[Bug]: Comma in a filename in app directory causes crash

[Meorge]

Describe the bug

I created a JSON file in my Flower app's main directory with a comma in its name. When attempting to run the app with flwr run . --stream, I get the following output:

(.venv) ➜  quickstart-pytorch flwr run . --stream
⚠️ Warning: `options.` fields in the SuperLink connection configuration are deprecated. Use `--federation-config` with `flwr run` instead. Alternatively, permanently set your simulation configuration via `flwr federation simulation-config`.
🎊 Successfully started run 16733369766915575127
INFO :      Starting logstream for run_id `16733369766915575127`
INFO :      Starting Flower Simulation
ERROR :     Simulation raised an exception
Traceback (most recent call last):
  File "/Users/malcolmanderson/Documents/Repositories/ThesisWork/FedLearningPoisoning2026/.venv/lib/python3.13/site-packages/flwr/simulation/app.py", line 199, in run_simulation_process
    install_from_fab(fab.content, skip_prompt=True)
    ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/malcolmanderson/Documents/Repositories/ThesisWork/FedLearningPoisoning2026/.venv/lib/python3.13/site-packages/flwr/cli/install.py", line 122, in install_from_fab
    if not content_file.exists() or not _verify_hashes(
                                        ~~~~~~~~~~~~~~^
        content_file.read_text(), tmpdir_path
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    ):
    ^
  File "/Users/malcolmanderson/Documents/Repositories/ThesisWork/FedLearningPoisoning2026/.venv/lib/python3.13/site-packages/flwr/cli/install.py", line 232, in _verify_hashes
    rel_path, hash_expected, _ = line.split(",")
    ^^^^^^^^^^^^^^^^^^^^^^^^^^
ValueError: too many values to unpack (expected 3)

By inserting a print statement at the beginning of flwr/cli/install.py's _verify_hashes() function, like so:

def _verify_hashes(list_content: str, tmpdir: Path) -> bool:
    """Verify file hashes based on the CONTENT manifest.

    Parameters
    ----------
    list_content : str
        Content of the CONTENT manifest file with hash information.
    tmpdir : Path
        Temporary directory containing extracted files.

    Returns
    -------
    bool
        True if all file hashes match, False otherwise.
    """
    print(list_content)
    for line in list_content.strip().split("\n"):
        rel_path, hash_expected, _ = line.split(",")
        ...

I get the following output:

pyproject.toml,c5e8e8a32506881f7953dd9fbaf43a922496602bf9108166b6c5a08cb214934f,6616
1787181290,m=0.0.json,1ac825665498132980a7657679318e9bad4abd3e2f2e641c5fc91524a56479d4,18424
LICENSE,cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30,90864
README.md,26a0b7e105439ff9defd2edbf5fbe992398f7e4cf75b9521149fd192f32c9c03,24816
pytorchexample/__init__.py,060758d3c3c2868215a6bf658db65f601f5ed8fba8a699c2093e028a49cd2763,176
pytorchexample/client_app.py,39bc02f25e78b41e49d65f41ab4df98c559dd744cbe2af683ddebb235c432818,28464
pytorchexample/data_poisoning.py,8acbf61a4f0a1592a33e53bb88ec76a4847a24d028f84a156a6202a09c0ffa23,2344
pytorchexample/server_app.py,8a190dfa74e11149c80642f47f11354e66099dcd73f9b1855aa4def89749f70e,23176
pytorchexample/task.py,0e88d05f0ac283fb6b2b0732041865eeac04172e31eb5e10a97e6621b91e2ec7,32280

The second line shows the culprit: 1787181290,m=0.0.json is the name of my JSON file, but this algorithm splits it on the comma and detects it as two separate components.

Furthermore, by changing the comma to a different character, the simulation starts fine:

(.venv) ➜  quickstart-pytorch flwr run . --stream
⚠️ Warning: `options.` fields in the SuperLink connection configuration are deprecated. Use `--federation-config` with `flwr run` instead. Alternatively, permanently set your simulation configuration via `flwr federation simulation-config`.
🎊 Successfully started run 16494327214807902701
INFO :      Starting logstream for run_id `16494327214807902701`
INFO :      Starting Flower Simulation
pyproject.toml,c5e8e8a32506881f7953dd9fbaf43a922496602bf9108166b6c5a08cb214934f,6616
1787181290_m=0.0.json,1ac825665498132980a7657679318e9bad4abd3e2f2e641c5fc91524a56479d4,18424
LICENSE,cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30,90864
README.md,26a0b7e105439ff9defd2edbf5fbe992398f7e4cf75b9521149fd192f32c9c03,24816
pytorchexample/__init__.py,060758d3c3c2868215a6bf658db65f601f5ed8fba8a699c2093e028a49cd2763,176
pytorchexample/client_app.py,39bc02f25e78b41e49d65f41ab4df98c559dd744cbe2af683ddebb235c432818,28464
pytorchexample/data_poisoning.py,8acbf61a4f0a1592a33e53bb88ec76a4847a24d028f84a156a6202a09c0ffa23,2344
pytorchexample/server_app.py,8a190dfa74e11149c80642f47f11354e66099dcd73f9b1855aa4def89749f70e,23176
pytorchexample/task.py,0e88d05f0ac283fb6b2b0732041865eeac04172e31eb5e10a97e6621b91e2ec7,32280
Successfully installed quickstart-pytorch to /Users/malcolmanderson/.flwr/apps/flwrlabs.quickstart-pytorch.1.1.6.a4b81e86.
Main is starting!
INFO :      Starting FedAvg strategy:
INFO :          ├── Number of rounds: 20
INFO :          ├── ArrayRecord (0.24 MB)
INFO :          ├── ConfigRecord (train): {'lr': 0.01, 'malicious_nodes': []}
INFO :          ├── ConfigRecord (evaluate): {'malicious_nodes': []}
INFO :          ├──> Sampling:
INFO :          │       ├──Fraction: train (1.00) | evaluate ( 1.00)
INFO :          │       ├──Minimum nodes: train (2) | evaluate (2)
INFO :          │       └──Minimum available nodes: 2
INFO :          └──> Keys in records:
INFO :                  ├── Weighted by: 'num-examples'
INFO :                  ├── ArrayRecord key: 'arrays'
INFO :                  └── ConfigRecord key: 'config'
INFO :     

Steps/Code to Reproduce

Create a file with a comma in its name in the app directory, and attempt to run it via flwr run . --stream. The simulation should crash nearly immediately with the error above.

Expected Results

The app does not crash and begins training.

Actual Results

The app immediately crashes.