projectOption$2,
+			optionsUsage: projectUsage$3,
+			options: projectOption$3,
 			positionals: {
 				min: 0,
 				max: 0
 			},
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom$2(run, invocation.values.project);
+				const projectId = await projectFrom$3(run, invocation.values.project);
 				const items = await credentialsOf(run.api, projectId);
-				return printed(run, items, (credentials) => credentials.length === 0 ? "The project holds no credential yet." : renderTable([
+				return printed(run, items, (credentials) => credentials.length === 0 ? "The project holds no credential yet." : [renderTable([
 					{ header: "LABEL" },
 					{ header: "KIND" },
+					{ header: "SERVER" },
+					{ header: "ACCOUNT" },
 					{ header: "FINGERPRINT" },
 					{ header: "VERIFIED" },
 					{ header: "EXPIRES" },
-					{ header: "USAGE" },
 					{ header: "ID" }
 				], credentials.map((credential) => [
 					credential.label,
 					credential.kind,
+					credentialServerOf(credential) ?? notApplicable,
+					accountOf(credential),
 					credential.fingerprint,
 					credential.verification,
 					expiryOf(credential),
-					usageSummaryOf(credential),
 					credential.id
-				])));
+				])), ...missingIdentityNotes(credentials, invocation.values.project).flatMap((note, index) => index === 0 ? ["", note] : [note])].join("\n"));
 			}
 		}),
 		defineCommand({
 			name: "add",
 			summary: "Store a credential in a project, asking for the secret.",
-			usage: "credentials add --project <name> --kind <kind> --label <label> [--secret-file <path>]",
+			usage: "credentials add --project <name> [--kind <kind>] --label <label> [--server-url <url>] [--secret-file <path>]",
 			optionsUsage: [
-				...projectUsage$2,
-				["--kind <kind>", `one of ${credentialKinds.join(", ")}`],
+				...projectUsage$3,
+				["--kind <kind>", `the kind of the credential (default: ${defaultKind})`],
+				["", "kcloud claude-accounts add stores a Claude account in the organization"],
 				["--label <label>", "how the panel and the agents name it"],
+				...gitOptionsUsage,
 				...secretUsage
 			],
 			options: {
-				...projectOption$2,
+				...projectOption$3,
 				...secretOptions,
+				...gitOptions,
 				kind: { type: "string" },
 				label: { type: "string" }
 			},
@@ -6554,11 +6887,13 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 			run: async (invocation) => {
 				const { values } = invocation;
 				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom$2(run, values.project);
-				const kind = credentialKinds.find((candidate) => candidate === values.kind);
-				if (kind === void 0) throw new UsageError(`--kind ${values.kind ?? ""} is not a kind of credential.`, `The kinds are ${credentialKinds.join(", ")}.`);
+				const projectId = await projectFrom$3(run, values.project);
+				const given = values.kind ?? defaultKind;
+				const kind = credentialKinds.find((candidate) => candidate === given);
+				if (kind === void 0) throw new UsageError(`--kind ${given} is not a kind of credential.`, `The kinds are ${credentialKinds.join(", ")}.`);
 				const label = values.label ?? "";
 				if (label.trim() === "") throw new UsageError("credentials add needs --label <label>.");
+				const gitFields = gitFieldsOf(kind, values);
 				const secret = await secretOf({
 					run,
 					file: values["secret-file"],
@@ -6570,19 +6905,60 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 					body: {
 						kind,
 						label,
-						secret
+						secret,
+						...gitFields
 					}
-				}), credentialHints);
+				}), addHints);
 				return printed(run, credential, (stored) => `Stored ${stored.label} (${stored.fingerprint}) as ${stored.id}.`);
 			}
 		}),
+		defineCommand({
+			name: "set-identity",
+			summary: "Set the name and e-mail the commits of a git token carry.",
+			usage: "credentials set-identity <credential> --project <name> --commit-name <name> --commit-email <email>",
+			optionsUsage: [
+				...projectUsage$3,
+				["--commit-name <name>", "the name its commits carry"],
+				["--commit-email <email>", "the e-mail its commits carry"],
+				["", "the agents that use the token need a restart to sign with it"]
+			],
+			options: {
+				...projectOption$3,
+				"commit-name": { type: "string" },
+				"commit-email": { type: "string" }
+			},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				const commitName = values["commit-name"] ?? "";
+				const commitEmail = values["commit-email"] ?? "";
+				if (commitName.trim() === "" || commitEmail.trim() === "") throw new UsageError("credentials set-identity needs --commit-name <name> and --commit-email <email>.");
+				const run = await runOf(adaptersOf, invocation);
+				const projectId = await projectFrom$3(run, values.project);
+				const credentialId = await resolveCredentialId(run.api, projectId, invocation.positionals[0] ?? "");
+				const credential = dataOf("set the commit identity of the credential", await run.api.PUT("/projects/{id}/credentials/{credentialId}/commit-identity", {
+					params: { path: {
+						id: projectId,
+						credentialId
+					} },
+					body: {
+						commitName,
+						commitEmail
+					}
+				}), credentialHints);
+				return printed(run, credential, (changed) => `${changed.label} signs commits as ${commitName} <${commitEmail}> now.`);
+			}
+		}),
 		defineCommand({
 			name: "rename",
 			summary: "Change the label of a credential.",
 			usage: "credentials rename <credential> --project <name> --label <label>",
-			optionsUsage: [...projectUsage$2, ["--label <label>", "the new label"]],
+			optionsUsage: [...projectUsage$3, ["--label <label>", "the new label"]],
 			options: {
-				...projectOption$2,
+				...projectOption$3,
 				label: { type: "string" }
 			},
 			positionals: {
@@ -6592,7 +6968,7 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 			run: async (invocation) => {
 				const { values } = invocation;
 				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom$2(run, values.project);
+				const projectId = await projectFrom$3(run, values.project);
 				const credentialId = await resolveCredentialId(run.api, projectId, invocation.positionals[0] ?? "");
 				const label = values.label ?? "";
 				if (label.trim() === "") throw new UsageError("credentials rename needs --label <label>.");
@@ -6611,12 +6987,12 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 			summary: "Replace the secret of a credential.",
 			usage: "credentials rotate <credential> --project <name> [--restart-agents] [--secret-file <path>]",
 			optionsUsage: [
-				...projectUsage$2,
+				...projectUsage$3,
 				["--restart-agents", "restart the agents that use it once the secret is in"],
 				...secretUsage
 			],
 			options: {
-				...projectOption$2,
+				...projectOption$3,
 				...secretOptions,
 				"restart-agents": {
 					type: "boolean",
@@ -6630,7 +7006,7 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 			run: async (invocation) => {
 				const { values } = invocation;
 				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom$2(run, values.project);
+				const projectId = await projectFrom$3(run, values.project);
 				const credentialId = await resolveCredentialId(run.api, projectId, invocation.positionals[0] ?? "");
 				const secret = await secretOf({
 					run,
@@ -6655,15 +7031,15 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 			name: "verify",
 			summary: "Ask the instance to verify a credential against its service.",
 			usage: "credentials verify <credential> --project <name>",
-			optionsUsage: projectUsage$2,
-			options: projectOption$2,
+			optionsUsage: projectUsage$3,
+			options: projectOption$3,
 			positionals: {
 				min: 1,
 				max: 1
 			},
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom$2(run, invocation.values.project);
+				const projectId = await projectFrom$3(run, invocation.values.project);
 				const credentialId = await resolveCredentialId(run.api, projectId, invocation.positionals[0] ?? "");
