@vellumai/assistant 0.6.3 → 0.6.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vellumai/assistant",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "license": "MIT",
   "type": "module",
   "exports": {
@@ -23,7 +23,7 @@
     "test": "bash scripts/test.sh",
     "test:coverage": "COVERAGE=true bash scripts/test.sh",
     "test:stable": "EXCLUDE_EXPERIMENTAL=true bash scripts/test.sh",
-    "test:bench": "find src/__tests__ -maxdepth 1 -type f -name '*.benchmark.test.ts' -print0 | xargs -0 -P 1 -I {} bun test {}",
+    "test:bench": "find src -type f -name '*.benchmark.test.ts' -print0 | xargs -0 -P 1 -I {} bun test {}",
     "test:filesystem-tools": "bash scripts/test-filesystem-tools.sh",
     "postinstall": "cd .. && (git config core.hooksPath || git config core.hooksPath .githooks 2>/dev/null || true) && ([ -f meta/feature-flags/sync-bundled-copies.ts ] && bun run meta/feature-flags/sync-bundled-copies.ts 2>/dev/null || true)",
     "prepack": "node ../scripts/prepack-bundled-deps.mjs"
@@ -35,17 +35,19 @@
     "@modelcontextprotocol/sdk": "1.27.1",
     "@qdrant/js-client-rest": "1.17.0",
     "@resvg/resvg-js": "2.6.2",
+    "@resvg/resvg-js-darwin-arm64": "2.6.2",
+    "@resvg/resvg-js-darwin-x64": "2.6.2",
     "@sentry/node": "10.43.0",
     "@vellumai/ces-contracts": "file:../packages/ces-contracts",
     "@vellumai/credential-storage": "file:../packages/credential-storage",
     "@vellumai/egress-proxy": "file:../packages/egress-proxy",
-    "agentmail": "0.1.19",
     "archiver": "7.0.1",
     "commander": "13.1.0",
     "croner": "10.0.1",
     "dotenv": "17.3.1",
-    "drizzle-orm": "0.38.4",
+    "drizzle-orm": "0.45.2",
     "jszip": "3.10.1",
+    "marked": "18.0.0",
     "minimatch": "10.2.4",
     "openai": "6.29.0",
     "pino": "9.14.0",
@@ -53,8 +55,8 @@
     "playwright": "1.58.2",
     "postgres": "3.4.8",
     "qrcode": "1.5.4",
-    "react": "19.2.4",
     "rrule": "2.8.1",
+    "tar-stream": "3.1.7",
     "tldts": "7.0.25",
     "tree-sitter-bash": "0.25.1",
     "uuid": "11.1.0",
@@ -71,14 +73,13 @@
     "@vellumai/egress-proxy"
   ],
   "overrides": {
-    "lodash": "^4.18.0",
-    "path-to-regexp": "^8.4.0"
+    "lodash": "4.18.1",
+    "path-to-regexp": "8.4.2"
   },
   "devDependencies": {
     "@types/archiver": "7.0.0",
     "@types/bun": "1.3.10",
     "@types/node": "25.5.0",
-    "@types/react": "19.2.14",
     "@types/uuid": "10.0.0",
     "drizzle-kit": "0.30.6",
     "eslint": "10.0.3",

package/scripts/generate-openapi.ts

@@ -56,6 +56,17 @@ const RouteBodySchemaSchema = z.any().refine(
   { message: "Expected a Zod schema or a plain JSON Schema object" },
 );
 
