@indigoai-us/hq-cloud 6.18.87 → 6.18.89

package/dist/outposts/command.js

@@ -9,15 +9,19 @@
  *
  * Personal Outposts are caller-scoped: hq-pro keys those `/outpost/*` calls on
  * the caller's Cognito sub. `--company <slug>` switches the same provision and
- * status commands onto the company Outpost, and `outposts jobs register` sends
- * a company job for server acceptance. `--id <outpostId>` still selects a
- * personal box; when omitted, personal calls target the caller's primary slot.
+ * status commands onto the company Outpost. `outposts jobs` registers, edits,
+ * pauses, resumes, deletes, and runs a company job. `--id <outpostId>` still
+ * selects a personal box; when omitted, personal calls target the caller's primary slot.
  *
  * Subcommands:
  *   outposts provision [--company]  — provision a box (paid; requires --yes)
  *   outposts list                   — every personal Outpost you own
+ *   outposts list --company         - a company's Outposts (name, id, state, jobs)
+ *   outposts create --company --name - another named company Outpost (billed to the company)
+ *   --outpost <name|id>             - picks a company Outpost on status, login, login-code
+ *                                     and jobs register; optional when there is only one
  *   outposts status [--id|--company] — live detail for one box
- *   outposts jobs register          — register a company job, print its revision
+ *   outposts jobs                  — register, edit, pause, resume, delete, run-now
  *   outposts exec <command...>      — run a command on the box (sync/async/detach)
  *   outposts exec-stage             — presign an input upload for an async command
  *   outposts exec-submit <cmd...>   — fire-and-forget async submit
@@ -25,7 +29,7 @@
  *   outposts codex-enable [--id]    — enable / retry Codex on the box
  *   outposts login [--id]           — request a fresh login URL
  *   outposts login-code <code>      — hand the box its Claude sign-in code
- *   outposts destroy [--id] --yes   — tear the box down (destructive; flag-guarded)
+ *   outposts destroy [--id | --company [--outpost]] [--yes] [--json] — tear a box down (destructive; confirmed first)
  *   outposts heartbeat              — hidden; box-side systemd loop
  *   outposts session-host           — hidden; box-side sessions for the desktop app
  *   outposts self-deploy            — hidden; make THIS host an unmanaged outpost
@@ -38,7 +42,8 @@
 import chalk from "chalk";
 import * as fs from "node:fs";
 import { OUTPOST_PRICE_CENTS } from "./billing.js";
-import { buildCompanyJobDefinition, companyPayerLabel, companyProvisionProgress, CompanyTargetError, describeCompanySignIn, explainCompanyFailure, isCompanySlug, parseCompanySignIn, isProvisionOutcomeUnknown, mergeCompanyJobs, } from "./company.js";
+import { buildCompanyJobDefinition, mergeCompanyJobEdit, companyPayerLabel, companyProvisionProgress, CompanyTargetError, JobDefinitionError, describeCompanySignIn, explainCompanyFailure, isCompanySlug, parseCompanySignIn, companyCreateContinues, isProvisionOutcomeUnknown, mergeCompanyJobs, provisionErrorSkipsStatusRead, } from "./company.js";
+import { companyOutpostChargeLine, companyOutpostsUnreadableLine, CompanyOutpostSelectError, explainCompanyOutpostCreateFailure, explainCompanyOutpostSelect, isCompanyOutpostId, isOutpostName, LEGACY_OUTPOST_NAME, safeLifecycle, selectCompanyOutpost, } from "./company-outposts.js";
 import { confirmChargeOrExit, confirmCompanyOutpostChargeOrExit, surfaceBillingBlocked, } from "./cli-billing.js";
 import { EXEC_MAX_TIMEOUT_SECONDS, OutpostsClient, } from "./client.js";
 import { OutpostExecWaitError, OutpostHttpError } from "./errors.js";
@@ -77,8 +82,39 @@ function fail(err) {
     }
     process.exit(1);
 }
-function failCompany(slug, err, intent) {
-    console.error(explainCompanyFailure(slug, err, intent));
+function companyFailureCode(err) {
+    if (err instanceof CompanyOutpostSelectError)
+        return err.reason;
+    if (err instanceof OutpostHttpError) {
+        if (err.code)
+            return err.code;
+        if (err.status === 403)
+            return "admin_required";
+        if (err.status === 401)
+            return "unauthorized";
+    }
+    if (err instanceof JobDefinitionError)
+        return "invalid_definition";
+    if (err instanceof CompanyTargetError)
+        return err.reason;
+    return "request_failed";
+}
+function failCompany(slug, err, intent, json) {
+    const message = err instanceof CompanyOutpostSelectError
+        ? explainCompanyOutpostSelect(isCompanySlug(slug) ? slug : "that company", err)
+        : explainCompanyFailure(slug, err, intent, json?.jobId);
+    if (json) {
+        process.stdout.write(JSON.stringify({
+            ok: false,
+            action: json.action,
+            jobId: json.jobId,
+            code: companyFailureCode(err),
+            message,
+        }) + "\n");
+    }
+    else {
+        console.error(message);
+    }
     process.exit(1);
 }
 async function requireCompany(client, slug) {
@@ -96,6 +132,151 @@ async function requireCompany(client, slug) {
         throw err;
     }
 }
+/**
+ * The Outpost a company command acts on. `--outpost` is optional when the
+ * company has one Outpost. The legacy Outpost has no outpostId, so callers
+ * send none and older servers see the request they always did.
+ */
+async function requireCompanyOutpost(client, company, flag, command) {
+    return selectCompanyOutpost(await client.listCompanyOutposts(company.uid), flag, command);
+}
+/** Exit when --outpost is passed without --company. */
+function rejectOutpostWithoutCompany(opts) {
+    if (opts.outpost !== undefined && opts.company === undefined) {
+        console.error(explainCompanyOutpostSelect("", new CompanyOutpostSelectError("needs_company")));
+        process.exit(1);
+    }
+}
+/** " --outpost <name>" for next-step hints, only when the company has a choice to make. */
+function outpostHint(outpost, passed) {
+    return passed !== undefined ? ` --outpost ${outpost.name}` : "";
+}
+/**
+ * `hq outposts list` is the only command that reads status after a rejected
+ * list query, and only to print the legacy row's state. The id from that
+ * read is not kept, so later commands still omit `outpostId`.
+ */
+async function legacyListWithLifecycle(client, companyUid, list) {
+    const row = list.outposts[0];
+    if (!list.legacy || list.outposts.length !== 1 || !row || row.lifecycle)
+        return list;
+    try {
+        const status = await client.companyStatus(companyUid);
+        const lifecycle = safeLifecycle(status.outpost?.lifecycle);
+        if (!lifecycle)
+            return list;
+        return { ...list, outposts: [{ ...row, lifecycle }] };
+    }
+    catch (err) {
+        // Only the server's coded "no Outpost" answer is an empty list. A codeless
+        // 404 is not proof, so it fails instead of suggesting a billed create.
+        if (err instanceof OutpostHttpError && err.status === 404 && err.code === "not_found") {
+            return { outposts: [], legacy: true };
+        }
+        throw err;
+    }
+}
+async function listCompanyOutpostsCommand(client, slug, asJson) {
+    const company = await requireCompany(client, slug);
+    const list = await legacyListWithLifecycle(client, company.uid, await client.listCompanyOutposts(company.uid));
+    const unreadable = list.unreadable ?? 0;
+    // Every row unreadable is not "no Outpost": fail instead of an empty list or the create hint.
