feat: all module timeouts now configurable from Settings page

- Added katanaTimeout() and xssTimeout() wrapper functions that read
  from DB (timeout_katana/timeout_xss) → env → default fallback.
- Subdomain katana phase: replaced hardcoded 10*60 with katanaTimeout().
- Subdomain xss-detection phase: replaced hardcoded 20*60 with xssTimeout().
- Domain misconfig phase: replaced hardcoded 1800 with GetTimeout().
- API config response now includes timeout_katana and timeout_xss.
- API settings update now persists timeout_katana and timeout_xss to DB.
- Settings page now has Katana Crawler and Dalfox XSS timeout inputs.
- Now all 6 timeouts (zerodays, nuclei, backup, misconfig, katana, xss)
  are fully configurable from the dashboard and survive redeployments.

Author: h0tak88r

internal/api/ui/pages/settings.js

@@ -111,6 +111,16 @@
                 <input id="timeout-misconfig-input" type="number" min="0" class="form-control premium-input" value="${escValue(String(cfg.timeout_misconfig ?? 1800))}" />
                 <span>seconds</span>
               </div>
+              <div class="timeout-field">
+                <label>🕷️ Katana Crawler</label>
+                <input id="timeout-katana-input" type="number" min="0" class="form-control premium-input" value="${escValue(String(cfg.timeout_katana ?? 600))}" />
+                <span>seconds</span>
+              </div>
+              <div class="timeout-field">
+                <label>🐛 Dalfox XSS</label>
+                <input id="timeout-xss-input" type="number" min="0" class="form-control premium-input" value="${escValue(String(cfg.timeout_xss ?? 1200))}" />
+                <span>seconds</span>
+              </div>
             </div>
             <div style="margin-top: 20px; display: flex; align-items: center; gap: 15px;">
               <button class="btn btn-primary" onclick="window.SettingsPage.saveTimeoutSettings()" id="timeout-save-btn">💾 Save All Timeouts</button>
@@ -203,14 +213,18 @@
     const nuInput  = document.getElementById('timeout-nuclei-input');
     const buInput  = document.getElementById('timeout-backup-input');
     const mcInput  = document.getElementById('timeout-misconfig-input');
+    const kaInput  = document.getElementById('timeout-katana-input');
+    const xsInput  = document.getElementById('timeout-xss-input');
     const btn      = document.getElementById('timeout-save-btn');
     const note     = document.getElementById('timeout-save-note');
-    if (!zdInput || !nuInput || !buInput || !mcInput) return;
+    if (!zdInput || !nuInput || !buInput || !mcInput || !kaInput || !xsInput) return;
     const zdVal = parseInt(zdInput.value, 10);
     const nuVal = parseInt(nuInput.value, 10);
     const buVal = parseInt(buInput.value, 10);
     const mcVal = parseInt(mcInput.value, 10);
-    if ([zdVal, nuVal, buVal, mcVal].some(v => isNaN(v) || v < 0)) {
+    const kaVal = parseInt(kaInput.value, 10);
+    const xsVal = parseInt(xsInput.value, 10);
+    if ([zdVal, nuVal, buVal, mcVal, kaVal, xsVal].some(v => isNaN(v) || v < 0)) {
       window.showToast('error', 'Invalid value', 'Timeouts must be 0 or a positive integer.');
       return;
     }
@@ -225,10 +239,12 @@
           timeout_nuclei:   nuVal,
           timeout_backup:   buVal,
           timeout_misconfig: mcVal,
+          timeout_katana:   kaVal,
+          timeout_xss:      xsVal,
         })
       });
       if (!res.ok) throw new Error('Failed to update timeout settings');
-      window.showToast('success', 'Saved!', `Zerodays: ${zdVal}s · Nuclei: ${nuVal}s · Backup: ${buVal}s · Misconfig: ${mcVal}s  (0 = unlimited)`);
+      window.showToast('success', 'Saved!', `Zerodays: ${zdVal}s · Nuclei: ${nuVal}s · Backup: ${buVal}s · Misconfig: ${mcVal}s · Katana: ${kaVal}s · XSS: ${xsVal}s  (0 = unlimited)`);
       if (note) note.textContent = `✅ Saved to DB at ${new Date().toLocaleTimeString()} — persists across redeployments`;
       try { window.state.config = await window.apiFetch('/api/config'); } catch(_) {}
     } catch (e) {

