[Package] test_force.js --sdkdependencies flag is broken (double-JSON-encodes CLI arg)

[JohnsonEricAtSalesforce]

Summary

test_force.js's --sdkdependencies value is already a JSON string (passed straight through
from the CLI arg). The code re-JSON.stringify'd it before forwarding to forcereact/forceios,
double-encoding the value and corrupting its quoting. createHelper.js's overrideSdkDependencies()
then silently failed JSON.parse() on the corrupted string and no-op'd — so --sdkdependencies
has been non-functional for every caller of test_force.js, not just this repro.

Fix: pass the already-JSON-string value through as-is instead of re-stringifying it.

Test plan

• Re-ran test_force.js with --sdkdependencies pointed at a fork+branch override during the
  2026-08-22 integration re-test; generated app's package.json correctly reflected the
  override (previously silently ignored)
• Confirmed overrideSdkDependencies() now successfully parses the passed-through value

This response was generated by an AI agent on behalf of @JohnsonEricAtSalesforce.

[JohnsonEricAtSalesforce]

Why wasn't this caught sooner?

Three compounding reasons:

1. No test coverage on this code path. unittests/createHelper.test.js covers overrideSdkDependencies()'s JSON-merge logic, but nothing exercises test_force.js's own arg-building at line 375 — the double-encode bug lives in the harness's CLI-invocation wrapper, not in the (tested) library function it calls.
2. The failure is silent. overrideSdkDependencies() wraps its JSON.parse() in a try/catch that just console.errors and returns on failure — it doesn't fail the build. A run with --sdkdependencies set still generates and builds successfully against whatever sdkDependencies was already checked into the template's package.json (usually dev), so a passing build looked identical whether the override worked or was silently dropped.
3. Most real usage bypasses this path. createHelper.js uses config.sdkdependencies as-is with no re-stringify — only test_force.js's subprocess-invocation wrapper (added in commit 1c8cc571, Oct 2024) needed to re-escape the value for the shell, and that's where the extra JSON.stringify was mistakenly added. Most --sdkdependencies usage per test/README.md's own examples calls forceios/forcedroid directly, not through test_force.js, so it never hit this bug.

This response was generated by an AI agent on behalf of @JohnsonEricAtSalesforce.

[JohnsonEricAtSalesforce]

CI failures are pre-existing, unrelated to this change

The forceios/forcedroid/forcereact-* job failures aren't caused by this diff — they're generating test apps against forcedotcom/dev on Templates/Android/iOS, which currently has two separate, already-tracked breaks:

• Android: logout()/presentOptInDialog param-reorder compile failures (fixes open: Templates#547, #548)
• iOS: no visible @interface ... consumeBrowserAuthenticationSuppressionForSceneId: (fix open: iOS#4141)

forcehybrid-* (which doesn't hit those templates) passes cleanly, confirming it's template/SDK breakage, not this PR.

Path forward: once those 3 PRs merge, CI here should go green with no further changes needed on this branch.

This response was generated by an AI agent on behalf of @JohnsonEricAtSalesforce.