+    if (list.outposts.length === 0 && unreadable > 0) {
+        console.error(companyOutpostsUnreadableLine(company.slug));
+        process.exit(1);
+    }
+    if (asJson) {
+        process.stdout.write(JSON.stringify({ company: company.slug, legacy: list.legacy, outposts: list.outposts, ...(unreadable > 0 ? { unreadable } : {}) }, null, 2) + "\n");
+        return;
+    }
+    if (list.outposts.length === 0) {
+        console.log(`${company.slug} does not have an Outpost yet.`);
+        console.log(`Next: hq outposts provision --company ${company.slug}`);
+        return;
+    }
+    const nameW = Math.max(4, ...list.outposts.map((o) => o.name.length));
+    const idW = Math.max(2, ...list.outposts.map((o) => (o.outpostId ?? "").length));
+    console.log(chalk.bold(["NAME".padEnd(nameW), "ID".padEnd(idW), "STATE"].join("  ")));
+    for (const o of list.outposts) {
+        console.log([
+            o.name.padEnd(nameW),
+            (o.outpostId ?? "").padEnd(idW),
+            o.lifecycle ?? "",
+        ].join("  "));
+    }
+    if (list.legacy) {
+        console.log(chalk.dim(`${company.slug} has one Outpost, shown as ${LEGACY_OUTPOST_NAME}.`));
+    }
+    if (unreadable > 0) {
+        console.log(chalk.yellow(`${unreadable} more Outpost row(s) could not be read and are not shown.`));
+    }
+}
+async function createCompanyOutpostCommand(client, host, opts, wait = {}) {
+    const json = opts.json === true;
+    const name = opts.name?.trim() ?? "";
+    if (!isOutpostName(name)) {
+        console.error("An Outpost needs a name of 1 to 32 lowercase letters, digits or dashes, such as research. " +
+            `Next: re-run with --company ${isCompanySlug(opts.company) ? opts.company : "<slug>"} --name <name>.`);
+        if (json) {
+            writeCompanyProvisionJson({ ok: false, company: opts.company, state: "not_created", reason: "invalid_name" });
+        }
+        process.exit(1);
+    }
+    let company;
+    try {
+        company = await requireCompany(client, opts.company);
+    }
+    catch (err) {
+        if (err && typeof err === "object")
+            failedBeforeCreate.add(err);
+        throw err;
+    }
+    const charge = companyOutpostChargeLine(companyPayerLabel(company));
+    const unnamed = `The name ${name} is not sent. This server creates the company's main Outpost.`;
+    if (!opts.yes) {
+        if (!host.isStdinTty()) {
+            console.error(`Creating ${company.slug}'s main Outpost costs ${charge}. ${unnamed} ` +
+                `Next: re-run with --yes to confirm this charge.`);
+            if (json) {
+                writeCompanyProvisionJson({
+                    ok: false,
+                    company: company.slug,
+                    state: "not_created",
+                    reason: "confirmation_required",
+                });
+            }
+            process.exit(1);
+        }
+        // In --json the prompt goes to stderr so stdout stays one object.
+        const prompt = `Create ${company.slug}'s main Outpost? ${charge}. ${unnamed} Type yes to confirm: `;
+        if (json)
+            process.stderr.write(prompt);
+        else
+            process.stdout.write(prompt);
+        if (!(await host.confirm())) {
+            if (json) {
+                console.error("Nothing was created or billed.");
+                writeCompanyProvisionJson({
+                    ok: false,
+                    company: company.slug,
+                    state: "not_created",
+                    reason: "confirmation_declined",
+                });
+            }
+            else {
+                console.log("Nothing was created or billed.");
+            }
+            return;
+        }
+    }
+    else {
+        provisionProgress(json, `Confirmed: ${charge}. ${unnamed}`);
+    }
+    await startCompanyOutpost(client, company, wait, {
+        json,
+        explainRefusal: (err) => explainCompanyOutpostCreateFailure(company.slug, err),
+    });
+}
 function printCompanyJobs(companySlug, jobs, healthAvailable) {
     if (jobs.length === 0) {
         console.log("No company jobs yet.");
@@ -108,116 +289,524 @@ function printCompanyJobs(companySlug, jobs, healthAvailable) {
     console.log(["JOB", "LAST RUN", "NEXT RUN", "STATUS"].join("  "));
     for (const job of jobs) {
         console.log([job.jobId, job.lastRunAt ?? "none", job.nextRunAt ?? "none", job.status].join("  "));
+        if (job.message)
+            console.log(`  ${job.message}`);
+        if (job.nextStep)
+            console.log(`  Next: ${job.nextStep}`);
     }
 }
 const COMPANY_PROVISION_POLL_MS = 5_000;
 // The create Lambda's own timeout is 600s.
 const COMPANY_PROVISION_MAX_WAIT_MS = 600_000;
 const COMPANY_PROVISION_PROGRESS_EVERY_MS = 30_000;
-async function provisionCompanyOutpost(client, slug, yes, wait = {}) {
-    const company = await requireCompany(client, slug);
+function writeCompanyProvisionJson(body) {
+    const payload = {
+        ok: body.ok,
+        company: body.company,
+        state: body.state,
+    };
+    if (body.outpostId)
+        payload.outpostId = body.outpostId;
+    if (body.code)
+        payload.code = body.code;
+    if (body.reason)
+        payload.reason = body.reason;
+    process.stdout.write(JSON.stringify(payload) + "\n");
+}
+/** Errors thrown before the create request was sent, so nothing can exist. */
+const failedBeforeCreate = new WeakSet();
+function companyProvisionFailureJson(company, err) {
+    if (err instanceof CompanyTargetError) {
+        return JSON.stringify({
+            ok: false,
+            company,
+            state: "not_created",
+            reason: err.reason,
+        }) + "\n";
+    }
+    const code = err instanceof OutpostHttpError ? err.code : undefined;
+    const reason = code ?? "request_failed";
+    let state = "unconfirmed";
+    if (err && typeof err === "object" && failedBeforeCreate.has(err))
+        state = "not_created";
+    else if (code === "already_exists" || code === "billing_required")
+        state = "blocked";
+    else if (code === "feature_disabled" ||
+        code === "unavailable" ||
+        code === "dependencies_unavailable" ||
+        code === "unauthorized" ||
+        code === "forbidden" ||
+        code === "admin_required" ||
+        (typeof code === "string" && code.startsWith("invalid_"))) {
+        state = "not_created";
+    }
+    return JSON.stringify({
+        ok: false,
+        company,
+        state,
+        ...(code ? { code } : {}),
+        reason,
+    }) + "\n";
+}
+function provisionProgress(json, line) {
+    if (json)
+        console.error(chalk.dim(line));
+    else
+        console.log(chalk.dim(line));
+}
+function correlationFrom(outpost, err) {
+    const fromError = err instanceof OutpostHttpError ? err : undefined;
+    const attemptId = typeof outpost?.attemptId === "string" ? outpost.attemptId : fromError?.attemptId;
+    const operationId = typeof outpost?.operationId === "string" ? outpost.operationId : fromError?.operationId;
+    return {
+        ...(attemptId ? { attemptId } : {}),
+        ...(operationId ? { operationId } : {}),
+    };
+}
+async function provisionCompanyOutpost(client, slug, yes, wait = {}, json = false) {
+    let company;
+    try {
+        company = await requireCompany(client, slug);
+    }
+    catch (err) {
+        if (err && typeof err === "object")
+            failedBeforeCreate.add(err);
+        throw err;
+    }
     confirmCompanyOutpostChargeOrExit({
         slug: company.slug,
         payerLabel: companyPayerLabel(company),
         yes,
+        json,
     });
+    await startCompanyOutpost(client, company, wait, { json });
+}
+/**
+ * Send the create, then report what status shows. `provision --company` and
+ * `create --company --name` both use this, so neither prints "not created"
+ * for a create that may still be running.
