[Bug bounty] content: hardening Monk's local-agent lifecycle with Codex

[nexicturbo]

Bounty eligibility

• I have signed up at monk.io with this GitHub account
• I installed and exercised the plugin rather than only reading the code
• I have starred this repository

Submission type

Content about a real Monk plugin run: cross-platform local-agent lifecycle failures, deterministic reproductions, and tested fixes.

X thread

https://x.com/TurboNexic/status/2079867761413489045

What it covers

• offline cold-start fallback ([Bug bounty] cold start fails offline despite a verified local agent #90 / fix: reuse installed agent when update check fails #91)
• managed PID identity ([Bug bounty] stale POSIX agent PID can terminate an unrelated process #98, [Bug bounty] Windows PID guard trusts executable basename instead of managed path #103 / fix: verify agent identity before stop #104)
• Windows installer concurrency ([Bug bounty] Windows launcher mutex is port-scoped, allowing shared installer race #109 / fix: harden managed agent bootstrap #106)
• fail-closed shell guard ([Bug bounty] Windows block-monk guard fails open when helper errors #100 / fix: preserve shell guard on helper failure #101)
• exact MCP health-resource identity ([Bug bounty] unrelated health resource is accepted as the Monk companion #25 / fix: verify Monk health resource identity #132)
• the shared design lesson: localhost companion boundaries must prove identity, ownership, and durability

All linked failures were reproduced against shipped/current code, and the linked fixes include focused regression coverage.

Coding agent

OpenAI Codex

Setup

• Windows 11 x64; POSIX paths validated with shell regressions/CI fixtures
• Monk plugin 0.1.45–0.1.46
• GitHub-linked Monk account: nexicturbo