Skip to content

fix launcher telemetry JSON escaping - #189

Open
jhontejada95 wants to merge 1 commit into
monk-io:mainfrom
jhontejada95:agent/fix-telemetry-json-escaping
Open

fix launcher telemetry JSON escaping#189
jhontejada95 wants to merge 1 commit into
monk-io:mainfrom
jhontejada95:agent/fix-telemetry-json-escaping

Conversation

@jhontejada95

Copy link
Copy Markdown

Summary

  • replace the lossy _msan filter with a POSIX od/awk JSON string encoder
  • escape quotes, backslashes, standard escapes, and every remaining 0x000x1f control byte while preserving UTF-8
  • keep the root, packaged, and Antigravity launcher scripts byte-identical
  • add a regression test to the Unix CI matrix

Root cause

The POSIX launcher builds its early PostHog payload by hand. Its sanitizer deleted quotes, backslashes, CR, and LF, but left tabs and other control bytes in JSON strings. Those bytes make the payload invalid, while deleting valid characters also silently changed telemetry values.

Impact

Dynamic launcher properties containing quotes, slashes, whitespace controls, or UTF-8 now remain valid and round-trip without data loss, preventing affected telemetry events from being corrupted or dropped.

Validation

  • ./tests/monk-launcher-telemetry-json.sh
  • sh -n on all three telemetry scripts and the regression test
  • ./tests/start-monk-agent-fastpath.sh
  • ./tests/start-monk-agent-readiness-timeout.sh
  • git diff --check

Fixes #179

@jhontejada95
jhontejada95 marked this pull request as ready for review July 30, 2026 17:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug bounty] Telemetry script injects unescaped special characters into JSON payload, corrupting PostHog events

1 participant