fix(runtime): add subprocess timeout config for claude-code driver

[benhoverter]

Summary

The claude-code driver hardcoded its per-message turn timeout inside ClaudeCodeDriver and exposed no operator-facing knob, so long-running CC subprocess turns (large prompt-caches, deep tool chains) hit the internal default with no escape hatch. This PR adds a complete config surface — env var + config.toml field — honored today only by the claude-code driver, designed so future subprocess drivers can opt in without re-shaping the API.

The work lands as two commits:

1. 79aa34c introduces the public surface: DriverConfig.subprocess_timeout_secs, OPENFANG_SUBPROCESS_TIMEOUT_SECS, and the precedence chain in create_driver(). At this commit, every construction site still passed None, so the config field was wired but unfed by on-disk config.
2. b1c4061 plumbs the field through to config.toml: deserializable on DefaultModelConfig and FallbackProviderConfig, with all relevant kernel.rs / routes.rs construction sites pulling the loaded value through. Validated end-to-end against a live daemon.

Together they fully close the gap: operators can set the timeout statically in config.toml, override transiently via env var, or fall through to the driver default — three sources, highest wins.

Fixes RightNow-AI#1128

Changes

Commit 1 — 79aa34c: public surface

Public surface (crates/openfang-runtime/src/llm_driver.rs, drivers/mod.rs)

• New field: DriverConfig.subprocess_timeout_secs: Option<u64> with a six-paragraph doc comment (semantic + scope + provider in/out list + forward-compat note).
• New env var: OPENFANG_SUBPROCESS_TIMEOUT_SECS.
• Precedence in create_driver(): env var > config field > driver default. Nine-line precedence comment + a NOTE block flagging the scope-vs-implementation gap so the next subprocess-driver contributor knows where to wire in.

Naming rationale (deliberate, documented)

• Field/env name is scope-flavored (subprocess_*), not semantic (message_*), on purpose. It telegraphs that HTTP providers (default / anthropic, openai, bedrock, qwen-code) accept-but-silently-ignore the field today. A semantic name would have invited the same silent-no-op footgun on those providers.
• Driver-internal field in claude_code.rs intentionally kept as message_timeout_secs — it's not on the public boundary and the semantic name accurately describes what the driver stores. Public-boundary = scope-flavored, internals = semantic.

Tests (drivers/mod.rs, four new unit tests covering all precedence branches)

• default_when_unset — no env, no config → driver default
• config_set — config field flows through
• env_overrides_config — env var wins over config (construction-only assertion; trait-object opacity prevents reading the value back from LlmDriver)
• malformed_env_falls_through — unparseable env silently falls through to config, matching the .parse::<u64>().ok() chain in production
• All four tests scrub OPENFANG_SUBPROCESS_TIMEOUT_SECS pre/post to avoid cross-test pollution.

Mechanical pass-throughs (no logic touched)

• 12 × DriverConfig { .. } test fixtures in drivers/mod.rs gain subprocess_timeout_secs: None.
• routes.rs (1), kernel.rs (6), agent_loop.rs (2): same pass-through fills in DriverConfig literals.

Diffstat: 5 files, +135 / -4. The +135 is dominated by the four new tests (~73 lines) and the doc comment (~17 lines); real logic change is the ~13-line precedence block in create_driver().

Commit 2 — b1c4061: config.toml plumbing

Deserializable fields (crates/openfang-types/src/config.rs)

• DefaultModelConfig.subprocess_timeout_secs: Option<u64> with #[serde(default)].
• FallbackProviderConfig.subprocess_timeout_secs: Option<u64> with #[serde(default)].
• Per-provider granularity is deliberate (option A from the design discussion): each configured provider can have its own timeout, so primary can be generous and fallback can be strict. A single global field would have over-collapsed the design space.

Construction-site wiring (replacing subprocess_timeout_secs: None placeholders left behind by commit 1)

• kernel.rs — 6 sites (663, 687, 736, 5031, 5108, 5139).

