docs: update What's New page (2026-04-16)

[edspencer]

Summary

Adds a new changelog entry for the Windows Path Separator Fix released in @herdctl/core@5.10.1 on March 17, 2026.

Changes

• Added changelog entry documenting the fix for path traversal validation on Windows
• Updated agents/changelog/state.md tracking:
  • last_checked_commit: 6053872 → 3662d18
  • 4 commits analyzed, 1 user-facing entry added
  • Current branch: changelog/auto-update-2026-04-16

Test Plan

• Entry follows existing changelog format
• Date and package versions are accurate
• State tracking updated correctly
• Branch naming follows convention

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Fixed path traversal validation on Windows to properly handle platform-specific path separators, preventing spurious validation errors during file operations.

• Documentation

  • Updated security audit documentation with latest findings and vulnerability assessments.
  • Added Windows path separator fix details to "What's New" section.

• Chores

  • Updated internal agent state tracking and changelog metadata.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates multiple agent state files and security audit documentation, advancing timestamps across changelog, documentation, engineer, and security tracking systems. New security findings (#013 npm vulnerabilities) are introduced with audit reports, and a Windows path separator validation fix is documented in the public What's New section.

Changes

Cohort / File(s)	Summary
Changelog and Documentation Agent State agents/changelog/state.md, agents/docs/state.md	Updated last_checked_commit, last_run timestamps, and entry/gap counts reflecting recent audit runs. Added new run history table entries for April dates.
Engineer Agent State and Logs agents/engineer/state.md, agents/engineer/conversations.md	Updated last_active timestamp from March 12 to April 15. Appended multiple daily housekeeping conversation entries documenting state file maintenance checks for April 2–15. Incremented token_estimate from 2000 to 2500.
Security Audit State and Findings agents/security/STATE.md, agents/security/intel/FINDINGS-INDEX.md, agents/security/scans/history.txt	Advanced audit date from 2026-03-06 to 2026-04-11. Introduced Finding #013 (npm dependency vulnerability escalation with 41 total vulnerabilities). Marked Finding #008 as superseded. Updated coverage tracking and added new scan history entries.
Security Audit Reports agents/security/intel/2026-04-11.md, agents/security/summaries/2026-04-11-summary.md, agents/security/summaries/2026-04-13-summary.md, agents/security/summaries/latest.md	Created new audit report for 2026-04-11 documenting path traversal hardening, Discord file attachment controls, and voice transcription integration. Added executive summaries for April 11 and 13. Updated latest summary pointer.
Public Documentation docs/src/content/docs/whats-new.md	Added new "Windows Path Separator Fix" entry for version @herdctl/core@5.10.1, documenting buildSafeFilePath() improvements for cross-platform path validation.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• fix: use path.sep in path traversal check for Windows compatibility #210: Introduces and documents the Windows path-separator/path-traversal hardening in buildSafeFilePath() that is referenced in the What's New documentation addition.
• docs: update What's New page (2026-03-13) #206: Previous automated changelog and documentation state update that this PR advances by moving last_checked_commit and updating run history entries.
• docs: auto-update documentation (2026-03-07) #199: Concurrent security audit and documentation updates touching the same path-traversal hardening improvements and security findings area.

Poem

🐰 Hops through April's audit trail,
State files hop along the way,
Path separator woes now pale,
Security findings dance in play,
Nine findings hopping strong and true! 🔐

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main change: updating the What's New documentation page with a new changelog entry for the Windows path separator fix, dated 2026-04-16.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch changelog/auto-update-2026-04-16

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cloudflare-workers-and-pages]

Deploying herdctl with    Cloudflare Pages

Latest commit:	b3d268a
Status:	✅  Deploy successful!
Preview URL:	https://3135e207.herdctl.pages.dev
Branch Preview URL:	https://changelog-auto-update-2026-0-l131.herdctl.pages.dev

View logs

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

agents/changelog/state.md (1)

11-11: ⚠️ Potential issue | 🟡 Minor

Update the stale displayed timestamp.

Line 11 still shows 2026-02-25T04:05:06Z, but this file was updated for the 2026-04-16 run. This creates conflicting state metadata.

Suggested fix

-**Last Updated:** 2026-02-25T04:05:06Z
+**Last Updated:** 2026-04-16T00:00:00Z

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@agents/changelog/state.md` at line 11, Update the stale timestamp string in
agents/changelog/state.md by replacing the existing "2026-02-25T04:05:06Z" value
with the correct run timestamp for the 2026-04-16 update (use the same ISO8601
format, e.g. "2026-04-16T00:00:00Z" or the precise run time), so the metadata
displayed by the file (the "Last Updated" entry) matches the actual 2026-04-16
run.

🧹 Nitpick comments (2)

agents/security/intel/FINDINGS-INDEX.md (1)

289-305: Consider adding language specifiers to code fence blocks.

The code blocks at lines 289-292 (growth trend) and 300-305 (scanner output) are missing language specifiers.

