@indigoai-us/hq-cli 5.345.81 → 5.345.82

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [5.345.82] — 2026-10-11
+- Session-start health no longer treats an ordinary HQ Core upgrade warning
+  as an unrepaired doctor finding. `hq doctor` still shows the upgrade;
+  `--fix` still cannot apply it.
+- `hq storage status` runs the local report, the offload scan and the cloud
+  listing at the same time, and lists cloud file history by folder in parallel
+  instead of one page at a time. Cloud credentials are vended right before the
+  first listing call and vended again before they expire, so a long scan or
+  dry run no longer fails with "The provided token has expired."
+
 ## [5.345.81] — 2026-10-11
 - HQ Storage (`hq storage status|prune|offload|fetch`) is available behind the Indigo-only `hq-storage` flag and fails closed when the flag is off. Requires @indigoai-us/hq-cloud 6.18.61, whose sync skips `.hq-offload/` and supports cloud-only `.hqcloud` placeholders.
 - `hq storage status` reports local autosave history and cloud file-version usage per company, grouped by age. `hq storage prune` deletes old noncurrent cloud file versions in companies where you are an owner or admin, and never touches the current version. A version's age counts from when it was replaced, so a recent undo copy of an old file is kept. `status --json` marks each company with `can_delete`, and still shows local usage when you are signed out.

package/dist/command-catalog.generated.d.ts

@@ -2931,6 +2931,10 @@ export declare const COMMAND_CATALOG: readonly [{
             readonly flags: "--company <slug>";
             readonly description: "Only this company (must be one of yours)";
             readonly hidden: false;
+        }, {
+            readonly flags: "--no-cache";
+            readonly description: "List cloud file history live instead of using figures from the last 15 minutes";
+            readonly hidden: false;
         }];
         readonly subcommands: readonly [];
     }, {

package/dist/command-catalog.generated.js

@@ -3533,6 +3533,11 @@ export const COMMAND_CATALOG = [
                         "flags": "--company <slug>",
                         "description": "Only this company (must be one of yours)",
                         "hidden": false
+                    },
+                    {
+                        "flags": "--no-cache",
+                        "description": "List cloud file history live instead of using figures from the last 15 minutes",
+                        "hidden": false
                     }
                 ],
                 "subcommands": []

package/dist/commands/doctor.d.ts

@@ -59,6 +59,11 @@ export interface RunDoctorOptions {
     resolveClientHealthReasonCodesForCompany?: (companySlug: string | null) => Promise<boolean>;
     /** Resolve the separate status-report flag per company in sync results. */
     resolveClientHealthCheckStatusForCompany?: (companySlug: string | null) => Promise<boolean>;
+    /**
+     * Omit ordinary hq-core upgrade WARNs from `--json` (the SessionStart health
+     * hook). Default `--json` and text output still include them.
+     */
+    clientHealthReport?: boolean;
     /** In text mode, also print every PASS result. Default: false. */
     verbose?: boolean;
     /** In text mode, emit ANSI colour. Default: false (no escape sequences). */

package/dist/commands/doctor.js

@@ -181,6 +181,7 @@ export async function runDoctor(options = {}) {
             scope,
             clientHealthReasonCodesEnabledCheckIds,
             clientHealthCheckStatusEnabledCheckIds,
+            clientHealthReport: options.clientHealthReport === true,
         })));
     }
     else {
@@ -437,6 +438,7 @@ export function registerDoctorCommand(program) {
             only: parseOnly(opts.only),
             resolveClientHealthReasonCodesForCompany: clientHealthReasonCodesResolver,
             resolveClientHealthCheckStatusForCompany: clientHealthCheckStatusResolver,
+            clientHealthReport: opts.clientHealthReport === true,
         });
         // Set the exit code rather than calling process.exit, so the CLI's
         // normal shutdown (telemetry flush) still runs. Non-zero means either an

