From d73c31110b79485d73984e80732c7636ad5a6373 Mon Sep 17 00:00:00 2001
From: Shakker <shakkerdroid@gmail.com>
Date: Wed, 22 Apr 2026 02:37:37 +0100
Subject: [PATCH] fix: harden static provider catalog listing

---
 extensions/vercel-ai-gateway/models.ts       | 4 ++--
 src/commands/models/list.provider-catalog.ts | 4 ++++
 src/plugins/provider-discovery.runtime.ts    | 2 ++
 src/plugins/provider-discovery.ts            | 1 +
 4 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/extensions/vercel-ai-gateway/models.ts b/extensions/vercel-ai-gateway/models.ts
index 7f83adf90e0..cd318227715 100644
--- a/extensions/vercel-ai-gateway/models.ts
+++ b/extensions/vercel-ai-gateway/models.ts
@@ -86,8 +86,8 @@ const STATIC_VERCEL_AI_GATEWAY_MODEL_CATALOG: readonly StaticVercelGatewayModel[
     name: "Kimi K2.6",
     reasoning: true,
     input: ["text", "image"],
-    contextWindow: 262_000,
-    maxTokens: 262_000,
+    contextWindow: 262_144,
+    maxTokens: 262_144,
     cost: {
       input: 0.95,
       output: 4,
diff --git a/src/commands/models/list.provider-catalog.ts b/src/commands/models/list.provider-catalog.ts
index de32365e117..c7881e0faef 100644
--- a/src/commands/models/list.provider-catalog.ts
+++ b/src/commands/models/list.provider-catalog.ts
@@ -50,10 +50,14 @@ export async function loadProviderCatalogModelsForList(params: {
         env,
       })
     : undefined;
+  if (providerFilter && !onlyPluginIds) {
+    return [];
+  }
   const providers = await resolvePluginDiscoveryProviders({
     config: params.cfg,
     env,
     ...(onlyPluginIds ? { onlyPluginIds } : {}),
+    includeUntrustedWorkspacePlugins: false,
   });
   const byOrder = groupPluginDiscoveryProvidersByOrder(providers);
   const rows: Model<Api>[] = [];
diff --git a/src/plugins/provider-discovery.runtime.ts b/src/plugins/provider-discovery.runtime.ts
index 972a2e1ff83..2bd08019226 100644
--- a/src/plugins/provider-discovery.runtime.ts
+++ b/src/plugins/provider-discovery.runtime.ts
@@ -42,6 +42,7 @@ function resolveProviderDiscoveryEntryPlugins(params: {
   workspaceDir?: string;
   env?: NodeJS.ProcessEnv;
   onlyPluginIds?: string[];
+  includeUntrustedWorkspacePlugins?: boolean;
 }): ProviderPlugin[] {
   const pluginIds = resolveDiscoveredProviderPluginIds(params);
   const pluginIdSet = new Set(pluginIds);
@@ -75,6 +76,7 @@ export function resolvePluginDiscoveryProvidersRuntime(params: {
   workspaceDir?: string;
   env?: NodeJS.ProcessEnv;
   onlyPluginIds?: string[];
+  includeUntrustedWorkspacePlugins?: boolean;
 }): ProviderPlugin[] {
   const entryProviders = resolveProviderDiscoveryEntryPlugins(params);
   if (entryProviders.length > 0) {
diff --git a/src/plugins/provider-discovery.ts b/src/plugins/provider-discovery.ts
index e471d6ea210..07f5e594ba7 100644
--- a/src/plugins/provider-discovery.ts
+++ b/src/plugins/provider-discovery.ts
@@ -24,6 +24,7 @@ export async function resolvePluginDiscoveryProviders(params: {
   workspaceDir?: string;
   env?: NodeJS.ProcessEnv;
   onlyPluginIds?: string[];
+  includeUntrustedWorkspacePlugins?: boolean;
 }): Promise<ProviderPlugin[]> {
   return (await loadProviderRuntime())
     .resolvePluginDiscoveryProvidersRuntime(params)