siltrun 0.1.0

package/src/login.test.ts

@@ -0,0 +1,307 @@
+// Tests for the CLI identity layer: the credentials store, the `siltrun login`
+// loopback arc (against a mock intake + a fake "browser"), and `siltrun deploy`'s
+// credential precedence (session first, legacy SILT_DEPLOY_TOKEN fallback,
+// per-backend session scoping).
+//
+// No real browser, no real worker: the injected openBrowser plays the browser's
+// role by following the redirect contract directly — exactly the data path the
+// worker's /login/callback 302 produces.
+
+import { describe, expect, test, afterEach } from "bun:test";
+import { mkdtempSync, rmSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  clearCredentials,
+  credentialsPath,
+  loadCredentials,
+  saveCredentials,
+} from "./credentials.ts";
+import { runLogin, runWhoami } from "./login.ts";
+import { runDeploy, type DeployLogger } from "./deploy.ts";
+
+const tempDirs: string[] = [];
+function tempHome(): string {
+  const d = mkdtempSync(join(tmpdir(), "silt-login-test-"));
+  tempDirs.push(d);
+  return d;
+}
+afterEach(() => {
+  for (const d of tempDirs.splice(0)) rmSync(d, { recursive: true, force: true });
+});
+
+function quietLogger(): DeployLogger & { lines: string[] } {
+  const lines: string[] = [];
+  return {
+    lines,
+    info: (m: string) => lines.push(`info ${m}`),
+    warn: (m: string) => lines.push(`warn ${m}`),
+    error: (m: string) => lines.push(`error ${m}`),
+    plain: (m = "") => lines.push(m),
+  };
+}
+
+// ── credentials store ────────────────────────────────────────────────────────
+
+describe("credentials store", () => {
+  test("round-trips and is chmod 600", () => {
+    const env = { SILT_HOME: tempHome() };
+    expect(loadCredentials(env)).toBeNull();
+
+    const creds = {
+      token: "s-abc123",
+      login: "alice",
+      accountId: "acc-1",
+      intakeUrl: "http://127.0.0.1:9999",
+      createdAt: new Date().toISOString(),
+    };
+    const p = saveCredentials(creds, env);
+    expect(p).toBe(credentialsPath(env));
+    expect(loadCredentials(env)).toEqual(creds);
+    expect(statSync(p).mode & 0o777).toBe(0o600);
+
+    expect(clearCredentials(env)).toBe(true);
+    expect(loadCredentials(env)).toBeNull();
+    expect(clearCredentials(env)).toBe(false);
+  });
+
+  test("malformed file reads as not-logged-in", () => {
+    const env = { SILT_HOME: tempHome() };
+    saveCredentials(
+      { token: "s-x", login: "a", intakeUrl: "http://x", createdAt: "now" },
+      env,
+    );
+    // Corrupt it.
