@kikimoradev/kcloud 1.2.0 → 1.4.0

package/dist/main.js

@@ -844,7 +844,6 @@ const errorCodes = Object.keys({
 	"backup.unavailable": "rule_violation",
 	"backup.corrupt": "rule_violation",
 	"backup.undecryptable": "rule_violation",
-	"volume.invalid_size": "rule_violation",
 	"notification.not_found": "not_found",
 	"logo.not_found": "not_found",
 	"logo.unreadable": "rule_violation",
@@ -1101,7 +1100,8 @@ agentEventSchema.options.map((option) => option.shape.event.value);
 	crashLooping: "platform.crashLooping",
 	provisioned: "platform.provisioned",
 	sandboxStarted: "platform.sandboxStarted",
-	sandboxStopped: "platform.sandboxStopped"
+	sandboxStopped: "platform.sandboxStopped",
+	restartedByNode: "platform.restartedByNode"
 }).rawLog;
 const agentStateSchema = z.enum([
 	"created",
@@ -1198,41 +1198,11 @@ const degradedAgentSchema = z.object({
 z.object({
 	status: z.enum(runtimeHealthStates),
 	database: z.object({ ok: z.boolean() }),
-	engine: z.enum(runtimeEngineKinds),
-	docker: z.object({
-		state: z.enum(dockerStates),
-		lastError: z.string().nullable(),
-		checkedAt: z.iso.datetime().nullable()
-	}),
-	storage: z.object({
-		data: storageStateSchema,
-		engine: storageStateSchema
-	}),
 	partitions: z.object({
 		defaultRows: z.int().nonnegative(),
 		ensuredThrough: z.string().nullable(),
 		lastMaintenanceAt: z.iso.datetime().nullable()
 	}),
-	reconcile: z.object({
-		lastTickAt: z.iso.datetime().nullable(),
-		lastTickError: z.string().nullable(),
-		agentsQueued: z.int().nonnegative(),
-		agentsActive: z.int().nonnegative()
-	}),
-	ingest: z.object({
-		readers: z.int().nonnegative(),
-		oldestCursorLagSeconds: z.number().nonnegative().nullable()
-	}),
-	sandbox: z.object({
-		enabled: z.boolean(),
-		image: z.object({
-			tag: z.string(),
-			digest: z.string()
-		}),
-		agentsWithSandbox: z.int().nonnegative(),
-		sidecarsRunning: z.int().nonnegative(),
-		volumeBytes: z.int().nonnegative().nullable()
-	}),
 	metrics: runtimeMetricsSchema,
 	deadLetters: z.array(deadLetterQueueSchema),
 	degradedAgents: z.array(degradedAgentSchema)
@@ -1641,8 +1611,10 @@ const admissionHoldSchema = z.object({
 const nodeStateSchema = z.enum([
 	"pending",
 	"online",
-	"offline"
+	"offline",
+	"outdated"
 ]);
+const minimumNodeVersion = "1.3.0";
 const nodeProviders = ["self_hosted", "digitalocean"];
 const nodeProviderSchema = z.enum(nodeProviders);
 const nodeNameSchema = z.string().trim().regex(slugPattern);
@@ -1706,7 +1678,8 @@ const poolUsageSchema = z.object({
 	memoryBytes: z.int().nonnegative(),
 	memoryMaxBytes: z.int().nonnegative().nullable(),
 	cpus: z.number().nonnegative().nullable(),
-	memoryKills: z.int().nonnegative()
+	memoryKills: z.int().nonnegative(),
+	processors: z.int().positive().nullable().optional()
 }).meta({ id: "PoolUsage" });
 const nodePoolSchema = z.object({
 	slots: z.int().nonnegative(),
@@ -1715,8 +1688,26 @@ const nodePoolSchema = z.object({
 	holders: z.array(sessionHolderSchema).nullable(),
 	usage: poolUsageSchema.nullable()
 }).meta({ id: "NodePool" });
+const sessionRefusalsSchema = z.object({
+	count: z.int().positive(),
+	lastAt: z.iso.datetime(),
+	pool: sessionRoleSchema,
+	reason: z.string()
+}).meta({ id: "SessionRefusals" });
+const poolLayoutSchema = z.object({
+	cores: z.array(z.int().positive()).min(1),
+	cpus: z.object({
+		monitor: z.number().positive(),
+		executor: z.number().positive()
+	}).nullable(),
+	topologyError: z.string().nullable(),
+	clamped: z.boolean()
+}).meta({ id: "PoolLayout" });
 const nodePoolsSchema = z.object({
 	enforcement: poolEnforcementSchema,
+	agentsSlice: poolEnforcementSchema.nullable(),
+	refused: sessionRefusalsSchema.nullable(),
+	layout: poolLayoutSchema.nullable(),
 	monitor: nodePoolSchema,
 	executor: nodePoolSchema
 }).meta({ id: "NodePools" });
@@ -1822,12 +1813,7 @@ const nodeAgentSchema = z.object({
 const nodeRuntimeSchema = z.object({
 	reportedAt: z.iso.datetime(),
 	docker: z.object({
-		state: z.enum([
-			"ok",
-			"unavailable",
-			"disabled",
-			"adopting"
-		]),
+		state: z.enum(dockerStates),
 		lastError: z.string().nullable()
 	}),
 	storage: z.object({
@@ -1840,7 +1826,20 @@ const nodeRuntimeSchema = z.object({
 		agentsQueued: z.int().nonnegative(),
