@agent-native/core 0.125.0 → 0.127.1

package/corpus/README.md

@@ -28,6 +28,6 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- core files: 1737
+- core files: 1739
 - toolkit files: 160
-- template files: 6804
+- template files: 6815

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,84 @@
 # @agent-native/core
 
+## 0.127.1
+
+### Patch Changes
+
+- bbd202b: Fix the model picker offering a model the app cannot route, and the chat bridge dropping submitted model overrides.
+  - The picker now defaults only to a configured engine group, and shows nothing when none is configured. `DEFAULT_MODEL` is a builder-gateway id that no group carries unless Builder is connected, so the old `?? DEFAULT_MODEL` / `?? groups[0]` fallbacks produced a selection the server silently replaced with its own default.
+  - A submitted `model`/`engine` pair is now applied regardless of whether the engine list has loaded, travels with cold-start queued sends, keeps the sender's engine, and treats a blank engine as absent. Previously it was honored only when the model already appeared in the (initially empty) engine list, so app-initiated first turns lost it.
+  - `[agent-chat] resolved …` now logs `requestModel` and `turnId`, making a server-side model substitution visible.
+
+## 0.127.0
+
+### Minor Changes
+
+- cbc6936: Make connecting one agent-native app to another a guided flow instead of three
+  blank text fields.
+  - New `GET /_agent-native/agents/probe` reads a peer's agent card and makes one
+    authenticated no-op call, reporting `reachable` and `authorized` as
+    independent fields. A peer that answers but rejects the caller's token is the
+    failure local dev hides — the receiver runs unauthenticated on localhost, so a
+    mismatched secret previously surfaced only after deploy.
+  - Settings → Manage agent → Connected Agents is URL-first: paste a peer URL,
+    press Check, and the name and description come from its card. Unreachable
+    never blocks the save. Rows carry a liveness dot from one batched probe.
+  - The section now shows shared-secret state and a Sync to apps action inline,
+    reusing the existing org hooks. A caller who cannot see the secret is told so
+    rather than being shown "not set".
+  - After an add, the UI states that registration is one-directional and deep
+    links to the peer's own settings with the values prefilled.
+  - The Connected Agents list collapses a remote agent that still has its
+    pre-migration `agents/*.json` row alongside the canonical
+    `remote-agents/*.json` one, instead of listing it twice with the same URL.
+  - `list-connected-agents` keys custom manifests by the normalized agent id, so
+    an agent registered as `images`/`asset` no longer appears once as a discovered
+    agent and again as a custom one.
+  - Export `resolveA2ACallerAuth` from `@agent-native/core/a2a` so app code can
+    authenticate outbound A2A calls without reimplementing org-secret lookup.
+  - The `a2a-protocol` skill documents the real setup path — A2A is auto-mounted,
+    peers are `remote-agents/*.json` resources, and auth is a JWT signed with
+    `A2A_SECRET` or the per-org secret — replacing the `mountA2A` + per-peer
+    `apiKeyEnv` flow the framework no longer wires up.
+
+### Patch Changes
+
+- f8df095: Keep cross-app `ask_app_status` polling attached to the original task route with an encrypted task handle, report the configured app identity in standalone MCP discovery, and reject unknown cross-app targets instead of running them locally.
+- cbc6936: Hide pending workspace apps by default and expose app ownership metadata from each card's overflow menu.
+- cbc6936: Show the provider's brand logo on agent tool rows for catalog-backed MCP tools, instead of a generic code icon.
+- cbc6936: Settings → Connections: the "New" key menu is now a searchable, scrolling combobox instead of a cropped dropdown, so every registered key is reachable.
+- cbc6936: Send `X-Content-Type-Options: nosniff` on CDN-served static assets.
+
+  `/assets/**`, `/favicon.*`, `/manifest.json`, `/icon-*.svg`, and
+  `/library-presets/**` are served straight off the CDN, so the security-headers
+  h3 middleware never runs for them and they shipped without the `nosniff` header
+  that every function-served response already carries.
+
+- cbc6936: Make the chat Stop button actually stop the turn.
+
+  A turn runs as a chain of runs: every `loop_limit` / `auto_continue` boundary
+  and every background handoff starts a successor under a new run id but the same
+  turn id. Stop only aborted the run id the client happened to hold, so the
+  successor claimed itself and the agent kept looping — the turn-abort marker that
+  `isTurnAborted` consults was only ever written on the pre-run path, which is
+  dead as soon as a run id exists.
+
+  `POST /runs/:id/abort` now escalates user-intent reasons (`user`, `abort`,
+  `user_stuck_cancel`, `user_stuck_retry`) to a turn-wide abort. Watchdog reasons
+  (`no_progress`, `auto_stuck_retry`) keep single-run semantics so they cannot
+  kill a server-side continuation chain that is still making progress.
+
+- Updated dependencies [cbc6936]
+  - @agent-native/toolkit@0.10.9
+
+## 0.126.0
+
+### Minor Changes
+
+- b99b899: **Breaking:** rename the `registerShareableResource` resolver `getShareEmailLogoUrl` (added in 0.125.0) to `getLogoUrl`. Update any registration that used the old name.
+
+  Add `getBrandName`, `getSender`, and `getHeroHtml` resolvers to `registerShareableResource`, plus an optional `heroHtml` on `renderEmail` and `fromName` on `sendEmail`. Share-notification emails can now render a template-owned preview block above the CTA (injected verbatim, so a template supplies its own markup — e.g. a video thumbnail with a play badge), override the brand name shown beside the logo, and appear to come from the sharing user ("Alice via Clips") with replies routed to them while keeping the configured domain-verified sending address so SPF/DKIM still pass.
+
 ## 0.125.0
 
