elevate: default socket to XDG_RUNTIME_DIR, add to sandbox env

Both x/elevate and elevate-adapter-superpowerd now default the socket
path to $XDG_RUNTIME_DIR/ollie/elevate.sock (falling back to
/run/user/<uid>/ollie/elevate.sock) when OLLIE_ELEVATE_SOCKET is unset.
Add OLLIE_ELEVATE_SOCKET to env sections of both sandbox configs.
Add {XDG_RUNTIME_DIR}/ollie to restricted sandbox filesystem rw rules
so x/elevate can reach the socket. Update README env block and
scripts/README socket path docs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

README.md

@@ -55,7 +55,7 @@ OLLIE_KIRO_TOKEN=...           # bearer token or sqlite:// path (auto-detected f
 OLLIE_MODEL=qwen/qwen3-235b-a22b
 OLLIE_TOOLS_PATH=~/.config/ollie/tools    # directory for tool scripts ({tool} steps)
 OLLIE_MEMORY_PATH=~/.config/ollie/memory  # directory for memory files (ollie/m)
-OLLIE_ELEVATE_SOCKET=~/.run/ollie-elevate.sock  # socket path for x/elevate adapter
+OLLIE_ELEVATE_SOCKET=${XDG_RUNTIME_DIR}/ollie/elevate.sock  # socket path for x/elevate adapter (default: $XDG_RUNTIME_DIR/ollie/elevate.sock)
 ```
 
 Shell environment variables take precedence over the env file.

sandbox/default.yaml

@@ -118,6 +118,7 @@ env:
   - OLLIE_SESSION_ID
   - OLLIE_SKILLS_PATH
   - OLLIE_TMP_PATH
+  - OLLIE_ELEVATE_SOCKET
   - OLLIE_TOOLS_PATH
   - OLLIE_TRANSCRIPT_PATH
   - HOME

sandbox/restricted.yaml

@@ -24,6 +24,7 @@ filesystem:
     - "/dev/null"
     - "/tmp"
     - "{NAMESPACE}"
+    - "{XDG_RUNTIME_DIR}/ollie"
   rwx:
     - "{CWD}"
     - "{OLLIE}"
@@ -37,6 +38,7 @@ env:
   - OLLIE_SESSION_ID
   - OLLIE_SKILLS_PATH
   - OLLIE_TMP_PATH
+  - OLLIE_ELEVATE_SOCKET
   - OLLIE_TOOLS_PATH
   - OLLIE_TRANSCRIPT_PATH
   - PATH

scripts/README.md

@@ -219,10 +219,13 @@ returns the result.
 exit_code}`. The adapter on the other end is backend-specific. Multiple adapters can
 coexist at different socket paths; switching backends is a single env var change.
 
-Set `OLLIE_ELEVATE_SOCKET` in `~/.config/ollie/env`:
+Set `OLLIE_ELEVATE_SOCKET` in `~/.config/ollie/env`. The default is
+`$XDG_RUNTIME_DIR/ollie/elevate.sock` (falling back to
+`/run/user/<uid>/ollie/elevate.sock`), so this only needs to be set when using
+a non-default path:
 
 ```
-OLLIE_ELEVATE_SOCKET=~/.run/ollie-elevate.sock
+OLLIE_ELEVATE_SOCKET=${XDG_RUNTIME_DIR}/ollie/elevate.sock
 ```
 
 ### Protocol

scripts/x/elevate

@@ -13,11 +13,13 @@ import socket
 import sys
 
 
+def default_socket_path():
+    xdg = os.environ.get("XDG_RUNTIME_DIR") or f"/run/user/{os.getuid()}"
+    return os.path.join(xdg, "ollie", "elevate.sock")
+
+
 def main():
-    sock_path = os.environ.get("OLLIE_ELEVATE_SOCKET")
-    if not sock_path:
-        print("elevate: OLLIE_ELEVATE_SOCKET not set", file=sys.stderr)
-        sys.exit(1)
+    sock_path = os.environ.get("OLLIE_ELEVATE_SOCKET") or default_socket_path()
 
     if len(sys.argv) < 3:
         print("usage: elevate -- <cmd>", file=sys.stderr)

scripts/x/elevate-adapter-superpowerd

@@ -9,7 +9,8 @@ Usage:
     superpowers run-session -- python3 elevate-adapter-superpowerd
 
 Environment:
-    OLLIE_ELEVATE_SOCKET      path for the listening socket (required)
+    OLLIE_ELEVATE_SOCKET       path for the listening socket
+                               (default: $XDG_RUNTIME_DIR/ollie/elevate.sock)
     SUPERPOWERD_SESSION_TOKEN  set automatically by superpowers run-session
     SUPERPOWERD_SOCKET         override superpowerd socket path
     SUPERPOWERD_SOCKET_DIR     directory containing superpowerd.sock
@@ -22,6 +23,11 @@ import sys
 import threading
 
 
+def default_socket_path():
+    xdg = os.environ.get("XDG_RUNTIME_DIR") or f"/run/user/{os.getuid()}"
+    return os.path.join(xdg, "ollie", "elevate.sock")
+
+
 def sp_socket_path():
     if p := os.environ.get("SUPERPOWERD_SOCKET"):
         return p
@@ -95,11 +101,7 @@ def main():
         os.execvp("superpowers", ["superpowers", "run-session", "--",
                                    sys.executable, __file__] + sys.argv[1:])
 
-    sock_path = os.environ.get("OLLIE_ELEVATE_SOCKET")
-    if not sock_path:
-        print("elevate-adapter-superpowerd: OLLIE_ELEVATE_SOCKET not set", file=sys.stderr)
-        sys.exit(1)
-
+    sock_path = os.environ.get("OLLIE_ELEVATE_SOCKET") or default_socket_path()
     sock_path = os.path.expanduser(sock_path)
     os.makedirs(os.path.dirname(sock_path), exist_ok=True)