 				doneWith("verify the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/verify", { params: { path: {
 					id: projectId,
@@ -6676,9 +7052,9 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 			name: "usage",
 			summary: "Show the usage of the Claude subscription behind a Claude Code OAuth token.",
 			usage: "credentials usage <credential> --project <name> [--refresh]",
-			optionsUsage: [...projectUsage$2, ["--refresh", "read it from Anthropic now; within 30 seconds the last reading"]],
+			optionsUsage: [...projectUsage$3, ["--refresh", "read it from Anthropic now; within 30 seconds the last reading"]],
 			options: {
-				...projectOption$2,
+				...projectOption$3,
 				refresh: {
 					type: "boolean",
 					default: false
@@ -6690,9 +7066,9 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 			},
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom$2(run, invocation.values.project);
+				const projectId = await projectFrom$3(run, invocation.values.project);
 				const stored = await resolveCredential(run.api, projectId, invocation.positionals[0] ?? "");
-				if (stored.kind !== "claude_oauth_token") throw new CliError(`${stored.label} is a ${stored.kind}, which reports no usage.`, usageUnavailable);
+				if (stored.kind !== "claude_oauth_token") throw new CliError(`${stored.label} is a ${stored.kind}, which reports no usage.`, usageUnavailable$1);
 				const credential = invocation.values.refresh ? dataOf("read the usage of the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/usage", { params: { path: {
 					id: projectId,
 					credentialId: stored.id
@@ -6704,15 +7080,15 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 			name: "delete",
 			summary: "Delete a credential no agent uses.",
 			usage: "credentials delete <credential> --project <name>",
-			optionsUsage: projectUsage$2,
-			options: projectOption$2,
+			optionsUsage: projectUsage$3,
+			options: projectOption$3,
 			positionals: {
 				min: 1,
 				max: 1
 			},
 			run: async (invocation) => {
 				const run = await runOf(adaptersOf, invocation);
-				const projectId = await projectFrom$2(run, invocation.values.project);
+				const projectId = await projectFrom$3(run, invocation.values.project);
 				const reference = invocation.positionals[0] ?? "";
 				const credentialId = await resolveCredentialId(run.api, projectId, reference);
 				await confirmed({
@@ -6730,6 +7106,263 @@ const createCredentialsCommand = (adaptersOf) => defineGroup({
 	]
 });
 //#endregion
+//#region src/commands/claude-accounts.ts
+const accountUsage$1 = [["", "an account is named by its label or its id"]];
+const usageUnavailable = "Only a Claude subscription reports its usage.";
+const queuesText = (projects) => typeof projects === "string" && projects !== "" ? projects : "some projects";
+const claudeAccountHints = {
+	...organizationHints,
+	"auth.forbidden": "Changing a Claude account takes an admin of the organization.",
+	"account.not_found": "kcloud claude-accounts list shows the Claude accounts of the organization.",
+	"account.label_taken": "Another Claude account of the organization already has that label.",
+	"account.in_queue": ({ projects }) => `It stands in the queue of ${queuesText(projects)}; kcloud projects accounts remove <account> --project <project> takes it out.`,
+	"credential.usage_unavailable": usageUnavailable
+};
+const queuesOf = (queues) => queues.length === 0 ? "-" : queues.map(({ projectName, position }) => `${projectName} #${String(position)}`).join(", ");
+const statusOf = ({ verification, creditsExhaustedAt }) => creditsExhaustedAt === null ? verification : "no credits";
+const claudeAccountsOf = async (api, organizationId) => dataOf("list the Claude accounts of the organization", await api.GET("/organizations/{organizationId}/claude-accounts", { params: { path: { organizationId } } }), claudeAccountHints).items;
+const claudeAccountIn = (accounts, reference) => {
+	const found = accounts.filter((account) => account.id === reference.toLowerCase() || account.label === reference);
+	const [first] = found;
+	if (first === void 0) throw new CliError(`The organization has no Claude account ${reference}.`, accounts.length === 0 ? "kcloud claude-accounts add stores one." : `Its Claude accounts are ${accounts.map(({ label }) => label).join(", ")}.`);
+	if (found.length > 1) throw new CliError(`${reference} names ${found.length} Claude accounts.`, "Name it by its id instead.");
+	return first;
+};
+const resolveClaudeAccount = async (scope, reference) => {
+	const { id } = await scope.organization();
+	return {
+		organizationId: id,
+		account: claudeAccountIn(await claudeAccountsOf(scope.api, id), reference)
+	};
+};
+const renamedClaudeAccount = async (api, organizationId, credentialId, label) => dataOf("rename the Claude account", await api.PATCH("/organizations/{organizationId}/claude-accounts/{credentialId}", {
+	params: { path: {
+		organizationId,
+		credentialId
+	} },
+	body: { label }
+}), claudeAccountHints);
+const verifyClaudeAccount = async (api, organizationId, credentialId) => {
+	doneWith("verify the Claude account", await api.POST("/organizations/{organizationId}/claude-accounts/{credentialId}/verify", { params: { path: {
+		organizationId,
+		credentialId
+	} } }), claudeAccountHints);
+};
+const refreshedClaudeAccount = async (api, organizationId, credentialId) => dataOf("read the usage of the Claude account", await api.POST("/organizations/{organizationId}/claude-accounts/{credentialId}/usage", { params: { path: {
+	organizationId,
+	credentialId
+} } }), claudeAccountHints);
+const deleteClaudeAccount = async (api, organizationId, credentialId) => {
+	doneWith("delete the Claude account", await api.DELETE("/organizations/{organizationId}/claude-accounts/{credentialId}", { params: { path: {
+		organizationId,
+		credentialId
+	} } }), claudeAccountHints);
+};
+const createClaudeAccountsCommand = (adaptersOf) => defineGroup({
+	name: "claude-accounts",
+	summary: "The Claude subscriptions and Anthropic API keys of the organization.",
+	usage: "claude-accounts <command>",
+	subcommands: [
+		defineCommand({
+			name: "list",
+			summary: "List the Claude accounts of the organization and the queues they are in.",
+			usage: "claude-accounts list",
+			options: {},
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const items = await claudeAccountsOf(run.api, organization.id);
+				return printed(run, items, (accounts) => accounts.length === 0 ? `${organization.slug} has no Claude account yet; kcloud claude-accounts add stores one.` : renderTable([
+					{ header: "KIND" },
+					{ header: "LABEL" },
+					{ header: "STATUS" },
+					{ header: "USAGE" },
+					{ header: "QUEUES" },
+					{ header: "ID" }
+				], accounts.map((account) => [
+					account.kind,
+					account.label,
+					statusOf(account),
+					usageSummaryOf(account),
+					queuesOf(account.queues),
+					account.id
+				])));
+			}
+		}),
+		defineCommand({
+			name: "add",
+			summary: "Store a Claude subscription or an Anthropic API key, asking for it.",
+			usage: "claude-accounts add --kind <kind> --label <label> [--secret-file <path>]",
+			optionsUsage: [
+				["--kind <kind>", "claude_oauth_token for a subscription, anthropic_api_key for an API key"],
+				["--label <label>", "how the panel and the queues name it"],
+				...secretUsage,
+				["", "kcloud projects accounts add puts it in the queue of a project"]
+			],
+			options: {
+				...secretOptions,
+				kind: { type: "string" },
+				label: { type: "string" }
+			},
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				const kind = claudeCredentialKinds.find((candidate) => candidate === values.kind);
+				if (kind === void 0) throw new UsageError(`--kind ${values.kind ?? ""} is not a kind of Claude account.`, `The kinds are ${claudeCredentialKinds.join(", ")}.`);
+				const label = values.label ?? "";
