fix(test): Windows compat — USERPROFILE + npx.cmd in PR-3 tests

PR #129's three new test files (cursor-auth-config, agent-sdk-factory,
hooks-workspace-fallback) failed on windows-latest CI for two
mechanical reasons. Linux/macOS were fine.

1) HOME env override is a no-op on Windows
-------------------------------------------
`os.homedir()` reads `process.env.USERPROFILE` on win32, not `HOME`.
Overriding only `process.env.HOME` in beforeEach() worked on POSIX
but not Windows, so `authConfigPath()` resolved to the user's real
home dir, polluted/got polluted across tests.

Fix: override BOTH USERPROFILE and HOME on win32; restore both in
afterEach.

2) spawnSync("npx", ...) doesn't resolve on Windows
----------------------------------------------------
npm/npx ship as `.cmd` shims on Windows. Bare "npx" fails ENOENT.
Plus `.cmd` files cannot be spawned directly with arguments on
recent Node due to CVE-2024-27980 — must use shell mode.

Fix in test/hooks-workspace-fallback.test.ts: use "npx.cmd" + shell:
true on win32, "npx" on POSIX.

No product code changes. Pure test infrastructure fix. Tests still
pass 604/604 on Linux locally.

#!axme pr=129 repo=AxmeAI/axme-code

Author: George-iam

test/agent-sdk-factory.test.ts

@@ -4,15 +4,18 @@ import { mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 
 const SANDBOX_HOME = "/tmp/axme-agent-sdk-factory-test";
-const ORIGINAL_HOME = process.env.HOME;
-const ORIGINAL_AXME_IDE = process.env.AXME_IDE;
-const ORIGINAL_API_KEY = process.env.ANTHROPIC_API_KEY;
-const ORIGINAL_CURSOR_KEY = process.env.CURSOR_API_KEY;
+// On Windows os.homedir() reads USERPROFILE, not HOME — override both
+// for cross-platform sandboxing.
+const HOME_VARS = process.platform === "win32" ? ["USERPROFILE", "HOME"] : ["HOME"];
+const ORIGINAL: Record<string, string | undefined> = {};
+for (const v of [...HOME_VARS, "AXME_IDE", "ANTHROPIC_API_KEY", "CURSOR_API_KEY"]) {
+  ORIGINAL[v] = process.env[v];
+}
 
 beforeEach(() => {
   rmSync(SANDBOX_HOME, { recursive: true, force: true });
   mkdirSync(SANDBOX_HOME, { recursive: true });
-  process.env.HOME = SANDBOX_HOME;
+  for (const v of HOME_VARS) process.env[v] = SANDBOX_HOME;
   delete process.env.AXME_IDE;
   delete process.env.CURSOR_API_KEY;
   // Keep ANTHROPIC_API_KEY out so factory falls into the "neither" path
@@ -22,14 +25,10 @@ beforeEach(() => {
 
 afterEach(() => {
   rmSync(SANDBOX_HOME, { recursive: true, force: true });
-  if (ORIGINAL_HOME === undefined) delete process.env.HOME;
-  else process.env.HOME = ORIGINAL_HOME;
-  if (ORIGINAL_AXME_IDE === undefined) delete process.env.AXME_IDE;
-  else process.env.AXME_IDE = ORIGINAL_AXME_IDE;
-  if (ORIGINAL_API_KEY === undefined) delete process.env.ANTHROPIC_API_KEY;
-  else process.env.ANTHROPIC_API_KEY = ORIGINAL_API_KEY;
-  if (ORIGINAL_CURSOR_KEY === undefined) delete process.env.CURSOR_API_KEY;
-  else process.env.CURSOR_API_KEY = ORIGINAL_CURSOR_KEY;
+  for (const v of [...HOME_VARS, "AXME_IDE", "ANTHROPIC_API_KEY", "CURSOR_API_KEY"]) {
+    if (ORIGINAL[v] === undefined) delete process.env[v];
+    else process.env[v] = ORIGINAL[v];
+  }
 });
 
 describe("createAgentSdk — IDE selection", () => {

test/cursor-auth-config.test.ts

@@ -3,20 +3,26 @@ import assert from "node:assert/strict";
 import { mkdirSync, rmSync, writeFileSync, statSync, existsSync } from "node:fs";
 import { join } from "node:path";
 
-// Override $HOME so the auth-config module reads from a sandboxed path.
+// Override the home-dir env var so auth-config (which calls os.homedir())
+// reads from a sandboxed path. On Windows os.homedir() reads USERPROFILE,
+// not HOME — set both for cross-platform safety.
 const SANDBOX_HOME = "/tmp/axme-cursor-auth-test-home";
-const ORIGINAL_HOME = process.env.HOME;
+const HOME_VARS = process.platform === "win32" ? ["USERPROFILE", "HOME"] : ["HOME"];
+const ORIGINAL: Record<string, string | undefined> = {};
+for (const v of HOME_VARS) ORIGINAL[v] = process.env[v];
 
 beforeEach(() => {
   rmSync(SANDBOX_HOME, { recursive: true, force: true });
   mkdirSync(SANDBOX_HOME, { recursive: true });
-  process.env.HOME = SANDBOX_HOME;
+  for (const v of HOME_VARS) process.env[v] = SANDBOX_HOME;
 });
 
 afterEach(() => {
   rmSync(SANDBOX_HOME, { recursive: true, force: true });
-  if (ORIGINAL_HOME === undefined) delete process.env.HOME;
-  else process.env.HOME = ORIGINAL_HOME;
+  for (const v of HOME_VARS) {
+    if (ORIGINAL[v] === undefined) delete process.env[v];
+    else process.env[v] = ORIGINAL[v];
+  }
 });
 
 describe("auth.yaml round-trip with cursor_sdk mode", () => {

test/hooks-workspace-fallback.test.ts

@@ -29,13 +29,19 @@ afterEach(() => {
 });
 
 function spawnHook(hookName: "pre-tool-use" | "post-tool-use" | "session-end", argv: string[], stdinJson: object) {
+  // On Windows npm/npx ship as .cmd shims; spawnSync won't resolve bare "npx".
+  // Use the .cmd extension on win32 and spawn through cmd.exe to avoid
+  // CVE-2024-27980 EINVAL when invoking .cmd directly with arguments.
+  const isWin = process.platform === "win32";
+  const npxBin = isWin ? "npx.cmd" : "npx";
   const args = ["tsx", "src/cli.ts", "hook", hookName, ...argv];
-  const result = spawnSync("npx", args, {
+  const result = spawnSync(npxBin, args, {
     cwd: REPO_ROOT,
     input: JSON.stringify(stdinJson),
     encoding: "utf-8",
     env: { ...process.env, AXME_TELEMETRY_DISABLED: "1" },
     timeout: 15000,
+    shell: isWin,  // .cmd on Windows requires shell mode
   });
   return result;
 }