fix: honour the web fetch timeout budget end to end (#249)

[ankitranjan7]

Fixes #249.

Root cause

--timeout already set a deadline the retry ladder honoured — the ladder is not where the time went. Instrumenting webFetch against the URL from the issue:

0.9s plain 200            challenge=true
0.9s impit start chrome   remaining=4088ms
2.1s impit done  chrome   200
2.1s impit start firefox  remaining=2932ms
3.2s impit done  firefox  200
3.2s closing proxy
...
67.9s UNCAUGHT This socket has been ended by the other party

Everything finished in 3.2s. The remaining 65s was proxy.close(): it calls server.close(), which stays pending until every connection drains, and impit leaves keep-alive CONNECT tunnels open. The budget was enforced on the requests and then thrown away in the finally. The same dangling sockets surfaced later as an unhandled 'error' event that killed the process instead of producing a usable error.

Fix

• src/fetch/safe-proxy.ts tracks every socket it opens — server connections, the CONNECT client half, and the upstream halves the HTTP server never learns about — and destroys them in close(). server.close() then returns immediately.
• Socket 'error' handlers destroy rather than propagate, so a torn-down peer cannot crash the process.
• src/fetch/client.ts maps an aborted fetch (AbortError / DOM TimeoutError) to the structured TimeoutError, so the budget being hit yields code: TIMEOUT and the TEMPFAIL exit code rather than a leaked DOMException.

Measured

	before	after
web fetch --url https://news.ycombinator.com --timeout 5	68.5s, process crash	3.4s, clean error
host that accepts and never responds, --timeout 3	~68s	3.3s, TimeoutError: web fetch timed out after 3s

Tests

src/fetch/safe-proxy.test.ts opens a CONNECT tunnel to a server that never replies and asserts close() resolves in under a second — it hangs until the test timeout without this change. Plus two client.test.ts cases: the proxy is closed when the ladder throws, and an aborted fetch surfaces as TIMEOUT.

Full suite passes except tests/e2e/plugin-management.test.ts, which fails identically on main.

Noted, not fixed

• Hacker News still runs the impit ladder pointlessly and ends in FETCH_BLOCKED: its CSP header names cdnjs.cloudflare.com and recaptcha, and isChallengeResponse matches its markers against every header value. Separate defect, filed as [Bug]: web fetch challenge detection false-positives on CSP headers (news.ycombinator.com fails with FETCH_BLOCKED) #264. This PR bounds the budget regardless of how many tiers run.
• readBody() on an impit response is not bounded by any signal — impit's timeout covers the request, not the body stream. Marked with a ponytail: comment naming the ceiling rather than building a race for a case not yet observed.

🤖 Generated with Claude Code

[github-actions]

🟢 No documentation gap found — medium confidence

The automated review found no documentation gap in the supplied changes.

This review is advisory and does not block merging.