+				if (label.trim() === "") throw new UsageError("claude-accounts add needs --label <label>.");
+				const run = await runOf(adaptersOf, invocation);
+				const organization = await run.organization();
+				const secret = await secretOf({
+					run,
+					file: values["secret-file"],
+					fromStdin: values["secret-stdin"],
+					question: `The secret of ${label}`
+				});
+				const account = dataOf("store the Claude account", await run.api.POST("/organizations/{organizationId}/claude-accounts", {
+					params: { path: { organizationId: organization.id } },
+					body: {
+						kind,
+						label,
+						secret
+					}
+				}), claudeAccountHints);
+				return printed(run, account, (stored) => `Stored ${stored.label} (${stored.fingerprint}) as ${stored.id}; the instance is verifying it.`);
+			}
+		}),
+		defineCommand({
+			name: "rename",
+			summary: "Change the label of a Claude account.",
+			usage: "claude-accounts rename <account> --label <label>",
+			optionsUsage: [...accountUsage$1, ["--label <label>", "the new label"]],
+			options: { label: { type: "string" } },
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const label = invocation.values.label ?? "";
+				if (label.trim() === "") throw new UsageError("claude-accounts rename needs --label <label>.");
+				const run = await runOf(adaptersOf, invocation);
+				const { organizationId, account } = await resolveClaudeAccount(run, invocation.positionals[0] ?? "");
+				const renamed = await renamedClaudeAccount(run.api, organizationId, account.id, label);
+				return printed(run, renamed, (shown) => `The Claude account is ${shown.label} now.`);
+			}
+		}),
+		defineCommand({
+			name: "rotate",
+			summary: "Replace the secret of a Claude account.",
+			usage: "claude-accounts rotate <account> [--restart-agents] [--secret-file <path>]",
+			optionsUsage: [
+				...accountUsage$1,
+				["--restart-agents", "restart the agents that work on it once the secret is in"],
+				...secretUsage
+			],
+			options: {
+				...secretOptions,
+				"restart-agents": {
+					type: "boolean",
+					default: false
+				}
+			},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const { values } = invocation;
+				const run = await runOf(adaptersOf, invocation);
+				const { organizationId, account } = await resolveClaudeAccount(run, invocation.positionals[0] ?? "");
+				const secret = await secretOf({
+					run,
+					file: values["secret-file"],
+					fromStdin: values["secret-stdin"],
+					question: `The new secret of ${account.label}`
+				});
+				const rotated = dataOf("rotate the Claude account", await run.api.POST("/organizations/{organizationId}/claude-accounts/{credentialId}/rotate", {
+					params: { path: {
+						organizationId,
+						credentialId: account.id
+					} },
+					body: {
+						secret,
+						restartAgents: values["restart-agents"]
+					}
+				}), claudeAccountHints);
+				return printed(run, rotated, (shown) => `Rotated ${shown.label} to ${shown.fingerprint}${values["restart-agents"] ? "; its agents restart" : ""}.`);
+			}
+		}),
+		defineCommand({
+			name: "verify",
+			summary: "Ask the instance to verify a Claude account against Anthropic.",
+			usage: "claude-accounts verify <account>",
+			optionsUsage: accountUsage$1,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const { organizationId, account } = await resolveClaudeAccount(run, invocation.positionals[0] ?? "");
+				await verifyClaudeAccount(run.api, organizationId, account.id);
+				return said(run, `The instance is verifying ${account.label}; kcloud claude-accounts list shows the answer.`);
+			}
+		}),
+		defineCommand({
+			name: "usage",
+			summary: "Show the usage of a Claude subscription.",
+			usage: "claude-accounts usage <account> [--refresh]",
+			optionsUsage: [...accountUsage$1, ["--refresh", "read it from Anthropic now; within 30 seconds the last reading"]],
+			options: { refresh: {
+				type: "boolean",
+				default: false
+			} },
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const { organizationId, account } = await resolveClaudeAccount(run, invocation.positionals[0] ?? "");
+				if (account.kind !== "claude_oauth_token") throw new CliError(`${account.label} is an ${account.kind}, which reports no usage.`, usageUnavailable);
+				const read = invocation.values.refresh ? await refreshedClaudeAccount(run.api, organizationId, account.id) : account;
+				return printed(run, read, usageReportOf);
+			}
+		}),
+		defineCommand({
+			name: "delete",
+			summary: "Delete a Claude account that stands in no queue.",
+			usage: "claude-accounts delete <account>",
+			optionsUsage: accountUsage$1,
+			options: {},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const reference = invocation.positionals[0] ?? "";
+				const { organizationId, account } = await resolveClaudeAccount(run, reference);
+				await confirmed({
+					prompt: run.prompt,
+					settings: run.settings,
+					question: `Delete the Claude account ${account.label}? The platform erases its secret.`
+				});
+				await deleteClaudeAccount(run.api, organizationId, account.id);
+				return said(run, `Deleted the Claude account ${account.label}.`);
+			}
+		})
+	]
+});
+//#endregion
 //#region src/mcp/tool.ts
 const defineTool = (definition) => ({
 	...definition,
@@ -6990,7 +7623,7 @@ const agentTools = [
 	defineTool({
 		name: "agent_create",
 		title: "Create an agent",
-		description: "Create an agent in a project. The node it runs on, the credentials, repositories and tools are named by the ids that nodes_list, credentials_list, repositories_list and tools_list return; agent_show with asPlan shows a complete example. requiredCapabilities names what the node has to offer, from the offered list of nodes_list; the instance refuses a node that lacks one. The agent stays stopped until agent_action starts it.",
+		description: "Create an agent in a project. The node it runs on, the git provider credentials, repositories and tools are named by the ids that nodes_list, credentials_list, repositories_list and tools_list return; gitCredentialIds takes one git provider credential for each server of its repositories; agent_show with asPlan shows a complete example. The agent works on the queue of Claude accounts of its project, which project_accounts_list shows. requiredCapabilities names what the node has to offer, from the offered list of nodes_list; the instance refuses a node that lacks one. The agent stays stopped until agent_action starts it.",
 		operations: ["createAgent"],
 		safety: "write",
 		input: z.object({
@@ -7005,7 +7638,7 @@ const agentTools = [
 	defineTool({
 		name: "agent_update",
 		title: "Change an agent",
-		description: "Change sections of an agent. Without version the change applies to the version read just before it. When restartRequired comes back true, agent_action start or update applies the change, whichever availableActions offers.",
+		description: "Change sections of an agent; the credentials section names its git provider credentials as gitCredentialIds, and takes the repositories section in the same change. Without version the change applies to the version read just before it. When restartRequired comes back true, agent_action start or update applies the change, whichever availableActions offers.",
 		operations: ["updateAgent"],
 		safety: "write",
 		input: z.object({
@@ -7695,13 +8328,311 @@ const agentBackupTools = [
 	})
 ];
 //#endregion
+//#region src/commands/projects/accounts.ts
+const projectAccountsHints = {
+	...projectHint,
+	"auth.forbidden": "Changing the queue of a project takes an admin of the project.",
+	"account.not_found": "kcloud claude-accounts list shows the Claude accounts of the organization.",
+	"account.kind_mismatch": "A queue holds Claude subscriptions and Anthropic API keys alone.",
+	"concurrency.conflict": "Someone changed the queue meanwhile; kcloud projects accounts list shows it now."
