feat(ecmascript): add execution_timeout to AgentOptions

[Foorack]

Allow embedders to set execution timeout for security.

[Copilot]

Pull request overview

Adds an embedder-configurable execution time limit to the Nova VM by introducing execution_timeout in AgentOptions and enforcing it via a per-execution Instant deadline checked from the bytecode dispatch loop.

Changes:

• Add execution_timeout: Option<Duration> to AgentOptions and track a per-run execution_deadline on Agent.
• Set/clear the deadline around script_evaluation, and enforce it on every bytecode instruction dispatch.
• Add a regression test ensuring an infinite loop is interrupted by the configured timeout; update CLI agent construction to initialize the new option.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
nova_vm/src/engine/bytecode/vm.rs	Enforces an active execution deadline in the bytecode instruction dispatch loop by throwing a JS Error on timeout.
nova_vm/src/ecmascript/scripts_and_modules/script.rs	Establishes and clears a per-execution deadline around script_evaluation; adds a timeout regression test.
nova_vm/src/ecmascript/execution/agent.rs	Extends AgentOptions with execution_timeout and adds execution_deadline storage on Agent.
nova_cli/src/lib/lib.rs	Initializes execution_timeout when constructing the CLI agent.
nova_cli/src/lib/globals.rs	Initializes execution_timeout for child agents created by CLI internals.

Comments suppressed due to low confidence (1)

nova_vm/src/ecmascript/execution/agent.rs:74

• AgentOptions is a public, non-#[non_exhaustive] struct, so adding execution_timeout is a SemVer-breaking change for downstream users constructing it with struct literals. If 1.x compatibility is a goal, consider #[non_exhaustive] and/or a constructor/builder, and ensure the release/versioning strategy accounts for this break.

    /// Wall-clock time limit for a single script execution. When set, any
    /// script that runs longer than this duration will be terminated with a
    /// JavaScript `Error`.
    pub execution_timeout: Option<std::time::Duration>,
}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.