fix: guard duplicate rpc mount paths, reap idle connections

[rustatian]

• mount collected plugin handlers in sorted-name order (deterministic across restarts) via a new buildMux() helper, covered by unit tests
• a duplicate mount path now fails Serve() with an error naming both plugins — it means the same service is wired twice (build-time bug); previously http.ServeMux.Handle panicked the whole process and map iteration made the winner nondeterministic
• set IdleTimeout (1m) on the rpc server so idle h2c keep-alive connections get reaped; WriteTimeout is deliberately left unset — handlers may block longer than any fixed limit (e.g. lock waits with a client-chosen wait TTL)
• update dependencies (tests module)

[coderabbitai]

Warning

Review limit reached

@rustatian, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 58 minutes and 7 seconds. Learn how PR review limits work.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 73e96a96-f5b5-488c-8909-050450f5ddce

📥 Commits

Reviewing files that changed from the base of the PR and between 6447363 and 499f82c.

⛔ Files ignored due to path filters (1)

• tests/go.sum is excluded by !**/*.sum

📒 Files selected for processing (4)

• .github/workflows/linux.yml
• plugin.go
• plugin_internal_test.go
• tests/go.mod

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/rpc-server-hardening

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.80%. Comparing base (6447363) to head (499f82c).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #110      +/-   ##
==========================================
+ Coverage   63.94%   70.80%   +6.86%     
==========================================
  Files           3        3              
  Lines         147      161      +14     
==========================================
+ Hits           94      114      +20     
+ Misses         36       32       -4     
+ Partials       17       15       -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR improves RPC server robustness by making plugin RPC handler mounting deterministic and safe in the presence of duplicate mount paths, and by reaping idle keep-alive connections via an IdleTimeout.

Changes:

• Build the RPC http.ServeMux deterministically (sorted plugin names) and skip duplicate/invalid mount paths with warnings instead of panicking.
• Extract mux construction into buildMux() and add a unit test covering duplicate/invalid path skipping behavior.
• Configure the RPC http.Server with IdleTimeout: 1m to reap idle connections; update test-module dependencies.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.

File	Description
plugin.go	Adds deterministic mux construction (buildMux()), duplicate mount-path guarding, and sets IdleTimeout on the HTTP server.
plugin_internal_test.go	Adds a unit test for buildMux() behavior with duplicate/invalid paths.
tests/go.mod	Bumps indirect dependency versions for the tests module.
tests/go.sum	Updates checksums corresponding to the dependency bumps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[rustatian]

Closing: the Connect-RPC server this hardens is being reverted to goridge/net-rpc (see #114).