fix(core): keep catalog strings inside the wire limits that decode them

The codec caps a model's display name at 512 characters and its description at
2048. Nothing upstream of it did. A refreshed models.dev row longer than either
built a catalog entry the Host could encode but no client could decode, and
the whole page was rejected — every model gone, not the one long string.

Name the two limits where the catalog is built, truncate there, and have the
codec read them. A producer that cannot exceed the limit is why the decoder
never has to reject a page.

Generated-by: Claude Code

Author: Astro-Han

packages/core/src/model-catalog.ts

@@ -167,6 +167,12 @@ export function buildModelCatalogEntries(input: BuildModelCatalogInput): ModelCa
  * unencodable. Providers that do discover models substitute their fallback
  * list instead of prepending it, so they add nothing here.
  */
+// What a model row may carry on the wire. The producer reads them here and the
+// decoder enforces them: an over-long string caught only on arrival is one the
+// catalog already built.
+export const CONNECTION_MODEL_DISPLAY_NAME_MAX_LENGTH = 512;
+export const CONNECTION_MODEL_DESCRIPTION_MAX_LENGTH = 2_048;
+
 export const MAX_PREPENDED_FALLBACK_MODELS: number = Object.keys(PROVIDER_REGISTRY).reduce(
   (largest, providerType) => {
     if (providerSupportsModelDiscovery(providerType as ProviderType)) return largest;
@@ -461,7 +467,9 @@ function makeEntry(
   return {
     id: normalizedModel.id,
     ...displayNameForModel(input.providerType, normalizedModel),
-    ...(description !== undefined ? { description } : {}),
+    ...(description !== undefined
+      ? { description: withinWireLimit(description, CONNECTION_MODEL_DESCRIPTION_MAX_LENGTH) }
+      : {}),
     canUseAsChatDefault,
     isDefault: overrides.isDefault ?? normalizedModel.id === normalizedDefaultModel,
     supportsVision: capabilities.vision === true,
@@ -494,7 +502,9 @@ function displayNameForModel(
   model: ModelInfo,
 ): { displayName?: string } {
   const displayName = model.displayName?.trim();
-  if (displayName && displayName !== model.id) return { displayName };
+  if (displayName && displayName !== model.id) {
+    return { displayName: withinWireLimit(displayName, CONNECTION_MODEL_DISPLAY_NAME_MAX_LENGTH) };
+  }
   return displayNameForKnownModel(providerType, model.id);
 }
 
@@ -503,7 +513,20 @@ function displayNameForKnownModel(
   id: string,
 ): { displayName?: string } {
   const displayName = lookupModelMetadata(providerType, id).displayName;
-  return displayName ? { displayName } : {};
+  return displayName
+    ? { displayName: withinWireLimit(displayName, CONNECTION_MODEL_DISPLAY_NAME_MAX_LENGTH) }
+    : {};
+}
+
+/**
+ * Entries are what the connection catalog puts on the wire, and its decoder
+ * refuses an over-long string by failing the whole catalog read. Every text a
+ * model row or metadata table can carry passes through here, so this is where
+ * a source that grew past the bound gets cut rather than where it takes the
+ * catalog down.
+ */
+function withinWireLimit(value: string, maxLength: number): string {
+  return value.length <= maxLength ? value : value.slice(0, maxLength);
 }
 
 /**

packages/core/src/runtime-policy/connection-catalog-codec.ts

@@ -24,7 +24,11 @@ import {
   validateSlug,
   type ProviderType,
 } from '../llm-connections.js';
-import { MAX_PREPENDED_FALLBACK_MODELS } from '../model-catalog.js';
+import {
+  CONNECTION_MODEL_DESCRIPTION_MAX_LENGTH,
+  CONNECTION_MODEL_DISPLAY_NAME_MAX_LENGTH,
+  MAX_PREPENDED_FALLBACK_MODELS,
+} from '../model-catalog.js';
 import {
   DECLARABLE_RELAY_THINKING_LEVELS,
   isThinkingLevel,
@@ -546,10 +550,22 @@ export function decodeConnectionModel(value: unknown): ConnectionModel {
     id: decodeConnectionModelId(item.id),
     ...(item.displayName === undefined
       ? {}
-      : { displayName: stringValue(item.displayName, 'model display name', 512) }),
+      : {
+          displayName: stringValue(
+            item.displayName,
+            'model display name',
+            CONNECTION_MODEL_DISPLAY_NAME_MAX_LENGTH,
+          ),
+        }),
     ...(item.description === undefined
       ? {}
-      : { description: stringValue(item.description, 'model description', 2048) }),
+      : {
+          description: stringValue(
+            item.description,
+            'model description',
+            CONNECTION_MODEL_DESCRIPTION_MAX_LENGTH,
+          ),
+        }),
     ...(item.apiProtocol === undefined ? {} : { apiProtocol: item.apiProtocol }),
     ...(item.contextWindow === undefined
       ? {}