fix: use --sfdx-url-file for Windows CI auth, add test_session cleanup

Replace stdin-based auth with temp file + --sfdx-url-file for reliable
cross-platform behavior (stdin and flag order fail on Windows). Add
root-level after() hook to remove leftover test_session_* directories.

Made-with: Cursor

Author: deepu-mungamuri94

test/commands/webapp/_cleanup.nut.ts

@@ -0,0 +1,45 @@
+/*
+ * Copyright 2026, Salesforce, Inc.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { readdirSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+
+/**
+ * Root-level cleanup: remove any test_session_* directories left behind.
+ *
+ * TestSession.clean() normally deletes these, but they can persist when:
+ * - rm fails (e.g. Windows file locks from spawned processes)
+ * - Process is killed before after() runs (timeout, SIGKILL)
+ * - TESTKIT_SAVE_ARTIFACTS is set
+ *
+ * This hook runs after all NUTs complete as a fallback.
+ */
+after(() => {
+  const cwd = process.cwd();
+  try {
+    for (const name of readdirSync(cwd)) {
+      if (name.startsWith('test_session_')) {
+        try {
+          rmSync(join(cwd, name), { recursive: true, force: true });
+        } catch {
+          /* ignore per-dir failures */
+        }
+      }
+    }
+  } catch {
+    /* ignore */
+  }
+});

test/commands/webapp/helpers/webappProjectUtils.ts

@@ -15,8 +15,9 @@
  */
 
 import { execSync } from 'node:child_process';
-import { mkdirSync, writeFileSync } from 'node:fs';
+import { mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { tmpdir } from 'node:os';
 import type { TestSession } from '@salesforce/cli-plugins-testkit';
 
 /**
@@ -48,13 +49,19 @@ export function authOrgViaUrl(): string {
     throw new Error('TESTKIT_AUTH_URL environment variable is not set.');
   }
 
-  const output = execSync('sf org login sfdx-url --sfdx-url-stdin --json', {
-    input: authUrl,
-    stdio: ['pipe', 'pipe', 'pipe'],
-  }).toString();
-
-  const result = JSON.parse(output) as { result: { username: string } };
-  return result.result.username;
+  // Use --sfdx-url-file instead of stdin for cross-platform reliability
+  // (stdin can fail on Windows; --sfdx-url-stdin must be last flag)
+  const tmpFile = join(tmpdir(), `testkit-auth-${Date.now()}-${Math.random().toString(36).slice(2)}.txt`);
+  try {
+    writeFileSync(tmpFile, authUrl, 'utf8');
+    const output = execSync(`sf org login sfdx-url --sfdx-url-file "${tmpFile}" --json`, {
+      stdio: 'pipe',
+    }).toString();
+    const result = JSON.parse(output) as { result: { username: string } };
+    return result.result.username;
+  } finally {
+    rmSync(tmpFile, { force: true });
+  }
 }
 
 /**