From df9f50ea3113130f7699cf53f029e87da71645b1 Mon Sep 17 00:00:00 2001
From: Quixos Development Agent 01f26965-84fa-4a79-8069-725682c13065
 <01f26965-84fa-4a79-8069-725682c13065@agents.gitea.internal.quixos.org>
Date: Wed, 28 Oct 2026 22:14:29 +0000
Subject: [PATCH] Reuse the canonical language bridge in deep Agent tmux
 fixtures (#503)

---
 socket-address-cli.mjs | 44 ++++++++++++++++++++++++++++++++++++++++++
 socket-address-cli.nix | 14 ++++++++++++++
 2 files changed, 58 insertions(+)
 create mode 100644 socket-address-cli.mjs
 create mode 100644 socket-address-cli.nix

diff --git a/socket-address-cli.mjs b/socket-address-cli.mjs
new file mode 100644
index 0000000..781935a
--- /dev/null
+++ b/socket-address-cli.mjs
@@ -0,0 +1,44 @@
+// Language bridge to the shared socket policy; identities contain no credentials.
+import {
+  checkedSocketPath,
+  prepareSocketDirectory,
+  removeEmptySocketDirectory,
+  socketAddress,
+} from "./socket-address.mjs";
+
+const [operation, role = "bootstrap"] = process.argv.slice(2);
+if (
+  !["check-path", "prepare", "prepare-directory", "address", "cleanup"].includes(operation) ||
+  process.argv.length > 4 ||
+  (process.argv.length === 4 && !["prepare", "address"].includes(operation))
+)
+  throw Error("Select a socket operation and an optional address role");
+const chunks = [];
+let length = 0;
+for await (const chunk of process.stdin) {
+  length += chunk.length;
+  if (length > 1024 * 1024) throw Error("Socket command input exceeds its bound");
+  chunks.push(chunk);
+}
+const identity = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks)));
+switch (operation) {
+  case "check-path":
+    console.log(checkedSocketPath(identity));
+    break;
+  case "prepare": {
+    // Validate the role before creating any directories.
+    const address = socketAddress(identity, role);
+    await prepareSocketDirectory(identity);
+    console.log(address);
+    break;
+  }
+  case "prepare-directory":
+    console.log(await prepareSocketDirectory(identity));
+    break;
+  case "address":
+    console.log(socketAddress(identity, role));
+    break;
+  case "cleanup":
+    await removeEmptySocketDirectory(identity);
+    break;
+}
diff --git a/socket-address-cli.nix b/socket-address-cli.nix
new file mode 100644
index 0000000..8371a88
--- /dev/null
+++ b/socket-address-cli.nix
@@ -0,0 +1,14 @@
+{ pkgs }:
+let
+  code = pkgs.runCommand "quixos-socket-address-code" { } ''
+    mkdir "$out"
+    cp ${./socket-address-cli.mjs} "$out/socket-address-cli.mjs"
+    cp ${./socket-address.mjs} "$out/socket-address.mjs"
+  '';
+in
+pkgs.writeShellApplication {
+  name = "quixos-socket-address";
+  text = ''
+    exec ${pkgs.nodejs_24}/bin/node --max-old-space-size=64 ${code}/socket-address-cli.mjs "$@"
+  '';
+}