@agent-native/core 0.107.0 → 0.107.1

package/corpus/core/src/client/resources/mcp-integration-catalog.ts

@@ -24,6 +24,7 @@ export type McpIntegrationVerification =
 declare const __AGENT_NATIVE_MCP_INTEGRATIONS_CONFIG__:
   | NormalizedMcpIntegrationsConfig
   | undefined;
+declare const __AGENT_NATIVE_TEMPLATE__: string | undefined;
 
 export interface DefaultMcpIntegration {
   id: string;
@@ -41,6 +42,11 @@ export interface DefaultMcpIntegration {
   logoUrl: string;
   docsUrl?: string;
   setupNoteKey?: string;
+  apiFallback?: {
+    secretKey: string;
+    docsUrl: string;
+    templateUses?: readonly string[];
+  };
   headerPlaceholder?: string;
   keywords: string[];
 }
@@ -272,6 +278,12 @@ export const DEFAULT_MCP_INTEGRATIONS: DefaultMcpIntegration[] = [
     logoUrl: mcpIntegrationLogo("figma"),
     docsUrl: "https://developers.figma.com/docs/figma-mcp-server/",
     setupNoteKey: "mcpIntegrations.catalog.figma.setupNote",
+    apiFallback: {
+      secretKey: "FIGMA_ACCESS_TOKEN",
+      docsUrl:
+        "https://developers.figma.com/docs/rest-api/personal-access-tokens/",
+      templateUses: ["design"],
+    },
     keywords: ["design", "figjam", "components", "variables", "canvas"],
   },
   {
@@ -532,6 +544,39 @@ function readRuntimeMcpIntegrationsConfig(): NormalizedMcpIntegrationsConfig {
   return normalizeMcpIntegrationsConfig();
 }
 
+function normalizeTemplateName(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim().toLowerCase();
+  return normalized || null;
+}
+
+function getActiveTemplateName(): string | null {
+  try {
+    const compiledTemplate = normalizeTemplateName(__AGENT_NATIVE_TEMPLATE__);
+    if (compiledTemplate) return compiledTemplate;
+  } catch {
+    // Test and non-Vite contexts may not define the compile-time constant.
+  }
+
+  const runtimeConfig = (
+    globalThis as typeof globalThis & {
+      __AGENT_NATIVE_CONFIG__?: { template?: unknown };
+    }
+  ).__AGENT_NATIVE_CONFIG__;
+  return normalizeTemplateName(runtimeConfig?.template);
+}
+
+export function getMcpIntegrationApiFallback(
+  integration: DefaultMcpIntegration,
+  templateName = getActiveTemplateName(),
+): DefaultMcpIntegration["apiFallback"] | null {
+  const fallback = integration.apiFallback;
+  if (!fallback) return null;
+  if (!fallback.templateUses?.length) return fallback;
+  if (!templateName) return null;
+  return fallback.templateUses.includes(templateName) ? fallback : null;
+}
+
 function normalizePresetConfig(
   config?: McpIntegrationsConfigInput | NormalizedMcpIntegrationsConfig,
 ): NormalizedMcpIntegrationsConfig {

package/corpus/core/src/client/sharing/ShareButton.tsx

@@ -261,6 +261,7 @@ function handleSharePopoverInteractOutside(
  */
 export function ShareButton(props: ShareButtonProps) {
   const [open, setOpen] = useState(false);
+  const [inviteEmail, setInviteEmail] = useState("");
   const shareTabDefaultValue = props.shareTabs?.defaultValue ?? "share";
   const [activeShareTab, setActiveShareTab] = useState(shareTabDefaultValue);
   const [pendingVisibility, setPendingVisibility] = useState<Visibility | null>(
@@ -295,6 +296,10 @@ export function ShareButton(props: ShareButtonProps) {
     }
   };
 
