@indigoai-us/hq-cli 5.345.138 → 5.345.140

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [5.345.140] — 2026-10-16
+- `hq auth status` now reports the machine token cache when HQ runs under a machine identity (fleet agents and other machine sign-ins). Before, it read only the person token file and reported "no cached session yet" on a machine that held a valid machine session, even though `hq auth refresh` had just renewed it.
+
+## [5.345.139] — 2026-10-15
+- `hq storage offload` and `hq storage fetch` no longer fail about 15 to 25 minutes into a run. Personal and company
+  vault credentials are now re-vended before they expire, for the whole run and in the middle of a multipart upload.
+  When S3 still refuses a request's credentials, HQ re-vends once and retries that request once. A request refused
+  again fails, and an interrupted company upload resumes from its last finished part on the next run.
+- Vault errors now name the request, the vault, the HTTP status and the error code, for example
+  `HEAD failed in company vault 'acme': HTTP 403 Forbidden (no error body: credentials expired or access denied)`,
+  instead of a bare `UnknownError`.
+
 ## [5.345.138] — 2026-10-15
 - `hq storage offload --current` can now free company files larger than the 50 MB sync limit. It uploads each one to its company vault, checks the vault copy against the file's sha256 and size, records it as cloud-only, writes the `.hqcloud` placeholder, and only then removes the local copy. An interrupted upload leaves the file in place and resumes on the next run. The dry run shows `upload+offload` with the byte count and the vault key. A path the `.hqinclude` allowlist excludes is refused with the line to add. `hq storage fetch` checks the vault copy's sha256 before restoring it. The upload path turns on once the bundled hq-cloud includes the new upload exports; until then these files report that HQ sync needs an update.
 

package/dist/commands/auth.js

@@ -21,7 +21,7 @@ import { open, realpath } from "node:fs/promises";
 import path from "node:path";
 import chalk from "chalk";
 import { browserLogin, clearCachedTokens, loadCachedTokens, isExpiring, loadMachineCreds, CognitoAuthError, } from "@indigoai-us/hq-cloud";
-import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, ensureMachineSessionTokens, personTokenCacheFile, machineTokenCacheFile, } from "../utils/cognito-session.js";
+import { DEFAULT_COGNITO, refreshCachedSession, resolveCognitoTokenSource, ensureMachineSessionTokens, personTokenCacheFile, machineTokenCacheFile, loadMachineCachedTokens, } from "../utils/cognito-session.js";
 // Static (node builtins only): a lazy import here would need a resident
 // preload entry for the auth-login path.
 import * as tokenKeychain from "../utils/token-keychain.js";
@@ -358,7 +358,11 @@ export function registerAuthCommands(program) {
         // the person cache rejected (transient refresh errors still report person).
         const tokenSource = resolveCognitoTokenSource();
         const machine = tokenSource === "machine";
-        const cached = loadCachedTokens();
+        // Machine tokens live in the daemon state dir, never ~/.hq. Reading the
+        // person cache here reported "no cached session" on agent boxes whose
+        // machine cache was valid, and could show a stale person session as the
+        // machine one.
+        const cached = machine ? loadMachineCachedTokens() : loadCachedTokens();
         if (!cached) {
             if (machine) {
                 // No cached session yet, but machine creds mint one on demand —

package/dist/commands/storage-offload.d.ts

@@ -130,12 +130,54 @@ export interface BlobStore {
 export interface OffloadS3Client {
     send(cmd: PutObjectCommand | HeadObjectCommand | GetObjectCommand): Promise<unknown>;
 }
+/**
+ * True when S3 refused the request's credentials: an expired, invalid or
+ * denied token, or a 403 with no error body (what S3 sends for HEAD).
