feat(cli): auto-name clients <firstname>-NN + make --location optional (#137)

[saadqbal]

Closes #137. Part of the installer first-run UX v2 spec (umbrella backend#992; interim copy fixes shipped in client#307).

Makes client create need zero flags and zero prompts on the installer path.

What changed

Auto-name <firstname>-NN

• first_name is parsed from GET /userinfo/ into api.Identity and persisted in the profile at login.
• When --name / TRACEBLOC_CLIENT_NAME is absent, the name is auto-derived as <slug(first_name)>-NN (fallback: email local-part, then client). No name prompt, ever.
• NN is the next free two-digit number across the account's existing client names and namespaces, so a second machine lands on lukas-02 rather than a slug -2 bump — and the derived name passes through slug.Derive unchanged (name = namespace by construction).

--location optional

• No errMissingFlag("--location"), no prompt. CreateClientRequest.Location → json:"location,omitempty": with no --location the CLI sends nothing and the backend records the client with no location (backend#993), not a silent default.
• --location still honored verbatim. internal/geo stays in the tree for opt-in enrichment but no longer runs on the silent path; the now-dead detectZone seam and errMissingFlag/validateNonEmpty helpers are removed.

Noun pass — adopt message is now "This machine is already registered as client …" (machine = hardware, client = tracebloc entity). The vendor→collaborator sweep was already done in client#307; no user-facing vendor strings remain in the Go.

Docs — RFC-0001 Rev 8 amendment: §6.6/§6.7/§7.7 + the D1 row note the <firstname>-NN / optional-location deviation from the hostname-derived design (decided by Lukas 2026-07-06), keeping the original text as design-of-record.

Acceptance (all covered by tests)

• client create --yes --credential-file f with no other flags, non-interactive → succeeds, auto-name minted, no location key in the request body.
• Two machines, same account/first name → lukas-01, lukas-02.
• Re-run on the same cluster still adopts (idempotency unchanged — R7 tests green).
• --name/--location honored verbatim.

Local: go build, go vet, gofmt, errcheck, goimports, and the full go test ./... all clean.

Coordination notes for review

• Branches off develop, not the proto/cli-owns-cluster prototype (PROTOTYPE: client owns teardown; installer stays create front door; withdraw use, hide list #136) — a release ships from develop→main, so client create: auto-generate the client name (<firstname>-NN) and make --location optional #137 must be releasable independently. PROTOTYPE: client owns teardown; installer stays create front door; withdraw use, hide list #136 leaves the name/location block and adopt message untouched, so a later PROTOTYPE: client owns teardown; installer stays create front door; withdraw use, hide list #136↔develop merge should auto-resolve those regions to this PR's version.
• RFC "Rev 8" label collides with PROTOTYPE: client owns teardown; installer stays create front door; withdraw use, hide list #136, which also adds a Rev 8 (§15 client-surface). Whichever merges second should bump one to Rev 9 — the content is independent.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes provisioning defaults and API payloads (omitted location, new naming) and adds fail-closed paths around list failures and credential minting—behavioral risk for installer/CI, not auth/crypto.

Overview
Implements cli#137 so the installer can run client create with zero flags and zero prompts, while RFC-0001 documents the product shift in Rev 8.

Auto-name <firstname>-NN: Login persists first_name from GET /userinfo/ in the profile; when --name / TRACEBLOC_CLIENT_NAME are absent, the CLI picks the next free two-digit handle from the account’s existing clients (reuses the anchored client’s name on cluster re-run). Location is optional: CreateClientRequest.location uses omitempty so unset means no location key in JSON; internal/geo is deleted and name/location prompts are removed.

Safety: Login clears stale email/first name before WhoAmI; non-interactive mint requires --yes or --credential-file unless the cluster will adopt; auto-naming and that guard fail closed if the client list can’t be read (426 surfaces upgrade-required). Flags and env vars still override; resume commands pin the resolved auto-name.

^{Reviewed by Cursor Bugbot for commit 7670986. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

Deep review (multi-agent: 8 finder angles → independent verification per finding; two findings confirmed empirically against this branch). Overall: the core design is right and the test evolution is genuinely good — the acceptance tests check the raw JSON body for the absent location key and pin the auto-name into the failure-resume command. But the silent path has two real safety regressions worth fixing before merge; the rest is polish.

Findings, most severe first

1. internal/cli/client.go:256 — a bare non-interactive client create now provisions silently and prints the credential to stdout.
Deleting errMissingFlag removed the only guard that stopped a zero-flag, no---yes run from side-effecting. tracebloc client create | tee out.log → stdout isn't a TTY → prompter nil → review+confirm skipped → real client minted, machine credential lands in the log file. Before this PR: fail-fast with "required (non-interactive)" before any network write. Suggest: when pr == nil, require --yes (or --credential-file).

