test(cron): handle Windows path and permission semantics

[rerdi92]

Summary

• Make cron/config permission tests portable on Windows by keeping strict POSIX mode-bit assertions on POSIX only.
• Keep Windows coverage meaningful by still asserting that sensitive files/directories are created.
• Make the ~ workdir normalization test patch Windows-native home variables (USERPROFILE, HOMEDRIVE, HOMEPATH) in addition to HOME.

Root cause

Two tests encoded POSIX-only assumptions:

1. Windows/NTFS does not round-trip chmod(0600/0700) through stat().st_mode as strict POSIX mode bits.
2. Path("~").expanduser() on Windows uses USERPROFILE/HOMEDRIVE+HOMEPATH, not HOME alone.

Test plan

• Reproduced the Windows failures before the patch:
  • tests/cron/test_file_permissions.py strict 0600/0700 assertions failed as 0666/0777.
  • tests/cron/test_cron_workdir.py::TestNormalizeWorkdir::test_tilde_expands resolved to C:\Users\82109 instead of patched HOME.
• Focused verification:

python -m pytest tests/cron/test_file_permissions.py tests/cron/test_cron_workdir.py -q

29 passed

• Syntax/checks:

python -m py_compile tests/cron/test_file_permissions.py tests/cron/test_cron_workdir.py
git diff --check

Scope note

This is intentionally separate from the cron profile-scoped jobs storage fix in #60882.

[tonydwb]

Code Review Summary

Verdict: Comment (token read-only)

PR 60888 adds unit tests for Windows path and permission semantics in cron. Test improvements for cross-platform compatibility. Well-scoped (2 files, 32 additions, 19 deletions). No security issues or debug artifacts detected.

LGTM - awaiting maintainer approval.

[teknium1]

Thanks for the focused Windows portability coverage. The premise remains valid on current main: tests/cron/test_file_permissions.py:37-118 still asserts POSIX 0600/0700 mode bits unconditionally, while tests/cron/test_cron_workdir.py:48-52 only patches HOME before cron.jobs._normalize_workdir() calls Path.expanduser() at cron/jobs.py:823.

The patch matches existing repository precedent: tests/hermes_cli/test_atomic_json_write.py:162-166 limits durable mode-bit assertions to platforms that support them, and tests/tools/test_checkpoint_manager.py:57-60 patches USERPROFILE while clearing HOMEDRIVE and HOMEPATH for deterministic home expansion.

The PR is behind current main, but the two changed test regions remain applicable; salvage should be mechanical.

Automated hermes-sweeper review.

[LceAn]

Independent confirmation: I reproduced the same two failures and arrived at the same fix independently on a different Windows setup — Python 3.13.14 (the original report in #60243 was 3.11.15), so the issue and this fix hold across Python versions.

For the workdir test, the USERPROFILE + HOMEDRIVE/HOMEPATH patch makes it pass (not skip) on Windows under 3.13, exercising the ~ expansion for real rather than gating it out.

One thing worth flagging for reviewers: this is the cron instance of a recurring HOME / POSIX-assumption pattern that also shows up in:

• tests/agent/lsp/test_workspace.py + tests/agent/test_context_references.py → test(agent): honor Windows expanduser home in HOME-dependent tests #49118 (fix up in test(agent): pin Windows HOME variables in tilde-dependent tests #63562)
• tests/hermes_cli/test_backup.py (chmod 0o600) → [Windows] backup import test fails: os.chmod(..., 0o600) is a no-op on Windows #56923 / test(cli): gate only the POSIX mode-bit assertion on Windows #59433

The assert_secure_mode() helper here is actually the nicer of the approaches taken — it keeps the existence assertion on Windows rather than skipping wholesale, which the 0o600 backup test (#59433) currently does with a plain skipif. Worth aligning on a shared helper across these if the maintainers want one pattern for the whole class of bug.

Not opening a competing PR — this one covers it. Posting only to add the cross-version verification and the cross-issue context.