test(jetsocat): replace flaky socks5_to_jmux proptest with deterministic CLI test (#1718)

The proptest-based integration test was flaky on both Linux and Windows
CI:
- External network call to rust-lang.org:80 failed when the server
returned an unexpected HTTP response (e.g. redirect without HTML body)
- Same ports rebound 32 times per run risked TIME_WAIT races

Replace with two deterministic rstest cases (TCP and WebSocket) in the
testsuite CLI suite. The new test spawns real jetsocat subprocesses and
uses an in-process tokio echo server, with no external network
dependency.

Author: CBenoit

Cargo.lock

@@ -81,7 +81,3 @@ features = [
   "Win32_Globalization",
 ]
 
-[dev-dependencies]
-test-utils = { path = "../crates/test-utils" }
-tokio = { version = "1.45", features = ["time"] }
-proptest = "1.7"

jetsocat/Cargo.toml

@@ -4,9 +4,6 @@ use humantime as _;
 use seahorse as _;
 use tracing_appender as _;
 use tracing_subscriber as _;
-// Used by tests
-#[cfg(test)]
-use {proptest as _, test_utils as _};
 
 #[macro_use]
 extern crate tracing;

jetsocat/src/lib.rs

@@ -22,9 +22,6 @@ use tokio_tungstenite as _;
 use transport as _;
 #[cfg(windows)]
 use windows as _;
-// Used by tests
-#[cfg(test)]
-use {proptest as _, test_utils as _};
 #[cfg(feature = "rustls")]
 use {rustls as _, rustls_native_certs as _};
 

jetsocat/src/main.rs

@@ -31,6 +31,7 @@ tokio-tungstenite = { version = "0.26", features = ["rustls-tls-native-roots"] }
 
 [dev-dependencies]
 base64 = "0.22"
+proxy-socks = { path = "../crates/proxy-socks" }
 libsql = { version = "0.9", default-features = false, features = ["core"] }
 mcp-proxy.path = "../crates/mcp-proxy"
 rstest = "0.25"

jetsocat/tests/socks5-to-jmux.rs

@@ -93,3 +93,48 @@ pub async fn wait_for_tcp_port(port: u16) -> anyhow::Result<()> {
         }
     }
 }
+
+/// Waits until a TCP port on localhost is bound by another process, without connecting to it.
+///
+/// Use this instead of [`wait_for_tcp_port`] when the target listener accepts only a single
+/// connection (e.g. `tcp-listen://` or `ws-listen://` in jetsocat). Connecting to such a
+/// listener would consume its one accept slot. Instead, this function attempts to bind the same
+/// port itself; `AddrInUse` means the target process has already claimed it.
+///
+/// Polls every 50ms until the port is seen as bound or 10 seconds elapse.
+///
+/// # Errors
+/// Returns an error if the port is not bound within the timeout.
+pub async fn wait_for_port_bound(port: u16) -> anyhow::Result<()> {
+    use std::io::ErrorKind;
+    use std::net::{Ipv4Addr, SocketAddr};
+    use std::time::{Duration, Instant};
+
+    let timeout = Duration::from_secs(10);
+    let poll_interval = Duration::from_millis(50);
+    let addr = SocketAddr::from((Ipv4Addr::LOCALHOST, port));
+    let start = Instant::now();
+
+    loop {
+        if start.elapsed() > timeout {
+            anyhow::bail!("port {port} was not bound within {timeout:?}");
+        }
+
+        match tokio::net::TcpListener::bind(addr).await {
+            // We managed to bind it ourselves — the target hasn't claimed it yet.
+            // Explicitly drop before awaiting: in async/await state machines, temporaries in
+            // match arms can be kept alive across the await point, which would leave the port
+            // bound while we sleep and prevent the target from claiming it.
+            Ok(listener) => {
+                drop(listener);
+                tokio::time::sleep(poll_interval).await;
+            }
+            // Someone else owns the port — the target process is ready.
+            // On Linux this is AddrInUse; on Windows with SO_EXCLUSIVEADDRUSE it is
+            // PermissionDenied (WSAEACCES).
+            Err(e) if matches!(e.kind(), ErrorKind::AddrInUse | ErrorKind::PermissionDenied) => return Ok(()),
+            // Any other error is unexpected; surface it.
+            Err(e) => return Err(e.into()),
+        }
+    }
+}