+};
+const projectOption$2 = { project: { type: "string" } };
+const projectUsage$2 = [["--project <name>", "the project whose queue it is, by slug, name or id"], ["", "an account is named by its label or its id"]];
+const pad = (value) => String(value).padStart(2, "0");
+const dayOf$1 = (moment) => `${String(moment.getFullYear())}-${pad(moment.getMonth() + 1)}-${pad(moment.getDate())}`;
+const clockOf = (at, now) => {
+	const moment = new Date(at);
+	const time = `${pad(moment.getHours())}:${pad(moment.getMinutes())}`;
+	return dayOf$1(moment) === dayOf$1(now) ? time : `${dayOf$1(moment)} ${time}`;
+};
+const stateOf$1 = ({ state, until }, now) => {
+	switch (state) {
+		case "inUse": return "in use";
+		case "exhausted": return until === null ? "exhausted" : `exhausted until ${clockOf(until, now)}`;
+		case "noCredits": return "no credits";
+		default: return state;
+	}
+};
+const waitTextOf = ({ waitReason, nearestResetAt }, now) => {
+	switch (waitReason) {
+		case "exhausted": return nearestResetAt === null ? "Every account of the queue is exhausted; the agents wait for a reset." : `Every account of the queue is exhausted; the agents wait until ${clockOf(nearestResetAt, now)}.`;
+		case "blocked": return "No account of the queue can work: top up the credits of a key, or fix or replace an invalid account.";
+		case "empty": return "The queue is empty, so the agents of the project cannot start; kcloud projects accounts add <account> --project <name> adds one.";
+		default: return null;
+	}
+};
+const queueText = (queue, now) => {
+	const wait = waitTextOf(queue, now);
+	if (queue.entries.length === 0) return wait ?? "The queue is empty.";
+	const table = renderTable([
+		{
+			header: "#",
+			align: "right"
+		},
+		{ header: "LABEL" },
+		{ header: "KIND" },
+		{ header: "STATE" },
+		{ header: "USAGE" },
+		{
+			header: "AGENTS",
+			align: "right"
+		},
+		{ header: "ID" }
+	], queue.entries.map((entry) => [
+		String(entry.position),
+		entry.credential.label,
+		entry.credential.kind,
+		stateOf$1(entry, now),
+		usageSummaryOf(entry.credential),
+		String(entry.agents),
+		entry.credential.id
+	]));
+	return wait === null ? table : `${table}\n\n${wait}`;
+};
+const projectClaudeAccountsOf = async (api, projectId) => dataOf("list the queue of Claude accounts of the project", await api.GET("/projects/{id}/claude-accounts", { params: { path: { id: projectId } } }), projectAccountsHints);
+const queueSet = async (api, projectId, credentialIds, version) => dataOf("set the queue of Claude accounts of the project", await api.PUT("/projects/{id}/claude-accounts", {
+	params: { path: { id: projectId } },
+	body: {
+		credentialIds: [...credentialIds],
+		version
+	}
+}), projectAccountsHints);
+const organizationAccountIds = async (api, projectId, references) => {
+	if (references.length === 0) return [];
+	const { organizationId } = await projectOf(api, projectId);
+	const accounts = await claudeAccountsOf(api, organizationId);
+	const ids = references.map((reference) => claudeAccountIn(accounts, reference).id);
+	const twice = references.filter((_, index) => ids.indexOf(ids[index] ?? "") !== index);
+	if (twice.length > 0) throw new UsageError(`${twice.join(", ")} ${twice.length === 1 ? "names an account" : "name accounts"} named before.`, "A queue holds each account once.");
+	return ids;
+};
+const queuedIndexOf = (queue, reference) => {
+	const found = queue.entries.findIndex(({ credential }) => credential.id === reference.toLowerCase() || credential.label === reference);
+	if (found === -1) throw new CliError(`${reference} stands in no place of the queue.`, queue.entries.length === 0 ? "The queue is empty." : `The queue holds ${queue.entries.map(({ credential }) => credential.label).join(", ")}.`);
+	return found;
+};
+const idsOf = (queue) => queue.entries.map(({ credential }) => credential.id);
+const queueWith = async (api, projectId, reference) => {
+	const queue = await projectClaudeAccountsOf(api, projectId);
+	const [id = ""] = await organizationAccountIds(api, projectId, [reference]);
+	const place = queue.entries.find(({ credential }) => credential.id === id);
+	if (place !== void 0) throw new CliError(`${place.credential.label} already stands at place ${String(place.position)} of the queue.`, "kcloud projects accounts move <account> --to <n> --project <name> moves it.");
+	return queueSet(api, projectId, [...idsOf(queue), id], queue.version);
+};
+const queueWithout = async (api, projectId, reference) => {
+	const queue = await projectClaudeAccountsOf(api, projectId);
+	const index = queuedIndexOf(queue, reference);
+	const ids = idsOf(queue);
+	ids.splice(index, 1);
+	return queueSet(api, projectId, ids, queue.version);
+};
+const queueMoved = async (api, projectId, reference, place) => {
+	const queue = await projectClaudeAccountsOf(api, projectId);
+	if (place > queue.entries.length) throw new UsageError(`--to ${String(place)} lies beyond the queue, which holds ${String(queue.entries.length)} account${queue.entries.length === 1 ? "" : "s"}.`);
+	const ids = idsOf(queue);
+	const [moved = ""] = ids.splice(queuedIndexOf(queue, reference), 1);
+	ids.splice(place - 1, 0, moved);
+	return queueSet(api, projectId, ids, queue.version);
+};
+const placeOf = (given) => {
+	if (given === void 0) throw new UsageError("projects accounts move needs --to <n>.");
+	if (!/^[0-9]+$/u.test(given) || Number(given) < 1) throw new UsageError(`--to ${given} is not a place in the queue, counted from 1.`);
+	return Number(given);
+};
+const projectFrom$2 = async (scope, given) => {
+	if (given === void 0) throw new UsageError("This command needs a project.", "Pass --project <name>; kcloud projects list shows them.");
+	return resolveProjectId(scope, given);
+};
+const printedQueue = (run, queue) => printed(run, queue, (shown) => queueText(shown, run.adapters.now()));
+const projectAccountsCommand = (adaptersOf) => defineGroup({
+	name: "accounts",
+	summary: "The queue of Claude accounts the agents of a project work on.",
+	usage: "projects accounts <command>",
+	subcommands: [
+		defineCommand({
+			name: "list",
+			summary: "List the queue of Claude accounts of a project with their state.",
+			usage: "projects accounts list --project <name>",
+			optionsUsage: projectUsage$2,
+			options: projectOption$2,
+			positionals: {
+				min: 0,
+				max: 0
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const projectId = await projectFrom$2(run, invocation.values.project);
+				return printedQueue(run, await projectClaudeAccountsOf(run.api, projectId));
+			}
+		}),
+		defineCommand({
+			name: "set",
+			summary: "Set the whole queue of Claude accounts of a project, in order.",