+    require("node:fs").writeFileSync(credentialsPath(env), "{nope");
+    expect(loadCredentials(env)).toBeNull();
+  });
+});
+
+// ── the login arc ────────────────────────────────────────────────────────────
+
+/** A mock intake: only /v0/me — the "browser" below plays the /login/* half. */
+function mockIntake(me: { accountId: string; login: string; provider?: string }) {
+  return Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch(req) {
+      const url = new URL(req.url);
+      if (url.pathname === "/v0/me") {
+        const authz = req.headers.get("Authorization") || "";
+        if (!authz.startsWith("Bearer s-")) {
+          return new Response(JSON.stringify({ error: "unauthorized" }), { status: 401 });
+        }
+        return new Response(JSON.stringify({ provider: "stub", ...me }), {
+          headers: { "Content-Type": "application/json" },
+        });
+      }
+      return new Response("nf", { status: 404 });
+    },
+  });
+}
+
+/** A fake browser: parse callback+state off the /login/start URL and hit the
+ *  loopback the way the worker's final 302 would. */
+function fakeBrowser(opts: { token?: string; stateOverride?: string; login?: string } = {}) {
+  return async (startUrl: string): Promise<boolean> => {
+    const u = new URL(startUrl);
+    const callback = u.searchParams.get("callback")!;
+    const state = opts.stateOverride ?? u.searchParams.get("state")!;
+    const cb = new URL(callback);
+    cb.searchParams.set("token", opts.token ?? "s-sessiontoken");
+    cb.searchParams.set("login", opts.login ?? "alice");
+    cb.searchParams.set("state", state);
+    await fetch(cb.toString()).catch(() => {});
+    return true;
+  };
+}
+
+describe("siltrun login", () => {
+  test("happy arc: token lands, /v0/me confirms, credentials persist", async () => {
+    const intake = mockIntake({ accountId: "acc-42", login: "alice" });
+    const env = { SILT_HOME: tempHome(), SILT_DEPLOY_URL: `http://127.0.0.1:${intake.port}` };
+    try {
+      const result = await runLogin({
+        env,
+        logger: quietLogger(),
+        openBrowser: fakeBrowser({ token: "s-fromworker" }),
+        timeoutMs: 5000,
+      });
+      expect(result.ok).toBe(true);
+      expect(result.login).toBe("alice");
+
+      const creds = loadCredentials(env)!;
+      expect(creds.token).toBe("s-fromworker");
+      expect(creds.accountId).toBe("acc-42");
+      expect(creds.intakeUrl).toBe(`http://127.0.0.1:${intake.port}`);
+    } finally {
+      intake.stop(true);
+    }
+  });
+
+  test("state mismatch rejects the CLI wait immediately — no 5-min hang (finding #6)", async () => {
+    // Before the fix the loopback handler 400'd the browser but never rejected
+    // the CLI's tokenArrived, so runLogin blocked for the full timeout. A generous
+    // timeout here would blow the test budget if that regressed; the fix makes it
+    // return at once with a clear message.
+    const intake = mockIntake({ accountId: "acc-42", login: "alice" });
+    const env = { SILT_HOME: tempHome(), SILT_DEPLOY_URL: `http://127.0.0.1:${intake.port}` };
+    const logger = quietLogger();
+    try {
+      const started = Date.now();
+      const result = await runLogin({
+        env,
+        logger,
+        openBrowser: fakeBrowser({ stateOverride: "wrong-state-entirely" }),
+        timeoutMs: 60_000, // generous on purpose — a hang would take the whole budget
+      });
+      const elapsed = Date.now() - started;
+      expect(result.ok).toBe(false);
+      expect(result.error).toContain("state mismatch");
+      expect(elapsed).toBeLessThan(5_000); // rejected on the mismatch, not the timeout
+      expect(loadCredentials(env)).toBeNull();
+      expect(logger.lines.join("\n")).toContain("state mismatch");
+    } finally {
+      intake.stop(true);
+    }
+  });
+
+  test("whoami reports the stored login via /v0/me", async () => {
+    const intake = mockIntake({ accountId: "acc-42", login: "alice" });
+    const env = { SILT_HOME: tempHome(), SILT_DEPLOY_URL: `http://127.0.0.1:${intake.port}` };
+    try {
+      saveCredentials(
+        {
+          token: "s-tok",
+          login: "alice",
+          intakeUrl: `http://127.0.0.1:${intake.port}`,
+          createdAt: "now",
+        },
+        env,
+      );
+      const logger = quietLogger();
+      expect(await runWhoami({ env, logger })).toBe(true);
+      expect(logger.lines.join("\n")).toContain("alice");
+    } finally {
+      intake.stop(true);
+    }
+  });
+});
+
+// ── deploy credential precedence ─────────────────────────────────────────────
+
+// A minimal fetch mock that records the Authorization header of the deploy POST
+// and plays a live deploy so runDeploy completes.
