fix(init): reject empty/whitespace project names

_validate_project_name only checked for path separators and '..', so an
empty or whitespace-only name (e.g. `apm install <pkg>` auto-bootstrapping
apm.yml from Path.cwd().name at a container's unset root WORKDIR, or a
blank `apm init` prompt) silently wrote `name: ''` into apm.yml. Every
later install/lock/compile then failed with "Invalid apm.yml identity:
'name' must be a non-empty string" once #2155 tightened
APMPackage.from_apm_yml's identity check.

Reject empty/whitespace names in _validate_project_name, and add
_resolve_bootstrap_project_name() so the install auto-bootstrap path
falls back to "my-project" instead of writing an empty name.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: nadav-y

src/apm_cli/commands/_helpers.py

@@ -622,17 +622,34 @@ def _validate_project_name(name):
 
     Project names are used directly as directory names and must not contain
     '/' or '\' so the name is not interpreted as a filesystem path,
-    and must not be '..' to prevent directory traversal.
+    and must not be '..' to prevent directory traversal. Must also be
+    non-empty: an empty/whitespace name writes an apm.yml with 'name: ""',
+    which APMPackage.from_apm_yml's identity check rejects on every later
+    install/lock/compile run (#2155).
 
     Returns True if valid, False otherwise.
     """
+    if not name or not name.strip():
+        return False
     if "/" in name or "\\" in name:
         return False
     if name == "..":  # noqa: SIM103
         return False
     return True
 
 
+def _resolve_bootstrap_project_name(candidate: str) -> str:
+    """Return a valid apm.yml project name for the install auto-bootstrap path.
+
+    ``Path.cwd().name`` (or ``Path.home().name``) is '' at a filesystem/drive
+    root -- e.g. a container with ``WORKDIR /``. Writing that candidate
+    straight into apm.yml would produce ``name: ''``, which
+    ``APMPackage.from_apm_yml``'s identity check rejects on every later
+    install/lock/compile run (#2155). Falls back to a generic default instead.
+    """
+    return candidate if _validate_project_name(candidate) else "my-project"
+
+
 def _create_plugin_json(config):
     """Create plugin.json file with package metadata.
 

src/apm_cli/commands/init.py

@@ -149,7 +149,8 @@ def _perform_init(
         if project_name and not _validate_project_name(project_name):
             logger.error(
                 f"Invalid project name '{project_name}': "
-                "project names must not contain path separators ('/' or '\\\\') or be '..'."
+                "project names must be non-empty and must not contain "
+                "path separators ('/' or '\\\\') or be '..'."
             )
             sys.exit(1)
 
@@ -395,7 +396,8 @@ def _interactive_project_setup(default_name, logger):
                 break
             console.print(
                 f"[error]Invalid project name '{name}': "
-                "project names must not contain path separators ('/' or '\\\\') or be '..'.[/error]"
+                "project names must be non-empty and must not contain "
+                "path separators ('/' or '\\\\') or be '..'.[/error]"
             )
 
         version = Prompt.ask("Version", default="1.0.0").strip()
@@ -412,7 +414,8 @@ def _interactive_project_setup(default_name, logger):
                 break
             click.echo(
                 f"{ERROR}Invalid project name '{name}': "
-                f"project names must not contain path separators ('/' or '\\\\') or be '..'.{RESET}"
+                f"project names must be non-empty and must not contain "
+                f"path separators ('/' or '\\\\') or be '..'.{RESET}"
             )
 
         version = click.prompt("Version", default="1.0.0").strip()

src/apm_cli/commands/install.py

@@ -121,6 +121,7 @@
 from ._helpers import (
     _create_minimal_apm_yml,
     _get_default_config,
+    _resolve_bootstrap_project_name,
 )
 
 # CRITICAL: Shadow Python builtins that share names with Click commands
@@ -1429,6 +1430,7 @@ def install(  # noqa: PLR0913
 
         if not apm_yml_exists and packages:
             project_name = Path.cwd().name if scope is InstallScope.PROJECT else Path.home().name
+            project_name = _resolve_bootstrap_project_name(project_name)
             config = _get_default_config(project_name)
             if manifest_targets := manifest_targets_from_target_option(target):
                 config["targets"] = manifest_targets

tests/unit/test_init_command.py

@@ -453,6 +453,39 @@ def test_dotdot_in_slash_path_caught_by_slash_check(self):
 
         assert _validate_project_name("a/../b") is False  # slash catches it
 
+    def test_invalid_empty_or_whitespace(self):
+        """Empty/whitespace names must be rejected (#2155 regression).
+
+        An empty ``name`` passes through undetected into apm.yml, then
+        every later `from_apm_yml` call (install/lock/compile) fails with
+        "Invalid apm.yml identity: 'name' must be a non-empty string".
+        """
+        from apm_cli.commands._helpers import _validate_project_name
+
+        assert _validate_project_name("") is False
+        assert _validate_project_name(" ") is False
+        assert _validate_project_name("\t\n") is False
+
+
+class TestResolveBootstrapProjectName:
+    """Unit tests for _resolve_bootstrap_project_name (install auto-bootstrap)."""
+
+    def test_passes_through_valid_name(self):
+        from apm_cli.commands._helpers import _resolve_bootstrap_project_name
+
+        assert _resolve_bootstrap_project_name("my-project") == "my-project"
+
+    def test_falls_back_when_empty(self):
+        """Path.cwd().name is '' at a filesystem/drive root (#2155 regression)."""
+        from apm_cli.commands._helpers import _resolve_bootstrap_project_name
+
+        assert _resolve_bootstrap_project_name("") == "my-project"
+
+    def test_falls_back_when_whitespace(self):
+        from apm_cli.commands._helpers import _resolve_bootstrap_project_name
+
+        assert _resolve_bootstrap_project_name("   ") == "my-project"
+
 
 class TestInitProjectNameValidation:
     """Integration tests: apm init rejects project names with path separators or '..'."""
@@ -520,6 +553,27 @@ def test_init_interactive_reprompts_on_dotdot_click(self):
             assert "Invalid project name" in result.output
             assert (Path(tmp_dir) / "apm.yml").exists()
 
+    def test_init_interactive_reprompts_on_blank_name_click(self):
+        """A blank/whitespace name must re-prompt instead of writing name: ''.
+
+        Regression test for #2155: an empty name silently accepted here used
+        to write an apm.yml that every later `apm install`/`lock`/`compile`
+        rejected with "Invalid apm.yml identity: 'name' must be a non-empty
+        string", since APMPackage.from_apm_yml enforces a non-empty name.
+        """
+        with self.runner.isolated_filesystem() as tmp_dir:
+            result = self.runner.invoke(
+                cli,
+                ["init"],
+                input=" \nmy-project\n1.0.0\n\n\ny\ndone\ny\n",
+                catch_exceptions=False,
+            )
+            assert "Invalid project name" in result.output
+            apm_yml_path = Path(tmp_dir) / "apm.yml"
+            assert apm_yml_path.exists()
+            data = yaml.safe_load(apm_yml_path.read_text(encoding="utf-8"))
+            assert data["name"] == "my-project"
+
 
 class TestInitTargetPrompt:
     """Test cases for the target selection prompt in apm init (S1-S7)."""