fix(auth): read OS credentials under Node as well as Bun

.github/workflows/ci.yml

@@ -181,6 +181,10 @@ jobs:
         if: runner.os == 'Linux'
         uses: t1m0thyj/unlock-keyring@v1
 
+      - name: Install Secret Service CLI
+        if: runner.os == 'Linux'
+        run: sudo apt-get install -qq libsecret-tools
+
       - name: Run tests (extended timeout)
         timeout-minutes: 15
         # Unit tests must pass for fork PRs (no secrets). Keep API-dependent tests

build.js

@@ -125,12 +125,6 @@ if (content.startsWith("#!")) {
   content = content.slice(content.indexOf("\n") + 1);
 }
 
-// Patch secrets requirement back in for node build
-content = content.replace(
-  `(()=>{throw new Error("Cannot require module "+"bun");})().secrets`,
-  `globalThis.Bun.secrets`,
-);
-
 const withShebang = `#!/usr/bin/env node
 ${content}`;
 await Bun.write(outputPath, withShebang);

scripts/isolated-unit-tests.json

@@ -97,6 +97,16 @@
       "timeoutMs": 15000,
       "reason": "Uses a top-level Bun module mock for the backend client."
     },
+    {
+      "path": "src/utils/secret-backends.test.ts",
+      "timeoutMs": 30000,
+      "reason": "Mutates the secrets runtime override and service name while exercising the real OS credential store."
+    },
+    {
+      "path": "src/utils/secrets.test.ts",
+      "timeoutMs": 30000,
+      "reason": "Mutates the process-global secrets service name while exercising the real OS credential store."
+    },
     {
       "path": "src/websocket/listen-client-concurrency.test.ts",
       "timeoutMs": 30000,

src/test-utils/test-process-env.test.ts

@@ -43,6 +43,7 @@ describe("test process env helpers", () => {
     expect(env.LETTA_MEMORY_DIR).toBeUndefined();
     expect(env.MEMORY_DIR).toBeUndefined();
     expect(env.LETTA_DISABLE_SESSION_PERSIST).toBe("1");
+    expect(env.LETTA_SKIP_KEYCHAIN_CHECK).toBe("1");
     expect(env.DISABLE_AUTOUPDATER).toBe("1");
   });
 

src/test-utils/test-process-env.ts

@@ -9,6 +9,7 @@ export function createIsolatedCliTestEnv(
 
   Object.assign(env, {
     LETTA_DISABLE_SESSION_PERSIST: "1",
+    LETTA_SKIP_KEYCHAIN_CHECK: "1",
     DISABLE_AUTOUPDATER: "1",
   });