grafana-pathfinder-app v2.12.1

2.12.0

Added

• Section-level requirements "Fix this" button: Section requirement banners now expose the same "Fix this" affordance individual steps already provide. When a section's location requirement fails, the banner shows a user-friendly explanation and a button that dispatches the existing fix infrastructure (NavigationManager, getRequirementExplanation) — no new patterns, no new recovery paths. Closes #476. (#884)
• Highlighted-guide experiment auto-launches the guide tab: The pathfinder.highlighted-guide-experiment flag now opens the configured guide directly as a sidebar tab on matched pages (parity with ?doc=), instead of only opening the sidebar and pinning the recommendations tab. Featured-slot injection still runs in parallel as a fallback re-entry point. (#897)
• Centralised deep-linking with SPA navigation listener: The ?doc= / ?panelMode= / ?kiosk_session= deep-link flow now re-runs on subsequent SPA navigations, not just at plugin module load. Users can deep-link to Pathfinder from another page in Grafana — useful when downstream plugins (e.g. setup-guide) hand users off mid-session. (#904)

Fixed

• Floating panel preserved milestone on dock-back: Floating mode snapshotted localStorage at pop-out and restored it verbatim on dock-back, overwriting milestone progress made in the floating panel. All surfaces now share tabStorage and the latest currentUrl wins on mount; the snapshot mechanism is removed and the pop-out handoff awaits saveTabsToStorage() before flipping mode. (#928)
• Starting-location prompt is one-shot per guide launch: The implied-0th-step alignment prompt grew a reactive re-evaluation loop that fired on every Grafana history change, pausing guides mid-flow when they stepped the user across pages. The prompt now evaluates once at guide launch and never re-surfaces. Net -643 lines. (#926)
• Popout panel milestone navigation + theme conformance: The floating panel now mounts the shared milestone toolbar (prev/next arrows, "Milestone X of Y", Open, Reset, keyboard shortcuts) and wraps its standalone React root in ThemeContext.Provider, so it matches Grafana's light/dark theme and live-updates on theme toggle. (#925)
• "Fix this" docks the nav from overlay state: openAndDockNavigation() previously bailed without docking whenever nav items were visible in the DOM, conflating "already docked" and "overlay mode." A new aria-label discriminator (#dock-menu-button reads "Dock menu" in overlay, "Undock menu" when docked) clicks the button only in the overlay case. Closes #910. (#921)
• Completion store persists additive merge from hydration resolve: A race between an in-flight section hydration read and a synchronous markStepCompleted write could overwrite the on-disk snapshot, then silently leave storage out of sync with the in-memory merge. The hydration .then resolver now persists when it adds new IDs, not only when it clears. F-5 follow-up to #909. (#919)
• All-passive guide reports 100% when acknowledged: Guides with entirely passive sections stayed at 0% in the progress chip and My Learning row even after every section was acknowledged, because the ack writer routed through sectionAcknowledgementStorage while the completion store read from interactiveStepStorage. The completion store now reads ack counts directly. F-1 follow-up to #909. (#917)
• Browser storage quota toast: All four QuotaExceededError catch blocks in user-storage.ts previously swallowed the error into a console.warn, so users never learned their progress had silently stopped persisting. A single alertWarning toast now fires the first time any catch block trips: "Browser storage full. Your progress may not be saved. Try resetting old guide progress via My Learning to free up space." N-3 follow-up to #909. (#913)
• Cross-tab completion-store sync: With the same guide open in two tabs, each tab had its own module-scope completion-store cache while sharing localStorage. Tab B's stale cache could silently write back over tab A's authoritative reset. A new module-scope storage event listener plus a hydration-generation counter close the race. N-2 follow-up to #909. (#912)
• Feature-flag exposure fires on override + documented /packages URL form: The pathfinder_feature_flag_evaluated event only fired on real OpenFeature evaluations, so clearExposures() / showExposures() were no-ops for any override-driven QA run. Exposure reporting is now shared between the hook and the override branches. The required guideId URL form for interactive-learning.grafana.net guides is now documented up front in EXPERIMENT_TESTING.md. (#906)
• Refreshed Prometheus + Loki 101 bundled guides: Rebuilt against the current Grafana dashboard editor UX (edit sidebar instead of the legacy Add → Visualization menu). Headings and narrative copy switched to sentence case; leftover guided wrappers flattened to plain interactive steps. The Prometheus guide adds a new "Create a dashboard from Explore" section. (#905)
• Section header swaps to "Steps" when no interactive steps: Sections with no author-set title and only passive or noop children no longer show the misleading "Interactive section" header. Author-supplied titles are preserved verbatim. Closes #843. (#902)
• Floating panel resize constraints removed: The 600×700 popout panel max-width and max-height limits are gone — the panel can now be resized up to the full viewport. Default size and minimum bounds are unchanged. (#901)
• First-dashboard guides repaired against the new editor flow: OSS and Cloud first-dashboard guides now work end-to-end without page refreshes. Switched brittle raw selectors to Grafana's canonical e2e ids and fixed the underlying engine bug where InteractiveConditional did not re-render branches when exists-reftarget flipped after an action (added a debounced MutationObserver for portal-injected elements). (#900)
• Toast surfaces when guide reset fails: Replaces the TODO in useContentReset's catch block with an alertError toast published via getAppEvents. Completes #824. (#899)
• Block editor type-switch to terminal-connect: Adds terminal-connect to REQUIRED_DEFAULTS so converting from image, video, or content-less code-block no longer fails Zod validation and silently leaves the block type unchanged. (#892)
• Requirement buttons gain title + aria-describedby: Accessibility fix — interactive requirement buttons now expose a title tooltip and aria-describedby context for screen readers. (#908)