+const RouteRequestBodyVariantSchema = z.object({
+  contentType: z.string(),
+  /** Zod schema OR plain JSON Schema fragment. */
+  schema: z.any(),
+});
+
+const RouteAdditionalResponseSchema = z.object({
+  description: z.string(),
+  schema: z.any().optional(),
+});
+
 const RouteEntrySchema = z.object({
   method: z.string(),
   /** Endpoint path relative to /v1/ (e.g. "conversations/:id"). */
@@ -70,8 +81,14 @@ const RouteEntrySchema = z.object({
   queryParams: z.array(RouteQueryParamSchema).optional(),
   /** JSON Schema for the request body. */
   requestBody: RouteBodySchemaSchema.optional(),
+  /** Multi-content-type request body variants (overrides `requestBody` when present). */
+  requestBodies: z.array(RouteRequestBodyVariantSchema).optional(),
   /** JSON Schema for the 200 response body. */
   responseBody: RouteBodySchemaSchema.optional(),
+  /** Extra non-200 responses documented in the spec. */
+  additionalResponses: z
+    .record(z.string(), RouteAdditionalResponseSchema)
+    .optional(),
   /** Source module filename, used for auto-deriving tags. */
   sourceModule: z.string().optional(),
 });
@@ -212,7 +229,6 @@ async function collectRoutesFromModules(): Promise<RouteEntry[]> {
  * here if openapi.yaml is also stale. Plan items B2/C2 address this gap.
  */
 const INLINE_ROUTES: RouteEntry[] = [
-  { endpoint: "browser-cdp", method: "POST" },
   { endpoint: "conversations", method: "GET" },
   { endpoint: "conversations/seen", method: "POST" },
   { endpoint: "conversations/unread", method: "POST" },
@@ -299,21 +315,13 @@ interface OpenApiOperation {
   parameters?: OpenApiParameter[];
   requestBody?: {
     required: boolean;
-    content: {
-      "application/json": {
-        schema: JSONSchemaObject;
-      };
-    };
+    content: Record<string, { schema: JSONSchemaObject }>;
   };
   responses: Record<
     string,
     {
       description: string;
-      content?: {
-        "application/json": {
-          schema: JSONSchemaObject;
-        };
-      };
+      content?: Record<string, { schema: JSONSchemaObject }>;
     }
   >;
 }
@@ -447,7 +455,19 @@ function buildSpec(
       operation.parameters = parameters;
     }
 
-    if (entry.requestBody) {
+    // Multi-content-type request bodies take precedence over the single
+    // application/json requestBody. This lets an endpoint advertise a
+    // `oneOf`-style choice between `application/octet-stream`,
+    // `multipart/form-data`, and `application/json` on the same URL.
+    if (entry.requestBodies && entry.requestBodies.length > 0) {
+      const content: Record<string, { schema: JSONSchemaObject }> = {};
+      for (const variant of entry.requestBodies) {
+        content[variant.contentType] = {
+          schema: toJSONSchemaObject(variant.schema),
+        };
+      }
+      operation.requestBody = { required: true, content };
+    } else if (entry.requestBody) {
       operation.requestBody = {
         required: true,
         content: {
@@ -458,6 +478,24 @@ function buildSpec(
       };
     }
 
+    // Extra documented response variants (e.g. 502 fetch_failed).
+    if (entry.additionalResponses) {
+      for (const [status, resp] of Object.entries(entry.additionalResponses)) {
+        operation.responses[status] = {
+          description: resp.description,
+          ...(resp.schema
+            ? {
+                content: {
+                  "application/json": {
+                    schema: toJSONSchemaObject(resp.schema),
+                  },
+                },
+              }
+            : {}),
+        };
+      }
+    }
+
     paths[route.path][methodLower] = operation;
   }
 

package/scripts/test.sh

@@ -18,6 +18,19 @@ set -uo pipefail
 EXCLUDE_EXPERIMENTAL="${EXCLUDE_EXPERIMENTAL:-false}"
 WORKERS="${TEST_WORKERS:-$(sysctl -n hw.logicalcpu 2>/dev/null || nproc 2>/dev/null || echo 8)}"
 COVERAGE="${COVERAGE:-false}"
+
+# Ensure the bundled feature-flag-registry.json exists before running tests.
+# The canonical copy lives at meta/feature-flags/feature-flag-registry.json and
+# is synced into assistant/src/ and gateway/src/ by sync-bundled-copies.ts.
+# CI runs this as a dedicated step; locally, postinstall handles it — but when
+# node_modules is symlinked (e.g. worktrees) postinstall never fires, so the
+# bundled copy can be missing and feature-flag-registry-bundled.test.ts fails.
+# Running the sync here is idempotent and cheap (two file copies).
+repo_root_sync="$(cd .. && pwd)"
+if [[ -f "${repo_root_sync}/meta/feature-flags/sync-bundled-copies.ts" ]]; then
+  (cd "${repo_root_sync}" && bun run meta/feature-flags/sync-bundled-copies.ts >/dev/null 2>&1 || true)
+fi
+unset repo_root_sync
 # Per-test timeout (seconds). Kills bun processes that pass but don't exit due to open handles.
 PER_TEST_TIMEOUT="${PER_TEST_TIMEOUT:-120}"
 # Longest-first scheduling: provide a durations file from a previous run to sort
@@ -30,11 +43,28 @@ EXPERIMENTAL_FILES=(
   "memory-regressions.experimental.test.ts"
 )
 