+			usage: "projects accounts set [<account>...] --project <name>",
+			optionsUsage: [...projectUsage$2, ["", "the first account named comes first; none empties the queue"]],
+			options: projectOption$2,
+			positionals: {
+				min: 0,
+				max: 50
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const projectId = await projectFrom$2(run, invocation.values.project);
+				const ids = await organizationAccountIds(run.api, projectId, invocation.positionals);
+				const { version } = await projectClaudeAccountsOf(run.api, projectId);
+				return printedQueue(run, await queueSet(run.api, projectId, ids, version));
+			}
+		}),
+		defineCommand({
+			name: "add",
+			summary: "Put a Claude account of the organization at the end of the queue.",
+			usage: "projects accounts add <account> --project <name>",
+			optionsUsage: projectUsage$2,
+			options: projectOption$2,
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const projectId = await projectFrom$2(run, invocation.values.project);
+				return printedQueue(run, await queueWith(run.api, projectId, invocation.positionals[0] ?? ""));
+			}
+		}),
+		defineCommand({
+			name: "remove",
+			summary: "Take a Claude account out of the queue; it stays in the organization.",
+			usage: "projects accounts remove <account> --project <name>",
+			optionsUsage: projectUsage$2,
+			options: projectOption$2,
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const run = await runOf(adaptersOf, invocation);
+				const projectId = await projectFrom$2(run, invocation.values.project);
+				return printedQueue(run, await queueWithout(run.api, projectId, invocation.positionals[0] ?? ""));
+			}
+		}),
+		defineCommand({
+			name: "move",
+			summary: "Move a Claude account to another place of the queue.",
+			usage: "projects accounts move <account> --to <n> --project <name>",
+			optionsUsage: [...projectUsage$2, ["--to <n>", "the new place, counted from 1"]],
+			options: {
+				...projectOption$2,
+				to: { type: "string" }
+			},
+			positionals: {
+				min: 1,
+				max: 1
+			},
+			run: async (invocation) => {
+				const place = placeOf(invocation.values.to);
+				const run = await runOf(adaptersOf, invocation);
+				const projectId = await projectFrom$2(run, invocation.values.project);
+				return printedQueue(run, await queueMoved(run.api, projectId, invocation.positionals[0] ?? "", place));
+			}
+		})
+	]
+});
+//#endregion
+//#region src/mcp/tools/claude-accounts.ts
+const accountField$1 = z.string().trim().min(1).describe("The Claude account, by its label or its id, from claude_accounts_list.");
+const claudeAccountTools = [
+	defineTool({
+		name: "claude_accounts_list",
+		title: "List the Claude accounts of the organization",
+		description: "List the Claude subscriptions and Anthropic API keys of the organization this server acts in, with their fingerprint, verification, usage and the queues of the projects they stand in, never their secrets.",
+		operations: ["listClaudeAccounts"],
+		safety: "read",
+		input: z.object({}),
+		run: async (_, run) => claudeAccountsOf(run.api, (await run.organization()).id)
+	}),
+	defineTool({
+		name: "claude_account_update",
+		title: "Rename, verify or read the usage of a Claude account",
+		description: "rename gives a Claude account a new label; verify asks the instance to check it against Anthropic, and claude_accounts_list shows the answer; refresh_usage reads the usage of a Claude subscription now, or answers the last reading within 30 seconds of the previous one. Each action takes an admin of the organization.",
+		operations: [
+			"renameClaudeAccount",
+			"verifyClaudeAccount",
+			"refreshClaudeAccountUsage"
+		],
+		safety: "write",
+		input: z.object({
+			account: accountField$1,
+			action: z.enum([
+				"rename",
+				"verify",
+				"refresh_usage"
+			]),
+			label: z.string().trim().min(1).optional().describe("The new label, for rename.")
+		}),
+		run: async ({ account, action, label }, run) => {
+			if (action === "rename" && label === void 0) throw new UsageError("rename needs a label.");
+			const { organizationId, account: found } = await resolveClaudeAccount(run, account);
+			if (action === "refresh_usage") return refreshedClaudeAccount(run.api, organizationId, found.id);
+			if (action === "verify") {
+				await verifyClaudeAccount(run.api, organizationId, found.id);
+				return {
+					id: found.id,
+					verifying: true
+				};
+			}
+			return renamedClaudeAccount(run.api, organizationId, found.id, label ?? "");
+		}
+	}),
+	defineTool({
+		name: "claude_account_delete",
+		title: "Delete a Claude account",
+		description: "Delete a Claude account of the organization and erase its secret. The instance refuses while it stands in the queue of a project, and names those projects. Takes an admin of the organization.",
+		operations: ["deleteClaudeAccount"],
+		safety: "destructive",
+		input: z.object({ account: accountField$1 }),
+		run: async ({ account }, run) => {
+			const { organizationId, account: found } = await resolveClaudeAccount(run, account);
+			await deleteClaudeAccount(run.api, organizationId, found.id);
+			return { deleted: found.id };
+		}
+	}),
+	defineTool({
+		name: "project_accounts_list",
+		title: "List the queue of Claude accounts of a project",
+		description: "List the queue of Claude accounts the agents of a project work on, in order, each with its state: inUse, available, exhausted until a moment, noCredits or invalid. activeCredentialId names the account in use, and waitReason says why the agents wait: exhausted, blocked or empty.",
+		operations: ["listProjectClaudeAccounts"],
+		safety: "read",
+		input: z.object({ project: projectField }),
+		run: async ({ project }, run) => projectClaudeAccountsOf(run.api, await projectIdOf(run, project))
+	}),
+	defineTool({
+		name: "project_accounts_set",
+		title: "Set the queue of Claude accounts of a project",
+		description: "Set the whole queue of Claude accounts of a project, in order: the first account comes first, an account left out leaves the queue and stays in the organization, and an empty list empties the queue. Without version the change applies to the queue read just before it. Takes an admin of the project.",
+		operations: ["listProjectClaudeAccounts", "setProjectClaudeAccounts"],
+		safety: "write",
+		idempotent: true,
+		input: z.object({
+			project: projectField,
+			accounts: z.array(accountField$1).max(50).describe("The Claude accounts of the queue, by label or id, first one first."),
+			version: z.int().nonnegative().optional().describe("The version of the queue the change is based on, to refuse a change made meanwhile.")
