@vellumai/assistant 0.6.3 → 0.6.5

package/src/__tests__/emit-event-signal.test.ts

@@ -0,0 +1,71 @@
+/**
+ * Behavioral test for the generic CLI→daemon event bridge.
+ *
+ * Callers write a JSON-encoded {@link ServerMessage} to
+ * `<signalsDir>/emit-event`. {@link handleEmitEventSignal} reads that
+ * payload and republishes it through the {@link assistantEventHub} so
+ * SSE subscribers receive it.
+ */
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { afterEach, describe, expect, test } from "bun:test";
+
+import type { ServerMessage } from "../daemon/message-protocol.js";
+import type { AssistantEvent } from "../runtime/assistant-event.js";
+import { assistantEventHub } from "../runtime/assistant-event-hub.js";
+import { DAEMON_INTERNAL_ASSISTANT_ID } from "../runtime/assistant-scope.js";
+import { handleEmitEventSignal } from "../signals/emit-event.js";
+import { getSignalsDir } from "../util/platform.js";
+
+function signalPath(): string {
+  return join(getSignalsDir(), "emit-event");
+}
+
+const subscriptions: Array<{ dispose(): void }> = [];
+
+afterEach(() => {
+  for (const sub of subscriptions.splice(0)) {
+    sub.dispose();
+  }
+  const path = signalPath();
+  if (existsSync(path)) {
+    rmSync(path, { force: true });
+  }
+});
+
+describe("handleEmitEventSignal", () => {
+  test("reads a ServerMessage from the signal file and publishes it to the event hub", async () => {
+    mkdirSync(getSignalsDir(), { recursive: true });
+
+    const payload: ServerMessage = { type: "tasks_changed" };
+
+    writeFileSync(signalPath(), JSON.stringify(payload), "utf-8");
+
+    const received: AssistantEvent[] = [];
+    let resolveDelivered: (() => void) | null = null;
+    const delivered = new Promise<void>((resolve) => {
+      resolveDelivered = resolve;
+    });
+
+    subscriptions.push(
+      assistantEventHub.subscribe(
+        { assistantId: DAEMON_INTERNAL_ASSISTANT_ID },
+        (event) => {
+          received.push(event);
+          resolveDelivered?.();
+        },
+      ),
+    );
+
+    handleEmitEventSignal();
+
+    await delivered;
+
+    expect(received).toHaveLength(1);
+    const event = received[0];
+    expect(event.assistantId).toBe(DAEMON_INTERNAL_ASSISTANT_ID);
+    expect(event.message).toEqual(payload);
+    expect(typeof event.id).toBe("string");
+    expect(typeof event.emittedAt).toBe("string");
+  });
+});

package/src/__tests__/ephemeral-permissions.test.ts

@@ -83,7 +83,7 @@ describe("ephemeral-permissions", () => {
       expect(fileReadRule.createdAt).toBeGreaterThan(0);
 
       // Ephemeral task rules should not auto-allow high-risk tools
-      expect(fileReadRule.allowHighRisk).toBeUndefined();
+      // allowHighRisk is no longer a field on rules
 
       // Check other rules have correct tool names
       expect(rules[1].tool).toBe("bash");
@@ -276,7 +276,7 @@ describe("ephemeral-permissions", () => {
       expect(result.decision).toBe("allow");
     });
 
-    test("high-risk tool still prompts even with ephemeral allow rule (no allowHighRisk)", async () => {
+    test("high-risk tool still prompts even with ephemeral allow rule", async () => {
       const ephemeralRules: TrustRule[] = [
         {
           id: "ephemeral:run-1:bash",
@@ -286,7 +286,7 @@ describe("ephemeral-permissions", () => {
           decision: "allow",
           priority: 50,
           createdAt: Date.now(),
-          // Note: allowHighRisk is NOT set
+          // allowHighRisk is no longer a field
         },
       ];
 
@@ -306,6 +306,96 @@ describe("ephemeral-permissions", () => {
     });
   });
 
