fix(mcp): extend capability execution timeout

[reachjalil]

Summary

• extend the Den execute_capability outer budget from 45 seconds to 180 seconds
• keep the structured timeout message derived from the configured budget
• assert that the outer budget outlives the 150-second external MCP tool lifecycle

Follow-up to #2750.

Root cause

#2750 extended external MCP tool requests to 120 seconds and their bounded lifecycle to 150 seconds. The engine-to-Den execute_capability wrapper still returned capability_timeout after 45 seconds, so callers could receive a premature failure while the downstream operation was still within its allowed lifecycle.

Impact

Long-running external MCP tools can now use the full downstream lifecycle. The 180-second outer budget leaves a 30-second margin for Den authorization and persistence work around the provider call. Existing provider request/lifecycle bounds, retry guidance, and error envelopes are unchanged.

Validation

• pnpm exec bun test ee/apps/den-api/test/mcp-agent-timeouts.test.ts — passed, 9 tests / 23 expectations
• pnpm exec bun test ee/apps/den-api/test/external-mcp-diagnostics.test.ts -t "allows tool execution to use a longer bounded request timeout" — passed, 1 test / 4 expectations
• pnpm --filter @openwork-ee/den-api build — passed
• git diff --check — passed

Security and trust boundaries

• no authentication, credential storage, tenant scope, SSRF, authorization, or provider network behavior changes
• the downstream call remains capped at 120 seconds with a 150-second lifecycle
• timeout results remain structured and continue to discourage unnecessary reconnect/reconfiguration advice

Verification gaps

• no live third-party provider call was run; this PR is covered by the MCP boundary tests and Den API production build
• no UI changed, so no fraimz, screenshot, or video evidence was produced

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-landing	Ready	Preview, Comment, Open in v0	Jul 14, 2026 8:26pm

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
openwork-diagnostics	Skipped		Jul 14, 2026 8:26pm

[vercel]

@reachjalil is attempting to deploy a commit to the Different AI Team on Vercel.

A member of the Team first needs to authorize it.