package/dist/commands/storage.d.ts

@@ -51,6 +51,8 @@ export interface CloudCompanyStatus {
     delete_markers: number;
     tranches: CloudTranche[];
     error?: string;
+    /** When these figures were listed (ISO). Older than now when served from the cache. */
+    listed_at?: string;
 }
 export interface StorageStatus {
     local: LocalReport;
@@ -112,7 +114,24 @@ export interface StorageDeps {
     log: (line: string) => void;
     /** Offload section for `status`. Absent in deps that only prune. */
     getOffload?: () => Promise<OffloadStatus>;
+    /** Cache of cloud status per company (see cloudStatusCache). Absent = always list. */
+    cloudCache?: CloudStatusCache;
 }
+/**
+ * Listing every version of a large vault takes minutes (about 2 for 2.4M
+ * versions, most of it parsing S3's XML), so `status` keeps each company's
+ * cloud figures for CLOUD_CACHE_TTL_MS. Only complete, successful listings are
+ * kept; a real cloud prune drops the company's entry; dry runs and real prunes
+ * always list live.
+ */
+export interface CloudStatusCache {
+    read(company: CompanyRef): CloudCompanyStatus | undefined;
+    write(company: CompanyRef, status: CloudCompanyStatus): void;
+    drop(company: CompanyRef): void;
+}
+export declare const CLOUD_CACHE_TTL_MS: number;
+/** File cache under <hq>/workspace/.storage-cache/cloud-<company uid>.json. */
+export declare function cloudStatusCache(hqRoot: string, now: () => Date, ttlMs?: number): CloudStatusCache;
 export declare function localScriptPath(hqRoot: string): string;
 /**
  * Core `drop-backups --expired` right before a real local prune; undefined
@@ -148,6 +167,16 @@ export interface VersionEntry {
  * to its own LastModified.
  */
 export declare function annotateNoncurrentSince(entries: VersionEntry[]): VersionEntry[];
+/** Folder levels split into parallel listings (`a/`, then `a/b/`). */
+export declare const LIST_SPLIT_DEPTH = 2;
+/** Listings in flight at once per bucket. */
+export declare const LIST_CONCURRENCY = 32;
+/**
+ * A printable-ASCII key strictly between `lo` and `hi` in S3's (UTF-8 byte)
+ * order, or undefined when none is found. Used to split one long listing into
+ * two that run at the same time.
+ */
+export declare function keyBetween(lo: string, hi: string): string | undefined;
 /** Plain message when S3 refuses a version delete for one company. */
 export declare function deleteDeniedMessage(slug: string): string;
 export declare function describeCloudError(err: unknown, action: "list" | "delete", slug?: string): string;
@@ -162,6 +191,7 @@ export declare function selectPrunable(versions: VersionEntry[], cutoff: Date):
 export declare function pruneCloud(company: CompanyRef, cutoff: Date, dryRun: boolean, deps: StorageDeps): Promise<CloudPruneResult>;
 export declare function runStorageStatus(opts: {
     company?: string;
+    noCache?: boolean;
 }, deps: StorageDeps): Promise<StorageStatus>;
 export declare function parseCutoff(value: string, flag: string): Date;
 export declare function runStoragePrune(opts: {
@@ -195,5 +225,25 @@ export declare const NEEDS_YES = "No terminal to confirm in. Re-run with --yes t
 export declare function confirmOnTty(message: string, input?: NodeJS.ReadableStream & {
     isTTY?: boolean;
 }, output?: NodeJS.WritableStream): Promise<boolean>;
+/** STS credentials from one vend, with the time they stop working. */
+export interface VendedCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string;
+    expiresAt?: string;
+}
+/**
+ * AWS credential provider that vends fresh credentials on first use and again
+ * whenever the previous ones are within `marginMs` of expiring. Each vend calls
+ * `vend` anew, which signs in again (the CLI refreshes an expiring Cognito
+ * session there), so a cloud listing or delete that starts after a long local
+ * scan, or that itself outlasts one STS session, never sends an expired token.
+ */
+export declare function refreshingVendedCredentials(vend: () => Promise<VendedCredentials>, now?: () => number, marginMs?: number): () => Promise<{
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string;
+    expiration?: Date;
+}>;
 export declare function registerStorageCommand(program: Command): Command;
 //# sourceMappingURL=storage.d.ts.map