 		agentsActive: z.int().nonnegative()
 	}),
-	ingest: z.object({ readers: z.int().nonnegative() }),
+	ingest: z.object({
+		readers: z.int().nonnegative(),
+		oldestCursorLagSeconds: z.number().nonnegative().nullable()
+	}),
+	sandbox: z.object({
+		enabled: z.boolean(),
+		image: z.object({
+			tag: z.string(),
+			digest: z.string()
+		}),
+		agentsWithSandbox: z.int().nonnegative(),
+		sidecarsRunning: z.int().nonnegative(),
+		volumeBytes: z.int().nonnegative().nullable()
+	}),
 	sessions: z.object({
 		monitor: z.object({
 			effective: z.int().nonnegative(),
@@ -1859,6 +1858,28 @@ nodeSchema.extend({
 	update: nodeUpdateSchema.nullable()
 }).meta({ id: "NodeDetail" });
 z.object({ items: z.array(nodeSchema) }).meta({ id: "NodeList" });
+const adminNodeSessionsSchema = z.object({
+	effective: z.int().nonnegative(),
+	inUse: z.int().nonnegative()
+});
+const nodeHealthSchema = z.object({
+	docker: z.enum(dockerStates),
+	storage: z.enum(storageStates),
+	reconcileError: z.string().nullable()
+}).meta({ id: "NodeHealth" });
+const adminNodeSchema = nodeSchema.extend({
+	organization: z.object({
+		id: idSchema,
+		name: z.string().nullable()
+	}),
+	update: nodeUpdateSchema.nullable(),
+	sessions: z.object({
+		monitor: adminNodeSessionsSchema,
+		executor: adminNodeSessionsSchema
+	}).nullable(),
+	health: nodeHealthSchema.nullable()
+}).meta({ id: "AdminNode" });
+z.object({ items: z.array(adminNodeSchema) }).meta({ id: "AdminNodeList" });
 z.object({ nodeId: idSchema });
 z.object({
 	organizationId: idSchema,
@@ -1932,6 +1953,30 @@ const splitFits = (split, host) => {
 	const overflow = splitOverflowOf(split, host);
 	return overflow.cpus <= 0 && overflow.memoryMb <= 0;
 };
+const poolProcessorsOf = (cpus, hostCpus) => Math.max(1, Math.min(Math.round(cpus), Math.round(hostCpus)));
+const layoutAppliesSplit = (layout, split) => layout?.cpus != null && split !== null && layout.cpus.monitor === split.monitor.cpus && layout.cpus.executor === split.executor.cpus;
+const splitCoresOf = (split, cores) => {
+	const processors = cores.reduce((total, size) => total + size, 0);
+	const sizeAt = (index) => cores[Math.min(index, cores.length - 1)] ?? 1;
+	const coresFrom = (first, cpus) => {
+		const wanted = poolProcessorsOf(cpus, processors);
+		let taken = sizeAt(first);
+		let count = 1;
+		while (taken + sizeAt(first + count) <= wanted) {
+			taken += sizeAt(first + count);
+			count += 1;
+		}
+		return count;
+	};
+	const executor = coresFrom(0, split.executor.cpus);
+	const monitor = coresFrom(executor, split.monitor.cpus);
+	return {
+		cores: cores.length,
+		monitor,
+		executor,
+		fits: executor + monitor < cores.length
+	};
+};
 //#endregion
 //#region ../../packages/contracts/src/appearance.ts
 const colorSchema = z.string().regex(hexColorPattern);
@@ -2571,9 +2616,6 @@ const containerHealthSchema = z.enum([
 ]);
 const maxAgentDescriptionLength = 2e3;
 const maxAgentPromptLength = 64e3;
-const minAgentCpus = .25;
-const maxAgentMemoryMb = 16384;
-const defaultAgentMemoryMb = 4096;
 const workspaceDirectorySchema = z.string().regex(/^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/);
 const timeZones = new Set(Intl.supportedValuesOf("timeZone"));
 const timezoneSchema = z.string().trim().refine((value) => timeZones.has(value), { message: "expected an IANA time zone identifier" });
@@ -2584,11 +2626,10 @@ const agentDiskGbSchema = z.int().min(1).max(100);
 const agentMachineSchema = z.object({
 	docker: z.boolean(),
 	browser: z.boolean(),
-	cpus: z.number().min(minAgentCpus).max(8),
-	memoryMb: z.int().min(512).max(maxAgentMemoryMb),
 	diskGb: agentDiskGbSchema
-}).meta({ id: "AgentMachine" });
+});
 const agentMachineInputSchema = agentMachineSchema.extend({ diskGb: agentDiskGbSchema.optional() });
+const agentMachineDtoSchema = agentMachineSchema.meta({ id: "AgentMachine" });
 const agentPromptsSchema = z.object({
 	monitor: agentPromptSchema,
 	executor: agentPromptSchema
@@ -2674,7 +2715,7 @@ agentListItemSchema.extend({
 	version: z.int().nonnegative(),
 	description: z.string(),
 	timezone: z.string(),
-	machine: agentMachineSchema,
+	machine: agentMachineDtoSchema,
 	settings: kikimoraSettingsSchema,
 	effectiveSettings: workerSettingsSchema,