+ */
+export declare function isCredentialRejection(err: unknown): boolean;
+/** A failed vault request, described with its HTTP status, error code and vault. */
+export declare class VaultRequestError extends Error {
+    readonly status?: number;
+    readonly code?: string;
+    constructor(message: string, opts: {
+        status?: number;
+        code?: string;
+        cause: unknown;
+    });
+}
+/**
+ * Describes an AWS error from `op` against `where` so the user sees the HTTP
+ * status, the error code and the vault, never the SDK's bare "UnknownError".
+ * Errors that did not come from AWS pass through unchanged.
+ */
+export declare function describeVaultError(err: unknown, op: string, where: string, retried?: boolean): unknown;
+/** Turns any per-file failure into one line for the run's error list. */
+export declare function failureMessage(err: unknown): string;
+/**
+ * Runs vault requests on `initial` and, when S3 refuses the credentials,
+ * re-vends once and retries the request once on the new client. Requests
+ * refused on the same client share one re-vend. A request refused again
+ * after the re-vend fails with a described error; it is never retried twice.
+ */
+export declare function credentialRetry<C>(initial: C, where: string, revend?: () => Promise<C>): <T>(op: string, fn: (client: C) => Promise<T>) => Promise<T>;
+/**
+ * Wraps every method of `initial` (a multipart client) so each call gets
+ * {@link credentialRetry}: one re-vend and one retry when S3 refuses the
+ * credentials, and a described error otherwise.
+ */
+export declare function credentialRetryingClient<C extends object>(initial: C, where: string, revend: () => Promise<C>): C;
+export interface S3StoreOptions<C> {
+    /** How errors name the vault, e.g. "personal vault" or "company vault 'acme'". */
+    where?: string;
+    /** Vends fresh credentials and returns a client that uses them. */
+    revend?: () => Promise<C>;
+}
 /**
  * S3-backed store over the caller's personal vault bucket. Accepts only
  * personal vault buckets (`hq-vault-prs-*`) so a mis-resolved entity can never
  * receive offloaded bytes.
  */
-export declare function s3BlobStore(bucket: string, s3: OffloadS3Client): BlobStore;
+export declare function s3BlobStore(bucket: string, s3: OffloadS3Client, opts?: S3StoreOptions<OffloadS3Client>): BlobStore;
 /** Read-only access to vault objects at their sync keys, pinned to an ETag. */
 export interface VaultObjectStore {
     /**
@@ -153,7 +195,7 @@ export interface VaultObjectStore {
 export interface VaultObjectS3Client {
     send(cmd: GetObjectCommand | HeadObjectCommand): Promise<unknown>;
 }
-export declare function s3VaultObjectStore(bucket: string, s3: VaultObjectS3Client): VaultObjectStore;
+export declare function s3VaultObjectStore(bucket: string, s3: VaultObjectS3Client, opts?: S3StoreOptions<VaultObjectS3Client>): VaultObjectStore;
 export interface OffloadDeps {
     hqRoot: string;
     now: () => Date;
@@ -484,13 +526,4 @@ export declare function getOffloadStatus(deps: OffloadDeps, opts: {
 export declare function gitExportBlob(hqRoot: string): (sha: string, dest: string) => Promise<void>;
 export declare function gitListPlaceholders(hqRoot: string): () => Promise<string[]>;
 export declare function defaultTmpDir(): string;
-export declare function personalS3Store(input: {
-    bucket: string;
-    region: string;
-    credentials: {
-        accessKeyId: string;
-        secretAccessKey: string;
-        sessionToken: string;
-    };
-}): BlobStore;
 //# sourceMappingURL=storage-offload.d.ts.map

package/dist/commands/storage-offload.js

@@ -50,7 +50,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { spawn, execFile } from "node:child_process";
-import { S3Client, GetObjectCommand, HeadObjectCommand, PutObjectCommand, } from "@aws-sdk/client-s3";
+import { GetObjectCommand, HeadObjectCommand, PutObjectCommand, } from "@aws-sdk/client-s3";
 import { checkPreconditions, coreHasFlag, coreSupports, dropExpiredBackups, PRECONDITION_FALLBACK, coreKeepsUndo, reclaimFields, reclaimWindowHours, runCoreScript, } from "./storage-core.js";
