fix(audits): catch coercions under fallbacks in tools.config.tool, and clarify declared timeout params

Author: waleedlatif1

.agents/skills/add-tools/SKILL.md

@@ -190,7 +190,7 @@ fallback, or caller-controlled `_context` authority.
 
 A required `'hidden'` param needs an `oauth` declaration or `hosting.apiKeyParam` to supply it (`bun run check:tool-param-reachability`).
 
-A declared `timeout` param goes to the provider as-is; it becomes Sim's millisecond request deadline only when the tool sets `timeoutParamIsDeadline: true` (`http_request`). A `method` param on a tool with a fixed `request.method` would be sent as the HTTP verb, so the same audit rejects it.
+A declared `timeout` param is an ordinary tool input — put it in the request body or URL yourself if the provider expects it; it becomes Sim's millisecond request deadline only when the tool sets `timeoutParamIsDeadline: true` (`http_request`). A `method` param on a tool with a fixed `request.method` would be sent as the HTTP verb, so the same audit rejects it.
 
 ### Parameter Types
 - `'string'` - Text values

apps/sim/scripts/check-block-registry.ts

@@ -256,11 +256,15 @@ const COERCION_CALLEES = new Set([
   'parseInt',
 ])
 
-function isCoercion(expression: ts.Expression): boolean {
-  let inner = expression
-  while (ts.isParenthesizedExpression(inner) || ts.isAsExpression(inner)) inner = inner.expression
-  if (ts.isPrefixUnaryExpression(inner)) return inner.operator === ts.SyntaxKind.PlusToken
-  return ts.isCallExpression(inner) && COERCION_CALLEES.has(inner.expression.getText())
+/** Whether `expression` coerces anywhere in it, including under `??`, `||`, or a conditional. */
+function isCoercion(expression: ts.Node): boolean {
+  if (ts.isPrefixUnaryExpression(expression) && expression.operator === ts.SyntaxKind.PlusToken) {
+    return true
+  }
+  if (ts.isCallExpression(expression) && COERCION_CALLEES.has(expression.expression.getText())) {
+    return true
+  }
+  return ts.forEachChild(expression, (child) => (isCoercion(child) ? true : undefined)) ?? false
 }
 
 function findSelectorCoercions(file: string, source: ts.SourceFile): string[] {