 	prompts: agentPromptsSchema,
@@ -2816,13 +2857,20 @@ z.object({
 	nodeId: idSchema
 }).meta({ id: "RestoreAgentBody" });
 z.object({ agentId: idSchema }).meta({ id: "RestoredAgent" });
+const agentBackupContentDigestSchema = z.string().regex(/^[0-9a-f]{64}$/u);
 z.object({
 	agentId: idSchema,
 	trigger: z.enum(agentBackupTriggers),
 	kikimoraVersion: z.string().min(1).max(64),
-	entries: z.coerce.number().int().nonnegative()
+	entries: z.coerce.number().int().nonnegative(),
+	contentDigest: agentBackupContentDigestSchema.optional()
 });
 z.object({ backupId: idSchema });
+z.object({
+	agentId: idSchema,
+	contentDigest: agentBackupContentDigestSchema
+});
+z.object({ backupId: idSchema.nullable() });
 [
 	"application/vnd.oci.image.index.v1+json",
 	"application/vnd.oci.image.manifest.v1+json",
@@ -2830,21 +2878,12 @@ z.object({ backupId: idSchema });
 	"application/vnd.docker.distribution.manifest.v2+json"
 ].join(", ");
 const pinnedPlatformImagePattern = /^[a-z0-9][a-z0-9.-]*(?::[0-9]{1,5})?(?:\/[a-z0-9][a-z0-9._-]*)+@sha256:[0-9a-f]{64}$/;
-//#endregion
-//#region ../../packages/contracts/src/infrastructure.ts
-const volumeRoles = ["data", "agents"];
-const volumeRoleSchema = z.enum(volumeRoles);
+const volumeRoleSchema = z.enum(["data", "agents"]);
 const filesystemNameSchema = z.enum([
 	"root",
 	"data",
 	"agents"
 ]);
-z.enum([
-	"digitalOcean",
-	"spaces",
-	"ghcr",
-	"backup"
-]);
 const backupKindSchema = z.enum(["scheduled", "manual"]);
 const backupStatusSchema = z.enum([
 	"running",
@@ -2888,65 +2927,42 @@ const sha256HexPattern = /^[0-9a-f]{64}$/;
 const platformSecretPattern = /^[\x21-\x7e]+$/;
 const instantSchema$1 = z.iso.datetime();
 const byteCountSchema$1 = z.int().nonnegative();
-const platformSecretSchema = z.string().trim().min(1).max(maxPlatformSecretLength).regex(platformSecretPattern, { message: "expected printable ASCII characters without spaces" });
+z.string().trim().min(1).max(maxPlatformSecretLength).regex(platformSecretPattern, { message: "expected printable ASCII characters without spaces" });
 const secretPresenceSchema = z.object({ present: z.boolean() }).meta({ id: "SecretPresence" });
 const regionSchema = z.string().regex(regionSlugPattern);
+const bucketNameSchema = z.string().regex(bucketNamePattern);
 const platformVolumeSchema = z.object({
 	role: volumeRoleSchema,
 	id: z.guid(),
 	name: z.string().regex(volumeNamePattern)
 }).meta({ id: "PlatformVolume" });
-const oneVolumePerRole = (volumes) => volumes.length === volumeRoles.length && volumeRoles.every((role) => volumes.some((volume) => volume.role === role));
-const platformVolumesSchema = z.array(platformVolumeSchema).refine(oneVolumePerRole, { message: `expected exactly one volume for each role: ${volumeRoles.join(", ")}` });
+const countOfRole = (volumes, role) => volumes.filter((volume) => volume.role === role).length;
+const oneDataVolumeAndAtMostOneAgentsVolume = (volumes) => countOfRole(volumes, "data") === 1 && countOfRole(volumes, "agents") <= 1;
+const platformVolumesSchema = z.array(platformVolumeSchema).refine(oneDataVolumeAndAtMostOneAgentsVolume, { message: "expected one data volume and at most one agents volume" });
 const isOrigin = (value) => {
 	if (!URL.canParse(value)) return false;
 	const url = new URL(value);
 	return url.pathname === "/" && url.search === "" && url.hash === "" && url.username === "" && url.password === "";
 };
 const spacesEndpointSchema = z.url({ protocol: /^https?$/ }).max(2e3).refine(isOrigin, { message: "expected an origin without a path, a query, a fragment or credentials" });
-const digitalOceanShape = {
-	dropletId: z.int().positive(),
-	region: regionSchema,
-	reservedIp: z.ipv4(),
-	volumes: platformVolumesSchema
-};
-const spacesShape = {
-	endpoint: spacesEndpointSchema,
-	region: regionSchema,
-	bucket: z.string().regex(bucketNamePattern)
-};
 const backupSettingsSchema = z.object({ retentionDays: z.int().min(1).max(maxBackupRetentionDays) }).meta({ id: "BackupSettings" });
 z.object({
-	version: z.int().nonnegative(),
 	instance: z.string(),
 	domain: z.string(),
 	digitalOcean: z.object({
-		...digitalOceanShape,
-		token: secretPresenceSchema
+		dropletId: z.int().positive(),
