@agent-native/core 0.107.0 → 0.107.2

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -14,6 +14,7 @@ import {
 } from "h3";
 
 import {
+  appendA2AArtifactLinks,
   buildA2ARecoverableArtifactMessage,
   type A2AToolResultSummary,
 } from "../a2a/artifact-response.js";
@@ -27,6 +28,7 @@ import {
   createA2AApproval,
   updateTaskStatusMessage,
 } from "../a2a/task-store.js";
+import type { Message as A2AMessage } from "../a2a/types.js";
 import type { ActionHttpConfig } from "../action.js";
 import {
   canUpdateAgentAppModelDefaultSettings,
@@ -69,7 +71,7 @@ import {
   callerHasRunAccess,
   callerHasThreadAccess,
 } from "../agent/run-ownership.js";
-import { readBackgroundRunClaim } from "../agent/run-store.js";
+import { markTurnAborted, readBackgroundRunClaim } from "../agent/run-store.js";
 import {
   buildCurrentTimeUserContext,
   buildRuntimeContextPrompt,
@@ -275,6 +277,74 @@ export { loadRunCodeToolEntries };
 export { shouldDisableRecurringJobsRuntime };
 export { finalizeClaimedAgentChatProcessRunFailure };
 
+export function createSerializedA2ATaskStatusWriter(
+  taskId: string,
+  writeStatus: (
+    taskId: string,
+    message: A2AMessage,
+  ) => Promise<void> = updateTaskStatusMessage,
+  onError: (error: unknown) => void = (error) => {
+    console.error(
+      `[A2A] Failed to persist recoverable artifact message for task ${taskId}:`,
+      error,
+    );
+  },
+): {
+  enqueue: (message: A2AMessage) => void;
+  flush: () => Promise<void>;
+} {
+  const maxAttempts = 3;
+  let latestWrite: Promise<void> = Promise.resolve();
+
+  const persistWithRetry = async (message: A2AMessage): Promise<void> => {
+    let lastError: unknown;
+    for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+      try {
+        await writeStatus(taskId, message);
+        return;
+      } catch (error) {
+        lastError = error;
+      }
+    }
+    try {
+      onError(lastError);
+    } catch {
+      // The durable-write error below remains the authoritative failure.
+    }
+    throw lastError;
+  };
+
+  return {
+    enqueue(message) {
+      // A newer checkpoint supersedes an earlier failed checkpoint, so keep
+      // the queue moving. flush() still rejects when the latest write itself
+      // cannot be made durable after bounded retries.
+      latestWrite = latestWrite
+        .catch(() => undefined)
+        .then(() => {
+          return persistWithRetry(message);
+        });
+    },
+    flush() {
+      return latestWrite;
+    },
+  };
+}
+
+export async function resolveA2ARecoverableArtifactSecret(
+  orgId: string | null | undefined = getRequestOrgId(),
+): Promise<string | undefined> {
+  const globalSecret = process.env.A2A_SECRET?.trim();
+  if (globalSecret) return globalSecret;
+  if (!orgId) return undefined;
+  try {
+    const { getOrgA2ASecret } = await import("../org/context.js");
+    return (await getOrgA2ASecret(orgId))?.trim() || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 export function buildLeanRunPolicyPrompt(
   codeEditingSurfaceRestriction: string,
   prodCodeExecPromptNote: string,
@@ -1468,6 +1538,10 @@ export function createAgentChatPlugin(
           const a2aEvents: AgentChatEvent[] = [];
           const a2aToolResults: A2AToolResultSummary[] = [];
           let lastRecoverableArtifactText = "";
+          const recoverableArtifactSecret =
+            await resolveA2ARecoverableArtifactSecret();
+          const recoverableArtifactStatusWriter =
+            createSerializedA2ATaskStatusWriter(context.taskId);
           const controller = new AbortController();
 