package/dist/commands/storage.js

@@ -56,6 +56,45 @@ export function canDeleteCloudHistory(company) {
     return company.role !== undefined && DELETE_ROLES.has(company.role);
 }
 export const DELETE_ROLE_REASON = "Only company owners and admins can delete cloud file history.";
+export const CLOUD_CACHE_TTL_MS = 15 * 60 * 1000;
+/** File cache under <hq>/workspace/.storage-cache/cloud-<company uid>.json. */
+export function cloudStatusCache(hqRoot, now, ttlMs = CLOUD_CACHE_TTL_MS) {
+    const dir = path.join(hqRoot, "workspace", ".storage-cache");
+    const file = (c) => path.join(dir, `cloud-${c.uid.replace(/[^A-Za-z0-9_-]/g, "_")}.json`);
+    return {
+        read(c) {
+            try {
+                const raw = JSON.parse(fs.readFileSync(file(c), "utf8"));
+                const at = Date.parse(raw.listed_at ?? "");
+                const age = now().getTime() - at;
+                if (raw.uid !== c.uid || raw.available !== true || Number.isNaN(at) || age < 0 || age >= ttlMs)
+                    return undefined;
+                const { uid: _uid, ...status } = raw;
+                // Role can change between runs; it comes from the live membership.
+                return { ...status, company: c.slug, can_delete: canDeleteCloudHistory(c) };
+            }
+            catch {
+                return undefined;
+            }
+        },
+        write(c, status) {
+            if (!status.available)
+                return;
+            try {
+                fs.mkdirSync(dir, { recursive: true });
+                const tmp = `${file(c)}.tmp.${process.pid}`;
+                fs.writeFileSync(tmp, JSON.stringify({ ...status, uid: c.uid }));
+                fs.renameSync(tmp, file(c));
+            }
+            catch {
+                // A cache that cannot be written only costs the next status a listing.
+            }
+        },
+        drop(c) {
+            fs.rmSync(file(c), { force: true });
+        },
+    };
+}
 // ── Local (hq-core script) ──────────────────────────────────────────────────
 export function localScriptPath(hqRoot) {
     return path.join(hqRoot, "core", "scripts", "hq-storage.sh");
@@ -149,52 +188,195 @@ export function annotateNoncurrentSince(entries) {
 function noncurrentAge(v) {
     return v.noncurrentSince ?? v.lastModified;
 }
-async function* listAllVersions(store) {
-    let keyMarker;
-    let versionIdMarker;
-    do {
-        const page = await store.s3.send(new ListObjectVersionsCommand({
-            Bucket: store.bucket,
-            KeyMarker: keyMarker,
-            VersionIdMarker: versionIdMarker,
-        }));
-        for (const v of page.Versions ?? []) {
-            if (!v.Key || !v.VersionId)
-                continue;
-            yield {
-                key: v.Key,
-                versionId: v.VersionId,
-                isLatest: Boolean(v.IsLatest),
-                lastModified: v.LastModified ? new Date(v.LastModified) : new Date(0),
-                size: v.Size ?? 0,
-                isDeleteMarker: false,
-            };
+function toEntries(page) {
+    const out = [];
+    for (const v of page.Versions ?? []) {
+        if (!v.Key || !v.VersionId)
+            continue;
+        out.push({
+            key: v.Key,
+            versionId: v.VersionId,
+            isLatest: Boolean(v.IsLatest),
+            lastModified: v.LastModified ? new Date(v.LastModified) : new Date(0),
+            size: v.Size ?? 0,
+            isDeleteMarker: false,
+        });
+    }
+    for (const m of page.DeleteMarkers ?? []) {
+        if (!m.Key || !m.VersionId)
+            continue;
+        out.push({
+            key: m.Key,
+            versionId: m.VersionId,
+            isLatest: Boolean(m.IsLatest),
+            lastModified: m.LastModified ? new Date(m.LastModified) : new Date(0),
+            size: 0,
+            isDeleteMarker: true,
+        });
+    }
+    return out;
+}
+/** Folder levels split into parallel listings (`a/`, then `a/b/`). */
+export const LIST_SPLIT_DEPTH = 2;
