fix: hashlib FIPS crash + assert→runtime guards in 4 production files

agent/codex_responses_adapter.py

@@ -233,7 +233,7 @@ def _derive_responses_function_call_id(
         return f"fc_{sanitized[:48]}"
 
     seed = source or str(response_item_id or "") or uuid.uuid4().hex
-    digest = hashlib.sha1(seed.encode("utf-8")).hexdigest()[:24]
+    digest = hashlib.sha1(seed.encode("utf-8"), usedforsecurity=False).hexdigest()[:24]
     return f"fc_{digest}"
 
 

agent/context_compressor.py

@@ -1266,7 +1266,7 @@ def _prune_old_tool_results(
                 continue
             if len(content) < 200:
                 continue
-            h = hashlib.md5(content.encode("utf-8", errors="replace")).hexdigest()[:12]
+            h = hashlib.md5(content.encode("utf-8", errors="replace"), usedforsecurity=False).hexdigest()[:12]
             if h in content_hashes:
                 # This is an older duplicate — replace with back-reference
                 result[i] = {**msg, "content": "[Duplicate tool output — same content as a more recent call]"}

agent/transports/codex_app_server_session.py

@@ -396,7 +396,8 @@ def run_turn(
             # turn re-spawns cleanly.
             result.should_retire = True
             return result
-        assert self._client is not None and self._thread_id is not None
+        if self._client is None or self._thread_id is None:
+            raise RuntimeError("codex session not initialised — call connect() first")
         result.thread_id = self._thread_id
 
         self._interrupt_event.clear()

tui_gateway/server.py

@@ -5850,7 +5850,8 @@ def _(rid, params: dict) -> dict:
     session, err = _sess_nowait({"session_id": sid}, rid)
     if err:
         return err
-    assert session is not None
+    if session is None:
+        return _err(rid, -32000, "session not found or unavailable")
 
     return _ok(
         rid,