+		}),
+		run: async ({ project, accounts, version }, run) => {
+			const projectId = await projectIdOf(run, project);
+			const ids = await organizationAccountIds(run.api, projectId, accounts);
+			const based = version ?? (await projectClaudeAccountsOf(run.api, projectId)).version;
+			return queueSet(run.api, projectId, ids, based);
+		}
+	})
+];
+//#endregion
 //#region src/mcp/tools/credentials.ts
 const credentialField$1 = z.string().trim().min(1).describe("The credential, by its label or its id.");
 const credentialTools = [
 	defineTool({
 		name: "credentials_list",
 		title: "List credentials",
-		description: "List the Claude and GitHub credentials of a project, with their fingerprints and verification, never their secrets.",
+		description: "List the git provider credentials of a project (GitHub, GitLab and Bitbucket), with their server, account, commit identity, fingerprints and verification, never their secrets. The Claude accounts belong to the organization: claude_accounts_list.",
 		operations: ["listCredentials"],
 		safety: "read",
 		input: z.object({ project: projectField }),
@@ -7709,11 +8640,12 @@ const credentialTools = [
 	}),
 	defineTool({
 		name: "credential_update",
-		title: "Rename, verify or read the usage of a credential",
-		description: "rename gives a credential a new label; verify asks the instance to check it against its service, and credentials_list shows the answer; refresh_usage reads the usage of the Claude subscription behind a Claude Code OAuth token now, or answers the last reading within 30 seconds of the previous one.",
+		title: "Rename, verify, sign commits as or read the usage of a credential",
+		description: "rename gives a credential a new label; verify asks the instance to check it against its service, and credentials_list shows the answer; set_identity sets the commitName and commitEmail the commits of a git provider token carry, which the agents that use it pick up after a restart; refresh_usage reads the usage of the Claude subscription behind a Claude Code OAuth token now, or answers the last reading within 30 seconds of the previous one.",
 		operations: [
 			"renameCredential",
 			"verifyCredential",
+			"setCredentialCommitIdentity",
 			"refreshCredentialUsage"
 		],
 		safety: "write",
@@ -7723,11 +8655,14 @@ const credentialTools = [
 			action: z.enum([
 				"rename",
 				"verify",
+				"set_identity",
 				"refresh_usage"
 			]),
-			label: z.string().trim().min(1).optional().describe("The new label, for rename.")
+			label: z.string().trim().min(1).optional().describe("The new label, for rename."),
+			commitName: commitNameSchema.optional().describe("The name its commits carry, for set_identity."),
+			commitEmail: commitEmailSchema.optional().describe("The e-mail its commits carry, for set_identity.")
 		}),
-		run: async ({ project, credential, action, label }, run) => {
+		run: async ({ project, credential, action, label, commitName, commitEmail }, run) => {
 			const projectId = await projectIdOf(run, project);
 			const credentialId = await resolveCredentialId(run.api, projectId, credential);
 			if (action === "refresh_usage") return dataOf("read the usage of the credential", await run.api.POST("/projects/{id}/credentials/{credentialId}/usage", { params: { path: {
@@ -7744,6 +8679,19 @@ const credentialTools = [
 					verifying: true
 				};
 			}
+			if (action === "set_identity") {
+				if (commitName === void 0 || commitEmail === void 0) throw new UsageError("set_identity needs a commitName and a commitEmail.");
+				return dataOf("set the commit identity of the credential", await run.api.PUT("/projects/{id}/credentials/{credentialId}/commit-identity", {
+					params: { path: {
+						id: projectId,
+						credentialId
+					} },
+					body: {
+						commitName,
+						commitEmail
+					}
+				}), credentialHints);
+			}
 			if (label === void 0) throw new UsageError("rename needs a label.");
 			return dataOf("rename the credential", await run.api.PATCH("/projects/{id}/credentials/{credentialId}", {
 				params: { path: {
@@ -8528,6 +9476,12 @@ const costsText = (costs, { from, to }, slugs) => [
 	"",
 	`${costs.totalCostUsd.toFixed(2)} over ${costs.totalRuns} runs and ${costs.sessions} sessions.`
 ].join("\n");
+const switchThresholdOf = (given) => {
+	if (given === void 0) return void 0;
+	const threshold = Number(given);
+	if (!/^[0-9]+$/u.test(given) || threshold < 1 || threshold > 100) throw new UsageError(`--switch-threshold ${given} is not a whole percent from 1 to 100.`);
+	return threshold;
+};
 const organizationChangeHints = {
 	...organizationHints,
 	"organization.slug_taken": "Another organization already uses that slug.",
@@ -8548,12 +9502,14 @@ const updatedOrganization = async (api, current, fields) => {
 	if ([
 		fields.name,
 		fields.slug,
-		fields.color
+		fields.color,
+		fields.switchThreshold
 	].every((field) => field === void 0)) return current;
 	const body = {
 		name: fields.name ?? current.name,
 		slug: fields.slug ?? current.slug,
-		color: fields.color ?? current.color
+		color: fields.color ?? current.color,
+		...fields.switchThreshold === void 0 ? {} : { claudeSwitchThreshold: fields.switchThreshold }
 	};
 	validated(updateOrganizationBodySchema, body, "a change to an organization");
 	return dataOf("change the organization", await api.PATCH("/organizations/{organizationId}", {
@@ -8656,6 +9612,7 @@ const createOrgsCommand = (adaptersOf) => defineGroup({
 					["slug", shown.slug],
 					["color", shown.color],
 					["logo", shown.logoHash ?? "-"],
+					["switch threshold", `${String(shown.claudeSwitchThreshold)}%`],
 					["created", shown.createdAt],
 					["id", shown.id]
 				]));
@@ -8663,18 +9620,20 @@ const createOrgsCommand = (adaptersOf) => defineGroup({
 		}),
 		defineCommand({
 			name: "set",
-			summary: "Change the name, slug, color or logo of an organization.",