+  // ── Canonical shape and scope fallback semantics ──────────────────
+  //
+  // Validates that ephemeral rules follow canonical persisted shapes
+  // and that optional scope behaves correctly as a fallback.
+
+  describe("canonical shape and scope fallback semantics", () => {
+    beforeEach(() => {
+      clearCache();
+    });
+
+    test("ephemeral rule with scope 'everywhere' matches from any working directory", () => {
+      // Use a tool (host_file_read) that has no default allow rule and a
+      // high priority so the ephemeral rule wins over the default ask rule.
+      const ephemeralRules: TrustRule[] = [
+        {
+          id: "ephemeral:run-scope:host_file_read",
+          tool: "host_file_read",
+          pattern: "**",
+          scope: "everywhere",
+          decision: "allow",
+          priority: 2000,
+          createdAt: Date.now(),
+        },
+      ];
+
+      const ctx: PolicyContext = { ephemeralRules };
+
+      // Should match from /tmp
+      const r1 = findHighestPriorityRule(
+        "host_file_read",
+        ["host_file_read:/tmp/foo.txt"],
+        "/tmp",
+        ctx,
+      );
+      expect(r1).not.toBeNull();
+      expect(r1!.id).toBe("ephemeral:run-scope:host_file_read");
+
+      // Should match from /home/user/project
+      const r2 = findHighestPriorityRule(
+        "host_file_read",
+        ["host_file_read:/home/user/project/bar.ts"],
+        "/home/user/project",
+        ctx,
+      );
+      expect(r2).not.toBeNull();
+      expect(r2!.id).toBe("ephemeral:run-scope:host_file_read");
+    });
+
+    test("ephemeral rule does not carry stray metadata fields for non-scoped tools", () => {
+      // buildTaskRules generates canonical ephemeral rules.
+      // For a tool like file_read (scoped family), the generated rule
+      // should have no executionTarget.
+      const rules = buildTaskRules("run-canon", ["file_read", "bash"], "/tmp");
+
+      for (const rule of rules) {
+        expect(rule.scope).toBe("everywhere");
+        expect(rule.executionTarget).toBeUndefined();
+      }
+    });
+
+    test("ephemeral rule with project scope does not match sibling project", () => {
+      const ephemeralRules: TrustRule[] = [
+        {
+          id: "ephemeral:run-proj:file_write",
+          tool: "file_write",
+          pattern: "**",
+          scope: "/home/user/project-a",
+          decision: "allow",
+          priority: 75,
+          createdAt: Date.now(),
+        },
+      ];
+
+      const ctx: PolicyContext = { ephemeralRules };
+
+      // Should NOT match from a sibling directory
+      const result = findHighestPriorityRule(
+        "file_write",
+        ["file_write:/home/user/project-b/file.ts"],
+        "/home/user/project-b",
+        ctx,
+      );
+
+      // The ephemeral rule should not be the match (scope mismatch)
+      if (result) {
+        expect(result.id).not.toBe("ephemeral:run-proj:file_write");
+      }
+    });
+  });
+
   describe("workspace mode interactions", () => {
     beforeEach(() => {
       clearCache();