+  useEffect(() => {
+    setInviteEmail("");
+  }, [props.resourceType, props.resourceId]);
+
   const handleShareTabChange = (value: string) => {
     setActiveShareTab(value);
     props.shareTabs?.onValueChange?.(value);
@@ -399,6 +404,8 @@ export function ShareButton(props: ShareButtonProps) {
       >
         <SharePanel
           {...props}
+          inviteEmail={inviteEmail}
+          onInviteEmailChange={setInviteEmail}
           sharesQuery={sharesQuery}
           visibilityOverride={pendingVisibility}
           onVisibilityChange={handleVisibilityChange}
@@ -575,6 +582,8 @@ function mergeMembers(existing: OrgMember[], next: OrgMember[]): OrgMember[] {
 
 function SharePanel(
   props: ShareButtonProps & {
+    inviteEmail: string;
+    onInviteEmailChange: (email: string) => void;
     sharesQuery: ReturnType<typeof useActionQuery<SharesResponse>>;
     visibilityOverride: Visibility | null;
     onVisibilityChange: (visibility: Visibility) => Promise<void>;
@@ -591,17 +600,18 @@ function SharePanel(
     visibilityOverride,
     onVisibilityChange,
     onClose,
+    inviteEmail,
+    onInviteEmailChange,
   } = props;
 
   const share = useActionMutation("share-resource");
   const unshare = useActionMutation("unshare-resource");
 
-  const [email, setEmail] = useState("");
   const [role, setRole] = useState<Role>("viewer");
   const [notifyPeople, setNotifyPeople] = useState(true);
   const [shareError, setShareError] = useState<string | null>(null);
   const [suggestionsOpen, setSuggestionsOpen] = useState(false);
-  const hasInviteEmail = email.trim().length > 0;
+  const hasInviteEmail = inviteEmail.trim().length > 0;
 
   // Optimistic overlays so clicks feel instant.
   const [pendingAdds, setPendingAdds] = useState<Share[]>([]);
@@ -685,7 +695,10 @@ function SharePanel(
       .map((s) => ({ ...s, role: roleOverrides[keyOf(s)] ?? s.role })),
     ...pendingAdds,
   ];
-  const memberSearch = useOrgMemberSearch(email, canManage && suggestionsOpen);
+  const memberSearch = useOrgMemberSearch(
+    inviteEmail,
+    canManage && suggestionsOpen,
+  );
   const excludedMemberEmails = new Set<string>();
   if (data?.ownerEmail) excludedMemberEmails.add(data.ownerEmail.toLowerCase());
   for (const s of shares) {
@@ -726,7 +739,7 @@ function SharePanel(
   };
 
   const handleAdd = () => {
-    const trimmed = email.trim();
+    const trimmed = inviteEmail.trim();
     if (!trimmed) return;
     const optimistic: Share = {
       id: `pending-${trimmed}`,
@@ -739,7 +752,7 @@ function SharePanel(
     if (inFlight.has(k)) return;
     setShareError(null);
     setPendingAdds((p) => [...p, optimistic]);
-    setEmail("");
+    onInviteEmailChange("");
     setSuggestionsOpen(false);
     addInFlight(k);
     share.mutate(
@@ -762,7 +775,7 @@ function SharePanel(
         onError: (err: any) => {
           setPendingAdds((p) => p.filter((s) => s.id !== optimistic.id));
           clearInFlight(k);
-          setEmail(trimmed);
+          onInviteEmailChange(trimmed);
           setShareError(extractShareErrorMessage(err));
         },
       },
@@ -898,15 +911,15 @@ function SharePanel(
         <div className="mb-4 space-y-2">
           <div className="flex items-stretch gap-2">
             <MemberAutocomplete
-              value={email}
+              value={inviteEmail}
               open={suggestionsOpen}
               onOpenChange={setSuggestionsOpen}
               onValueChange={(next) => {
-                setEmail(next);
+                onInviteEmailChange(next);
                 if (shareError) setShareError(null);
               }}
               onSelectMember={(member) => {
-                setEmail(member.email);
+                onInviteEmailChange(member.email);
                 setSuggestionsOpen(false);
                 if (shareError) setShareError(null);
               }}
@@ -920,6 +933,14 @@ function SharePanel(
               search={memberSearch}
             />
             <RoleSelect value={role} onChange={setRole} />
+            <button
+              type="button"
+              onClick={handleAdd}
+              disabled={!hasInviteEmail}
+              className={BUTTON_PRIMARY_SM}
+            >
+              Add
+            </button>
           </div>
           {shareError ? (
             <div

package/corpus/core/src/client/use-agent-chat-home-handoff.ts

@@ -35,7 +35,7 @@ export interface UseAgentChatHomeHandoffLinksOptions {
   enabled?: boolean;
   /** How long the handoff marker remains valid. Defaults to 6 hours. */
   ttlMs?: number;
-  /** Only intercept links if a recent handoff marker already exists. */
+  /** Only intercept links if a recent handoff marker already exists. Defaults to true. */
   requireActiveHandoff?: boolean;
 }
 