+function recordingFetch(seen: { auth: string | null }) {
+  return (async (input: any, init?: any) => {
+    const url = String(input);
+    if (url.includes("/v0/deploy?")) {
+      seen.auth = init?.headers?.Authorization ?? null;
+      return new Response(
+        JSON.stringify({ deployId: "d1", room: "r", status: "queued" }),
+        { status: 201, headers: { "Content-Type": "application/json" } },
+      );
+    }
+    return new Response(
+      JSON.stringify({ deployId: "d1", room: "r", status: "live", url: "https://x/room/r" }),
+      { status: 200, headers: { "Content-Type": "application/json" } },
+    );
+  }) as typeof fetch;
+}
+
+function deployDeps(env: Record<string, string | undefined>, seen: { auth: string | null }) {
+  return {
+    env,
+    fetchImpl: recordingFetch(seen),
+    sleep: async () => {},
+    bundle: async (_c: string, out: string) => {
+      await Bun.write(out, "export default {}");
+      return out;
+    },
+    doctor: async () => ({ status: "skipped", note: "test" }) as any,
+    logger: quietLogger(),
+    pollIntervalMs: 1,
+    pollBudgetMs: 200,
+  };
+}
+
+describe("siltrun deploy credential precedence", () => {
+  const contract = join(import.meta.dir, "deploy.ts"); // any existing file works
+
+  test("explicit SILT_DEPLOY_TOKEN wins over a stored session (explicit beats ambient)", async () => {
+    // Review finding #2: an explicitly-set env token must outrank the login
+    // session, even for the session's own backend — and say so once.
+    const home = tempHome();
+    const base = "http://127.0.0.1:4242";
+    saveCredentials(
+      { token: "s-session", login: "alice", intakeUrl: base, createdAt: "now" },
+      { SILT_HOME: home },
+    );
+    const seen = { auth: null as string | null };
+    const deps = deployDeps({ SILT_HOME: home, SILT_DEPLOY_URL: base, SILT_DEPLOY_TOKEN: "t-legacy" }, seen);
+    const result = await runDeploy({ contract, room: "r" }, deps);
+    expect(result.ok).toBe(true);
+    expect(seen.auth).toBe("Bearer t-legacy");
+    expect((deps.logger as any).lines.join("\n")).toContain("SILT_DEPLOY_TOKEN");
+    expect((deps.logger as any).lines.join("\n")).toContain("logged-in account ignored");
+  });
+
+  test("no env token → the stored session is used for its own backend", async () => {
+    // The other half of the precedence: with SILT_DEPLOY_TOKEN unset, the login
+    // session is what deploys (byte-compatible with the pre-fix session path).
+    const home = tempHome();
+    const base = "http://127.0.0.1:4242";
+    saveCredentials(
+      { token: "s-session", login: "alice", intakeUrl: base, createdAt: "now" },
+      { SILT_HOME: home },
+    );
+    const seen = { auth: null as string | null };
+    const result = await runDeploy(
+      { contract, room: "r" },
+      deployDeps({ SILT_HOME: home, SILT_DEPLOY_URL: base }, seen),
+    );
+    expect(result.ok).toBe(true);
+    expect(seen.auth).toBe("Bearer s-session");
+  });
+
+  test("session for a DIFFERENT backend is not sent — env token used instead", async () => {
+    const home = tempHome();
+    saveCredentials(
+      { token: "s-session", login: "alice", intakeUrl: "http://other-backend:1", createdAt: "now" },
+      { SILT_HOME: home },
+    );
+    const seen = { auth: null as string | null };
+    const result = await runDeploy(
+      { contract, room: "r" },
+      deployDeps(
+        { SILT_HOME: home, SILT_DEPLOY_URL: "http://127.0.0.1:4242", SILT_DEPLOY_TOKEN: "t-legacy" },
+        seen,
+      ),
+    );
+    expect(result.ok).toBe(true);
+    expect(seen.auth).toBe("Bearer t-legacy");
+  });
+
+  test("no session → legacy env token still works (the QA path)", async () => {
+    const seen = { auth: null as string | null };
+    const result = await runDeploy(
+      { contract, room: "r" },
+      deployDeps(
+        { SILT_HOME: tempHome(), SILT_DEPLOY_URL: "http://127.0.0.1:4242", SILT_DEPLOY_TOKEN: "t-legacy" },
+        seen,
+      ),
+    );
+    expect(result.ok).toBe(true);
+    expect(seen.auth).toBe("Bearer t-legacy");
+  });
+
+  test("no credential at all → honest abort mentioning siltrun login", async () => {
+    const seen = { auth: null as string | null };
+    const deps = deployDeps({ SILT_HOME: tempHome(), SILT_DEPLOY_URL: "http://127.0.0.1:4242" }, seen);
+    const result = await runDeploy({ contract, room: "r" }, deps);
+    expect(result.ok).toBe(false);
+    expect(result.error).toBe("no token");
+    expect((deps.logger as any).lines.join("\n")).toContain("siltrun login");
+  });
+});

package/src/login.ts

@@ -0,0 +1,263 @@
+// `siltrun login` / `siltrun logout` / `siltrun whoami` — account identity for the CLI.
