fix(windows): make native coverage graph portable

packages/credentials/credentials-local/src/index.ts

@@ -97,16 +97,23 @@ const GROUP_OTHER_BITS = 0o077
  * here — so the check is skipped rather than faked, and the file's protection
  * there is whatever the create and replace APIs express.
  * @param filename - absolute path of the document.
- * @throws when the file exists with group or other permission bits set.
+ * @throws when the path hierarchy is invalid or the file exists with group or other permission bits set.
  */
 async function assertOwnerOnly(filename: string): Promise<void> {
-  /* v8 ignore next -- native Windows coverage exercises the skip; POSIX covers the check */
-  if (process.platform === 'win32') return
+  /* v8 ignore start -- native Windows coverage exercises this path; POSIX covers mode enforcement */
+  if (process.platform === 'win32') {
+    // Windows has no POSIX mode bits, but it reports a file-as-parent as
+    // ordinary ENOENT; canonicalization preserves the invalid-path failure.
+    await canonicalizeWatchPath(filename)
+    return
+  }
+  /* v8 ignore stop */
   let mode: number
   try {
     mode = (await stat(filename)).mode
   } catch (error) {
     if (!isENOENT(error)) throw error
+    await canonicalizeWatchPath(filename)
     return
   }
   const offending = mode & GROUP_OTHER_BITS

packages/credentials/credentials-local/tests/local.spec.ts

@@ -168,7 +168,7 @@ describe('layer ladder', () => {
     expect(await stored.credentials.resolve(KEY)).toEqual({ value: 'stored', source: 'file' })
   })
 
-  it('refuses a document other OS users can read', async () => {
+  it.skipIf(process.platform === 'win32')('refuses a document other OS users can read', async () => {
     const dir = await tempDir()
     const path = join(dir, '.credentials.yaml')
     await writeFile(path, 'DSH_CRED_TEST: leaked\n', { mode: 0o644 })
@@ -274,7 +274,7 @@ describe('document writes', () => {
     const seen = updates(ctx)
     await ctx.credentials.set(KEY, 'sk-fresh')
     expect(await readFile(path, 'utf8')).toBe('DSH_CRED_TEST: sk-fresh\n')
-    expect((await stat(path)).mode & 0o777).toBe(0o600)
+    if (process.platform !== 'win32') expect((await stat(path)).mode & 0o777).toBe(0o600)
     expect(await ctx.credentials.resolve(KEY)).toEqual({ value: 'sk-fresh', source: 'file' })
     expect(seen).toEqual([KEY])
   })

packages/credentials/credentials-local/tests/review-fixes.spec.ts

@@ -78,7 +78,7 @@ describe('read-modify-write', () => {
     const home = join(dir, 'home')
     const ctx = await boot({ path: join(home, '.credentials.yaml'), watch: false })
     await ctx.credentials.set(ALPHA, 'one')
-    expect((await stat(home)).mode & 0o777).toBe(0o700)
+    if (process.platform !== 'win32') expect((await stat(home)).mode & 0o777).toBe(0o700)
   })
 })