feat(admin): allow trusted plugins to add editor panels

[logelog]

What does this PR do?

Adds a focused contentEditorPanels extension contract for trusted React plugins. Plugins can contribute host-framed panels to the saved-entry settings sidebar while EmDash retains layout ownership, collection and role filtering, disabled-plugin lifecycle handling, deterministic ordering, and render-error isolation.

New entries keep the native editor unchanged. A failing contribution cannot take down the editor.

Discussion: #2105

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation (if applicable). Do not include messages.po changes except in translation PRs - a workflow extracts catalogs on merge to main.
• I have added a changeset (if this PR changes a published package)
• New features link to an approved Discussion: Trusted native content editor extension panels #2105

Screenshots / test output

• pnpm typecheck
• pnpm lint - 0 warnings, 0 errors
• pnpm format
• 25 focused resolver and editor integration tests passed

[changeset-bot]

🦋 Changeset detected

Latest commit: 28139f7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 17 packages

Name	Type
emdash	Minor
@emdash-cms/admin	Minor
@emdash-cms/cloudflare	Minor
@emdash-cms/sandbox-workerd	Patch
@emdash-cms/plugin-mcp-smoke	Major
@emdash-cms/fixture-perf-site	Patch
@emdash-cms/perf-demo-site	Patch
@emdash-cms/cache-demo-site	Patch
@emdash-cms/do-demo-site	Patch
@emdash-cms/do-solo-demo-site	Patch
@emdash-cms/auth	Minor
@emdash-cms/blocks	Minor
@emdash-cms/gutenberg-to-portable-text	Minor
@emdash-cms/x402	Minor
create-emdash	Minor
@emdash-cms/auth-atproto	Patch
@emdash-cms/plugin-embeds	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Scope check

This PR changes 548 lines across 10 files. Large PRs are harder to review and more likely to be closed without review.

If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs.

See CONTRIBUTING.md for contribution guidelines.

[pkg-pr-new]

Open in StackBlitz

@emdash-cms/admin

npm i https://pkg.pr.new/@emdash-cms/admin@2187

@emdash-cms/auth

npm i https://pkg.pr.new/@emdash-cms/auth@2187

@emdash-cms/auth-atproto

npm i https://pkg.pr.new/@emdash-cms/auth-atproto@2187

@emdash-cms/blocks

npm i https://pkg.pr.new/@emdash-cms/blocks@2187

@emdash-cms/cloudflare

npm i https://pkg.pr.new/@emdash-cms/cloudflare@2187

@emdash-cms/contentful-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/contentful-to-portable-text@2187

emdash

npm i https://pkg.pr.new/emdash@2187

create-emdash

npm i https://pkg.pr.new/create-emdash@2187

@emdash-cms/gutenberg-to-portable-text

npm i https://pkg.pr.new/@emdash-cms/gutenberg-to-portable-text@2187

@emdash-cms/plugin-cli

npm i https://pkg.pr.new/@emdash-cms/plugin-cli@2187

@emdash-cms/plugin-types

npm i https://pkg.pr.new/@emdash-cms/plugin-types@2187

@emdash-cms/registry-client

npm i https://pkg.pr.new/@emdash-cms/registry-client@2187

@emdash-cms/registry-lexicons

npm i https://pkg.pr.new/@emdash-cms/registry-lexicons@2187

@emdash-cms/registry-verification

npm i https://pkg.pr.new/@emdash-cms/registry-verification@2187

@emdash-cms/sandbox-workerd

npm i https://pkg.pr.new/@emdash-cms/sandbox-workerd@2187

@emdash-cms/x402

npm i https://pkg.pr.new/@emdash-cms/x402@2187

@emdash-cms/plugin-ai-moderation

npm i https://pkg.pr.new/@emdash-cms/plugin-ai-moderation@2187

@emdash-cms/plugin-atproto

npm i https://pkg.pr.new/@emdash-cms/plugin-atproto@2187

@emdash-cms/plugin-audit-log

npm i https://pkg.pr.new/@emdash-cms/plugin-audit-log@2187

@emdash-cms/plugin-color

npm i https://pkg.pr.new/@emdash-cms/plugin-color@2187

@emdash-cms/plugin-embeds

npm i https://pkg.pr.new/@emdash-cms/plugin-embeds@2187

@emdash-cms/plugin-field-kit

npm i https://pkg.pr.new/@emdash-cms/plugin-field-kit@2187

@emdash-cms/plugin-forms

npm i https://pkg.pr.new/@emdash-cms/plugin-forms@2187

@emdash-cms/plugin-webhook-notifier

npm i https://pkg.pr.new/@emdash-cms/plugin-webhook-notifier@2187

commit: 28139f7

[emdashbot]