+//
+// The login is a browser-handoff arc (the wrangler/vercel shape), against the
+// intake worker's /login routes (deploy/CONTROL-PLANE.md v0.3):
+//
+//   1. start a loopback HTTP listener on an ephemeral 127.0.0.1 port
+//   2. open the browser at <intake>/login/start?callback=<loopback>&state=<nonce>
+//      (and print the URL, for headless/remote shells)
+//   3. the worker runs the provider dance (stub today, GitHub later — the
+//      provider is the WORKER's configuration seam; this CLI code is identical
+//      for both) and 302s the browser back to the loopback with an `s-` session
+//      token + the state nonce
+//   4. verify the state matches (the CSRF binding), confirm the token against
+//      GET /v0/me, and persist it via credentials.ts
+//
+// From then on `siltrun deploy` is account-keyed: it sends the stored session
+// token instead of a hand-issued tester token.
+
+import { spawn } from "node:child_process";
+
+import { DEFAULT_INTAKE_URL } from "./deploy.ts";
+import { normalizeBase, type FetchLike } from "./deploy-client.ts";
+import {
+  clearCredentials,
+  credentialsPath,
+  loadCredentials,
+  saveCredentials,
+} from "./credentials.ts";
+import { log, paint } from "./log.ts";
+import type { DeployLogger } from "./deploy.ts";
+
+const LOGIN_TIMEOUT_MS = 5 * 60_000; // the human is in a browser — be generous
+
+export interface LoginDeps {
+  env: Record<string, string | undefined>;
+  fetchImpl: FetchLike;
+  logger: DeployLogger;
+  /** Open `url` in the user's browser; resolve false if that failed (we printed
+   *  the URL anyway, so failure is non-fatal). */
+  openBrowser: (url: string) => Promise<boolean>;
+  timeoutMs: number;
+}
+
+function defaultDeps(): LoginDeps {
+  return {
+    env: process.env,
+    fetchImpl: fetch,
+    logger: log,
+    openBrowser: systemOpen,
+    timeoutMs: LOGIN_TIMEOUT_MS,
+  };
+}
+
+async function systemOpen(url: string): Promise<boolean> {
+  const cmd =
+    process.platform === "darwin"
+      ? ["open", url]
+      : process.platform === "win32"
+        ? ["cmd", "/c", "start", "", url]
+        : ["xdg-open", url];
+  try {
+    const child = spawn(cmd[0]!, cmd.slice(1), { stdio: "ignore", detached: true });
+    child.unref();
+    return await new Promise((resolve) => {
+      child.on("error", () => resolve(false));
+      child.on("spawn", () => resolve(true));
+    });
+  } catch {
+    return false;
+  }
+}
+
+export interface LoginResult {
+  ok: boolean;
+  login?: string;
+  error?: string;
+}
+
+/** The page the loopback listener serves once the token lands — the "you can
+ *  close this tab" moment. Deliberately free of the token. */
+const DONE_PAGE = (login: string) => `<!doctype html><meta charset="utf-8"><title>silt — logged in</title>
+<body style="font-family:system-ui;max-width:26rem;margin:4rem auto;line-height:1.5">
+<h1 style="font-size:1.2rem">✓ Logged in as ${login.replace(/&/g, "&amp;").replace(/</g, "&lt;")}</h1>
+<p>You can close this tab and return to your terminal.</p></body>`;
+
+export async function runLogin(overrides: Partial<LoginDeps> = {}): Promise<LoginResult> {
+  const deps = { ...defaultDeps(), ...overrides };
+  const { logger, env } = deps;
+
+  const baseUrl = normalizeBase(env.SILT_DEPLOY_URL || DEFAULT_INTAKE_URL);
+  // State nonce: the CSRF binding between this process and the browser redirect.
