fix: extend copy2→copyfile fix to integrations/base and copilot

Two install paths missed in f70bdf9: copy_command_to_directory(),
install_scripts() in IntegrationBase, and the vscode-settings.json
copy in CopilotIntegration all used copy2, propagating 0o444/0o555
from bundled package data (Nix store) to destination files.

Switch to copyfile at all three sites. Add permission regression tests
for each.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: rayhem

src/specify_cli/integrations/base.py

@@ -428,7 +428,7 @@ def copy_command_to_directory(
         """
         dest_dir.mkdir(parents=True, exist_ok=True)
         dst = dest_dir / filename
-        shutil.copy2(src, dst)
+        shutil.copyfile(src, dst)
         return dst
 
     @staticmethod
@@ -504,7 +504,7 @@ def install_scripts(
             if not src_script.is_file():
                 continue
             dst_script = scripts_dest / src_script.name
-            shutil.copy2(src_script, dst_script)
+            shutil.copyfile(src_script, dst_script)
             if dst_script.suffix == ".sh":
                 dst_script.chmod(dst_script.stat().st_mode | 0o111)
             self.record_file_in_manifest(dst_script, project_root, manifest)

src/specify_cli/integrations/copilot/__init__.py

@@ -380,7 +380,7 @@ def _setup_default(
                 # remove the user's settings file on uninstall.
                 self._merge_vscode_settings(settings_src, dst_settings)
             else:
-                shutil.copy2(settings_src, dst_settings)
+                shutil.copyfile(settings_src, dst_settings)
                 self.record_file_in_manifest(dst_settings, project_root, manifest)
                 created.append(dst_settings)
 

tests/integrations/test_base.py

@@ -149,6 +149,14 @@ def test_copy_command_to_directory(self, tmp_path):
         assert result == dest_dir / "speckit.plan.md"
         assert result.read_text(encoding="utf-8") == "content"
 
+    def test_copy_command_to_directory_readonly_source_is_writable(self, tmp_path):
+        src = tmp_path / "source.md"
+        src.write_text("content", encoding="utf-8")
+        src.chmod(0o444)
+        dest_dir = tmp_path / "output"
+        result = IntegrationBase.copy_command_to_directory(src, dest_dir, "speckit.plan.md")
+        assert result.stat().st_mode & 0o200, "destination must be owner-writable"
+
     def test_record_file_in_manifest(self, tmp_path):
         f = tmp_path / "f.txt"
         f.write_text("hello", encoding="utf-8")
@@ -164,6 +172,27 @@ def test_write_file_and_record(self, tmp_path):
         assert dest.read_text(encoding="utf-8") == "content"
         assert "sub/f.txt" in m.files
 
+    def test_install_scripts_readonly_source_files_are_writable(self, tmp_path, monkeypatch):
+        scripts_src = tmp_path / "scripts_src"
+        scripts_src.mkdir()
+        helper = scripts_src / "helper.sh"
+        helper.write_text("#!/bin/sh\necho hi\n")
+        helper.chmod(0o444)
+        data = scripts_src / "data.txt"
+        data.write_text("payload")
+        data.chmod(0o444)
+
+        project = tmp_path / "project"
+        project.mkdir()
+        i = StubIntegration()
+        m = IntegrationManifest("stub", project)
+        monkeypatch.setattr(i, "integration_scripts_dir", lambda: scripts_src)
+        created = i.install_scripts(project, m)
+
+        assert len(created) == 2
+        for dst in created:
+            assert dst.stat().st_mode & 0o200, f"{dst.name} must be owner-writable"
+
     def test_setup_copies_shared_templates(self, tmp_path):
         i = StubIntegration()
         m = IntegrationManifest("stub", tmp_path)

tests/integrations/test_integration_copilot.py

@@ -67,6 +67,20 @@ def test_setup_creates_vscode_settings_new(self, tmp_path):
         assert settings in created
         assert any("settings.json" in k for k in m.files)
 
+    def test_setup_vscode_settings_readonly_source_is_writable(self, tmp_path, monkeypatch):
+        from specify_cli.integrations.copilot import CopilotIntegration
+        import json as _json
+        copilot = CopilotIntegration()
+        # Simulate a bundled settings file with read-only store permissions.
+        ro_src = tmp_path / "ro_settings.json"
+        ro_src.write_text(_json.dumps({"foo": "bar"}))
+        ro_src.chmod(0o444)
+        monkeypatch.setattr(copilot, "_vscode_settings_path", lambda: ro_src)
+        m = IntegrationManifest("copilot", tmp_path)
+        copilot.setup(tmp_path, m)
+        settings = tmp_path / ".vscode" / "settings.json"
+        assert settings.stat().st_mode & 0o200, ".vscode/settings.json must be owner-writable"
+
     def test_setup_merges_existing_vscode_settings(self, tmp_path):
         from specify_cli.integrations.copilot import CopilotIntegration
         copilot = CopilotIntegration()