+ *
+ * A refusal from {@link provisionErrorSkipsStatusRead} is a real answer:
+ * `explainRefusal` may give its plain line (not in `--json`), otherwise it
+ * is rethrown for the command's error handler. Any other error, such as a
+ * codeless 5xx (API Gateway's 30s cut-off on a create that keeps running),
+ * `503 outcome_unknown`, a coded 5xx, a dropped connection or an unreadable
+ * body, says nothing final about whether the box exists, so status is read.
+ * With `json`, progress goes to stderr and stdout gets one object.
+ */
+async function startCompanyOutpost(client, company, wait, opts = {}) {
+    const json = opts.json === true;
     let outpost;
+    let provisionError;
     try {
         outpost = (await client.provisionCompany(company.uid)).outpost;
     }
     catch (err) {
-        // A codeless 5xx (API Gateway's 30s cut-off on a create that keeps
-        // running), a dropped connection or an unreadable body says nothing about
-        // whether the box exists. Re-read status instead of reporting a failure.
-        if (!isProvisionOutcomeUnknown(err))
+        // A refusal or a coded "nothing changed" answer is final.
+        // Anything else may have created the box. Poll status before any failure text.
+        // A failed read, a single 404, or a timeout stays unconfirmed and keeps this error.
+        if (provisionErrorSkipsStatusRead(err)) {
+            const plain = opts.json ? undefined : opts.explainRefusal?.(err);
+            if (plain) {
+                console.error(plain);
+                process.exit(1);
+            }
             throw err;
-        console.log(chalk.dim("The create request did not return a result in time. Checking status..."));
+        }
+        provisionError = err;
+        const line = isProvisionOutcomeUnknown(err)
+            ? "The create request did not return a result in time. Checking status..."
+            : "The create request returned an error. Checking status...";
+        provisionProgress(json, line);
     }
-    const id = typeof outpost?.outpostId === "string" ? outpost.outpostId : undefined;
-    const finished = await waitForCompanyOutpost(client, company.uid, outpost, wait);
+    const code = provisionError instanceof OutpostHttpError ? provisionError.code : undefined;
+    const finished = await waitForCompanyOutpost(client, company.uid, outpost, wait, {
+        json,
+        correlation: correlationFrom(outpost, provisionError),
+        trustInitial: outpost !== undefined,
+        announceInProgress: provisionError !== undefined,
+    });
+    // The id goes into a terminal line and JSON, so only a printable one is shown.
+    const rawId = finished.outpostId ?? outpost?.outpostId;
+    const id = typeof rawId === "string" && isCompanyOutpostId(rawId) ? rawId : undefined;
     const label = `${company.slug}'s Outpost${id ? ` (${id})` : ""}`;
     if (finished.state === "ready") {
+        if (json) {
+            writeCompanyProvisionJson({
+                ok: true,
+                company: company.slug,
+                state: "ready",
+                ...(id ? { outpostId: id } : {}),
+            });
+            return;
+        }
         console.log(chalk.green(`${label} is ready.`));
         console.log(chalk.dim(`Next: hq outposts status --company ${company.slug}`));
         return;
     }
     if (finished.state === "blocked") {
-        console.error(finished.reason === "not_started"
-            ? `${label} was not created; nothing was built. Next: re-run hq outposts provision --company ${company.slug} to try again.`
-            : finished.reason === "billing_required"
-                ? `Billing for ${company.slug} is blocked, so the Outpost could not finish provisioning. Next: check the company's billing in the console, then run hq outposts status --company ${company.slug}.`
-                : `${label} stopped while provisioning and needs attention. Next: hq outposts status --company ${company.slug}, and contact support before retrying.`);
+        const notCreated = finished.reason === "not_started";
+        if (json) {
+            writeCompanyProvisionJson({
+                ok: false,
+                company: company.slug,
+                state: notCreated ? "not_created" : "blocked",
+                ...(id ? { outpostId: id } : {}),
+                ...(code ? { code } : {}),
+                ...(finished.reason ? { reason: finished.reason } : {}),
+            });
+        }
+        else if (notCreated) {
+            console.error(`${label} was not created; nothing was built. Next: re-run hq outposts provision --company ${company.slug} to try again.`);
+        }
+        else if (finished.reason === "billing_required") {
+            console.error(`Billing for ${company.slug} is blocked, so the Outpost could not finish provisioning. Next: check the company's billing in the console, then run hq outposts status --company ${company.slug}.`);
+        }
+        else {
+            console.error(`${label} stopped while provisioning and needs attention. Next: hq outposts status --company ${company.slug}, and contact support before retrying.`);
+        }
         // exitCode, not exit(): the action's catch must not add a second message.
         process.exitCode = 1;
         return;
     }
     if (finished.state === "unconfirmed") {
-        console.error(`The result of the create request could not be confirmed; no Outpost status was readable for ${company.slug}. Next: hq outposts status --company ${company.slug} before retrying.`);
+        console.error(finished.signInFailed
+            ? `The result of the create request could not be confirmed because the status check needs you to sign in to HQ again. Next: run hq login, then run hq outposts status --company ${company.slug} first, before retrying.`
+            : `The result of the create request could not be confirmed. Next: run hq outposts status --company ${company.slug} first, before retrying.`);
+        if (json) {
+            writeCompanyProvisionJson({
+                ok: false,
+                company: company.slug,
+                state: "unconfirmed",
+                ...(id ? { outpostId: id } : {}),
+                ...(code ? { code } : {}),
+                reason: code ?? "unconfirmed",
+            });
+        }
         process.exitCode = 1;
         return;
     }
+    if (json) {
+        writeCompanyProvisionJson({
+            ok: true,
+            company: company.slug,
+            state: "pending",
+            ...(id ? { outpostId: id } : {}),
+        });
+        return;
+    }
     console.log(chalk.yellow(`Provisioning started for ${label}; it is not ready yet. Check it with: hq outposts status --company ${company.slug}`));
 }
+function rowBelongsToCreate(outpost, poll) {
+    if (!outpost)
+        return false;
+    if (poll.correlation.attemptId || poll.correlation.operationId) {
+        return companyCreateContinues(outpost, poll.correlation);
+    }
+    if (poll.trustInitial)
+        return true;
+    return companyCreateContinues(outpost, {});
+}
 /**
  * Poll company status until the box is ready or blocked, or the wait runs out.
- * Status read errors are retried; they do not change the outcome.
+ * Any status-read error, or a row that is not this create, is "not yet".
+ * Only an adopted row can end the wait.