+/** Listings in flight at once per bucket. */
+export const LIST_CONCURRENCY = 32;
+function utf8Compare(a, b) {
+    return Buffer.compare(Buffer.from(a), Buffer.from(b));
+}
+/**
+ * A printable-ASCII key strictly between `lo` and `hi` in S3's (UTF-8 byte)
+ * order, or undefined when none is found. Used to split one long listing into
+ * two that run at the same time.
+ */
+export function keyBetween(lo, hi) {
+    const a = Buffer.from(lo);
+    const b = Buffer.from(hi);
+    const FIRST = 0x20;
+    const LAST = 0x7e;
+    let k = 0;
+    while (k < a.length && k < b.length && a[k] === b[k])
+        k++;
+    const out = [...a.subarray(0, k)];
+    // Walk down from the first differing byte, keeping `lo`'s bytes while the
+    // gap is too small, until a byte strictly between both bounds fits.
+    for (let i = k; i < k + 8; i++) {
+        const ca = i < a.length ? a[i] : FIRST - 1;
+        const cb = i === k ? (i < b.length ? b[i] : LAST + 1) : LAST + 1;
+        const loB = Math.max(ca, FIRST - 1);
+        const hiB = Math.min(cb, LAST + 1);
+        if (hiB - loB >= 2) {
+            out.push((loB + hiB) >> 1);
+            const bytes = Buffer.from(out);
+            const mid = bytes.toString("utf8");
+            // The kept part of `lo` may end inside a multi-byte character.
+            if (!Buffer.from(mid).equals(bytes))
+                return undefined;
+            return utf8Compare(lo, mid) < 0 && utf8Compare(mid, hi) < 0 ? mid : undefined;
         }
-        for (const m of page.DeleteMarkers ?? []) {
-            if (!m.Key || !m.VersionId)
-                continue;
-            yield {
-                key: m.Key,
-                versionId: m.VersionId,
-                isLatest: Boolean(m.IsLatest),
-                lastModified: m.LastModified ? new Date(m.LastModified) : new Date(0),
-                size: 0,
-                isDeleteMarker: true,
-            };
+        if (i >= a.length || a[i] < FIRST || a[i] > LAST)
+            return undefined;
+        out.push(a[i]);
+    }
+    return undefined;
+}
+/**
+ * Every version and delete marker in the bucket. One ListObjectVersions call
+ * returns at most 1,000 entries, so a sequential walk of a vault with millions
+ * of versions takes many minutes (and outlives a 15-minute STS session). The
+ * walk runs up to LIST_CONCURRENCY listings at once:
+ *   - down to LIST_SPLIT_DEPTH levels a folder is listed with a "/" delimiter
+ *     (its own entries plus its subfolders, each queued as its own listing);
+ *   - deeper folders are listed whole, as key ranges: while listings are idle,
+ *     a long range hands its second half (split at keyBetween) to a new one;
+ *   - a vault policy can refuse a Prefix listing of one folder (private DM
+ *     folders) while allowing the plain listing the sequential walk used, so a
+ *     refused folder is listed as a key range of the plain listing instead.
+ * Ranges never overlap and every version of a key falls in exactly one, so the
+ * result is the same set as one flat listing. Any other failure fails the walk.
+ */
+async function listAllVersions(store) {
+    const all = [];
+    const queue = [{ prefix: "", depth: 0, split: LIST_SPLIT_DEPTH > 0, usePrefix: true }];
+    let active = 0;
+    let failed;
+    const runOne = async (w) => {
+        const found = [];
+        const children = [];
+        let hi = w.hi;
+        let keyMarker = w.lo ?? (w.usePrefix || !w.prefix ? undefined : w.prefix.slice(0, -1));
+        let versionIdMarker;
+        let done = false;
+        try {
+            do {
+                const page = await store.s3.send(new ListObjectVersionsCommand({
+                    Bucket: store.bucket,
+                    KeyMarker: keyMarker,
+                    VersionIdMarker: versionIdMarker,
+                    ...(w.usePrefix && w.prefix ? { Prefix: w.prefix } : {}),
+                    ...(w.split ? { Delimiter: "/" } : {}),
+                }));
+                for (const e of toEntries(page)) {
+                    if (!e.key.startsWith(w.prefix)) {
