refactor(mcp): simplify header cache key and minimize critical section

- Replace SHA-256 hash with sorted key=value concatenation for header
  comparison — simpler, debuggable, and avoids ambiguous boundaries
- Move cache key computation outside mutex to minimize critical section
- Remove redundant comments on self-documenting functions

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ysyneu

mcp/client.go

@@ -3,7 +3,6 @@ package mcp
 
 import (
 	"context"
-	"crypto/sha256"
 	"fmt"
 	"log/slog"
 	"sort"
@@ -55,12 +54,12 @@ func (m *ClientManager) GetSession(ctx context.Context, server *protocol.MCPServ
 		logger = slog.With("server", server.Name)
 	}
 
+	serverName := server.Name
+	currentHash := headersCacheKey(server.Headers, server.DynamicHeaders)
+
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
-	serverName := server.Name
-	currentHash := hashHeaders(server.Headers, server.DynamicHeaders)
-
 	logger.Debug("mcp resolving session",
 		"transport", server.Transport,
 		"url", server.URL,
@@ -198,31 +197,22 @@ func (m *ClientManager) invalidateSession(serverName string) {
 	m.mu.Unlock()
 }
 
-// hashHeaders computes a stable hash of both static and dynamic headers.
-// Used to detect when credentials change so stale sessions are invalidated.
-func hashHeaders(headers, dynamicHeaders map[string]string) string {
-	h := sha256.New()
-	// Sort keys for deterministic hashing
-	writeMap := func(m map[string]string) {
+func headersCacheKey(headers, dynamicHeaders map[string]string) string {
+	encode := func(m map[string]string) string {
 		keys := make([]string, 0, len(m))
 		for k := range m {
 			keys = append(keys, k)
 		}
 		sort.Strings(keys)
-		for _, k := range keys {
-			h.Write([]byte(k))
-			h.Write([]byte(m[k]))
+		parts := make([]string, len(keys))
+		for i, k := range keys {
+			parts[i] = k + "=" + m[k]
 		}
+		return strings.Join(parts, "\x00")
 	}
-	h.Write([]byte("static:"))
-	writeMap(headers)
-	h.Write([]byte("dynamic:"))
-	writeMap(dynamicHeaders)
-	return fmt.Sprintf("%x", h.Sum(nil))
+	return "s:" + encode(headers) + "\x01d:" + encode(dynamicHeaders)
 }
 
-// maskKey returns the first 6 characters of a key for safe logging.
-// Returns empty string for empty/short keys.
 func maskKey(key string) string {
 	// Strip "Bearer " prefix if present
 	if strings.HasPrefix(key, "Bearer ") {