fix(memfs): dynamic git credential helper for memory repos

package.json

@@ -117,12 +117,14 @@
     "@modelcontextprotocol/sdk": "1.30.0",
     "@pierre/diffs": "1.2.2",
     "@scarf/scarf": "^1.4.0",
-    "cross-spawn": "^7.0.6",
+    "@types/proper-lockfile": "^4.1.4",
     "cron-parser": "^5.6.1",
+    "cross-spawn": "^7.0.6",
     "glob": "^13.0.0",
     "ink-link": "^5.0.0",
     "node-pty": "^1.1.0",
     "open": "^10.2.0",
+    "proper-lockfile": "^4.1.2",
     "react": "18.2.0",
     "sharp": "^0.34.5",
     "shiki": "^4.0.2",

scripts/source-file-size-baseline.json

@@ -1,6 +1,6 @@
 {
   "src/agent/client-skills.test.ts": 1196,
-  "src/agent/memory-git.ts": 2128,
+  "src/agent/memory-git.ts": 2123,
   "src/backend/local-backend.test.ts": 2532,
   "src/backend/local/local-backend.ts": 1014,
   "src/backend/local/local-store.ts": 3594,
@@ -24,7 +24,7 @@
   "src/cli/subcommands/skills.ts": 1264,
   "src/headless.ts": 5242,
   "src/hooks/integration.test.ts": 1147,
-  "src/index.ts": 2776,
+  "src/index.ts": 2763,
   "src/mods/learning-harness.ts": 2434,
   "src/mods/mod-engine.test.ts": 2153,
   "src/mods/mod-engine.ts": 1847,

src/agent/client-soft-fail.test.ts

@@ -43,6 +43,12 @@ async function runIsolatedClientScript(
     HOME: homeDir,
     USERPROFILE: homeDir,
     LETTA_CODE_AGENT_ROLE: "subagent",
+    // Force readPersistedAuthTokens (the coordinated refresh's durable
+    // snapshot) onto its file-backed path: these scenarios stub keychain
+    // behavior at the settingsManager level, and the machine keychain must
+    // never be consulted or written. Also makes the scenarios deterministic
+    // across platforms (Linux CI has no keychain; macOS runners do).
+    LETTA_SKIP_KEYCHAIN_CHECK: "1",
   };
   delete env.LETTA_API_KEY;
   delete env.LETTA_BASE_URL;
@@ -238,7 +244,21 @@ describe("getClient soft failures", () => {
         });
         await settingsManager.flush();
 
-        settingsManager.updateSettings = () => {};
+        // Persist refreshed tokens into the temp-HOME settings file instead
+        // of the real store: the coordinated refresh verifies persistence
+        // with a durable read-back (file-backed here via
+        // LETTA_SKIP_KEYCHAIN_CHECK), so a swallowing no-op would correctly
+        // be rejected as a failed persist.
+        const { writeFileSync } = await import("node:fs");
+        const { join } = await import("node:path");
+        const settingsPath = join(process.env.HOME, ".letta", "settings.json");
+        settingsManager.updateSettings = (updates) => {
+          writeFileSync(settingsPath, JSON.stringify({
+            env: { LETTA_API_KEY: updates.env?.LETTA_API_KEY },
+            refreshToken: updates.refreshToken,
+            tokenExpiresAt: updates.tokenExpiresAt,
+          }), "utf-8");
+        };
 
         let refreshReadCount = 0;
         let fetchCalls = 0;