+                        // Only the plain listing returns keys outside the folder.
+                        if (utf8Compare(e.key, w.prefix) > 0)
+                            done = true;
+                        continue;
+                    }
+                    if (hi !== undefined && utf8Compare(e.key, hi) > 0) {
+                        done = true;
+                        continue;
+                    }
+                    found.push(e);
+                }
+                if (w.split) {
+                    for (const cp of page.CommonPrefixes ?? []) {
+                        if (cp.Prefix && cp.Prefix !== w.prefix) {
+                            const depth = w.depth + 1;
+                            children.push({ prefix: cp.Prefix, depth, split: depth < LIST_SPLIT_DEPTH, usePrefix: w.usePrefix });
+                        }
+                    }
+                }
+                if (page.IsTruncated && !page.NextKeyMarker) {
+                    throw new Error("File history listing was cut short (no next marker). Nothing was changed.");
+                }
+                keyMarker = page.IsTruncated && !done ? page.NextKeyMarker : undefined;
+                versionIdMarker = page.IsTruncated && !done ? page.NextVersionIdMarker : undefined;
+                // Hand the rest of a long range to an idle slot: this listing keeps
+                // keys up to `mid`, the new one starts after it.
+                if (keyMarker !== undefined && !w.split && active + queue.length < LIST_CONCURRENCY) {
+                    const end = hi ?? `${w.prefix}\x7f`;
+                    const mid = keyBetween(keyMarker, end);
+                    if (mid !== undefined && mid.startsWith(w.prefix)) {
+                        queue.push({ ...w, lo: mid, hi });
+                        hi = mid;
+                        pump();
+                    }
+                }
+            } while (keyMarker !== undefined && failed === undefined);
         }
-        if (page.IsTruncated && !page.NextKeyMarker) {
-            throw new Error("File history listing was cut short (no next marker). Nothing was changed.");
+        catch (err) {
+            if (!w.usePrefix || !isAccessDenied(err))
+                throw err;
+            // Refused for this folder: list it again from the plain listing. Nothing
+            // from the refused attempt is kept, so nothing counts twice.
+            // Same key range as this attempt (a split-off rest is already queued).
+            queue.push({ ...w, split: false, usePrefix: false, hi });
+            return;
         }
-        keyMarker = page.IsTruncated ? page.NextKeyMarker : undefined;
-        versionIdMarker = page.IsTruncated ? page.NextVersionIdMarker : undefined;
-    } while (keyMarker !== undefined);
+        for (const e of found)
+            all.push(e);
+        for (const c of children)
+            queue.push(c);
+    };
+    let finish;
+    const finished = new Promise((resolve) => (finish = resolve));
+    function pump() {
+        if (failed === undefined) {
+            while (active < LIST_CONCURRENCY && queue.length > 0) {
+                const next = queue.shift();
+                active += 1;
+                runOne(next)
+                    .catch((err) => {
+                    failed ??= err;
+                })
+                    .finally(() => {
+                    active -= 1;
+                    pump();
+                });
+            }
+        }
+        if (active === 0 && (queue.length === 0 || failed !== undefined))
+            finish();
+    }
+    pump();
+    await finished;
+    if (failed !== undefined)
+        throw failed;
+    return all;
 }
 /** Every version and delete marker in the bucket, with `noncurrentSince` set. */
 async function listVersions(store) {
-    const all = [];
-    for await (const v of listAllVersions(store))
-        all.push(v);
-    return annotateNoncurrentSince(all);
+    return annotateNoncurrentSince(await listAllVersions(store));
 }
