From 4bb8f761584d52e59c0996261efeb6f6bee5eeda Mon Sep 17 00:00:00 2001
From: phatloi0010 <phatloi0010@gmail.com>
Date: Mon, 2 Nov 2026 23:11:25 +0700
Subject: [PATCH] Walkthrough preflight rejects timeout_secs values outside
 1..=600 (#390)

The walkthrough check refuses timeout_secs outside 1..=600, as the recorder does. Fixes #288.
---
 crates/engine/src/tools/browser_tools/script_check.rs | 3 +++
 crates/engine/src/tools/browser_tools/tests.rs        | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/crates/engine/src/tools/browser_tools/script_check.rs b/crates/engine/src/tools/browser_tools/script_check.rs
index 8eaf422..76f7271 100644
--- a/crates/engine/src/tools/browser_tools/script_check.rs
+++ b/crates/engine/src/tools/browser_tools/script_check.rs
@@ -243,6 +243,9 @@ impl WalkthroughParams {
         if self.keep_bodies.any() && !self.capture_network {
             return Err(ToolError::invalid("keep_bodies needs capture_network"));
         }
+        if !(1..=600).contains(&self.timeout_secs) {
+            return Err(ToolError::invalid("timeout_secs must be 1..=600"));
+        }
         Ok(())
     }
 }
diff --git a/crates/engine/src/tools/browser_tools/tests.rs b/crates/engine/src/tools/browser_tools/tests.rs
index 69711e5..395354b 100644
--- a/crates/engine/src/tools/browser_tools/tests.rs
+++ b/crates/engine/src/tools/browser_tools/tests.rs
@@ -684,6 +684,8 @@ fn the_checker_agrees_with_what_the_recorder_refuses() {
         json!({"actions": [ok_goto], "capture": {"events": ["no_such_family"]}}),
         json!({"actions": [ok_goto], "keep_bodies": {"request_body": true}, "capture_network": false}),
         json!({"actions": [ok_goto], "storage": {"cookies": [{"url": "ftp://x", "name": "a", "value": "b"}]}}),
+        json!({"actions": [ok_goto], "timeout_secs": 0}),
+        json!({"actions": [ok_goto], "timeout_secs": 601}),
         // Refused at the step, after those before it ran.
         json!({"actions": [{"kind": "goto", "url": "example.com"}]}),
         json!({"actions": [ok_goto, {"kind": "click"}]}),