Skills bundle hash crashes on bytes content

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

• #19575 fix(skills): hash byte-backed bundle files (closes #13408)

  merged to main

  files: scripts/release.py, tests/tools/test_skills_hub.py, tools/skills_hub.py

  Show the diff

  • scripts/release.py

    @@ -633,6 +633,8 @@
         "[redacted:email]": "CIRWEL",
         "[redacted:email]": "molvikar",
         "[redacted:email]": "nftpoetrist",
    +    "[redacted:email]": "colorcross",
    +    "[redacted:email]": "zhao0112",
         "[redacted:email]": "leozeli",
         "[redacted:email]": "LehaoLin",
         "[redacted:email]": "I3eg1nner",

  • tests/tools/test_skills_hub.py

    @@ -901,6 +901,69 @@ def test_bundle_content_hash_matches_installed_content_hash(self, tmp_path):
     
             assert bundle_content_hash(bundle) == content_hash(skill_dir)
     
    +    def test_bundle_content_hash_accepts_binary_files(self):
    +        bundle = SkillBundle(
    +            name="demo-binary-skill",
    +            files={
    +                "SKILL.md": "# Demo\n",
    +                "assets/logo.png": b"\x89PNG\r\n\x1a\nbinary",
    +            },
    +            source="github",
    +            identifier="owner/repo/demo-binary-skill",
    +            trust_level="community",
    +        )
    +
    +        digest = bundle_content_hash(bundle)
    +
    +        assert digest.startswith("sha256:")
    +
    +    def test_bundle_content_hash_bytes_matches_str_equivalent(self):
    +        """Bytes content must hash identically to its str-decoded form."""
    +        text_bundle = SkillBundle(
    +            name="demo-skill",
    +            files={
    +                "SKILL.md": "same content",
    +                "references/checklist.md": "- [ ] security\n",
    +            },
    +            source="github",
    +            identifier="owner/repo/demo-skill",
    +            trust_level="community",
    +        )
    +        bytes_bundle = SkillBundle(
    +            name="demo-skill",
    +            files={
    +                "SKILL.md": b"same content",
    +                "references/checklist.md": b"- [ ] security\n",
    +            },
    +            source="github",
    +            identifier="owner/repo/demo-skill",
    +            trust_level="community",
    +        )
    +
    +        assert bundle_content_hash(bytes_bundle) == bundle_content_hash(text_bundle)
    +
    +    def test_bundle_content_hash_mixed_matches_on_disk(self, tmp_path):
    +        """In-memory bundle hash must equal on-disk content_hash for mixed bytes+str."""
    +        from tools.skills_guard import content_hash
    +
    +        bundle = SkillBundle(
    +            name="demo-skill",
    +            files={
    +                "SKILL.md": b"# Demo Skill\n",
    +                "references/checklist.md": "- [ ] security\n",
    +            },
    +            source="github",
    +            identifier="owner/repo/demo-skill",
    +            trust_level="community",
    +        )
    +        skill_dir = tmp_path / "demo-skill"
    +        skill_dir.mkdir()
    +        (skill_dir / "SKILL.md").write_bytes(b"# Demo Skill\n")
    +        (skill_dir / "references").mkdir()
    +        (skill_dir / "references" / "checklist.md").write_text("- [ ] security\n")
    +
    +        assert bundle_content_hash(bundle) == content_hash(skill_dir)
    +
         def test_reports_update_when_remote_hash_differs(self):
             lock = MagicMock()
             lock.list_installed.return_value = [{

  • tools/skills_hub.py

    @@ -2801,7 +2801,11 @@ def bundle_content_hash(bundle: SkillBundle) -> str:
         """Compute a deterministic hash for an in-memory skill bundle."""
         h = hashlib.sha256()
         for rel_path in sorted(bundle.files):
    -        h.update(bundle.files[rel_path].encode("utf-8"))
    +        content = bundle.files[rel_path]
    +        if isinstance(content, bytes):
    +            h.update(content)
    +        else:
    +            h.update(content.encode("utf-8"))
         return f"sha256:{h.hexdigest()[:16]}"