Sites carried forward as None (kept-as-None, not wired)

• routes.rs — 2 sites: ~7531 (set_provider_key dashboard hot-update path) and 7701 (provider connectivity test endpoint). Both are mechanical subprocess_timeout_secs: None pass-throughs, not config-fed wiring.
• agent_loop.rs — 2 sites (1146, 1330) intentionally left as None: those iterate over the manifest fallback type, not the config-toml type. Wiring them would require widening the manifest path, which is out of scope. (Added in commit 1; carried forward unchanged by commit 2.) Documented inline.

Tests (2 new)

• TOML round-trip — populated subprocess_timeout_secs survives serialize/deserialize.
• Legacy-shape parse — config.toml files without the field still deserialize cleanly (the #[serde(default)] path).

Precedence comment update in drivers/mod.rs::create_driver — now reflects that the config-field path is real, not aspirational.

Mechanical pass-throughs — 8 fixture updates across openfang-api/tests and openfang-kernel/tests add the new field as None to existing config literals.

Diffstat: 12 files, +112 / -7.

Testing

• cargo clippy --workspace --all-targets -- -D warnings passes (Phase 1 of deploy-local.sh)
• cargo test --workspace passes (commit body claims 362 + 933 + 260 lib tests green; precedence tests + TOML round-trip tests included)
• Live integration tested — full deploy-local.sh run (all 7 phases) against the local daemon: build → backup → binary swap → launchctl kickstart → 10s log-tail → post-swap agent_send round-trip through the patched dispatch path. Round-trip clean; daemon stable.
• Live config.toml validation — daemon restarted with subprocess_timeout_secs = 600 under [default_model]; subsequent subprocess turns honor the new ceiling.

Security

• No new unsafe code
• No secrets or API keys in diff
• User input validated at boundaries — env var parsed via .parse::<u64>().ok(), malformed input silently falls through (test coverage for this branch); config field is Option<u64> deserialized from already-trusted TOML.

---

Notes for reviewers

A few decision points worth flagging up front:

1. Naming axis (scope vs. semantic). We deliberately picked scope-flavored for the public boundary — see "Naming rationale" above. If you'd prefer semantic (message_timeout_secs), the rename is mechanical (~12 occurrences across test fixtures + the Debug impl) but reintroduces the silent-no-op footgun on HTTP providers that the current name explicitly avoids.
2. Per-provider vs. global config field. Commit 2 puts the field on DefaultModelConfig and FallbackProviderConfig (option A). The alternative — a single [runtime] or top-level field — is cleaner if you never want different timeouts on primary vs. fallback. Open to flipping if the team prefers; the wiring sites would shrink.
3. Intentionally-None sites. Three categories of construction sites carry subprocess_timeout_secs: None rather than a config-fed value: agent_loop.rs:1146 and 1330 (manifest fallback type — doesn't carry config-toml values; widening the manifest path is out of scope), and routes.rs:~7531 (set_provider_key hot-update) and routes.rs:7701 (provider connectivity test). All flagged inline; reviewers can scan in one place here.
4. Trait-object test limitation. The env_overrides_config test asserts construction succeeds, not that 600 wins over 120 numerically. LlmDriver is a trait object; reading the timeout back would require either a getter on the trait or a downcast. Current judgment: precedence is two lines of pure data flow (.or()), so construction test + code reading is sufficient. Open to adding a trait getter if reviewers prefer.
5. Forward-compat NOTE block. The comment in drivers/mod.rs explicitly flags the scope-vs-implementation gap (config exists on the public surface; only one driver honors it today). This is intentional documentation, not a TODO — the next subprocess-driver contributor should read it before wiring their driver in.
6. No boot log line. There is currently no log line announcing the effective timeout + source at boot. Cheap follow-up (~3 lines in create_driver) if reviewers want explicit observability ("Driver subprocess timeout: 600s [source: config.toml]"); deliberately not added in either commit to keep diffs tight.