2. client.go:207 — a transient list failure deterministically mints a duplicate <base>-01.
ListClients failure is deliberately non-fatal, but auto-naming then numbers against an empty list. Since auto-naming is the default installer path, <base>-01 exists on virtually every account — so one 502 makes the duplicate the deterministic outcome, not a race; name and namespace collide (no server-side uniqueness), breaking D3's unique-handle contract, with the only trace in the install log file. The adopt pre-flight already fail-closes on listErr — this branch should too: refuse to auto-name (ask for --name), or fall back to a random -<hex4> suffix + a terminal warning.

3. internal/cli/auth.go:117 — a failed /userinfo/ during re-login leaves the previous user's identity in the profile.
Email/FirstName are written only on WhoAmI success and never cleared. Shared box: bob logs in while /userinfo/ 500s → profile keeps FirstName: Alice with bob's token → bob's client is durably named alice-01. Suggest: reset both fields before the best-effort fetch.

4. client.go:668–684 — the numbering bypasses the slug layer's 63-char cap, breaking the PR's own invariant.
fmt.Sprintf("%s-%02d", base, n) appends to a base already capped at 63, so a ≥61-char first_name yields a 66-char display name while slug.Derive truncates the namespace back — name ≠ namespace, and machine 2 then gets the exact slug -2 bump this PR exists to eliminate (verified empirically on this branch: base×63 → name …-01 (66 chars) vs namespace … (63); machine 2 → display …-02 but namespace …-2). Deeper fix: move NN-numbering into the slug package next to Derive's existing collision logic — that makes the name==namespace invariant structural and collapses the two hand-rolled taken-sets (lines 678 vs 243) that already have subtly different membership rules.

5. client.go:63 — --help still promises the old contract.
The --location help says "prompted if omitted" and the command Short still advertises (--name, --location) — the surface says prompts exist while the behavior is silent omission.

6. client.go:201 — comments + RFC promise TRACEBLOC_CLIENT_NAME overrides, but no code reads it.
It works via the installer (provision.sh maps the env var to --name), but a direct CLI invocation silently ignores it. Either wire os.Getenv as a fallback or scope the claim to the installer path.

7. internal/geo/ is now a dead package (~265 non-test lines + CI-run tests) with a comment claiming it "stays available".
The detectZone seam was its last caller. Meanwhile --location is sent verbatim with zero validation — the zone table that could catch --location Germany at the boundary ships in the binary, unreachable. Delete the package (git remembers), or actually wire opt-in validation.

8. client.go:307 — the noun swap went the wrong direction.
"This machine is already registered as client…" — but the adopt is keyed on the cluster anchor (kube-system UID), and the CLI can run from a workstation against a remote cluster a colleague provisioned; that workstation was never registered. The original "This cluster…" was factually right (and the sibling hint at line 149 still says "on the same cluster it adopts").

Minor, below the cap: the prompt-era answers: map[string]string{} scaffolding left in client_test.go:683 / verbose_install_test.go:142 is dead weight now that create never calls Input; and the new signInAs test helper silently writes to the developer's real ~/.tracebloc if ever called before withClientBackend sets TRACEBLOC_CONFIG_DIR — worth a guard.

Findings 1–3 are cheap fixes; #4's slug-layer move is the one structural ask.

🤖 Review generated with Claude Code

[saadqbal]

Great review — 1/2/3 are real and worth catching. Pushed 010ddf7 fixing everything except #7:

• 1/2 (the safety ones): non-interactive mint now fails closed unless --yes or --credential-file is given, and auto-naming refuses on a client-list error instead of numbering against an empty list into a <base>-01 duplicate. Installer passes both flags, so it's unaffected.
• 3: login clears email/first_name before the best-effort WhoAmI, so a failed confirm can't leave the prior user's identity.
• 4: capped <base>-NN at 63 so name == namespace holds for long names. Kept it in autoClientName rather than moving numbering into slug — same invariant, less churn; happy to do the slug-layer move as a follow-up if you'd prefer the structural version.
• 5/6: help/Short no longer claim prompting; wired TRACEBLOC_CLIENT_NAME/_LOCATION as real flag defaults so the override is true for a direct CLI call, not just the installer.
• 8: reverted to "This cluster…" (agreed — cluster-keyed + remote-capable, and the sibling hints say cluster).
• minors: dropped the dead prompter maps + guarded signInAs.

On #7 I'd keep internal/geo: the ticket parks it for opt-in --location enrichment and #95 builds directly on it, so deleting now churns a package that gets a caller back shortly. Fine to leave it, or do you want the --location zone-validation wired here instead of in #95?

Each fix has a regression test; full suite green under -race.

[saadqbal]

Re #7 — went with deleting it (c1aaa68). internal/geo is gone (geo.go + regions.go + tests), RFC Rev 8 callouts updated to say auto-detect is removed rather than parked. The rationale: location is optional and the backend is the source of truth for zones, so there's no caller and no plan for one. Closed PR #95 + issue #94 (the CLI-side zone-validation work) as superseded by this direction.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c15d354. Configure here.}