The change is a focused, well-scoped feature that fits EmDash's trusted-plugin model: it adds a contentEditorPanels export contract, resolves/filters panels using PluginAdminContext and the admin manifest, renders them in host-owned settings-sidebar sections, and isolates failures with a React error boundary. The implementation is clean, focused tests and docs are present, and the changeset is appropriate.

One process note: the PR checklist item "New features link to an approved Discussion" is left unchecked even though the description links to Discussion #2105. That box should be ticked, or the approval status confirmed, before merge per the feature PR policy.

One code finding: the new error boundary's retry button is a raw <button> despite the AGENTS.md rule to use Kumo components. It mirrors the existing PluginFieldErrorBoundary pattern, but new code should migrate to Kumo Button instead. Otherwise the changed files are in good shape and the new conventions (Lingui wrapping, RTL-safe logical classes, manifest lifecycle filtering) are followed.

[emdashbot]

[suggestion] The fallback UI uses a raw <button> with hand-rolled Tailwind classes (text-kumo-brand underline). AGENTS.md requires using Kumo components rather than custom buttons so the control gets Kumo focus rings, sizing, and dark-mode/RTL behavior for free. Import Button from @cloudflare/kumo and use it here (and, separately, migrate the identical pattern in the pre-existing PluginFieldErrorBoundary).

Suggested change

	<button
	type="button"
	className="mt-1 text-xs font-medium text-kumo-brand underline"
	onClick={() => this.setState({ hasError: false })}
	>
	<Trans>Retry</Trans>
	</button>
	<Button
	type="button"
	variant="ghost"
	size="sm"
	className="mt-1"
	onClick={() => this.setState({ hasError: false })}
	>
	<Trans>Retry</Trans>
	</Button>

[github-actions]

Overlapping PRs

This PR modifies files that are also changed by other open PRs:

• feat(admin): make content settings sections reorderable #2185 (3 shared files)

This may cause merge conflicts or duplicated work. A maintainer will coordinate.

[emdashbot]

The feature is a focused, well-scoped extension that fits EmDash's trusted-plugin model: it adds a contentEditorPanels export contract, resolves/filters panels via PluginAdminContext and the admin manifest, renders them in host-owned settings-sidebar sections, and isolates failures with a React error boundary. The approach is right for the problem.

Status of prior findings:

• ✅ The previous Kumo Button finding is resolved — ContentEditorPanelBoundary now imports and uses Button from @cloudflare/kumo instead of a raw <button>.
• ⚠️ The process note from the last review remains: the PR checklist item "New features link to an approved Discussion" is still unchecked. The description links to Discussion #2105, but per the feature PR policy the box should be ticked (or the approval status explicitly confirmed) before merge.

What I checked:

• Panel contract, validation, manifest lifecycle filtering, collection/role filtering, deterministic ordering, and render-error recovery in packages/admin/src/lib/content-editor-panels.tsx.
• Integration into ContentSettingsPanel and the manifest pass-through from ContentEditor.
• RTL/Tailwind classes, Lingui wrapping, Kumo component use, and comment discipline against AGENTS.md.
• Test coverage in ContentSettingsPanel.test.tsx and the new content-editor-panels.test.tsx.
• Changeset quality and documentation in react-admin.mdx.
• No changes touch server routes, SQL, content-table queries, or logged-out query counts.

Headline conclusion: The implementation is clean, the new tests and docs are appropriate, and the changeset is user-facing. No code defects were found. Once the Discussion checkbox is confirmed/ticked, this is ready to merge.