package/src/__tests__/estimator-calibration-integration.test.ts

@@ -0,0 +1,208 @@
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import {
+  getCalibrationSnapshot,
+  getCorrection,
+  recordEstimate,
+  resetCalibrations,
+} from "../context/estimator-calibration.js";
+import {
+  estimatePromptTokens,
+  getCalibrationProviderKey,
+} from "../context/token-estimator.js";
+import type { Message, Provider } from "../providers/types.js";
+
+/**
+ * Integration-style tests that exercise the full self-calibration loop end
+ * to end:
+ *   1. Estimate is recorded for a `(provider, model)` pair via
+ *      `handleUsage` (the record side still threads the provider-echoed
+ *      model through `recordEstimate`).
+ *   2. A subsequent `estimatePromptTokens` lookup picks up the learned
+ *      correction via the per-provider aggregate key `(provider, "")`.
+ *      Lookup always uses the aggregate — model-specific keys are only
+ *      read as a fallback inside `getCorrection`.
+ *
+ * Since the `modelId` lookup option has been removed from the public
+ * token-estimator API, the lookup side always converges to the aggregate.
+ * `recordEstimate` still updates both the specific `(provider, model)`
+ * key AND the `(provider, "")` aggregate on every sample, so the
+ * aggregate stays accurate even as per-model data accumulates.
+ */
+describe("estimator calibration — end-to-end recording → lookup", () => {
+  beforeEach(() => {
+    resetCalibrations();
+  });
+
+  /**
+   * Build a representative message history with enough content to clear the
+   * MIN_SAMPLE_MAGNITUDE floor (500 tokens). Each message repeats a block of
+   * text large enough to make the heuristic estimator produce a substantial
+   * token count so the calibration machinery actually runs.
+   */
+  function largeHistory(): Message[] {
+    const body = "lorem ipsum dolor sit amet ".repeat(500);
+    return [
+      { role: "user", content: [{ type: "text", text: body }] },
+      { role: "assistant", content: [{ type: "text", text: body }] },
+      { role: "user", content: [{ type: "text", text: body }] },
+    ];
+  }
+
+  test("subsequent estimate picks up the aggregate-key correction", () => {
+    const provider: Provider = {
+      name: "anthropic",
+      async sendMessage() {
+        throw new Error("not used in this test");
+      },
+    };
+    const model = "claude-sonnet-4-5";
+    const history = largeHistory();
+
+    // 1. Raw estimate (what agent/loop.ts computes pre-send).
+    const preSend = estimatePromptTokens(history, "system", {
+      providerName: getCalibrationProviderKey(provider),
+    });
+    expect(preSend).toBeGreaterThan(0);
+
+    // Baseline: no correction recorded yet.
+    expect(getCorrection("anthropic", "")).toBe(1.0);
+
+    // 2. Provider returns ground truth (simulating `handleUsage`, which
+    //    still records under (provider, event.model) and folds into the
+    //    aggregate). Simulate a systematic 30% underestimate.
+    const groundTruth = Math.ceil(preSend * 1.3);
+    recordEstimate(
+      getCalibrationProviderKey(provider),
+      model,
+      preSend,
+      groundTruth,
+    );
+
+    // 3. Lookup under the aggregate key now returns the learned ratio.
+    expect(getCorrection("anthropic", "")).toBeCloseTo(1.3, 3);
+
+    // And the corrected estimate moves toward the ground truth.
+    const corrected = estimatePromptTokens(history, "system", {
+      providerName: getCalibrationProviderKey(provider),
+    });
+    // With correction factor ≈1.3, corrected estimate is within 1 token of
+    // the ground truth (Math.ceil rounding).
+    expect(corrected).toBeGreaterThan(preSend);
+    expect(Math.abs(corrected - groundTruth)).toBeLessThanOrEqual(1);
+  });
+
+  test("record with model writes both the specific and aggregate keys", () => {
+    // Simulate a preflight site that records against (anthropic, sonnet).
+    // `recordEstimate` also folds the sample into the `(anthropic, "")`
+    // aggregate so aggregate-key callers see the correction.
+    const provider: Provider = {
+      name: "anthropic",
+      async sendMessage() {
+        throw new Error("not used");
+      },
+    };
+    const history = largeHistory();
+
