[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DWTTJVC70FDBYX1DJFFZN":3,"skill-same:01M71DWTTJVC70FDBYX1DJFFZN":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":51,"ownerDescription":52,"updatedAt":53,"install":54,"resources":67},"01M71DWTTJVC70FDBYX1DJFFZN","designate-team",null,"Mark a company as HQ Pro cloud-backed and sync its team setup.","indigoai-us\u002Fhq-core","indigoai-us","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F122242446?v=4","01M71DTQ5NGD10GT1Z7E6XKWC5","HQ","01M71DTQ6BKSYYBNC9RAKT3YDK",94,"MIT","https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesignate-team\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"designate team","team","mktemp","setup","Bash","cloud","pro","grep","sync","mkdir","company","jq","read","tr","wc","awk","mv","yq","mark","as","2026-11-10 10:12:30",false,"---\nname: designate-team\ndescription: Mark a company as HQ Pro cloud-backed and sync its team setup.\nallowed-tools: Read, Bash(bash:*), Bash(yq:*), Bash(awk:*), Bash(grep:*), Bash(wc:*), Bash(tr:*), Bash(mkdir:*), Bash(mktemp:*), Bash(mv:*), Bash(printf:*), Bash(date:*), Bash(jq:*), Bash(hq:*), Bash\n---\n\n# \u002Fdesignate-team\n\nDesignate one local `companies\u002F{slug}\u002F` directory as an HQ Pro team workspace by\nsetting `cloud: true` in `companies\u002F{slug}\u002Fcompany.yaml` (an HQ Desktop App marker), then\ndelegating cloud provisioning to the canonical CLI subcommand\n`hq cloud provision company \u003Cslug>`.\n\n**Company slug:** `$ARGUMENTS`\n\n## Rules\n\n- Refuse `personal`; personal sync is auto-provisioned per-user.\n- Validate the slug is non-empty and uses only `[A-Za-z0-9._-]`.\n- Validate `companies\u002F{slug}\u002F` exists locally (deeper validation — manifest\n  membership, archived status — happens inside the CLI subcommand).\n- Write `cloud: true` to `companies\u002F{slug}\u002Fcompany.yaml` idempotently. This is\n  an **HQ Desktop App marker** that `provision.rs::provision_missing_companies()` reads\n  to discover cloud-eligible companies. The CLI subcommand writes\n  `.hq\u002Fconfig.json` + patches `manifest.yaml` but does NOT touch `company.yaml`.\n- Delegate manifest patching, vault entity creation, S3 bucket provisioning, and\n  initial sync to `hq cloud provision company \u003Cslug>`. The CLI emits one line of\n  structured JSON to stdout on success (or partial success on exit code 3).\n- If `hq` is not on `PATH`, print the exact subcommand for the user to run later\n  and exit 0 (company.yaml has been written; remaining work is recoverable).\n- Echo the active HQ environment (vault URL, Cognito pool domain, current\n  operator) before calling the CLI. This catches \"wrong userpool\" \u002F \"wrong\n  vault\" surprises early and works for every HQ user — no owner-specific paths.\n- After the CLI succeeds, run a `GET \u002Fmembership\u002Fme` self-check against the\n  vault API the CLI just used. If the new `cloud_uid` is present in the\n  response, the company will appear in the HQ console for the current operator.\n  This is the same endpoint the console calls, so a green check here is a\n  deterministic guarantee of console visibility.\n- After the CLI succeeds, write the baseline member grants: `@all write` on\n  each of `knowledge\u002F*`, `projects\u002F*`, `policies\u002F*`, `skills\u002F*` as four separate\n  shared-folder prefix grants (`hq files share '\u003Cprefix>\u002F*' --with @all\n  --permission write --company {slug}`). Never a bucket-wide `*` grant. A\n  trailing slash without `*` is the private create-only pattern, so do not use\n  it for recursive baseline access. Members hold no implicit\n  file access (only owner\u002Fadmin bypass the ACL walk), so without these rows a\n  member cannot push the knowledge they create or pull what teammates wrote.\n  A failed grant is a warning with the exact re-run command, not a hard exit.\n  Narrow it afterward with `\u002Fteam-access` when a folder mixes shared and\n  private material. `ontology\u002F`, `signals\u002F`, and `sources\u002F` are never in the\n  baseline; the ontology worker grants them per audience.