refactor(sandbox): centralize sha256 helpers

src/agents/sandbox/config-hash.ts

@@ -1,5 +1,5 @@
-import crypto from "node:crypto";
 import type { SandboxBrowserConfig, SandboxDockerConfig, SandboxWorkspaceAccess } from "./types.js";
+import { hashTextSha256 } from "./hash.js";
 
 type SandboxHashInput = {
   docker: SandboxDockerConfig;
@@ -51,5 +51,5 @@ export function computeSandboxBrowserConfigHash(input: SandboxBrowserHashInput):
 function computeHash(input: unknown): string {
   const payload = normalizeForHash(input);
   const raw = JSON.stringify(payload);
-  return crypto.createHash("sha256").update(raw).digest("hex");
+  return hashTextSha256(raw);
 }

src/agents/sandbox/hash.ts

@@ -0,0 +1,5 @@
+import crypto from "node:crypto";
+
+export function hashTextSha256(value: string): string {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}

src/agents/sandbox/shared.ts

@@ -1,12 +1,12 @@
-import crypto from "node:crypto";
 import path from "node:path";
 import { normalizeAgentId } from "../../routing/session-key.js";
 import { resolveUserPath } from "../../utils.js";
 import { resolveAgentIdFromSessionKey } from "../agent-scope.js";
+import { hashTextSha256 } from "./hash.js";
 
 export function slugifySessionKey(value: string) {
   const trimmed = value.trim() || "session";
-  const hash = crypto.createHash("sha1").update(trimmed).digest("hex").slice(0, 8);
+  const hash = hashTextSha256(trimmed).slice(0, 8);
   const safe = trimmed
     .toLowerCase()
     .replace(/[^a-z0-9._-]+/g, "-")