 ### Minor Changes

package/corpus/core/docs/content/external-agents-catalog.mdx

@@ -225,13 +225,13 @@ In practice, every agent-native app should be authored with both: MCP Apps for i
 
 On top of the per-action tools the MCP server exposes a stable verb set, so an external agent has a predictable surface without guessing per-app action names:
 
-| Tool                                               | Side effects | Returns                                                                                                                      |
-| -------------------------------------------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------- |
-| `list_apps`                                        | none         | workspace apps + their URLs / running state                                                                                  |
-| `open_app({ app, view?, path?, params?, embed? })` | none         | a deep link or same-origin route; `embed: true` renders the full app inline where supported                                  |
-| `ask_app({ app, message, async?, maxWaitMs? })`    | agent loop   | routes a natural-language task to that app's in-app agent; long work returns a durable `taskId` for `ask_app_status` polling |
-| `create_workspace_app({ name, template })`         | scaffolds    | a new app booted via the workspace path, plus its running URL + deep link                                                    |
-| `list_templates`                                   | none         | the allow-listed templates only                                                                                              |
+| Tool                                               | Side effects | Returns                                                                                                                                                 |
+| -------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `list_apps`                                        | none         | workspace apps + their URLs / running state                                                                                                             |
+| `open_app({ app, view?, path?, params?, embed? })` | none         | a deep link or same-origin route; `embed: true` renders the full app inline where supported                                                             |
+| `ask_app({ app, message, async?, maxWaitMs? })`    | agent loop   | routes a natural-language task to that app's in-app agent; long work returns a durable `taskHandle` plus a legacy `taskId` for `ask_app_status` polling |
+| `create_workspace_app({ name, template })`         | scaffolds    | a new app booted via the workspace path, plus its running URL + deep link                                                                               |
+| `list_templates`                                   | none         | the allow-listed templates only                                                                                                                         |
 
 `create_workspace_app` rejects any non-allow-listed template — the public template allow-list in `packages/shared-app-config/templates.ts` is authoritative and CI-guarded; an external agent cannot widen it. A same-named template action overrides a builtin (template-over-core precedence). Disable the whole set with `MCPConfig.builtinCrossAppTools: false`.
 
