Issues

[Bug bounty] monk.install.run fails 9 in a row with the same 'Monk CLI and daemon need to be installed.' string — same string across 4 workspace contexts, no diagnostic context

monk-io/monk-plugin#485 · opened

on Aug 31, 2026

1

[Bug bounty] monk.workload.stop error string contains UTF-16 LE NUL bytes between every character — terminal renders disconnect, downstream grep fails

monk-io/monk-plugin#484 · opened

on Aug 31, 2026

1

[Bug bounty] monk.cluster.upgrade accepts approval for raw 'not-a-version' string — semver/version-shape validation happens only post-approval, not at MCP boundary

monk-io/monk-plugin#483 · opened

on Aug 31, 2026

1

[Bug bounty] monk.cluster.create logs workspaceRoot='C:\Windows\System32' against an active workspace session — workspace-context binding leaks across dashboard tabs (gauntlet step 4)

monk-io/monk-plugin#482 · opened

on Aug 31, 2026

1

[Bug bounty] monk.watcher.remove emits 4 distinct error shapes in 95 min — no error-shape categorisation, no retry-hint, no escalation path

monk-io/monk-plugin#481 · opened

on Aug 31, 2026

1

[Bug bounty] Windows install-wsl-distro times out before a healthy slow Ubuntu rootfs download can finish

monk-io/monk-plugin#477 · opened

on Aug 31, 2026

[Bug bounty] monk.install.status ready:true contradicts monk.runtime.status ready:false — monkd-ping ok while monk-cli fails (simultaneous MCP split-brain)

monk-io/monk-plugin#473 · opened

on Aug 31, 2026

4

[Bug bounty] Antigravity PreInvocation hook never auto-updates monk-agent — skips scripts/ensure-monk-agent bootstrap

monk-io/monk-plugin#472 · opened

on Aug 31, 2026

3

[Bug bounty] PreToolUse block-monk fallback regex bypassed by shell separators (monk; / monk& / monk|)

monk-io/monk-plugin#471 · opened

on Aug 30, 2026

4

[Bug bounty] Cross-platform hook execution fails on Linux/POSIX due to unescaped Windows backslashes in hooks. json

monk-io/monk-plugin#466 · opened

on Aug 30, 2026

3

[Bug bounty] `monk --json status` reports cluster:true and `monk cluster info` prints a monkcode for Cluster Name local while MCP cluster.list is [] and context.mode is local

monk-io/monk-plugin#464 · opened

on Aug 30, 2026

3

[Bug bounty] dashboard.open {path:"/?item=not-a-uuid"} returns ok:true with that path in the URL — no validation that the item exists

monk-io/monk-plugin#463 · opened

on Aug 30, 2026

[Bug bounty] Unauthenticated POST /auth/register creates a pending dashboard security approval “Connect monk-agent-client-<uuid> to Monk”

monk-io/monk-plugin#462 · opened

on Aug 30, 2026

1

[Bug bounty] `monk system ns-list --depth` defaults to 2147483647 (2^31-1)

monk-io/monk-plugin#461 · opened

on Aug 30, 2026

2

[Bug bounty] cluster.status info.addresses lists the same multiaddrs twice (n=2× unique) when connected to the phantom local cluster

monk-io/monk-plugin#459 · opened

on Aug 30, 2026

[Bug bounty] `monk system ns-list` hangs (no output until killed) even with `-d 1 /`; help default depth is 2147483647

monk-io/monk-plugin#458 · opened

on Aug 30, 2026

[Bug bounty] package.search query:"*" returns the registry catalog (available:true) instead of requiring a real search string

monk-io/monk-plugin#456 · opened

on Aug 30, 2026

[Bug bounty] cluster.ingress.list_certificates throws “ingress plugin is not enabled” while cluster.ingress.status returns {enabled:false} with no error — same moment, local mode

monk-io/monk-plugin#455 · opened

on Aug 30, 2026

[Bug bounty] watcher.status reports connected:true and lists system/watcher-agent + watcher-ai (deployed:false) while cluster.list is [] and context.mode is local

monk-io/monk-plugin#454 · opened

on Aug 30, 2026

1

[Bug bounty] `monk restart` and `monk restart --all` print “Nothing to choose from” while podman still has the app containers Up (and curl :3000 is 200)

monk-io/monk-plugin#453 · opened

on Aug 30, 2026

[Bug bounty] CLI `monk logs` / `monk exec` report “container … not found” for every name form of a workload that MCP `workload.logs` can read (and that `monk ps` listed)

monk-io/monk-plugin#452 · opened

on Aug 30, 2026

[Bug bounty] CLI `monk logs --tail 2 <template>` treats --tail as a boolean flag (alias of -l 10), so `2` is a second argument — error is “should not have more than 1 argument(s)” AND “Command not found: logs”