 // ── Constants ───────────────────────────────────────────────────────────────
 export const PLACEHOLDER_SUFFIX = ".hqcloud";
@@ -211,103 +211,268 @@ function isNotFound(err) {
     const e = err;
     return e?.name === "NotFound" || e?.name === "NoSuchKey" || e?.$metadata?.httpStatusCode === 404;
 }
+// ── Vault request errors and credential refresh ─────────────────────────────
+/** Error codes S3 and STS return when the request's credentials are refused. */
+const CREDENTIAL_ERROR_HINTS = {
+    ExpiredToken: "credentials expired",
+    ExpiredTokenException: "credentials expired",
+    TokenRefreshRequired: "credentials expired",
+    RequestExpired: "credentials expired",
+    InvalidToken: "credentials rejected",
+    InvalidAccessKeyId: "credentials rejected",
+    InvalidSecurityToken: "credentials rejected",
+    InvalidClientTokenId: "credentials rejected",
+    AccessDenied: "access denied",
+};
+/** Placeholder names the SDK uses when the response carried no error code. */
+const NO_CODE = new Set(["", "Unknown", "UnknownError", "Error"]);
+function awsErrorCode(err) {
+    const candidates = [err.Code, err.code, err.name, err.$response?.headers?.["x-amz-error-code"]];
+    return candidates.find((c) => typeof c === "string" && !NO_CODE.has(c));
+}
+function isAwsError(err) {
+    if (!err || typeof err !== "object")
+        return false;
+    const e = err;
+    return typeof e.$metadata === "object" || typeof e.$fault === "string" || e.name === "Unknown";
+}
+/**
+ * True when S3 refused the request's credentials: an expired, invalid or
+ * denied token, or a 403 with no error body (what S3 sends for HEAD).
+ */
+export function isCredentialRejection(err) {
+    if (!isAwsError(err))
+        return false;
+    const status = err.$metadata?.httpStatusCode;
+    const code = awsErrorCode(err);
+    if (code)
+        return code in CREDENTIAL_ERROR_HINTS && (status === undefined || status === 400 || status === 403);
+    return status === 403;
+}
+/** A failed vault request, described with its HTTP status, error code and vault. */
+export class VaultRequestError extends Error {
+    status;
+    code;
+    constructor(message, opts) {
+        super(message, { cause: opts.cause });
+        this.name = "VaultRequestError";
+        this.status = opts.status;
+        this.code = opts.code;
+    }
+}
+/**
+ * Describes an AWS error from `op` against `where` so the user sees the HTTP
+ * status, the error code and the vault, never the SDK's bare "UnknownError".
+ * Errors that did not come from AWS pass through unchanged.
+ */
+export function describeVaultError(err, op, where, retried = false) {
+    if (err instanceof VaultRequestError || !isAwsError(err))
+        return err;
+    const status = err.$metadata?.httpStatusCode;
+    const code = awsErrorCode(err);
+    let what;
+    if (code) {
+        const hint = CREDENTIAL_ERROR_HINTS[code];
+        what = hint ? `${code} (${hint})` : code;
+    }
+    else if (status === 403) {
+        what = "Forbidden (no error body: credentials expired or access denied)";
+    }
+    else {
+        what = "error with no error code";
+    }
+    let message = `${op} failed in ${where}: ${status ? `HTTP ${status} ` : ""}${what}`;
+    if (retried)
+        message += ", after re-vending credentials once";
+    const detail = err.message?.trim();
+    if (detail && !NO_CODE.has(detail) && detail !== code)
+        message += `: ${detail}`;
+    return new VaultRequestError(message, { status, code, cause: err });
+}
+/** Turns any per-file failure into one line for the run's error list. */
+export function failureMessage(err) {
+    const described = describeVaultError(err, "Request", "the vault");
+    return described instanceof Error ? described.message : String(described);
+}
+/**
+ * Runs vault requests on `initial` and, when S3 refuses the credentials,
+ * re-vends once and retries the request once on the new client. Requests
+ * refused on the same client share one re-vend. A request refused again
+ * after the re-vend fails with a described error; it is never retried twice.
