fix: subAgent tool reads env vars not reflected in config.yaml

[avoidwork]

Summary

The subAgent tool reads MADZ_SUBAGENT_TIMEOUT and MADZ_SESSION_ID from process.env, but these values are not reflected in config.yaml. The tool's env var handling is fundamentally incorrect — it reads from process.env for values that should be sourced from config.yaml (e.g., process.subAgent.timeout exists at line 85, but no env var bridge exists). The tool assumes env var overrides without any config.yaml support or documentation.

Environment

• OS: Linux 7.0.2-7-pve
• Node.js: v25.8.1
• madz version: 1.18.1
• LLM provider: Unknown — user to confirm

Reproduction

1. Check config.yaml for subAgent.timeout or subAgent.sessionId configuration paths
2. Observe that the subAgent tool reads MADZ_SUBAGENT_TIMEOUT and MADZ_SESSION_ID directly from process.env
3. Note that no env var bridge exists to sync config.yaml values into process.env
4. The tool has no fallback to config.yaml when env vars are unset

Expected Behavior

The subAgent tool should source its configuration from config.yaml as the canonical configuration source. If env var overrides are desired, there should be an explicit bridge layer that reads config.yaml first, then allows env vars to override — with documentation of the precedence rules.

Actual Behavior

The tool reads MADZ_SUBAGENT_TIMEOUT and MADZ_SESSION_ID directly from process.env with no connection to config.yaml. The config file defines process.subAgent.timeout (line 85) but the tool never reads from it. There is no documentation of env var behavior or precedence.

Additional Context

• process.subAgent.timeout exists in config.yaml at line 85 but is never read by the subAgent tool
• No env var bridge exists to sync config values into process.env
• The tool assumes env var overrides without any config.yaml support
• This creates a configuration drift: the config file and the tool are out of sync

---

Audit Findings

• File: src/tools/subAgent.js:258-274 — The resolveTimeout function implements a three-tier priority chain: per-call parameter > MADZ_SUBAGENT_TIMEOUT env var > config.process.subAgent.timeout from config.yaml. The config fallback does exist at line 268-270.
• File: src/tools/subAgent.js:117 — MADZ_SESSION_ID is not read from env; it is generated via generateSessionId() (line 108) and injected into the child process env at line 117. No env var read exists for this value.
• File: src/tools/subAgent.js:410 — Tool schema description states timeout "Overrides MADZ_SUBAGENT_TIMEOUT env var and config default" — this implies env var is primary, but the code shows per-call > env > config precedence. Documentation is misleading.
• File: config.yaml:84-90 — process.subAgent config block defines timeout, maxConcurrent, sessionMode, defaultStrategy, defaultOnError, and temperature. Only timeout is read by the tool; maxConcurrent, defaultStrategy, and defaultOnError are read directly from config (lines 296-298) but have no env var override path.

Assessment: The user's report contains a partial inaccuracy — the timeout config fallback to config.yaml does exist. The real issues are:

1. MADZ_SESSION_ID is never read from env (it's generated per-call), so the env var reference is dead code or a misunderstanding
2. No env var bridge exists for maxConcurrent, defaultStrategy, or defaultOnError — these are config-only
3. Tool description is misleading about precedence
4. No documentation of the env var override behavior