+    const preSend = estimatePromptTokens(history, "system", {
+      providerName: getCalibrationProviderKey(provider),
+    });
+    const groundTruth = Math.ceil(preSend * 1.25);
+
+    recordEstimate(
+      getCalibrationProviderKey(provider),
+      "claude-sonnet-4-5",
+      preSend,
+      groundTruth,
+    );
+
+    // A subsequent lookup via the token-estimator uses the per-provider
+    // aggregate (the only key the public API reads).
+    const correctedAggregate = estimatePromptTokens(history, "system", {
+      providerName: getCalibrationProviderKey(provider),
+    });
+    // Aggregate ratio ≈ 1.25 (first sample snaps to exact ratio).
+    expect(correctedAggregate).toBe(Math.ceil(preSend * 1.25));
+  });
+
+  test("wrapper provider (OpenRouter → Anthropic) uses the canonical key on both sides", () => {
+    // This is the Devin scenario: OpenRouter wraps Anthropic. If the record
+    // site used `name` ("openrouter") and the lookup site used
+    // `tokenEstimationProvider` ("anthropic"), the data would be scattered
+    // across mismatched keys and calibration would silently fail.
+    // `getCalibrationProviderKey` gives us one source of truth.
+    const openrouter: Provider = {
+      name: "openrouter",
+      tokenEstimationProvider: "anthropic",
+      async sendMessage() {
+        throw new Error("not used");
+      },
+    };
+    const model = "anthropic/claude-sonnet-4-5";
+    const history = largeHistory();
+
+    // Pre-send estimate via the canonical key.
+    const preSend = estimatePromptTokens(history, "system", {
+      providerName: getCalibrationProviderKey(openrouter),
+    });
+    expect(preSend).toBeGreaterThan(0);
+
+    // Provider returns ground truth. `handleUsage` uses the same helper
+    // to pick the calibration key, so the record and lookup sides agree.
+    const groundTruth = Math.ceil(preSend * 1.2);
+    recordEstimate(
+      getCalibrationProviderKey(openrouter),
+      model,
+      preSend,
+      groundTruth,
+    );
+
+    // Lookup under "anthropic" — the canonical upstream key — returns the
+    // ratio. See note above about precision=3.
+    expect(getCorrection("anthropic", model)).toBeCloseTo(1.2, 3);
+    // Aggregate under the canonical upstream key is also populated.
+    expect(getCorrection("anthropic", "")).toBeCloseTo(1.2, 3);
+    // And under the bare wrapper name stays at the default, because NOTHING
+    // was recorded under "openrouter".
+    expect(getCorrection("openrouter", "")).toBe(1.0);
+
+    // The snapshot reflects a single (provider, model) key + aggregate under
+    // the canonical upstream key — never under the wrapper name.
+    const keys = getCalibrationSnapshot().map(
+      (e) => `${e.provider}::${e.model}`,
+    );
+    expect(keys).toContain(`anthropic::${model}`);
+    expect(keys).toContain("anthropic::");
+    expect(keys).not.toContain(`openrouter::${model}`);
+  });
+
+  test("a run of consistent samples pulls the estimate toward ground truth", () => {
+    // The EWMA should converge quickly. After five consistent 1.3 samples
+    // the correction should be within 1% of 1.3, and the corrected estimate
+    // should be within 1% of the ground truth.
+    const model = "claude-sonnet-4-5";
+    const history = largeHistory();
+
+    const preSend = estimatePromptTokens(history, "system", {
+      providerName: "anthropic",
+    });
+    const groundTruth = Math.ceil(preSend * 1.3);
+
+    for (let i = 0; i < 5; i++) {
+      recordEstimate("anthropic", model, preSend, groundTruth);
+    }
+
+    const finalCorrection = getCorrection("anthropic", "");
+    // EWMA with alpha=0.2 on constant 1.3 stays at 1.3 from the first sample
+    // onward (all deltas are 0 after the initial snap). `precision=3` gives
+    // us ~0.0005 tolerance which covers the Math.ceil rounding noise.
+    expect(finalCorrection).toBeCloseTo(1.3, 3);
+
+    const corrected = estimatePromptTokens(history, "system", {
+      providerName: "anthropic",
+    });
+    // Corrected should be very close to the ground truth (within 1 token
+    // because of the Math.ceil rounding at the end of estimatePromptTokens).
+    expect(Math.abs(corrected - groundTruth)).toBeLessThanOrEqual(1);
+  });
+});

