fix: escape launchd plist values

[LeonDong0807]

Fixes #16

[nooga]

Good find — this is confirmed. To make it count for the bounty you still need to: ☐ install and run the plugin (you're already signed in). Complete that before Aug 1 12:00 UTC and the points are yours.

[LeonDong0807]

Hi nooga — I completed the remaining install-and-run verification for #28.

• Host: OpenAI Codex CLI 0.145.0 on Windows 11 Home 64-bit (build 26200)
• Plugin: monk@monk-plugins v0.1.46, installed and enabled from monk-io/monk-plugin
• Completed: 2026-07-22 07:50 UTC
• Test target: a runnable, synthetic Node.js web app (not the Monk plugin source); its health endpoint returned HTTP 200
• Hook/session: I manually audited the Monk SessionStart hook and permitted it for the validation session; the local Monk agent and MCP endpoint started successfully
• Authentication: monk.auth.status completed with signedIn: true
• Analysis: after explicitly approving transmission of the four synthetic test files, monk.project.analyze completed successfully and reported manifestFound: false, which is expected because the app was intentionally left unconfigured
• Safety: no deployment, project configuration, secrets, or cost-bearing actions

Redacted verification results:

{
  "plugin": {
    "id": "monk@monk-plugins",
    "version": "0.1.46",
    "installed": true,
    "enabled": true
  },
  "auth": {
    "tool": "monk.auth.status",
    "callStatus": "completed",
    "signedIn": true
  },
  "analysis": {
    "tool": "monk.project.analyze",
    "callStatus": "completed",
    "manifestFound": false
  },
  "appHealth": {
    "statusCode": 200,
    "ok": true
  }
}

Could you confirm that this satisfies the install/run requirement for PR #28?

[LeonDong0807]

Hi @nooga — following up before the Aug 1 deadline. Could you confirm whether the install-and-run verification above satisfies the remaining requirement for PR #28? I’m happy to provide any additional non-sensitive evidence if needed.