+# Tests that exist in the tree but are known-broken when run.  They were
+# invisible to the previous `src/__tests__ -maxdepth 1` glob, so drift against
+# the surrounding code went uncaught.  They are excluded unconditionally until
+# triage lands a fix for each.  Each entry should get a follow-up issue before
+# being removed from this list.
+#
+# Entries must be repo-relative paths (e.g.
+# `src/cli/commands/platform/__tests__/connect.test.ts`) — matching by
+# `basename` would silently exclude every copy of ambiguous names like
+# `connect.test.ts` or `status.test.ts`, since those recur under multiple
+# `src/cli/commands/*/__tests__/` directories.
+#
+# To triage an entry: run `bun test <path>` from `assistant/` and fix the
+# underlying code or tests until the file is green, then remove it here.
+KNOWN_BROKEN_FILES=(
+)
+
 # Collect test files, filtering experimental if needed
 test_files=()
 while IFS= read -r test_file; do
+  base_name="$(basename "${test_file}")"
   if [[ "${EXCLUDE_EXPERIMENTAL}" == "true" ]]; then
-    base_name="$(basename "${test_file}")"
     skip=0
     for ef in "${EXPERIMENTAL_FILES[@]}"; do
       if [[ "${base_name}" == "${ef}" ]]; then
@@ -47,15 +77,32 @@ while IFS= read -r test_file; do
     fi
   fi
   # Always exclude benchmark files — run them with `bun run test:bench` instead
-  if [[ "$(basename "${test_file}")" == *.benchmark.test.ts ]]; then
+  if [[ "${base_name}" == *.benchmark.test.ts ]]; then
+    continue
+  fi
+  # Always exclude known-broken files (see comment above the list).
+  # Compare against the full repo-relative path — matching by basename would
+  # silently drop every copy of ambiguous filenames.
+  # The `${arr[@]+...}` guard keeps `set -u` happy when the list is empty
+  # (bash 3.2 on macOS treats `"${empty[@]}"` as unbound).
+  skip_broken=0
+  for bf in ${KNOWN_BROKEN_FILES[@]+"${KNOWN_BROKEN_FILES[@]}"}; do
+    if [[ "${test_file}" == "${bf}" ]]; then
+      skip_broken=1
+      break
+    fi
+  done
+  if [[ ${skip_broken} -eq 1 ]]; then
     continue
   fi
 
   test_files+=("${test_file}")
-done < <(find src/__tests__ -maxdepth 1 -type f -name '*.test.ts' | sort)
+done < <(
+  find src -type f -name '*.test.ts' | sort
+)
 
 if [[ ${#test_files[@]} -eq 0 ]]; then
-  echo "No test files found under src/__tests__"
+  echo "No test files found under src"
   exit 1
 fi
 
@@ -64,32 +111,38 @@ fi
 # piling up at the end and becoming long poles.
 if [[ -n "${TEST_DURATIONS_FILE}" && -f "${TEST_DURATIONS_FILE}" ]]; then
   sorted_files=()
-  # Build lookup: basename -> duration_ms
+  # Build lookup: repo-relative path -> duration_ms.
+  # Keying by basename would collide on ambiguous names (e.g. `connect.test.ts`
+  # exists under several `src/cli/commands/*/__tests__/` directories) and
+  # mis-schedule them, so stick with the full path that `find` produces.
   declare -A dur_map
-  while IFS=$'\t' read -r ms name; do
-    dur_map["${name}"]="${ms}"
+  while IFS=$'\t' read -r ms path; do
+    [[ -z "${path}" ]] && continue
+    dur_map["${path}"]="${ms}"
   done < "${TEST_DURATIONS_FILE}"
 
   # Partition into known (with durations) and unknown
   known=()
   unknown=()
   for f in "${test_files[@]}"; do
-    base="$(basename "${f}")"
-    if [[ -n "${dur_map["${base}"]:-}" ]]; then
-      known+=("${dur_map["${base}"]}"$'\t'"${f}")
+    if [[ -n "${dur_map["${f}"]:-}" ]]; then
+      known+=("${dur_map["${f}"]}"$'\t'"${f}")
     else
       unknown+=("${f}")
     fi
   done
 