@@ -148,7 +148,7 @@ export function useAgentChatHomeHandoffLinks({
   isChatPath,
   enabled = true,
   ttlMs,
-  requireActiveHandoff = false,
+  requireActiveHandoff = true,
 }: UseAgentChatHomeHandoffLinksOptions): void {
   const location = useLocation();
   const navigate = useNavigate();

package/corpus/core/src/localization/default-messages.ts

@@ -697,7 +697,10 @@ const messages = {
     configure: "Configure",
     connect: "Connect",
     connectWithOAuth: "Connect with OAuth",
+    useApiToken: "Use API token",
     connectSuggestion: "Connect {{name}} to use this link in chat",
+    connectSuggestionWithApiToken:
+      "Connect {{name}} with an API token to use this link in chat",
     dismissSuggestion: "Dismiss integration suggestion",
     backToIntegrations: "Back to integrations",
     customTitle: "Add custom MCP server",
@@ -792,7 +795,7 @@ const messages = {
           "Bring Figma design context and canvas actions into an agent.",
         useCase: "Design files, components, variables, design systems, canvas",
         setupNote:
-          "Figma only allows clients listed in its MCP Catalog. Agent Native needs vendor approval before this remote endpoint can complete a connection; use the existing Figma OAuth connector for app-owned workflows in the meantime.",
+          "Figma MCP only allows clients listed in Figma's MCP Catalog, so this remote endpoint cannot connect from Agent Native yet. Use the Figma REST API fallback with a personal access token for reading file and node context; MCP canvas actions remain unavailable until Figma approves Agent Native.",
       },
       canva: {
         description: "Search, create, and update Canva designs and assets.",

package/corpus/core/src/secrets/register-framework-secrets.ts

@@ -197,4 +197,32 @@ export function registerFrameworkSecrets(): void {
       required: false,
     });
   }
+
+  if (!getRequiredSecret("FIGMA_ACCESS_TOKEN")) {
+    registerRequiredSecret({
+      key: "FIGMA_ACCESS_TOKEN",
+      label: "Figma access token",
+      description:
+        "Optional fallback for reading Figma file and node context when the hosted Figma MCP server is unavailable. Generate a personal access token with current_user:read and file_content:read.",
+      docsUrl:
+        "https://developers.figma.com/docs/rest-api/personal-access-tokens/",
+      scope: "user",
+      kind: "api-key",
+      required: false,
+      validator: async (value) => {
+        const response = await fetch("https://api.figma.com/v1/me", {
+          headers: {
+            "X-Figma-Token": value,
+            "User-Agent": "AgentNative/1.0",
+          },
+        });
+        return response.ok
+          ? { ok: true }
+          : {
+              ok: false,
+              error: `Figma rejected the token (HTTP ${response.status}).`,
+            };
+      },
+    });
+  }
 }

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -69,7 +69,7 @@ import {
   callerHasRunAccess,
   callerHasThreadAccess,
 } from "../agent/run-ownership.js";
-import { readBackgroundRunClaim } from "../agent/run-store.js";
+import { markTurnAborted, readBackgroundRunClaim } from "../agent/run-store.js";
 import {
   buildCurrentTimeUserContext,
   buildRuntimeContextPrompt,
@@ -4137,6 +4137,31 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             callerHasRunAccess(owner, runId, "viewer", { orgId });
           const canEditRun = (runId: string) =>
             callerHasRunAccess(owner, runId, "editor", { orgId });
+          const canEditThread = (threadId: string) =>
+            callerHasThreadAccess(owner, threadId, "editor", { orgId });
+
+          // Route: POST /runs/turn/:turnId/abort
+          // Covers the short window where the client has sent a turn but the
+          // server has not yet created its background run id.
+          const turnAbortMatch =
+            url.match(/\/runs\/turn\/([^/?]+)\/abort/) ||
+            url.match(/^\/turn\/([^/?]+)\/abort/);
+          if (turnAbortMatch && method === "POST") {
+            const turnId = decodeURIComponent(turnAbortMatch[1]);
+            const body = await readBody(event).catch(() => null);
+            const threadId =
+              typeof body?.threadId === "string" ? body.threadId : "";
+            if (
+              !/^[a-zA-Z0-9_-]{1,160}$/.test(turnId) ||
+              !threadId ||
+              !(await canEditThread(threadId))
+            ) {
+              setResponseStatus(event, 404);
+              return { error: "Run not found" };
+            }
+            await markTurnAborted(threadId, turnId);
+            return { ok: true };
+          }
 
