run402 4.37.1 → 4.38.1

package/lib/gitvault.mjs

@@ -19,6 +19,7 @@
 import { readFileSync } from "node:fs";
 import { resolveProjectId } from "./config.mjs";
 import { resolveOwningOrgId } from "./org-context.mjs";
+import { resolveGitvaultTarget } from "./gitvault-target.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import {
@@ -69,8 +70,12 @@ Subcommands:
             deploy — a vault-only project snapshots for months without one.
             Against a project with no vault yet, this ALLOCATES one inline
             (the six-stage creation, same as \`init\`) before publishing — one
-            command, no prior \`gitvault init\`. The one-shot recovery receipt
-            and keystore path print to stderr the moment that happens.
+            command, no prior \`gitvault init\`. When --repo/--project are
+            both omitted and the local run402/origin remote is a slug-form
+            address (run402::<org-slug>/<name>), PUSH-TO-CREATES through it
+            instead (design D6) — same as pushing that name with \`git\`. The
+            one-shot recovery receipt and keystore path print to stderr the
+            moment that happens.
             Before reporting a snapshot as landed the SDK compares finalization
             receipts against the expected manifest and reads the admitted head
             back from storage; a 200 alone is never enough. \`push\` is a
@@ -164,19 +169,36 @@ Examples:
  * Resolve which vault to act on, plus the local git tree.
  *
  * `--repo` addresses the vault directly (the cold-restart path: an agent that
- * knows its repo_id needs no project lookup). Otherwise the project is
- * resolved the CLI-wide way — `--project`, then RUN402_PROJECT_ID, then the
- * active project — and the SDK resolves the vault from it.
+ * knows its repo_id needs no project lookup). Otherwise the project targets,
+ * highest first: `--project` > the repo's own pin/remote > RUN402_PROJECT_ID
+ * > the active project (repo-first-onramp follow-up, kychee-com/run402#559 —
+ * see `gitvault-target.mjs`'s module doc for the full targeting order and
+ * why it exists: a stale active-project pointer used to silently outrank the
+ * repository this command is actually standing in).
  */
-function vaultTarget(a) {
+async function vaultTarget(a) {
   const repoId = flagValue(a, "--repo");
   const project = flagValue(a, "--project");
-  const target = { repo_dir: process.cwd() };
+  const repoDir = process.cwd();
+  const resolved = await resolveGitvaultTarget({
+    repoDir,
+    explicitProjectId: project ?? undefined,
+    explicitRepoId: repoId ?? undefined,
+  });
+  const target = { repo_dir: repoDir };
   if (repoId != null) target.repo_id = repoId;
   // Only demand a project when one is actually needed: `--repo` alone is a
-  // complete address, and requiring an active project on top of it would make
-  // the cold-restart path fail for no reason.
-  if (repoId == null || project != null) target.project_id = resolveProjectId(project);
+  // complete address, and requiring one on top of it would make the
+  // cold-restart path fail for no reason.
+  if (repoId == null || project != null) {
+    if ("repo_id" in resolved && project == null) target.repo_id = resolved.repo_id;
+    // `resolveGitvaultTarget` reports its last (env/active) tier
+    // non-throwingly (`run402 doctor`'s call site needs that) — this call
+    // site is the one that historically failed closed with PROJECT_REQUIRED
+    // when nothing resolves anywhere, and still does: `resolveProjectId`
+    // re-derives the exact same env/active check and throws.
+    if ("project_id" in resolved) target.project_id = resolved.project_id ?? resolveProjectId(project);
+  }
   return target;
 }
 