\n- Append one JSONL audit row to `workspace\u002Flearnings\u002Fdesignate-team-runs.jsonl`\n  capturing the structured result from the CLI plus the `membership_visible`\n  flag from the self-check.\n- Exit codes: 0 success | 1 vault\u002Fauth | 2 invalid input | 3 sync failed\n  (entity provisioned) | 4 provisioned but membership self-check failed\n  (entity exists but operator can't see it — likely a userpool\u002Ftoken mismatch).\n\n## Implementation\n\nRun this from the HQ root:\n\n```bash\nset -euo pipefail\n\nslug=\"${ARGUMENTS:-}\"\nif [ -z \"$slug\" ]; then\n  echo \"Usage: \u002Fdesignate-team \u003Ccompany-slug>\" >&2\n  exit 2\nfi\nif [ \"$slug\" = \"personal\" ]; then\n  echo \"ERROR: personal is out of scope for \u002Fdesignate-team\" >&2\n  exit 2\nfi\ncase \"$slug\" in\n  *[!A-Za-z0-9._-]*)\n    echo \"ERROR: invalid company slug '$slug'\" >&2\n    exit 2\n    ;;\nesac\n\ncompany_dir=\"companies\u002F$slug\"\ncompany_yaml=\"$company_dir\u002Fcompany.yaml\"\naudit_log=\"workspace\u002Flearnings\u002Fdesignate-team-runs.jsonl\"\n\nif [ ! -d \"$company_dir\" ]; then\n  echo \"ERROR: company directory not found: $company_dir\" >&2\n  exit 1\nfi\n\n# Idempotently write cloud: true to company.yaml.\n# This is the HQ Desktop App marker (provision.rs walks companies\u002F*\u002Fcompany.yaml looking\n# for cloud:true). The CLI subcommand never writes this file — it writes\n# .hq\u002Fconfig.json and patches manifest.yaml.\nmkdir -p \"$company_dir\"\nif [ ! -f \"$company_yaml\" ]; then\n  printf \"slug: %s\\ncloud: true\\n\" \"$slug\" > \"$company_yaml\"\nelif ! grep -Eq '^[[:space:]]*cloud:[[:space:]]*true[[:space:]]*$' \"$company_yaml\"; then\n  tmp=\"$(mktemp)\"\n  awk '\n    BEGIN { seen=0 }\n    \u002F^[[:space:]]*cloud:[[:space:]]*\u002F {\n      if (!seen) { print \"cloud: true\"; seen=1 }\n      next\n    }\n    { print }\n    END { if (!seen) print \"cloud: true\" }\n  ' \"$company_yaml\" > \"$tmp\"\n  mv \"$tmp\" \"$company_yaml\"\nfi\n\ncloud_count=\"$(grep -Ec '^[[:space:]]*cloud:[[:space:]]*' \"$company_yaml\" || true)\"\nif [ \"$cloud_count\" != \"1\" ]; then\n  echo \"ERROR: expected exactly one cloud key in $company_yaml, found $cloud_count\" >&2\n  exit 1\nfi\n\n# Graceful path: hq not on PATH. Surface the exact CLI command for the user.\nif ! command -v hq >\u002Fdev\u002Fnull 2>&1; then\n  echo \"Updated $company_yaml\"\n  echo \"hq binary not found on PATH. After installing the HQ CLI, run:\"\n  echo \"  hq cloud provision company $slug\"\n  exit 0\nfi\n\n# Echo the active HQ environment so any user can sanity-check their target.\n# Reads from env (HQ_VAULT_API_URL, HQ_COGNITO_DOMAIN) when set, otherwise\n# falls back to the CLI defaults. Operator identity comes from `hq whoami`\n# when available — this is informational only, never blocking.\nhq_vault_api_url_env=\"${HQ_VAULT_API_URL:-}\"\nhq_cognito_domain_env=\"${HQ_COGNITO_DOMAIN:-}\"\nhq_whoami_line=\"\"\nif hq whoami >\u002Fdev\u002Fnull 2>&1; then\n  hq_whoami_line=\"$(hq whoami 2>\u002Fdev\u002Fnull | head -1 || true)\"\nfi\necho \"HQ environment for designation:\"\necho \"  Operator:          ${hq_whoami_line:-\u003Cunknown — run \\`hq auth login\\`>}\"\necho \"  Vault API URL:     ${hq_vault_api_url_env:-\u003CCLI default>}\"\necho \"  Cognito domain:    ${hq_cognito_domain_env:-\u003CCLI default>}\"\n\n# Delegate to the canonical CLI subcommand.\n# Exit codes: 0 success | 1 vault\u002Fauth | 2 invalid input | 3 sync failed (entity provisioned)\nprovision_output=\"$(mktemp)\"\nset +e\nhq cloud provision company \"$slug\" >\"$provision_output\"\nprovision_status=$?\nset -e\n\n# CLI emits one structured JSON line to stdout. Log lines go to stderr.\nprovision_json=\"$(grep -E '^\\{' \"$provision_output\" | tail -1 || true)\"\ncat \"$provision_output\"\nrm -f \"$provision_output\"\n\nif [ \"$provision_status\" -ne 0 ] && [ \"$provision_status\" -ne 3 ]; then\n  echo \"ERROR: hq cloud provision company $slug failed (exit $provision_status)\" >&2\n  exit \"$provision_status\"\nfi\n\n# Parse fields for the audit row + summary. Defaults handle empty JSON.