           // Route: GET /runs/list?goalId=agent-team|agent-harness
           // Returns background agents in the Code hub-compatible run shape.
@@ -5180,6 +5205,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
               }
               workerBody = {
                 ...parsedPayload,
+                ...(prepared.body.internalContinuation === true
+                  ? { internalContinuation: true }
+                  : {}),
                 [AGENT_CHAT_BACKGROUND_RUN_FIELD]: preparedMarker,
               };
             }

package/corpus/core/src/vite/client.ts

@@ -2579,6 +2579,27 @@ function createAgentNativePlugins(
   ].filter(Boolean);
 }
 
+function resolveAgentNativeTemplate(cwd: string): string {
+  const configured = [
+    process.env.AGENT_NATIVE_TEMPLATE,
+    process.env.VITE_AGENT_NATIVE_TEMPLATE,
+    process.env.VITE_APP_TEMPLATE,
+  ].find((value) => value?.trim());
+  if (configured) return configured.trim().toLowerCase();
+
+  const normalizedCwd = cwd.replaceAll("\\", "/");
+  const marker = "/templates/";
+  const markerIndex = normalizedCwd.lastIndexOf(marker);
+  if (markerIndex === -1) return "";
+  return (
+    normalizedCwd
+      .slice(markerIndex + marker.length)
+      .split("/")[0]
+      ?.trim()
+      .toLowerCase() ?? ""
+  );
+}
+
 function createAgentNativeConfig(
   options: ClientConfigOptions | AgentNativeVitePluginOptions = {},
   command?: AgentNativeViteCommand,
@@ -2683,6 +2704,9 @@ function createAgentNativeConfig(
       __AGENT_NATIVE_MCP_INTEGRATIONS_CONFIG__: JSON.stringify(
         normalizeMcpIntegrationsConfig(options.mcpIntegrations),
       ),
+      __AGENT_NATIVE_TEMPLATE__: JSON.stringify(
+        resolveAgentNativeTemplate(cwd),
+      ),
     },
     server: {
       ...(userConfig.server ?? {}),

package/corpus/templates/analytics/.agents/skills/dashboard-management/SKILL.md

@@ -83,7 +83,7 @@ When the user asks for a dashboard:
 2. If a metric definition, date range, or grain is ambiguous and the choice would change the panel's numbers, use the `ask-question` clarifying tool once before building. Skip it when the dictionary or the user already settled it.
 3. If a metric is not documented, do not guess column names. Ask for the table/columns or introspect the provider schema, then propose a dictionary entry with `save-data-dictionary-entry`.
 4. Build a complete `SqlDashboardConfig` with `name` and `panels`. Optionally set top-level `columns` (1–6, default 2) to control how many grid columns the panels before any section use.
-5. Every panel needs `id`, `title`, `source`, `chartType`, `width`, and `sql`. `width` is the number of grid columns the panel spans (1..6, clamped to the active section's column count). Section panels skip `source` and `sql` and may set their own `columns` (1–6) to override the dashboard default for the panels following the section. Extension panels (`chartType: "extension"`) also skip `source` and `sql`; instead they require `config.extensionId` (see "Embedding An Extension As A Panel").
+5. Every panel needs `id`, `title`, `source`, `chartType`, `width`, and `sql`. `width` is the number of grid columns the panel spans (1..6, clamped to the active section's column count). Section panels skip `source` and `sql` and may set their own `columns` (1–6) to override the dashboard default for the panels following the section. Extension panels (`chartType: "extension"`) also skip `source` and `sql`; use `config.extensionSlotId` for new panels, with legacy `config.extensionId` supported for existing direct embeds (see "Embedding An Extension As A Panel").
 6. Persist with `update-dashboard`, not raw SQL or settings writes.
 7. Navigate to it with `pnpm action navigate --view=adhoc --dashboardId=<id>`.
 
