@indigoai-us/hq-cli 5.74.0 → 5.76.0

package/src/commands/outposts.ts

@@ -41,23 +41,51 @@ import {
   type BillingErrorPayload,
 } from "../utils/billing-gate.js";
 
+/**
+ * hq-pro's per-person cap envelope on a `409` provision block. Unlike every
+ * other `/outpost/*` failure this body carries NO `message`/`error` field —
+ * only the cap facts — so it has to be decoded structurally or the reason
+ * degrades to a bare `res.statusText` ("Conflict").
+ */
+export interface OutpostCappedPayload {
+  limit: number;
+  outposts: OutpostSummary[];
+}
+
+/** Decode hq-pro's `{ capped, limit, outposts }` cap envelope, if present. */
+export function parseCappedPayload(
+  body: unknown,
+): OutpostCappedPayload | undefined {
+  if (!body || typeof body !== "object") return undefined;
+  const b = body as { capped?: unknown; limit?: unknown; outposts?: unknown };
+  if (b.capped !== true) return undefined;
+  return {
+    limit: typeof b.limit === "number" ? b.limit : 0,
+    outposts: Array.isArray(b.outposts) ? (b.outposts as OutpostSummary[]) : [],
+  };
+}
+
 /** A non-2xx from the `/outpost/*` control plane. Carries status + `step`. */
 export class OutpostHttpError extends Error {
   status: number;
   step?: string;
   /** hq-pro's billing envelope on a `402 billing_required` provision block. */
   billing?: BillingErrorPayload;
+  /** hq-pro's cap envelope on a `409` provision block. */
+  capped?: OutpostCappedPayload;
   constructor(
     status: number,
     message: string,
     step?: string,
     billing?: BillingErrorPayload,
+    capped?: OutpostCappedPayload,
   ) {
     super(message);
     this.name = "OutpostHttpError";
     this.status = status;
     this.step = step;
     this.billing = billing;
+    this.capped = capped;
   }
 }
 
@@ -105,6 +133,7 @@ export async function outpostRequest<T>(opts: {
       message,
       body.step,
       parseBillingPayload(body),
+      parseCappedPayload(body),
     );
   }
   return (await res.json()) as T;
@@ -113,9 +142,11 @@ export async function outpostRequest<T>(opts: {
 /**
  * Provision the caller's Outpost. Sends the cached Cognito refresh token so the
  * box can authenticate AS the caller (the same body the console's
- * `provisionMyOutpost` sends). Idempotent server-side: a caller already at their
- * per-person cap gets their existing box back rather than a duplicate. The
- * refresh token is sent over HTTPS and NEVER printed.
+ * `provisionMyOutpost` sends). No duplicate is ever created: a caller already at
+ * their per-person cap gets a `409` whose body lists their existing boxes —
+ * thrown here as an `OutpostHttpError` carrying `capped` (hq-pro checks the cap
+ * BEFORE activation billing, so a capped call is never charged). The refresh
+ * token is sent over HTTPS and NEVER printed.
  */
 export async function provisionOutpost(
   token: string,
@@ -268,6 +299,8 @@ export interface OutpostExecSubmission {
   instanceId: string;
   commandId: string;
   outputPrefix: string;
+  /** Shell budget applied server-side (AWS-RunShellScript executionTimeout). */
+  executionTimeoutSeconds?: number;
 }
 
 /** Poll response from `mode: "result"`; streams arrive only when terminal. */
@@ -300,12 +333,17 @@ export async function submitExec(
   token: string,
   command: string,
   outpostId?: string,
+  timeoutSeconds?: number,
 ): Promise<OutpostExecSubmission> {
   return outpostRequest({
     token,
     path: "/outpost/exec",
     method: "POST",
-    body: { mode: "submit", command },
+    body: {
+      mode: "submit",
+      command,
+      ...(timeoutSeconds !== undefined ? { timeoutSeconds } : {}),
+    },
     query: outpostId ? { outpostId } : undefined,
   });
 }
@@ -473,6 +511,31 @@ function ensureTrailingNewline(s: string): string {
 // Command registration
 // ---------------------------------------------------------------------------
 