\nif [ -n \"$provision_json\" ]; then\n  cloud_uid=\"$(printf '%s' \"$provision_json\" | jq -r '.cloud_uid \u002F\u002F \"\"')\"\n  bucket_name=\"$(printf '%s' \"$provision_json\" | jq -r '.bucket_name \u002F\u002F \"\"')\"\n  vault_api_url=\"$(printf '%s' \"$provision_json\" | jq -r '.vault_api_url \u002F\u002F \"\"')\"\n  manifest_patched=\"$(printf '%s' \"$provision_json\" | jq -r '.manifest_patched \u002F\u002F false')\"\n  config_written=\"$(printf '%s' \"$provision_json\" | jq -r '.config_written \u002F\u002F false')\"\n  sync_ok=\"$(printf '%s' \"$provision_json\" | jq -r '.initial_sync.ok \u002F\u002F false')\"\n  files_uploaded=\"$(printf '%s' \"$provision_json\" | jq -r '.initial_sync.files_uploaded \u002F\u002F 0')\"\nelse\n  cloud_uid=\"\"; bucket_name=\"\"; vault_api_url=\"\"\n  manifest_patched=false; config_written=false; sync_ok=false; files_uploaded=0\nfi\n\n# Membership self-check — confirms the new cloud_uid is visible to the\n# operator's Cognito identity. If the CLI surfaced its own vault URL we use\n# that; else fall back to the vault URL written into .hq\u002Fconfig.json (the\n# CLI's source of truth); else env override; else skip silently. Token comes\n# from the standard cache the CLI maintains at ~\u002F.hq\u002Fcognito-tokens.json.\n# Sets membership_visible=true|false|unknown — only `false` triggers exit 4.\nmembership_visible=\"unknown\"\nmembership_check_url=\"\"\nif [ -n \"$vault_api_url\" ]; then\n  membership_check_url=\"$vault_api_url\"\nelif [ -f .hq\u002Fconfig.json ]; then\n  membership_check_url=\"$(jq -r '.vaultApiUrl \u002F\u002F empty' .hq\u002Fconfig.json 2>\u002Fdev\u002Fnull || true)\"\nfi\nif [ -z \"$membership_check_url\" ] && [ -n \"$hq_vault_api_url_env\" ]; then\n  membership_check_url=\"$hq_vault_api_url_env\"\nfi\n\ntoken_file=\"${HOME}\u002F.hq\u002Fcognito-tokens.json\"\nif [ -n \"$cloud_uid\" ] && [ -n \"$membership_check_url\" ] && [ -f \"$token_file\" ]; then\n  access_token=\"$(jq -r '.accessToken \u002F\u002F empty' \"$token_file\" 2>\u002Fdev\u002Fnull || true)\"\n  if [ -n \"$access_token\" ]; then\n    membership_body=\"$(mktemp)\"\n    membership_status=\"$(curl -sS -o \"$membership_body\" -w '%{http_code}' \\\n      -H \"Authorization: Bearer ${access_token}\" \\\n      -H \"Accept: application\u002Fjson\" \\\n      \"${membership_check_url%\u002F}\u002Fmembership\u002Fme\" 2>\u002Fdev\u002Fnull || echo \"000\")\"\n    if [ \"$membership_status\" = \"200\" ]; then\n      if jq -e --arg u \"$cloud_uid\" '.memberships \u002F\u002F [] | map(.companyUid) | index($u)' \\\n          \"$membership_body\" >\u002Fdev\u002Fnull 2>&1; then\n        membership_visible=\"true\"\n      else\n        membership_visible=\"false\"\n      fi\n    fi\n    rm -f \"$membership_body\"\n  fi\nfi\n\n# Audit row — structured JSONL (one record per run).\nmkdir -p \"$(dirname \"$audit_log\")\"\nprintf '{\"ts\":\"%s\",\"company\":\"%s\",\"company_yaml\":\"%s\",\"cli\":\"hq cloud provision company\",\"exit_status\":%d,\"cloud_uid\":%s,\"bucket_name\":%s,\"vault_api_url\":%s,\"manifest_patched\":%s,\"config_written\":%s,\"initial_sync_ok\":%s,\"files_uploaded\":%s,\"membership_visible\":%s}\\n' \\\n  \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" \\\n  \"$slug\" \\\n  \"$company_yaml\" \\\n  \"$provision_status\" \\\n  \"$(if [ -n \"$cloud_uid\" ]; then jq -Rn --arg v \"$cloud_uid\" '$v'; else printf 'null'; fi)\" \\\n  \"$(if [ -n \"$bucket_name\" ]; then jq -Rn --arg v \"$bucket_name\" '$v'; else printf 'null'; fi)\" \\\n  \"$(if [ -n \"$vault_api_url\" ]; then jq -Rn --arg v \"$vault_api_url\" '$v'; else printf 'null'; fi)\" \\\n  \"$manifest_patched\" \\\n  \"$config_written\" \\\n  \"$sync_ok\" \\\n  \"$files_uploaded\" \\\n  \"$(jq -Rn --arg v \"$membership_visible\" '$v')\" \\\n  >> \"$audit_log\"\n\nif [ \"$provision_status\" -eq 3 ]; then\n  echo \"PARTIAL: $slug entity provisioned but initial sync failed.\"\n  echo \"  Cloud UID: $cloud_uid\"\n  echo \"  Bucket: $bucket_name\"\n  echo \"  Re-run 'hq sync push companies\u002F$slug --company $slug' to retry.\"\n  exit 3\nfi\n\necho \"Designated $slug for cloud sync.\"\n[ -n \"$cloud_uid\" ] && echo \"Cloud UID: $cloud_uid\"\n[ -n \"$bucket_name\" ] && echo \"Bucket: $bucket_name\"\n[ \"$sync_ok\" = \"true\" ] && echo \"Initial sync: $files_uploaded files uploaded\"\n\n# Baseline member grants — one @all WRITE grant per synced top-level shared glob.