+		region: regionSchema,
+		reservedIp: z.ipv4(),
+		volumes: platformVolumesSchema
 	}).nullable(),
 	spaces: z.object({
-		...spacesShape,
-		accessKey: secretPresenceSchema,
-		secretKey: secretPresenceSchema
+		endpoint: spacesEndpointSchema,
+		region: regionSchema,
+		bucket: bucketNameSchema
 	}).nullable(),
 	ghcrToken: secretPresenceSchema,
-	backup: backupSettingsSchema,
-	updatedAt: instantSchema$1
+	backup: backupSettingsSchema
 }).meta({ id: "PlatformSettings" });
-z.object({
-	version: z.int().nonnegative(),
-	digitalOcean: z.object({
-		...digitalOceanShape,
-		token: platformSecretSchema.nullable()
-	}).nullable(),
-	spaces: z.object({
-		...spacesShape,
-		accessKey: platformSecretSchema.nullable(),
-		secretKey: platformSecretSchema.nullable()
-	}).nullable(),
-	ghcrToken: platformSecretSchema.nullable(),
-	backup: backupSettingsSchema.nullable()
-}).meta({ id: "UpdatePlatformSettingsBody" });
 const storageReadingSchema = z.discriminatedUnion("measured", [z.object({
 	measured: z.literal(true),
 	path: z.string(),
@@ -3010,8 +3026,6 @@ z.object({
 		dockerRootDir: z.string().nullable()
 	})
 }).meta({ id: "PlatformNode" });
-z.object({ role: volumeRoleSchema });
-z.object({ sizeGb: z.int().positive() }).meta({ id: "ResizeVolumeBody" });
 const requesterSchema = z.object({
 	userId: idSchema,
 	label: z.string().nullable()
@@ -3137,7 +3151,6 @@ const masterKeyVersionSchema = z.object({
 	secrets: z.object({
 		credentials: secretCountSchema,
 		toolSecrets: secretCountSchema,
-		platformSecrets: secretCountSchema,
 		providerAccounts: secretCountSchema.default(0)
 	}),
 	backups: secretCountSchema,
@@ -3148,12 +3161,15 @@ z.object({
 	versions: z.array(masterKeyVersionSchema),
 	rotationPending: z.boolean()
 }).meta({ id: "MasterKey" });
-const metricsRangeSchema = z.enum([
+//#endregion
+//#region ../../packages/contracts/src/metrics.ts
+const metricsRanges = [
 	"1h",
 	"24h",
 	"7d",
 	"90d"
-]);
+];
+const metricsRangeSchema = z.enum(metricsRanges);
 const agentMetricsRanges = [
 	"1h",
 	"24h",
@@ -3207,18 +3223,13 @@ const agentUsageSchema = z.object({
 	blockReadBytes: byteCountSchema,
 	blockWriteBytes: byteCountSchema
 }).meta({ id: "AgentUsage" });
-const nodeHostSeriesSchema = z.object({
-	nodeId: idSchema,
-	nodeName: z.string(),
-	points: z.array(hostPointSchema)
-}).meta({ id: "NodeHostSeries" });
 z.object({
 	resolution: metricsResolutionSchema,
 	from: instantSchema,
 	to: instantSchema,
-	nodes: z.array(nodeHostSeriesSchema),
+	points: z.array(hostPointSchema),
 	agents: z.array(agentUsageSchema)
-}).meta({ id: "HostMetrics" });
+}).meta({ id: "NodeMetrics" });
 z.object({
 	resolution: metricsResolutionSchema,
 	from: instantSchema,
@@ -3255,7 +3266,8 @@ const notificationTargetTypeSchema = z.enum([
 	"backup",
 	"queue",
 	"volume",
-	"platform"
+	"platform",
+	"node"
 ]);
 const hostOperationOutcomes = [
 	"succeeded",
@@ -4160,6 +4172,13 @@ const nodeDetailOf = async (api, { organizationId, nodeId }) => dataOf("describe
 	organizationId,
 	nodeId
 } } }), nodeHints);
+const nodeMetricsOf = async (api, { organizationId, nodeId }, range) => dataOf("show what the node used", await api.GET("/organizations/{organizationId}/nodes/{nodeId}/metrics", { params: {
+	path: {
+		organizationId,
+		nodeId
+	},
+	query: { range }
+} }), nodeHints);
 const createdNode = async (api, organizationId, body) => {
 	validated(createNodeBodySchema, body, "a node");
 	return providerDataOf("create the node", await api.POST("/organizations/{organizationId}/nodes", {
@@ -4271,7 +4290,8 @@ const agentHints = {
 	"agent.busy": "The agent is working on another action; try again in a moment.",
 	"concurrency.conflict": "Someone changed the agent meanwhile; read it again and retry.",
 	"agent.node_unsuitable": "The node lacks a capability the agent requires; kcloud nodes show <node> lists what it offers.",
-	"node.offline": "The node of the agent is not connected; kcloud nodes show <node> tells when it was last seen."
+	"node.offline": "The node of the agent is not connected; kcloud nodes show <node> tells when it was last seen.",
+	"node.outdated": "The node of the agent runs an older release; kcloud nodes show <node> names the release it runs and its update."
