fix(node): force HTTP/1.1 for the sync long-poll (stop GOAWAY flapping)

The node reaches the panel through :443 — Xray (VLESS-Vision) with the panel
behind its fallback. The sync is a 30-60s HELD request; over HTTP/2 that path
recycles the connection with a GOAWAY before the hold completes, so nearly every
poll ended in "unexpected EOF" (~50/hour). Each was treated as a failure, pinning
the agent at the 60s backoff ceiling (slow-polling, not long-polling), and every
check-in that slipped past the 2-minute window flapped a "node not responding"
alert. Forcing HTTP/1.1 on the sync client (empty TLSNextProto + no ForceAttempt
HTTP2) carries the held request through the fallback intact. Node-side only;
the master's :443 offers both h2 and h1.

Author: AppsGanin

internal/nodeagent/agent.go

@@ -350,16 +350,33 @@ func geoStale(dir string, maxAge time.Duration) bool {
 	return false
 }
 
+// syncTransport builds the transport for the node's long-poll. It forces HTTP/1.1.
+//
+// The sync is a 30-60s HELD request, reached through the panel's :443 — which is Xray
+// (VLESS-Vision), with the panel served behind its fallback. Over HTTP/2 that path
+// recycles the connection with a GOAWAY before the hold completes, so every poll ends
+// in "unexpected EOF": the node then treats each as a failure, backs off to the 60s
+// ceiling (slow-polling instead of long-polling), and every missed check-in past the
+// 2-minute window flaps a "node not responding" alert. A plain HTTP/1.1 held request
+// carries through the fallback intact. A non-nil (empty) TLSNextProto disables the
+// automatic h2 upgrade; ForceAttemptHTTP2=false keeps it off.
+func syncTransport(insecure bool) *http.Transport {
+	tr := http.DefaultTransport.(*http.Transport).Clone()
+	tr.ForceAttemptHTTP2 = false
+	tr.TLSNextProto = map[string]func(string, *tls.Conn) http.RoundTripper{}
+	if insecure {
+		tr.TLSClientConfig = &tls.Config{InsecureSkipVerify: true} //nolint:gosec // opt-in via --insecure
+	}
+	return tr
+}
+
 func newAgent(dataDir string, ident *Identity) (*Agent, error) {
 	if err := os.MkdirAll(dataDir, 0o700); err != nil {
 		return nil, err
 	}
 	bin := resolveNodeXrayBin(filepath.Join(dataDir, "bin"))
 	sup := xray.NewSupervisor(bin, filepath.Join(dataDir, "xray", "config.json"), filepath.Join(dataDir, "geo"))
-	client := &http.Client{Timeout: syncTimeout}
-	if ident.Insecure {
-		client.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} //nolint:gosec // opt-in via --insecure
-	}
+	client := &http.Client{Timeout: syncTimeout, Transport: syncTransport(ident.Insecure)}
 	operaDir := filepath.Join(dataDir, "opera")
 	a := &Agent{
 		dataDir:      dataDir,

internal/nodeagent/agent_synctransport_test.go

@@ -0,0 +1,29 @@
+package nodeagent
+
+import "testing"
+
+// The long-poll must not use HTTP/2: over the panel's :443 Xray-fallback an h2 hold
+// gets GOAWAY'd mid-poll. Guard that the transport keeps h2 disabled.
+func TestSyncTransportForcesHTTP1(t *testing.T) {
+	tr := syncTransport(false)
+	if tr.ForceAttemptHTTP2 {
+		t.Error("ForceAttemptHTTP2 is true; the sync long-poll would negotiate h2 and get GOAWAY'd")
+	}
+	if tr.TLSNextProto == nil {
+		t.Error("TLSNextProto is nil; h2 auto-upgrade is not disabled")
+	}
+	if len(tr.TLSNextProto) != 0 {
+		t.Errorf("TLSNextProto has %d entries, want an empty map (no h2)", len(tr.TLSNextProto))
+	}
+	if tr.TLSClientConfig != nil && tr.TLSClientConfig.InsecureSkipVerify {
+		t.Error("secure transport must not skip TLS verification")
+	}
+	// Insecure opt-in still forces h1 and only then skips verification.
+	ins := syncTransport(true)
+	if ins.TLSNextProto == nil || len(ins.TLSNextProto) != 0 {
+		t.Error("insecure transport did not disable h2")
+	}
+	if ins.TLSClientConfig == nil || !ins.TLSClientConfig.InsecureSkipVerify {
+		t.Error("insecure transport should skip verification")
+	}
+}