[Bug bounty] Analyzer ignores defines: group members when computing unused runnables

[joelcf001]

Bounty eligibility

• I have signed up at monk.io with this GitHub account
• I have used the product (installed the current plugin and Agent, authenticated, generated a real application configuration through the Monk editor workflow, and ran monk.analyzer.diagnose)
• I have starred this repo

Stage

build

Coding agent

OpenAI Codex

Coding agent version

Codex CLI 0.146.0-alpha.3.1; Monk plugin and Agent 0.1.52

Repro steps

1. Start with a small application containing a Dockerfile.

2. Run the Monk configure/editor workflow. It generates this MANIFEST:

   REPO monk-smoke-app
   LOAD monk.yaml
   ENTRY monk-smoke-app/stack
   IMAGE monk-smoke-app:latest monk-smoke-app/app . Dockerfile
   

3. Use this valid monk.yaml:

   namespace: monk-smoke-app
   
   stack:
     defines: group
     members:
       - monk-smoke-app/app
   
   app:
     defines: runnable
     containers:
       app:
         image: monk-smoke-app:latest
     services:
       http:
         container: app
         port: 8080
         protocol: tcp

4. Run monk.analyzer.diagnose against the workspace.

The fully-qualified group-member syntax above matches Monk's documented examples, including the cloudflare-example/nextjs-app member under a defines: group stack:
https://docs.monk.io/integrations/cloudflare

No deployment, cloud resource, or paid credit was used in this reproduction.

Expected behavior

The analyzer should recognize monk-smoke-app/app as a member of monk-smoke-app/stack and should not report the runnable as ungrouped.

Actual behavior

The analyzer returns:

{
  "severity": "info",
  "message": "'app' is not in any group and has no connections. Consider removing it if unused, or add to a group.",
  "file": "monk.yaml",
  "line": 8,
  "column": 0,
  "source": "structural",
  "sourceLine": "app:"
}

This is a false positive: app is explicitly in the stack group's members list. It makes a configuration produced by the Monk workflow appear incomplete and encourages the user to remove or change a runnable that is already correctly grouped.

Severity (your guess)

minor

The generated configuration remains usable, but the diagnostic is misleading during the normal configure/analyze workflow.

OS

macOS 15.7.7

monkd version

Not installed or invoked; reproduced through the local Monk Agent/plugin 0.1.52

Target cloud

None (local analysis only)

Integration (if relevant)

Monk analyzer MCP used by the OpenAI Codex plugin

Duplicate check

Immediately before filing, I searched all open and closed reports in monk-io/monk-plugin for the exact diagnostic, group members unused runnable analyzer, and defines: group. No matching report was found.

OpenAI Codex assisted with the product run, independent reproduction, duplicate check, and report, as permitted by the contest.

[joelcf001]

Administrative note: I submitted this report through the GitHub API using the repository's issue-form sections, and GitHub dropped the template's default bug-bounty label because I do not have triage permission. Could a maintainer please apply the contest label? The report itself is unchanged.

[praveenchand-2005]

I am claiming this issue to fix the structural analyzer group member path resolution bug.

Summary of Fix:

• Normalizing fully-qualified namespace/runnable member strings in defines: group definitions.
• Suppressing false-positive 'app' is not in any group diagnostics.
• Regression test suite verified locally.

[praveenchand-2005]

I have resolved this issue on branch fix-group-members-unused-runnables-issue-185.

Here is the Pull Request: https://github.com/praveenchand-2005/monk-plugin/tree/fix-group-members-unused-runnables-issue-185

Fix Summary:

• Normalized structural path resolution for fully-qualified group member declarations (e.g. monk-smoke-app/app).
• Suppressed false positive warning in monk.analyzer.diagnose.
• Automated tests passed.