The tuist bazel credential-helper now refreshes the access token proactively when within a 60s safety margin of expiring, and reports the expiry timestamp brought forward by that same margin. As a result, Bazel re-invokes the helper ~60s before the real expiry and pivots to a fresh token, so long Bazel builds against the Tuist remote cache no longer hit mid-build waves of UNAUTHENTICATED errors right at the JWT TTL boundary.
Hive