 };
 const agentFrom = async (run, reference, project) => {
 	if (reference === void 0 || reference === "") throw new UsageError("This command needs an agent.", "Name it as <project>/<agent>, or pass --project.");
@@ -4495,6 +4515,23 @@ const enforcementText = ({ state, reason }) => {
 		case "unsupported": return `The node holds no pool to a limit: ${reason === null ? "it cannot" : unsupportedReasons[reason] ?? reason}.`;
 	}
 };
+const agentsSliceReasons = {
+	cgroup_driver: "Docker on the host does not use the systemd cgroup driver",
+	cgroup_driver_unread: "the node has not read the cgroup driver of Docker yet",
+	host_unread: "the node has not read its host yet",
+	configure_failed: "systemd did not take the limits",
+	pending: "the node has not applied the limit yet",
+	platform: "the node runs no pool service"
+};
+const agentsSliceText = ({ state, reason }) => {
+	switch (state) {
+		case "enforced": return "The node holds its agents and their sessions together to the host minus its reserve.";
+		case "unsplit": return "The node has no split, so its agents outside their sessions have no limit.";
+		case "unsupported": return `The node holds its agents outside their sessions to no limit: ${reason === null ? "it cannot" : agentsSliceReasons[reason] ?? reason}.`;
+	}
+};
+const refusedText = ({ count, pool, lastAt, reason }) => `The session starter refused ${count === 1 ? "1 session" : `${count} sessions`} of the ${pool} pool in the last hour, the last at ${lastAt}: ${reason}`;
+const layoutTexts = (layout, split) => [...layout.topologyError === null ? [] : [`The node did not read its processor cores, so each logical processor counts as a core and a pool can share a physical core: ${layout.topologyError}`], ...layout.clamped && layoutAppliesSplit(layout, split) ? ["The split does not fit the cores of the node, so its pools run on fewer cores than the split asks for; kcloud nodes split <node> shows the cores each pool takes."] : []];
 const memoryOf$1 = (pool) => {
 	if (pool.usage === null) return "-";
 	const { memoryBytes, memoryMaxBytes } = pool.usage;
@@ -4549,10 +4586,13 @@ const queueOf = (pools) => {
 		{ header: "WORK" }
 	], waiting);
 };
-const poolsText = (pools) => {
+const poolsText = (pools, split) => {
 	const holders = holdersOf(pools);
 	return [
 		enforcementText(pools.enforcement),
+		...pools.agentsSlice == null ? [] : [agentsSliceText(pools.agentsSlice)],
+		...pools.refused == null ? [] : [refusedText(pools.refused)],
+		...pools.layout == null ? [] : layoutTexts(pools.layout, split),
 		renderTable([
 			{ header: "POOL" },
 			{ header: "SLOTS IN USE" },
@@ -4603,8 +4643,36 @@ const agentPlanOf = (agent) => ({
 	prompts: agent.prompts,
 	settings: agent.settings,
 	timezone: agent.timezone,
-	machine: agent.machine
+	machine: {
+		docker: agent.machine.docker,
+		browser: agent.machine.browser,
+		diskGb: agent.machine.diskGb
+	}
 });
+const machineLimitKeys = /* @__PURE__ */ new Set(["cpus", "memoryMb"]);
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const warnIgnored = ({ context }, keys) => {
+	const named = keys.map((key) => `machine.${key}`).join(" and ");
+	context.terminal.error(context.terminal.errorStyles.warning(`warning ${named} ${keys.length === 1 ? "is" : "are"} ignored: an agent has no limits of its own, and the pools of its node limit its sessions.`));
+};
+const machineWithoutLimits = (run, machine) => {
+	if (!isRecord(machine)) return machine;
+	const ignored = Object.keys(machine).filter((key) => machineLimitKeys.has(key));
+	if (ignored.length === 0) return machine;
+	warnIgnored(run, ignored);
+	return Object.fromEntries(Object.entries(machine).filter(([key]) => !machineLimitKeys.has(key)));
+};
+const agentFileWithoutLimits = (run, document) => isRecord(document) && "machine" in document ? {
+	...document,
+	machine: machineWithoutLimits(run, document.machine)
+} : document;
+const agentChangeWithoutLimits = (run, document) => isRecord(document) && isRecord(document.sections) && "machine" in document.sections ? {
+	...document,
+	sections: {
+		...document.sections,
+		machine: machineWithoutLimits(run, document.sections.machine)
+	}
+} : document;
 //#endregion
 //#region src/commands/agents/config.ts
 const agentsOf = async (scope, project) => {
@@ -4715,7 +4783,7 @@ const configCommands = (adaptersOf) => [
 			const agentId = await agentFrom(run, invocation.positionals[0], invocation.values.project);
 			const file = invocation.values.file;
 			if (file === void 0) throw new UsageError("agents set needs --file <path>.", "The file holds the sections to change; kcloud agents show <agent> --json shows the current ones.");
-			const agent = await changedAgent(run.api, agentId, await documentOf(run, file));
+			const agent = await changedAgent(run.api, agentId, agentChangeWithoutLimits(run, await documentOf(run, file)));
 			return printed(run, agent, (changed) => changed.restartRequired ? `Changed ${changed.name}; it needs kcloud agents update to take the change.` : `Changed ${changed.name}.`);
 		}
 	}),
@@ -4781,7 +4849,7 @@ const detailsOf = (agent) => [
 		["node", agent.node === null ? "none" : `${agent.node.name} (${agent.node.state})`],