  */
-async function waitForCompanyOutpost(client, companyUid, initial, wait) {
+async function waitForCompanyOutpost(client, companyUid, initial, wait, poll) {
     const pollMs = wait.pollMs ?? COMPANY_PROVISION_POLL_MS;
     const maxWaitMs = wait.maxWaitMs ?? COMPANY_PROVISION_MAX_WAIT_MS;
     const pause = wait.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
     const now = wait.now ?? Date.now;
+    let outpostId = typeof initial?.outpostId === "string" ? initial.outpostId : undefined;
     let progress = initial ? companyProvisionProgress(initial) : undefined;
-    if (progress && progress.state !== "pending")
-        return progress;
+    let announced = false;
+    const announce = (state) => {
+        if (announced || !poll.announceInProgress || state.state !== "pending")
+            return;
+        announced = true;
+        const line = "Status shows a create in progress.";
+        if (poll.json)
+            console.error(line);
+        else
+            console.log(line);
+    };
+    if (progress && progress.state !== "pending") {
+        return outpostId ? { ...progress, outpostId } : progress;
+    }
+    if (progress?.state === "pending")
+        announce(progress);
     const started = now();
     let lastLifecycle = progress?.state === "pending" ? progress.lifecycle : undefined;
     let lastProgressAt = started;
     let anyRead = initial !== undefined;
     for (;;) {
         if (now() - started >= maxWaitMs) {
-            return anyRead ? { state: "pending" } : { state: "unconfirmed" };
+            if (anyRead && progress)
+                return outpostId ? { ...progress, outpostId } : progress;
+            return outpostId ? { state: "unconfirmed", outpostId } : { state: "unconfirmed" };
         }
         await pause(pollMs);
         try {
+            // No outpostId: the deployed server rejects it with 400 invalid_body
+            // until hq-pro-agents #1217 ships. Rows are matched by attempt id instead.
             const status = await client.companyStatus(companyUid);
+            if (!rowBelongsToCreate(status.outpost, poll))
+                continue;
             progress = companyProvisionProgress(status.outpost);
             anyRead = true;
+            if (typeof status.outpost?.outpostId === "string")
+                outpostId = status.outpost.outpostId;
         }
         catch (err) {
-            // Not found yet, a codeless 5xx or a network failure: keep waiting.
-            // Auth and other client errors will not fix themselves; surface them.
-            if (err instanceof OutpostHttpError &&
-                err.status >= 400 &&
-                err.status < 500 &&
-                err.status !== 404) {
-                throw err;
+            // A create was already sent, so no status-read error proves what happened.
+            // A sign-in failure will not fix itself: stop now, still unconfirmed.
+            if (err instanceof OutpostHttpError && (err.status === 401 || err.status === 403)) {
+                return { state: "unconfirmed", signInFailed: true, ...(outpostId ? { outpostId } : {}) };
             }
+            // Anything else is "not yet"; the timeout ends unconfirmed with the create's own error.
             continue;
         }
-        if (progress.state !== "pending")
-            return progress;
+        if (!progress || progress.state !== "pending") {
+            return outpostId && progress ? { ...progress, outpostId } : progress ?? { state: "unconfirmed" };
+        }
+        announce(progress);
         const elapsed = Math.round((now() - started) / 1000);
         if (progress.lifecycle !== lastLifecycle) {
             lastLifecycle = progress.lifecycle;
             lastProgressAt = now();
-            console.log(chalk.dim(`Outpost is ${progress.lifecycle ?? "being created"} (${elapsed}s).`));
+            provisionProgress(poll.json, `Outpost is ${progress.lifecycle ?? "being created"} (${elapsed}s).`);
         }
         else if (now() - lastProgressAt >= COMPANY_PROVISION_PROGRESS_EVERY_MS) {
             lastProgressAt = now();
-            console.log(chalk.dim(`Still ${progress.lifecycle ?? "provisioning"} (${elapsed}s).`));
+            provisionProgress(poll.json, `Still ${progress.lifecycle ?? "provisioning"} (${elapsed}s).`);
         }
     }
 }
-async function showCompanyStatus(client, slug, asJson) {
+function writeCompanyDestroyJson(body) {
+    const payload = {
+        ok: body.ok,
+        company: body.company,
+        outpostId: body.outpostId ?? null,
+        state: body.state,
+    };
+    if (body.code)
+        payload.code = body.code;
+    if (body.reason)
+        payload.reason = body.reason;
+    process.stdout.write(JSON.stringify(payload) + "\n");
+}
+/**
+ * A destroy error the server sent as a final answer: a coded 4xx refusal
+ * such as `admin_required`, `reconciliation_required` or `not_found`.
+ * Anything else (every 5xx, coded or not, a codeless 4xx, a timeout, a
+ * dropped connection, `outcome_unknown`) may have started the teardown, so
+ * company status is read before anything is reported. The destroy itself is
+ * never retried.
+ */
+function destroyErrorIsFinal(err) {
+    if (!(err instanceof OutpostHttpError))
+        return false;
+    if (err.code === undefined || err.code === "outcome_unknown")
+        return false;
+    return err.status >= 400 && err.status < 500;
+}
+/**
+ * Read company status until the Outpost reads destroyed, or the wait runs out.
+ * The first read is immediate. A coded 404 `not_found` means the row is gone,
+ * which is destroyed. `destroying` keeps waiting. Any other lifecycle stops
+ * the wait as not confirmed. Other read errors are "not yet".
+ */
+async function waitForCompanyDestroy(client, companyUid, outpostId, wait, json) {
+    const pollMs = wait.pollMs ?? COMPANY_PROVISION_POLL_MS;
+    const maxWaitMs = wait.maxWaitMs ?? COMPANY_PROVISION_MAX_WAIT_MS;
+    const pause = wait.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
+    const now = wait.now ?? Date.now;
+    const started = now();
+    let sawDestroying = false;
+    let lastProgressAt = started;
+    for (let first = true;; first = false) {
+        if (!first) {
+            if (now() - started >= maxWaitMs) {
+                return sawDestroying ? { state: "destroying" } : { state: "unconfirmed" };
+            }
+            await pause(pollMs);
+        }
+        let lifecycle;
+        try {
+            const status = await client.companyStatus(companyUid, outpostId);
+            lifecycle = safeLifecycle(status.outpost?.lifecycle);
+        }
+        catch (err) {
+            // The server's coded "no active Outpost" is gone. A codeless 404 is not proof.
+            if (err instanceof OutpostHttpError && err.status === 404 && err.code === "not_found") {
+                return { state: "destroyed" };
+            }
+            // A sign-in failure will not fix itself: stop now, still unconfirmed.
+            if (err instanceof OutpostHttpError && (err.status === 401 || err.status === 403)) {
+                return { state: "unconfirmed", signInFailed: true };
+            }
+            // Anything else is "not yet"; the timeout ends unconfirmed.
+            continue;
+        }
+        if (lifecycle === "destroyed")
+            return { state: "destroyed" };
+        if (lifecycle !== "destroying") {
+            return lifecycle ? { state: "unconfirmed", lifecycle } : { state: "unconfirmed" };
+        }
+        const elapsed = Math.round((now() - started) / 1000);
+        if (!sawDestroying) {
+            sawDestroying = true;
+            lastProgressAt = now();
+            provisionProgress(json, `Outpost is destroying (${elapsed}s).`);
+        }
+        else if (now() - lastProgressAt >= COMPANY_PROVISION_PROGRESS_EVERY_MS) {
+            lastProgressAt = now();
+            provisionProgress(json, `Still destroying (${elapsed}s).`);
+        }
+    }
+}
+/** Plain refusal for destroy. Nothing was destroyed. */
+function failCompanyDestroy(slug, outpostId, err, json) {
+    const reason = err instanceof CompanyOutpostSelectError
+        ? explainCompanyOutpostSelect(isCompanySlug(slug) ? slug : "that company", err)
+        : explainCompanyFailure(slug, err, "destroy");
+    console.error(reason);
+    if (json) {
+        writeCompanyDestroyJson({
+            ok: false,
+            company: slug,
+            ...(outpostId ? { outpostId } : {}),
+            state: "not_destroyed",
+            code: companyFailureCode(err),
+            reason,
+        });
+    }
+    process.exit(1);
+}
+/**
+ * `hq outposts destroy --company <slug> [--outpost <name|id>]`.
+ *
+ * Never touches the personal Outpost. Nothing is sent until the person
+ * confirms: at a terminal they type the Outpost name or yes; without one,
+ * `--yes` is required. With `--json`, only `--yes` confirms. After the call, company status decides what is
+ * reported: destroyed, still destroying, or not confirmed.
+ */
+async function destroyCompanyOutpostCommand(client, host, opts, wait = {}) {
+    const json = opts.json === true;
+    // A script never confirms at a prompt: with --json, only --yes destroys.