+/**
+ * Explain a `409` per-person cap. hq-pro checks the cap BEFORE activation
+ * billing, so nothing was charged — worth saying, since the caller just
+ * confirmed a recurring charge to get here.
+ */
+function surfaceOutpostCapped(capped: OutpostCappedPayload): void {
+  const owned = capped.outposts.length;
+  console.error(
+    chalk.yellow(
+      `You're already at your Outpost limit (${owned} of ${capped.limit}). ` +
+        `No new box was provisioned and you have not been charged.`,
+    ),
+  );
+  for (const o of capped.outposts) {
+    const detail = [o.state, o.instanceName, o.region]
+      .filter(Boolean)
+      .join("  ");
+    console.error(`  ${o.outpostId}  ${detail}`);
+  }
+  console.error(chalk.dim("Inspect it: hq outposts status"));
+  console.error(
+    chalk.dim("Or tear it down first: hq outposts destroy --id <id> --yes"),
+  );
+}
+
 function fail(err: unknown): never {
   if (err instanceof OutpostHttpError) {
     console.error(chalk.red(err.message));
@@ -506,8 +569,7 @@ export interface SelfDeployDependencies {
   ) => ReturnType<typeof spawnSync>;
   readTextFile: (file: string) => string;
   loadCachedTokens: () =>
-    | { refreshToken?: string; idToken?: string }
-    | undefined;
+    { refreshToken?: string; idToken?: string } | undefined;
   getUid: () => number | undefined;
   isStdinTty: () => boolean;
   confirm: () => Promise<boolean>;
@@ -588,10 +650,9 @@ function hqIdentityFromSession(session: {
   try {
     const payload = session.idToken.split(".")[1];
     if (!payload) return "your cached HQ session";
-    const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as Record<
-      string,
-      unknown
-    >;
+    const claims = JSON.parse(
+      Buffer.from(payload, "base64url").toString("utf8"),
+    ) as Record<string, unknown>;
     for (const key of [
       "email",
       "preferred_username",
@@ -691,9 +752,10 @@ function runPrivileged(
   runChecked(deps, "sudo", [command, ...args], description, options);
 }
 
-function selfDeployPreflight(
-  deps: SelfDeployDependencies,
-): { refreshToken?: string; idToken?: string } {
+function selfDeployPreflight(deps: SelfDeployDependencies): {
+  refreshToken?: string;
+  idToken?: string;
+} {
   let osRelease: string;
   try {
     osRelease = deps.readTextFile("/etc/os-release");
@@ -733,7 +795,9 @@ function selfDeployPreflight(
 
   const session = deps.loadCachedTokens();
   if (!session?.refreshToken) {
-    throw selfDeployError("no HQ login session was found. Run `hq login`, then re-run this command.");
+    throw selfDeployError(
+      "no HQ login session was found. Run `hq login`, then re-run this command.",
+    );
   }
   return session;
 }
@@ -756,7 +820,9 @@ async function selfDeployOutpost(
       ),
     );
     if (!deps.isStdinTty()) {
-      throw new Error("Confirmation requires a TTY. Pass --yes to continue non-interactively.");
+      throw new Error(
+        "Confirmation requires a TTY. Pass --yes to continue non-interactively.",
+      );
     }
     if (!(await deps.confirm())) {
       throw new Error("Self-deploy cancelled.");
@@ -799,12 +865,7 @@ async function selfDeployOutpost(
       stdio: ["pipe", "ignore", "pipe"],
     },
   );
-  runPrivileged(
-    deps,
-    "systemctl",
-    ["daemon-reload"],
-    "Reloading systemd",
-  );
+  runPrivileged(deps, "systemctl", ["daemon-reload"], "Reloading systemd");
   runPrivileged(
     deps,
     "systemctl",
@@ -812,9 +873,19 @@ async function selfDeployOutpost(
     "Enabling outpost-sync.service",
   );
 
-  console.log(chalk.green("This box is now a self-hosted HQ outpost and will sync all your company vaults continuously."));
-  console.log(chalk.dim("Check it with: systemctl status outpost-sync.service"));
-  console.log(chalk.dim("It is unregistered and unmanaged by hq-pro (no console entry or remote management)."));
+  console.log(
+    chalk.green(
+      "This box is now a self-hosted HQ outpost and will sync all your company vaults continuously.",
+    ),
+  );
+  console.log(
+    chalk.dim("Check it with: systemctl status outpost-sync.service"),
+  );
+  console.log(
+    chalk.dim(
+      "It is unregistered and unmanaged by hq-pro (no console entry or remote management).",
+    ),
+  );
 }
 