internal/api/ui_api.go

@@ -71,6 +71,8 @@ func apiConfigHandler(c *gin.Context) {
 		"timeout_nuclei":    utils.GetTimeout("nuclei", 1200),
 		"timeout_backup":    utils.GetTimeout("backup", 600),
 		"timeout_misconfig": utils.GetTimeout("misconfig", 1800),
+		"timeout_katana":    utils.GetTimeout("katana", 600),
+		"timeout_xss":       utils.GetTimeout("xss", 1200),
 		// Also include raw env fallbacks for legacy callers.
 		"timeout_zerodays_env": getIntEnvOr("AUTOAR_TIMEOUT_ZERODAYS", 600),
 		"timeout_nuclei_env":   getIntEnvOr("AUTOAR_TIMEOUT_NUCLEI", 1200),
@@ -90,6 +92,8 @@ type UpdateSettingsBody struct {
 	TimeoutNuclei    *int `json:"timeout_nuclei,omitempty"`
 	TimeoutBackup    *int `json:"timeout_backup,omitempty"`
 	TimeoutMisconfig *int `json:"timeout_misconfig,omitempty"`
+	TimeoutKatana    *int `json:"timeout_katana,omitempty"`
+	TimeoutXss       *int `json:"timeout_xss,omitempty"`
 }
 
 func apiUpdateSettingsHandler(c *gin.Context) {
@@ -125,6 +129,8 @@ func apiUpdateSettingsHandler(c *gin.Context) {
 	saveTimeout("nuclei", "AUTOAR_TIMEOUT_NUCLEI", body.TimeoutNuclei)
 	saveTimeout("backup", "AUTOAR_TIMEOUT_BACKUP", body.TimeoutBackup)
 	saveTimeout("misconfig", "AUTOAR_TIMEOUT_MISCONFIG", body.TimeoutMisconfig)
+	saveTimeout("katana", "AUTOAR_TIMEOUT_KATANA", body.TimeoutKatana)
+	saveTimeout("xss", "AUTOAR_TIMEOUT_XSS", body.TimeoutXss)
 
 	c.JSON(http.StatusOK, gin.H{"message": "Settings updated successfully", "ok": true})
 }

internal/scanner/domain/domain.go

@@ -169,7 +169,7 @@ func RunDomain(opts ScanOptions) (*Result, error) {
 		{"misconfig", "Cloud misconfiguration scan", func() error {
 			lh := ""; if _, err := os.Stat(liveHostsFile); err == nil { lh = liveHostsFile }
 			return misconfig.Run(misconfig.Options{Target: domain, Action: "scan", Threads: 150, LiveHostsFile: lh})
-		}, 1800},
+		}, utils.GetTimeout("misconfig", 1800)},
 	}
 
 	for _, p := range phases3 {

internal/scanner/subdomain/subdomain.go

@@ -269,7 +269,7 @@ func RunSubdomainWithOptions(subdomain string, opts RunOptions) (*Result, error)
 	// Phase 2.5: Katana (sequential — after URL collection, before deep scanning)
 	// Needs live hosts + initial URL corpus from Phase 2. Results merged into all-urls.txt
 	// so GF, reflection, and other Phase 3 tools see the complete URL set.
-	if err := utils.RunWorkflowPhase("katana", getNextStep(), totalSteps, "[Stage 2.5] Katana crawler", subdomainClean, 10*60, func() error {
+	if err := utils.RunWorkflowPhase("katana", getNextStep(), totalSteps, "[Stage 2.5] Katana crawler", subdomainClean, katanaTimeout(), func() error {
 		return urls.RunKatanaPhase(subdomainClean)
 	}); err != nil {
 		logger.GetLogger().Infof("[WARN] Katana phase failed: %v", err)
@@ -335,7 +335,7 @@ func RunSubdomainWithOptions(subdomain string, opts RunOptions) (*Result, error)
 
 	// Phase 4: Dalfox XSS confirmation (sequential, needs reflection/kxss results from Phase 3)
 	// Reads kxss-results.txt produced by the reflection phase above.
-	if err := utils.RunWorkflowPhase("xss-detection", getNextStep(), totalSteps, "[Stage 4] Dalfox XSS confirmation", subdomainClean, 20*60, func() error {
+	if err := utils.RunWorkflowPhase("xss-detection", getNextStep(), totalSteps, "[Stage 4] Dalfox XSS confirmation", subdomainClean, xssTimeout(), func() error {
 		return reflection.RunDalfoxPhase(subdomainClean)
 	}); err != nil {
 		logger.GetLogger().Infof("[WARN] Dalfox XSS phase failed: %v", err)

internal/scanner/subdomain/timeouts.go

@@ -25,3 +25,17 @@ func backupTimeout() int {
 func nucleiTimeout() int {
 	return utils.GetTimeout("nuclei", 1200)
 }
+
+// katanaTimeout returns the katana crawler phase timeout in seconds.
+// Configured via the dashboard Settings page (timeout_katana),
+// or AUTOAR_TIMEOUT_KATANA env var. Default: 600s (10 min).
+func katanaTimeout() int {
+	return utils.GetTimeout("katana", 600)
+}
+
+// xssTimeout returns the dalfox XSS confirmation phase timeout in seconds.
+// Configured via the dashboard Settings page (timeout_xss),
+// or AUTOAR_TIMEOUT_XSS env var. Default: 1200s (20 min).
+func xssTimeout() int {
+	return utils.GetTimeout("xss", 1200)
+}