Resource limits enforced

Without execution timeouts or storage quotas, a single misbehaving plugin — whether malicious or accidentally written with an infinite loop — can block the Node.js event loop, starve other request handlers, or fill disk. CWE-400 (Uncontrolled Resource Consumption) and ISO 25010 performance-efficiency.resource-utilization both require that resource consumption be bounded. In a multi-tenant plugin environment this is especially severe: one customer's plugin degrades service for all customers, and the host has no mechanism to identify or interrupt the culprit.

Start with handler execution timeouts — they are the highest-impact resource limit and require no additional infrastructure. Race each handler invocation against a setTimeout reject and surface a clear timeout error attributing it to the specific plugin.

async function invokeWithTimeout(
  handler: Function,
  context: HookContext,
  timeoutMs: number = 5000
): Promise<void> {
  const timeout = new Promise<never>((_, reject) =>
    setTimeout(() => reject(new Error(`Handler timed out after ${timeoutMs}ms`)), timeoutMs)
  );
  await Promise.race([handler(context), timeout]);
}