 		["requires", agent.requiredCapabilities.length === 0 ? "nothing" : agent.requiredCapabilities.join(", ")],
 		["timezone", agent.timezone],
-		["machine", `${agent.machine.cpus} vCPU, ${agent.machine.memoryMb} MB`],
+		["disk", `${String(agent.machine.diskGb)} GB`],
 		["docker", agent.machine.docker ? "yes" : "no"],
 		["browser", agent.machine.browser ? "yes" : "no"],
 		["container", agent.runtime.containerId ?? "none"],
@@ -4976,15 +5044,13 @@ const askedPlan = async (run, projectId, values, required) => {
 		timezone: values.timezone ?? localTimezone(),
 		machine: {
 			docker: values.docker,
-			browser: values.browser,
-			cpus: 2,
-			memoryMb: defaultAgentMemoryMb
+			browser: values.browser
 		}
 	};
 };
 const isObject = (document) => typeof document === "object" && document !== null && !Array.isArray(document);
 const fileOf = async (run, projectId, { file, node }, required) => {
-	const document = await documentOf(run, file);
+	const document = agentFileWithoutLimits(run, await documentOf(run, file));
 	const placed = !isObject(document) || node === void 0 && "nodeId" in document ? document : {
 		...document,
 		nodeId: await placedNodeId(run, {
@@ -6689,6 +6755,115 @@ const agentTools = [
 		run: async ({ action, now, ...reference }, run) => actionOn(run, await agentIdOf(run, reference), action, action === "stop" && now)
 	})
 ];
+const percentOf = (ratio) => ratio === null ? "-" : `${(ratio * 100).toFixed(1)}%`;
+const disksOf = (point) => [
+	point.diskRootUsedRatio,
+	point.diskDataUsedRatio,
+	point.diskAgentsUsedRatio
+].map(percentOf).join(" / ");
+const gpuMemoryOf = ({ gpuMemoryUsedBytesAvg: used, gpuMemoryTotalBytes: total }) => used === null || total === null ? "-" : `${bytesOf(used)} of ${bytesOf(total)}`;
+const gpuOf = (point) => `${percentOf(point.gpuUtilRatioAvg)}, ${gpuMemoryOf(point)}`;
+const readsAGpu = (points) => points.some((point) => point.gpuUtilRatioAvg !== null || point.gpuMemoryTotalBytes !== null);
+const hostText$1 = (points) => {
+	const gpu = readsAGpu(points);
+	return renderTable([
+		{ header: "AT" },
+		{
+			header: "CPU",
+			align: "right"
+		},
+		{
+			header: "MEMORY",
+			align: "right"
+		},
+		{
+			header: "LOAD",
+			align: "right"
+		},
+		{
+			header: "DISKS ROOT / DATA / AGENTS",
+			align: "right"
+		},
+		...gpu ? [{
+			header: "GPU",
+			align: "right"
+		}] : []
+	], points.map((point) => [
+		point.ts,
+		percentOf(point.cpuRatioAvg),
+		`${bytesOf(point.memoryUsedBytesAvg)} of ${bytesOf(point.memoryTotalBytes)}`,
+		point.load1Avg === null ? "-" : point.load1Avg.toFixed(2),
+		disksOf(point),
+		...gpu ? [gpuOf(point)] : []
+	]));
+};
+const byFootprint = (left, right) => right.memoryBytesAvg - left.memoryBytesAvg || left.agentName.localeCompare(right.agentName);
+const agentsText = (agents) => renderTable([
+	{ header: "PROJECT" },
+	{ header: "AGENT" },
+	{
+		header: "CPU (CORES)",
+		align: "right"
+	},
+	{
+		header: "MEMORY AVG",
+		align: "right"
+	},
+	{
+		header: "MEMORY MAX",
+		align: "right"
+	},
+	{
+		header: "NETWORK IN / OUT",
+		align: "right"
+	},
+	{
+		header: "DISK READ / WRITE",
+		align: "right"
+	}
+], agents.toSorted(byFootprint).map((usage) => [
+	usage.projectName,
+	usage.agentName,
+	usage.cpuRatioAvg === null ? "-" : usage.cpuRatioAvg.toFixed(2),
+	bytesOf(usage.memoryBytesAvg),
+	bytesOf(usage.memoryBytesMax),
+	`${bytesOf(usage.networkRxBytes)} / ${bytesOf(usage.networkTxBytes)}`,
+	`${bytesOf(usage.blockReadBytes)} / ${bytesOf(usage.blockWriteBytes)}`
+]));
+const nodeMetricsText = (metrics) => [
+	`${metrics.from} to ${metrics.to}, one point per ${metrics.resolution}.`,
+	"",
+	metrics.points.length === 0 ? "The node sent no sample in that range." : hostText$1(metrics.points),
+	"",
+	metrics.agents.length === 0 ? "No agent you can see ran on the node in that range." : agentsText(metrics.agents)
+].join("\n");
+const rangeOf = (given) => {
+	if (given === void 0) return "1h";
+	const range = metricsRanges.find((candidate) => candidate === given);
+	if (range === void 0) throw new UsageError(`--range ${given} is not a range of metrics.`, `The ranges are ${metricsRanges.join(", ")}.`);
+	return range;
+};
+const createNodeMetricsCommand = (adaptersOf) => defineCommand({
+	name: "metrics",
+	summary: "Show what the host of a node and the agents on it used over a range.",
+	usage: "nodes metrics <node> [--range <range>]",
+	optionsUsage: [
+		...nodeUsage,
+		["--range <range>", `how far back: ${metricsRanges.join(", ")} (default: 1h)`],
+		["", "the agents are those of the projects you belong to, or all for an admin"]
+	],
+	options: { range: { type: "string" } },
+	positionals: {
+		min: 1,
+		max: 1
+	},
+	run: async (invocation) => {
+		const range = rangeOf(invocation.values.range);
+		const run = await runOf(adaptersOf, invocation);
+		const reference = await resolveNode(run, invocation.positionals[0] ?? "");
+		return printed(run, await nodeMetricsOf(run.api, reference, range), nodeMetricsText);
+	}
+});
 //#endregion
 //#region src/commands/nodes/split.ts
 const splitFields = [
@@ -6744,6 +6919,8 @@ const changeOfParts = ({ reserve, monitor, executor }) => {