           console.log(
@@ -1504,16 +1578,28 @@ export function createAgentChatPlugin(
                     isError: event.isError,
                     completedSideEffect: event.completedSideEffect,
                   });
-                  const recoverableArtifactText =
+                  const artifactBaseUrl = resolveArtifactBaseUrl(context.event);
+                  const recoverableArtifactMessage =
                     buildA2ARecoverableArtifactMessage(a2aToolResults, {
-                      baseUrl: resolveArtifactBaseUrl(context.event),
+                      baseUrl: artifactBaseUrl,
                     });
+                  const recoverableArtifactText = recoverableArtifactMessage
+                    ? appendA2AArtifactLinks(
+                        recoverableArtifactMessage,
+                        a2aToolResults,
+                        {
+                          baseUrl: artifactBaseUrl,
+                          includePersistedArtifactMarker: true,
+                          persistedArtifactSecret: recoverableArtifactSecret,
+                        },
+                      )
+                    : null;
                   if (
                     recoverableArtifactText &&
                     recoverableArtifactText !== lastRecoverableArtifactText
                   ) {
                     lastRecoverableArtifactText = recoverableArtifactText;
-                    updateTaskStatusMessage(context.taskId, {
+                    recoverableArtifactStatusWriter.enqueue({
                       role: "agent",
                       metadata: { agentNativeRecoverableArtifacts: true },
                       parts: [
@@ -1522,11 +1608,6 @@ export function createAgentChatPlugin(
                           text: recoverableArtifactText,
                         },
                       ],
-                    }).catch((err) => {
-                      console.error(
-                        `[A2A] Failed to persist recoverable artifact message for task ${context.taskId}:`,
-                        err,
-                      );
                     });
                   }
                 } else if (event.type === "error") {
@@ -1548,6 +1629,10 @@ export function createAgentChatPlugin(
             },
           );
 
+          // The continuation can observe terminal output immediately, so make
+          // its latest mutation checkpoint durable first.
+          await recoverableArtifactStatusWriter.flush();
+
           const approval = [...a2aEvents]
             .reverse()
             .find(
@@ -4137,6 +4222,31 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
             callerHasRunAccess(owner, runId, "viewer", { orgId });
           const canEditRun = (runId: string) =>
             callerHasRunAccess(owner, runId, "editor", { orgId });
+          const canEditThread = (threadId: string) =>
+            callerHasThreadAccess(owner, threadId, "editor", { orgId });
+
+          // Route: POST /runs/turn/:turnId/abort
+          // Covers the short window where the client has sent a turn but the
+          // server has not yet created its background run id.
+          const turnAbortMatch =
+            url.match(/\/runs\/turn\/([^/?]+)\/abort/) ||
+            url.match(/^\/turn\/([^/?]+)\/abort/);
+          if (turnAbortMatch && method === "POST") {
+            const turnId = decodeURIComponent(turnAbortMatch[1]);
+            const body = await readBody(event).catch(() => null);
+            const threadId =
+              typeof body?.threadId === "string" ? body.threadId : "";
+            if (
+              !/^[a-zA-Z0-9_-]{1,160}$/.test(turnId) ||
+              !threadId ||
+              !(await canEditThread(threadId))
+            ) {
+              setResponseStatus(event, 404);
+              return { error: "Run not found" };
+            }
+            await markTurnAborted(threadId, turnId);
+            return { ok: true };
+          }
 
           // Route: GET /runs/list?goalId=agent-team|agent-harness
           // Returns background agents in the Code hub-compatible run shape.
@@ -5180,6 +5290,9 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
               }
               workerBody = {
                 ...parsedPayload,
+                ...(prepared.body.internalContinuation === true
+                  ? { internalContinuation: true }
+                  : {}),
                 [AGENT_CHAT_BACKGROUND_RUN_FIELD]: preparedMarker,
               };
             }

package/corpus/core/src/vite/client.ts

@@ -2579,6 +2579,27 @@ function createAgentNativePlugins(
   ].filter(Boolean);
 }
 
