fix(create): sanitize the derived default package name

[m0g3r]

Refs #2521

This implements the first of the two smaller things the reporter listed at the bottom of #2521 and offered to split out. It is deliberately not the issue's headline ask (scaffolding into a non-empty directory), which is a design question with two competing proposals — hence Refs, not Closes.

Problem

deriveDefaultPackageName() in packages/cli/src/create/utils.ts derives the default package name from the target directory's basename. When that basename is not a valid npm package name, it was discarded entirely and replaced with a random two-word name from @nkzw/safe-word-list.

The reporter's directory ComfyUI-DenoiseHQNodes.feat-1-save-image-node is invalid only because of the uppercase letters, and scaffolded as appoint-track, perspective-detailed, and nation-virtually across three runs. In a non-interactive run that unrelated name lands in package.json unnoticed.

Changes

deriveDefaultPackageName now tries to repair the basename before giving up on it: lowercase it, replace characters npm rejects, collapse repeated separators, strip leading ./_/- and trailing -/., and truncate to npm's 214-character limit. If the repaired name validates, it is used; otherwise the existing random fallback is kept exactly as before.

directory	before	after
ComfyUI-DenoiseHQNodes.feat-1-save-image-node	random name	comfyui-denoisehqnodes.feat-1-save-image-node
My App (v2)!	random name	my-app-v2
.hidden	random name	hidden
My-App (scope @my-scope)	random name	@my-scope/my-app
!!!	random name	random name (unchanged)
/ (filesystem root)	random name	random name (unchanged)
my-app	my-app	my-app (unchanged)

Testing

Four new cases cover the sanitization paths, and the two fallback paths plus the already-valid path are asserted to be unchanged.

Verified in both directions against the current main, restoring only the old logic inside the module so failures are behavioural rather than import errors:

• unfixed → 4 assertion failures, each returning the random fallback instead of the sanitized name;
• fixed → all 7 cases pass.

One existing test was intentionally rewritten rather than deleted. should fallback to random name when directory name is invalid used .hidden, and its comment said "a random name is generated instead" — no longer true, since .hidden now derives hidden. Its input became !!! so it still guards the random-fallback path it was written for, and a new case asserts the .hidden → hidden behaviour. Coverage is preserved, not weakened.

Checks actually run:

• packages/cli/src/create/__tests__/utils.spec.ts — 48 → 54 passing.
• Whole create suite — before/after diffed in the same build state: identical failure set (all environmental), 50 → 55 passing.
• Whole packages/cli/src/** spec set — before/after diffed: identical failure set both ways, 223 → 228 passing.
• oxlint@1.79.0 (the repo's pinned version) with -D correctness -D perf -D suspicious on both changed files — exit 0.
• git diff --check — clean.

Not run: vp check, pnpm test:unit, tsgo, and the PTY snapshot suite, all of which need a full workspace build that this environment cannot produce. deriveDefaultPackageName is referenced only by create/utils.ts, its spec, and create/bin.ts, and no PTY snapshot fixture depends on it.

AI assistance

Claude Opus 5 wrote the implementation, the tests, and this description. The change is agent-authored and has not had a separate human review. Every result quoted above is from an actual run, not an estimate.

---

Generated by Claude Code

[netlify]

✅ Deploy Preview for viteplus-preview ready!

Name	Link
🔨 Latest commit	0d9a915
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a8bf2fa9c637800078a388e
😎 Deploy Preview	https://deploy-preview-2549--viteplus-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.