+  const state = crypto.randomUUID().replace(/-/g, "");
+
+  // 1. Loopback listener on an ephemeral port.
+  let resolveToken: (v: { token: string; login: string }) => void;
+  let rejectToken: (e: Error) => void;
+  const tokenArrived = new Promise<{ token: string; login: string }>((res, rej) => {
+    resolveToken = res;
+    rejectToken = rej;
+  });
+  // The loopback handler can reject this on a state mismatch BEFORE the awaiter
+  // below is attached (the browser round-trip lands first). A detached no-op
+  // handler keeps that from surfacing as an unhandled rejection; the real
+  // `await tokenArrived` still observes the rejection and fails the login.
+  tokenArrived.catch(() => {});
+
+  const server = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch(req) {
+      const url = new URL(req.url);
+      if (url.pathname !== "/cb") return new Response("not found", { status: 404 });
+      const token = url.searchParams.get("token") || "";
+      const login = url.searchParams.get("login") || "";
+      const gotState = url.searchParams.get("state") || "";
+      if (gotState !== state || !token) {
+        // Wrong/missing state: never accept the token — this is the CSRF gate.
+        // AND fail the CLI wait right now instead of hanging until the 5-min
+        // timeout: a mismatch means the real token is never coming.
+        rejectToken(new Error("state mismatch — re-run `siltrun login`"));
+        return new Response("login state mismatch — re-run `siltrun login`", { status: 400 });
+      }
+      resolveToken({ token, login });
+      return new Response(DONE_PAGE(login), {
+        headers: { "Content-Type": "text/html; charset=utf-8" },
+      });
+    },
+  });
+
+  try {
+    const callback = `http://127.0.0.1:${server.port}/cb`;
+    const startUrl = `${baseUrl}/login/start?callback=${encodeURIComponent(callback)}&state=${state}`;
+
+    logger.info(`logging in via ${paint.dim(baseUrl)}`);
+    const opened = await deps.openBrowser(startUrl);
+    logger.plain(
+      opened
+        ? paint.dim("  browser opened — finish logging in there. If nothing appeared, open:")
+        : paint.dim("  could not open a browser — open this URL yourself:"),
+    );
+    logger.plain(`  ${paint.cyan(startUrl)}`);
+
+    // 2. Wait for the redirect (or time out honestly).
+    const timer = setTimeout(
+      () => rejectToken(new Error(`no login completed within ${Math.round(deps.timeoutMs / 60000)} min`)),
+      deps.timeoutMs,
+    );
+    let token: string, login: string;
+    try {
+      ({ token, login } = await tokenArrived);
+    } finally {
+      clearTimeout(timer);
+    }
+
+    // 3. Confirm the token against /v0/me (and pick up the accountId).
