feat(runtime): clamp oversized setTimeout/setInterval delays to avoid Node TimeoutOverflowWarning

[yuntaojinghong]

Summary

When plugin (or AI-generated) code calls setTimeout / setInterval with a delay larger than 2^31 - 1 ms (e.g. setInterval(cb, 99999999000), ~1157 days), Node.js emits a TimeoutOverflowWarning and silently clamps the actual delay to 1 ms — the timer then fires almost immediately, causing confusing behavior and tight polling loops.

Observed

This happened while developing the dsh-balance-monitor plugin: an AI-assisted snippet used setInterval(cb, 99999999000). Node clamped it to 1 ms and printed the overflow warning to the terminal.

Current state (verified against the installed @deepseek-ai/dsh)

@deepseek-ai/dsh-code-runtime-worker-thread already guards its own watchdog timer: in the constructor, this.config.maxWallMs = Math.min(this.config.maxWallMs, 60000) (lib/index.js L665), so the runtime's setTimeout(..., this.config.maxWallMs) can never exceed 60 s. That path is safe.

The residual gap: the runtime cannot intercept arbitrary setTimeout / setInterval calls made inside executed plugin code (worker thread). Those go straight to Node's native timers, so an oversized value still triggers TimeoutOverflowWarning + 1 ms clamping.

Suggested fix

1. (Low effort) Where plugin code runs in a worker/child, document that delays > 2^31 - 1 ms are unsupported; or
2. (Best effort) Provide a sandboxed timer shim inside the code runtime that clamps delays to MAX_TIMER_DELAY_MS with a friendly warning instead of Node's raw warning, e.g.:

const safeDelay = Math.min(rawDelay, MAX_TIMER_DELAY_MS);
if (rawDelay > MAX_TIMER_DELAY_MS) {
  console.warn(`[dsh] timer delay ${rawDelay}ms exceeded limit, clamped to ${safeDelay}ms`);
}
setTimeout(cb, safeDelay);

Either way, the platform should be the last line of defense for AI-generated or misconfigured values.

Mitigation on the plugin side

dsh-balance-monitor v1.0.7 now clamps its configurable intervals at the config layer (auto-check ≤ 24 h, force-check ≤ 7 d), so it can never produce oversized delays again.

Environment

• OS: Windows
• Node: v18.x / v22.x
• Module: @deepseek-ai/dsh-code-runtime-worker-thread