+function resolveAgentNativeTemplate(cwd: string): string {
+  const configured = [
+    process.env.AGENT_NATIVE_TEMPLATE,
+    process.env.VITE_AGENT_NATIVE_TEMPLATE,
+    process.env.VITE_APP_TEMPLATE,
+  ].find((value) => value?.trim());
+  if (configured) return configured.trim().toLowerCase();
+
+  const normalizedCwd = cwd.replaceAll("\\", "/");
+  const marker = "/templates/";
+  const markerIndex = normalizedCwd.lastIndexOf(marker);
+  if (markerIndex === -1) return "";
+  return (
+    normalizedCwd
+      .slice(markerIndex + marker.length)
+      .split("/")[0]
+      ?.trim()
+      .toLowerCase() ?? ""
+  );
+}
+
 function createAgentNativeConfig(
   options: ClientConfigOptions | AgentNativeVitePluginOptions = {},
   command?: AgentNativeViteCommand,
@@ -2683,6 +2704,9 @@ function createAgentNativeConfig(
       __AGENT_NATIVE_MCP_INTEGRATIONS_CONFIG__: JSON.stringify(
         normalizeMcpIntegrationsConfig(options.mcpIntegrations),
       ),
+      __AGENT_NATIVE_TEMPLATE__: JSON.stringify(
+        resolveAgentNativeTemplate(cwd),
+      ),
     },
     server: {
       ...(userConfig.server ?? {}),

package/corpus/templates/analytics/.agents/skills/dashboard-management/SKILL.md

@@ -83,7 +83,7 @@ When the user asks for a dashboard:
 2. If a metric definition, date range, or grain is ambiguous and the choice would change the panel's numbers, use the `ask-question` clarifying tool once before building. Skip it when the dictionary or the user already settled it.
 3. If a metric is not documented, do not guess column names. Ask for the table/columns or introspect the provider schema, then propose a dictionary entry with `save-data-dictionary-entry`.
 4. Build a complete `SqlDashboardConfig` with `name` and `panels`. Optionally set top-level `columns` (1–6, default 2) to control how many grid columns the panels before any section use.
-5. Every panel needs `id`, `title`, `source`, `chartType`, `width`, and `sql`. `width` is the number of grid columns the panel spans (1..6, clamped to the active section's column count). Section panels skip `source` and `sql` and may set their own `columns` (1–6) to override the dashboard default for the panels following the section. Extension panels (`chartType: "extension"`) also skip `source` and `sql`; instead they require `config.extensionId` (see "Embedding An Extension As A Panel").
+5. Every panel needs `id`, `title`, `source`, `chartType`, `width`, and `sql`. `width` is the number of grid columns the panel spans (1..6, clamped to the active section's column count). Section panels skip `source` and `sql` and may set their own `columns` (1–6) to override the dashboard default for the panels following the section. Extension panels (`chartType: "extension"`) also skip `source` and `sql`; use `config.extensionSlotId` for new panels, with legacy `config.extensionId` supported for existing direct embeds (see "Embedding An Extension As A Panel").
 6. Persist with `update-dashboard`, not raw SQL or settings writes.
 7. Navigate to it with `pnpm action navigate --view=adhoc --dashboardId=<id>`.
 
@@ -114,14 +114,18 @@ rather than forcing it into a native dashboard config.
 
 ## Embedding An Extension As A Panel
 
-Use `chartType: "extension"` to embed an existing extension as a dashboard
-panel. This is different from the section above: there you replace the whole
-dashboard with an extension; here you drop a single extension widget into one
-panel slot alongside normal SQL charts. The panel renders the extension's
-sandboxed iframe instead of running a query, so it skips `source` and `sql` and
-instead requires `config.extensionId` (the id of an extension that already
-exists — create it first with `create-extension`). Validation rejects an
-extension panel without a non-empty `config.extensionId`.
+Use `chartType: "extension"` to add an extension box alongside normal SQL
+charts. The panel skips `source` and `sql`. New boxes use a stable slot id in
+`config.extensionSlotId`:
+
+```text
+analytics.dashboard.<dashboard-id>.panel.<panel-id>
+```
+
+Create or choose the extension, call `add-extension-slot-target` with the
+extension id and slot id, then call `install-extension` with the same values.
+The dashboard panel is shared, while the installed extension is per-user.
+Empty slots show the normal install affordance instead of a broken iframe.
 
 ```jsonc
 {
@@ -129,21 +133,22 @@ extension panel without a non-empty `config.extensionId`.
   "title": "Pipeline Widget",
   "chartType": "extension",
   "width": 3,
-  "config": { "extensionId": "<existing-extension-id>" },
+  "config": {
+    "extensionSlotId": "analytics.dashboard.weekly-metrics.panel.pipeline-widget",
+  },
 }
 ```
 
 Notes:
 
