Matthew Zeng 6bfdc75f0d Make reactive MCP OAuth refreshes cancellation-safe (#60981) ...

## Why

Cancelling an MCP HTTP request during a reactive OAuth refresh must not interrupt persistence of rotated credentials. Concurrent requests receiving a `401` also need to reuse a fresh replacement token without refreshing it again.

## What changed

- Route authenticated streamable HTTP requests through `OAuthRuntime`, giving token exchanges independent tasks that finish persistence even if the caller is cancelled.
- Serialize refreshes in both legacy and coordinated modes, recheck the rejected token and replacement expiry, and persist legacy credentials before releasing the manager lock.
- Keep requests waiting to start an exchange cancellable, and use cached access credentials for session cleanup without refreshing tokens.

## Testing

Add coverage for reactive refresh cancellation and rotated refresh-token persistence in both modes, concurrent refreshes with fresh or expired replacements, cancelled waiters, and legacy credentials with only a relative expiry.

GitOrigin-RevId: f52da37d82baf89abcb1585e8e24359de53d40d7

2026-11-12 02:53:52 +00:00

..

src

Make reactive MCP OAuth refreshes cancellation-safe (#60981)

2026-11-12 02:53:52 +00:00

tests

Use runtime authentication for OpenAI MCP and app requests (#59749)

2026-11-05 22:03:29 +00:00

BUILD.bazel

[3/4] Add executor-backed RMCP HTTP client (#18583)

2026-04-22 17:38:04 -07:00

Cargo.toml

Prevent idle Windows MCP pipes from blocking unrelated I/O (#59726)

2026-11-05 19:46:31 +00:00