 // ---------------------------------------------------------------------------
@@ -933,7 +1004,9 @@ function runBestEffort(
     return false;
   }
   if (!result || result.error || result.status !== 0) {
-    console.warn(`replica-sync: ${description} did not complete cleanly — continuing.`);
+    console.warn(
+      `replica-sync: ${description} did not complete cleanly — continuing.`,
+    );
     return false;
   }
   return true;
@@ -954,7 +1027,17 @@ function authGitHubViaVault(deps: ReplicaSyncDependencies): void {
   const authed = runBestEffort(
     deps,
     "hq",
-    ["secrets", "--personal", "exec", "--only", "GITHUB_TOKEN", "--", "bash", "-c", ghLogin],
+    [
+      "secrets",
+      "--personal",
+      "exec",
+      "--only",
+      "GITHUB_TOKEN",
+      "--",
+      "bash",
+      "-c",
+      ghLogin,
+    ],
     "GitHub auth via vault",
   );
   if (authed) {
@@ -971,7 +1054,9 @@ function replicateRepos(deps: ReplicaSyncDependencies, hqRoot: string): void {
   try {
     manifestText = deps.readTextFile(manifestPath);
   } catch {
-    console.log("replica-sync: no personal/data/repos.yaml — skipping repo clone.");
+    console.log(
+      "replica-sync: no personal/data/repos.yaml — skipping repo clone.",
+    );
     return;
   }
 
@@ -983,7 +1068,9 @@ function replicateRepos(deps: ReplicaSyncDependencies, hqRoot: string): void {
 
   const missing = repos.filter(
     (repo) =>
-      !deps.pathExists(path.join(hqRoot, "repos", repo.visibility, repo.name, ".git")),
+      !deps.pathExists(
+        path.join(hqRoot, "repos", repo.visibility, repo.name, ".git"),
+      ),
   );
   if (missing.length === 0) {
     console.log("replica-sync: all repos already present.");
@@ -1018,7 +1105,9 @@ async function replicaSyncOutpost(
   // signed in has nothing to pull — exit cleanly so the timer stays green.
   const session = deps.loadCachedTokens();
   if (!session?.refreshToken) {
-    console.log("replica-sync: no HQ session on this box yet — nothing to replicate.");
+    console.log(
+      "replica-sync: no HQ session on this box yet — nothing to replicate.",
+    );
     return;
   }
 
@@ -1034,7 +1123,15 @@ async function replicaSyncOutpost(
   runBestEffort(
     deps,
     "hq",
-    ["sync", "pull", "--personal", "--hq-root", hqRoot, "--on-conflict", "keep"],
+    [
+      "sync",
+      "pull",
+      "--personal",
+      "--hq-root",
+      hqRoot,
+      "--on-conflict",
+      "keep",
+    ],
     "personal vault pull",
   );
 
