fix(server): add 30s connection timeout to prevent slow-client thread exhaustion

[iRonin]

Summary

Adds a 30-second read timeout to the HTTP handler by setting timeout = 30 on the Handler class. Python BaseHTTPRequestHandler.setup() calls self.request.settimeout(self.timeout), which causes rfile.read() to raise socket.timeout after the configured duration on idle or slow connections.

Why

The ThreadingHTTPServer spawns one thread per connection. With no timeout:

• A slow-client (Slowloris) attack can exhaust all threads
• Hung connections from crashed clients hold threads open forever
• No upper bound on thread count under sustained abuse

The Fix

One line in server.py:

class Handler(BaseHTTPRequestHandler):
    timeout = 30  # seconds

This is the standard Python stdlib approach — no new dependencies, no architectural change.

Fixes #194

[nesquena-hermes]

Minimal and correct. Handler.timeout = 30 is exactly how the stdlib docs recommend setting a read timeout on BaseHTTPRequestHandler — setup() calls self.request.settimeout(self.timeout) if timeout is set.

What this protects against:

• Slowloris-style slow-header attacks (connection held open, data trickled in)
• Hung TCP connections from crashed clients that never send a FIN
• Unbounded thread accumulation under ThreadingHTTPServer

30 seconds is a reasonable default for a local/LAN tool. It's long enough that no normal browser request will be affected, and short enough to reclaim threads from hung connections within half a minute.

One thing to note:
This timeout applies to the initial read phase (headers + body). It does not limit how long an SSE stream can stay open — that's governed by the streaming write loop, which is correct behavior. Long-running agent streams should not be cut off by this.

The single-file, single-line change is easy to audit. Ready for maintainer review.

[nesquena]

Full Review: PR #198 — 30s connection timeout

Thanks @iRonin! Minimal and correct.

Security Audit

Clean. One line added — timeout = 30 on the Handler class. This is the stdlib-documented approach; BaseHTTPRequestHandler.setup() calls self.request.settimeout(self.timeout).

Code Review

Protects against:

• Slowloris-style slow-header attacks (connection held open indefinitely)
• Hung connections from crashed clients holding threads open
• Unbounded thread growth under sustained abuse

30 seconds is a reasonable balance — long enough for slow legitimate connections, short enough to reclaim resources from stalled ones. SSE streams are unaffected because they actively write data (the timeout is on idle read, not on the connection lifetime).

Test Results

506 passed, 0 failed, 41 skipped. No regressions.

Verdict

Approved. Ready to merge.