fix(cli): make project location + github repo optional, guard bad dirs

[jal-co]

What

Three fixes to the scaffold flow, all surfaced by user feedback:

1. Project location is optional. Pressing Enter accepts the default ./<name>. The prompt no longer errors Project location is required. when left blank, and absolute paths are rejected up front with a clear message. Scaffolding into . still works.
2. GitHub repo (owner/repo) is optional. Leaving it blank scaffolds with a <owner>/<name> placeholder (already the convention in --yes mode) so people can try the project without creating a repo first, then fill in the real slug later.
3. No more mkdir crash. An out-of-tree directory (e.g. an absolute /orc) previously crashed with a raw Unexpected error: ENOENT: no such file or directory, mkdir '/orc' stack trace. The CLI now refuses any target outside the current working directory (and home/root) with a friendly message and a non-zero exit.

Why

From feedback while trying the CLI:

"this one should be optional, especially for people to just try out your project, forcing repo creation will make them give up"

"here when I hit enter, it should give me that default which is displayed"

"and epic fail 😅" — ENOENT: no such file or directory, mkdir '/orc'

Required-by-default prompts and an unhandled crash are exactly the friction that makes people bail before their first successful scaffold.

How

• validateProjectLocation accepts empty (falls back to default) and rejects absolute paths.
• The GitHub slug prompt accepts empty; the existing <owner>/<name> placeholder fallback handles the rest.
• scaffold() resolves and validates the target dir before any mkdir, using path.relative containment plus explicit home/root checks; "." (current directory) stays allowed.

Type

• feat — New feature
• fix — Bug fix
• docs — Documentation
• refactor — Code restructuring
• perf — Performance improvement
• style — Formatting / code style
• chore — Maintenance / deps
• ci — CI/CD changes
• test — Tests

Checklist

• Branch follows conventional naming (fix/)
• Commits follow Conventional Commits
• npm run lint passes
• npm test passes (103 tests, +2 new)
• Tests added or updated (optional GitHub slug + directory guard)
• Docs updated (cli/prompts.mdx, cli/options.mdx note both as optional)

Screenshots

Verified locally with the built CLI:

# Absolute / out-of-tree dir — friendly cancel, no crash, nothing created
$ create-scn-stack orc --yes --directory /orc
└  Can't scaffold into /orc — it's outside the current directory. Use a relative path like ./orc.

# GitHub registry with no slug — placeholder, scaffolds fine
$ create-scn-stack ghkit --yes --github
│  npx shadcn@latest add <owner>/ghkit/button
└  ghkit ready as a GitHub source registry 🎉

# "." still scaffolds into the current directory
$ create-scn-stack dotkit --yes --directory .
└  dotkit ready with Next.js + Fumadocs 🎉

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
scn-stack	Ready	Preview, Comment	Jun 15, 2026 3:02am