package/src/__tests__/estimator-calibration.test.ts

@@ -0,0 +1,213 @@
+import { beforeEach, describe, expect, test } from "bun:test";
+
+import {
+  getCalibrationSnapshot,
+  getCorrection,
+  recordEstimate,
+  resetCalibrations,
+} from "../context/estimator-calibration.js";
+
+describe("estimator calibration", () => {
+  beforeEach(() => {
+    resetCalibrations();
+  });
+
+  test("default correction is 1.0 for unseen (provider, model)", () => {
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).toBe(1.0);
+    expect(getCorrection("openai", "gpt-5")).toBe(1.0);
+  });
+
+  test("first sample yields the exact ratio", () => {
+    recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 130_000);
+    const ratio = getCorrection("anthropic", "claude-sonnet-4-5");
+    expect(ratio).toBeCloseTo(1.3, 5);
+  });
+
+  test("EWMA converges to the target ratio given consistent samples", () => {
+    // Seed with a ratio far from the target so the first sample is off,
+    // then hammer with consistent 1.3 samples and watch EWMA close the gap.
+    recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 100_000);
+    for (let i = 0; i < 20; i++) {
+      recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 130_000);
+    }
+    const ratio = getCorrection("anthropic", "claude-sonnet-4-5");
+    expect(ratio).toBeGreaterThan(1.25);
+    expect(ratio).toBeLessThan(1.35);
+  });
+
+  test("ten consistent 1.3 samples land within 0.05 of 1.3", () => {
+    for (let i = 0; i < 10; i++) {
+      recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 130_000);
+    }
+    const ratio = getCorrection("anthropic", "claude-sonnet-4-5");
+    expect(Math.abs(ratio - 1.3)).toBeLessThan(0.05);
+  });
+
+  test("values below MIN_SAMPLE_MAGNITUDE are ignored", () => {
+    // Both below the floor
+    recordEstimate("anthropic", "claude-sonnet-4-5", 200, 400);
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).toBe(1.0);
+
+    // Estimated below the floor
+    recordEstimate("anthropic", "claude-sonnet-4-5", 200, 100_000);
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).toBe(1.0);
+
+    // Actual below the floor
+    recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 200);
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).toBe(1.0);
+  });
+
+  test("ratios outside [1/3, 3] are discarded as outliers", () => {
+    // 4x too high
+    recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 400_000);
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).toBe(1.0);
+
+    // 4x too low
+    recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 25_000);
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).toBe(1.0);
+
+    // Just above the 3x edge — still discarded
+    recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 300_001);
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).toBe(1.0);
+
+    // Exactly at the 3x edge — accepted (ratio === 3, not > 3)
+    recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 300_000);
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).toBeCloseTo(3, 5);
+  });
+
+  test("resetCalibrations clears all state", () => {
+    recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 130_000);
+    recordEstimate("openai", "gpt-5", 100_000, 90_000);
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).toBeCloseTo(1.3);
+    expect(getCorrection("openai", "gpt-5")).toBeCloseTo(0.9);
+
+    resetCalibrations();
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).toBe(1.0);
+    expect(getCorrection("openai", "gpt-5")).toBe(1.0);
+    expect(getCalibrationSnapshot()).toHaveLength(0);
+  });
+
+  test("distinct (provider, model) keys are independent", () => {
+    recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 130_000);
+    recordEstimate("anthropic", "claude-opus-4-7", 100_000, 110_000);
+    recordEstimate("openai", "gpt-5", 100_000, 90_000);
+    recordEstimate("openai", "gpt-5", 100_000, 90_000);
+    recordEstimate("openai", "gpt-5", 100_000, 90_000);
+
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).toBeCloseTo(1.3, 5);
+    expect(getCorrection("anthropic", "claude-opus-4-7")).toBeCloseTo(1.1, 5);
+    // openai::gpt-5: after 3 EWMA steps of ratio 0.9, still exactly 0.9
+    // because the first sample snaps to ratio and subsequent deltas are 0.
+    expect(getCorrection("openai", "gpt-5")).toBeCloseTo(0.9, 5);
+
+    // Model separation: ensure a sample to one (provider, model) pair does
+    // not pollute another model under the same provider.
+    expect(getCorrection("anthropic", "claude-opus-4-7")).not.toBe(
+      getCorrection("anthropic", "claude-sonnet-4-5"),
+    );
+  });
+
+  test("snapshot reports current calibrations", () => {
+    recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 130_000);
+    recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 130_000);