 function emptyTranches() {
     return TRANCHES.map((t) => ({ id: t.id, label: t.label, count: 0, bytes: 0 }));
@@ -264,7 +446,7 @@ export async function getCloudStatus(company, deps) {
             error: describeCloudError(err, "list"),
         };
     }
-    return status;
+    return { ...status, listed_at: now.toISOString() };
 }
 /**
  * Versions eligible for prune: noncurrent content versions and noncurrent
@@ -345,29 +527,42 @@ export async function pruneCloud(company, cutoff, dryRun, deps) {
 // ── Orchestrators ───────────────────────────────────────────────────────────
 export async function runStorageStatus(opts, deps) {
     // Read-only: no backup drop, no gc. Pending backup bytes come from report.
-    const local = await getLocalReport(deps);
-    const offload = deps.getOffload ? await deps.getOffload().catch(offloadUnavailable) : undefined;
-    let memberships;
-    try {
-        memberships = await deps.listCompanies();
-    }
-    catch (err) {
-        // Local sections still report when cloud is unreachable (signed out, API key).
-        return {
-            local,
-            cloud: [],
-            cloud_error: err instanceof Error ? err.message : String(err),
-            ...(offload ? { offload } : {}),
-            generated_at: deps.now().toISOString(),
+    // The local report, the offload scan and the cloud listing are independent,
+    // so they run at the same time: status takes as long as the slowest one.
+    const localP = getLocalReport(deps);
+    const offloadP = deps.getOffload ? deps.getOffload().catch(offloadUnavailable) : Promise.resolve(undefined);
+    const cloudP = (async () => {
+        let memberships;
+        try {
+            memberships = await deps.listCompanies();
+        }
+        catch (err) {
+            // Local sections still report when cloud is unreachable (signed out, API key).
+            return { cloud: [], cloud_error: err instanceof Error ? err.message : String(err) };
+        }
+        const companies = selectCompanies(memberships, opts.company);
+        const cached = async (c) => {
+            const hit = opts.noCache ? undefined : deps.cloudCache?.read(c);
+            if (hit)
+                return hit;
+            const fresh = await getCloudStatus(c, deps);
+            deps.cloudCache?.write(c, fresh);
+            return fresh;
         };
-    }
-    const companies = selectCompanies(memberships, opts.company);
-    const cloud = [];
-    for (const c of companies)
-        cloud.push(await getCloudStatus(c, deps));
+        return { cloud: await Promise.all(companies.map(cached)) };
+    })();
+    // Settle all three before returning, so no scan is left running behind a throw.
+    const [localR, offloadR, cloudR] = await Promise.allSettled([localP, offloadP, cloudP]);
+    for (const r of [localR, cloudR])
+        if (r.status === "rejected")
+            throw r.reason;
+    const local = localR.value;
+    const offload = offloadR.status === "fulfilled" ? offloadR.value : undefined;
+    const { cloud, cloud_error } = cloudR.value;
     return {
         local,
         cloud,
+        ...(cloud_error !== undefined ? { cloud_error } : {}),
         ...(offload ? { offload } : {}),
         generated_at: deps.now().toISOString(),
     };
@@ -422,8 +617,12 @@ export async function runStoragePrune(opts, deps) {
     }
     const cloud = [];
     if (cloudCutoff) {
-        for (const c of companies)
+        for (const c of companies) {
+            // A real prune changes the figures: the next status lists live.
+            if (!opts.dryRun)
+                deps.cloudCache?.drop(c);
             cloud.push(await pruneCloud(c, cloudCutoff, opts.dryRun, deps));
+        }
         for (const c of skipped) {
             cloud.push({
                 company: c.slug,
@@ -774,10 +973,43 @@ async function buildOffloadDeps() {
         },
     };
 }
+/**
+ * AWS credential provider that vends fresh credentials on first use and again
+ * whenever the previous ones are within `marginMs` of expiring. Each vend calls