@@ -1081,7 +1178,11 @@ export function registerOutpostsCommand(
     .description(
       "Replicate your full HQ onto this box (personal pull + core rescue + repos). Runs on a timer.",
     )
-    .option("--hq-root <path>", "HQ root to replicate into", deps.defaultHqRoot())
+    .option(
+      "--hq-root <path>",
+      "HQ root to replicate into",
+      deps.defaultHqRoot(),
+    )
     .action(async (opts: { hqRoot?: string }) => {
       // Best-effort background job: never hard-fail the systemd unit on a
       // transient step. Swallow, log, and exit 0.
@@ -1098,7 +1199,10 @@ export function registerOutpostsCommand(
     .command("provision")
     .alias("create")
     .description("Provision a new Outpost ($80/month — requires --yes)")
-    .option("--runtime <runtime>", "Agent runtime: claude | codex (default claude)")
+    .option(
+      "--runtime <runtime>",
+      "Agent runtime: claude | codex (default claude)",
+    )
     .option("--disk <gb>", "Root disk size in GB (EC2 only)")
     .option(
       "--client-ip <ip>",
@@ -1107,20 +1211,43 @@ export function registerOutpostsCommand(
     .option("--yes", "Confirm the $80/month charge (required to provision)")
     .action(async function (
       this: Command,
-      opts: { runtime?: string; disk?: string; clientIp?: string; yes?: boolean },
+      opts: {
+        runtime?: string;
+        disk?: string;
+        clientIp?: string;
+        yes?: boolean;
+      },
     ) {
       try {
+        // Reject an unrecognized runtime rather than resolving it to claude:
+        // `--runtime codx` would otherwise hand back a silently Claude box.
+        if (
+          opts.runtime !== undefined &&
+          opts.runtime !== "claude" &&
+          opts.runtime !== "codex"
+        ) {
+          console.error(
+            chalk.red(
+              `Invalid --runtime '${opts.runtime}': must be 'claude' or 'codex'.`,
+            ),
+          );
+          process.exit(1);
+        }
         const agentRuntime =
           opts.runtime === "codex"
             ? "codex"
-            : opts.runtime
+            : opts.runtime === "claude"
               ? "claude"
               : undefined;
         let diskSizeGb: number | undefined;
         if (opts.disk !== undefined) {
           diskSizeGb = Number(opts.disk);
           if (!Number.isFinite(diskSizeGb) || diskSizeGb <= 0) {
-            console.error(chalk.red(`Invalid --disk '${opts.disk}': must be a positive number of GB.`));
+            console.error(
+              chalk.red(
+                `Invalid --disk '${opts.disk}': must be a positive number of GB.`,
+              ),
+            );
             process.exit(1);
           }
         }
@@ -1137,7 +1264,9 @@ export function registerOutpostsCommand(
         const refreshToken = loadCachedTokens()?.refreshToken;
         if (!refreshToken) {
           console.error(
-            chalk.red("No cached session found — run `hq login` first, then re-run."),
+            chalk.red(
+              "No cached session found — run `hq login` first, then re-run.",
+            ),
           );
           process.exit(1);
         }
@@ -1162,6 +1291,16 @@ export function registerOutpostsCommand(
             await surfaceBillingRequired(token, err.billing);
             process.exit(1);
           }
+          // Already at the per-person cap → say so and name the box they own,
+          // not a bare "Conflict".
+          if (
+            err instanceof OutpostHttpError &&
+            err.status === 409 &&
+            err.capped
+          ) {
+            surfaceOutpostCapped(err.capped);
+            process.exit(1);
+          }
           throw err;
         }
       } catch (err) {
@@ -1191,7 +1330,10 @@ export function registerOutpostsCommand(
           4,
           ...rows.map((r) => (r.instanceName ?? "").length),
         );
-        const regionW = Math.max(6, ...rows.map((r) => (r.region ?? "").length));
+        const regionW = Math.max(
+          6,
+          ...rows.map((r) => (r.region ?? "").length),
+        );
         const rtW = Math.max(
           7,
           ...rows.map((r) => (r.agentRuntime ?? "").length),
@@ -1250,26 +1392,180 @@ export function registerOutpostsCommand(
   outposts
     .command("exec <command...>")
     .description(
-      "Run a shell command on an Outpost and print its output (use -- before flags meant for the remote command)",
+      "Run a shell command on an Outpost and print its output (use -- before flags meant for the remote command). " +
+        "Default is synchronous (API Gateway ~20s cap). Use --async for long jobs, or --detach to print the commandId and return immediately.",
     )
     .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+    .option(
+      "--async",
+      "Submit via the async transport and wait for completion (bypasses the ~20s sync cap; shell budget defaults to 48h)",
+    )
+    .option(
+      "--detach",
+      "Submit via the async transport, print commandId, and return immediately (pair with `hq outposts exec-result --wait`)",
+    )
+    .option(
+      "--timeout-seconds <n>",
+      "Async shell budget in seconds (AWS-RunShellScript executionTimeout; 1..172800). Implies --async unless --detach is set.",
+      (v: string) => {
+        const n = Number(v);
+        if (!Number.isInteger(n)) {
+          throw new Error("--timeout-seconds must be an integer");
+        }
+        return n;
+      },
+    )
     .option("--json", "Emit raw JSON")
     .action(async function (
       this: Command,
       commandParts: string[],
-      opts: { id?: string; json?: boolean },
+      opts: {
+        id?: string;
+        json?: boolean;
+        async?: boolean;
+        detach?: boolean;
+        timeoutSeconds?: number;
+      },
     ) {
       try {
         const command = joinCommandParts(commandParts);
         if (!command.trim()) {
-          console.error(chalk.red("No command given. Usage: hq outposts exec -- <command>"));
+          console.error(
+            chalk.red("No command given. Usage: hq outposts exec -- <command>"),
+          );
+          process.exit(1);
+        }
+        if (opts.async && opts.detach) {
+          console.error(
+            chalk.red("Use either --async (submit + wait) or --detach (submit only), not both."),
+          );
           process.exit(1);
         }
+        // --timeout-seconds only applies to the async path; bare use implies --async.
+        const useAsync =
+          Boolean(opts.async) ||
+          Boolean(opts.detach) ||
+          opts.timeoutSeconds !== undefined;
+        if (opts.timeoutSeconds !== undefined) {
+          if (
+            !Number.isInteger(opts.timeoutSeconds) ||
+            opts.timeoutSeconds < 1 ||
+            opts.timeoutSeconds > 172_800
+          ) {
+            console.error(
+              chalk.red(
+                "--timeout-seconds must be an integer between 1 and 172800 (48h, the AWS-RunShellScript max)",
+              ),
+            );
+            process.exit(1);
+          }
+        }
         const token = await ensureCognitoToken();
 
