Celia Chen 43ca762a59 Release MCP OAuth read locks before keyring access (#61401) ...

## Why

Encrypted MCP OAuth reads hold a shared file lock while accessing the keyring, blocking writers until the keyring lookup and decryption finish.

## What changed

- Add `LocalSecretsSnapshot` to capture ciphertext under the file lock, then release shared read locks before keyring access and decryption. Keep exclusive locks across conditional credential updates.
- Reuse the loaded passphrase when updating existing secrets, avoiding a second keyring lookup. Return an error when an existing encrypted file has no keyring passphrase instead of generating a replacement.
- Update login storage error fixtures to use directory reads that fail consistently across platforms.

## Testing

Add regression coverage for releasing read locks during keyring access, updating secrets with one keyring lookup, rejecting missing passphrases on cached reads, and reading captured snapshots after later writes.

GitOrigin-RevId: add8f60dba52f71c8f8bc10ae8b8ae2f3379ccac

2026-11-13 23:15:54 +00:00

..

src

Release MCP OAuth read locks before keyring access (#61401)

2026-11-13 23:15:54 +00:00

tests

Use runtime authentication for OpenAI MCP and app requests (#59749)

2026-11-05 22:03:29 +00:00

BUILD.bazel

[3/4] Add executor-backed RMCP HTTP client (#18583)

2026-04-22 17:38:04 -07:00

Cargo.toml

Extract HTTP headers helper execution into a shared crate (#61018)

2026-11-12 04:32:34 +00:00