@@ -333,7 +355,7 @@ async function policy(args) {
     });
   }
 
-  const target = vaultTarget(a);
+  const target = await vaultTarget(a);
   try {
     const sdk = getSdk();
     const repoId = target.repo_id ?? (await sdk.gitvault.forProject(target.project_id)).repo_id;
@@ -359,7 +381,7 @@ async function status(args) {
   requirePositionalCount(a, COMMON_VALUE_FLAGS, {
     min: 0, max: 0, command: "run402 gitvault status", missing: "",
   });
-  const target = vaultTarget(a);
+  const target = await vaultTarget(a);
   if (a.includes("--refs")) target.refs = true;
   try {
     const s = await getSdk().gitvault.status(target);
@@ -370,6 +392,15 @@ async function status(args) {
     if (s.remote) {
       console.error(`remote '${s.remote.name}': ${s.remote.url}${s.remote.matches ? "" : "  ← points at a DIFFERENT project than this status"}`);
     }
+    // The id-pinning state (design D6, task 4.5): a slug-form remote pins
+    // repo_id in local git state the first time it resolves; id-form pins
+    // nothing (it needs no pin — see resolveGitvaultAddress's doc comment).
+    if (s.pinned) {
+      console.error(
+        `pinned: repo_id ${s.pinned.repo_id}` +
+        (s.pinned.resolved_from ? ` (resolved from run402::${s.pinned.resolved_from.org_slug}/${s.pinned.resolved_from.repo_name})` : ""),
+      );
+    }
     if (s.refs) {
       const names = Object.keys(s.refs).sort();
       console.error(names.length === 0 ? "refs: (none yet)" : `refs (${names.length}):`);
@@ -396,6 +427,33 @@ async function status(args) {
  * only the dispatched SUBCOMMAND name changed (see `run()` below, where
  * `gitvault push` survives one release as a deprecation-warning alias).
  */
+/**
+ * D6 (repo-first-onramp task 4): when neither `--repo` nor `--project` was
+ * given explicitly, look at the local `run402`/`origin` remote (in that
+ * order, mirroring `scaffoldRemote`'s own naming) and, if it is a SLUG-form
+ * address (`run402::<org-slug>/<name>`), return the parsed address so
+ * `snapshot` can push-to-create through it — the same address-form
+ * resolution `git push` drives via the remote helper. `null` for an
+ * id-form remote, no remote at all, or an explicit `--repo`/`--project`.
+ */
+async function detectSlugFormRemote(a, repoDir) {
+  if (flagValue(a, "--repo") != null || flagValue(a, "--project") != null) return null;
+  const { hardenedGit } = await import("#sdk/node");
+  const { parseGitvaultRemoteUrl, gitvaultRemoteAddressForm } = await import("#sdk");
+  for (const name of ["run402", "origin"]) {
+    let url;
+    try {
+      url = (await hardenedGit(repoDir, ["remote", "get-url", name])).text().trim();
+    } catch {
+      continue;
+    }
+    if (!url) continue;
+    const address = parseGitvaultRemoteUrl(url);
+    if (address && gitvaultRemoteAddressForm(address) === "slug") return address;
+  }
+  return null;
+}
+
 async function snapshot(args) {
   const a = normalizeArgv(args);
   const valueFlags = [...COMMON_VALUE_FLAGS, "--message"];
@@ -404,14 +462,19 @@ async function snapshot(args) {
     min: 0, max: 0, command: "run402 gitvault snapshot", missing: "",
   });
   const message = flagValue(a, "--message");
-  const target = vaultTarget(a);
+  const repoDir = process.cwd();
+  const address = await detectSlugFormRemote(a, repoDir);
   // D2: lazily allocate the vault on first push when there is a project to
   // resolve the owning org from — the same resolution `gitvault init` uses.
   // `--repo`-only addressing has nothing to create FROM (no project_id), so
-  // it is skipped there, matching `open()`'s own precedence.
-  const orgId = target.project_id ? await resolveOwningOrgId(target.project_id) : null;
+  // it is skipped there, matching `open()`'s own precedence. Skipped
+  // entirely for a slug-form remote (`address` above) — that resolves
+  // through the address, not a project_id, and needs no separate org_id.
+  const target = address ? { repo_dir: repoDir } : await vaultTarget(a);
+  const orgId = !address && target.project_id ? await resolveOwningOrgId(target.project_id) : null;
   const opts = {
     ...target,
+    ...(address ? { address } : {}),
     ...(orgId ? { org_id: orgId } : {}),
     // The gitvault_commit line is progress, not payload: print it the moment
     // the snapshot exists, well before the publication round-trips finish, so
@@ -450,7 +513,7 @@ async function compact(args) {
     min: 0, max: 0, command: "run402 gitvault compact", missing: "",
   });
   try {
-    const result = await getSdk().gitvault.compact(vaultTarget(a));
+    const result = await getSdk().gitvault.compact(await vaultTarget(a));
     console.log(JSON.stringify(result, null, 2));
     console.error(
       `checkpoint published at generation ${result.generation}: ` +
@@ -519,7 +582,7 @@ async function prune(args) {
       hint: "Add --submit, or drop the flags to plan.",
     });
   }
-  const opts = vaultTarget(a);
+  const opts = await vaultTarget(a);
   if (submitting) {
     opts.submit = {
       core: readJsonFile("--intent-core", corePath),
@@ -565,7 +628,7 @@ async function verify(args) {
   requirePositionalCount(a, valueFlags, {
     min: 0, max: 0, command: "run402 gitvault verify", missing: "",
   });
-  const target = vaultTarget(a);
+  const target = await vaultTarget(a);
   const budget = flagValue(a, "--budget");
   if (budget != null) target.verification_budget = parseIntegerFlag("--budget", budget, { min: 1 });
   try {