+    let accountId: string | undefined;
+    try {
+      const res = await deps.fetchImpl(`${baseUrl}/v0/me`, {
+        headers: { Authorization: `Bearer ${token}` },
+      });
+      if (res.ok) {
+        const me = (await res.json()) as { accountId?: string; login?: string };
+        accountId = me.accountId;
+        if (me.login) login = me.login;
+      } else {
+        logger.warn(`could not confirm the session (/v0/me → ${res.status}) — storing it anyway`);
+      }
+    } catch (e) {
+      logger.warn(
+        `could not confirm the session (${e instanceof Error ? e.message : String(e)}) — storing it anyway`,
+      );
+    }
+
+    // 4. Persist.
+    const path = saveCredentials(
+      {
+        token,
+        login,
+        accountId,
+        intakeUrl: baseUrl,
+        createdAt: new Date().toISOString(),
+      },
+      env,
+    );
+
+    logger.plain("");
+    logger.info(paint.green(`logged in as ${paint.bold(login)}`) + paint.dim(` — saved to ${path}`));
+    logger.plain(paint.dim("  `siltrun deploy` now ships rooms under this account."));
+    return { ok: true, login };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    logger.error(`login failed: ${msg}`);
+    return { ok: false, error: msg };
+  } finally {
+    server.stop(true);
+  }
+}
+
+export async function runLogout(
+  env: Record<string, string | undefined> = process.env,
+  logger: DeployLogger = log,
+): Promise<boolean> {
+  const had = clearCredentials(env);
+  if (had) {
+    logger.info(`logged out ${paint.dim(`(removed ${credentialsPath(env)})`)}`);
+  } else {
+    logger.info("not logged in — nothing to remove");
+  }
+  return had;
+}
+
+export async function runWhoami(overrides: Partial<LoginDeps> = {}): Promise<boolean> {
+  const deps = { ...defaultDeps(), ...overrides };
+  const { logger, env } = deps;
+
+  const creds = loadCredentials(env);
+  if (!creds) {
+    logger.info("not logged in — run `siltrun login`");
+    if (env.SILT_DEPLOY_TOKEN) {
+      logger.plain(paint.dim("  (SILT_DEPLOY_TOKEN is set — deploys use that legacy beta token)"));
+    }
+    return false;
+  }
+
+  try {
+    const res = await deps.fetchImpl(`${normalizeBase(creds.intakeUrl)}/v0/me`, {
+      headers: { Authorization: `Bearer ${creds.token}` },
+    });
+    if (!res.ok) {
+      logger.warn(
+        `stored session for ${paint.bold(creds.login)} was rejected (${res.status}) — run \`siltrun login\` again`,
+      );
+      return false;
+    }
+    const me = (await res.json()) as { login?: string; accountId?: string; provider?: string };
+    logger.info(
+      `logged in as ${paint.bold(me.login || creds.login)} ` +
+        paint.dim(`(${me.provider || "?"} · account ${me.accountId || "?"} · ${creds.intakeUrl})`),
+    );
+    return true;
+  } catch (e) {
+    logger.warn(
+      `could not reach ${creds.intakeUrl} (${e instanceof Error ? e.message : String(e)}) — ` +
+        `stored login is ${paint.bold(creds.login)}`,
+    );
+    return false;
+  }
+}
+
+/** CLI entries (argv unused today — kept for symmetry with dev/deploy). */
+export async function login(_argv: string[]): Promise<void> {
+  const result = await runLogin();
+  if (!result.ok) process.exit(1);
+}
+
+export async function logout(_argv: string[]): Promise<void> {
+  await runLogout();
+}
+
+export async function whoami(_argv: string[]): Promise<void> {
+  const ok = await runWhoami();
+  if (!ok) process.exit(1);
+}

package/src/paths.ts

@@ -0,0 +1,92 @@
+// Resolves the runtime pieces the CLI drives — the Go room-server binary and the Bun
+// room-host — across the two ways `siltrun` runs:
+//
+//   1. INSTALLED (npm): the CLI package depends on @siltrun/room-host (the host/doctor
+//      sources) and on per-platform @siltrun/room-server-<os>-<arch> packages carrying a
+//      prebuilt server binary (the Wrangler/workerd distribution pattern). Everything
+//      resolves through node_modules — no repo checkout, no Go toolchain.