+    if (json && !opts.yes) {
+        const reason = "--json needs --yes to destroy an Outpost. Nothing was sent. Next: re-run with --yes to confirm.";
+        console.error(reason);
+        writeCompanyDestroyJson({
+            ok: false,
+            company: opts.company,
+            state: "not_destroyed",
+            code: "confirmation_required",
+            reason,
+        });
+        process.exit(1);
+    }
+    let company;
+    let target;
+    try {
+        company = await requireCompany(client, opts.company);
+        target = await requireCompanyOutpost(client, company, opts.outpost, "hq outposts destroy");
+    }
+    catch (err) {
+        failCompanyDestroy(opts.company, undefined, err, json);
+    }
+    const id = target.outpostId;
+    const label = `${company.slug}'s Outpost ${target.name}${id ? ` (${id})` : ""}`;
+    if (!opts.yes) {
+        if (!host.isStdinTty()) {
+            console.error(`Destroying ${label} needs confirmation. Nothing was sent. Next: re-run with --yes to confirm.`);
+            process.exit(1);
+        }
+        process.stdout.write("This permanently destroys an Outpost and everything on it.\n" +
+            `  Company: ${company.slug}\n` +
+            `  Outpost: ${target.name}\n` +
+            `  Id:      ${id ?? "none (the company's only Outpost)"}\n` +
+            `Type the Outpost name (${target.name}) or yes to confirm: `);
+        const answer = host.readAnswer
+            ? (await host.readAnswer()).trim()
+            : (await host.confirm()) ? "yes" : "";
+        if (answer !== target.name && !/^yes$/i.test(answer)) {
+            console.log("Nothing was destroyed.");
+            return;
+        }
+    }
+    else {
+        provisionProgress(json, `Confirmed with --yes: destroying ${label}.`);
+    }
+    let destroyError;
+    try {
+        await client.destroyCompany(company.uid, id);
+    }
+    catch (err) {
+        if (destroyErrorIsFinal(err))
+            failCompanyDestroy(company.slug, id, err, json);
+        destroyError = err;
+        provisionProgress(json, isProvisionOutcomeUnknown(err)
+            ? "The destroy request did not return a result in time. Checking status..."
+            : "The destroy request returned an error. Checking status...");
+    }
+    const finished = await waitForCompanyDestroy(client, company.uid, id, wait, json);
+    const code = destroyError instanceof OutpostHttpError ? destroyError.code : undefined;
+    const statusNext = `hq outposts status --company ${company.slug}${outpostHint(target, opts.outpost)}`;
+    if (finished.state === "destroyed") {
+        if (json) {
+            writeCompanyDestroyJson({ ok: true, company: company.slug, ...(id ? { outpostId: id } : {}), state: "destroyed" });
+            return;
+        }
+        console.log(chalk.green(`${label} is destroyed.`));
+        return;
+    }
+    if (finished.state === "destroying") {
+        const reason = `${label} is still being destroyed. Next: check it in a few minutes with ${statusNext}`;
+        if (json) {
+            console.error(reason);
+            writeCompanyDestroyJson({
+                ok: true,
+                company: company.slug,
+                ...(id ? { outpostId: id } : {}),
+                state: "destroying",
+                ...(code ? { code } : {}),
+                reason,
+            });
+            return;
+        }
+        console.log(chalk.yellow(reason));
+        return;
+    }
+    const reason = finished.signInFailed
+        ? `The destroy could not be confirmed because the status check needs you to sign in to HQ again. Next: run hq login, then ${statusNext} before retrying.`
+        : finished.lifecycle
+            ? `The destroy could not be confirmed: status shows ${label} as ${finished.lifecycle}. Next: ${statusNext} before retrying.`
+            : `The destroy could not be confirmed. Next: ${statusNext} before retrying.`;
+    console.error(reason);
+    if (json) {
+        writeCompanyDestroyJson({
+            ok: false,
+            company: company.slug,
+            ...(id ? { outpostId: id } : {}),
+            state: "unconfirmed",
+            code: code ?? "unconfirmed",
+            reason,
+        });
+    }
+    // exitCode, not exit(): the action's catch must not add a second message.
+    process.exitCode = 1;
+}
+async function showCompanyStatus(client, slug, asJson, outpostFlag) {
     const company = await requireCompany(client, slug);
-    const status = await client.companyStatus(company.uid);
+    const target = await requireCompanyOutpost(client, company, outpostFlag, "hq outposts status");
+    const status = await client.companyStatus(company.uid, target.outpostId);
     const outpost = status.outpost ?? {};
-    const registry = await client.listCompanyJobs(company.uid);
+    const registry = await client.listCompanyJobs(company.uid, target.outpostId);
     let health = null;
     let healthAvailable = false;
     try {
-        health = await client.companyJobHealth(company.uid);
+        health = await client.companyJobHealth(company.uid, target.outpostId);
         healthAvailable = true;
     }
     catch (err) {
@@ -228,7 +817,7 @@ async function showCompanyStatus(client, slug, asJson) {
     const jobs = mergeCompanyJobs(registry, health);
     let signIn = { signedIn: false, state: "unknown" };
     try {
-        signIn = parseCompanySignIn(await client.companySignIn(company.uid, "status"));
+        signIn = parseCompanySignIn(await client.companySignIn(company.uid, "status", undefined, target.outpostId));
     }
     catch (err) {
         // An older server has no sign-in route: unknown. A non-admin is told why.
@@ -239,6 +828,7 @@ async function showCompanyStatus(client, slug, asJson) {
     if (asJson) {
         process.stdout.write(JSON.stringify({
             company: { slug: company.slug, uid: company.uid, ...(company.name ? { name: company.name } : {}) },
+            outpostName: target.name,
             outpost,
             jobs,
             jobHealth: healthAvailable ? "available" : "unavailable",
@@ -254,7 +844,7 @@ async function showCompanyStatus(client, slug, asJson) {
         : "";
     console.log(`Company   ${company.slug}${company.name ? ` (${company.name})` : ""}`);
     console.log(`Payer     ${companyPayerLabel(company)}`);
-    console.log(`Outpost   ${outpostId}`);
+    console.log(`Outpost   ${target.name}${outpostId ? ` (${outpostId})` : ""}`);
     console.log(`State     ${lifecycle}`);
     if (instance)
         console.log(`Instance  ${instance}`);
@@ -267,13 +857,14 @@ async function registerCompanyJobCommand(client, opts) {
     const slug = opts.company ?? "";
     const definition = buildCompanyJobDefinition(opts);
     const company = await requireCompany(client, slug);
+    const target = await requireCompanyOutpost(client, company, opts.outpost, "hq outposts jobs register");
     if (definition.schedule.kind === "recurring" &&
         opts.cron !== undefined &&
         definition.schedule.cron !== opts.cron.trim() &&
         !opts.json) {
         console.log(`Using schedule ${definition.schedule.cron} for --cron "${opts.cron.trim()}".`);
     }
-    const created = await client.registerCompanyJob(company.uid, definition);
+    const created = await client.registerCompanyJob(company.uid, definition, target.outpostId);
     const jobId = created.job?.jobId;
     const revision = created.job?.acceptedRevision;
     if (!jobId || !revision) {
@@ -281,12 +872,184 @@ async function registerCompanyJobCommand(client, opts) {
         process.exit(1);
     }
     if (opts.json) {
-        process.stdout.write(JSON.stringify({ jobId, acceptedRevision: revision, company: company.slug }, null, 2) + "\n");
+        process.stdout.write(JSON.stringify({ jobId, acceptedRevision: revision, company: company.slug, outpost: target.name }, null, 2) + "\n");
         return;
     }
-    console.log(`Registered ${jobId} for ${company.slug}.`);
+    console.log(`Registered ${jobId} for ${company.slug} on Outpost ${target.name}.`);
     console.log(`Accepted revision: ${revision}`);
 }
+const COMPANY_JOB_WIRE = {
+    edit: "update",
+    pause: "disable",
+    resume: "enable",
+    delete: "delete",
+    "run-now": "run-now",
+};
+const COMPANY_JOB_ID = /^job_[A-Za-z0-9]+$/;
+const SAFE_TOKEN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+function safeToken(value) {
+    return typeof value === "string" && SAFE_TOKEN.test(value) ? value : undefined;
+}
+function stopCompanyJob(message, stop, code) {
+    if (stop.json) {
+        process.stdout.write(JSON.stringify({ ok: false, action: stop.action, jobId: stop.jobId, code, message }) + "\n");
+    }
+    else {
+        console.error(message);
+    }
+    process.exitCode = 1;
+}
+function deleteRerunLine(slug, outpostFlag, jobId, revision) {
+    const flag = outpostFlag && SAFE_TOKEN.test(outpostFlag) ? ` --outpost ${outpostFlag}` : "";
+    return `hq outposts jobs delete --company ${slug}${flag} ${jobId} --revision ${revision} --yes`;
+}
+function unconfirmedCompanyJob(slug) {
+    const status = isCompanySlug(slug)
+        ? `hq outposts status --company ${slug}`
+        : "hq outposts status --company <slug>";
+    return `The result could not be confirmed. The server may already have changed the job. Next: ${status}`;
+}
+async function runCompanyJobCommand(client, action, jobId, opts) {
+    const stop = { action, jobId, json: Boolean(opts.json) };
+    if (!COMPANY_JOB_ID.test(jobId)) {
+        stopCompanyJob("That job id is not valid. Next: copy it from hq outposts status --company <slug>.", stop, "invalid_job");
+        return;
+    }
+    const company = await requireCompany(client, opts.company ?? "");
+    // Same selector as register: a name or an id. Omitted means the company's default Outpost.