-- The panel renders full-bleed (no card chrome/title) and does not receive the
-  dashboard's filters/variables/date range — it's a standalone widget for now.
-- Access is scoped per viewer: embedding does NOT grant access to the extension
-  (same model as ExtensionSlots). If you share a dashboard more broadly than the
-  embedded extension, viewers without access to that extension see an
-  "extension unavailable" message instead of the content. Share the extension to
-  the same audience as the dashboard so all viewers can see it.
+- Slot-backed extensions receive the dashboard id, name, description, current
+  filters, and panel id/title/slot id as live context.
+- Installs and extension access are per viewer. Sharing the dashboard does not
+  automatically install or grant access to its extension for other viewers.
+- `config.extensionId` remains supported for legacy direct embeds. Use it only
+  when preserving an existing dashboard; new boxes should use a slot.
 
-## Cloning An Extension-Backed Dashboard (e.g. per-customer copies)
+## Cloning A Legacy Direct-Extension Dashboard (e.g. per-customer copies)
 
 When the user asks for a copy of an existing extension-backed dashboard for a
 different customer/org (for example "make an Intuit version of the Roku usage
@@ -154,8 +159,11 @@ from that written file — never by pulling the body into chat context first or
 re-typing it as a `content` argument.
 
 1. `get-sql-dashboard` with `includeConfig: true` on the source dashboard and
-   confirm the target panel is `chartType: "extension"`; grab its
-   `config.extensionId`.
+   confirm the target panel is a legacy `chartType: "extension"` panel with
+   `config.extensionId`; grab that extension id. For a slot-backed panel, clone
+   the dashboard panel with a new stable `extensionSlotId`, then target and
+   install the desired extension into that slot instead of using this body-copy
+   playbook.
 2. `get-extension` for that id with `forceContent: true` **exactly once**. Reuse
    that body for the rest of the turn — a second same-run read intentionally
    omits `content` and returns `contentOmitted` instead. That is not the content
@@ -397,7 +405,7 @@ type PanelInput = PanelPatch & {
   chartType: NonNullable<PanelPatch["chartType"]>;
   source?: PanelPatch["source"]; // required for non-section / non-extension panels
   sql?: string; // required for non-section / non-extension panels
-  // For chartType "extension": config.extensionId is required (the extension to embed).
+  // For chartType "extension": use config.extensionSlotId; extensionId is legacy direct embed compatibility.
 };
 
 type PanelFilter = {

package/corpus/templates/analytics/AGENTS.md

@@ -163,6 +163,14 @@ membership id when its native update status reports `update-available`.
   serialization traps. The script is constrained: only documented dashboard
   method calls with JSON-compatible arguments are parsed; variables, imports,
   loops, functions, network, filesystem, and DB access are not available.
+- Dashboard extension boxes use `chartType: "extension"` with
+  `config.extensionSlotId`. The stable per-box slot is
+  `analytics.dashboard.<dashboard-id>.panel.<panel-id>`. To add an extension,
+  create/choose it, call `add-extension-slot-target` with that slot id, then
+  `install-extension` with the same slot id. Installs are per-user; the
+  dashboard panel remains shared. Slot-backed extensions receive dashboard id,
+  name, description, current filters, and the panel id/title/slot id as context.
+  `config.extensionId` is legacy direct embedding for existing dashboards.
 - Dashboard saves keep bounded history in SQL. Use
   `list-dashboard-revisions` to inspect undo points and
   `restore-dashboard-revision` to restore one instead of hand-editing history

