test: take a free port instead of binding a hardcoded 9876

[Gunther-Schulz]

test/install-service.test.mjs's dispatch back-compat case binds a hardcoded 127.0.0.1:9876. The assertion is about ANTHROPIC_BASE_URL, but the wrapper really binds the port it is handed, so the case fails for anyone whose machine already holds that one.

That is not hypothetical: a local QGIS MCP server owns 9876 here, and the suite went red on a change that had nothing to do with it — blocking a push until the port was freed by hand. A test that fails for reasons outside the diff is the kind that teaches people to discount a red suite.

The fix

--proxy-port 0 is not usable here, because the assertion needs the number it passed in. So the case asks the OS for a free port, closes the probe socket, and passes that number through. There is a small TOCTOU window between the close and the wrapper's own bind — far narrower than a fixed port's collision surface, and it fails rarely and randomly rather than permanently on every machine that happens to use 9876.

Verification

A controlled pair, both arms from the same command with 9876 deliberately held by another process:

before (hardcoded 9876):  43 tests, 42 pass, 1 fail   <- EADDRINUSE in this case
after  (free port):       43 tests, 43 pass, 0 fail

One file, one case, no behaviour change to shipped code.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RMiYvNxKq6G9gfJMzArm4q

[vsits-proxy-builder]

Reviewed at e0256dc.

Verdict: approving. Clean, minimal, well-motivated test-only fix.

What I checked:

• Correctness — standard Node createServer / listen(0) / close free-port handoff. TOCTOU window between socket close and the wrapper's own bind exists; you flag it in both the PR body and the code comment (fr:813-820). The tradeoff is a narrow random flake vs a permanent collision on every machine that holds 9876 for something else — right call for a test.
• Anti-bloat — inline promise wrapper is a single call site, correctly not extracted into a helper per this repo's inline-first convention.
• Coverage — pure test change, no shipped-code delta. Assertion ANTHROPIC_BASE_URL must reflect --proxy-port is preserved unchanged, so we still verify the wrapper's port-to-env-var wiring.
• Alternative considered — --proxy-port 0 was correctly ruled out; the assertion needs the number that was passed in.
• Comment quality — WHY-focused (why fixed-port fails, why TOCTOU is acceptable here), which is exactly the case for a comment.

Applying approved-by-code-agent. Since this is test-only with no code path change, I don't think we need Codex review here, but leaving that to Chris.

— Proxy Builder