+    const target = opts.outpost === undefined
+        ? undefined
+        : await requireCompanyOutpost(client, company, opts.outpost, `hq outposts jobs ${action}`);
+    const outpostId = target?.outpostId;
+    const listed = await client.listCompanyJobs(company.uid, outpostId);
+    const job = listed.find((row) => row.jobId === jobId);
+    if (!job) {
+        stopCompanyJob(`No job ${jobId} on this Outpost. Next: pass --outpost <id> when the company has more than one, or run hq outposts status --company ${company.slug}.`, stop, "job_not_found");
+        return;
+    }
+    const revision = safeToken(job.acceptedRevision);
+    if (!revision) {
+        stopCompanyJob("Someone else changed this job. Reload it and try again.", stop, "job_changed");
+        return;
+    }
+    if (opts.revision !== undefined && safeToken(opts.revision) !== revision) {
+        stopCompanyJob("Someone else changed this job. Reload it and try again.", stop, "job_changed");
+        return;
+    }
+    if (action === "delete" && !opts.yes) {
+        stopCompanyJob(`This will delete job ${jobId} on ${company.slug}'s Outpost.\n` +
+            `Accepted revision: ${revision}\n` +
+            `Re-run with --yes to confirm: ${deleteRerunLine(company.slug, opts.outpost, jobId, revision)}`, stop, "confirmation_required");
+        return;
+    }
+    if ((action === "edit" || (action === "delete" && opts.yes)) && opts.revision === undefined) {
+        stopCompanyJob(action === "delete"
+            ? `Delete needs --revision ${revision} so a newer change is not removed.\n` +
+                `Next: ${deleteRerunLine(company.slug, opts.outpost, jobId, revision)}`
+            : `This edit needs the revision you last saw, so it does not overwrite a newer change. Next: re-run with --revision ${revision}.`, stop, "revision_required");
+        return;
+    }
+    if (action === "run-now" && job.status === "paused") {
+        stopCompanyJob(`This job is paused. Next: hq outposts jobs resume --company ${company.slug} ${jobId}`, stop, "paused");
+        return;
+    }
+    const definition = action === "edit"
+        ? mergeCompanyJobEdit(job, {
+            prompt: opts.prompt,
+            timezone: opts.timezone,
+            cron: opts.cron,
+            at: opts.at,
+            script: opts.script,
+            context: opts.context,
+            clearScript: opts.clearScript,
+            clearContext: opts.clearContext,
+        })
+        : undefined;
+    if (definition?.schedule.kind === "recurring" &&
+        opts.cron !== undefined &&
+        definition.schedule.cron !== opts.cron.trim() &&
+        !opts.json) {
+        console.log(`Using schedule ${definition.schedule.cron} for --cron "${opts.cron.trim()}".`);
+    }
+    const body = await client.companyJobCommand({
+        companyUid: company.uid,
+        action: COMPANY_JOB_WIRE[action],
+        jobId,
+        revision,
+        ...(outpostId ? { outpostId } : {}),
+        ...(definition ? { definition } : {}),
+    });
+    printCompanyJobResult(action, company.slug, jobId, body, Boolean(opts.json));
+}
+function printCompanyJobResult(action, slug, jobId, body, json) {
+    const stop = { action, jobId, json };
+    if (action === "run-now") {
+        const runId = safeToken(body.runId);
+        const returnedJob = safeToken(body.jobId);
+        if (!runId || (returnedJob !== undefined && returnedJob !== jobId)) {
+            stopCompanyJob(unconfirmedCompanyJob(slug), stop, "unconfirmed");
+            return;
+        }
+        if (json) {
+            process.stdout.write(JSON.stringify({ ok: true, company: slug, action, jobId, runId }) + "\n");
+            return;
+        }
+        console.log(`Started run ${runId} for ${jobId}.`);
+        console.log(`Next: hq outposts status --company ${slug}`);
+        return;
+    }
+    const job = body.job;
+    const row = job && typeof job === "object" ? job : undefined;
+    const returnedId = safeToken(row?.jobId);
+    const revision = safeToken(row?.acceptedRevision);
+    if (!row || returnedId !== jobId) {
+        stopCompanyJob(unconfirmedCompanyJob(slug), stop, "unconfirmed");
+        return;
+    }
+    if (action === "pause" && row.status !== "paused") {
+        stopCompanyJob(unconfirmedCompanyJob(slug), stop, "unconfirmed");
+        return;
+    }
+    if (action === "resume" && row.status !== "active") {
+        stopCompanyJob(unconfirmedCompanyJob(slug), stop, "unconfirmed");
+        return;
+    }
+    if (action === "delete" && row.deleted !== true) {
+        stopCompanyJob(unconfirmedCompanyJob(slug), stop, "unconfirmed");
+        return;
+    }
+    if (action === "edit" && !revision) {
+        stopCompanyJob(unconfirmedCompanyJob(slug), stop, "unconfirmed");
+        return;
+    }
+    const status = row.status === "paused" || row.status === "active" ? row.status : undefined;
+    if (json) {
+        process.stdout.write(JSON.stringify({
+            ok: true,
+            company: slug,
+            action,
+            jobId,
+            ...(revision ? { acceptedRevision: revision } : {}),
+            ...(status ? { status } : {}),
+            ...(action === "delete" ? { deleted: true } : {}),
+        }) + "\n");
+        return;
+    }
+    if (action === "edit") {
+        console.log(`Updated ${jobId} for ${slug}.`);
+        console.log(`Accepted revision: ${revision}`);
+        return;
+    }
+    if (action === "pause") {
+        console.log(`Paused ${jobId} for ${slug}.`);
+        return;
+    }
+    if (action === "resume") {
+        console.log(`Resumed ${jobId} for ${slug}.`);
+        return;
+    }
+    console.log(`Deleted ${jobId} for ${slug}.`);
+}
 function quoteShellArgument(value) {
     return `'${value.replaceAll("'", "'\\''")}'`;
 }
@@ -415,22 +1178,64 @@ export function registerOutpostsCommand(program, deps) {
         .option("--disk <gb>", "Root disk size in GB (EC2 only). Personal boxes only.")
