feat(transport): share TLS client session cache across NetworkPool transports

[superGekFordJ]

Hey there,

The current http.Transport idle pool does a great job reusing connections and reducing overhead, but it looks like we might be missing a shared TLS ClientSessionCache.

Because of this, we aren't truly maximizing the handshake savings during scenarios like pause/resume, user network switching, or when workers are forced to dial a fresh connection (e.g., after CDN disconnects or during dynamic scale-ups).

So, let's introduce a package-level tls.ClientSessionCache (I went with an LRU of 256) and wire it directly into the TLSClientConfig for new transports! By doing this, anytime the engine actually needs to establish a new connection to the same host, we can consistently save a full 1-RTT on the TLS handshake overhead.

I've put together a small patch to enable this. Let's see how much we can smooth out those reconnection bumps! Let me know your thoughts on this approach.

Greptile Summary

This PR enables TLS session resumption across transports created by NetworkPool.

• Adds a process-wide, concurrency-safe LRU client-session cache with 256 entries.
• Assigns each transport a distinct TLS configuration backed by the shared cache.
• Adds tests covering cross-pool-key sharing, preservation across CloseAll, and continued HTTP/2 disablement.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness or security issues identified.

The shared standard-library TLS session cache is safe for concurrent use, remains scoped by TLS server identity, and rejected or stale sessions transparently fall back to a full handshake.

T-Rex Logs

What T-Rex did

• I reviewed the general-contract-validation-proof to identify how the before and after states compare for transports and TLS resume.
• I verified that after the PR the transports are distinct, there is no TCP reuse, and server_tls_did_resume is [false true], confirming the intended post-change behavior.
• I confirmed that CloseAll closed the idle connection without discarding the process-wide TLS session cache.
• I linked and reviewed the uploaded artifacts (the Go source and three log artifacts) to support reviewer inspection of the proof.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
internal/transport/network.go	Adds a package-level TLS client-session cache and wires it into newly created transports without changing certificate validation or TLS-version defaults.
internal/transport/network_test.go	Verifies cache sharing and lifecycle behavior while preserving the transport's existing HTTP/2 configuration.

Sequence Diagram

sequenceDiagram
participant P as NetworkPool
participant T1 as Transport A
participant C as Shared TLS Session Cache
participant T2 as Transport B
P->>T1: Create transport
T1->>C: Store session for host
P->>T2: Create transport for another pool key
T2->>C: Retrieve session for host
T2-->>T2: Attempt resumed TLS handshake

Loading

_{Reviews (1): Last reviewed commit: "feat(transport): share TLS client sessio..." | Re-trigger Greptile}

[github-actions]

Binary Size Analysis

⚠️ Size Increased

Version	Human Readable	Raw Bytes
Main	17.68 MB	18534692
PR	17.68 MB	18542884
Difference	8.00 KB	8192

[SuperCoolPencil]

Thank you so much @superGekFordJ :)
It's so inspiring to see someone put so much care and effort into PRs nowadays.