-			usage: "orgs set [<organization>] [--name <name>] [--slug <slug>] [--color <#rrggbb>] [--logo <path> | --no-logo]",
+			summary: "Change the name, slug, color, logo or Claude switch threshold of an organization.",
+			usage: "orgs set [<organization>] [--name <name>] [--slug <slug>] [--color <#rrggbb>] [--logo <path> | --no-logo] [--switch-threshold <percent>]",
 			optionsUsage: [
 				["--name <name>", "the new name"],
 				["--slug <slug>", "the new slug; scripts and --org that name the old one stop finding it"],
 				["--color <#rrggbb>", "the color of the organization in the panel"],
-				...logoUsage
+				...logoUsage,
+				["--switch-threshold <percent>", `the usage at which a project moves to its next Claude account, 1 to 100`]
 			],
 			options: {
 				name: { type: "string" },
 				slug: { type: "string" },
 				color: { type: "string" },
+				"switch-threshold": { type: "string" },
 				...logoOptions
 			},
 			positionals: {
@@ -8683,15 +9642,20 @@ const createOrgsCommand = (adaptersOf) => defineGroup({
 			},
 			run: async (invocation) => {
 				const { values } = invocation;
+				const switchThreshold = switchThresholdOf(values["switch-threshold"]);
 				if ([
 					values.name,
 					values.slug,
-					values.color
-				].every((value) => value === void 0) && !isLogoChange(values)) throw new UsageError("orgs set needs --name, --slug, --color, --logo or --no-logo.");
+					values.color,
+					switchThreshold
+				].every((value) => value === void 0) && !isLogoChange(values)) throw new UsageError("orgs set needs --name, --slug, --color, --logo, --no-logo or --switch-threshold.");
 				const logo = await logoActionOf(invocation.context.workingDirectory, values);
 				const run = await runOf(adaptersOf, invocation);
 				const current = await organizationOrInUse(run, invocation.positionals[0]);
-				const updated = await updatedOrganization(run.api, current, values);
+				const updated = await updatedOrganization(run.api, current, {
+					...values,
+					switchThreshold
+				});
 				if (updated.slug !== current.slug) {
 					await followSlug(run.context.homeDirectory, run.origin, current, updated);
 					run.context.terminal.error(run.context.terminal.errorStyles.warning(`warning Scripts that pass --org ${current.slug} or set ${organizationVariable}=${current.slug} need ${updated.slug} now.`));
@@ -8767,14 +9731,15 @@ const organizationTools = [
 	defineTool({
 		name: "organization_update",
 		title: "Change an organization",
-		description: "Change the name or color of an organization, by default the one this server acts in. A field left out keeps its value. A new slug is set with kcloud orgs set or in the panel.",
+		description: "Change the name, the color or the Claude switch threshold of an organization, by default the one this server acts in. A field left out keeps its value. A new slug is set with kcloud orgs set or in the panel.",
 		operations: ["listOrganizations", "updateOrganization"],
 		safety: "write",
 		idempotent: true,
 		input: z.object({
 			organization: z.string().trim().min(1).optional().describe("The organization, by its slug, its name or its id."),
 			name: organizationNameSchema.optional(),
-			color: colorSchema.optional().describe("The color in the panel, as #rrggbb.")
+			color: colorSchema.optional().describe("The color in the panel, as #rrggbb."),
+			switchThreshold: switchThresholdSchema.optional().describe("The used share of a subscription, in percent, at which a project moves to its next Claude account; 100 moves only at the limit.")
 		}),
 		run: async ({ organization, ...change }, run) => updatedOrganization(run.api, await organizationOrInUse(run, organization), change)
 	}),
@@ -9484,7 +10449,8 @@ const createProjectsCommand = (adaptersOf) => defineGroup({
 				return said(run, `Deleted the project ${project.name}.`);
 			}
 		}),
-		projectMembersCommand(adaptersOf)
+		projectMembersCommand(adaptersOf),
+		projectAccountsCommand(adaptersOf)
 	]
 });
 //#endregion
@@ -9683,14 +10649,17 @@ const releaseTools = [defineTool({
 //#region src/commands/repositories.ts
 const projectOption = { project: { type: "string" } };
 const projectUsage = [["--project <name>", "the project the repository belongs to, by slug, name or id"]];
+const providerOf = (details) => providerNameOf(details.provider);
 const repositoryHints = {
 	"project.not_found": "kcloud projects list shows the projects you are a member of.",
 	"repository.not_found": "kcloud repositories list --project <name> shows them.",
 	"repository.already_registered": "The project already has that repository.",
 	"repository.in_use": "Take it off its agents first.",
-	"repository.unreachable": "The credential cannot see it on GitHub.",
-	"credential.kind_mismatch": "A repository needs a github_pat credential.",
-	"credential.rejected": "GitHub refused that credential; kcloud credentials rotate <credential> --project <name> replaces it.",
+	"repository.unreachable": (details) => `The credential cannot see it on ${providerOf(details)}; kcloud repositories available lists what it sees.`,
+	"repository.catalog_unavailable": ({ provider, serverUrl }) => `${providerNameOf(provider)} at ${String(serverUrl)} did not return the repositories of the credential. kcloud repositories add <owner>/<name> --credential <credential> registers one by its path.`,
+	"credential.kind_mismatch": "A repository needs the credential of a git provider: a github_pat, gitlab_token or bitbucket_token.",
+	"credential.rejected": (details) => `${providerOf(details)} refused that credential; kcloud credentials rotate <credential> --project <name> replaces it.`,
+	"credential.server_mismatch": ({ provider, serverUrl }) => `The repository is on ${providerNameOf(provider)} at ${String(serverUrl)}; the credential belongs to another provider or server. The SERVER column of kcloud credentials list shows where each one acts.`,
 	"credential.not_found": "kcloud credentials list --project <name> shows them."