@@ -244,9 +244,10 @@ For fast ChatGPT/Claude handoffs, the ideal path is direct: call the action that
 MCP hosts and gateways do not share one long tool-call timeout; some enforce a
 five-minute ceiling and others are configurable. Do not design an external
 agent integration around a ten-minute blocking `tools/call`. `ask-agent` and
-`ask_app` acknowledge hosted work quickly, then return a durable `taskId` when
-the inline wait expires. Poll with `ask_app_status` using the returned `app`
-and `taskId`; the result includes `pollAfterMs` as a host-friendly interval.
+`ask_app` acknowledge hosted work quickly, then return a durable `taskHandle`
+plus a legacy `taskId` when the inline wait expires. Poll with `ask_app_status`
+by replaying the returned `poll.arguments` unchanged, especially the
+`taskHandle`; the result includes `pollAfterMs` as a host-friendly interval.
 The task must be created before the first response can time out, so a polling
 URL returned only after a long call is not a reliable recovery contract.
 
@@ -254,7 +255,9 @@ If a bounded transient status read is unavailable, `ask_app_status` can return
 `status: "unknown"`, `statusRead: "unavailable"`, `retryable: true`, the
 original `app` and `taskId`, and `pollAfterMs` / `poll`. This means the status
 read is unavailable—not that the durable task failed. Retry `ask_app_status`
-with that exact `app` and `taskId`; never resubmit `ask_app` to recover, because
+with the exact returned `poll.arguments`, including `taskHandle` when present;
+legacy results without a handle must reuse the same `app` and `taskId`. Never
+resubmit `ask_app` to recover, because
 submission can duplicate work. Permanent authentication, not-found, and
 protocol failures remain errors.
 