\n# Plain members (role=member) get NO implicit file access: owner\u002Fadmin bypass\n# the ACL walk, members do not, and invite\u002Faccept writes no grants. Without\n# these rows a member who creates knowledge locally cannot push it (presign\n# PUT needs write on the key) and cannot pull what teammates wrote. Grants are\n# per-folder on purpose: never a bucket-wide '*' grant. Use an explicit `\u002F*`\n# shared glob for recursive access; a trailing `\u002F` only authorizes creating one\n# direct child and locks that child to its creator after first upload.\n# Idempotent: re-granting an existing @all entry is a no-op on the server.\nbaseline_grant_failures=0\nfor prefix in knowledge projects policies skills; do\n  if hq files share \"$prefix\u002F*\" --with @all --permission write --company \"$slug\" >\u002Fdev\u002Fnull 2>&1; then\n    echo \"Baseline grant: @all write on $prefix\u002F*\"\n  else\n    echo \"WARN: baseline grant failed for $prefix\u002F* — re-run: hq files share '$prefix\u002F*' --with @all --permission write --company $slug\" >&2\n    baseline_grant_failures=$((baseline_grant_failures + 1))\n  fi\ndone\n[ \"$baseline_grant_failures\" -eq 0 ] || echo \"WARN: $baseline_grant_failures baseline grant(s) failed; members may be unable to sync until re-run.\" >&2\n\ncase \"$membership_visible\" in\n  true)\n    echo \"Console visibility: confirmed via \u002Fmembership\u002Fme\"\n    ;;\n  false)\n    echo \"WARN: $slug provisioned but not visible via \u002Fmembership\u002Fme.\" >&2\n    echo \"  This usually means the CLI authenticated against a different Cognito\" >&2\n    echo \"  pool than the console. Check HQ_COGNITO_DOMAIN \u002F HQ_VAULT_API_URL,\" >&2\n    echo \"  refresh tokens with \\`hq auth login\\`, and re-run the self-check:\" >&2\n    echo \"    curl -H \\\"Authorization: Bearer \\$(jq -r .accessToken ~\u002F.hq\u002Fcognito-tokens.json)\\\" \\\\\" >&2\n    echo \"      ${membership_check_url%\u002F}\u002Fmembership\u002Fme\" >&2\n    exit 4\n    ;;\n  unknown)\n    echo \"Console visibility: not checked (no cached token or vault URL).\"\n    ;;\nesac\n```\n\n## See also\n\n- `\u002Fonboard` — provision a company first\n- `\u002Fhq-sync` — sync the cloud-backed company\n","# \u002Fdesignate-team\n\nDesignate one local `companies\u002F{slug}\u002F` directory as an HQ Pro team workspace by\nsetting `cloud: true` in `companies\u002F{slug}\u002Fcompany.yaml` (an HQ Desktop App marker), then\ndelegating cloud provisioning to the canonical CLI subcommand\n`hq cloud provision company \u003Cslug>`.\n\n**Company slug:** `$ARGUMENTS`\n\n## Rules\n\n- Refuse `personal`; personal sync is auto-provisioned per-user.\n- Validate the slug is non-empty and uses only `[A-Za-z0-9._-]`.\n- Validate `companies\u002F{slug}\u002F` exists locally (deeper validation — manifest\n  membership, archived status — happens inside the CLI subcommand).\n- Write `cloud: true` to `companies\u002F{slug}\u002Fcompany.yaml` idempotently. This is\n  an **HQ Desktop App marker** that `provision.rs::provision_missing_companies()` reads\n  to discover cloud-eligible companies. The CLI subcommand writes\n  `.hq\u002Fconfig.json` + patches `manifest.yaml` but does NOT touch `company.yaml`.\n- Delegate manifest patching, vault entity creation, S3 bucket provisioning, and\n  initial sync to `hq cloud provision company \u003Cslug>`. The CLI emits one line of\n  structured JSON to stdout on success (or partial success on exit code 3).\n- If `hq` is not on `PATH`, print the exact subcommand for the user to run later\n  and exit 0 (company.yaml has been written; remaining work is recoverable).\n- Echo the active HQ environment (vault URL, Cognito pool domain, current\n  operator) before calling the CLI. This catches \"wrong userpool\" \u002F \"wrong\n  vault\" surprises early and works for every HQ user — no owner-specific paths.\n- After the CLI succeeds, run a `GET \u002Fmembership\u002Fme` self-check against the\n  vault API the CLI just used. If the new `cloud_uid` is present in the\n  response, the company will appear in the HQ console for the current operator.