package/lib/next-actions.mjs

@@ -66,3 +66,28 @@ export function deployAction() {
     why: "Apply your release manifest to deploy.",
   });
 }
+
+/**
+ * `repos create` (and `gitvault init`) on an org with no claimed slug: the
+ * response's `address: null` had no pointer to WHY, or to the named-addressing
+ * feature at all (kychee-com/run402#560). One-time $1 fee, owner-only.
+ */
+export function claimOrgSlugAction() {
+  return nextAction("claim_org_slug", {
+    command: "run402 org slug <slug>",
+    why: "This organization has no claimed slug yet, so its repos have no run402::<slug>/<name> address. One-time $1, owner-only.",
+  });
+}
+
+/**
+ * The org already has a slug, but this project's address-form repo name was
+ * not claimed this time (a collision, or the best-effort claim failed for
+ * some other reason) — point at the explicit claim verb instead of leaving
+ * `address: null` unexplained.
+ */
+export function claimRepoNameAction(projectId) {
+  return nextAction("claim_repo_name", {
+    command: `run402 repos name <name> --project ${projectId}`,
+    why: "The owning organization has a slug, but this project has no claimed address-form name yet.",
+  });
+}

package/lib/org.mjs

@@ -30,6 +30,7 @@ Usage:
   run402 org get    <org_id>
   run402 org rename <org_id> --name <display_name>   (or: --clear to remove the label)
   run402 org payout-wallet <org_id> --wallet <wallet_address>  (or: --clear to remove the explicit default)
+  run402 org slug   <slug> [--org <org_id>]
   run402 org whoami
   run402 org use     <org_id>
   run402 org current
@@ -53,6 +54,9 @@ Subcommands:
   list        Orgs you are a member of
   get         Read one org (label + tier/lease + your role)
   rename      Set or clear an org's display label (owner-only)
+  slug        Claim or rename the org's globally-unique, address-form slug
+              (owner-only). A genesis claim spends a one-time claim fee; a
+              rename releases the old slug into a ~90-day cooldown.
   use         Select the current org for this wallet profile
   current     Report the resolved current org and where it came from
   clear       Clear this wallet profile's org selection
@@ -120,6 +124,26 @@ Legacy (still supported):
 
