fix(command-code): omit max_tokens when client omits it (#5221)

Cherry-picked the corrective part of #5221 only: the executor stops fabricating
`max_tokens` (= per-model registry cap) when the client omits it, which caused
`400 "expected <=200000"` on /alpha/generate for high-cap models. An explicit
oversized client value is clamped to the 200k endpoint ceiling. The PR's registry
maxOutputTokens recaps (open-sse/config/providers/registry/command-code/index.ts)
are intentionally NOT included pending reconciliation; #5221 stays open for that.

tests/unit/command-code-executor.test.ts

@@ -294,40 +294,60 @@ test("Command Code executor surfaces upstream and streamed errors", async () =>
   }, /boom/);
 });
 
-test("Command Code executor caps max_tokens to the registered per-model limit (GLM-5.x)", async () => {
+test("Command Code executor omits max_tokens when the client does not supply one (GLM-5.x)", async () => {
   const calls: FetchCall[] = [];
   globalThis.fetch = async (url, init = {}) => {
     calls.push({ url: String(url), init, body: JSON.parse(String(init.body)) });
     return commandCodeStream([{ type: "text-delta", text: "ok" }, { type: "finish" }]);
   };
 
-  // GLM-5 and GLM-5.1 are registered with maxOutputTokens: 131072.
-  // Without per-model capping, the upstream rejects with
-  // "限制数值范围[1,131072]".
+  // No client max_tokens: we must NOT fabricate one. Omitting the field lets
+  // Command Code's upstream apply the model's own native default.
   await getExecutor("command-code").execute({
     model: "zai-org/GLM-5.1",
     stream: false,
     credentials: { apiKey: "cc_test_key" },
     body: { messages: [{ role: "user", content: "Hi" }] },
   });
-  assert.equal(calls[0].body.params.max_tokens, 131072);
+  assert.ok(!("max_tokens" in calls[0].body.params));
 });
 
-test("Command Code executor caps max_tokens to the registered per-model limit (DeepSeek v4)", async () => {
+test("Command Code executor omits max_tokens for DeepSeek v4 when the client does not supply one", async () => {
   const calls: FetchCall[] = [];
   globalThis.fetch = async (url, init = {}) => {
     calls.push({ url: String(url), init, body: JSON.parse(String(init.body)) });
     return commandCodeStream([{ type: "text-delta", text: "ok" }, { type: "finish" }]);
   };
 
-  // DeepSeek v4 pro is registered with maxOutputTokens: 384000.
+  // Regression: previously the executor invented max_tokens from the registry
+  // (384000), which /alpha/generate rejects with a 400
+  // "Too big: expected number to be <=200000". With no client value we now omit
+  // the field entirely, so the request succeeds and upstream picks the default.
   await getExecutor("command-code").execute({
     model: "deepseek/deepseek-v4-pro",
     stream: false,
     credentials: { apiKey: "cc_test_key" },
     body: { messages: [{ role: "user", content: "Hi" }] },
   });
-  assert.equal(calls[0].body.params.max_tokens, 384000);
+  assert.ok(!("max_tokens" in calls[0].body.params));
+});
+
+test("Command Code executor clamps an oversized client-supplied max_tokens to the endpoint ceiling", async () => {
+  const calls: FetchCall[] = [];
+  globalThis.fetch = async (url, init = {}) => {
+    calls.push({ url: String(url), init, body: JSON.parse(String(init.body)) });
+    return commandCodeStream([{ type: "text-delta", text: "ok" }, { type: "finish" }]);
+  };
+
+  // A client asking for more than the 200000 endpoint ceiling is clamped down
+  // (not 400'd), mirroring the provider-driven clamp in antigravity.ts.
+  await getExecutor("command-code").execute({
+    model: "deepseek/deepseek-v4-pro",
+    stream: false,
+    credentials: { apiKey: "cc_test_key" },
+    body: { messages: [{ role: "user", content: "Hi" }], max_tokens: 500000 },
+  });
+  assert.equal(calls[0].body.params.max_tokens, 200000);
 });
 
 test("Command Code executor honors a smaller client-provided max_tokens under the per-model cap", async () => {