\n  This is the same endpoint the console calls, so a green check here is a\n  deterministic guarantee of console visibility.\n- After the CLI succeeds, write the baseline member grants: `@all write` on\n  each of `knowledge\u002F*`, `projects\u002F*`, `policies\u002F*`, `skills\u002F*` as four separate\n  shared-folder prefix grants (`hq files share '\u003Cprefix>\u002F*' --with @all\n  --permission write --company {slug}`). Never a bucket-wide `*` grant. A\n  trailing slash without `*` is the private create-only pattern, so do not use\n  it for recursive baseline access. Members hold no implicit\n  file access (only owner\u002Fadmin bypass the ACL walk), so without these rows a\n  member cannot push the knowledge they create or pull what teammates wrote.\n  A failed grant is a warning with the exact re-run command, not a hard exit.\n  Narrow it afterward with `\u002Fteam-access` when a folder mixes shared and\n  private material. `ontology\u002F`, `signals\u002F`, and `sources\u002F` are never in the\n  baseline; the ontology worker grants them per audience.\n- Append one JSONL audit row to `workspace\u002Flearnings\u002Fdesignate-team-runs.jsonl`\n  capturing the structured result from the CLI plus the `membership_visible`\n  flag from the self-check.\n- Exit codes: 0 success | 1 vault\u002Fauth | 2 invalid input | 3 sync failed\n  (entity provisioned) | 4 provisioned but membership self-check failed\n  (entity exists but operator can't see it — likely a userpool\u002Ftoken mismatch).\n\n## Implementation\n\nRun this from the HQ root:\n\n```bash\nset -euo pipefail\n\nslug=\"${ARGUMENTS:-}\"\nif [ -z \"$slug\" ]; then\n  echo \"Usage: \u002Fdesignate-team \u003Ccompany-slug>\" >&2\n  exit 2\nfi\nif [ \"$slug\" = \"personal\" ]; then\n  echo \"ERROR: personal is out of scope for \u002Fdesignate-team\" >&2\n  exit 2\nfi\ncase \"$slug\" in\n  *[!A-Za-z0-9._-]*)\n    echo \"ERROR: invalid company slug '$slug'\" >&2\n    exit 2\n    ;;\nesac\n\ncompany_dir=\"companies\u002F$slug\"\ncompany_yaml=\"$company_dir\u002Fcompany.yaml\"\naudit_log=\"workspace\u002Flearnings\u002Fdesignate-team-runs.jsonl\"\n\nif [ ! -d \"$company_dir\" ]; then\n  echo \"ERROR: company directory not found: $company_dir\" >&2\n  exit 1\nfi\n\n# Idempotently write cloud: true to company.yaml.\n# This is the HQ Desktop App marker (provision.rs walks companies\u002F*\u002Fcompany.yaml looking\n# for cloud:true). The CLI subcommand never writes this file — it writes\n# .hq\u002Fconfig.json and patches manifest.yaml.\nmkdir -p \"$company_dir\"\nif [ ! -f \"$company_yaml\" ]; then\n  printf \"slug: %s\\ncloud: true\\n\" \"$slug\" > \"$company_yaml\"\nelif ! grep -Eq '^[[:space:]]*cloud:[[:space:]]*true[[:space:]]*$' \"$company_yaml\"; then\n  tmp=\"$(mktemp)\"\n  awk '\n    BEGIN { seen=0 }\n    \u002F^[[:space:]]*cloud:[[:space:]]*\u002F {\n      if (!seen) { print \"cloud: true\"; seen=1 }\n      next\n    }\n    { print }\n    END { if (!seen) print \"cloud: true\" }\n  ' \"$company_yaml\" > \"$tmp\"\n  mv \"$tmp\" \"$company_yaml\"\nfi\n\ncloud_count=\"$(grep -Ec '^[[:space:]]*cloud:[[:space:]]*' \"$company_yaml\" || true)\"\nif [ \"$cloud_count\" != \"1\" ]; then\n  echo \"ERROR: expected exactly one cloud key in $company_yaml, found $cloud_count\" >&2\n  exit 1\nfi\n\n# Graceful path: hq not on PATH. Surface the exact CLI command for the user.\nif ! command -v hq >\u002Fdev\u002Fnull 2>&1; then\n  echo \"Updated $company_yaml\"\n  echo \"hq binary not found on PATH. After installing the HQ CLI, run:\"\n  echo \"  hq cloud provision company $slug\"\n  exit 0\nfi\n\n# Echo the active HQ environment so any user can sanity-check their target.\n# Reads from env (HQ_VAULT_API_URL, HQ_COGNITO_DOMAIN) when set, otherwise\n# falls back to the CLI defaults. Operator identity comes from `hq whoami`\n# when available — this is informational only, never blocking.