🤖 Fix SSH exec timeout to include connection establishment

The timeout in SSHRuntime.exec() was not comprehensive - it only killed
the SSH process after the timeout, but didn't configure SSH itself to
respect the timeout during connection establishment.

This meant that if SSH was hanging during DNS lookup, TCP handshake, or
authentication, the command could take much longer than the specified
timeout.

Changes:
- Add ConnectTimeout SSH option set to the configured timeout value
- Add ServerAliveInterval=5 and ServerAliveCountMax=2 to detect dead
  connections quickly (10 second detection window)
- These SSH options ensure the timeout is respected from the moment the
  ssh command starts, not just after connection is established
- Add integration test for timeout behavior

The fix ensures:
1. Connection establishment can't hang indefinitely
2. Established connections that die are detected quickly
3. The overall timeout is respected comprehensively

Author: ammar-agent

src/runtime/SSHRuntime.ts

@@ -121,6 +121,22 @@ export class SSHRuntime implements Runtime {
     sshArgs.push("-o", `ControlPath=${this.controlPath}`);
     sshArgs.push("-o", "ControlPersist=60");
 
+    // Set comprehensive timeout options to ensure SSH respects the timeout
+    // ConnectTimeout: Maximum time to wait for connection establishment (DNS, TCP handshake, SSH auth)
+    // ServerAliveInterval: Send keepalive every 5 seconds to detect dead connections
+    // ServerAliveCountMax: Consider connection dead after 2 missed keepalives (10 seconds total)
+    // Together these ensure that:
+    // 1. Connection establishment can't hang indefinitely
+    // 2. Established connections that die are detected quickly
+    // 3. The overall timeout is respected from the moment ssh command starts
+    if (options.timeout !== undefined) {
+      // Use the configured timeout for connection establishment
+      sshArgs.push("-o", `ConnectTimeout=${Math.ceil(options.timeout)}`);
+      // Set aggressive keepalives to detect dead connections
+      sshArgs.push("-o", "ServerAliveInterval=5");
+      sshArgs.push("-o", "ServerAliveCountMax=2");
+    }
+
     sshArgs.push(this.config.host, remoteCommand);
 
     // Debug: log the actual SSH command being executed

tests/runtime/runtime.test.ts

@@ -142,6 +142,25 @@ describeIntegration("Runtime integration tests", () => {
 
           expect(result.stdout.trim()).toContain(workspace.path);
         });
+        test.concurrent("handles timeout correctly", async () => {
+          const runtime = createRuntime();
+          await using workspace = await TestWorkspace.create(runtime, type);
+
+          // Command that sleeps longer than timeout
+          const startTime = performance.now();
+          const result = await execBuffered(runtime, "sleep 10", {
+            cwd: workspace.path,
+            timeout: 1, // 1 second timeout
+          });
+          const duration = performance.now() - startTime;
+
+          // Exit code should be EXIT_CODE_TIMEOUT (-998)
+          expect(result.exitCode).toBe(-998);
+          // Should complete in around 1 second, not 10 seconds
+          // Allow some margin for overhead (especially on SSH)
+          expect(duration).toBeLessThan(3000); // 3 seconds max
+          expect(duration).toBeGreaterThan(500); // At least 0.5 seconds
+        });
       });
 
       describe("readFile() - File reading", () => {