Security

• uuid and brace-expansion patches via scoped npm overrides: Patches CVE-2026-41907 (uuid out-of-bounds write in @grafana/ui via the v3/v5/v6 APIs; CVSS 7.5) by bumping uuid 11.1.0 → 11.1.1, and CVE-2026-33750 (brace-expansion DoS via zero-step patterns in minimatch@9; CVSS 6.5) by bumping brace-expansion 2.0.2 → 2.0.3. Both overrides are scoped to avoid touching already-patched siblings elsewhere in the tree. (#943)
• golang.org/x/crypto to v0.52.0: Resolves CVE-2026-39833 (the in-memory keyring silently accepting unsupported ConfirmBeforeUse constraints) and rides a routine 0.50 → 0.52 Go security advisory bump. (#937)
• lodash 4.17.23 → 4.18.1: Resolves CVE-2026-4800 (_.template code injection via untrusted options.imports key names; CVSS 8.1). Lock-file-only change; lodash is purely transitive via the @grafana/* packages and slate/slate-react. npm audit fix rode along a batch of unrelated transitive bumps (dompurify 3.3.2 → 3.4.7, fast-uri 3.0.6 → 3.1.2, flatted 3.3.3 → 3.4.2, hono 4.12.16 → 4.12.23, ip-address 10.1.0 → 10.2.0, terser-webpack-plugin 5.3.16 → 5.6.0, @grafana/scenes 8.2.5 → 8.2.6). Vulnerability count 22 → 11. (#936)
• Drop protobufjs to resolve CVE-2026-41242: Removes the vulnerable @protobufjs/utf8 transitive dependency entirely by bumping @grafana/faro-web-tracing 2.2.3 → 2.7.0 (whose @opentelemetry/otlp-transformer no longer requires protobufjs). @grafana/faro-react is pinned exact at 2.0.2 because newer versions add an incompatible react-router@7 peer; faro-web-sdk dedups across both packages. (#933)