 };
 const projectFrom = async (run, given) => {
@@ -9707,13 +10676,15 @@ const resolveRepositoryId = async (api, projectId, reference) => {
 	return first.id;
 };
 const ownerAndName = (reference) => {
-	const [owner, name, ...rest] = reference.split("/");
-	if (owner === void 0 || name === void 0 || rest.length > 0 || name === "") throw new UsageError(`${reference} is not a GitHub repository.`, "Name it as owner/name.");
+	const separator = reference.lastIndexOf("/");
+	const owner = reference.slice(0, separator);
+	const name = reference.slice(separator + 1);
+	if (separator < 1 || !isRepositoryOwner(owner) || !repositoryNamePattern.test(name)) throw new UsageError(`${reference} is not a repository path.`, "Name it as owner/name, or group/subgroup/name on GitLab, with up to 20 names before the last.");
 	return [owner, name];
 };
 const createRepositoriesCommand = (adaptersOf) => defineGroup({
 	name: "repositories",
-	summary: "The GitHub repositories of a project.",
+	summary: "The GitHub, GitLab and Bitbucket repositories of a project.",
 	usage: "repositories <command>",
 	subcommands: [
 		defineCommand({
@@ -9732,6 +10703,8 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 				const items = await repositoriesOf(run.api, projectId);
 				return printed(run, items, (repositories) => repositories.length === 0 ? "The project has no repository yet." : renderTable([
 					{ header: "REPOSITORY" },
+					{ header: "PROVIDER" },
+					{ header: "SERVER" },
 					{ header: "BRANCH" },
 					{ header: "VISIBILITY" },
 					{ header: "STATUS" },
@@ -9739,6 +10712,8 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 					{ header: "ID" }
 				], repositories.map((repository) => [
 					`${repository.owner}/${repository.name}`,
+					repository.provider,
+					repository.serverUrl,
 					repository.defaultBranch,
 					repository.isPrivate ? "private" : "public",
 					repository.status,
@@ -9749,9 +10724,9 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 		}),
 		defineCommand({
 			name: "available",
-			summary: "List the GitHub repositories one credential can see.",
+			summary: "List the repositories one git provider credential can see.",
 			usage: "repositories available --project <name> --credential <label>",
-			optionsUsage: [...projectUsage, ["--credential <label>", "the github_pat credential to look through"]],
+			optionsUsage: [...projectUsage, ["--credential <label>", "the git provider credential to look through"]],
 			options: {
 				...projectOption,
 				credential: { type: "string" }
@@ -9766,7 +10741,7 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 				const credential = invocation.values.credential;
 				if (credential === void 0) throw new UsageError("repositories available needs --credential <label>.", "kcloud credentials list --project <name> shows them.");
 				const credentialId = await resolveCredentialId(run.api, projectId, credential);
-				const listed = dataOf("list the repositories of the credential", await run.api.GET("/projects/{id}/repositories/github", { params: {
+				const listed = dataOf("list the repositories of the credential", await run.api.GET("/projects/{id}/repositories/available", { params: {
 					path: { id: projectId },
 					query: { credentialId }
 				} }), repositoryHints);
@@ -9776,16 +10751,20 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 					{ header: "VISIBILITY" }
 				], page.items.map((repository) => [
 					`${repository.owner}/${repository.name}`,
-					repository.defaultBranch,
+					repository.defaultBranch ?? "-",
 					repository.isPrivate ? "private" : "public"
-				])), ...page.truncated ? ["", "GitHub returned only the first page."] : []].join("\n"));
+				])), ...page.truncated ? ["", `${providerNameOf(page.provider)} returned only the first pages.`] : []].join("\n"));
 			}
 		}),
 		defineCommand({
 			name: "add",
-			summary: "Register a GitHub repository in a project.",
+			summary: "Register a repository of a git provider in a project.",
 			usage: "repositories add <owner/name> --project <name> --credential <label>",
-			optionsUsage: [...projectUsage, ["--credential <label>", "the github_pat credential that can see it"]],
+			optionsUsage: [
+				...projectUsage,
+				["--credential <label>", "the git provider credential that can see it; it sets the provider and the server"],
+				["", "a GitLab subgroup belongs to the owner: group/subgroup/name; Bitbucket Data Center takes KEY/name"]
+			],
 			options: {
 				...projectOption,
 				credential: { type: "string" }
@@ -9816,7 +10795,7 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 			name: "set-credential",
 			summary: "Point a repository at another credential.",
 			usage: "repositories set-credential <owner/name> --project <name> --credential <label>",
-			optionsUsage: [...projectUsage, ["--credential <label>", "the github_pat credential to use from now on"]],
+			optionsUsage: [...projectUsage, ["--credential <label>", "the credential to use from now on, of the provider and server of the repository"]],
 			options: {
 				...projectOption,
 				credential: { type: "string" }
@@ -9844,7 +10823,7 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 		}),
 		defineCommand({
 			name: "refresh",
-			summary: "Check a repository against GitHub again.",
+			summary: "Check a repository against its provider again.",
 			usage: "repositories refresh <owner/name> --project <name>",
 			optionsUsage: projectUsage,
 			options: projectOption,
@@ -9894,26 +10873,26 @@ const createRepositoriesCommand = (adaptersOf) => defineGroup({
 });
 //#endregion
 //#region src/mcp/tools/repositories.ts
-const repositoryField = z.string().trim().min(1).describe("The repository, as owner/name, by its name or by its id.");
-const credentialField = z.string().trim().min(1).describe("A github_pat credential of the project, by its label or its id.");
+const repositoryField = z.string().trim().min(1).describe("The repository, as owner/name (group/subgroup/name on GitLab), by its name or by its id.");
+const credentialField = z.string().trim().min(1).describe("A git provider credential of the project (github_pat, gitlab_token or bitbucket_token), by its label or its id.");
 const repositoryTools = [
 	defineTool({
 		name: "repositories_list",
 		title: "List repositories",
-		description: "registered lists the GitHub repositories of a project; github lists what one github_pat credential can see on GitHub, to pick one for repository_add.",
-		operations: ["listRepositories", "listGitHubRepositories"],
+		description: "registered lists the repositories of a project, each with its provider and server; available lists what one git provider credential can see on its server, to pick one for repository_add.",
+		operations: ["listRepositories", "listAvailableRepositories"],
 		safety: "read",
 		input: z.object({
 			project: projectField,
-			source: z.enum(["registered", "github"]).default("registered"),
-			credential: credentialField.optional().describe("The credential to look through, for github.")
+			source: z.enum(["registered", "available"]).default("registered"),
+			credential: credentialField.optional().describe("The credential to look through, for available.")
 		}),
 		run: async ({ project, source, credential }, run) => {
 			const projectId = await projectIdOf(run, project);
 			if (source === "registered") return repositoriesOf(run.api, projectId);
-			if (credential === void 0) throw new UsageError("github needs a credential.");
+			if (credential === void 0) throw new UsageError("available needs a credential.");
 			const credentialId = await resolveCredentialId(run.api, projectId, credential);
-			return dataOf("list the repositories of the credential", await run.api.GET("/projects/{id}/repositories/github", { params: {
+			return dataOf("list the repositories of the credential", await run.api.GET("/projects/{id}/repositories/available", { params: {
 				path: { id: projectId },
 				query: { credentialId }
 			} }), repositoryHints);
@@ -9922,12 +10901,12 @@ const repositoryTools = [
 	defineTool({
 		name: "repository_add",
 		title: "Register a repository",
-		description: "Register a GitHub repository in a project, so agents can clone it.",
+		description: "Register a repository of a git provider in a project, so agents can clone it. The credential decides the provider and the server.",
 		operations: ["registerRepository"],
 		safety: "write",
 		input: z.object({
 			project: projectField,
-			repository: z.string().trim().min(1).describe("The GitHub repository, as owner/name."),
+			repository: z.string().trim().min(1).describe("The repository, as owner/name, or group/subgroup/name for a GitLab subgroup."),
 			credential: credentialField
 		}),
 		run: async ({ project, repository, credential }, run) => {
@@ -9947,7 +10926,7 @@ const repositoryTools = [
 	defineTool({
 		name: "repository_update",
 		title: "Change or refresh a repository",
-		description: "set_credential points a repository at another github_pat credential; refresh checks it on GitHub again.",
+		description: "set_credential points a repository at another credential of its provider and server; refresh checks it against its provider again.",
 		operations: ["updateRepository", "refreshRepository"],
 		safety: "write",
 		input: z.object({
@@ -10123,6 +11102,7 @@ const kcloudTools = [
 	...accountTools,
 	...organizationTools,
 	...projectTools,
+	...claudeAccountTools,
 	...credentialTools,
 	...repositoryTools,
 	...projectToolTools,
@@ -10906,6 +11886,7 @@ const kcloudCommands = () => [
 	createTokensCommand(createAdapters),
 	createAuthCommand(createAdapters),
 	createProjectsCommand(createAdapters),
+	createClaudeAccountsCommand(createAdapters),
 	createCredentialsCommand(createAdapters),
 	createRepositoriesCommand(createAdapters),
 	createToolsCommand(createAdapters),