+    recordEstimate("openai", "gpt-5", 100_000, 90_000);
+
+    const snap = getCalibrationSnapshot();
+    // Every non-empty-model sample also updates the per-provider aggregate
+    // key (provider, ""). Two providers × {specific model, aggregate} = 4.
+    expect(snap).toHaveLength(4);
+
+    const anthropicEntry = snap.find(
+      (e) => e.provider === "anthropic" && e.model === "claude-sonnet-4-5",
+    );
+    expect(anthropicEntry).toBeDefined();
+    expect(anthropicEntry?.samples).toBe(2);
+    expect(anthropicEntry?.ratio).toBeCloseTo(1.3, 5);
+
+    const openaiEntry = snap.find(
+      (e) => e.provider === "openai" && e.model === "gpt-5",
+    );
+    expect(openaiEntry).toBeDefined();
+    expect(openaiEntry?.samples).toBe(1);
+    expect(openaiEntry?.ratio).toBeCloseTo(0.9, 5);
+
+    // Per-provider aggregates are present and track the specific samples.
+    const anthropicAggregate = snap.find(
+      (e) => e.provider === "anthropic" && e.model === "",
+    );
+    expect(anthropicAggregate?.samples).toBe(2);
+    expect(anthropicAggregate?.ratio).toBeCloseTo(1.3, 5);
+
+    const openaiAggregate = snap.find(
+      (e) => e.provider === "openai" && e.model === "",
+    );
+    expect(openaiAggregate?.samples).toBe(1);
+    expect(openaiAggregate?.ratio).toBeCloseTo(0.9, 5);
+  });
+
+  test("specific-model lookup falls back to the per-provider aggregate when no model-specific samples exist", () => {
+    // Writing only to the aggregate simulates the case where callers without
+    // a resolved modelId have been recording, and then a model-specific
+    // caller asks for its correction.
+    recordEstimate("anthropic", "", 100_000, 130_000);
+    expect(getCorrection("anthropic", "")).toBeCloseTo(1.3, 5);
+    // The specific model has no own samples, but gets the aggregate.
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).toBeCloseTo(1.3, 5);
+    // An unseen provider still defaults to 1.0.
+    expect(getCorrection("gemini", "gemini-2.5-pro")).toBe(1.0);
+  });
+
+  test("specific-model samples take precedence over the aggregate", () => {
+    recordEstimate("anthropic", "", 100_000, 130_000); // aggregate = 1.3
+    recordEstimate("anthropic", "claude-opus-4-7", 100_000, 110_000); // specific = 1.1
+    expect(getCorrection("anthropic", "claude-opus-4-7")).not.toBeCloseTo(
+      1.3,
+      5,
+    );
+    // A different model under the same provider still falls back to the
+    // aggregate (which now reflects both samples via EWMA).
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).not.toBe(1.0);
+  });
+
+  test("recording with a specific model also updates the per-provider aggregate", () => {
+    // The calibration writes `(provider, model)` and every caller of
+    // `estimatePromptTokens` that cannot resolve a model falls back to
+    // `(provider, "")`. Without the aggregate update, those callers would
+    // stay at the 1.0 default forever, defeating the whole mechanism.
+    recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 130_000);
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).toBeCloseTo(1.3, 5);
+    expect(getCorrection("anthropic", "")).toBeCloseTo(1.3, 5);
+    // A different provider is unaffected.
+    expect(getCorrection("openai", "")).toBe(1.0);
+  });
+
+  test("the per-provider aggregate tracks a rolling EWMA across models", () => {
+    // Samples across two models for one provider should each feed the
+    // aggregate EWMA, so a generic lookup reflects recent activity from
+    // any model on that provider.
+    recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 120_000);
+    recordEstimate("anthropic", "claude-opus-4-7", 100_000, 120_000);
+    recordEstimate("anthropic", "claude-sonnet-4-5", 100_000, 120_000);
+    recordEstimate("anthropic", "claude-opus-4-7", 100_000, 120_000);
+
+    // After four consistent 1.2 samples (folded into both the model-specific
+    // and the aggregate keys) the EWMA for each sits very close to 1.2.
+    expect(getCorrection("anthropic", "")).toBeCloseTo(1.2, 1);
+    expect(getCorrection("anthropic", "claude-sonnet-4-5")).toBeCloseTo(1.2, 1);
+    expect(getCorrection("anthropic", "claude-opus-4-7")).toBeCloseTo(1.2, 1);
+  });
+
+  test("explicit empty-model recording does not double-count the aggregate", () => {
+    // When a caller passes an empty model string (degenerate case), the
+    // aggregate update path must not run — otherwise the sample would be
+    // folded into the EWMA twice and the ratio would be wrong.
+    recordEstimate("anthropic", "", 100_000, 120_000);
+    // Exactly one sample applied.
+    const snap = getCalibrationSnapshot().filter(
+      (e) => e.provider === "anthropic" && e.model === "",
+    );
+    expect(snap).toHaveLength(1);
+    expect(snap[0].samples).toBe(1);
+    expect(snap[0].ratio).toBeCloseTo(1.2, 5);
+  });
+});