+ * `vend` anew, which signs in again (the CLI refreshes an expiring Cognito
+ * session there), so a cloud listing or delete that starts after a long local
+ * scan, or that itself outlasts one STS session, never sends an expired token.
+ */
+export function refreshingVendedCredentials(vend, now = Date.now, marginMs = 5 * 60 * 1000) {
+    let cached;
+    let pending;
+    return async () => {
+        if (cached && cached.expiration && cached.expiration.getTime() - now() > marginMs)
+            return cached;
+        pending ??= vend()
+            .then((c) => {
+            const t = c.expiresAt ? Date.parse(c.expiresAt) : NaN;
+            cached = {
+                accessKeyId: c.accessKeyId,
+                secretAccessKey: c.secretAccessKey,
+                sessionToken: c.sessionToken,
+                // Unknown expiry: treat as already due so the next call vends again.
+                expiration: new Date(Number.isNaN(t) ? now() : t),
+            };
+            return cached;
+        })
+            .finally(() => {
+            pending = undefined;
+        });
+        return pending;
+    };
+}
 async function buildDeps() {
-    // Sign-in is lazy so `status` can still report local sections when signed out.
-    let session;
-    const signedIn = () => (session ??= signedInVault());
+    // Sign-in is lazy so `status` can still report local sections when signed out,
+    // and it is resolved again for every cloud call (never once at the start): the
+    // local scan before the cloud listing can outlast a session token, and
+    // resolveVaultCredential refreshes an expiring Cognito session.
+    const signedIn = () => signedInVault();
     const offloadDeps = await buildOffloadDeps();
     return {
         getOffload: () => getOffloadStatus(offloadDeps, {
@@ -786,6 +1018,7 @@ async function buildDeps() {
         }),
         hqRoot: findHqRoot(),
         now: () => new Date(),
+        cloudCache: cloudStatusCache(findHqRoot(), () => new Date()),
         runScript: defaultRunScript,
         confirm: (message) => confirmOnTty(message),
         log: (line) => console.log(line),
@@ -799,10 +1032,16 @@ async function buildDeps() {
         },
         openCompany: async (company) => {
             const { vault } = await signedIn();
-            const vend = await vault.sts.vend({ companyUid: company.uid });
             const entity = await vault.entity.get(company.uid);
             const bucket = entity.bucketName ?? `hq-vault-cmp-${company.slug}`;
-            const s3 = new S3Client({ region: DEFAULT_COGNITO.region, credentials: vend.credentials });
+            // Credentials are vended right before the first S3 call and re-vended
+            // (with a freshly refreshed sign-in) before they expire.
+            const credentials = refreshingVendedCredentials(async () => {
+                const { vault: fresh } = await signedIn();
+                const vend = await fresh.sts.vend({ companyUid: company.uid });
+                return { ...vend.credentials, expiresAt: vend.expiresAt };
+            });
+            const s3 = new S3Client({ region: DEFAULT_COGNITO.region, credentials });
             return { bucket, s3 };
         },
     };
@@ -817,9 +1056,10 @@ export function registerStorageCommand(program) {
         .description("Show local autosave history and cloud file history sizes")
         .option("--json", "Print JSON")
         .option("--company <slug>", "Only this company (must be one of yours)")
+        .option("--no-cache", "List cloud file history live instead of using figures from the last 15 minutes")
         .action(async (opts) => {
         try {
-            const status = await runStorageStatus({ company: opts.company }, await buildDeps());
+            const status = await runStorageStatus({ company: opts.company, noCache: opts.cache === false }, await buildDeps());
             console.log(opts.json ? JSON.stringify(status, null, 2) : formatStorageStatus(status));
         }
         catch (err) {

