fix: type guard in mask_api_key, remove dead skill ref, explicit utf-8 encoding

gateway/run.py

@@ -14702,7 +14702,7 @@ def _agent_config_signature(
         # (e.g. "eyJhbGci"), which can cause false cache hits across auth
         # switches if only the first few characters are considered.
         _api_key = str(runtime.get("api_key", "") or "")
-        _api_key_fingerprint = hashlib.sha256(_api_key.encode()).hexdigest() if _api_key else ""
+        _api_key_fingerprint = hashlib.sha256(_api_key.encode("utf-8")).hexdigest() if _api_key else ""
 
         _cache_keys_sorted = sorted((cache_keys or {}).items())
 
@@ -14722,7 +14722,7 @@ def _agent_config_signature(
             sort_keys=True,
             default=str,
         )
-        return hashlib.sha256(blob.encode()).hexdigest()[:16]
+        return hashlib.sha256(blob.encode("utf-8")).hexdigest()[:16]
 
     def _apply_session_model_override(
         self, session_key: str, model: str, runtime_kwargs: dict

hermes_cli/auth.py

@@ -698,15 +698,15 @@ def _resolve_zai_base_url(api_key: str, default_url: str, env_override: str) ->
     cached = state.get("detected_endpoint")
     if isinstance(cached, dict) and cached.get("base_url"):
         key_hash = cached.get("key_hash", "")
-        if key_hash == hashlib.sha256(api_key.encode()).hexdigest()[:16]:
+        if key_hash == hashlib.sha256(api_key.encode("utf-8")).hexdigest()[:16]:
             logger.debug("Z.AI: using cached endpoint %s", cached["base_url"])
             return cached["base_url"]
 
     # Probe — may take up to ~8s per endpoint.
     detected = detect_zai_endpoint(api_key)
     if detected and detected.get("base_url"):
         # Persist the detection result keyed on the API key hash.
-        key_hash = hashlib.sha256(api_key.encode()).hexdigest()[:16]
+        key_hash = hashlib.sha256(api_key.encode("utf-8")).hexdigest()[:16]
         state["detected_endpoint"] = {
             "base_url": detected["base_url"],
             "endpoint_id": detected.get("id", ""),
@@ -6771,7 +6771,7 @@ def _minimax_pkce_pair() -> tuple:
     import secrets
     verifier = secrets.token_urlsafe(64)[:96]
     challenge = base64.urlsafe_b64encode(
-        hashlib.sha256(verifier.encode()).digest()
+        hashlib.sha256(verifier.encode("utf-8")).digest()
     ).decode().rstrip("=")
     state = secrets.token_urlsafe(16)
     return verifier, challenge, state

hermes_cli/kanban_swarm.py

@@ -209,7 +209,7 @@ def create_swarm(
         priority=priority,
         workspace_kind=workspace_kind,
         workspace_path=workspace_path,
-        skills=["avoid-ai-writing"],
+        skills=[],
     )
 
     created = SwarmCreated(root, worker_ids, verifier, synthesizer)

hermes_cli/webhook.py

@@ -250,15 +250,15 @@ def _cmd_test(args):
     import hmac
     import hashlib
     sig = "sha256=" + hmac.new(
-        secret.encode(), payload.encode(), hashlib.sha256
+        secret.encode("utf-8"), payload.encode("utf-8"), hashlib.sha256
     ).hexdigest()
 
     print(f"  Sending test POST to {url}")
     try:
         import urllib.request
         req = urllib.request.Request(
             url,
-            data=payload.encode(),
+            data=payload.encode("utf-8"),
             headers={
                 "Content-Type": "application/json",
                 "X-Hub-Signature-256": sig,

run_agent.py

@@ -1443,6 +1443,8 @@ def _mask_api_key_for_logs(self, key: Any) -> Optional[str]:
             return "<entra-id-bearer>"
         if not key:
             return None
+        if not isinstance(key, str):
+            return repr(key)[:12]
         if len(key) <= 12:
             return "***"
         return f"{key[:8]}...{key[-4:]}"