         .option("--client-ip <ip>", "Your public IP for the box's SSH ingress (optional; server derives it otherwise). Personal boxes only.")
         .option("--company <slug>", "Provision the company's Outpost instead of your personal box")
-        .option("--yes", "Confirm the $80/month charge (required to provision)")
+        .option("--name <name>", "With --company: not sent. This server creates the company's main Outpost and does not take a name yet")
+        .option("--yes", "Confirm the monthly charge (required to provision or create)")
+        .option("--json", "With --company, emit one JSON object. Progress goes to stderr.")
         .action(async function (opts) {
         try {
+            if (opts.name !== undefined && opts.company === undefined) {
+                console.error("--name names a company Outpost. Next: re-run with --company <slug> --name <name>.");
+                process.exit(1);
+            }
+            if (opts.company !== undefined && opts.name !== undefined) {
+                if (opts.runtime !== undefined || opts.disk !== undefined || opts.clientIp !== undefined) {
+                    console.error("Those options are for a personal Outpost. Next: re-run with --company and --name, and leave out --runtime, --disk and --client-ip.");
+                    process.exit(1);
+                }
+                try {
+                    await createCompanyOutpostCommand(client, host, {
+                        company: opts.company,
+                        name: opts.name,
+                        ...(opts.yes !== undefined ? { yes: opts.yes } : {}),
+                        ...(opts.json ? { json: true } : {}),
+                    }, deps.companyProvisionWait);
+                }
+                catch (err) {
+                    // The create already reported this and called process.exit.
+                    if (err instanceof Error && err.message.startsWith("process.exit("))
+                        throw err;
+                    if (opts.json) {
+                        process.stdout.write(companyProvisionFailureJson(opts.company, err));
+                        process.exit(1);
+                    }
+                    failCompany(opts.company, err, "provision");
+                }
+                return;
+            }
             if (opts.company !== undefined) {
                 if (opts.runtime !== undefined || opts.disk !== undefined || opts.clientIp !== undefined) {
                     console.error("Those options are for a personal Outpost. Next: re-run with --company and --yes, and leave out --runtime, --disk and --client-ip.");
                     process.exit(1);
                 }
                 try {
-                    await provisionCompanyOutpost(client, opts.company, opts.yes, deps.companyProvisionWait);
+                    await provisionCompanyOutpost(client, opts.company, opts.yes, deps.companyProvisionWait, Boolean(opts.json));
                 }
                 catch (err) {
+                    // The charge gate already reported this and called process.exit.
+                    if (err instanceof Error && err.message.startsWith("process.exit("))
+                        throw err;
+                    if (opts.json) {
+                        process.stdout.write(companyProvisionFailureJson(opts.company, err));
+                        process.exit(1);
+                    }
                     failCompany(opts.company, err, "provision");
                 }
                 return;
             }
+            if (opts.json) {
+                console.error("--json applies to a company Outpost. Next: re-run with --company <slug> --json, or drop --json.");
+                process.exit(1);
+            }
             // Reject an unrecognized runtime rather than resolving it to claude:
             // `--runtime codx` would otherwise hand back a silently Claude box.
             if (opts.runtime !== undefined &&
@@ -500,9 +1305,19 @@ export function registerOutpostsCommand(program, deps) {
     });
     outposts
         .command("list")
-        .description("List every Outpost you own")
+        .description("List every Outpost you own, or a company's Outposts with --company")
+        .option("--company <slug>", "List the company's Outposts")
         .option("--json", "Emit raw JSON")
         .action(async function (opts) {
+        if (opts.company !== undefined) {
+            try {
+                await listCompanyOutpostsCommand(client, opts.company, Boolean(opts.json));
+            }
+            catch (err) {
+                failCompany(opts.company, err, "status");
+            }
+            return;
+        }
         try {
             const rows = await client.list();
             if (opts.json) {
@@ -546,8 +1361,10 @@ export function registerOutpostsCommand(program, deps) {
         .description("Show live detail for one Outpost")
         .option("--id <outpostId>", "Personal Outpost id (defaults to your primary box)")
         .option("--company <slug>", "Show the company Outpost, its jobs, and each job's run status")
+        .option("--outpost <name|id>", "Which company Outpost, when the company has more than one")
         .option("--json", "Emit raw JSON")
         .action(async function (opts) {
+        rejectOutpostWithoutCompany(opts);
         try {
             if (opts.company !== undefined) {
                 if (opts.id !== undefined) {
@@ -555,7 +1372,7 @@ export function registerOutpostsCommand(program, deps) {
                     process.exit(1);
                 }
                 try {
-                    await showCompanyStatus(client, opts.company, Boolean(opts.json));
+                    await showCompanyStatus(client, opts.company, Boolean(opts.json), opts.outpost);
                 }
                 catch (err) {
                     failCompany(opts.company, err, "status");
@@ -575,7 +1392,7 @@ export function registerOutpostsCommand(program, deps) {
     });
     const jobs = outposts
         .command("jobs")
-        .description("Register a job on a company Outpost");
+        .description("Register, edit, pause, resume, delete, or run a job on a company Outpost");
     jobs
         .command("register")
         .description("Register a company job and print the accepted revision")
@@ -586,8 +1403,10 @@ export function registerOutpostsCommand(program, deps) {
         .option("--at <iso>", "One-time ISO-8601 instant. Do not combine with --cron")
         .option("--script <text>", "Optional precondition script stored with the job")
         .option("--context <json>", "Optional JSON object stored with the job")
+        .option("--outpost <name|id>", "Which company Outpost runs the job, when the company has more than one")
         .option("--json", "Emit the job id and accepted revision as JSON")
         .action(async function (opts) {
+        rejectOutpostWithoutCompany(opts);
         try {
             await registerCompanyJobCommand(client, opts);
         }
@@ -595,6 +1414,45 @@ export function registerOutpostsCommand(program, deps) {
             failCompany(opts.company ?? "", err, "register");
         }
     });
+    const companyJobActions = [
+        { name: "edit", description: "Change a company job. Omitted fields stay as they are. Requires --revision", definition: true, confirm: false },
+        { name: "pause", description: "Pause a company job", definition: false, confirm: false },
+        { name: "resume", description: "Resume a paused company job", definition: false, confirm: false },
+        { name: "delete", description: "Delete a company job (requires --yes)", definition: false, confirm: true },
+        { name: "run-now", description: "Run a company job once now", definition: false, confirm: false },
+    ];
+    for (const spec of companyJobActions) {
+        const command = jobs
+            .command(spec.name)
+            .description(spec.description)
+            .argument("<jobId>", "Job id from hq outposts status --company <slug>")
+            .option("--company <slug>", "Company that owns the Outpost")
+            .option("--outpost <name|id>", "Which company Outpost, when the company has more than one")
+            .option("--revision <rev>", "Accepted revision you last saw. Required for edit and delete --yes");
+        if (spec.definition) {
+            command
+                .option("--prompt <text>", "What the job should do. Omit to keep the current prompt")
+                .option("--timezone <name>", "IANA timezone, such as America/New_York. Omit to keep the current timezone")
+                .option("--cron <expr>", 'Recurring schedule: rate(N minutes|hours|days), a five-field cron with * for day of month and month (such as "*/15 * * * *"; translated to the AWS form), or cron(MIN HOUR ? * DOW *). Omit to keep the current schedule')
+                .option("--at <iso>", "One-time ISO-8601 instant. Do not combine with --cron")
+                .option("--script <text>", "Precondition script stored with the job. Omit to keep the current script")
+                .option("--context <json>", "JSON object stored with the job. Omit to keep the current context")
+                .option("--clear-script", "Remove the job's precondition script")
+                .option("--clear-context", "Remove the job's stored context");
+        }
+        if (spec.confirm) {
+            command.option("--yes", "Confirm deletion of this job");
+        }
+        command.option("--json", "Emit the result as JSON").action(async function (jobId, opts) {
+            rejectOutpostWithoutCompany(opts);
+            try {
+                await runCompanyJobCommand(client, spec.name, jobId, opts);
+            }
+            catch (err) {
+                failCompany(opts.company ?? "", err, spec.name, opts.json ? { action: spec.name, jobId } : undefined);
+            }
+        });
+    }
     outposts
         .command("exec <command...>")
         .description("Run a shell command on an Outpost and print its output (use -- before flags meant for the remote command). " +
@@ -948,11 +1806,13 @@ export function registerOutpostsCommand(program, deps) {
         .command("refresh-config")
         .description("Re-apply the server's job runner configuration to the company Outpost (owner or admin)")
         .requiredOption("--company <slug>", "Company slug")
+        .option("--outpost <name|id>", "Which company Outpost, when the company has more than one")
         .option("--json", "Emit raw JSON")
         .action(async function (opts) {
         try {
             const company = await requireCompany(client, opts.company);
-            await client.refreshCompanyConfig(company.uid);
+            const target = await requireCompanyOutpost(client, company, opts.outpost, "hq outposts refresh-config");
+            await client.refreshCompanyConfig(company.uid, target.outpostId);
             // requireCompany validated opts.company; print the user's slug, never server text.