+ */
+export function credentialRetry(initial, where, revend) {
+    let client = initial;
+    let generation = 0;
+    let pending;
+    return async function call(op, fn) {
+        const used = generation;
+        try {
+            return await fn(client);
+        }
+        catch (err) {
+            if (!revend || !isCredentialRejection(err))
+                throw describeVaultError(err, op, where);
+            if (generation === used) {
+                pending ??= revend()
+                    .then((fresh) => {
+                    client = fresh;
+                    generation += 1;
+                })
+                    .finally(() => {
+                    pending = undefined;
+                });
+                try {
+                    await pending;
+                }
+                catch (vendErr) {
+                    const refused = describeVaultError(err, op, where);
+                    throw new Error(`${refused.message}; re-vending credentials for ${where} failed: ${vendErr?.message ?? String(vendErr)}`, { cause: vendErr });
+                }
+            }
+            try {
+                return await fn(client);
+            }
+            catch (again) {
+                throw describeVaultError(again, op, where, true);
+            }
+        }
+    };
+}
+const CLIENT_METHOD_OPS = {
+    create: "CreateMultipartUpload",
+    uploadPart: "UploadPart",
+    listParts: "ListParts",
+    complete: "CompleteMultipartUpload",
+    abort: "AbortMultipartUpload",
+    head: "HeadObject",
+};
+/**
+ * Wraps every method of `initial` (a multipart client) so each call gets
+ * {@link credentialRetry}: one re-vend and one retry when S3 refuses the
+ * credentials, and a described error otherwise.
+ */
+export function credentialRetryingClient(initial, where, revend) {
+    const call = credentialRetry(initial, where, revend);
+    const wrapped = {};
+    for (const name of Object.keys(initial)) {
+        if (typeof initial[name] !== "function")
+            continue;
+        wrapped[name] = (...args) => call(CLIENT_METHOD_OPS[name] ?? name, (c) => c[name].apply(c, args));
+    }
+    return { ...initial, ...wrapped };
+}
+function pipeToNewFile(body, dest) {
+    return new Promise((resolve, reject) => {
+        const out = fs.createWriteStream(dest, { flags: "wx" });
+        body.on("error", reject);
+        out.on("error", reject);
+        out.on("finish", () => resolve());
+        body.pipe(out);
+    });
+}
 /**
  * S3-backed store over the caller's personal vault bucket. Accepts only
  * personal vault buckets (`hq-vault-prs-*`) so a mis-resolved entity can never
  * receive offloaded bytes.
  */
-export function s3BlobStore(bucket, s3) {
+export function s3BlobStore(bucket, s3, opts = {}) {
     if (!bucket || !bucket.startsWith(PERSONAL_BUCKET_PREFIX)) {
         throw new Error(`Refusing to offload into '${bucket}': offload only writes to your personal vault.`);
     }
+    const call = credentialRetry(s3, opts.where ?? `vault '${bucket}'`, opts.revend);
     return {
         vault: "personal",
-        async head(key) {
-            try {
-                const res = (await s3.send(new HeadObjectCommand({ Bucket: bucket, Key: key, ChecksumMode: "ENABLED" })));
-                const fromChecksum = res.ChecksumSHA256 && !res.ChecksumSHA256.includes("-")
-                    ? Buffer.from(res.ChecksumSHA256, "base64").toString("hex")
-                    : undefined;
-                // The server-computed checksum wins; client metadata is a fallback for
-                // objects stored without one.