package/corpus/templates/analytics/actions/dashboard-mutation-api.ts

@@ -132,7 +132,7 @@ export const DASHBOARD_MUTATION_EXAMPLES = [
   `dashboard.insertPanel({"id":"new-kpi","title":"New KPI","source":"first-party","chartType":"metric","width":1,"config":{"timeScope":"dashboard"},"sql":"SELECT COUNT(*) AS value FROM analytics_events WHERE event_date >= '{{dateStart}}' AND event_date < '{{dateEnd}}'"}).atTop();`,
   `dashboard.insertPanel({"id":"new-chart","title":"New Chart","source":"first-party","chartType":"line","width":1,"config":{"timeScope":"dashboard"},"sql":"SELECT event_date AS date, COUNT(*) AS value FROM analytics_events WHERE event_date >= '{{dateStart}}' AND event_date < '{{dateEnd}}' GROUP BY event_date ORDER BY event_date"}).nextTo("retention-over-time");`,
   `dashboard.insertPanel({"id":"row-chart","title":"Row Chart","source":"first-party","chartType":"bar","width":1,"config":{"timeScope":"dashboard"},"sql":"SELECT event_name AS name, COUNT(*) AS value FROM analytics_events WHERE event_date >= '{{dateStart}}' AND event_date < '{{dateEnd}}' GROUP BY event_name"}).atRow(2);`,
-  'dashboard.insertPanel({"id":"pipeline-widget","title":"Pipeline Widget","chartType":"extension","width":3,"config":{"extensionId":"<existing-extension-id>"}}).atBottom();',
+  'dashboard.insertPanel({"id":"pipeline-widget","title":"Pipeline Widget","chartType":"extension","width":3,"config":{"extensionSlotId":"analytics.dashboard.<dashboard-id>.panel.pipeline-widget"}}).atBottom();',
 ] as const;
 
 export type DashboardMutationOperation =

package/corpus/templates/analytics/actions/update-dashboard.ts

@@ -369,8 +369,12 @@ export function validateDashboardConfig(
         cfg && typeof cfg.extensionId === "string"
           ? cfg.extensionId.trim()
           : "";
-      if (!extensionId) {
-        return `panel[${i}].config.extensionId is required for extension panels (the id of the extension to render inline)`;
+      const extensionSlotId =
+        cfg && typeof cfg.extensionSlotId === "string"
+          ? cfg.extensionSlotId.trim()
+          : "";
+      if (!extensionId && !extensionSlotId) {
+        return `panel[${i}].config.extensionId or config.extensionSlotId is required for extension panels`;
       }
     }
     if (

package/corpus/templates/analytics/app/components/dashboard/SqlChart.tsx

@@ -1,5 +1,8 @@
 import { useDemoModeStatus, useT } from "@agent-native/core/client";
-import { EmbeddedExtension } from "@agent-native/core/client/extensions";
+import {
+  EmbeddedExtension,
+  ExtensionSlot,
+} from "@agent-native/core/client/extensions";
 import {
   IconArrowsSort,
   IconSortAscending,
@@ -1185,6 +1188,8 @@ interface SqlChartProps {
   className?: string;
   loadData?: boolean;
   onExportCsvChange?: (handler: (() => void) | null) => void;
+  /** Dashboard/panel state sent to slot-backed extension boxes. */
+  extensionContext?: Record<string, unknown> | null;
 }
 
 export function SqlChart({
@@ -1192,6 +1197,7 @@ export function SqlChart({
   resolvedSql,
   loadData = true,
   onExportCsvChange,
+  extensionContext,
 }: SqlChartProps) {
   const t = useT();
   const { enabled: demoModeEnabled } = useDemoModeStatus();
@@ -1266,11 +1272,12 @@ export function SqlChart({
     );
   }
 
-  // Extension panels render a sandboxed extension iframe instead of querying a
-  // data source. The extension id lives in config.extensionId.
+  // Extension panels render either a named extension-point slot or a legacy
+  // direct extension iframe instead of querying a data source.
   if (isExtension) {
     const extensionId = panel.config?.extensionId;
-    if (!extensionId) {
+    const slotId = panel.config?.extensionSlotId;
+    if (!extensionId && !slotId) {
       return (
         <div className="flex flex-1 items-center justify-center px-4 py-8 min-h-[120px]">
           <p className="text-sm text-muted-foreground text-center">
@@ -1280,7 +1287,12 @@ export function SqlChart({
       );
     }
     return (
-      <DashboardExtensionPanel extensionId={extensionId} panelId={panel.id} />
+      <DashboardExtensionPanel
+        extensionId={extensionId}
+        panelId={panel.id}
+        slotId={slotId}
+        context={extensionContext}
+      />
     );
   }
   const colors = panel.config?.colors || DEFAULT_COLORS;
@@ -1409,9 +1421,13 @@ export function SqlChart({
 function DashboardExtensionPanel({
   extensionId,
   panelId,
+  slotId,
+  context,
 }: {
-  extensionId: string;
+  extensionId?: string;
   panelId: string;
+  slotId?: string;
+  context?: Record<string, unknown> | null;
 }) {
   const t = useT();
   // Hold the report-readiness marker until the extension iframe paints so
@@ -1419,6 +1435,18 @@ function DashboardExtensionPanel({
   const [ready, setReady] = useState(false);
   const [unavailable, setUnavailable] = useState(false);
 