 Owner-only + step-up gated. Pass --clear (or an empty display_name) to remove
 the label. Output includes the updated tier and lease timestamps.
+`,
+  slug: `run402 org slug — claim or rename the org's address-form slug
+
+Usage:
+  run402 org slug <slug> [--org <org_id>] [--idempotency-key <key>]
+
+The slug is a globally-unique, claimable, address-form handle for the org
+(repo-first-onramp design D6) — the <org-slug> half of a named repo address
+run402::<org-slug>/<name>. Grammar: lowercase [a-z0-9-], no leading/trailing/
+double hyphen, max 39 chars. Owner-only.
+
+A genesis claim (the org had no prior slug) spends a one-time claim fee off
+the org's balance. A rename is free but releases the OLD slug into a ~90-day
+cooldown: it stops resolving, with a typed SLUG_RELEASED refusal naming the
+new slug as successor — there is no redirect, so update every remote and
+address that still names the old one.
+
+This is a paid, side-effecting mutation and requires Idempotency-Key; the SDK
+generates one automatically unless --idempotency-key is passed, so a retried
+call after a dropped response can never double-bill.
 `,
   "payout-wallet": `run402 org payout-wallet — set or clear the tenant route payout wallet
 
@@ -413,6 +437,51 @@ async function payoutWallet(args) {
   }
 }
 
+/**
+ * `run402 org slug <slug>` — claim or rename the org's address-form slug
+ * (repo-first-onramp design D6). Owner-only, and a genesis claim spends a
+ * one-time claim fee — this is a PAID, side-effecting mutation, so it
+ * requires `Idempotency-Key`; the SDK generates one client-side when
+ * `--idempotency-key` is omitted, so a retried call after a dropped response
+ * can never double-bill.
+ */
+async function slug(args) {
+  const a = normalizeArgv(args);
+  const valueFlags = ["--org", "--idempotency-key"];
+  assertKnownFlags(a, [...valueFlags, "--help", "-h"], valueFlags);
+  const [newSlug] = requirePositionalCount(a, valueFlags, {
+    min: 1,
+    max: 1,
+    command: "run402 org slug <slug> [--org <org_id>]",
+    missing: "Missing <slug>.",
+  });
+  const org = await resolveOrg(a, { cmd: "org" });
+  if (!org) {
+    fail({
+      code: "ORG_UNRESOLVED",
+      message: "Could not resolve which organization to claim this slug for.",
+      hint: "Pass --org <org_id>, or select one first with `run402 org use <id>`.",
+    });
+  }
+  const idempotencyKey = flagValue(a, "--idempotency-key");
+  try {
+    const result = await getSdk().org(org.orgId).claimSlug(newSlug, idempotencyKey != null ? { idempotencyKey } : {});
+    console.log(JSON.stringify(result, null, 2));
+    if (result.created) {
+      console.error(`slug "${result.slug}" claimed for ${org.orgId} — a one-time claim fee was debited from the org's balance.`);
+    } else if (result.previous_slug && result.previous_slug !== result.slug) {
+      console.error(
+        `org ${org.orgId} renamed from "${result.previous_slug}" to "${result.slug}" — no fee. ` +
+        `"${result.previous_slug}" now enters its ~90-day release cooldown: it stops resolving with a typed SLUG_RELEASED refusal (naming "${result.slug}" as the successor), never a redirect. Update every remote and address that still names it.`,
+      );
+    } else {
+      console.error(`"${result.slug}" was already ${org.orgId}'s current slug — nothing changed, no fee.`);
+    }
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
 async function audit(args) {
   const a = normalizeArgv(args);
   const valueFlags = ["--limit", "--after", "--before"];
@@ -630,6 +699,7 @@ export async function run(sub, args) {
     case "get": await get(args); break;
     case "rename": await rename(args); break;
     case "payout-wallet": await payoutWallet(args); break;
+    case "slug": await slug(args); break;
     case "whoami": await whoami(args); break;
     case "use": await use(args); break;
     case "current": await current(args); break;