package/corpus/core/docs/content/mcp-protocol.mdx

@@ -235,7 +235,11 @@ The agent runs the same loop as the interactive chat — it can call multiple to
 {
   "poll": {
     "tool": "ask_app_status",
-    "arguments": { "app": "mail", "taskId": "task_123" }
+    "arguments": {
+      "app": "mail",
+      "taskId": "task_123",
+      "taskHandle": "opaque_handle"
+    }
   }
 }
 ```
@@ -248,9 +252,10 @@ If a bounded transient status read is unavailable, `ask_app_status` can return
 `status: "unknown"`, `statusRead: "unavailable"`, `retryable: true`, the
 original `app` and `taskId`, and `pollAfterMs` / `poll`. This means the status
 read is unavailable—not that the durable task failed. Retry `ask_app_status`
-with that exact `app` and `taskId`; never resubmit `ask_app` to recover, because
-submission can duplicate work. Permanent authentication, not-found, and
-protocol failures remain errors.
+with the returned `poll.arguments` unchanged, including `taskHandle` when
+present; legacy results without a handle must reuse the same `app` and `taskId`.
+Never resubmit `ask_app` to recover, because submission can duplicate work.
+Permanent authentication, not-found, and protocol failures remain errors.
 
 ## Authentication {#authentication}
 

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.125.0",
+  "version": "0.127.1",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/a2a/index.ts

@@ -21,6 +21,8 @@ export {
 
 // Client
 export { A2AClient, callAction, callAgent, signA2AToken } from "./client.js";
+export { resolveA2ACallerAuth } from "./caller-auth.js";
+export type { A2ACallerAuth } from "./caller-auth.js";
 export {
   AgentInvocationError,
   buildAgentInvocationPrompt,

package/corpus/core/src/agent/production-agent.ts

@@ -141,6 +141,7 @@ import {
   getRun,
   abortRun,
   abortRunDurably,
+  abortTurnDurably,
   tryClaimRunSlot,
   isHostedRuntime,
   resolveRunSoftTimeoutMs,
@@ -7409,8 +7410,11 @@ export function createProductionAgentHandler(
     // sent from the model picker; `engine.name` is what resolveEngine picked.
     // Divergence between them is the usual cause of "status says builder but
     // no [builder-engine] log lines appear" confusion.
+    // `requestModel` differing from `model` means normalizeModelForEngine
+    // substituted the engine default — otherwise indistinguishable from the
+    // client never asking for one.
     console.log(
-      `[agent-chat] resolved engine=${engine.name} model=${effectiveModel} requestEngine=${requestEngine ?? "(none)"} modelSource=${modelSelectionSource}`,
+      `[agent-chat] resolved engine=${engine.name} model=${effectiveModel} requestModel=${requestModel ?? "(none)"} requestEngine=${requestEngine ?? "(none)"} modelSource=${modelSelectionSource} turnId=${requestTurnId ?? "(none)"}`,
     );
 
     if (
@@ -9020,5 +9024,6 @@ export {
   getRun,
   abortRun,
   abortRunDurably,
+  abortTurnDurably,
   subscribeToRun,
 };

package/corpus/core/src/agent/run-manager.ts

@@ -15,6 +15,8 @@ import {
   getRunEventsSince,
   getRunById,
   getRunByThread,
+  getRunTurnRef,
+  markTurnAborted,
   cleanupOldRuns,
   updateRunHeartbeat,
   bumpRunProgress,
@@ -2095,5 +2097,40 @@ export async function abortRunDurably(
   return abortedInMemory;
 }
 
+/**
+ * Stop the whole turn `runId` belongs to, not just that run.
+ *
+ * A turn is executed as a chain of runs: every `loop_limit` / `auto_continue`
+ * boundary and every background handoff starts a successor run with a NEW run
+ * id under the same turn id. Aborting one run therefore only ends the current
+ * chunk — the successor claims itself and the turn keeps going, which is what
+ * users see as "Stop didn't stop it". The durable turn-abort marker is the only
+ * thing the successor-claim path (`isTurnAborted`) consults.
+ */
+export async function abortTurnDurably(
+  runId: string,
+  reason: string = "user",
+): Promise<void> {
+  const memRun = activeRuns.get(runId);
+  // In-memory first: a foreground run's SQL insert is async, so the row may not
+  // exist yet when Stop lands moments after send.
+  const ref = memRun
+    ? { threadId: memRun.threadId, turnId: memRun.turnId }
+    : await getRunTurnRef(runId).catch(() => null);
+  if (!ref) return;
+  try {
+    await markTurnAborted(ref.threadId, ref.turnId, reason);
+  } catch (error) {
