[Bug bounty] Antigravity Windows block-monk guard fails open when CRLF POSIX hook is selected #135

Bounty eligibility

• I have signed up at monk.io with this GitHub account
• I have used the product by installing and running the Monk plugin/agent
• I have starred this repo

Stage

operate

Coding agent

Google Antigravity hook path, reproduced from Codex desktop

Coding agent version

Codex desktop; Monk plugin repo a4c9972 (v0.1.46); installed monk-agent 0.1.45

Duplicate check

I searched current open and closed issues for:

• CRLF line endings sh
• Illegal option sh word unexpected
• env sh carriage return
• Antigravity hook CRLF
• bash Windows hook
• start-monk-agent.sh Windows
• monk-diagnostics.sh
• block-monk.sh

I did not find an existing report for CRLF line endings breaking Antigravity .sh hooks on Windows and causing the Windows PowerShell hook to delegate to a broken POSIX sibling.

Closest related but not duplicate:

• [Bug bounty] Antigravity POSIX block-monk fallback misses quoted and escaped monk commands #55: POSIX block-monk fallback parsing gaps; this report is about the hook file failing before any parsing.
• [Bug bounty] Windows block-monk guard fails open when helper errors #100: Windows block-monk.ps1 fails open when the helper errors; this report occurs before the PowerShell hook calls the helper, because it exits when bash exists.
• [Bug bounty] block-monk helper allows shell wrapper Monk CLI invocations #133: normal helper allows wrapper-form Monk CLI invocations; this report uses a direct monk deploy payload that the helper correctly denies.
• [Bug bounty] Antigravity Windows hook-started companion survives official uninstaller #120/[Bug bounty] Antigravity hook-started companion survives the official Unix uninstaller #17: Antigravity lifecycle/uninstall behavior, not hook line endings or guard decisions.

Summary

The Antigravity Windows hooks ship both PowerShell and POSIX hook siblings. The PowerShell block-monk.ps1 intentionally exits without a decision when bash exists, because it expects the .sh sibling to make the decision:

if (Get-Command bash -ErrorAction SilentlyContinue) { exit 0 }

On my Windows install, the Antigravity .sh files in both the current repo checkout and the marketplace/plugin tree have CRLF line endings. When the .sh sibling is run by a POSIX shell, it fails before it can emit the deny JSON:

hooks/block-monk.sh: 14: <CR>
: not found
hooks/block-monk.sh: 15: set: Illegal option -

Result: a direct monk deploy command is denied by the underlying monk-agent hook block-monk --format antigravity helper, but the packaged Antigravity hook path emits no deny decision.

This proof does not run the Monk CLI or touch a cluster. It only feeds a hook payload into the guard.

Repro steps

1. On Windows with bash.exe present, install / fetch the Monk plugin marketplace tree that includes .antigravity-plugin.

2. Confirm Antigravity block-monk.ps1 delegates to the .sh sibling when bash exists:

Get-Command bash
Select-String -Path .\.antigravity-plugin\hooks\block-monk.ps1 -Pattern 'Get-Command bash'

3. Confirm the .sh hook files have CRLF line endings:

$root = ".\.antigravity-plugin"
Get-ChildItem -Recurse -File $root -Include *.sh | ForEach-Object {
  $bytes = [IO.File]::ReadAllBytes($_.FullName)
  $head = [Text.Encoding]::ASCII.GetString($bytes, 0, [Math]::Min(120, $bytes.Length))
  [pscustomobject]@{
    file = $_.FullName
    hasCRLF = $head.Contains("`r`n")
  }
}

Observed for both the current repo checkout a4c9972 (v0.1.46) and the installed/fetched Antigravity tree:

hooks/block-monk.sh             hasCRLF=True
hooks/ensure-monk-agent.sh      hasCRLF=True
hooks/monk-diagnostics.sh       hasCRLF=True
scripts/ensure-monk-agent.sh    hasCRLF=True
scripts/monk-launcher-telemetry.sh hasCRLF=True
scripts/plugin-version.sh       hasCRLF=True
scripts/start-monk-agent.sh     hasCRLF=True
scripts/uninstall-monk-agent.sh hasCRLF=True

4. Compare the underlying helper decision with the packaged hooks:

$Root = "C:\Users\PC\.codex\.tmp\marketplaces\monk-plugins\.antigravity-plugin"
$RootUnix = "/mnt/c/Users/PC/.codex/.tmp/marketplaces/monk-plugins/.antigravity-plugin"
$Agent = "$HOME\.monk\bin\monk-agent.exe"
$payload = @{
  toolCall = @{
    name = "run_command"
    args = @{ CommandLine = "monk deploy" }
  }
} | ConvertTo-Json -Compress -Depth 8

$payload | & $Agent hook block-monk --format antigravity
$payload | powershell.exe -NoProfile -ExecutionPolicy Bypass -File (Join-Path $Root "hooks\block-monk.ps1")
$payload | bash -lc "cd '$RootUnix' && sh hooks/block-monk.sh"

Observed:

{
  "directHelper": {
    "stdout": "{\"decision\":\"deny\",\"reason\":\"Blocked: do not shell out to the `monk` CLI ...\"}",
    "denied": true
  },
  "powerShellHook": {
    "stdout": "",
    "denied": false
  },
  "shellHook": {
    "exitCode": 2,
    "stderr": "hooks/block-monk.sh: 14: <CR>\n: not found\nhooks/block-monk.sh: 15: set: Illegal option -",
    "denied": false
  }
}

Expected behavior

The Antigravity block-monk guard should deny a direct monk ... command on Windows when the installed monk-agent helper is healthy. If the PowerShell hook exits because bash exists, the POSIX sibling must be runnable and must emit the deny decision.

Actual behavior

The PowerShell hook exits without calling the helper because bash is present. The POSIX sibling fails on CRLF line endings before it can call the helper or its fallback. No deny JSON is emitted for a direct monk deploy payload.

Impact

The block-monk hook is intended to prevent agents from shelling out to the Monk CLI and bypassing the MCP/dashboard workflow. In this Windows-with-bash state, Antigravity can fail open for direct Monk CLI commands: the exact command that the healthy helper denies produces no packaged-hook deny decision.

This can allow Monk CLI execution through run_command instead of the intended guarded MCP path.

I did not run a real Monk command. The proof stops at the hook enforcement boundary.

Severity (your guess)

major

OS

Windows 11 with bash.exe available

monkd version

Not involved; this is the local Antigravity hook before runtime access.

Target cloud

None; local hook guard only.

Integration (if relevant)

Google Antigravity .antigravity-plugin PreToolUse block-monk hook on Windows.

Suggested fix

• Force LF endings for POSIX files in the repository and packaged marketplace output, for example with .gitattributes:

*.sh text eol=lf
.antigravity-plugin/**/*.sh text eol=lf
hooks/*.sh text eol=lf
scripts/*.sh text eol=lf

• Add a Windows regression that checks .sh files in generated plugin trees contain LF, not CRLF.
• Avoid making the PowerShell hook exit solely because bash is present unless the POSIX sibling is known runnable.