package/lib/repos.mjs

@@ -35,11 +35,12 @@
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
 import { withAutoApprove } from "./operator.mjs";
-import { allowanceAuthHeaders, isCoreApiTarget } from "./config.mjs";
+import { allowanceAuthHeaders, isCoreApiTarget, resolveProjectId } from "./config.mjs";
 import { loadLiveControlPlaneSession } from "../core-dist/control-plane-session.js";
 import { resolveOrgId, resolveOwningOrgId } from "./org-context.mjs";
-import { nextAction } from "./next-actions.mjs";
+import { nextAction, claimOrgSlugAction, claimRepoNameAction } from "./next-actions.mjs";
 import { printKeystoreLocation } from "./gitvault.mjs";
+import { gitvaultRemoteUrlForRepo } from "#sdk";
 import {
   normalizeArgv,
   hasHelp,
@@ -56,21 +57,30 @@ Usage:
   run402 repos create <name> [--org <org_id>] [--dir <path>] [--tier <tier>]
   run402 repos list   [--org <org_id>]
   run402 repos delete <project_id> [--force]
+  run402 repos name   <name> [--project <id>]
 
 Subcommands:
   create  Provision a project, ALLOCATE its vault (mints key material and a
           one-shot recovery receipt), and scaffold the run402 remote —
           origin when free, run402 when taken (D1). No deploy plan, no
           release, nothing deployed: the vault-only track (design D8), for a
-          project that only ever hosts encrypted source.
+          project that only ever hosts encrypted source. When the owning org
+          has a slug (run402 org slug), also claims the project's address-
+          form repo name (best-effort — a name collision or missing slug
+          never fails the command) and prints the run402::<slug>/<name>
+          address (design D6).
   list    The organization's vault-bearing projects — those with an
           allocated vault, whether or not they have ever deployed. Not
-          every project in the org; ones with no vault are omitted.
+          every project in the org; ones with no vault are omitted. Shows
+          the run402::<slug>/<name> address for a repo that has claimed one.
   delete  Delete the project and everything in it (database, functions,
           subdomains, mailbox, secrets). REFUSES while the vault holds any
           admitted generation unless --force is passed — this is
           irreversible and destroys the vault's entire encrypted history
           along with everything else.
+  name    Claim or rename the project's per-org-unique, address-form name
+          (design D6) — the <name> half of run402::<org-slug>/<name>. No
+          fee, unlike the org slug. Same authority as renaming the project.
 
 Options:
   --org <org_id>    create/list: the owning organization. create resolves it
@@ -88,6 +98,8 @@ Options:
                      derived from the name)
   --force           delete: proceed even though the vault holds generations
                      that would be permanently and irrecoverably lost
+  --project <id>    name: project to claim the repo name for (default: the
+                     active project)
   --json            No-op: stdout is already JSON.
 
 There is no separate gitvault price: bytes count against the same
@@ -97,6 +109,7 @@ organization-pooled storage budget every project already has.
 const CREATE_VALUE_FLAGS = ["--org", "--dir", "--tier", "--idempotency-key"];
 const LIST_VALUE_FLAGS = ["--org"];
 const DELETE_VALUE_FLAGS = ["--project"];
+const NAME_VALUE_FLAGS = ["--project"];
 
 function validateProjectName(name) {
   if (name === "") {
@@ -123,6 +136,24 @@ function validateProjectName(name) {
   }
 }
 