+    // The current run is already stopped; a failed marker write must not turn
+    // Stop into a 500. Successors will keep running — capture it so that is
+    // visible rather than silent.
+    captureError(error, {
+      route: "/_agent-native/agent-chat/runs/:id/abort",
+      tags: { source: "agent-run-manager", phase: "abort-turn" },
+      extra: { runId, reason, ...ref },
+    });
+  }
+}
+
 // Re-export so callers can avoid importing from run-store directly.
 export { tryClaimRunSlot } from "./run-store.js";

package/corpus/core/src/agent/run-store.ts

@@ -2053,6 +2053,24 @@ export async function markTurnAborted(
   );
 }
 
+/**
+ * Turn identity for a run, or null when the row is unknown. `turn_id` is null
+ * for rows written before the column existed; those runs are their own turn.
+ */
+export async function getRunTurnRef(
+  runId: string,
+): Promise<{ threadId: string; turnId: string } | null> {
+  await ensureRunTables();
+  const { rows } = await getDbExec().execute({
+    sql: `SELECT thread_id, turn_id FROM agent_runs WHERE id = ?`,
+    args: [runId],
+  });
+  const row = rows[0] as { thread_id?: unknown; turn_id?: unknown } | undefined;
+  const threadId = row?.thread_id ? String(row.thread_id) : "";
+  if (!threadId) return null;
+  return { threadId, turnId: row?.turn_id ? String(row.turn_id) : runId };
+}
+
 export async function isTurnAborted(
   threadId: string,
   turnId: string,

package/corpus/core/src/client/MultiTabAssistantChat.tsx

@@ -88,6 +88,8 @@ interface PendingSend {
 interface PendingDelivery {
   threadId: string | null;
   send: PendingSend;
+  /** Applied to whichever thread this send lands on; a queued send outlives the handler that parsed it. */
+  modelOverride?: ModelSelection;
 }
 
 /** The single path that hands a queued send to a mounted chat ref. */
@@ -154,28 +156,28 @@ function resolveModelSelection(
   groups: EngineModelGroup[],
 ): ModelSelection | undefined {
   if (!selection?.model) return undefined;
-  if (groups.length === 0) {
-    return {
-      model: selection.model,
-      effort: resolveReasoningEffortSelection(
-        selection.model,
-        selection.effort,
-      ),
-    };
-  }
-  const preferredGroup = groups.find(
-    (group) =>
-      group.engine === selection.engine &&
-      group.models.includes(selection.model),
-  );
-  const fallbackGroup = groups.find((group) =>
-    group.models.includes(selection.model),
-  );
-  if (groups.length > 0 && !preferredGroup && !fallbackGroup) {
-    return undefined;
-  }
+  // Engine precedence turns on whether the catalog OFFERS the supplied engine,
+  // not on whether that engine advertises this model:
+  //   offered      → honor it. A gateway's advertised list is its built-in
+  //                  catalog, not what the endpoint serves, and one model id
+  //                  sits under several groups (claude-sonnet-5 under both
+  //                  anthropic and builder) — so a model-only match would
+  //                  reroute the turn to a different provider and bill it there.
+  //   not offered  → heal to a group that serves the model. A selection left
+  //                  on `builder` after disconnecting it must still run on the
+  //                  user's own key; the same model through another configured
+  //                  provider is the point of bring-your-own-key.
+  // `builder` is in the catalog exactly when Builder is connected, so this is a
+  // real availability signal rather than a guess.
+  const suppliedEngine = selection.engine?.trim()
+    ? selection.engine
+    : undefined;
   const engine =
-    preferredGroup?.engine ?? fallbackGroup?.engine ?? selection.engine;
+    (groups.some((group) => group.engine === suppliedEngine)
+      ? suppliedEngine
+      : undefined) ??
+    groups.find((group) => group.models.includes(selection.model))?.engine ??
+    suppliedEngine;
   if (!engine && groups.length > 0) return undefined;
 
   const effort = resolveReasoningEffortSelection(
@@ -1120,7 +1122,14 @@ export function MultiTabAssistantChat({
         .catch(() => null),
     ])
       .then(([enginesData, envKeys, builderStatus]) => {
-        if (!enginesData?.engines) return;
+        if (!enginesData?.engines) {
+          // Leaves `availableModels` empty for the session, so an override with
+          // no engine of its own has nothing to resolve against.
+          console.warn(
