indigoai-us/hq-core/hq-cowork

/hq-cowork — Native HQ from a sandboxed agent

Cowork's bash runs in an isolated Linux VM that cannot see ~/.hq (Cognito auth) or reach the host's hq / qmd binaries. hq-pack-cowork ships a host-side stdio MCP server that runs those binaries with full auth and exposes them as mcp__hq__* tool calls. This skill is the map: it tells you which tool covers which HQ capability and how to call it.

Args: $ARGUMENTS — optional. A capability keyword (e.g. sync, secrets, meetings) jumps straight to that section's guidance. No arg = print the full capability map below and ask what the user wants.

Capability map

Security envelope (carries over from HQ core policies)

• Secret values never cross the MCP boundary. hq_secrets_exec injects

them into a child process env; hq_secrets_list shows names only. There is no value-revealing tool. Never try to echo a secret to capture its value.

• Cross-company isolation. Always pass company explicitly when crossing

contexts. Never let the server fall back to another company's scope. If the scoped creds fail, stop and ask — don't retry against a different company.

• Share-session URLs are single-use capabilities. hq_share returns the

minted URL once. Print it that turn, then redact as https://hq.{co}.com/share-session/<TOKEN_REDACTED> everywhere after.

• Escape hatch stays guarded. hq_cli blocks login/logout/onboard,

secret-value output, raw hq secrets set|exec, and hq run (use hq_run instead).

When to use this instead of the unprefixed skills

Use the hq-cowork-* family (and direct mcp__hq__* calls) only inside Cowork or another sandboxed plugin host. On a normal host-side Claude Code session prefer the unprefixed /hq-sync, /hq-share, /search, /hq-secrets, /dm, etc. — fewer hops, same result.

What you do

1. If $ARGUMENTS names a capability, skip to that tool and call it with the

user's parameters. If ambiguous or empty, show the capability map and ask.

1. Prefer the dedicated hq-cowork-* skill when one exists (search, share,

secrets, files, dm, meetings) — it carries the per-capability nuance.

1. Always start a fresh wiring with mcp__hq__hq_whoami if a tool errors with

an auth/ENOENT message — that confirms whether the host server is logged in and has hq/qmd on PATH.