+/**
+ * Best-effort slugify for the address-form repo name (design D6's grammar:
+ * lowercase [a-z0-9-], no leading/trailing/double hyphen, <=63 chars). The
+ * free-text project display name (`repos create <name>`'s positional) is
+ * NOT already in this charset, so `create` derives a candidate rather than
+ * sending the raw name straight to the claim route and failing on the first
+ * space or capital letter.
+ */
+function slugifyRepoName(name) {
+  return name
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, "-")
+    .replace(/-+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 63)
+    .replace(/-+$/g, "");
+}
+
 async function create(args) {
   const a = normalizeArgv(args);
   assertKnownFlags(a, [...CREATE_VALUE_FLAGS, "--help", "-h"], CREATE_VALUE_FLAGS);
@@ -177,21 +208,63 @@ async function create(args) {
       project_id: provisioned.project_id,
       repo_dir: dir,
     });
+    // Best-effort address-form name claim (design D6): when the owning org
+    // has a slug, name this repo so it is reachable as
+    // run402::<slug>/<name> too — never fails `create` itself. A collision,
+    // a missing slug, or any other refusal just means no address this time;
+    // `run402 repos name <name>` claims it explicitly later.
+    let address = null;
+    let orgSlug = null;
+    try {
+      const orgRecord = await getSdk().org(effectiveOrgId).get();
+      orgSlug = orgRecord.slug ?? null;
+      if (orgSlug) {
+        const candidate = slugifyRepoName(name);
+        if (candidate) {
+          const named = await getSdk().projects.setRepoName(provisioned.project_id, candidate);
+          address = gitvaultRemoteUrlForRepo(orgSlug, named.repo_name);
+        }
+      }
+    } catch (err) {
+      console.error(`repo name not claimed (non-fatal): ${err?.message ?? String(err)}`);
+    }
+
+    // `address: null` used to have no pointer to WHY, or to the
+    // named-addressing feature at all (kychee-com/run402#560): an agent
+    // reading the output had no path from "address is null" to
+    // `run402 org slug`/`run402 repos name`. One typed next_actions entry,
+    // pointing at whichever half is actually missing.
+    const nextActions = address
+      ? []
+      : orgSlug
+        ? [claimRepoNameAction(provisioned.project_id)]
+        : [claimOrgSlugAction()];
+
     const out = {
       project_id: provisioned.project_id,
       repo_id: vault.repo_id,
+      address,
       remote: vault.remote,
       deduplicated: vault.deduplicated,
       genesis_sha256: vault.genesis_sha256,
       recovery_receipt: vault.recovery_receipt,
       terminal_loss_statement: vault.terminal_loss_statement,
       deployed: false,
+      next_actions: nextActions,
     };
     console.log(JSON.stringify(out, null, 2));
     console.error(
       `project ${provisioned.project_id} provisioned; vault ${vault.repo_id} ` +
       (vault.deduplicated ? "already existed — nothing was re-allocated" : `allocated (genesis ${vault.genesis_sha256})`),
     );
+    if (address) console.error(`address: ${address}`);
+    else if (!orgSlug) {
+      console.error(
+        "no named address yet — claim an org slug (run402 org slug <slug>, one-time $1) to get run402::<slug>/<name> addresses",
+      );
+    } else {
+      console.error(`no address claimed — run 'run402 repos name <name> --project ${provisioned.project_id}' to claim one`);
+    }
     if (vault.remote) console.error(`remote '${vault.remote.name}' -> ${vault.remote.url} (${vault.remote.reason})`);
     console.error("");
     console.error(vault.terminal_loss_statement);
@@ -244,8 +317,21 @@ async function list(args) {
       genesis_admitted_at: status.vault.genesis_admitted_at,
     });
   }
-  console.log(JSON.stringify({ org_id: orgId, repos }, null, 2));
+  // The org's slug, when claimed (design D6) — printed so a human/agent can
+  // construct run402::<slug>/<name> addresses by hand. There is deliberately
+  // no per-project `address` field here yet: the gateway has no bulk (or
+  // even single) READ for a project's claimed repo_name today, only the
+  // WRITE route (`POST /projects/v1/:id/repo-name`) — adding one is gateway
+  // work, out of scope for this client-only change (see the final report).
+  let orgSlug = null;
+  try {
+    orgSlug = (await getSdk().org(orgId).get()).slug;
+  } catch {
+    // Best-effort — `list` must not fail over an org-slug lookup.
+  }
+  console.log(JSON.stringify({ org_id: orgId, org_slug: orgSlug, repos }, null, 2));
   console.error(`${repos.length} vault-bearing project(s) of ${projects.length} total in this organization`);
+  if (orgSlug) console.error(`org slug: ${orgSlug} — a repo with a claimed address-form name is reachable at run402::${orgSlug}/<name>`);
 }
 
 async function del(args) {
@@ -297,6 +383,41 @@ async function del(args) {
   }
 }
 