+            "[agent-chat] no engine list; model overrides cannot be catalog-resolved",
+          );
+          return;
+        }
         const configuredKeys = new Set(
           (envKeys as Array<{ key: string; configured: boolean }>)
             .filter((k) => k.configured)
@@ -1598,6 +1607,7 @@ export function MultiTabAssistantChat({
         context,
         openSidebar,
         model,
+        engine,
         effort,
         newTab,
         background,
@@ -1638,32 +1648,44 @@ export function MultiTabAssistantChat({
         ...(submitMessageId ? { submitMessageId } : {}),
       };
 
+      // Resolved once, up front, and carried with the send until a thread
+      // exists to key it by. Applying it only when `model` matched
+      // `availableModels` dropped every override that arrived before the
+      // engines fetch resolved — and the cold-start replay below runs at mount,
+      // when that list is always still empty.
+      let modelOverride: ModelSelection | undefined;
+      if (model) {
+        const catalogEngine = availableModels.find((g) =>
+          g.models.includes(model),
+        )?.engine;
+        const overrideEngine = engine ?? catalogEngine;
+        if (!overrideEngine && availableModels.length > 0) {
+          console.warn(
+            `[agent-chat] model override "${model}" is in no engine group and carries no engine; the server will substitute its default`,
+          );
+        }
+        modelOverride = {
+          model,
+          ...(overrideEngine ? { engine: overrideEngine } : {}),
+          effort: resolveReasoningEffortSelection(
+            model,
+            isReasoningEffort(effort) ? effort : undefined,
+          ),
+        };
+      }
+
       const sendToTab = (threadId: string) => {
         if (isAgentChatSubmitCancelled(submitMessageId)) return;
-        // If a model override was specified, apply it only if we recognize it
-        if (model) {
-          const matchedGroup = availableModels.find((g) =>
-            g.models.includes(model),
-          );
-          if (matchedGroup) {
-            const selectedEffort = resolveReasoningEffortSelection(
-              model,
-              isReasoningEffort(effort) ? effort : undefined,
-            );
-            threadModelRef.current.set(threadId, {
-              model,
-              engine: matchedGroup.engine,
-              effort: selectedEffort,
-            });
-            bumpModelSelectionVersion();
-          }
+        if (modelOverride) {
+          threadModelRef.current.set(threadId, modelOverride);
+          bumpModelSelectionVersion();
         }
 
         const ref = chatRefs.current.get(threadId);
         if (ref) {
           deliverPendingSend(ref, send);
         } else {
-          pendingDeliveries.current.push({ threadId, send });
+          pendingDeliveries.current.push({ threadId, send, modelOverride });
         }
       };
 
@@ -1709,7 +1731,11 @@ export function MultiTabAssistantChat({
         } else {
           // Cold start: no thread yet. Queue for the first active thread (the
           // bootstrap effect creates it) rather than racing a second create.
-          pendingDeliveries.current.push({ threadId: null, send });
+          pendingDeliveries.current.push({
+            threadId: null,
+            send,
+            modelOverride,
+          });
         }
       }
     };
@@ -1762,16 +1788,22 @@ export function MultiTabAssistantChat({
       if (isAgentChatSubmitCancelled(delivery.send.submitMessageId)) continue;
       const threadId = delivery.threadId ?? active ?? null;
       const ref = threadId ? chatRefs.current.get(threadId) : null;
+      if (threadId && delivery.modelOverride) {
+        threadModelRef.current.set(threadId, delivery.modelOverride);
+        bumpModelSelectionVersion();
+      }
       if (threadId && ref) {
         const { send } = delivery;
         setTimeout(() => deliverPendingSend(ref, send), 50);
       } else {
         // Not ready — keep it, pinning the resolved threadId once known.
-        remaining.push(threadId ? { threadId, send: delivery.send } : delivery);
+        remaining.push(
+          threadId ? { ...delivery, threadId, send: delivery.send } : delivery,
+        );
       }
     }
     pendingDeliveries.current = remaining;
-  }, [openTabIds, activeThreadId]);