📝 Suggested improvements

For the growth trend block (line 289):

-```
+```text
 2026-03-06:  0 critical,  4 high,  4 moderate
 2026-04-11:  2 critical, 15 high, 24 moderate

For the scanner output block (line 300):
```diff
-```
+```text
 npm-audit: 3 findings
   - CRITICAL: 2 critical vulnerabilities in dependencies
   - HIGH: 15 high severity vulnerabilities in dependencies
   - MEDIUM: 24 moderate vulnerabilities in dependencies

</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against the current code and only fix it if needed.

In @agents/security/intel/FINDINGS-INDEX.md around lines 289 - 305, The fenced
code blocks showing the growth trend and the scanner output in FINDINGS-INDEX.md
are missing language specifiers; update the two code fences around the growth
trend lines ("2026-03-06: …" / "2026-04-11: …") and the scanner output block
("npm-audit: 3 findings …") to include a language token (e.g., ```text) so they
render and highlight consistently in markdown viewers.

</details>

</blockquote></details>
<details>
<summary>agents/security/summaries/latest.md (1)</summary><blockquote>

`1-1`: **LGTM - latest summary pointer updated correctly.**

The file correctly points to the new 2026-04-13 security summary.


**Optional:** Consider adding a trailing newline at end of file for POSIX compliance.

<details>
<summary>🤖 Prompt for AI Agents</summary>

```
Verify each finding against the current code and only fix it if needed.