+/**
+ * `run402 repos name <name> [--project <id>]` — the explicit address-form
+ * claim (design D6, task 4.2): a project gets its per-org-unique `<name>`
+ * half of `run402::<org-slug>/<name>` either at push-to-create time or here.
+ */
+async function name(args) {
+  const a = normalizeArgv(args);
+  assertKnownFlags(a, [...NAME_VALUE_FLAGS, "--help", "-h"], NAME_VALUE_FLAGS);
+  const [repoName] = requirePositionalCount(a, NAME_VALUE_FLAGS, {
+    min: 1, max: 1, command: "run402 repos name <name> [--project <id>]", missing: "run402 repos name <name>: a name is required",
+  });
+  const projectId = resolveProjectId(flagValue(a, "--project"));
+  try {
+    const result = await getSdk().projects.setRepoName(projectId, repoName);
+    let address = null;
+    try {
+      const owningOrg = await resolveOwningOrgId(projectId);
+      const orgSlug = owningOrg ? (await getSdk().org(owningOrg).get()).slug : null;
+      if (orgSlug) address = gitvaultRemoteUrlForRepo(orgSlug, result.repo_name);
+    } catch {
+      // The claim itself already succeeded — a failed address-preview lookup is never fatal.
+    }
+    console.log(JSON.stringify({ ...result, address }, null, 2));
+    console.error(
+      result.previous_repo_name && result.previous_repo_name !== result.repo_name
+        ? `renamed from "${result.previous_repo_name}" to "${result.repo_name}"`
+        : `name "${result.repo_name}" claimed for ${projectId}`,
+    );
+    if (address) console.error(`address: ${address}`);
+    else console.error("this org has no slug yet — claim one with `run402 org slug <slug>` to get a full run402::<slug>/<name> address");
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
 export async function run(sub, args) {
   const argv = Array.isArray(args) ? args : [];
   if (!sub || hasHelp([sub, ...argv])) {
@@ -316,6 +437,10 @@ export async function run(sub, args) {
       await del(argv);
       break;
     }
+    case "name": {
+      await name(argv);
+      break;
+    }
     default:
       failUnknownSubcommand("repos", sub, {
         hint: "Run `run402 repos --help` for usage.",

package/lib/up.mjs

@@ -585,14 +585,31 @@ function looksLikeGitRemoteUrl(source) {
   return /^[a-z][a-z0-9+.-]*:\/\//i.test(source) || /^[^\s@]+@[^\s:]+:/.test(source);
 }
 
-/** `git init` only when `dir` is not a repository yet. Returns whether it did. */
+/**
+ * `git init` only when `dir` is not a repository yet. Returns whether it did.
+ *
+ * `-b main`, not whatever `init.defaultBranch` (or the pre-2.28 hardcoded
+ * `master`) happens to be — the docs teach `git push origin main`, and the
+ * gitvault remote helper's own dangling-HEAD hazard note (a first push of
+ * any OTHER branch leaves HEAD naming a ref that does not exist yet) is
+ * exactly what a mismatched default branch here would walk `up` straight
+ * into. `-b` needs git 2.28+ (2020); an older git falls back to the same
+ * result by a different route — `symbolic-ref` on a still-empty repository
+ * has no existing ref to disturb, so it is exactly as safe as `-b main`
+ * would have been. Mirrors `Gitvault.scaffoldRemote`'s identical fallback.
+ */
 async function gitInitIfNeeded(dir) {
   const { hardenedGit } = await import("#sdk/node");
   try {
     await hardenedGit(dir, ["rev-parse", "--git-dir"]);
     return false;
   } catch {
-    await hardenedGit(dir, ["init", "-q", "-b", "main", "."]);
+    try {
+      await hardenedGit(dir, ["init", "-q", "-b", "main", "."]);
+    } catch {
+      await hardenedGit(dir, ["init", "-q", "."]);
+      await hardenedGit(dir, ["symbolic-ref", "HEAD", "refs/heads/main"]);
+    }
     return true;
   }
 }