\nhq_vault_api_url_env=\"${HQ_VAULT_API_URL:-}\"\nhq_cognito_domain_env=\"${HQ_COGNITO_DOMAIN:-}\"\nhq_whoami_line=\"\"\nif hq whoami >\u002Fdev\u002Fnull 2>&1; then\n  hq_whoami_line=\"$(hq whoami 2>\u002Fdev\u002Fnull | head -1 || true)\"\nfi\necho \"HQ environment for designation:\"\necho \"  Operator:          ${hq_whoami_line:-\u003Cunknown — run \\`hq auth login\\`>}\"\necho \"  Vault API URL:     ${hq_vault_api_url_env:-\u003CCLI default>}\"\necho \"  Cognito domain:    ${hq_cognito_domain_env:-\u003CCLI default>}\"\n\n# Delegate to the canonical CLI subcommand.\n# Exit codes: 0 success | 1 vault\u002Fauth | 2 invalid input | 3 sync failed (entity provisioned)\nprovision_output=\"$(mktemp)\"\nset +e\nhq cloud provision company \"$slug\" >\"$provision_output\"\nprovision_status=$?\nset -e\n\n# CLI emits one structured JSON line to stdout. Log lines go to stderr.\nprovision_json=\"$(grep -E '^\\{' \"$provision_output\" | tail -1 || true)\"\ncat \"$provision_output\"\nrm -f \"$provision_output\"\n\nif [ \"$provision_status\" -ne 0 ] && [ \"$provision_status\" -ne 3 ]; then\n  echo \"ERROR: hq cloud provision company $slug failed (exit $provision_status)\" >&2\n  exit \"$provision_status\"\nfi\n\n# Parse fields for the audit row + summary. Defaults handle empty JSON.\nif [ -n \"$provision_json\" ]; then\n  cloud_uid=\"$(printf '%s' \"$provision_json\" | jq -r '.cloud_uid \u002F\u002F \"\"')\"\n  bucket_name=\"$(printf '%s' \"$provision_json\" | jq -r '.bucket_name \u002F\u002F \"\"')\"\n  vault_api_url=\"$(printf '%s' \"$provision_json\" | jq -r '.vault_api_url \u002F\u002F \"\"')\"\n  manifest_patched=\"$(printf '%s' \"$provision_json\" | jq -r '.manifest_patched \u002F\u002F false')\"\n  config_written=\"$(printf '%s' \"$provision_json\" | jq -r '.config_written \u002F\u002F false')\"\n  sync_ok=\"$(printf '%s' \"$provision_json\" | jq -r '.initial_sync.ok \u002F\u002F false')\"\n  files_uploaded=\"$(printf '%s' \"$provision_json\" | jq -r '.initial_sync.files_uploaded \u002F\u002F 0')\"\nelse\n  cloud_uid=\"\"; bucket_name=\"\"; vault_api_url=\"\"\n  manifest_patched=false; config_written=false; sync_ok=false; files_uploaded=0\nfi\n\n# Membership self-check — confirms the new cloud_uid is visible to the\n# operator's Cognito identity. If the CLI surfaced its own vault URL we use\n# that; else fall back to the vault URL written into .hq\u002Fconfig.json (the\n# CLI's source of truth); else env override; else skip silently. Token comes\n# from the standard cache the CLI maintains at ~\u002F.hq\u002Fcognito-tokens.json.\n# Sets membership_visible=true|false|unknown — only `false` triggers exit 4.\nmembership_visible=\"unknown\"\nmembership_check_url=\"\"\nif [ -n \"$vault_api_url\" ]; then\n  membership_check_url=\"$vault_api_url\"\nelif [ -f .hq\u002Fconfig.json ]; then\n  membership_check_url=\"$(jq -r '.vaultApiUrl \u002F\u002F empty' .hq\u002Fconfig.json 2>\u002Fdev\u002Fnull || true)\"\nfi\nif [ -z \"$membership_check_url\" ] && [ -n \"$hq_vault_api_url_env\" ]; then\n  membership_check_url=\"$hq_vault_api_url_env\"\nfi\n\ntoken_file=\"${HOME}\u002F.hq\u002Fcognito-tokens.json\"\nif [ -n \"$cloud_uid\" ] && [ -n \"$membership_check_url\" ] && [ -f \"$token_file\" ]; then\n  access_token=\"$(jq -r '.accessToken \u002F\u002F empty' \"$token_file\" 2>\u002Fdev\u002Fnull || true)\"\n  if [ -n \"$access_token\" ]; then\n    membership_body=\"$(mktemp)\"\n    membership_status=\"$(curl -sS -o \"$membership_body\" -w '%{http_code}' \\\n      -H \"Authorization: Bearer ${access_token}\" \\\n      -H \"Accept: application\u002Fjson\" \\\n      \"${membership_check_url%\u002F}\u002Fmembership\u002Fme\" 2>\u002Fdev\u002Fnull || echo \"000\")\"\n    if [ \"$membership_status\" = \"200\" ]; then\n      if jq -e --arg u \"$cloud_uid\" '.memberships \u002F\u002F [] | map(.companyUid) | index($u)' \\\n          \"$membership_body\" >\u002Fdev\u002Fnull 2>&1; then\n        membership_visible=\"true\"\n      else\n        membership_visible=\"false\"\n      fi\n    fi\n    rm -f \"$membership_body\"\n  fi\nfi\n\n# Audit row — structured JSONL (one record per run).