monk-io/monk-plugin#451 · opened

on Aug 30, 2026

[Bug bounty] arrowscript.operator.doc/search for "||" does not resolve to the `or` operator (doc: Boolean OR / default) — doc says not found with zero suggestions; search returns internal `const`/`var`

monk-io/monk-plugin#450 · opened

on Aug 30, 2026

[Bug bounty] cluster.gpuTypes returns a bare JSON array [] (not an object) when it has nothing to say — unlike catalog/estimate which return objects with message/error

monk-io/monk-plugin#449 · opened

on Aug 30, 2026

[Bug bounty] package.list marks packages type:"runnable" but runnables is always [] — 12/12 acmefit hits; package.info of the same path has a real runnable

monk-io/monk-plugin#448 · opened

on Aug 30, 2026

Navigation Menu

Repository navigation

Issues

[Bug bounty] monk.install.run fails 9 in a row with the same 'Monk CLI and daemon need to be installed.' string — same string across 4 workspace contexts, no diagnostic context

[Bug bounty] monk.workload.stop error string contains UTF-16 LE NUL bytes between every character — terminal renders disconnect, downstream grep fails

[Bug bounty] monk.cluster.upgrade accepts approval for raw 'not-a-version' string — semver/version-shape validation happens only post-approval, not at MCP boundary

[Bug bounty] monk.cluster.create logs workspaceRoot='C:\Windows\System32' against an active workspace session — workspace-context binding leaks across dashboard tabs (gauntlet step 4)

[Bug bounty] monk.watcher.remove emits 4 distinct error shapes in 95 min — no error-shape categorisation, no retry-hint, no escalation path

[Bug bounty] Windows install-wsl-distro times out before a healthy slow Ubuntu rootfs download can finish

[Bug bounty] monk.install.status ready:true contradicts monk.runtime.status ready:false — monkd-ping ok while monk-cli fails (simultaneous MCP split-brain)

[Bug bounty] Antigravity PreInvocation hook never auto-updates monk-agent — skips scripts/ensure-monk-agent bootstrap

[Bug bounty] PreToolUse block-monk fallback regex bypassed by shell separators (monk; / monk& / monk|)

[Bug bounty] Cross-platform hook execution fails on Linux/POSIX due to unescaped Windows backslashes in hooks. json

[Bug bounty] `monk --json status` reports cluster:true and `monk cluster info` prints a monkcode for Cluster Name local while MCP cluster.list is [] and context.mode is local

[Bug bounty] dashboard.open {path:"/?item=not-a-uuid"} returns ok:true with that path in the URL — no validation that the item exists

[Bug bounty] Unauthenticated POST /auth/register creates a pending dashboard security approval “Connect monk-agent-client-<uuid> to Monk”

[Bug bounty] `monk system ns-list --depth` defaults to 2147483647 (2^31-1)

[Bug bounty] cluster.status info.addresses lists the same multiaddrs twice (n=2× unique) when connected to the phantom local cluster

[Bug bounty] `monk system ns-list` hangs (no output until killed) even with `-d 1 /`; help default depth is 2147483647

[Bug bounty] package.search query:"*" returns the registry catalog (available:true) instead of requiring a real search string

[Bug bounty] cluster.ingress.list_certificates throws “ingress plugin is not enabled” while cluster.ingress.status returns {enabled:false} with no error — same moment, local mode

[Bug bounty] watcher.status reports connected:true and lists system/watcher-agent + watcher-ai (deployed:false) while cluster.list is [] and context.mode is local

[Bug bounty] `monk restart` and `monk restart --all` print “Nothing to choose from” while podman still has the app containers Up (and curl :3000 is 200)

[Bug bounty] CLI `monk logs` / `monk exec` report “container … not found” for every name form of a workload that MCP `workload.logs` can read (and that `monk ps` listed)

[Bug bounty] CLI `monk logs --tail 2 <template>` treats --tail as a boolean flag (alias of -l 10), so `2` is a second argument — error is “should not have more than 1 argument(s)” AND “Command not found: logs”

[Bug bounty] arrowscript.operator.doc/search for "||" does not resolve to the `or` operator (doc: Boolean OR / default) — doc says not found with zero suggestions; search returns internal `const`/`var`

[Bug bounty] cluster.gpuTypes returns a bare JSON array [] (not an object) when it has nothing to say — unlike catalog/estimate which return objects with message/error

[Bug bounty] package.list marks packages type:"runnable" but runnables is always [] — 12/12 acmefit hits; package.info of the same path has a real runnable