@Danigm-dev is attempting to deploy a commit to the Sim Team on Vercel.

A member of the Team first needs to authorize it.

Greptile Summary

This PR removes the hardcoded 300s (5 minute) internal timeout for SSH/tool execution by forwarding the configurable EXECUTION_TIMEOUT_FREE value to the underlying secureFetchWithPinnedIP calls. The implementation replaces the local AbortController pattern with direct timeout forwarding, allowing SSH blocks to run up to 10 minutes when configured.

• Refactored internal route handling in apps/sim/tools/index.ts to use secureFetchWithPinnedIP with configurable timeout
• Added comprehensive test coverage for timeout forwarding behavior with two dedicated test cases
• Updated documentation for both Docker Compose and Helm deployments with clear configuration examples
• Test expectations aligned with current error parser behavior (HTTP status text fallback when response body parsing fails)

Confidence Score: 5/5

• This PR is safe to merge with no identified risks
• The implementation is clean and focused, with comprehensive test coverage verifying both explicit and default timeout forwarding. The refactoring properly handles DNS resolution for internal routes, constructs Response objects correctly for different status codes, and maintains clear error messages. Documentation is thorough for both local and cloud deployments.
• No files require special attention

Important Files Changed

_{Last reviewed commit: a624850}

PR Summary

Medium Risk
Changes internal tool HTTP execution to use SSRF-protected secureFetchWithPinnedIP with DNS/IP resolution and body handling, which could affect all internal /api/* tool calls and timeout/error behavior. Adds new timeout-related tests and deployment docs, but regressions would surface as tool execution failures or altered error messages.

Overview
Removes the hard ~300s internal cutoff for tool calls to internal /api/* routes by forwarding the effective tool timeout (or DEFAULT_EXECUTION_TIMEOUT_MS) into secureFetchWithPinnedIP, including resolving/pinning the internal hostname to an IP.

Adjusts internal-response handling to correctly deal with no-body statuses (e.g. 204) and to parse error bodies more safely via response.clone() (preserving plain-text errors when JSON parsing fails). Adds focused Vitest coverage for internal timeout propagation, plain-text error preservation, and 204 behavior.

Updates self-hosting docs and deployment configs to expose EXECUTION_TIMEOUT_FREE (Docker Compose + Helm) and explains how to align workflow execution timeouts with the internal tool HTTP timeout path for 10-minute SSH runs.

^{Written by Cursor Bugbot for commit c589adf. This will update automatically on new commits. Configure here.}

Fixed in c589adfd0.

The issue was valid: the internal secure-fetch path rebuilt a standard Response, and the error handler then tried response.json() before falling back to response.text(), which could consume the body and lose plain-text error messages.

This is now fixed by probing JSON from response.clone() and preserving the original body for the text fallback.

I also added targeted coverage for:

• internal secure-fetch responses with text/plain error bodies
• internal 204 responses to ensure we do not attempt to read a body

Relevant tests pass locally for the affected paths.