         // Run from the box's HQ folder by default (works over both SSM and SSH).
         const remoteCommand = withRemoteHqDir(command);
 
+        if (useAsync) {
+          try {
+            const submitted = await submitExec(
+              token,
+              remoteCommand,
+              opts.id,
+              opts.timeoutSeconds,
+            );
+            if (opts.detach) {
+              const output = {
+                commandId: submitted.commandId,
+                ...(submitted.executionTimeoutSeconds !== undefined
+                  ? { executionTimeoutSeconds: submitted.executionTimeoutSeconds }
+                  : opts.timeoutSeconds !== undefined
+                    ? { executionTimeoutSeconds: opts.timeoutSeconds }
+                    : {}),
+              };
+              if (opts.json) {
+                process.stdout.write(JSON.stringify(output) + "\n");
+              } else {
+                printKeyValues(output);
+                console.error(
+                  chalk.dim(
+                    "Submitted. Poll with: hq outposts exec-result --command-id " +
+                      submitted.commandId +
+                      (opts.id ? ` --id ${opts.id}` : "") +
+                      " --wait",
+                  ),
+                );
+              }
+              return;
+            }
+
+            // --async (or --timeout-seconds without --detach): wait for terminal.
+            if (!opts.json) {
+              console.error(
+                chalk.dim(
+                  `Submitted ${submitted.commandId}; waiting for completion…`,
+                ),
+              );
+            }
+            const result = await waitForExecResult(
+              token,
+              submitted.commandId,
+              opts.id,
+            );
+            if (opts.json) {
+              process.stdout.write(
+                JSON.stringify(
+                  {
+                    commandId: submitted.commandId,
+                    done: result.done,
+                    status: result.status,
+                    exitCode: result.exitCode ?? null,
+                    stdout: result.stdout ?? "",
+                    stderr: result.stderr ?? "",
+                    truncated: result.truncated ?? false,
+                  },
+                  null,
+                  2,
+                ) + "\n",
+              );
+            } else {
+              if (result.stdout) process.stdout.write(result.stdout);
+              if (result.stderr) process.stderr.write(result.stderr);
+              if (result.truncated) {
+                console.error(
+                  chalk.yellow(
+                    "(output truncated — redirect to a file on the box for full output)",
+                  ),
+                );
+              }
+              if (result.status !== "Success" && result.exitCode === null) {
+                console.error(
+                  chalk.yellow(`(command ended with SSM status: ${result.status})`),
+                );
+              }
+            }
+            process.exitCode =
+              typeof result.exitCode === "number" ? result.exitCode : 0;
+            return;
+          } catch (err) {
+            // Async requires EC2/SSM. Lightsail has no async channel — refuse
+            // rather than silently falling back to a live SSH hold, which is
+            // the exact timeout failure mode --async is meant to escape.
+            if (
+              err instanceof OutpostHttpError &&
+              err.step === "platform-unsupported"
+            ) {
+              console.error(
+                chalk.red(
+                  "Async exec requires an EC2 Outpost (SSM). This box is Lightsail — " +
+                    "re-provision on EC2, or run a short sync command / SSH session instead.",
+                ),
+              );
+              process.exit(1);
+            }
+            throw err;
+          }
+        }
+
         try {
           const result = await execOutpost(token, remoteCommand, opts.id);
           if (opts.json) {
@@ -1280,11 +1576,17 @@ export function registerOutpostsCommand(
             if (result.stderr) process.stderr.write(result.stderr);
             if (result.truncated) {
               console.error(
-                chalk.yellow("(output truncated by SSM's inline limit — redirect to a file on the box for full output)"),
+                chalk.yellow(
+                  "(output truncated by SSM's inline limit — redirect to a file on the box for full output)",
+                ),
               );
             }
             if (result.status !== "Success" && result.exitCode === null) {
-              console.error(chalk.yellow(`(command ended with SSM status: ${result.status})`));
+              console.error(
+                chalk.yellow(
+                  `(command ended with SSM status: ${result.status})`,
+                ),
+              );
             }
           }
           // Propagate the remote exit code so `hq outposts exec -- false` exits 1.
@@ -1299,7 +1601,9 @@ export function registerOutpostsCommand(
             const access = await getOutpostSshAccess(token, opts.id);
             const ssh = execViaSsh(access, remoteCommand);
             if (ssh.error) {
-              console.error(chalk.red(`Could not run the command over SSH: ${ssh.error}`));
+              console.error(
+                chalk.red(`Could not run the command over SSH: ${ssh.error}`),
+              );
               process.exit(1);
             }
             if (opts.json) {
@@ -1369,25 +1673,69 @@ export function registerOutpostsCommand(
 