             const slug = opts.company;
             if (opts.json) {
@@ -960,7 +1820,7 @@ export function registerOutpostsCommand(program, deps) {
                 return;
             }
             console.log(chalk.green(`Configuration refresh started for ${slug}'s Outpost. It takes a few minutes.`));
-            console.log(chalk.dim(`Next: hq outposts status --company ${slug}`));
+            console.log(chalk.dim(`Next: hq outposts status --company ${slug}${outpostHint(target, opts.outpost)}`));
         }
         catch (err) {
             failCompany(opts.company, err, "refresh");
@@ -989,8 +1849,10 @@ export function registerOutpostsCommand(program, deps) {
         .description("Request a fresh login URL for an Outpost")
         .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
         .option("--company <slug>", "Request a new sign-in link for the company's Outpost (owner or admin)")
+        .option("--outpost <name|id>", "Which company Outpost, when the company has more than one")
         .option("--json", "Emit raw JSON")
         .action(async function (opts) {
+        rejectOutpostWithoutCompany(opts);
         if (opts.company !== undefined) {
             if (opts.id) {
                 console.error(chalk.red("Use either --company or --id, not both."));
@@ -998,13 +1860,14 @@ export function registerOutpostsCommand(program, deps) {
             }
             try {
                 const company = await requireCompany(client, opts.company);
-                await client.companySignIn(company.uid, "regenerate");
+                const target = await requireCompanyOutpost(client, company, opts.outpost, "hq outposts login");
+                await client.companySignIn(company.uid, "regenerate", undefined, target.outpostId);
                 if (opts.json) {
-                    process.stdout.write(JSON.stringify({ ok: true, company: company.slug, action: "regenerate" }, null, 2) + "\n");
+                    process.stdout.write(JSON.stringify({ ok: true, company: company.slug, outpost: target.name, action: "regenerate" }, null, 2) + "\n");
                     return;
                 }
-                console.log(chalk.green(`A new sign-in link was requested for ${company.slug}'s Outpost.`));
-                console.log(chalk.dim(`Next: hq outposts status --company ${company.slug} to read it.`));
+                console.log(chalk.green(`A new sign-in link was requested for ${company.slug}'s Outpost ${target.name}.`));
+                console.log(chalk.dim(`Next: hq outposts status --company ${company.slug}${outpostHint(target, opts.outpost)} to read it.`));
             }
             catch (err) {
                 failCompany(opts.company, err, "signin");
@@ -1034,8 +1897,10 @@ export function registerOutpostsCommand(program, deps) {
         .description("Submit the Claude sign-in code for an Outpost that is awaiting login")
         .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
         .option("--company <slug>", "Sign in the company's Outpost (owner or admin)")
+        .option("--outpost <name|id>", "Which company Outpost, when the company has more than one")
         .option("--json", "Emit raw JSON")
         .action(async function (code, opts) {
+        rejectOutpostWithoutCompany(opts);
         const trimmed = code.trim();
         if (!trimmed) {
             console.error(chalk.red("Provide the sign-in code: hq outposts login-code [--company <slug>] <code>"));
@@ -1048,13 +1913,14 @@ export function registerOutpostsCommand(program, deps) {
             }
             try {
                 const company = await requireCompany(client, opts.company);
-                await client.companySignIn(company.uid, "code", trimmed);
+                const target = await requireCompanyOutpost(client, company, opts.outpost, "hq outposts login-code <code>");
+                await client.companySignIn(company.uid, "code", trimmed, target.outpostId);
                 if (opts.json) {
-                    process.stdout.write(JSON.stringify({ ok: true, company: company.slug, action: "code" }, null, 2) + "\n");
+                    process.stdout.write(JSON.stringify({ ok: true, company: company.slug, outpost: target.name, action: "code" }, null, 2) + "\n");
                     return;
                 }
-                console.log(chalk.green(`Code submitted. ${company.slug}'s Outpost will finish signing in shortly.`));
-                console.log(chalk.dim(`Next: hq outposts status --company ${company.slug}`));
+                console.log(chalk.green(`Code submitted. ${company.slug}'s Outpost ${target.name} will finish signing in shortly.`));
+                console.log(chalk.dim(`Next: hq outposts status --company ${company.slug}${outpostHint(target, opts.outpost)}`));
             }
             catch (err) {
                 failCompany(opts.company, err, "signin");
@@ -1080,8 +1946,24 @@ export function registerOutpostsCommand(program, deps) {
         .command("destroy")
         .description("Tear down (permanently destroy) an Outpost")
         .option("--id <outpostId>", "Outpost id (defaults to your primary box)")
+        .option("--company <slug>", "Destroy one of the company's Outposts (owner or admin)")
+        .option("--outpost <name|id>", "Which company Outpost, when the company has more than one")
+        .option("--json", "With --company and --yes: print one result object on stdout")
         .option("--yes", "Confirm the irreversible teardown (required)")
         .action(async function (opts) {
+        rejectOutpostWithoutCompany(opts);
+        if (opts.company !== undefined) {
+            if (opts.id) {
+                console.error(chalk.red("Use either --company or --id, not both."));
+                process.exit(1);
+            }
+            await destroyCompanyOutpostCommand(client, host, { company: opts.company, outpost: opts.outpost, yes: opts.yes, json: opts.json }, deps.companyDestroyWait);
+            return;
+        }
+        if (opts.json) {
+            console.error("--json applies to a company Outpost. Next: re-run with --company <slug> --yes --json, or drop --json.");
+            process.exit(1);
+        }
         const target = opts.id ?? "your primary Outpost";
         if (!opts.yes) {
             console.error(chalk.yellow(`This will permanently destroy ${target} and delete its cloud resources. ` +