+//   2. IN-REPO (this monorepo): room-server and room-host are siblings under
+//      packages/, and the server is built from Go source (server-build.ts) so local
+//      .go edits are always honored.
+//
+// Sibling paths win when they exist (in-repo dev stays source-fresh); packaged
+// resolution covers the installed case. Every path is overridable by env for tests
+// and for unusual setups.
+
+import { dirname, join, resolve } from "node:path";
+import { existsSync } from "node:fs";
+
+// import.meta.dir is the directory of THIS file under Bun: .../packages/cli/src
+// (or .../node_modules/silt/src when installed — siblings then don't exist).
+const packagesDir = resolve(import.meta.dir, "..", "..");
+
+/** Resolve an installed package's directory, or null when it isn't installed. */
+function packageDir(name: string): string | null {
+  try {
+    return dirname(Bun.resolveSync(`${name}/package.json`, import.meta.dir));
+  } catch {
+    return null;
+  }
+}
+
+/** node platform-arch key, e.g. darwin-arm64 — matches the platform package suffixes. */
+export const platformKey = `${process.platform}-${process.arch}`;
+
+/** Prebuilt room-server binary from the installed platform package, or null. */
+function packagedRoomServerBin(): string | null {
+  const dir = packageDir(`@siltrun/room-server-${platformKey}`);
+  if (!dir) return null;
+  const bin = join(
+    dir,
+    process.platform === "win32" ? "silt-room-server.exe" : "silt-room-server",
+  );
+  return existsSync(bin) ? bin : null;
+}
+
+/** room-host entry (host.ts / doctor.ts) from the installed @siltrun/room-host, or null. */
+function packagedRoomHostFile(file: string): string | null {
+  const dir = packageDir("@siltrun/room-host");
+  if (!dir) return null;
+  const p = join(dir, file);
+  return existsSync(p) ? p : null;
+}
+
+// Sibling locations (the in-repo layout).
+const siblingRoomServerDir = join(packagesDir, "room-server");
+const siblingRoomHost = (file: string) => join(packagesDir, "room-host", file);
+
+export const paths = {
+  packagesDir,
+  /** Go source dir for in-repo builds; server-build skips it when it doesn't exist. */
+  roomServerDir: process.env.SILT_ROOM_SERVER_DIR || siblingRoomServerDir,
+  /** Prebuilt server binary: env override → installed platform package → null. */
+  roomServerBin:
+    process.env.SILT_ROOM_SERVER_BIN ||
+    (existsSync(siblingRoomServerDir) ? null : packagedRoomServerBin()),
+  // SEAM §1 pins the host invocation as `bun host.ts <bundle>`, so host.ts is the entry.
+  roomHostEntry:
+    process.env.SILT_ROOM_HOST_ENTRY ||
+    (existsSync(siblingRoomHost("host.ts"))
+      ? siblingRoomHost("host.ts")
+      : (packagedRoomHostFile("host.ts") ?? siblingRoomHost("host.ts"))),
+  // CONTRACT §4 / brief: the determinism doctor, if B has shipped it.
+  doctorEntry:
+    process.env.SILT_DOCTOR_ENTRY ||
+    (existsSync(siblingRoomHost("doctor.ts"))
+      ? siblingRoomHost("doctor.ts")
+      : (packagedRoomHostFile("doctor.ts") ?? siblingRoomHost("doctor.ts"))),
+};
+
+export function roomHostDir(): string {
+  return dirname(paths.roomHostEntry);
+}
+
+export const has = {
+  roomHost: () => existsSync(paths.roomHostEntry),
+  doctor: () => existsSync(paths.doctorEntry),
+};
+
+/** The bun binary running this CLI — handed to every downstream spawn (SILT_BUN). */
+export function bunBin(): string {
+  return process.env.SILT_BUN || process.execPath;
+}