fix(transport): lower IdleConnTimeout 90s to 60s to undercut peer keep-alives (#51)

* fix(transport): lower IdleConnTimeout 90s -> 60s to undercut peer keep-alives

All four http.Transport literals in roundtripper.go declared
IdleConnTimeout: 90 * time.Second. Most servers behind nginx idle-close at
~65-75s (and badssl in particular at ~70s), so the 90s window guaranteed
that any second request after a brief pause checked out a peer-closed
connection from the idle pool. The transport then surfaced bare 'EOF' or
'http: server closed idle connection' to the caller.

Lower to 60s. This matches Go's net/http stdlib default and gives a
5-10s safety margin under typical peer keep-alive windows.

Tests: golang/roundtripper_test.go - source-level invariants pin the 60s
upper bound across all 4 transport sites and assert no IdleConnTimeout: 90
declarations regress.

* ci: re-trigger after rebase on slim-matrix main

Author: Danny-Dasilva

golang/roundtripper.go

@@ -177,7 +177,7 @@ func (rt *roundTripper) getTransport(req *http.Request, addr string) error {
 			MaxIdleConns:          100,
 			MaxConnsPerHost:       100,
 			MaxIdleConnsPerHost:   100, // Go default is 2, which causes 98% of connections to close
-			IdleConnTimeout:       90 * time.Second,
+			IdleConnTimeout:       60 * time.Second,
 			DisableKeepAlives:     false,
 		}
 		return nil
@@ -354,7 +354,7 @@ func (rt *roundTripper) dialTLS(ctx context.Context, network, addr string) (net.
 			MaxIdleConns:         100,
 			MaxConnsPerHost:      100,
 			MaxIdleConnsPerHost:  100, // Go default is 2, which causes 98% of connections to close
-			IdleConnTimeout:      90 * time.Second,
+			IdleConnTimeout:      60 * time.Second,
 			DisableKeepAlives:    false, // Enable keep-alives for connection reuse
 		}
 	}
@@ -456,7 +456,7 @@ func (rt *roundTripper) retryWithTLS13CompatibleCurves(ctx context.Context, netw
 			MaxIdleConns:         100,
 			MaxConnsPerHost:      100,
 			MaxIdleConnsPerHost:  100, // Go default is 2, which causes 98% of connections to close
-			IdleConnTimeout:      90 * time.Second,
+			IdleConnTimeout:      60 * time.Second,
 			DisableKeepAlives:    false, // Enable keep-alives for connection reuse
 		}
 	}
@@ -535,7 +535,7 @@ func (rt *roundTripper) retryWithOriginalTLS12JA3(ctx context.Context, network,
 			MaxIdleConns:         100,
 			MaxConnsPerHost:      100,
 			MaxIdleConnsPerHost:  100, // Go default is 2, which causes 98% of connections to close
-			IdleConnTimeout:      90 * time.Second,
+			IdleConnTimeout:      60 * time.Second,
 			DisableKeepAlives:    false, // Enable keep-alives for connection reuse
 		}
 	}

golang/roundtripper_test.go

@@ -0,0 +1,82 @@
+package main
+
+import (
+	"os"
+	"regexp"
+	"testing"
+
+	http "github.com/Danny-Dasilva/fhttp"
+)
+
+// readRoundTripperSource loads roundtripper.go from disk so tests can pin
+// invariants over the http.Transport literals without standing up a full
+// HTTPS handshake harness.
+func readRoundTripperSource(t *testing.T) string {
+	t.Helper()
+	b, err := os.ReadFile("roundtripper.go")
+	if err != nil {
+		t.Fatalf("failed to read roundtripper.go: %v", err)
+	}
+	return string(b)
+}
+
+// TestIdleConnTimeoutMatchesStdlibDefault asserts that every http.Transport
+// constructed in roundtripper.go uses an IdleConnTimeout no larger than 60s.
+//
+// Background: peer servers fronted by nginx typically idle-close at
+// ~65–75s. With cycletls's previous 90s timeout, requests #2+ would race
+// the peer's keep-alive close, surfacing as bare "EOF" or
+// "http: server closed idle connection". Lowering to ≤60s gives a 5–10s
+// safety margin under the typical peer window and matches Go's net/http
+// stdlib default.
+//
+// We assert by scanning the source: each `&http.Transport{...}` literal
+// must declare `IdleConnTimeout: <=60s`. This is a layered defense — the
+// http.Transport literals are deeply nested inside dialTLS / retry paths
+// that require real network I/O to exercise, so a source-level assertion
+// is the most reliable invariant we can pin without a network harness.
+func TestIdleConnTimeoutMatchesStdlibDefault(t *testing.T) {
+	src := readRoundTripperSource(t)
+
+	// Match `IdleConnTimeout:       <number> * time.Second`
+	re := regexp.MustCompile(`IdleConnTimeout:\s*(\d+)\s*\*\s*time\.Second`)
+	matches := re.FindAllStringSubmatch(src, -1)
+
+	if len(matches) == 0 {
+		t.Fatalf("no IdleConnTimeout declarations found in roundtripper.go")
+	}
+
+	for _, m := range matches {
+		got := m[1]
+		// Allowed values: any integer ≤ 60.
+		switch got {
+		case "60", "30", "15":
+			// fine
+		default:
+			t.Errorf("IdleConnTimeout: %s * time.Second exceeds the 60s safety bound; "+
+				"see test comment for rationale", got)
+		}
+	}
+
+	// And there must be at least 4 transports (HTTP scheme path + HTTPS HTTP1
+	// path + 2 TLS retry paths). If the count drops, the test should fail
+	// loudly because someone may have removed a path without adjusting this
+	// invariant.
+	if len(matches) < 4 {
+		t.Errorf("expected at least 4 IdleConnTimeout declarations (HTTP scheme + HTTP/1 + 2 retry paths); got %d", len(matches))
+	}
+}
+
+// TestNoStaleNinetySecondIdleConnTimeout is a focused regression: the literal
+// "90 * time.Second" must not reappear next to IdleConnTimeout.
+func TestNoStaleNinetySecondIdleConnTimeout(t *testing.T) {
+	src := readRoundTripperSource(t)
+	re := regexp.MustCompile(`IdleConnTimeout:\s*90\s*\*\s*time\.Second`)
+	if re.MatchString(src) {
+		t.Errorf("found IdleConnTimeout: 90 * time.Second — must be lowered to ≤60s to undercut peer keep-alives")
+	}
+}
+
+// (sanity check) the http import is referenced so that gofmt/imports does
+// not strip it if other tests are removed in the future.
+var _ = http.MethodGet