Celia Chen b4ad33d1a3 Cache decrypted Codex auth and managed secrets (#56081) ...

## Why

Repeated reads of Codex auth and managed secrets repeat expensive scrypt decryption even when the encrypted file and keyring passphrase are unchanged.

## What changed

Extend the decrypted snapshot cache to `CodexAuth` and `ManagedSecrets`, keeping at most one snapshot per namespace. Reuse snapshots only when the file path, ciphertext, and passphrase match, and invalidate matching snapshots on writes. Every read still checks the file and keyring before reusing plaintext.

## Testing

Extend cache tests to cover concurrent reuse, writes, external file replacement, file removal, key rotation, keyring errors, invalid ciphertext, and isolation across homes and namespaces. Prime the auth cache before verifying fallback when the keyring fails.

GitOrigin-RevId: eaf802ef4cfdbe482b56423807a1fe0fe3def2cd

2026-10-22 04:59:19 +00:00

..

src

Cache decrypted Codex auth and managed secrets (#56081)

2026-10-22 04:59:19 +00:00

BUILD.bazel

Move sanitizer into codex-secrets (#12306)

2026-02-20 22:47:54 +00:00

Cargo.toml

Disable empty Cargo test targets (#21584)

2026-05-07 15:44:17 -07:00