package/dist/lib/doctor/fix/remediation.js

@@ -119,6 +119,16 @@ export function deriveRemediation(result) {
             command: remediation ?? `hq bot start ${target}`,
         };
     }
+    // Available hq-core upgrade. WARN is intentional in `hq doctor` and is
+    // not a broken sync; --fix has no mechanical repair for it.
+    if (checkId === "sync.update.core") {
+        return {
+            autoFixable: false,
+            fixClass: null,
+            action: "Ordinary hq-core upgrade, not a failed repair. hq doctor --fix will leave this WARN in place. Run /update-hq in a fresh session.",
+            command: "",
+        };
+    }
     // refresh-sync — a company journal that is stale or never-synced, or a
     // live personal / personal-vault journal. Leftover shards are NA at the
     // check layer, so they never reach this classifier. A SessionStart

package/dist/lib/doctor/json-output.d.ts

@@ -104,7 +104,23 @@ export interface BuildDoctorJsonInput {
     clientHealthReasonCodesEnabledCheckIds?: ReadonlySet<string>;
     /** Check ids whose own company enabled per-check status reporting in hq-flags. */
     clientHealthCheckStatusEnabledCheckIds?: ReadonlySet<string>;
+    /**
+     * JSON consumed by the SessionStart health hook (`--client-health-report`).
+     * Ordinary hq-core upgrade WARNs stay in human `hq doctor` output and in
+     * default `--json`, but they are omitted here: `--fix` cannot apply a
+     * release, and older hooks treated the leftover WARN as an unrepaired
+     * failure.
+     */
+    clientHealthReport?: boolean;
 }
+/**
+ * True when a sync finding is an ordinary, non-repairable hq-core upgrade.
+ * FAIL stays visible: that is a broken local core, not "a newer release exists".
+ */
+export declare function isOrdinaryCoreUpdateWarn(result: {
+    checkId: string;
+    status: DoctorStatus;
+}): boolean;
 /** Assemble the machine-readable document from a completed run. */
 export declare function buildDoctorJson(input: BuildDoctorJsonInput): DoctorJsonDocument;
 /** Serialise the document as pretty-printed JSON with a trailing newline. */

package/dist/lib/doctor/json-output.js

@@ -29,11 +29,21 @@ import { deriveRemediation } from "./fix/remediation.js";
  * was passed, so a consumer can see what `--fix` would do without invoking it.
  */
 export const DOCTOR_JSON_SCHEMA_VERSION = 2;
+/**
+ * True when a sync finding is an ordinary, non-repairable hq-core upgrade.
+ * FAIL stays visible: that is a broken local core, not "a newer release exists".
+ */
+export function isOrdinaryCoreUpdateWarn(result) {
+    return result.checkId === "sync.update.core" && result.status === "WARN";
+}
 /** Assemble the machine-readable document from a completed run. */
 export function buildDoctorJson(input) {
     const results = [];
     for (const run of input.families) {
         for (const result of run.results) {
+            if (input.clientHealthReport === true && isOrdinaryCoreUpdateWarn(result)) {
+                continue;
+            }
             results.push(toJsonResult(run.family.id, result, input.clientHealthReasonCodesEnabledCheckIds, input.clientHealthCheckStatusEnabledCheckIds));
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indigoai-us/hq-cli",
-  "version": "5.345.81",
+  "version": "5.345.82",
   "description": "HQ by Indigo management CLI — modules and cloud sync",
   "main": "dist/index.js",
   "bin": {