+  }, [openTabIds, activeThreadId, bumpModelSelectionVersion]);
 
   // Listen for chatRunning completion events
   useEffect(() => {

package/corpus/core/src/client/agent-chat.ts

@@ -858,6 +858,17 @@ function normalizeAgentChatRequestMode(
   return value === "act" || value === "plan" ? value : undefined;
 }
 
+/**
+ * Composers submit `engine: ""` whenever the engines list failed to load. An
+ * empty string is not nullish, so it survives `??` yet reads as falsy — one
+ * value meaning both "specified" and "absent". Absent is decided here, once.
+ */
+function nonEmptyString(value: unknown): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : undefined;
+}
+
 /** A normalized `agentNative.submitChat` payload — decode via {@link parseSubmitChatMessage}. */
 export interface ParsedSubmitChat {
   /** Visible prompt text (non-empty). */
@@ -867,6 +878,12 @@ export interface ParsedSubmitChat {
   submit: boolean;
   openSidebar?: boolean;
   model?: string;
+  /**
+   * Engine paired with `model`. The receiver cannot re-derive it for an id the
+   * catalog omits, and a model sent without one is normalized to the resolved
+   * engine's default server-side.
+   */
+  engine?: string;
   /** Raw effort hint; the receiver validates it against the model. */
   effort?: unknown;
   newTab?: boolean;
@@ -907,7 +924,8 @@ export function parseSubmitChatMessage(
     submit: raw.submit !== false,
     openSidebar:
       typeof raw.openSidebar === "boolean" ? raw.openSidebar : undefined,
-    model: typeof raw.model === "string" ? raw.model : undefined,
+    model: nonEmptyString(raw.model),
+    engine: nonEmptyString(raw.engine),
     effort: raw.effort,
     newTab: typeof raw.newTab === "boolean" ? raw.newTab : undefined,
     background:

package/corpus/core/src/client/chat/tool-call-display.tsx

@@ -41,6 +41,7 @@ import {
 import { ConnectBuilderCard } from "../ConnectBuilderCard.js";
 import { useT } from "../i18n.js";
 import { McpAppRenderer } from "../mcp-apps/McpAppRenderer.js";
+import { findMcpIntegrationForToolName } from "../resources/mcp-integration-catalog.js";
 import type { AgentCallProgress, ContentPart } from "../sse-event-processor.js";
 import {
   BashCell,
@@ -279,7 +280,31 @@ type ToolIconComponent = React.ComponentType<{
   size?: number | string;
 }>;
 
+const brandIcons = new Map<string, ToolIconComponent>();
+
+function brandToolIcon(logoUrl: string, name: string): ToolIconComponent {
+  const cached = brandIcons.get(logoUrl);
+  if (cached) return cached;
+  const Icon: ToolIconComponent = ({ className, size }) => (
+    <img
+      src={logoUrl}
+      alt=""
+      aria-hidden
+      width={size}
+      height={size}
+      title={name}
+      className={cn("rounded-[3px] object-contain", className)}
+    />
+  );
+  brandIcons.set(logoUrl, Icon);
+  return Icon;
+}
+
 function resolveToolIcon(toolName: string): ToolIconComponent {
+  const integration = findMcpIntegrationForToolName(toolName);
+  if (integration) {
+    return brandToolIcon(integration.logoUrl, integration.name);
+  }
   const name = toolName.toLowerCase();
   if (name.includes("slack")) return IconBrandSlack;
   if (

package/corpus/core/src/client/resources/mcp-integration-catalog.ts

@@ -803,6 +803,29 @@ export function findMcpIntegrationForText(
   return null;
 }
 
+/**
+ * Matches the server segment of an `mcp__<server>__<tool>` name, not prose, so
+ * ambiguous brand words ("box", "monday", "linear") are safe here in a way they
+ * are not in `findMcpIntegrationForText`.
+ */
+export function findMcpIntegrationForToolName(
+  toolName: string,
+  integrations: readonly DefaultMcpIntegration[] = DEFAULT_MCP_INTEGRATIONS,
+): DefaultMcpIntegration | null {
+  const server = /^mcp__(.+?)__/.exec(toolName.toLowerCase())?.[1];
+  if (!server) return null;
+  return (
+    integrations.find((integration) =>
+      [
+        integration.id,
+        integration.provider,
+        ...(integration.brandAliases ?? []),
+        ...(integration.aliases ?? []),
+      ].some((alias) => textContainsTerm(server, alias)),
+    ) ?? null
+  );
+}
+
 export function isMcpConnectionFailureText(text: string): boolean {
   return /\b(?:can(?:not|'t|’t)|could(?: not|n't|n’t)|unable|failed|don't have access|don’t have access|not connected|not able)\b[\s\S]{0,80}\b(?:read|access|open|see|fetch|connect)\b/i.test(
     text,