UAT: `session import` checksum verification uses `sha256:` prefix inconsistently — export stores raw hex, import prepends prefix #4690

New issue

Open

opened 2026-04-08 18:01:22 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-08 18:01:22 +00:00

Owner

Summary

session export stores the checksum as a raw SHA-256 hex digest, but session import prepends "sha256:" to the stored value before comparing. While the round-trip comparison works (both sides get the prefix added), the _render_export_panels function displays sha256:xxxx...xxxx while the actual stored value in the JSON file is just the hex string. This creates a confusing inconsistency and a latent bug.

Expected Behavior

The checksum format should be consistent between export storage and display. Either:

Store as sha256:<hex> and compare directly, OR
Store as <hex> and display as <hex> (or add prefix only for display)

Actual Behavior

Export (src/cleveragents/domain/models/core/session.py line 465):

export["checksum"] = hashlib.sha256(canonical.encode()).hexdigest()
# Stored as: "abc123..." (raw hex, no prefix)

Import (src/cleveragents/application/services/session_service.py lines 263-272):

raw_checksum = data.get("checksum")  # Gets "abc123..." (raw hex)
checksum = "sha256:" + raw_checksum  # Becomes "sha256:abc123..."
# ...
expected_checksum = "sha256:" + hashlib.sha256(canonical.encode()).hexdigest()
# Comparison: "sha256:abc123..." == "sha256:abc123..." ← works but confusing

Display (src/cleveragents/cli/commands/session.py lines ~540-545):

checksum_display = (
    f"sha256:{checksum_raw[:4]}...{checksum_raw[-4:]}"
    if len(checksum_raw) >= 8
    else checksum_raw or "n/a"
)
# Displays: "sha256:abc1...3xyz" but stored value is just "abc1...3xyz"

Latent Bug

If the stored checksum were ever to include the sha256: prefix (e.g., from a future format change or external tool), the import would double-prefix it as sha256:sha256:... and fail verification.

Code Location

src/cleveragents/domain/models/core/session.py — as_export_dict(), line 465
src/cleveragents/application/services/session_service.py — import_session(), lines 263-272
src/cleveragents/cli/commands/session.py — _render_export_panels(), lines ~540-545

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Summary `session export` stores the checksum as a raw SHA-256 hex digest, but `session import` prepends `"sha256:"` to the stored value before comparing. While the round-trip comparison works (both sides get the prefix added), the `_render_export_panels` function displays `sha256:xxxx...xxxx` while the actual stored value in the JSON file is just the hex string. This creates a confusing inconsistency and a latent bug. ## Expected Behavior The checksum format should be consistent between export storage and display. Either: - Store as `sha256:<hex>` and compare directly, OR - Store as `<hex>` and display as `<hex>` (or add prefix only for display) ## Actual Behavior **Export** (`src/cleveragents/domain/models/core/session.py` line 465): ```python export["checksum"] = hashlib.sha256(canonical.encode()).hexdigest() # Stored as: "abc123..." (raw hex, no prefix) ``` **Import** (`src/cleveragents/application/services/session_service.py` lines 263-272): ```python raw_checksum = data.get("checksum") # Gets "abc123..." (raw hex) checksum = "sha256:" + raw_checksum # Becomes "sha256:abc123..." # ... expected_checksum = "sha256:" + hashlib.sha256(canonical.encode()).hexdigest() # Comparison: "sha256:abc123..." == "sha256:abc123..." ← works but confusing ``` **Display** (`src/cleveragents/cli/commands/session.py` lines ~540-545): ```python checksum_display = ( f"sha256:{checksum_raw[:4]}...{checksum_raw[-4:]}" if len(checksum_raw) >= 8 else checksum_raw or "n/a" ) # Displays: "sha256:abc1...3xyz" but stored value is just "abc1...3xyz" ``` ## Latent Bug If the stored checksum were ever to include the `sha256:` prefix (e.g., from a future format change or external tool), the import would double-prefix it as `sha256:sha256:...` and fail verification. ## Code Location - `src/cleveragents/domain/models/core/session.py` — `as_export_dict()`, line 465 - `src/cleveragents/application/services/session_service.py` — `import_session()`, lines 263-272 - `src/cleveragents/cli/commands/session.py` — `_render_export_panels()`, lines ~540-545 --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

Rows
Columns

UAT: session import checksum verification uses sha256: prefix inconsistently — export stores raw hex, import prepends prefix #4690