\nmkdir -p \"$(dirname \"$audit_log\")\"\nprintf '{\"ts\":\"%s\",\"company\":\"%s\",\"company_yaml\":\"%s\",\"cli\":\"hq cloud provision company\",\"exit_status\":%d,\"cloud_uid\":%s,\"bucket_name\":%s,\"vault_api_url\":%s,\"manifest_patched\":%s,\"config_written\":%s,\"initial_sync_ok\":%s,\"files_uploaded\":%s,\"membership_visible\":%s}\\n' \\\n  \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" \\\n  \"$slug\" \\\n  \"$company_yaml\" \\\n  \"$provision_status\" \\\n  \"$(if [ -n \"$cloud_uid\" ]; then jq -Rn --arg v \"$cloud_uid\" '$v'; else printf 'null'; fi)\" \\\n  \"$(if [ -n \"$bucket_name\" ]; then jq -Rn --arg v \"$bucket_name\" '$v'; else printf 'null'; fi)\" \\\n  \"$(if [ -n \"$vault_api_url\" ]; then jq -Rn --arg v \"$vault_api_url\" '$v'; else printf 'null'; fi)\" \\\n  \"$manifest_patched\" \\\n  \"$config_written\" \\\n  \"$sync_ok\" \\\n  \"$files_uploaded\" \\\n  \"$(jq -Rn --arg v \"$membership_visible\" '$v')\" \\\n  >> \"$audit_log\"\n\nif [ \"$provision_status\" -eq 3 ]; then\n  echo \"PARTIAL: $slug entity provisioned but initial sync failed.\"\n  echo \"  Cloud UID: $cloud_uid\"\n  echo \"  Bucket: $bucket_name\"\n  echo \"  Re-run 'hq sync push companies\u002F$slug --company $slug' to retry.\"\n  exit 3\nfi\n\necho \"Designated $slug for cloud sync.\"\n[ -n \"$cloud_uid\" ] && echo \"Cloud UID: $cloud_uid\"\n[ -n \"$bucket_name\" ] && echo \"Bucket: $bucket_name\"\n[ \"$sync_ok\" = \"true\" ] && echo \"Initial sync: $files_uploaded files uploaded\"\n\n# Baseline member grants — one @all WRITE grant per synced top-level shared glob.\n# Plain members (role=member) get NO implicit file access: owner\u002Fadmin bypass\n# the ACL walk, members do not, and invite\u002Faccept writes no grants. Without\n# these rows a member who creates knowledge locally cannot push it (presign\n# PUT needs write on the key) and cannot pull what teammates wrote. Grants are\n# per-folder on purpose: never a bucket-wide '*' grant. Use an explicit `\u002F*`\n# shared glob for recursive access; a trailing `\u002F` only authorizes creating one\n# direct child and locks that child to its creator after first upload.\n# Idempotent: re-granting an existing @all entry is a no-op on the server.\nbaseline_grant_failures=0\nfor prefix in knowledge projects policies skills; do\n  if hq files share \"$prefix\u002F*\" --with @all --permission write --company \"$slug\" >\u002Fdev\u002Fnull 2>&1; then\n    echo \"Baseline grant: @all write on $prefix\u002F*\"\n  else\n    echo \"WARN: baseline grant failed for $prefix\u002F* — re-run: hq files share '$prefix\u002F*' --with @all --permission write --company $slug\" >&2\n    baseline_grant_failures=$((baseline_grant_failures + 1))\n  fi\ndone\n[ \"$baseline_grant_failures\" -eq 0 ] || echo \"WARN: $baseline_grant_failures baseline grant(s) failed; members may be unable to sync until re-run.\" >&2\n\ncase \"$membership_visible\" in\n  true)\n    echo \"Console visibility: confirmed via \u002Fmembership\u002Fme\"\n    ;;\n  false)\n    echo \"WARN: $slug provisioned but not visible via \u002Fmembership\u002Fme.\" >&2\n    echo \"  This usually means the CLI authenticated against a different Cognito\" >&2\n    echo \"  pool than the console. Check HQ_COGNITO_DOMAIN \u002F HQ_VAULT_API_URL,\" >&2\n    echo \"  refresh tokens with \\`hq auth login\\`, and re-run the self-check:\" >&2\n    echo \"    curl -H \\\"Authorization: Bearer \\$(jq -r .accessToken ~\u002F.hq\u002Fcognito-tokens.json)\\\" \\\\\" >&2\n    echo \"      ${membership_check_url%\u002F}\u002Fmembership\u002Fme\" >&2\n    exit 4\n    ;;\n  unknown)\n    echo \"Console visibility: not checked (no cached token or vault URL).\"\n    ;;\nesac\n```\n\n## See also\n\n- `\u002Fonboard` — provision a company first\n- `\u002Fhq-sync` — sync the cloud-backed company\n",{"name":5,"description":7,"allowed-tools":44},"Read, Bash(bash:*), Bash(yq:*), Bash(awk:*), Bash(grep:*), Bash(wc:*), Bash(tr:*), Bash(mkdir:*), Bash(mktemp:*), Bash(mv:*), Bash(printf:*), Bash(date:*), Bash(jq:*), Bash(hq:*), Bash","main","205cf61728a27ef15e9153aa38df5856fc8d82f5",".claude\u002Fskills\u002Fdesignate-team",18,"https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core","https:\u002F\u002Fgithub.com\u002Findigoai-us","https:\u002F\u002Fhqforwork.com\u002F","The AI Context Layer for Teams","2026-11-12 