-  # Sort known by duration descending
-  while IFS= read -r line; do
-    sorted_files+=("${line#*$'\t'}")
-  done < <(printf '%s\n' "${known[@]}" | sort -t$'\t' -k1 -rn)
+  # Sort known by duration descending. Guard with `${arr[@]+...}` so bash 3.2
+  # under `set -u` doesn't trip when either partition is empty.
+  if [[ ${#known[@]} -gt 0 ]]; then
+    while IFS= read -r line; do
+      sorted_files+=("${line#*$'\t'}")
+    done < <(printf '%s\n' "${known[@]}" | sort -t$'\t' -k1 -rn)
+  fi
 
   # Append unknown files at the end
-  sorted_files+=("${unknown[@]}")
-  test_files=("${sorted_files[@]}")
+  sorted_files+=(${unknown[@]+"${unknown[@]}"})
+  test_files=(${sorted_files[@]+"${sorted_files[@]}"})
   echo "Sorted tests longest-first using ${TEST_DURATIONS_FILE} (${#known[@]} known, ${#unknown[@]} new)"
 fi
 
@@ -154,8 +207,10 @@ printf '%s\n' "${test_files[@]}" | xargs -P "${WORKERS}" -I {} bash -c '
 
   base="$(basename "${test_file}")"
 
-  # Record duration for longest-first scheduling in future runs
-  echo -e "${elapsed}\t${base}" >> "${results_dir}/durations"
+  # Record duration for longest-first scheduling in future runs.
+  # Write the repo-relative path (not the basename) so the lookup in future
+  # runs disambiguates files that share a basename across directories.
+  echo -e "${elapsed}\t${test_file}" >> "${results_dir}/durations"
 
   if [[ -n "${timeout_cmd}" && ( ${exit_code} -eq 124 || ${exit_code} -eq 137 ) ]]; then
     # timeout killed the process — check if all tests actually passed.

package/src/__tests__/agent-image-optimize.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, it } from "bun:test";
+
+import { shouldRescaleImage } from "../agent/image-optimize.js";
+
+describe("shouldRescaleImage", () => {
+  it("rescales when any side exceeds the max dimension, regardless of file size", () => {
+    // Regression: a sparse screenshot can be tiny in bytes but 3000+ px wide,
+    // which Anthropic rejects in many-image requests with a 2000 px cap.
+    expect(shouldRescaleImage({ width: 3000, height: 900 }, 50_000)).toBe(true);
+    expect(shouldRescaleImage({ width: 900, height: 3000 }, 50_000)).toBe(true);
+  });
+
+  it("skips rescale when dimensions are known and within limits", () => {
+    expect(shouldRescaleImage({ width: 1200, height: 800 }, 50_000)).toBe(
+      false,
+    );
+    // Even a large file is fine as long as dimensions are within limits —
+    // Anthropic's constraint is per-side pixels, not bytes.
+    expect(shouldRescaleImage({ width: 1568, height: 1568 }, 5_000_000)).toBe(
+      false,
+    );
+  });
+
+  it("falls back to file size when dimensions are unparseable", () => {
+    expect(shouldRescaleImage(null, 50_000)).toBe(false);
+    expect(shouldRescaleImage(null, 5_000_000)).toBe(true);
+  });
+});