 const cpusText = (cpus) => String(Math.round(cpus * 100) / 100);
 const hostText = (host) => `${cpusText(host.cpus)} CPU and ${hostMemoryMbOf(host)} MB`;
 const excessText = ({ cpus, memoryMb }) => [...cpus > 0 ? [`${cpusText(cpus)} CPU`] : [], ...memoryMb > 0 ? [`${memoryMb} MB`] : []].join(" and ");
+const coresText = (count) => count === 1 ? "1 core" : `${String(count)} cores`;
+const coresOfNode = (node) => node.runtime?.pools.layout?.cores ?? null;
 const fittingSplit = (node, change, nameOf) => {
 	const merged = {
 		...node.split === null ? {} : valuesOf(node.split),
@@ -6757,9 +6934,25 @@ const fittingSplit = (node, change, nameOf) => {
 	validated(nodeSplitSchema, split, "a split of a node");
 	if (node.host === null) throw new CliError(`${node.name} has not reported its CPUs and memory yet, so it cannot be split.`, "The node reports them once its service runs; kcloud nodes show <node> shows its state.");
 	if (!splitFits(split, node.host)) throw new CliError(`The split asks for ${excessText(splitOverflowOf(split, node.host))} more than ${node.name} has.`, `${node.name} has ${hostText(node.host)}; shrink a pool or the reserve.`);
+	const cores = coresOfNode(node);
+	const fit = cores === null ? null : splitCoresOf(split, cores);
+	if (fit !== null && !fit.fits) throw new CliError(`The pools take whole cores of ${node.name}: the executor pool would get ${coresText(fit.executor)} and the monitor pool ${coresText(fit.monitor)} of ${String(fit.cores)}, and the reserve keeps at least 1.`, "Shrink a pool, so the reserve keeps the core of processor 0.");
 	return split;
 };
+const processorCountsOf = (node) => {
+	const pools = node.runtime?.pools;
+	if (pools === void 0 || !layoutAppliesSplit(pools.layout, node.split)) return null;
+	const monitor = pools.monitor.usage?.processors ?? null;
+	const executor = pools.executor.usage?.processors ?? null;
+	return monitor === null && executor === null ? null : {
+		monitor,
+		executor
+	};
+};
+const processorsText = (count) => count === 1 ? "1 processor" : `${String(count)} processors`;
+const poolCpusText = (cpus, processors) => processors === null ? cpusText(cpus) : `${cpusText(cpus)} (${processorsText(processors)})`;
 const splitViewOf = (node) => {
+	const cores = coresOfNode(node);
 	const overflow = node.split === null || node.host === null ? null : splitOverflowOf(node.split, node.host);
 	return {
 		id: node.id,
@@ -6770,6 +6963,8 @@ const splitViewOf = (node) => {
 			memoryMb: hostMemoryMbOf(node.host)
 		},
 		split: node.split,
+		processors: processorCountsOf(node),
+		cores: cores === null || node.split === null ? null : splitCoresOf(node.split, cores),
 		free: overflow === null ? null : {
 			cpus: -overflow.cpus,
 			memoryMb: -overflow.memoryMb
@@ -6779,10 +6974,12 @@ const splitViewOf = (node) => {
 const resourceCells = ({ cpus, memoryMb }) => [cpusText(cpus), `${memoryMb} MB`];
 const oneSlotOf = ({ cpus, memoryMb, slots }) => `${cpusText(cpus / slots)} CPU, ${Math.floor(memoryMb / slots)} MB`;
 const hostLineOf = (view) => view.host === null ? `${view.name} has not reported its CPUs and memory yet.` : `The host has ${cpusText(view.host.cpus)} CPU and ${view.host.memoryMb} MB.`;
+const coresLineOf = ({ cores, executor, monitor, fits }) => fits ? `The pools take whole cores: the executor pool ${coresText(executor)} and the monitor pool ${coresText(monitor)}; the reserve keeps ${coresText(cores - executor - monitor)} of ${String(cores)}.` : `The executor pool would take ${coresText(executor)} and the monitor pool ${coresText(monitor)} of ${String(cores)}, so the node runs them on fewer cores and keeps 1 for the reserve.`;
 const splitTableOf = (view, split) => {
 	const poolRow = (role) => [
 		role,
-		...resourceCells(split[role]),
+		poolCpusText(split[role].cpus, view.processors?.[role] ?? null),
+		`${String(split[role].memoryMb)} MB`,
 		String(split[role].slots),
 		oneSlotOf(split[role])
 	];
@@ -6830,7 +7027,8 @@ const splitTableOf = (view, split) => {
 			{ header: "ONE SLOT" }
 		], rows),
 		...view.host === null ? ["", hostLineOf(view)] : [],
-		...over === "" ? [] : ["", `The split asks for ${over} more than the host has.`]
+		...over === "" ? [] : ["", `The split asks for ${over} more than the host has.`],
+		...view.cores === null ? [] : ["", coresLineOf(view.cores)]
 	].join("\n");
 };
 const splitText = (view) => view.split === null ? [
@@ -6838,10 +7036,14 @@ const splitText = (view) => view.split === null ? [
 	hostLineOf(view),
 	`kcloud nodes split set ${view.name} with every part splits it.`
 ].join("\n") : splitTableOf(view, view.split);
-const splitSummaryOf = (split) => {
+const splitSummaryOf = (split, processors = null) => {
 	if (split === null) return "none, slots counted from the host without hard limits";
 	const { reserve, monitor, executor } = split;
-	const pool = (role, { cpus, memoryMb, slots }) => `${role} ${cpusText(cpus)} CPU, ${memoryMb} MB, ${slots} slots`;
+	const pool = (role, { cpus, memoryMb, slots }) => {
+		const count = processors?.[role] ?? null;
+		const onProcessors = count === null ? "" : ` (${processorsText(count)})`;
+		return `${role} ${cpusText(cpus)} CPU${onProcessors}, ${memoryMb} MB, ${slots} slots`;