+  if (slotId) {
+    return (
+      <ExtensionSlot
+        id={slotId}
+        context={context}
+        showEmptyAffordance
+        className="min-h-[120px] w-full"
+        toolClassName="w-full"
+      />
+    );
+  }
+
   // Embedding never grants access to the extension itself (same model as
   // ExtensionSlots). A viewer with dashboard-only access who can't see the
   // referenced extension gets a clear message instead of a blank panel.
@@ -1438,7 +1466,7 @@ function DashboardExtensionPanel({
       data-dashboard-report-loading={ready ? undefined : "true"}
     >
       <EmbeddedExtension
-        extensionId={extensionId}
+        extensionId={extensionId!}
         slotId={`dashboard-panel-${panelId}`}
         className="w-full"
         // Intentional for v1: extension panels are standalone widgets and do not

package/corpus/templates/analytics/app/components/layout/Layout.tsx

@@ -163,8 +163,6 @@ export function Layout({ children }: LayoutProps) {
     activePath: location.pathname,
     enabled: !isAskRoute && !reportScreenshot,
   });
-  const sidebarScope = chatHomeHandoffActive ? null : analyticsScope;
-
   useEffect(() => {
     function handleChatRunning(event: Event) {
       const detail = (event as CustomEvent).detail;
@@ -294,7 +292,7 @@ export function Layout({ children }: LayoutProps) {
               t("chat.suggestionAnomalies"),
               t("chat.suggestionMrr"),
             ]}
-            scope={sidebarScope}
+            scope={analyticsScope}
             composerSlot={<CreativeContextComposerChip />}
           >
             {contentFrame}

package/corpus/templates/analytics/app/pages/adhoc/sql-dashboard/SqlChartCard.tsx

@@ -67,6 +67,7 @@ interface SqlChartCardProps {
   isDragSource?: boolean;
   selectedForChat?: boolean;
   onSelectForChat?: (options?: SelectDashboardPanelOptions) => void;
+  extensionContext?: Record<string, unknown> | null;
 }
 
 const PanelDragHandle = memo(function PanelDragHandle({
@@ -122,6 +123,7 @@ export function SqlChartCard({
   isDragSource = false,
   selectedForChat = false,
   onSelectForChat,
+  extensionContext,
 }: SqlChartCardProps) {
   const t = useT();
   const queryClient = useQueryClient();
@@ -346,6 +348,7 @@ export function SqlChartCard({
             panel={panel}
             resolvedSql={resolvedSql}
             loadData
+            extensionContext={extensionContext}
           />
         )}
         <div className="absolute right-1 top-1 flex items-center gap-1 opacity-0 group-hover:opacity-100">
@@ -435,6 +438,7 @@ export function SqlChartCard({
                   panel={panel}
                   resolvedSql={resolvedSql}
                   loadData
+                  extensionContext={extensionContext}
                 />
               </ChartFillHeight>
             </div>
@@ -616,6 +620,7 @@ export function SqlChartCard({
             resolvedSql={resolvedSql}
             loadData={shouldLoadData}
             onExportCsvChange={handleExportCsvChange}
+            extensionContext={extensionContext}
           />
         </CardContent>
       </Card>
@@ -627,7 +632,12 @@ export function SqlChartCard({
           </DialogHeader>
           <div className="flex min-h-0 flex-1 flex-col overflow-auto">
             <ChartFillHeight>
-              <SqlChart panel={panel} resolvedSql={resolvedSql} loadData />
+              <SqlChart
+                panel={panel}
+                resolvedSql={resolvedSql}
+                loadData
+                extensionContext={extensionContext}
+              />
             </ChartFillHeight>
           </div>
         </DialogContent>

package/corpus/templates/analytics/app/pages/adhoc/sql-dashboard/extension-slot.ts