@@ -114,14 +114,18 @@ rather than forcing it into a native dashboard config.
 
 ## Embedding An Extension As A Panel
 
-Use `chartType: "extension"` to embed an existing extension as a dashboard
-panel. This is different from the section above: there you replace the whole
-dashboard with an extension; here you drop a single extension widget into one
-panel slot alongside normal SQL charts. The panel renders the extension's
-sandboxed iframe instead of running a query, so it skips `source` and `sql` and
-instead requires `config.extensionId` (the id of an extension that already
-exists — create it first with `create-extension`). Validation rejects an
-extension panel without a non-empty `config.extensionId`.
+Use `chartType: "extension"` to add an extension box alongside normal SQL
+charts. The panel skips `source` and `sql`. New boxes use a stable slot id in
+`config.extensionSlotId`:
+
+```text
+analytics.dashboard.<dashboard-id>.panel.<panel-id>
+```
+
+Create or choose the extension, call `add-extension-slot-target` with the
+extension id and slot id, then call `install-extension` with the same values.
+The dashboard panel is shared, while the installed extension is per-user.
+Empty slots show the normal install affordance instead of a broken iframe.
 
 ```jsonc
 {
@@ -129,21 +133,22 @@ extension panel without a non-empty `config.extensionId`.
   "title": "Pipeline Widget",
   "chartType": "extension",
   "width": 3,
-  "config": { "extensionId": "<existing-extension-id>" },
+  "config": {
+    "extensionSlotId": "analytics.dashboard.weekly-metrics.panel.pipeline-widget",
+  },
 }
 ```
 
 Notes:
 
-- The panel renders full-bleed (no card chrome/title) and does not receive the
-  dashboard's filters/variables/date range — it's a standalone widget for now.
-- Access is scoped per viewer: embedding does NOT grant access to the extension
-  (same model as ExtensionSlots). If you share a dashboard more broadly than the
-  embedded extension, viewers without access to that extension see an
-  "extension unavailable" message instead of the content. Share the extension to
-  the same audience as the dashboard so all viewers can see it.
+- Slot-backed extensions receive the dashboard id, name, description, current
+  filters, and panel id/title/slot id as live context.
+- Installs and extension access are per viewer. Sharing the dashboard does not
+  automatically install or grant access to its extension for other viewers.
+- `config.extensionId` remains supported for legacy direct embeds. Use it only
+  when preserving an existing dashboard; new boxes should use a slot.
 
-## Cloning An Extension-Backed Dashboard (e.g. per-customer copies)
+## Cloning A Legacy Direct-Extension Dashboard (e.g. per-customer copies)
 
 When the user asks for a copy of an existing extension-backed dashboard for a
 different customer/org (for example "make an Intuit version of the Roku usage
@@ -154,8 +159,11 @@ from that written file — never by pulling the body into chat context first or
 re-typing it as a `content` argument.
 
 1. `get-sql-dashboard` with `includeConfig: true` on the source dashboard and
-   confirm the target panel is `chartType: "extension"`; grab its
-   `config.extensionId`.
+   confirm the target panel is a legacy `chartType: "extension"` panel with
+   `config.extensionId`; grab that extension id. For a slot-backed panel, clone
+   the dashboard panel with a new stable `extensionSlotId`, then target and
+   install the desired extension into that slot instead of using this body-copy
+   playbook.
 2. `get-extension` for that id with `forceContent: true` **exactly once**. Reuse
    that body for the rest of the turn — a second same-run read intentionally
    omits `content` and returns `contentOmitted` instead. That is not the content
@@ -397,7 +405,7 @@ type PanelInput = PanelPatch & {
   chartType: NonNullable<PanelPatch["chartType"]>;
   source?: PanelPatch["source"]; // required for non-section / non-extension panels
   sql?: string; // required for non-section / non-extension panels
-  // For chartType "extension": config.extensionId is required (the extension to embed).
+  // For chartType "extension": use config.extensionSlotId; extensionId is legacy direct embed compatibility.
 };
 
