fix(cli): reject path-like project names in init

concore_cli/commands/init.py

@@ -258,8 +258,14 @@ def _build_graphml(project_name, selected_langs):
 # ---------------------------------------------------------------------------
 
 
+def _check_project_name(name):
+    if name in (".", "..") or Path(name).name != name:
+        raise ValueError("Project name must not contain path separators")
+
+
 def init_project_interactive(name, selected_langs, console):
     """Create a project with one node per selected language (no edges)."""
+    _check_project_name(name)
     project_path = Path(name)
 
     if project_path.exists():
@@ -327,6 +333,7 @@ def init_project_interactive(name, selected_langs, console):
 
 def init_project(name, template, console):
     """Non-interactive init — single Python node skeleton."""
+    _check_project_name(name)
     project_path = Path(name)
 
     if project_path.exists():

tests/test_cli.py

@@ -55,6 +55,15 @@ def test_init_existing_directory(self):
             self.assertNotEqual(result.exit_code, 0)
             self.assertIn("already exists", result.output)
 
+    def test_init_rejects_path_in_name(self):
+        with self.runner.isolated_filesystem(temp_dir=self.temp_dir):
+            Path("work").mkdir()
+            os.chdir("work")
+            result = self.runner.invoke(cli, ["init", "../x"])
+            self.assertNotEqual(result.exit_code, 0)
+            self.assertIn("path separators", result.output)
+            self.assertFalse(Path("../x").exists())
+
     def test_validate_missing_file(self):
         result = self.runner.invoke(cli, ["validate", "nonexistent.graphml"])
         self.assertNotEqual(result.exit_code, 0)