-                return { size: res.ContentLength ?? -1, sha256: fromChecksum ?? res.Metadata?.sha256 };
-            }
-            catch (err) {
-                if (isNotFound(err))
-                    return null;
-                throw err;
-            }
+        head(key) {
+            return call("HEAD", async (client) => {
+                try {
+                    const res = (await client.send(new HeadObjectCommand({ Bucket: bucket, Key: key, ChecksumMode: "ENABLED" })));
+                    const fromChecksum = res.ChecksumSHA256 && !res.ChecksumSHA256.includes("-")
+                        ? Buffer.from(res.ChecksumSHA256, "base64").toString("hex")
+                        : undefined;
+                    // The server-computed checksum wins; client metadata is a fallback for
+                    // objects stored without one.
+                    return { size: res.ContentLength ?? -1, sha256: fromChecksum ?? res.Metadata?.sha256 };
+                }
+                catch (err) {
+                    if (isNotFound(err))
+                        return null;
+                    throw err;
+                }
+            });
         },
         async put(key, file, digest) {
-            await s3.send(new PutObjectCommand({
-                Bucket: bucket,
-                Key: key,
-                Body: fs.createReadStream(file),
-                ContentLength: digest.size,
-                ChecksumSHA256: Buffer.from(digest.sha256, "hex").toString("base64"),
-                StorageClass: "STANDARD",
-                Metadata: { sha256: digest.sha256, "git-blob": digest.gitBlob },
-            }));
+            await call("PUT", async (client) => {
+                // A fresh stream per attempt: a refused attempt may have read from the last one.
+                const body = fs.createReadStream(file);
+                try {
+                    await client.send(new PutObjectCommand({
+                        Bucket: bucket,
+                        Key: key,
+                        Body: body,
+                        ContentLength: digest.size,
+                        ChecksumSHA256: Buffer.from(digest.sha256, "hex").toString("base64"),
+                        StorageClass: "STANDARD",
+                        Metadata: { sha256: digest.sha256, "git-blob": digest.gitBlob },
+                    }));
+                }
+                finally {
+                    body.destroy();
+                }
+            });
         },
         async download(key, dest) {
-            const res = (await s3.send(new GetObjectCommand({ Bucket: bucket, Key: key })));
+            // Only the request is retried: the destination is created by the pipe below.
+            const res = await call("GET", async (client) => (await client.send(new GetObjectCommand({ Bucket: bucket, Key: key }))));
             const body = res.Body;
             if (!body)
                 throw new Error(`Empty download for ${key}.`);
-            await new Promise((resolve, reject) => {
-                const out = fs.createWriteStream(dest, { flags: "wx" });
-                body.on("error", reject);
-                out.on("error", reject);
-                out.on("finish", () => resolve());
-                body.pipe(out);
-            });
+            await pipeToNewFile(body, dest);
         },
     };
 }
-export function s3VaultObjectStore(bucket, s3) {
+export function s3VaultObjectStore(bucket, s3, opts = {}) {
+    const call = credentialRetry(s3, opts.where ?? `vault '${bucket}'`, opts.revend);
     return {
-        async head(key) {
-            try {
-                const res = (await s3.send(new HeadObjectCommand({ Bucket: bucket, Key: key })));
-                const head = {
-                    size: res.ContentLength ?? -1,
-                    etag: normalizeEtag(res.ETag),
-                };
-                const sha = res.Metadata?.[VAULT_SHA256_METADATA_KEY];
-                if (sha && HEX64.test(sha))
-                    head.sha256 = sha;
-                return head;
-            }
-            catch (err) {
-                if (isNotFound(err))
-                    return null;
-                throw err;
-            }
+        head(key) {
+            return call("HEAD", async (client) => {
+                try {
+                    const res = (await client.send(new HeadObjectCommand({ Bucket: bucket, Key: key })));
+                    const head = {
+                        size: res.ContentLength ?? -1,
+                        etag: normalizeEtag(res.ETag),
+                    };
+                    const sha = res.Metadata?.[VAULT_SHA256_METADATA_KEY];
+                    if (sha && HEX64.test(sha))
+                        head.sha256 = sha;
+                    return head;
+                }
+                catch (err) {
+                    if (isNotFound(err))
+                        return null;
+                    throw err;
+                }
+            });
         },
         async download(key, dest, etag) {
-            let res;
-            try {
-                res = (await s3.send(new GetObjectCommand({ Bucket: bucket, Key: key, IfMatch: `"${normalizeEtag(etag)}"` })));
-            }
-            catch (err) {
-                const e = err;
-                if (e?.name === "PreconditionFailed" || e?.$metadata?.httpStatusCode === 412) {
-                    throw new Error("The cloud copy of this file changed since HQ sync last saw it. Run `hq sync`, then try again.");
+            // Only the request is retried: the destination is created by the pipe below.
