hermes - 💡(How to fix) Fix [workflow-engine] HIGH: loop and bash nodes leak subprocesses on timeout

Severity: HIGH (correctness/concurrency, resource leak)

Loop and bash nodes leak subprocesses on timeout.

Evidence

• plugins/workflow-engine/engine/nodes/loop.py:29-42 — _run_until_bash wait_for timeout is caught by a bare except and returns False, but the subprocess is never killed → leaked/zombie bash processes accumulate across loop iterations.
• plugins/workflow-engine/engine/nodes/bash.py:64-69 — kills the process on timeout but never await proc.wait(), leaving a zombie.

Impact

Long-running or looping workflows accumulate leaked/zombie processes for the daemon process lifetime — fd and PID exhaustion under sustained use.

Fix

On asyncio.TimeoutError:

proc.kill()
await proc.wait()

in both the loop node and the bash node paths.

Filed from opus-4.8 plugin audit (workflow-engine).