fix: invalidate key_pair cache instead of setting directly

src/config.rs

@@ -1356,14 +1356,31 @@ impl Config {
         }
         *lock = cfg;
         lock.store();
-        // Currently only tested on macOS, so this change is limited to macOS for safety.
+        // Drop CONFIG lock before acquiring KEY_PAIR lock to avoid potential deadlock.
         #[cfg(target_os = "macos")]
-        {
-            *KEY_PAIR.lock().unwrap() = Some(lock.key_pair.clone());
-        }
+        let new_key_pair = lock.key_pair.clone();
+        drop(lock);
+        #[cfg(target_os = "macos")]
+        Self::invalidate_key_pair_cache_if_changed(&new_key_pair);
         true
     }
 
+    /// Invalidate KEY_PAIR cache if it differs from the new key_pair.
+    /// Use None to invalidate the cache instead of Some(key_pair).
+    /// If we use Some with an empty key_pair, get_key_pair() would always return
+    /// the empty key_pair from cache without regenerating.
+    /// By clearing the cache, get_key_pair() will reload and regenerate if needed.
+    #[cfg(target_os = "macos")]
+    fn invalidate_key_pair_cache_if_changed(new_key_pair: &KeyPair) {
+        let mut key_pair_cache = KEY_PAIR.lock().unwrap();
+        if let Some(cached) = key_pair_cache.as_ref() {
+            if cached != new_key_pair {
+                *key_pair_cache = None;
+                log::info!("key pair cache invalidated");
+            }
+        }
+    }
+
     fn with_extension(path: PathBuf) -> PathBuf {
         let ext = path.extension();
         if let Some(ext) = ext {