+            const res = await call("GET", async (client) => {
+                try {
+                    return (await client.send(new GetObjectCommand({ Bucket: bucket, Key: key, IfMatch: `"${normalizeEtag(etag)}"` })));
                 }
-                if (isNotFound(err))
-                    throw new Error(`This file is no longer in the cloud (${key}).`);
-                throw err;
-            }
+                catch (err) {
+                    const e = err;
+                    if (e?.name === "PreconditionFailed" || e?.$metadata?.httpStatusCode === 412) {
+                        throw new Error("The cloud copy of this file changed since HQ sync last saw it. Run `hq sync`, then try again.");
+                    }
+                    if (isNotFound(err))
+                        throw new Error(`This file is no longer in the cloud (${key}).`);
+                    throw err;
+                }
+            });
             const body = res.Body;
             if (!body)
                 throw new Error(`Empty download for ${key}.`);
-            await new Promise((resolve, reject) => {
-                const out = fs.createWriteStream(dest, { flags: "wx" });
-                body.on("error", reject);
-                out.on("error", reject);
-                out.on("finish", () => resolve());
-                body.pipe(out);
-            });
+            await pipeToNewFile(body, dest);
             return normalizeEtag(res.ETag);
         },
     };
@@ -879,7 +1044,7 @@ async function runCurrent(opts, deps, result) {
             current.freed_bytes += plan.bytes;
         }
         catch (err) {
-            result.errors.push(`${plan.path}: ${err.message}`);
+            result.errors.push(`${plan.path}: ${failureMessage(err)}`);
         }
     }
     return "ok";
@@ -1023,7 +1188,7 @@ export async function runOffload(opts, deps) {
             });
         }
         catch (err) {
-            result.errors.push(`${blob.paths[0] ?? blob.sha}: ${err.message}`);
+            result.errors.push(`${blob.paths[0] ?? blob.sha}: ${failureMessage(err)}`);
         }
     }
     if (manifest.length === 0)
@@ -1393,7 +1558,4 @@ export function gitListPlaceholders(hqRoot) {
 export function defaultTmpDir() {
     return os.tmpdir();
 }
-export function personalS3Store(input) {
-    return s3BlobStore(input.bucket, new S3Client({ region: input.region, credentials: input.credentials }));
-}
 //# sourceMappingURL=storage-offload.js.map

package/dist/commands/storage.d.ts

@@ -35,7 +35,7 @@
  */
 import { Command } from "commander";
 import { type ReclaimReport } from "./storage-core.js";
-import { ListObjectVersionsCommand, DeleteObjectsCommand, type ListObjectVersionsCommandOutput, type DeleteObjectsCommandOutput } from "@aws-sdk/client-s3";
+import { S3Client, ListObjectVersionsCommand, DeleteObjectsCommand, type ListObjectVersionsCommandOutput, type DeleteObjectsCommandOutput } from "@aws-sdk/client-s3";
 import { type OffloadResult, type OffloadStatus } from "./storage-offload.js";
 export type TrancheId = "7d" | "30d" | "90d" | "365d" | "older";
 export declare const TRANCHES: readonly {
@@ -265,6 +265,17 @@ export declare const NEEDS_YES = "No terminal to confirm in. Re-run with --yes t
 export declare function confirmOnTty(message: string, input?: NodeJS.ReadableStream & {
     isTTY?: boolean;
 }, output?: NodeJS.WritableStream): Promise<boolean>;
+/**
+ * An S3 client for one vault whose credentials are re-vended before they
+ * expire, plus `revend`, which vends now and returns a client on the new
+ * credentials (the SDK caches credentials per client, so a forced refresh
+ * needs a new client).
