Use canonical builder source hash

agent_builder/tools.py

@@ -1278,7 +1278,22 @@ def _write_builder_state(
 
 
 def _source_bundle_hash(bundle: bytes) -> str:
-    return hashlib.sha256(bundle).hexdigest()
+    digest = hashlib.sha256()
+    with tarfile.open(fileobj=io.BytesIO(bundle), mode="r:gz") as tf:
+        members = sorted(
+            (member for member in tf.getmembers() if member.isfile()),
+            key=lambda member: member.name,
+        )
+        for member in members:
+            extracted = tf.extractfile(member)
+            body = extracted.read() if extracted is not None else b""
+            digest.update(member.name.encode("utf-8"))
+            digest.update(b"\0")
+            digest.update(str(len(body)).encode("ascii"))
+            digest.update(b"\0")
+            digest.update(body)
+            digest.update(b"\0")
+    return digest.hexdigest()
 
 
 def _record_sandbox_result(