fix: harden static provider catalog listing

extensions/vercel-ai-gateway/models.ts

@@ -86,8 +86,8 @@ const STATIC_VERCEL_AI_GATEWAY_MODEL_CATALOG: readonly StaticVercelGatewayModel[
     name: "Kimi K2.6",
     reasoning: true,
     input: ["text", "image"],
-    contextWindow: 262_000,
-    maxTokens: 262_000,
+    contextWindow: 262_144,
+    maxTokens: 262_144,
     cost: {
       input: 0.95,
       output: 4,

src/commands/models/list.provider-catalog.ts

@@ -50,10 +50,14 @@ export async function loadProviderCatalogModelsForList(params: {
         env,
       })
     : undefined;
+  if (providerFilter && !onlyPluginIds) {
+    return [];
+  }
   const providers = await resolvePluginDiscoveryProviders({
     config: params.cfg,
     env,
     ...(onlyPluginIds ? { onlyPluginIds } : {}),
+    includeUntrustedWorkspacePlugins: false,
   });
   const byOrder = groupPluginDiscoveryProvidersByOrder(providers);
   const rows: Model<Api>[] = [];

src/plugins/provider-discovery.runtime.ts

@@ -42,6 +42,7 @@ function resolveProviderDiscoveryEntryPlugins(params: {
   workspaceDir?: string;
   env?: NodeJS.ProcessEnv;
   onlyPluginIds?: string[];
+  includeUntrustedWorkspacePlugins?: boolean;
 }): ProviderPlugin[] {
   const pluginIds = resolveDiscoveredProviderPluginIds(params);
   const pluginIdSet = new Set(pluginIds);
@@ -75,6 +76,7 @@ export function resolvePluginDiscoveryProvidersRuntime(params: {
   workspaceDir?: string;
   env?: NodeJS.ProcessEnv;
   onlyPluginIds?: string[];
+  includeUntrustedWorkspacePlugins?: boolean;
 }): ProviderPlugin[] {
   const entryProviders = resolveProviderDiscoveryEntryPlugins(params);
   if (entryProviders.length > 0) {

src/plugins/provider-discovery.ts

@@ -24,6 +24,7 @@ export async function resolvePluginDiscoveryProviders(params: {
   workspaceDir?: string;
   env?: NodeJS.ProcessEnv;
   onlyPluginIds?: string[];
+  includeUntrustedWorkspacePlugins?: boolean;
 }): Promise<ProviderPlugin[]> {
   return (await loadProviderRuntime())
     .resolvePluginDiscoveryProvidersRuntime(params)