mirror of
https://github.com/openai/codex.git
synced 2026-11-14 21:40:39 +00:00
Celia Chen
43ca762a59
## Why Encrypted MCP OAuth reads hold a shared file lock while accessing the keyring, blocking writers until the keyring lookup and decryption finish. ## What changed - Add `LocalSecretsSnapshot` to capture ciphertext under the file lock, then release shared read locks before keyring access and decryption. Keep exclusive locks across conditional credential updates. - Reuse the loaded passphrase when updating existing secrets, avoiding a second keyring lookup. Return an error when an existing encrypted file has no keyring passphrase instead of generating a replacement. - Update login storage error fixtures to use directory reads that fail consistently across platforms. ## Testing Add regression coverage for releasing read locks during keyring access, updating secrets with one keyring lookup, rejecting missing passphrases on cached reads, and reading captured snapshots after later writes. GitOrigin-RevId: add8f60dba52f71c8f8bc10ae8b8ae2f3379ccac