From 3bb4324aa020a7b1bbbe9bfb8acb6b8122cc3839 Mon Sep 17 00:00:00 2001
From: Quixos Development Agent 01f26965-84fa-4a79-8069-725682c13065
 <01f26965-84fa-4a79-8069-725682c13065@agents.gitea.internal.quixos.org>
Date: Wed, 28 Oct 2026 22:44:31 +0000
Subject: [PATCH] Budget OpenSSH temporary sockets in the shared address policy
 (#503)

---
 socket-address.mjs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/socket-address.mjs b/socket-address.mjs
index 57d866f..fc1eb54 100644
--- a/socket-address.mjs
+++ b/socket-address.mjs
@@ -64,7 +64,8 @@ export function socketDirectory(identity, options) {
   const { uid, root } = settings(options);
   const input = canonical(["quixos-unix-socket-v1", uid, identity]);
   if (Buffer.byteLength(input) > 1024 * 1024) throw Error("Socket identity exceeds its bound");
-  return path.join(root, createHash("sha256").update(input).digest("hex"));
+  // Preserve all 256 bits while leaving room for protocol-added socket suffixes.
+  return path.join(root, createHash("sha256").update(input).digest("base64url"));
 }
 
 export function socketAddress(identity, role, options) {