+	};
 	return [
 		`reserve ${cpusText(reserve.cpus)} CPU, ${reserve.memoryMb} MB`,
 		pool("monitor", monitor),
@@ -7023,6 +7225,18 @@ const nodeTools = [
 		input: z.object({ node: nodeField }),
 		run: async ({ node }, run) => nodeDetailOf(run.api, await resolveNode(run, node))
 	}),
+	defineTool({
+		name: "node_metrics",
+		title: "Show what the host of a node and its agents used",
+		description: "Show the CPU, memory, load, disks and GPU of the host of a node over a range, and what each agent on it used over the whole range: the agents of the projects the caller belongs to, or every agent for an admin of the organization.",
+		operations: ["getNodeMetrics"],
+		safety: "read",
+		input: z.object({
+			node: nodeField,
+			range: z.enum(metricsRanges).default("1h")
+		}),
+		run: async ({ node, range }, run) => nodeMetricsOf(run.api, await resolveNode(run, node), range)
+	}),
 	defineTool({
 		name: "node_split_set",
 		title: "Split a node into pools",
@@ -9663,6 +9877,7 @@ const capabilitiesOf = (node) => {
 	const { sandbox, uidIsolation } = node.capabilities;
 	return `sandbox ${sandbox ? "yes" : "no"}, uid isolation ${uidIsolation ? "yes" : "no"}`;
 };
+const stateOf = (node) => node.state === "outdated" ? `outdated: runs ${node.version ?? "-"}, needs an update to ${minimumNodeVersion} or later` : node.state;
 const registrationOf = (node) => node.registrationExpiresAt === null ? "-" : `a token waits until ${node.registrationExpiresAt}`;
 const storageOf = ({ state, freeBytes, totalBytes, path }) => `${state}, ${gibibytes(freeBytes)} free of ${gibibytes(totalBytes)} at ${path}`;
 const shapeText = ({ size, volumeGb }) => `${size} with a volume of ${volumeGb} GB`;
@@ -9684,14 +9899,23 @@ const operationRowsOf = (operation) => {
 		...error === null ? [] : [["error", error]]
 	];
 };
-const runtimeRowsOf = (runtime) => [
+const lagOf = ({ oldestCursorLagSeconds }) => oldestCursorLagSeconds === null ? "-" : `${oldestCursorLagSeconds} s`;
+const sandboxRowsOf = ({ sandbox }) => sandbox.enabled ? [
+	["sandboxes", `enabled, image ${sandbox.image.tag}`],
+	["agents with docker", String(sandbox.agentsWithSandbox)],
+	["sidecars running", String(sandbox.sidecarsRunning)],
+	["sandbox volumes", sandbox.volumeBytes === null ? "not measured yet" : bytesOf(sandbox.volumeBytes)]
+] : [["sandboxes", "disabled, SANDBOX_ENABLED is off on the node"]];
+const runtimeRowsOf = (runtime, engine) => [
 	["reported", runtime.reportedAt],
 	["docker", runtime.docker.lastError === null ? runtime.docker.state : `${runtime.docker.state}: ${runtime.docker.lastError}`],
 	["data storage", storageOf(runtime.storage.data)],
 	["engine storage", storageOf(runtime.storage.engine)],
 	["last reconcile", runtime.reconcile.lastTickError === null ? runtime.reconcile.lastTickAt ?? "never" : `${runtime.reconcile.lastTickAt ?? "never"}: ${runtime.reconcile.lastTickError}`],
 	["agents", `${runtime.reconcile.agentsActive} active, ${runtime.reconcile.agentsQueued} queued`],
-	["log readers", String(runtime.ingest.readers)]
+	["log readers", String(runtime.ingest.readers)],
+	["oldest cursor lag", lagOf(runtime.ingest)],
+	...engine === "native" ? [] : sandboxRowsOf(runtime)
 ];
 const sessionsText = (count, noun) => `${String(count)} ${noun}${count === 1 ? "" : "s"}`;
 const heldPoolsOf = ({ held = [] }) => held;
@@ -9714,7 +9938,7 @@ const lastUpdateOf = ({ update }) => {
 const nodeDetailsText = (node) => [
 	renderTable([{ header: "FIELD" }, { header: "VALUE" }], [
 		["name", node.name],
-		["state", node.state],
+		["state", stateOf(node)],
 		["provider", node.provider],
 		...machineRowsOf(node.machine),
 		...operationRowsOf(node.operation),
@@ -9725,7 +9949,7 @@ const nodeDetailsText = (node) => [
 		["data root", node.host?.dataRoot ?? "-"],
 		["capabilities", capabilitiesOf(node)],
 		["offers", node.offered.length === 0 ? "-" : node.offered.join(", ")],
-		["split", splitSummaryOf(node.split)],
+		["split", splitSummaryOf(node.split, processorCountsOf(node))],
 		["registration", registrationOf(node)],
 		["connected", node.connectedAt ?? "never"],
 		["last seen", node.lastSeenAt ?? "never"],
@@ -9751,9 +9975,9 @@ const nodeDetailsText = (node) => [
 	])),
 	"",
 	...node.runtime === null ? ["The node has reported no runtime yet."] : [
-		renderTable([{ header: "RUNTIME" }, { header: "VALUE" }], runtimeRowsOf(node.runtime)),
+		renderTable([{ header: "RUNTIME" }, { header: "VALUE" }], runtimeRowsOf(node.runtime, node.engine)),
 		"",
-		poolsText(node.runtime.pools)
+		poolsText(node.runtime.pools, node.split)
 	]
 ].join("\n");
 const installCommandsOf = (origin) => [
@@ -9880,6 +10104,7 @@ const createNodesCommand = (adaptersOf) => defineGroup({
 				return printed(run, await nodeDetailOf(run.api, reference), nodeDetailsText);
 			}
 		}),
+		createNodeMetricsCommand(adaptersOf),
 		createSplitCommand(adaptersOf),
 		defineCommand({
 			name: "create",

package/package.json

@@ -15,7 +15,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.2.0",
+  "version": "1.4.0",
   "dependencies": {
     "@clack/prompts": "1.8.1",
     "@modelcontextprotocol/server": "2.1.0",