@@ -0,0 +1,11 @@
+/**
+ * Stable extension-point name for a dashboard box. The dashboard and panel ids
+ * are encoded independently so arbitrary saved ids cannot collapse into one
+ * slot or add path separators to the slots API.
+ */
+export function dashboardExtensionSlotId(
+  dashboardId: string,
+  panelId: string,
+): string {
+  return `analytics.dashboard.${encodeURIComponent(dashboardId)}.panel.${encodeURIComponent(panelId)}`;
+}

package/corpus/templates/analytics/app/pages/adhoc/sql-dashboard/index.tsx

@@ -142,6 +142,7 @@ import {
   resolveFilterVars,
 } from "./DashboardFilterBar";
 import { EmailReportDialog } from "./EmailReportDialog";
+import { dashboardExtensionSlotId } from "./extension-slot";
 import { interpolate } from "./interpolate";
 import { serializePanelSql } from "./panel-sql";
 import { AddPanelPopover, PanelEditorDialog } from "./PanelEditorDialog";
@@ -271,6 +272,7 @@ const PanelCell = memo(function PanelCell({
   onRemovePanel,
   onEditPanel,
   onSavePanel,
+  dashboardExtensionContext,
 }: {
   panel: SqlPanel;
   vars: Record<string, string>;
@@ -286,6 +288,7 @@ const PanelCell = memo(function PanelCell({
   onRemovePanel: (panelId: string) => void;
   onEditPanel: (panel: SqlPanel) => void;
   onSavePanel: (panel: SqlPanel) => Promise<void>;
+  dashboardExtensionContext: Record<string, unknown>;
 }) {
   const resolved = useMemo(
     () =>
@@ -366,6 +369,23 @@ const PanelCell = memo(function PanelCell({
         isDragSource={isDragSource}
         selectedForChat={selectedForChat}
         onSelectForChat={handleSelectForChat}
+        extensionContext={
+          panel.chartType === "extension"
+            ? {
+                ...dashboardExtensionContext,
+                panel: {
+                  id: panel.id,
+                  title: panel.title,
+                  slotId:
+                    panel.config?.extensionSlotId ??
+                    dashboardExtensionSlotId(
+                      String(dashboardExtensionContext.dashboardId),
+                      panel.id,
+                    ),
+                },
+              }
+            : undefined
+        }
       />
     </div>
   );
@@ -1966,6 +1986,13 @@ export default function SqlDashboardPage() {
                                 onRemovePanel={removePanel}
                                 onEditPanel={openEditPanel}
                                 onSavePanel={handleSavePanel}
+                                dashboardExtensionContext={{
+                                  dashboardId,
+                                  dashboardName: dashboard.name,
+                                  dashboardDescription:
+                                    dashboard.description ?? null,
+                                  filters: vars,
+                                }}
                               />
                               <DashboardDropLine
                                 slot={{

package/corpus/templates/analytics/app/pages/adhoc/sql-dashboard/types.ts

@@ -99,8 +99,14 @@ export interface SqlPanelConfig {
   /**
    * Extension panels only (`chartType: "extension"`): id of the extension to
    * render inline as a sandboxed iframe instead of running the SQL pipeline.
+   * Kept for dashboards saved before slot-backed dashboard boxes.
    */
   extensionId?: string;
+  /**
+   * Extension panels only: a named extension-point slot. The dashboard renders
+   * its installed extensions as this panel's box and supplies dashboard context.
+   */
+  extensionSlotId?: string;
 }
 
 export interface SqlPanel {

package/corpus/templates/analytics/changelog/2026-07-17-dashboard-extension-boxes.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-07-17
+---
+
+Dashboards can now host installed extensions as contextual, slot-backed boxes.

package/corpus/templates/analytics/server/lib/agent-readable-resource-context.ts

@@ -64,6 +64,14 @@ function panelSummaries(config: Record<string, unknown>) {
         typeof panelConfig.description === "string"
           ? panelConfig.description
           : undefined,
+      extensionId:
+        typeof panelConfig.extensionId === "string"
+          ? panelConfig.extensionId
+          : undefined,
+      extensionSlotId:
+        typeof panelConfig.extensionSlotId === "string"
+          ? panelConfig.extensionSlotId
+          : undefined,
     };
   });
 }