   outposts
     .command("exec-submit <command...>")
-    .description("Submit an asynchronous shell command to an Outpost")
+    .description(
+      "Submit an asynchronous shell command to an Outpost (returns immediately with commandId; shell budget defaults to 48h)",
+    )
     .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+    .option(
+      "--timeout-seconds <n>",
+      "Shell budget in seconds (AWS-RunShellScript executionTimeout; 1..172800)",
+      (v: string) => {
+        const n = Number(v);
+        if (!Number.isInteger(n)) {
+          throw new Error("--timeout-seconds must be an integer");
+        }
+        return n;
+      },
+    )
     .option("--json", "Emit raw JSON")
     .action(async function (
       this: Command,
       commandParts: string[],
-      opts: { id?: string; json?: boolean },
+      opts: { id?: string; json?: boolean; timeoutSeconds?: number },
     ) {
       try {
         const command = joinCommandParts(commandParts);
         if (!command.trim()) {
           console.error(
-            chalk.red("No command given. Usage: hq outposts exec-submit -- <command>"),
+            chalk.red(
+              "No command given. Usage: hq outposts exec-submit -- <command>",
+            ),
           );
           process.exit(1);
         }
+        if (opts.timeoutSeconds !== undefined) {
+          if (
+            !Number.isInteger(opts.timeoutSeconds) ||
+            opts.timeoutSeconds < 1 ||
+            opts.timeoutSeconds > 172_800
+          ) {
+            console.error(
+              chalk.red(
+                "--timeout-seconds must be an integer between 1 and 172800 (48h)",
+              ),
+            );
+            process.exit(1);
+          }
+        }
         const token = await ensureCognitoToken();
-        const submitted = await submitExec(token, command, opts.id);
-        const output = { commandId: submitted.commandId };
+        // exec-submit is the raw fire-and-forget path — do NOT wrap with
+        // withRemoteHqDir here (callers that want the HQ cwd use `exec --async`
+        // or prefix their own cd). Matches the existing contract.
+        const submitted = await submitExec(
+          token,
+          command,
+          opts.id,
+          opts.timeoutSeconds,
+        );
+        const output = {
+          commandId: submitted.commandId,
+          ...(submitted.executionTimeoutSeconds !== undefined
+            ? { executionTimeoutSeconds: submitted.executionTimeoutSeconds }
+            : opts.timeoutSeconds !== undefined
+              ? { executionTimeoutSeconds: opts.timeoutSeconds }
+              : {}),
+        };
         if (opts.json) {
           process.stdout.write(JSON.stringify(output) + "\n");
         } else {
@@ -1401,7 +1749,10 @@ export function registerOutpostsCommand(
   outposts
     .command("exec-result")
     .description("Fetch the result of an asynchronous Outpost command")
-    .requiredOption("--command-id <commandId>", "Command id returned by exec-submit")
+    .requiredOption(
+      "--command-id <commandId>",
+      "Command id returned by exec-submit",
+    )
     .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
     .option("--wait", "Poll until the command reaches a terminal state")
     .option("--json", "Emit raw JSON")
@@ -1504,7 +1855,11 @@ export function registerOutpostsCommand(
       try {
         const trimmed = code.trim();
         if (!trimmed) {
-          console.error(chalk.red("Provide the sign-in code: hq outposts login-code <code>"));
+          console.error(
+            chalk.red(
+              "Provide the sign-in code: hq outposts login-code <code>",
+            ),
+          );
           process.exit(1);
         }
         const token = await ensureCognitoToken();