package/src/__tests__/agent-loop-callsite-precedence.test.ts

@@ -0,0 +1,318 @@
+/**
+ * Verifies the field-precedence contract for `AgentLoop.run(..., callSite)`.
+ *
+ * When `callSite` is set, the loop must NOT pre-set the
+ * `max_tokens`/`thinking`/`effort`/`speed` fields from `this.config`
+ * (sourced from `llm.default`) because the downstream
+ * `RetryProvider.normalizeSendMessageOptions` only fills these fields when
+ * they're undefined. If the loop pre-sets them, every per-call-site override
+ * for these knobs is silently ignored.
+ *
+ * Precedence (highest wins):
+ *   1. Per-turn explicit (from `resolveSystemPrompt`'s
+ *      `resolved.maxTokens` / `resolved.model`)
+ *   2. Call-site resolved values (from `resolveCallSiteConfig` via the
+ *      normalizer)
+ *   3. Conversation defaults (`this.config.*`, from `llm.default`)
+ *
+ * The tests pipe the loop's per-call options through `RetryProvider` so we
+ * can observe the final, post-resolution config that downstream provider
+ * clients consume.
+ */
+
+import { beforeEach, describe, expect, mock, test } from "bun:test";
+
+mock.module("../util/logger.js", () => ({
+  getLogger: () =>
+    new Proxy({} as Record<string, unknown>, { get: () => () => {} }),
+}));
+
+let mockLlmConfig: Record<string, unknown> = {};
+
+mock.module("../config/loader.js", () => ({
+  getConfig: () => ({ llm: mockLlmConfig }),
+}));
+
+import type { ResolvedSystemPrompt } from "../agent/loop.js";
+import { AgentLoop } from "../agent/loop.js";
+import { LLMSchema } from "../config/schemas/llm.js";
+import { RetryProvider } from "../providers/retry.js";
+import type {
+  Message,
+  Provider,
+  ProviderResponse,
+  SendMessageOptions,
+  ToolDefinition,
+} from "../providers/types.js";
+
+const userMessage: Message = {
+  role: "user",
+  content: [{ type: "text", text: "hi" }],
+};
+
+function setLlmConfig(raw: unknown): void {
+  mockLlmConfig = LLMSchema.parse(raw) as Record<string, unknown>;
+}
+
+beforeEach(() => {
+  mockLlmConfig = LLMSchema.parse({}) as Record<string, unknown>;
+});
+
+/**
+ * Build a provider that captures the final `config` it receives. Wrap it in
+ * `RetryProvider` so the call-site resolver runs over whatever the agent loop
+ * emits — exactly mirroring production wiring.
+ */
+function makePipeline(providerName: string): {
+  provider: Provider;
+  lastConfig: () => Record<string, unknown> | undefined;
+} {
+  let captured: Record<string, unknown> | undefined;
+  const inner: Provider = {
+    name: providerName,
+    async sendMessage(
+      _messages: Message[],
+      _tools?: ToolDefinition[],
+      _systemPrompt?: string,
+      options?: SendMessageOptions,
+    ): Promise<ProviderResponse> {
+      captured = options?.config as Record<string, unknown> | undefined;
+      return {
+        content: [{ type: "text", text: "ok" }],
+        model: "mock-model",
+        usage: { inputTokens: 1, outputTokens: 1 },
+        stopReason: "end_turn",
+      };
+    },
+  };
+  return {
+    provider: new RetryProvider(inner),
+    lastConfig: () => captured,
+  };
+}
+
+describe("AgentLoop — call-site precedence", () => {
+  test("call-site maxTokens wins over conversation default when callSite is set", async () => {
+    setLlmConfig({
+      default: {
+        provider: "anthropic",
+        model: "claude-default",
+        maxTokens: 64000,
+      },
+      callSites: { mainAgent: { maxTokens: 4096 } },
+    });
+
+    const { provider, lastConfig } = makePipeline("anthropic");
+    const loop = new AgentLoop(provider, "system", { maxTokens: 64000 });
+
+    await loop.run(
+      [userMessage],
+      () => {},
+      undefined,
+      undefined,
+      undefined,
+      "mainAgent",
+    );
+
+    expect(lastConfig()!.max_tokens).toBe(4096);
+  });
+
+  test("call-site effort wins over conversation default when callSite is set", async () => {
+    setLlmConfig({
+      default: {
+        provider: "anthropic",
+        model: "claude-default",
+        effort: "high",
+      },
+      callSites: { mainAgent: { effort: "low" } },
+    });
+
+    const { provider, lastConfig } = makePipeline("anthropic");
+    const loop = new AgentLoop(provider, "system", {
+      maxTokens: 64000,
+      effort: "high",
+    });
+
+    await loop.run(
+      [userMessage],
+      () => {},
+      undefined,
+      undefined,
+      undefined,
+      "mainAgent",
+    );
+
+    expect(lastConfig()!.effort).toBe("low");
+  });
+
+  test("call-site speed wins over conversation default when callSite is set", async () => {
+    setLlmConfig({
+      default: {
+        provider: "anthropic",
+        model: "claude-default",
+        speed: "standard",
+      },
+      callSites: { mainAgent: { speed: "fast" } },
+    });
+
+    const { provider, lastConfig } = makePipeline("anthropic");