 type PanelFilter = {

package/corpus/templates/analytics/AGENTS.md

@@ -163,6 +163,14 @@ membership id when its native update status reports `update-available`.
   serialization traps. The script is constrained: only documented dashboard
   method calls with JSON-compatible arguments are parsed; variables, imports,
   loops, functions, network, filesystem, and DB access are not available.
+- Dashboard extension boxes use `chartType: "extension"` with
+  `config.extensionSlotId`. The stable per-box slot is
+  `analytics.dashboard.<dashboard-id>.panel.<panel-id>`. To add an extension,
+  create/choose it, call `add-extension-slot-target` with that slot id, then
+  `install-extension` with the same slot id. Installs are per-user; the
+  dashboard panel remains shared. Slot-backed extensions receive dashboard id,
+  name, description, current filters, and the panel id/title/slot id as context.
+  `config.extensionId` is legacy direct embedding for existing dashboards.
 - Dashboard saves keep bounded history in SQL. Use
   `list-dashboard-revisions` to inspect undo points and
   `restore-dashboard-revision` to restore one instead of hand-editing history

package/corpus/templates/analytics/actions/dashboard-mutation-api.ts

@@ -132,7 +132,7 @@ export const DASHBOARD_MUTATION_EXAMPLES = [
   `dashboard.insertPanel({"id":"new-kpi","title":"New KPI","source":"first-party","chartType":"metric","width":1,"config":{"timeScope":"dashboard"},"sql":"SELECT COUNT(*) AS value FROM analytics_events WHERE event_date >= '{{dateStart}}' AND event_date < '{{dateEnd}}'"}).atTop();`,
   `dashboard.insertPanel({"id":"new-chart","title":"New Chart","source":"first-party","chartType":"line","width":1,"config":{"timeScope":"dashboard"},"sql":"SELECT event_date AS date, COUNT(*) AS value FROM analytics_events WHERE event_date >= '{{dateStart}}' AND event_date < '{{dateEnd}}' GROUP BY event_date ORDER BY event_date"}).nextTo("retention-over-time");`,
   `dashboard.insertPanel({"id":"row-chart","title":"Row Chart","source":"first-party","chartType":"bar","width":1,"config":{"timeScope":"dashboard"},"sql":"SELECT event_name AS name, COUNT(*) AS value FROM analytics_events WHERE event_date >= '{{dateStart}}' AND event_date < '{{dateEnd}}' GROUP BY event_name"}).atRow(2);`,
-  'dashboard.insertPanel({"id":"pipeline-widget","title":"Pipeline Widget","chartType":"extension","width":3,"config":{"extensionId":"<existing-extension-id>"}}).atBottom();',
+  'dashboard.insertPanel({"id":"pipeline-widget","title":"Pipeline Widget","chartType":"extension","width":3,"config":{"extensionSlotId":"analytics.dashboard.<dashboard-id>.panel.pipeline-widget"}}).atBottom();',
 ] as const;
 
 export type DashboardMutationOperation =

package/corpus/templates/analytics/actions/update-dashboard.ts

@@ -369,8 +369,12 @@ export function validateDashboardConfig(
         cfg && typeof cfg.extensionId === "string"
           ? cfg.extensionId.trim()
           : "";
-      if (!extensionId) {
-        return `panel[${i}].config.extensionId is required for extension panels (the id of the extension to render inline)`;
+      const extensionSlotId =
+        cfg && typeof cfg.extensionSlotId === "string"
+          ? cfg.extensionSlotId.trim()
+          : "";
+      if (!extensionId && !extensionSlotId) {
+        return `panel[${i}].config.extensionId or config.extensionSlotId is required for extension panels`;
       }
     }
     if (