Chore

• Default-to-no-comments rule + QC8 review check: New repo-wide policy in AGENTS.md defaulting to no comments, with a catalog of bad shapes (narrating obvious code, defending non-actions, dead process artefacts, stale-in-waiting renames) and a keep-list (counterintuitive code, hidden invariants, external-bug workarounds, security warnings). /review now checks QC8. (#932)
• Refactor: collapse state ownership in the interactive renderer: Whole-pipeline cleanup of the interactive-guide rendering layer. Completion state moves out of component lifetime into a module-scope canonical store at src/global-state/completion-store.ts (Tier 1); four legacy progress events collapse into one unified pathfinder:progress discriminated event; three architecture-test ratchet exceptions are removed. (#909)
• Migrate Go MCP tools to TypeScript and retire the Go MCP server: The architecture pivoted to a single centrally hosted TS MCP on Cloud Run plus Grafana Assistant's web-surface tools, so the per-tenant Go MCP is unused on the new path. Deletes pkg/plugin/mcp.go, the three /mcp* routes, the static guides directory, and the scripts/copy-static.js build step. (#888)
• @grafana/* to v13 majors + @grafana/scenes v8: Bumps @grafana/{data,schema,i18n} 12.4.3 → 13.0.1, @grafana/ui 12.4.2 → 13.0.1, @grafana/scenes 7.4.2 → 8.2.6, and adds @grafana/runtime ^13.0.0 (resolves to 13.0.1) as an explicit dep so the 65+ files that already import from it stop relying on the transitive peer. Also bumps @grafana/assistant 0.1.19 → 0.1.24 and @grafana/plugin-e2e 3.6.1 → 3.8.0. @grafana/faro-react is pinned at 2.0.2 because 2.1+ requires react-router@7. grafanaDependency stays at >=12.3.0-0. Supersedes #799. (#898)
• Refactor: extract docs-panel renderer into components + hooks: Following the High-Risk Refactor Guidelines, the docs-panel renderer drops from 2,681 → 1,555 LoC (-42%); the CombinedLearningJourneyPanel SceneObject is untouched. Renderer logic moved into 17 new files plus 18 new test files pinning behaviour. Deferred to a future slice: async state-machine decomposition of loadTabContent, the _hasRestoredTabs / _pendingLaunchSource registry rework, singleton-to-injectable migrations, and any contract-surface renames. (#894)
• Refactor: interactive-section Tier A + Tier B extractions: interactive-section.tsx drops 2,118 → 1,418 lines (-33%). Tier A landed four atomic extractions (section registry, numbering helpers, step-type schema table, single table-driven loop replacing two parallel switch chains); Tier B landed five hooks (auto-collapse, scroll, document-step-progress, requirements, persistence). Tier C (the 430-line handleDoSection async orchestrator) is deliberately deferred — one of the four gate criteria failed. (#885)
• Refactor: youtube-video typed content-key accessors (F-3 follow-up): Replaces three window.* globals with typed content-key accessors. F-3 follow-up to #909. (#918)
• Refactor: multi-step data parameter tightening (F-6 follow-up): Narrows the multi-step data parameter to InteractiveElementData. F-6 follow-up to #909. (#916)
• Refactor: extract toResourceName and applyAuthorNote helpers: Block editor helper extractions, no behaviour change. (#924)
• Test: pin sibling re-render on completion-store flip (F-2 follow-up): Regression tripwire that re-renders sibling sections when the completion store flips on another section. F-2 follow-up to #909. (#920)
• Remove unused custom event listeners: Drops the dead grafana:location-changed listeners that the new SPA-navigation listener supersedes. (#922)
• Docs: promote /review to a real skill and re-home pr-review.md: .cursor/skills/review/SKILL.md becomes the orchestration entry point; docs/design/PR_REVIEW.md holds the pattern catalog. (#911)
• Docs: document step-model type-change orphan caveat (N-4 follow-up): STEP_MODEL.md now documents the orphan caveat for stable step IDs across type changes. N-4 follow-up to #909. (#915)
• Docs: document evictContentCache subscriber locality (N-5 follow-up): Documents the load-bearing invariant that every storage-clear path must also evict the in-memory cache. N-5 follow-up to #909. (#914)
• Docs: trim AGENTS.md baseline by ~70%: Compression pass on AGENTS.md to remove duplicated subsystem detail that lives in .cursor/rules/systemPatterns.mdc. Adds a routing table for on-demand context. (#891)
• plugin-ci-workflows CD v7.3.1 → v8.0.1 (GATB) (#931)
• grafana/plugin-actions digest update (#890)