[danny-avila]

Summary

• validate and carry the Code API command-timeout capability into the selected workspace context
• intersect the upstream ceiling with the administrator limit while preserving the legacy 30-second fallback
• keep omitted foreground Bash calls at 30 seconds and give detached background Bash calls the negotiated execution budget
• apply the same effective ceiling to programmatic Bash execution
• mark detached invocations in host-only configuration so user input cannot forge background semantics

Pairs with LibreChat-AI/code-interpreter#238. The PRs are backward-compatible and independently mergeable; deploying the Code API capability first activates the improved detached default as soon as this PR is deployed.

Verification

• Codegraph blast-radius review selected the status, workspace-capability, command, and detached-handler tests
• npx jest src/code/bridge.spec.ts src/code/capabilities.spec.ts src/code/command.spec.ts src/agents/handlers.background.spec.ts --runInBand --coverage=false (133 passed)
• npx tsc --noEmit in packages/api
• npm run static-checks (all affected checks passed)