fix: preserve executable permission bits on install (closes #1563)

[danielmeppiel]

Preserves executable permission bits when materializing package files through the reflink copy fast path and the Artifactory ZIP extraction path, aligning archive extraction with the registry extractor's Unix mode handling. How to test: uv run --locked --extra dev pytest tests/unit/test_file_ops.py tests/unit/test_reflink_phase3w5.py tests/unit/test_download_strategies.py tests/unit/install/test_artifactory_resolver.py -q; uv run --locked --extra dev ruff check src/ tests/ --quiet; uv run --locked --extra dev ruff format --check src/ tests/ --quiet. Closes #1563.

[Copilot]

Pull request overview

This PR fixes an install-time permissions regression by ensuring executable permission bits are preserved when APM materializes package files via (1) the reflink fast path and (2) the Artifactory ZIP extraction path, aligning behavior with the registry ZIP extractor.

Changes:

• Preserve file mode metadata on successful reflink clones by copying stat metadata after clone_file(...).
• Apply ZIP entry Unix mode bits from ZipInfo.external_attr during Artifactory archive extraction.
• Add regression tests covering both the reflink fast path and Artifactory ZIP extraction.

Show a summary per file

File	Description
src/apm_cli/utils/file_ops.py	Copies file metadata after successful reflink clone so executable bits are preserved.
src/apm_cli/deps/download_strategies.py	Applies ZIP Unix mode bits when extracting Artifactory archives to preserve executability.
tests/unit/test_file_ops.py	Adds a unit test asserting reflink fast path preserves executable bits.
tests/unit/test_download_strategies.py	Adds a unit test asserting Artifactory ZIP extraction preserves executable bits.

Copilot's findings

• Files reviewed: 4/4 changed files
• Comments generated: 2

[danielmeppiel]

APM Review Panel: ship_now

Executable-bit preservation fix ships with integration test coverage and no outstanding concerns.

cc @sergio-sisternes-epam -- a fresh advisory pass is ready for your review.

This PR fixes a concrete install correctness defect: executable permission bits were silently dropped during reflink copy and Artifactory archive extraction. The fix is narrow, bounded by the existing path-traversal guard and 0o755 mask, and now defended by unit plus integration-with-fixtures coverage. CI is green across all reported checks.

Aligned with: portable-by-manifest: installed artifacts preserve filesystem semantics; pragmatic-as-npm: installed scripts work without manual chmod.

Panel summary

Persona	B	R	N	Takeaway
Python Architect	0	0	0	Small, architecture-local fix matching registry extractor and copy2 metadata semantics.
CLI Logging Expert	0	0	0	No CLI output, logging, or diagnostic rendering touched.
DevX UX Expert	0	0	0	Improves install/run expectations by keeping scripts executable.
Supply Chain Security Expert	0	0	0	Permission preservation is bounded by path safety and mode masking.
OSS Growth Hacker	0	0	0	Internal installer correctness fix with no growth-surface changes.
Test Coverage Expert	0	0	0	Unit and integration coverage now defend the changed permission paths.

B = highest-signal findings, R = recommended, N = nits. Counts are signals, not gates. The maintainer ships.

Architecture

classDiagram
    class DownloadDelegate {
      +download_artifactory_archive()
    }
    class FileOps {
      +robust_copy2()
      -_reflink_copy_file()
    }
    class ZipInfo {
      +external_attr
    }
    DownloadDelegate ..> ZipInfo : reads unix mode
    FileOps ..> shutil : copystat after clone

Loading

flowchart TD
    A[Artifactory ZIP archive] --> B[DownloadDelegate.download_artifactory_archive]
    B --> C[path traversal guard]
    C --> D[write file]
    D --> E[chmod unix_mode and 0o755]
    F[robust_copy2] --> G[clone_file fast path]
    G --> H[shutil.copystat]

Loading

Recommendation

Ship now. The foldable test-coverage follow-up was resolved in 9600c8c7, and no remaining panel finding needs action in this PR.

Folded in this run

• (panel) Add integration-tier assertion that Artifactory archive extraction preserves executable bits through the real fixture path -- resolved in 9600c8c.

Regression-trap evidence (mutation-break gate)

• tests/integration/test_download_strategies_selection.py::TestDownloadArtifactoryArchive::test_executable_bits_survive_archive_extraction -- deleted os.chmod(dest, unix_mode & 0o755); test FAILED as expected; guard restored.

Lint contract

uv run --extra dev ruff check src/ tests/ and uv run --extra dev ruff format --check src/ tests/ both silent. Full local lint gate also passed: pylint duplicate guard and auth-signal lint clean.

CI

gh pr checks 1566 --repo microsoft/apm: 13 successful, 0 failing, 0 cancelled, 0 pending checks (after 0 CI fix iteration(s)).

Mergeability status

PR	head SHA	CEO stance	iters	folds	defers	Copilot rounds	CI	mergeable	mergeStateStatus	notes
#1566	9600c8c	ship_now	1	1	0	2	green	MERGEABLE	BLOCKED	pending required review

Convergence

1 outer iteration(s); 2 Copilot round(s). Final panel recommendation: ship_now.

Ready for maintainer review.

---

Full per-persona findings

Python Architect

No findings.

CLI Logging Expert

No findings.

DevX UX Expert

No findings.

Supply Chain Security Expert

No findings.

OSS Growth Hacker

No findings.

Auth Expert -- inactive

Changed files handle executable-bit preservation in download/file copy paths and tests; no AuthResolver, token, credential, or host classification behavior changes.

Doc Writer -- inactive

Runtime install internals and tests only; no user-facing documentation currently describes executable-bit preservation semantics, so no doc drift is created.

Test Coverage Expert

No findings.

_{This panel is advisory. It does not block merge. Re-apply the panel-review label after addressing feedback to re-run.}