package/corpus/templates/analytics/app/components/dashboard/SqlChart.tsx

@@ -1,5 +1,8 @@
 import { useDemoModeStatus, useT } from "@agent-native/core/client";
-import { EmbeddedExtension } from "@agent-native/core/client/extensions";
+import {
+  EmbeddedExtension,
+  ExtensionSlot,
+} from "@agent-native/core/client/extensions";
 import {
   IconArrowsSort,
   IconSortAscending,
@@ -1185,6 +1188,8 @@ interface SqlChartProps {
   className?: string;
   loadData?: boolean;
   onExportCsvChange?: (handler: (() => void) | null) => void;
+  /** Dashboard/panel state sent to slot-backed extension boxes. */
+  extensionContext?: Record<string, unknown> | null;
 }
 
 export function SqlChart({
@@ -1192,6 +1197,7 @@ export function SqlChart({
   resolvedSql,
   loadData = true,
   onExportCsvChange,
+  extensionContext,
 }: SqlChartProps) {
   const t = useT();
   const { enabled: demoModeEnabled } = useDemoModeStatus();
@@ -1266,11 +1272,12 @@ export function SqlChart({
     );
   }
 
-  // Extension panels render a sandboxed extension iframe instead of querying a
-  // data source. The extension id lives in config.extensionId.
+  // Extension panels render either a named extension-point slot or a legacy
+  // direct extension iframe instead of querying a data source.
   if (isExtension) {
     const extensionId = panel.config?.extensionId;
-    if (!extensionId) {
+    const slotId = panel.config?.extensionSlotId;
+    if (!extensionId && !slotId) {
       return (
         <div className="flex flex-1 items-center justify-center px-4 py-8 min-h-[120px]">
           <p className="text-sm text-muted-foreground text-center">
@@ -1280,7 +1287,12 @@ export function SqlChart({
       );
     }
     return (
-      <DashboardExtensionPanel extensionId={extensionId} panelId={panel.id} />
+      <DashboardExtensionPanel
+        extensionId={extensionId}
+        panelId={panel.id}
+        slotId={slotId}
+        context={extensionContext}
+      />
     );
   }
   const colors = panel.config?.colors || DEFAULT_COLORS;
@@ -1409,9 +1421,13 @@ export function SqlChart({
 function DashboardExtensionPanel({
   extensionId,
   panelId,
+  slotId,
+  context,
 }: {
-  extensionId: string;
+  extensionId?: string;
   panelId: string;
+  slotId?: string;
+  context?: Record<string, unknown> | null;
 }) {
   const t = useT();
   // Hold the report-readiness marker until the extension iframe paints so
@@ -1419,6 +1435,18 @@ function DashboardExtensionPanel({
   const [ready, setReady] = useState(false);
   const [unavailable, setUnavailable] = useState(false);
 
+  if (slotId) {
+    return (
+      <ExtensionSlot
+        id={slotId}
+        context={context}
+        showEmptyAffordance
+        className="min-h-[120px] w-full"
+        toolClassName="w-full"
+      />
+    );
+  }
+
   // Embedding never grants access to the extension itself (same model as
   // ExtensionSlots). A viewer with dashboard-only access who can't see the
   // referenced extension gets a clear message instead of a blank panel.
@@ -1438,7 +1466,7 @@ function DashboardExtensionPanel({
       data-dashboard-report-loading={ready ? undefined : "true"}
     >
       <EmbeddedExtension
-        extensionId={extensionId}
+        extensionId={extensionId!}
         slotId={`dashboard-panel-${panelId}`}
         className="w-full"
         // Intentional for v1: extension panels are standalone widgets and do not

package/corpus/templates/analytics/app/components/layout/Layout.tsx

@@ -163,8 +163,6 @@ export function Layout({ children }: LayoutProps) {
     activePath: location.pathname,
     enabled: !isAskRoute && !reportScreenshot,
   });
-  const sidebarScope = chatHomeHandoffActive ? null : analyticsScope;
-
   useEffect(() => {
     function handleChatRunning(event: Event) {
       const detail = (event as CustomEvent).detail;
@@ -294,7 +292,7 @@ export function Layout({ children }: LayoutProps) {
               t("chat.suggestionAnomalies"),
               t("chat.suggestionMrr"),
             ]}
-            scope={sidebarScope}
+            scope={analyticsScope}
             composerSlot={<CreativeContextComposerChip />}
           >
             {contentFrame}