[theoephraim]

Fixes #1275.

When several secrets resolve at once with no cached token, each lookup ran its own token acquisition. With the Azure CLI fallback that meant one blocking execSync('az account get-access-token ...') per secret, which stalled the event loop long enough for other Key Vault requests to hit their 10s timeout.

• getAccessToken now shares one in-flight request per resource. The entry is cleared on success and failure, so expiry checks and retries still work.
• az runs through async spawnAsync (with a shell on Windows, where az is a .cmd shim), so a slow CLI no longer blocks other requests.
• The CLI token cache files are read from AZURE_CONFIG_DIR when set, matching where az writes them.

Tests: three concurrent secrets with a service principal make one token request; with a fake az on PATH and an empty config dir, az is called exactly once.

Cross-process token caching (#1047) is left for later.

[github-actions]

The changes in this PR will be included in the next version bump.

Patch releases

• @varlock/azure-key-vault-plugin 1.3.1 → 1.3.2

Bump files in this PR

• azure-dedupe-token-requests.md (view diff) (edit)

Click here if you want to add another bump file to this PR

---

This comment is maintained by bumpy.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/varlock@1298

npm i https://pkg.pr.new/@varlock/azure-key-vault-plugin@1298

commit: a212096

[pullfrog]

✅ No new issues found.

Reviewed changes: Reviewed token-request sharing, asynchronous Azure CLI execution, and the related tests and documentation.

• Token sharing: Concurrent lookups share an instance-local request per resource, with cleanup on success and failure.
• CLI fallback: az runs asynchronously with the existing timeout and tenant scoping, using a shell on Windows.
• Config directory: Token-cache reads honor AZURE_CONFIG_DIR, with documentation updated accordingly.
• Regression coverage: New tests verify one token acquisition for concurrent secrets. The plugin build, all 21 tests, and typecheck passed on Linux; Windows execution was not tested locally.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}