This commit addresses the SDK test timeout issues caused by port conflicts
and incomplete process cleanup.

## Problem
- Web SDK tests frequently timeout when trying to start Rooch server
- Port 6767/6768 conflicts when multiple tests run or old processes remain
- No timeout mechanism for server startup, leading to indefinite hangs
- Process cleanup was incomplete, leaving zombie processes

## Solution
1. **Dynamic Port Allocation**
   - Added isPortAvailable() function to check port availability
   - Modified loadRoochEnv() to check if requested port is available
   - Falls back to dynamic port (0) if requested port is occupied
   - Ensures each test gets a unique port

2. **Timeout Mechanism**
   - Added 30-second timeout to roochAsyncCommand()
   - Provides clear error messages when startup fails
   - Includes captured output in error for debugging

3. **Improved Process Cleanup**
   - Enhanced cleanEnv() to use SIGTERM first, then SIGKILL
   - Added fallback port-based cleanup using lsof
   - Cross-platform support (macOS/Linux/Windows)
   - Better logging for troubleshooting

4. **Better Logging**
   - Added debug logs for port allocation and process lifecycle
   - Logs PID and port for each server instance
   - Helps diagnose issues in CI environment

## Testing
- Verified multiple servers can start concurrently without conflicts
- Confirmed process cleanup properly frees ports
- Tested timeout mechanism with unavailable ports

Fixes #3755

This commit addresses the SDK test timeout issues caused by port conflicts
and incomplete process cleanup.

## Problem
- Web SDK tests frequently timeout when trying to start Rooch server
- Port 6767/6768 conflicts when multiple tests run or old processes remain
- No timeout mechanism for server startup, leading to indefinite hangs
- Process cleanup was incomplete, leaving zombie processes

## Solution
1. **Dynamic Port Allocation**
   - Added isPortAvailable() function to check port availability
   - Modified loadRoochEnv() to check if requested port is available
   - Falls back to dynamic port (0) if requested port is occupied
   - Ensures each test gets a unique port

2. **Timeout Mechanism**
   - Added 30-second timeout to roochAsyncCommand()
   - Provides clear error messages when startup fails
   - Includes captured output in error for debugging

3. **Improved Process Cleanup**
   - Enhanced cleanEnv() to use SIGTERM first, then SIGKILL
   - Added fallback port-based cleanup using lsof
   - Cross-platform support (macOS/Linux/Windows)
   - Better logging for troubleshooting

4. **Better Logging**
   - Added debug logs for port allocation and process lifecycle
   - Logs PID and port for each server instance
   - Helps diagnose issues in CI environment

## Testing
- Verified multiple servers can start concurrently without conflicts
- Confirmed process cleanup properly frees ports
- Tested timeout mechanism with unavailable ports

Fixes #3755

…e tests

## Problem
- Previous approach used hardcoded ports (6767) causing conflicts
- Manual server management via npm scripts was error-prone
- Tests couldn't run concurrently due to port conflicts
- Platform-specific cleanup commands (lsof/netstat)

## Solution: Global Setup with Dynamic Port Allocation

### 1. Global Setup (globalSetup.ts)
- Starts single shared Rooch server for all e2e tests
- Uses dynamic port allocation (0 = auto-assign)
- Sets VITE_FULLNODE_URL environment variable
- Automatic cleanup via Vitest teardown

### 2. Simplified npm Scripts
- Removed: prepare:e2e, stop:e2e, wait-on dependency
- Now: just 'vitest run e2e'
- No manual server management needed

### 3. TestBox Integration
- Each test's TestBox now configures rooch CLI to use global server
- Fixed cmdPublishPackage to replace 'default' with actual address
- Improved JSON parsing to handle mixed output (logs + JSON)
- Enhanced error handling with detailed logging

### 4. Better Error Handling
- Capture both stdout and stderr from execSync
- Robust JSON extraction from mixed output
- Clear error messages for debugging

## Benefits
✅ No port conflicts (dynamic allocation)
✅ Faster tests (shared server, no repeated startup)
✅ Cross-platform (no lsof/netstat needed)
✅ Simpler scripts (3 files changed, 4 scripts removed)
✅ Better reliability (automatic cleanup)
✅ CI compatible (no workflow changes needed)

## Test Results
- All 13 test files pass (32 tests)
- Duration: ~89s
- Dynamic port confirmed: http://127.0.0.1:64271

Fixes #3755

…3794)

* fix(sdk): improve web SDK test port management and process cleanup

This commit addresses the SDK test timeout issues caused by port conflicts
and incomplete process cleanup.

