Potential fix for code scanning alert no. 10: Resource exhaustion

[noisyloop]

Potential fix for https://github.com/m0rs3c0d3/EverythingOS/security/code-scanning/10

In general, the problem is that a user‑controlled value (node.timeout) is being passed directly to setTimeout as a delay in milliseconds. To fix this in a robust way, we need to validate and constrain any timeout value before it is used: ensure it is a finite integer within a reasonable range (for example between 0 and some maximum like 30_000 or 60_000 milliseconds). If the value is invalid or exceeds the maximum, we should either reject it (throw an error / fail the node), or fall back to a safe default.

The single best fix with minimal functional impact is to enforce bounds in WorkflowEngine.executeWithTimeout, because that is the single choke point where timeouts are applied for all nodes, regardless of how the workflow was created or where timeout came from. We can:

• Normalize timeout to a number (e.g., Number(timeout)),
• Reject non‑finite or negative values,
• Clamp very large values to a configured maximum duration MAX_NODE_TIMEOUT_MS, and
• Use that sanitized value in setTimeout.

If the sanitized timeout ends up as 0 (due to invalid input), we can treat it as "no timeout" and simply call the handler directly to preserve existing behavior where no timeout was intended. This avoids having to modify the API server or the registry logic and keeps all changes localized to WorkflowEngine.ts. No new external dependencies are required; we can rely on built‑in JS/TS functionality.

Concretely, in src/core/workflow/WorkflowEngine.ts, we will modify executeWithTimeout to:

• Compute a safeTimeout from the input timeout:
  • If timeout is not a finite number or is negative, treat it as 0 (no timeout).
  • If it exceeds a chosen maximum (e.g. 60 seconds), clamp it to that maximum.
• If safeTimeout is 0, call handler(node, context) directly.
• Otherwise, use safeTimeout in setTimeout and in the error message instead of the raw timeout.

This directly prevents attackers from creating arbitrarily long timers while maintaining current functionality for sane timeout values.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.