06:53:38",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":66},[56,59,62],{"tool":57,"command":58},"npx","npx skills add indigoai-us\u002Fhq-core --skill designate-team",{"tool":60,"command":61},"bunx","bunx skills add indigoai-us\u002Fhq-core --skill designate-team",{"tool":63,"command":64},"pnpm","pnpm dlx skills add indigoai-us\u002Fhq-core --skill designate-team","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesignate-team\u002FSKILL.md",true,[68],{"path":69,"resourceType":70,"resourceTypeDesc":71,"sizeBytes":72,"sourceHtmlUrl":73},"agents\u002Fopenai.yaml","REFERENCE","参考文档",117,"https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdesignate-team\u002Fagents\u002Fopenai.yaml",[75,95,125,149,160,170],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":81,"publishedAt":39},"01M71E4MQ04WPK1EVDS7VKJ3E8","social-graphic","Generate 1080x1080 HTML social graphics for HQ update posts.","https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002Fcore\u002Fworkers\u002Fpublic\u002Fsocial-strategist\u002Fskills\u002Fsocial-graphic\u002FSKILL.md",[],[82,83,23,84,85,86,31,87,88,89,90,91,92,93,94],"social","social graphic","html","edit","write","update","generate","graphics","browser","open","agent-browser","for","posts",{"skillNo":96,"name":92,"nameZh":6,"description":97,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":98,"categories":99,"keywords":108,"publishedAt":39},"01M71E4H33K4P5H5M7ENPTMFSC","Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to \"open a website\", \"fill out a form\", \"click a button\", \"take a screenshot\", \"scrape data from a page\", \"test this web app\", \"login to a site\", \"automate browser actions\", or any task requiring programmatic web interaction.","https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002Fcore\u002Fworkers\u002Fpublic\u002Fqa-tester\u002Fskills\u002Fagent-browser\u002FSKILL.md",[100,105],{"categoryNo":101,"categoryName":102,"taxonomyType":103,"taxonomyTypeDesc":104},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":106,"categoryName":107,"taxonomyType":103,"taxonomyTypeDesc":104},"01JBSEEDCAT000000000000023","Skill与智能体开发",[109,90,110,111,112,113,23,114,115,116,117,118,91,119,92,120,121,122,123,124],"agent browser","click","ai agents","app","scrape","when","apps","actions","extracting","take a screenshot","testing","programmatic","browser automation","website","cli","interaction",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":39},"01M71E4FDBD7J8Y45JJ9KMMYGN","work-mesh","Work Mesh Live — automatic presence via hq mesh daemon; context reconcile\u002Forganize; manual session task-status, blocked, and note only.","https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fwork-mesh\u002FSKILL.md",[],[132,133,134,23,135,136,137,138,139,140,141,142,143,144,31,145,146,147,148],"work mesh","work","mesh","status","context","note","live","presence","automatic","reconcile","only","organize","task","session","manual","daemon","via",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":39},"01M71E4EGHNAAGWAPV6KGBMQ9W","review","Parity worker review skill (materialization fixture).","https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002Fcore\u002Fscripts\u002Ftests\u002Ffixtures\u002Fagent-session\u002Fworker-materialization\u002Fparity-worker\u002Fskills\u002Freview\u002FSKILL.md",[],[151,156,157,158,159],"review skill","fixture","parity","worker",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":39},"01M71E4D1FZDJPDC15DRERKX8Y","run","Run or list HQ workers (parity fixture).","https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002Fcore\u002Fscripts\u002Ftests\u002Ffixtures\u002Fagent-session\u002Fskills\u002Frun\u002FSKILL.md",[],[162,167,168,158,169,157],"parity fixture","workers","list",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":39},"01M71E4BF4MV5SEWZJZ4T1QPQW","handoff","Preserve session state for a follow-up agent (parity fixture).","https:\u002F\u002Fgithub.com\u002Findigoai-us\u002Fhq-core\u002Fblob\u002Fmain\u002Fcore\u002Fscripts\u002Ftests\u002Ffixtures\u002Fagent-session\u002Fskills\u002Fhandoff\u002FSKILL.md",[],[172,167,177,178,145,179,93,158,180,181,157],"up","preserve","session state","follow-up","state"]