{"record":{"id":"459c1b2a77d8db8f","repo":"abhigyanpatwari/GitNexus","slug":"sandboxed-git-diff-did-not-produce-a-sha-256-diges","errorCode":null,"errorMessage":"sandboxed git diff did not produce a SHA-256 digest","messagePattern":"sandboxed git diff did not produce a SHA-256 digest","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"eval/workflow_bench/runner_artifacts.py","lineNumber":400,"sourceCode":"    if not re.fullmatch(r\"[0-9a-fA-F]{40,64}\", orig_sha):\n        raise ValueError(f\"unsafe git object id: {orig_sha!r}\")\n    if prepare_untracked:\n        _prepare_untracked_for_diff(sandbox)\n    command = (\n        \"/usr/bin/git -c core.fsmonitor=false diff --no-ext-diff --no-textconv --binary \"\n        f\"{orig_sha} -- . ':(exclude)docs/plans' ':(exclude).claude/skills' \"\n        \"| /usr/bin/sha256sum\"\n    )\n    result = sandbox.run(\n        [\"/bin/sh\", \"-c\", command],\n        timeout=60,\n        env=build_sandbox_environment(),\n    )\n    if not result.ok:\n        raise ManagedProcessError(command, result)\n    digest = result.stdout_tail.strip().split()[0] if result.stdout_tail.strip() else \"\"\n    if not re.fullmatch(r\"[0-9a-f]{64}\", digest):\n        raise RuntimeError(\"sandboxed git diff did not produce a SHA-256 digest\")\n    return digest\n\n\ndef diff_churn(\n    sandbox: SandboxSession,\n    orig_sha: str,\n    *,\n    prepare_untracked: bool = True,\n) -> dict[str, int]:\n    \"\"\"Return code churn versus the arm's starting SHA.\"\"\"\n\n    if prepare_untracked:\n        _prepare_untracked_for_diff(sandbox)\n    output = _sandbox_git(\n        sandbox,\n        [\n            \"diff\",\n            \"--no-ext-diff\",","sourceCodeStart":382,"sourceCodeEnd":418,"githubUrl":"https://github.com/abhigyanpatwari/GitNexus/blob/d540b00184d71a896261ee02670da9a92d59d8f7/eval/workflow_bench/runner_artifacts.py#L382-L418","documentation":"Thrown by implementation_diff_digest when the diff|sha256sum pipeline reported success (exit 0) but the captured stdout does not start with a 64-char lowercase hex SHA-256 digest. The harness trusts only a well-formed digest as the implementation fingerprint, so a malformed/empty result is rejected even though the command nominally succeeded.","triggerScenarios":"After result.stdout_tail.strip().split()[0], the token does not fullmatch [0-9a-f]{64}. Causes: empty stdout (diff produced nothing and sha256sum of empty stdin still prints a digest, so this implies truncation/capture loss), stdout buffer overflowed so only a fragment remained, or the pipeline emitted a warning line before the digest.","commonSituations":"The sandbox stdout tail buffer truncated the digest line; sha256sum printed to stderr only; a non-English locale prefixed output; the harness's stdout capture window was exceeded by a huge diff (though --binary diff piped to sha256sum should stay small).","solutions":["Check that the sandbox run captured stdout (not just stderr) — implementation_diff_digest reads result.stdout_tail.","Confirm the diff actually completed; a 0-exit with empty stdout suggests the pipeline was short-circuited or the buffer rolled over.","If the diff is enormous, the streamed stdout may exceed the tail buffer; reduce the diff scope or increase capture (harness-level change).","Ensure orig_sha matches a real commit so `git diff orig_sha` emits a real diff rather than an error swallowed by the pipe."],"exampleFix":"// before — relying on a possibly-truncated tail\ndigest = result.stdout_tail.strip().split()[0]\n\n// after — verify the pipeline wrote exactly one digest line\nassert result.stdout_tail.strip().count('\\n') == 0\ndigest = result.stdout_tail.strip()\nassert re.fullmatch(r'[0-9a-f]{64}', digest)","handlingStrategy":"validation","validationCode":"import re\n\ndef is_sha256_digest(s: str) -> bool:\n    return isinstance(s, str) and bool(re.fullmatch(r'[0-9a-f]{64}', s))","typeGuard":"import re\n\ndef is_sha256_digest(s: str) -> bool:\n    return isinstance(s, str) and bool(re.fullmatch(r'[0-9a-f]{64}', s))","tryCatchPattern":"try:\n    digest = implementation_diff_digest(sandbox, orig_sha)\nexcept RuntimeError as e:\n    if 'did not produce a SHA-256 digest' in str(e):\n        # check stdout capture, confirm git diff actually emitted output\n        raise\n    raise","preventionTips":["Ensure the sandbox captures stdout (not only stderr) for the pipeline.","Confirm orig_sha resolves to a real commit so git diff emits real content.","Watch for stdout-tail buffer rollover on very large diffs.","Validate the digest with is_sha256_digest before trusting it downstream."],"tags":["git","sha256","evidence-integrity","sandbox","workflow-bench"],"backgroundTag":null,"analyzedSha":"d540b00184d71a896261ee02670da9a92d59d8f7","analyzedAt":"2026-08-12T19:50:25.132Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}