+    const loop = new AgentLoop(provider, "system", {
+      maxTokens: 64000,
+      effort: "high",
+      // Conversation default is "fast" (which would normally be applied) —
+      // ensure the call-site value is the one that ends up on the wire.
+      speed: "fast",
+    });
+
+    await loop.run(
+      [userMessage],
+      () => {},
+      undefined,
+      undefined,
+      undefined,
+      "mainAgent",
+    );
+
+    expect(lastConfig()!.speed).toBe("fast");
+  });
+
+  test("call-site thinking wins over conversation default when callSite is set", async () => {
+    setLlmConfig({
+      default: {
+        provider: "anthropic",
+        model: "claude-default",
+        // Default thinking enabled.
+        thinking: { enabled: true, streamThinking: true },
+      },
+      callSites: {
+        // Call site disables thinking — must be honoured even though the
+        // conversation default has it on.
+        mainAgent: { thinking: { enabled: false } },
+      },
+    });
+
+    const { provider, lastConfig } = makePipeline("anthropic");
+    const loop = new AgentLoop(provider, "system", {
+      maxTokens: 64000,
+      // Conversation default also has thinking on — without the fix, this
+      // would pre-set `thinking: { type: "adaptive" }` and mask the
+      // call-site override.
+      thinking: { enabled: true },
+    });
+
+    await loop.run(
+      [userMessage],
+      () => {},
+      undefined,
+      undefined,
+      undefined,
+      "mainAgent",
+    );
+
+    // Call-site override resolves `thinking.enabled: false`, so the
+    // RetryProvider normalizer must omit `thinking` entirely (matching the
+    // legacy non-callSite path which only sets `providerConfig.thinking`
+    // when enabled). Without the fix at agent/loop.ts, the conversation
+    // default's `thinking: { type: "adaptive" }` would be pre-set and mask
+    // the call-site override.
+    expect(lastConfig()!.thinking).toBeUndefined();
+  });
+
+  test("call-site thinking is converted to Anthropic wire-format when enabled", async () => {
+    setLlmConfig({
+      default: {
+        provider: "anthropic",
+        model: "claude-default",
+        thinking: { enabled: true, streamThinking: true },
+      },
+      callSites: { mainAgent: {} },
+    });
+
+    const { provider, lastConfig } = makePipeline("anthropic");
+    const loop = new AgentLoop(provider, "system", { maxTokens: 64000 });
+
+    await loop.run(
+      [userMessage],
+      () => {},
+      undefined,
+      undefined,
+      undefined,
+      "mainAgent",
+    );
+
+    // Must be wire-format `{ type: "adaptive" }` so the Anthropic SDK's
+    // `ThinkingConfigParam` accepts it. The schema-shape `{ enabled,
+    // streamThinking }` would be a runtime API error.
+    expect(lastConfig()!.thinking).toEqual({ type: "adaptive" });
+  });
+
+  test("conversation defaults still apply when callSite is absent", async () => {
+    setLlmConfig({
+      default: {
+        provider: "anthropic",
+        model: "claude-default",
+        // Resolver values that would *normally* be filled — but we don't
+        // pass a callSite, so they must not surface.
+        maxTokens: 999,
+        effort: "low",
+      },
+    });
+
+    const { provider, lastConfig } = makePipeline("anthropic");
+    const loop = new AgentLoop(provider, "system", {
+      maxTokens: 64000,
+      effort: "high",
+      speed: "fast",
+      thinking: { enabled: true },
+    });
+
+    await loop.run([userMessage], () => {}, undefined, undefined, undefined);
+
+    const config = lastConfig()!;
+    expect(config.max_tokens).toBe(64000);
+    expect(config.effort).toBe("high");
+    expect(config.speed).toBe("fast");
+    // No callSite → loop sets the wire-format thinking directly.
+    expect(config.thinking).toEqual({ type: "adaptive" });
+  });
+
+  test("per-turn resolveSystemPrompt.maxTokens wins over both call-site and default", async () => {
+    setLlmConfig({
+      default: {
+        provider: "anthropic",
+        model: "claude-default",
+        maxTokens: 64000,
+      },
+      callSites: { mainAgent: { maxTokens: 4096 } },
+    });
+
+    const { provider, lastConfig } = makePipeline("anthropic");
+    const resolveSystemPrompt = (): ResolvedSystemPrompt => ({
+      systemPrompt: "per-turn system",
+      maxTokens: 8192,
+    });
+
+    const loop = new AgentLoop(
+      provider,
+      "system",
+      { maxTokens: 64000 },
+      [],
+      undefined,
+      undefined,
+      resolveSystemPrompt,
+    );
+
+    await loop.run(
+      [userMessage],
+      () => {},
+      undefined,
+      undefined,
+      undefined,
+      "mainAgent",
+    );
+
+    // Per-turn explicit value beats both the call-site (4096) and the
+    // default (64000).
+    expect(lastConfig()!.max_tokens).toBe(8192);
+  });
+});