+ */
+export declare function vendedS3(vend: () => Promise<VendedCredentials>, bucket: string, makeClient?: (credentials: ReturnType<typeof refreshingVendedCredentials>) => S3Client): {
+    bucket: string;
+    client: S3Client;
+    revend: () => Promise<S3Client>;
+};
 /** STS credentials from one vend, with the time they stop working. */
 export interface VendedCredentials {
     accessKeyId: string;

package/dist/commands/storage.js

@@ -48,7 +48,7 @@ import { vaultApiFetch } from "../utils/vault-api.js";
 import { findHqRoot } from "../utils/manifest.js";
 import { maxLength } from "../utils/table-width.js";
 import { resolveCanonicalPersonUid } from "./cloud.js";
-import { DEFAULT_IDLE_DAYS, currentAvailability, defaultTmpDir, getOffloadStatus, gitExportBlob, gitListPlaceholders, personalS3Store, resolveMinBytes, runFetch, runFetchGitBlob, runOffload, s3VaultObjectStore, syncExcludesOffload, } from "./storage-offload.js";
+import { DEFAULT_IDLE_DAYS, currentAvailability, defaultTmpDir, getOffloadStatus, gitExportBlob, gitListPlaceholders, credentialRetryingClient, resolveMinBytes, runFetch, runFetchGitBlob, runOffload, s3BlobStore, s3VaultObjectStore, syncExcludesOffload, } from "./storage-offload.js";
 export const TRANCHES = [
     { id: "7d", label: "Last 7 days", maxAgeDays: 7 },
     { id: "30d", label: "8-30 days", maxAgeDays: 30 },
@@ -1018,8 +1018,14 @@ async function buildOffloadDeps() {
         }
         if (!entity.bucketName)
             throw new Error("Your personal vault has no storage yet. Run `hq onboard`.");
-        const vend = await vault.sts.vendSelf({ personUid: entity.uid });
-        return { bucket: entity.bucketName, credentials: vend.credentials };
+        const uid = entity.uid;
+        // A run can outlast one STS session, so every client re-vends before the
+        // credentials expire, and once more when S3 refuses them anyway.
+        return vendedS3(async () => {
+            const { vault } = await signedInVault();
+            const vend = await vault.sts.vendSelf({ personUid: uid });
+            return { ...vend.credentials, expiresAt: vend.expiresAt };
+        }, entity.bucketName);
     };
     const activeCompanies = async () => {
         const { token } = await signedInVault();
@@ -1037,7 +1043,13 @@ async function buildOffloadDeps() {
             throw new Error(`You are not an active member of '${slug}'.`);
         const { vault } = await signedInVault();
         const entity = await vault.entity.get(company.uid);
-        return { company, bucket: entity.bucketName ?? `hq-vault-cmp-${company.slug}` };
+        const bucket = entity.bucketName ?? `hq-vault-cmp-${company.slug}`;
+        const s3 = vendedS3(async () => {
+            const { vault } = await signedInVault();
+            const vend = await vault.sts.vend({ companyUid: company.uid });
+            return { ...vend.credentials, expiresAt: vend.expiresAt };
+        }, bucket);
+        return { company, ...s3 };
     };
     // Company upload, the ignore explainer and the cloud-only journal row ship
     // in a newer @indigoai-us/hq-cloud. Until the bundled one exports them,
@@ -1059,8 +1071,8 @@ async function buildOffloadDeps() {
         tmpDir: defaultTmpDir,
         syncExcludesOffload: () => syncExcludesOffload(PERSONAL_VAULT_EXCLUDED_TOP_LEVEL),
         openPersonal: async () => {
-            const { bucket, credentials } = await personalVault();
-            return personalS3Store({ bucket, region: DEFAULT_COGNITO.region, credentials });
+            const { bucket, client, revend } = await personalVault();
+            return s3BlobStore(bucket, client, { where: "personal vault", revend });
         },
         activeCompanySlugs: async () => (await activeCompanies()).map((c) => c.slug),
         // Current-file offload replaces a file with a placeholder only when the
@@ -1086,13 +1098,11 @@ async function buildOffloadDeps() {
         // come from the existing membership-scoped /sts/vend path.