## Problem
- Web SDK tests frequently timeout when trying to start Rooch server
- Port 6767/6768 conflicts when multiple tests run or old processes remain
- No timeout mechanism for server startup, leading to indefinite hangs
- Process cleanup was incomplete, leaving zombie processes

## Solution
1. **Dynamic Port Allocation**
   - Added isPortAvailable() function to check port availability
   - Modified loadRoochEnv() to check if requested port is available
   - Falls back to dynamic port (0) if requested port is occupied
   - Ensures each test gets a unique port

2. **Timeout Mechanism**
   - Added 30-second timeout to roochAsyncCommand()
   - Provides clear error messages when startup fails
   - Includes captured output in error for debugging

3. **Improved Process Cleanup**
   - Enhanced cleanEnv() to use SIGTERM first, then SIGKILL
   - Added fallback port-based cleanup using lsof
   - Cross-platform support (macOS/Linux/Windows)
   - Better logging for troubleshooting

4. **Better Logging**
   - Added debug logs for port allocation and process lifecycle
   - Logs PID and port for each server instance
   - Helps diagnose issues in CI environment

## Testing
- Verified multiple servers can start concurrently without conflicts
- Confirmed process cleanup properly frees ports
- Tested timeout mechanism with unavailable ports

Fixes #3755

* fix(sdk): address code review comments

- Fix Windows batch command syntax: use %%a instead of %a
- Make cleanup synchronous to avoid race conditions
- Remove redundant execSync require (use top-level import)
- Simplify cleanup logic by removing async setTimeout

Changes based on Copilot review feedback.

* feat(sdk): implement global setup with dynamic port allocation for e2e tests

## Problem
- Previous approach used hardcoded ports (6767) causing conflicts
- Manual server management via npm scripts was error-prone
- Tests couldn't run concurrently due to port conflicts
- Platform-specific cleanup commands (lsof/netstat)

## Solution: Global Setup with Dynamic Port Allocation

### 1. Global Setup (globalSetup.ts)
- Starts single shared Rooch server for all e2e tests
- Uses dynamic port allocation (0 = auto-assign)
- Sets VITE_FULLNODE_URL environment variable
- Automatic cleanup via Vitest teardown

### 2. Simplified npm Scripts
- Removed: prepare:e2e, stop:e2e, wait-on dependency
- Now: just 'vitest run e2e'
- No manual server management needed

### 3. TestBox Integration
- Each test's TestBox now configures rooch CLI to use global server
- Fixed cmdPublishPackage to replace 'default' with actual address
- Improved JSON parsing to handle mixed output (logs + JSON)
- Enhanced error handling with detailed logging

### 4. Better Error Handling
- Capture both stdout and stderr from execSync
- Robust JSON extraction from mixed output
- Clear error messages for debugging

## Benefits
✅ No port conflicts (dynamic allocation)
✅ Faster tests (shared server, no repeated startup)
✅ Cross-platform (no lsof/netstat needed)
✅ Simpler scripts (3 files changed, 4 scripts removed)
✅ Better reliability (automatic cleanup)
✅ CI compatible (no workflow changes needed)

## Test Results
- All 13 test files pass (32 tests)
- Duration: ~89s
- Dynamic port confirmed: http://127.0.0.1:64271

Fixes #3755

* fix(sdk): remove TOCTOU race condition in port availability check

## Problem
The isPortAvailable() function had a Time-of-Check-Time-of-Use (TOCTOU)
race condition:

1. Check if port is available ✓
2. Close test server, releasing the port ⚠️
3. **Another process could steal the port here** 💥
4. Try to start Rooch server on that port ✗

This could cause:
- Server startup failures
- 30-second timeout instead of fast failure
- Flaky tests in concurrent environments

## Solution
Remove the isPortAvailable() check entirely and use a simpler strategy:

- For port 0, 6767, or 6768: Always use dynamic allocation
- For other ports: Trust the caller, let server fail fast if unavailable

Benefits:
✅ No race condition
✅ Simpler code (removed isPortAvailable function)
✅ Faster failure (server bind error vs 30s timeout)
✅ Common ports (6767/6768) always use dynamic allocation

## Trade-offs
- Custom ports (not 0/6767/6768) won't be pre-checked
- Server will fail at bind time instead of during port check
- This is actually better: fail-fast with clear error message

* refactor(sdk): remove unnecessary address replacement in cmdPublishPackage

## Reason
The rooch CLI already supports 'default' keyword in named addresses:
--named-addresses alice=0x1234,bob=default

The 'default' keyword is automatically resolved to the active account
address by the rooch command itself.

## Changes
- Removed manual address replacement logic (await defaultCmdAddress())
- Simplified cmdPublishPackage to directly use options.namedAddresses
- Added comment explaining that rooch CLI handles 'default' keyword

## Benefits
✅ Simpler code (removed 2 lines)
✅ Faster execution (no async address lookup)
✅ Consistent with rooch CLI behavior
✅ Less error-prone (let CLI handle address resolution)

## Test Results
All 13 test files pass (32 tests) - Duration: 89.66s

* security(sdk): use execFileSync instead of execSync to prevent shell injection

## Security Issue
Using execSync with shell: true can lead to command injection vulnerabilities
if user input is not properly sanitized.

## Solution
Refactored buildRoochCommand to return structured command information:
- cmd: executable path
- args: array of arguments
- env: environment variables

Updated roochCommand to use execFileSync instead of execSync:
- execFileSync doesn't use shell, preventing injection attacks
- Arguments are passed as array, not concatenated strings
- More secure and explicit command execution

Updated roochAsyncCommand to use spawn without shell:
- spawn(cmd, args, { env }) instead of spawn(command, { shell: true })
- Same security benefits as execFileSync

## Benefits
✅ Prevents shell injection vulnerabilities
✅ More explicit argument handling
✅ Proper environment variable passing
✅ Cleaner separation of concerns

## Test Results
All 13 test files pass (32 tests) - Duration: 90.03s

Addresses GitHub Advanced Security code scanning alert

* fixup