Constant DEFAULT_PLUGIN_TOOL_TIMEOUT_SECS 

pub const DEFAULT_PLUGIN_TOOL_TIMEOUT_SECS: u64 = 30; // 30u64

Default wall-clock bound on a single plugin tool invocation — generous for a real script while bounding how long a hanging/misbehaving plugin can stall the agent loop (mirrors crate::mcp::DEFAULT_MCP_TIMEOUT’s rationale for the same “config-borne subprocess” trust class).