         openVaultObjects: async (target) => {
             if (target.vault === "personal") {
-                const { bucket, credentials } = await personalVault();
-                return s3VaultObjectStore(bucket, new S3Client({ region: DEFAULT_COGNITO.region, credentials }));
+                const { bucket, client, revend } = await personalVault();
+                return s3VaultObjectStore(bucket, client, { where: "personal vault", revend });
             }
-            const { company, bucket } = await companyVault(target.slug);
-            const { vault } = await signedInVault();
-            const vend = await vault.sts.vend({ companyUid: company.uid });
-            return s3VaultObjectStore(bucket, new S3Client({ region: DEFAULT_COGNITO.region, credentials: vend.credentials }));
+            const { company, bucket, client, revend } = await companyVault(target.slug);
+            return s3VaultObjectStore(bucket, client, { where: `company vault '${company.slug}'`, revend });
         },
         syncMaxFileBytes: typeof cloud.SYNC_MAX_FILE_BYTES === "number" ? cloud.SYNC_MAX_FILE_BYTES : undefined,
         syncExclusion: explainIgnore
@@ -1106,16 +1116,13 @@ async function buildOffloadDeps() {
         // since a multi-GB upload can outlast one STS session).
         openCompanyUploader: uploadLarge && multipartClient && recordOffloaded
             ? async (slug) => {
-                const { company, bucket } = await companyVault(slug);
+                const { company, bucket, client: s3, revend } = await companyVault(slug);
                 if (bucket.startsWith("hq-vault-prs-")) {
                     throw new Error(`'${bucket}' is a personal vault, not the company vault for '${slug}'.`);
                 }
-                const credentials = refreshingVendedCredentials(async () => {
-                    const { vault } = await signedInVault();
-                    const vend = await vault.sts.vend({ companyUid: company.uid });
-                    return { ...vend.credentials, expiresAt: vend.expiresAt };
-                });
-                const client = multipartClient(new S3Client({ region: DEFAULT_COGNITO.region, credentials }), bucket);
+                // Each multipart request re-vends once if S3 still refuses the
+                // credentials; a part refused twice leaves the upload resumable.
+                const client = credentialRetryingClient(multipartClient(s3, bucket), `company vault '${company.slug}'`, async () => multipartClient(await revend(), bucket));
                 return {
                     slug: company.slug,
                     bucket,
@@ -1133,6 +1140,24 @@ async function buildOffloadDeps() {
             : undefined,
     };
 }
+/**
+ * An S3 client for one vault whose credentials are re-vended before they
+ * expire, plus `revend`, which vends now and returns a client on the new
+ * credentials (the SDK caches credentials per client, so a forced refresh
+ * needs a new client).
+ */
+export function vendedS3(vend, bucket, makeClient = (credentials) => new S3Client({ region: DEFAULT_COGNITO.region, credentials })) {
+    return {
+        bucket,
+        client: makeClient(refreshingVendedCredentials(vend)),
+        revend: async () => {
+            const credentials = refreshingVendedCredentials(vend);
+            // Vend now, so a failed vend is reported as one rather than as a refused request.
+            await credentials();
+            return makeClient(credentials);
+        },
+    };
+}
 /**
  * AWS credential provider that vends fresh credentials on first use and again
  * whenever the previous ones are within `marginMs` of expiring. Each vend calls

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.138",
+  "version": "5.345.140",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {