fix: enforce max timeout and improve error message consistency

- Clamp timeout to max 600000ms (10 minutes) as documented
- External routes now report timeout value in error message

Author: waleedlatif1

apps/sim/lib/core/security/input-validation.ts

@@ -1011,7 +1011,7 @@ export async function secureFetchWithPinnedIP(
 
     req.on('timeout', () => {
       req.destroy()
-      reject(new Error('Request timeout'))
+      reject(new Error(`Request timed out after ${requestOptions.timeout}ms`))
     })
 
     if (options.body) {

apps/sim/tools/utils.ts

@@ -123,11 +123,15 @@ export function formatRequestParams(tool: ToolConfig, params: Record<string, any
     }
   }
 
-  // Get timeout from params (if specified)
+  // Get timeout from params (if specified) and validate
+  // Must be a finite positive number, max 600000ms (10 minutes) as documented
+  const MAX_TIMEOUT_MS = 600000
   const rawTimeout = params.timeout
   const timeout = rawTimeout != null ? Number(rawTimeout) : undefined
   const validTimeout =
-    timeout != null && Number.isFinite(timeout) && timeout > 0 ? timeout : undefined
+    timeout != null && Number.isFinite(timeout) && timeout > 0
+      ? Math.min(timeout, MAX_TIMEOUT_MS)
+      : undefined
 
   return { url, method, headers, body, timeout: validTimeout }
 }