[Bug]: MCP Apps that declare more than 32 CSP domains load blank and leave 320px gaps in the thread #36344

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

packages/contracts or packages/shared

Steps to reproduce

1. Connect the Higgsfield MCP server (https://mcp.higgsfield.ai/mcp) to Claude in T3 Code.
2. Ask the agent to call generate_image a few times. A cost preview (get_cost: true) is enough and spends no credits.
3. Collapse the work group and scroll the thread.

Expected behavior

Each Higgsfield call renders its MCP App, sized to the content the app reports.

Actual behavior

Each call leaves a blank 320px frame in the timeline. Three calls left about 1,000px of empty space between "Worked for 29s" and the reply.

The app's ui:// resource declares 42 _meta.ui.csp.resourceDomains. Its own script origin, https://mcp.higgsfield.ai, is entry 42. readDomains in packages/shared/src/mcpApp.ts keeps only the first 32 entries of each list (MAX_DOMAINS = 32), so the CSP injected into the stored app document leaves that origin out of script-src. The browser blocks the app's bundle. The app never sends ui/initialize or ui/notifications/size-changed, and McpAppFrame keeps its 320px default height.

I reproduced this in a harness that frames the stored document with T3's sandbox attributes:

Higgsfield's connectDomains (47 entries) are truncated the same way.

Impact

Major degradation or frequent failure

Version or commit

main @ c83e78f

Environment

macOS, T3 Code Nightly desktop, Claude provider, Higgsfield MCP server

Workaround

None in T3 Code. Affected documents already have the truncated CSP stored, so threads captured before a fix stay blank.