Summary

Severity: Medium
Area: Configuration
Affected files: agentkit/api/deps.py:181-185, agentkit/config.py:105-109, docker-compose.yml:74-86
Suggested branch: fix/wire-documented-settings
Suggested PR title: fix(config): wire TOOL_OUTPUT_MAX_CHARS and the documented compose settings

This is finding AUDIT-12 of 18 from a consolidated audit of agentkit/. It is deliberately self-contained so it can be fixed on its own branch with its own PR.

Related findings: Related: AUDIT-18 (compose hardening).

AUDIT-12 — Medium — TOOL_OUTPUT_MAX_CHARS ignored; compose omits documented settings

Files

• agentkit/api/deps.py:181-185
• agentkit/config.py:105-109
• docker-compose.yml:74-86

Current code — agentkit/api/deps.py:181-185

    config = AgentConfig(
        max_steps=settings.MAX_STEPS,
        run_timeout_s=settings.RUN_TIMEOUT_S,
        tool_timeout_s=settings.TOOL_TIMEOUT_S,
    )

Current code — docker-compose.yml:74-86

    environment:
      - DATABASE_URL=${DATABASE_URL:-postgresql+asyncpg://postgres:postgres@postgres:5432/agentkit}
      - REDIS_URL=${REDIS_URL:-redis://redis:6379/0}
      - FILE_TOOL_BASE_DIR=/tmp/agentkit_sandbox
      - RUN_TIMEOUT_S=${RUN_TIMEOUT_S:-60}
      - API_KEYS=${API_KEYS:-}
      - LLM_PROVIDER=${LLM_PROVIDER:-gemini}
      - LLM_MODEL=${LLM_MODEL:-gemini-3.1-flash-lite}
      - GEMINI_API_KEY=${GEMINI_API_KEY:-}
      - OPENAI_API_KEY=${OPENAI_API_KEY:-}

Why this is a bug

• AgentConfig.tool_output_max_chars is never set from Settings.TOOL_OUTPUT_MAX_CHARS → the setting is dead and the limit is always the hard-coded 2000.
• Compose does not pass SEARCH_API_KEY, RATE_LIMIT_PER_MIN, MAX_STEPS, TOOL_TIMEOUT_S, SESSION_TTL_S, TOOL_OUTPUT_MAX_CHARS, LLM_MAX_RETRIES, LLM_RETRY_BASE_DELAY_S, LLM_RETRY_MAX_DELAY_S — all documented in .env.example / docs/SPEC.md. A containerised deployment silently runs with defaults, and web_search is unusable without SEARCH_API_KEY.

Pass cases

• TOOL_OUTPUT_MAX_CHARS from the environment actually reaches AgentConfig.tool_output_max_chars (test: set it to e.g. 50 and assert a longer tool output is truncated to 50).
• Compose passes every setting documented in .env.example / docs/SPEC.md, with ${VAR:-} defaults so the stack still boots.
• A test (or a compose-config assertion) enumerates the documented settings and fails if one is missing from the compose environment block.
• docs/SPEC.md:225 and docs/AGENTKIT_SPEC.md:225 stay in sync with the real setting list.

Definition of done (per AGENTS.md)

• New/updated unit and integration tests covering the pass cases above, all passing (pytest).
• ruff check ., ruff format --check . and mypy agentkit clean.
• Docstrings updated where behaviour changed; docs/PROGRESS.md updated (status, PR link, commit count, notes).
• A new ADR in docs/DECISIONS.md if an architectural decision was made.
• Branch pushed and PR opened (never commit directly to main).

Baseline at the time of writing: pytest is green on main (all tests pass; tests/real/* skipped unless AGENTKIT_REAL_INFRA=1).