feat: diagnose workspace connector bindings

backend/src/config.ts

@@ -23,9 +23,12 @@ export interface AppConfig {
    * pay the probe; the local dev launcher (run-stack.sh) opts in via THT_DWH_PRECHECK.
    */
   dwhPrecheck: boolean;
+  workspaceDiagnosticTimeoutMs: number;
   workspaceRegistry: WorkspaceRegistryConfig;
 }
 
+export const MAX_WORKSPACE_DIAGNOSTIC_TIMEOUT_MS = 10_000;
+
 function requiredRegistryValue(value: string, label: string): string {
   if (value.length === 0 || value.trim() !== value || value.includes("\0")) {
     throw new Error(`workspace registry ${label} configuration is invalid`);
@@ -77,6 +80,14 @@ function positiveImportLimit(value: string | undefined, fallback: number): numbe
   return limit;
 }
 
+function diagnosticTimeout(value: string | undefined): number {
+  const timeout = Number(value ?? 5_000);
+  if (!Number.isSafeInteger(timeout) || timeout < 1 || timeout > MAX_WORKSPACE_DIAGNOSTIC_TIMEOUT_MS) {
+    throw new Error("workspace diagnostic timeout configuration is invalid");
+  }
+  return timeout;
+}
+
 export function loadConfig(env: Record<string, string | undefined>): AppConfig {
   const authMode = env.AUTH_MODE ?? "none";
   if (!(["none", "mock", "upstream"] as const).includes(authMode as AppConfig["authMode"])) {
@@ -192,6 +203,7 @@ export function loadConfig(env: Record<string, string | undefined>): AppConfig {
     secretFiles,
     modelApiKeyFile,
     dwhPrecheck: env.THT_DWH_PRECHECK === "true" || env.THT_DWH_PRECHECK === "1",
+    workspaceDiagnosticTimeoutMs: diagnosticTimeout(env.THT_WORKSPACE_DIAGNOSTIC_TIMEOUT_MS),
     workspaceRegistry,
   };
 }