In `@agents/security/summaries/latest.md` at line 1, Add a POSIX-compliant
trailing newline to the file latest.md by ensuring the file ends with a single
newline character (i.e., append a newline after the final line that points to
2026-04-13-summary.md); keep the pointer text unchanged and commit the file with
the newline at EOF.
```

</details>

</blockquote></details>

</blockquote></details>

<details>
<summary>🤖 Prompt for all review comments with AI agents</summary>

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @agents/security/intel/2026-04-11.md:

• Around line 23-25: The summary block incorrectly reports "High Issues: 0 new"
  while the report creates a HIGH finding labeled "Finding #013"; update the
  summary count to reflect that one high issue is new (or programmatically compute
  the summary from the findings list) so the "High Issues" value matches the
  presence of Finding #013; locate the summary text that contains the string "High
  Issues:" and change its value from 0 to 1 (or wire it to the findings-generation
  logic) to keep the counts consistent with the entries such as "Finding #013".

In @agents/security/STATE.md:

• Line 8: The state file has inconsistent counts: update the open_questions
  top-level value to match the actual enumerated list (make open_questions 11 if
  the list at the "open questions" section is correct), and adjust the severity
  summary values (e.g., change Low: 3 to Low: 4 or remove the extra list item)
  so every summary/count (the open_questions header and the severity counts)
  exactly matches the number of items in their corresponding enumerated lists;
  verify all other summary numbers in the file match their lists and run a quick
  grep to ensure no other mismatched counts remain.

In @agents/security/summaries/2026-04-11-summary.md:

• Around line 152-161: Update the incorrect header count for ongoing questions:
  change the string "Ongoing Questions (8):" to "Ongoing Questions (9):"
  so it matches the nine listed items (Q1, Q4, Q5, Q7, Q8, Q9, Q10, Q11, Q13) in
  the summary; ensure the header token and its numeric value in the markdown match
  the list items in agents/security/summaries/2026-04-11-summary.md (look for the
  exact header text "Ongoing Questions (8):") and adjust it to 9.

---

Outside diff comments:
In @agents/changelog/state.md:

• Line 11: Update the stale timestamp string in agents/changelog/state.md by
  replacing the existing "2026-02-25T04:05:06Z" value with the correct run
  timestamp for the 2026-04-16 update (use the same ISO8601 format, e.g.
  "2026-04-16T00:00:00Z" or the precise run time), so the metadata displayed by
  the file (the "Last Updated" entry) matches the actual 2026-04-16 run.

---

Nitpick comments:
In @agents/security/intel/FINDINGS-INDEX.md:

• Around line 289-305: The fenced code blocks showing the growth trend and the
  scanner output in FINDINGS-INDEX.md are missing language specifiers; update the
  two code fences around the growth trend lines ("2026-03-06: …" / "2026-04-11:
  …") and the scanner output block ("npm-audit: 3 findings …") to include a
  language token (e.g., ```text) so they render and highlight consistently in
  markdown viewers.

In @agents/security/summaries/latest.md:

• Line 1: Add a POSIX-compliant trailing newline to the file latest.md by
  ensuring the file ends with a single newline character (i.e., append a newline
  after the final line that points to 2026-04-13-summary.md); keep the pointer
  text unchanged and commit the file with the newline at EOF.

</details>

<details>
<summary>🪄 Autofix (Beta)</summary>

Fix all unresolved CodeRabbit comments on this PR:

- [ ] <!-- {"checkboxId": "4b0d0e0a-96d7-4f10-b296-3a18ea78f0b9"} --> Push a commit to this branch (recommended)
- [ ] <!-- {"checkboxId": "ff5b1114-7d8c-49e6-8ac1-43f82af23a33"} --> Create a new PR with the fixes

</details>

---

<details>
<summary>ℹ️ Review info</summary>

<details>
<summary>⚙️ Run configuration</summary>

**Configuration used**: defaults

**Review profile**: CHILL

**Plan**: Pro

**Run ID**: `edd617ee-b881-46c1-80e7-75044042ec1d`

</details>

<details>
<summary>📥 Commits</summary>

Reviewing files that changed from the base of the PR and between 3662d1851523cf49da28bfa6583408905ae35f60 and b3d268a995dc447c26d614eb4155c2a74f4abe8c.

</details>

<details>
<summary>📒 Files selected for processing (12)</summary>

* `agents/changelog/state.md`
* `agents/docs/state.md`
* `agents/engineer/conversations.md`
* `agents/engineer/state.md`
* `agents/security/STATE.md`
* `agents/security/intel/2026-04-11.md`
* `agents/security/intel/FINDINGS-INDEX.md`
* `agents/security/scans/history.txt`
* `agents/security/summaries/2026-04-11-summary.md`
* `agents/security/summaries/2026-04-13-summary.md`
* `agents/security/summaries/latest.md`
* `docs/src/content/docs/whats-new.md`

</details>

</details>

<!-- This is an auto-generated comment by CodeRabbit for review status -->

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Align “High Issues” with Finding #013 creation.

Line 24 says 0 new high issues, but Line 61 records a new HIGH finding (#013). Please make these consistent.

Suggested fix

-- **High Issues:** 0 new (dependency vulns require triage)
+- **High Issues:** 1 new (`#013` dependency vulnerability escalation; triage required)

Also applies to: 61-61

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@agents/security/intel/2026-04-11.md` around lines 23 - 25, The summary block
incorrectly reports "High Issues: 0 new" while the report creates a HIGH finding
labeled "Finding `#013`"; update the summary count to reflect that one high issue
is new (or programmatically compute the summary from the findings list) so the
"High Issues" value matches the presence of Finding `#013`; locate the summary
text that contains the string "High Issues:" and change its value from 0 to 1
(or wire it to the findings-generation logic) to keep the counts consistent with
the entries such as "Finding `#013`".

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Fix inconsistent open-question counts across the state file.

Counts conflict in multiple places:

• Line 8 says open_questions: 10
• Line 28 enumerates 11 open questions
• Line 45 says Low: 3 but lists 4 items

Please reconcile these so dashboards/triage don’t drift.

Suggested fix (if 11 open questions is correct)

-open_questions: 10
+open_questions: 11
...
-| Open questions | 10 | Q1, Q4, Q5, Q7, Q8, Q9, Q10, Q11, Q13, Q15, Q16 (5 answered) |
+| Open questions | 11 | Q1, Q4, Q5, Q7, Q8, Q9, Q10, Q11, Q13, Q15, Q16 (5 answered) |
...
-- Low: 3 (Q9 rate limiting, Q10 MCP security, Q11 GitHub SSRF, Q16 voice retention)
+- Low: 4 (Q9 rate limiting, Q10 MCP security, Q11 GitHub SSRF, Q16 voice retention)

Also applies to: 28-28, 44-46

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@agents/security/STATE.md` at line 8, The state file has inconsistent counts:
update the `open_questions` top-level value to match the actual enumerated list
(make `open_questions` 11 if the list at the "open questions" section is
correct), and adjust the severity summary values (e.g., change `Low: 3` to `Low:
4` or remove the extra list item) so every summary/count (the `open_questions`
header and the severity counts) exactly matches the number of items in their
corresponding enumerated lists; verify all other summary numbers in the file
match their lists and run a quick grep to ensure no other mismatched counts
remain.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Correct the ongoing-question total.

Line 152 says 8, but Lines 153–161 list 9 questions.

Suggested fix

-**Ongoing Questions (8):**
+**Ongoing Questions (9):**

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	**Ongoing Questions (8):**
	- Q1: Webhook authentication (related to #012)
	- Q4: Log injection via agent output
	- Q5: Fleet/agent config merge overrides
	- Q7: Container user UID handling
	- Q8: SDK wrapper prompt escaping
	- Q9: Rate limiting on triggers
	- Q10: MCP security model
	- Q11: GitHub SSRF (confirmed, mitigations present)
	- Q13: encodedPath explicit validation (partially answered)
	**Ongoing Questions (9):**
	- Q1: Webhook authentication (related to `#012`)
	- Q4: Log injection via agent output
	- Q5: Fleet/agent config merge overrides
	- Q7: Container user UID handling
	- Q8: SDK wrapper prompt escaping
	- Q9: Rate limiting on triggers
	- Q10: MCP security model
	- Q11: GitHub SSRF (confirmed, mitigations present)
	- Q13: encodedPath explicit validation (partially answered)

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@agents/security/summaries/2026-04-11-summary.md` around lines 152 - 161,
Update the incorrect header count for ongoing questions: change the string
"**Ongoing Questions (8):**" to "**Ongoing Questions (9):**" so it matches the
nine listed items (Q1, Q4, Q5, Q7, Q8, Q9, Q10, Q11, Q13) in the summary; ensure
the header token and its numeric value in the markdown match the list items in
agents/security/summaries/2026-04-11-summary.md (look for the exact header text
"**Ongoing Questions (8):**") and adjust it to 9.