concore init <name> uses the name directly as a filesystem path, so names like ../x or an absolute path create the project outside the directory the user is in. The name is never checked, and init_project() and init_project_interactive() in concore_cli/commands/init.py both do Path(name) followed by mkdir().
Repro:
mkdir work && cd work
concore init ../x
ls ..
The command succeeds and ../x now exists, containing src/, workflow.graphml, README.md and STUDY.json. Nothing was created inside work. A typo like concore init ../../my-study will quietly drop a project two levels up. The --interactive path behaves the same way.
Expected: a project name should be a single folder name. If it contains a path separator or .., the command should print a clear error such as Error: Project name must not contain path separators and exit without creating anything.
Actual: the folder is created wherever the path points.
Suggested fix (good first issue): add a small check at the top of both functions in init.py (or once in cli.py before they are called) that rejects names where Path(name).name != name or that are . / .., and add a test in tests/test_cli.py for ../x.
Tested on dev at d11e582, Python 3.12, Windows 11.
concore init <name>uses the name directly as a filesystem path, so names like../xor an absolute path create the project outside the directory the user is in. The name is never checked, andinit_project()andinit_project_interactive()inconcore_cli/commands/init.pyboth doPath(name)followed bymkdir().Repro:
mkdir work && cd workconcore init ../xls ..The command succeeds and
../xnow exists, containingsrc/,workflow.graphml,README.mdandSTUDY.json. Nothing was created insidework. A typo likeconcore init ../../my-studywill quietly drop a project two levels up. The--interactivepath behaves the same way.Expected: a project name should be a single folder name. If it contains a path separator or
.., the command should print a clear error such asError: Project name must not contain path separatorsand exit without creating anything.Actual: the folder is created wherever the path points.
Suggested fix (good first issue): add a small check at the top of both functions in
init.py(or once incli.pybefore they are called) that rejects names wherePath(name).name != nameor that are./.., and add a test intests/test_cli.pyfor../x.Tested on dev at d11e582, Python 3.12, Windows 11.