fix(init): validate only user-provided slugs, tighten looksLikePath

Move validateResourceId into resolveTarget so it only runs on
user-provided values (explicit and org-all cases), not on
API-resolved slugs from resolveProjectBySlug.

Tighten looksLikePath to match ~ only as '~' or '~/' — not '~foo',
which could be a valid slug. Rename misleading test accordingly.

Author: MathurAditya724

src/commands/init.ts

@@ -106,8 +106,12 @@ async function resolveTarget(targetArg: string | undefined): Promise<{
 
   switch (parsed.type) {
     case "explicit":
+      // Validate user-provided slugs before they reach API calls
+      validateResourceId(parsed.org, "organization slug");
+      validateResourceId(parsed.project, "project name");
       return { org: parsed.org, project: parsed.project };
     case "org-all":
+      validateResourceId(parsed.org, "organization slug");
       return { org: parsed.org, project: undefined };
     case "project-search": {
       // Bare slug — search for a project with this name across all orgs.
@@ -219,18 +223,12 @@ export const initCommand = buildCommand<
       .filter(Boolean);
 
     // 4. Resolve target → org + project
+    //    Validation of user-provided slugs happens inside resolveTarget.
+    //    API-resolved values (from resolveProjectBySlug) are already valid.
     const { org: explicitOrg, project: explicitProject } =
       await resolveTarget(targetArg);
 
-    // 5. Validate explicit slugs before passing to API calls
-    if (explicitOrg) {
-      validateResourceId(explicitOrg, "organization slug");
-    }
-    if (explicitProject) {
-      validateResourceId(explicitProject, "project name");
-    }
-
-    // 6. Run the wizard
+    // 5. Run the wizard
     await runWizard({
       directory: targetDir,
       yes: flags.yes,

src/lib/arg-parsing.ts

@@ -89,12 +89,17 @@ export function looksLikeIssueShortId(str: string): boolean {
  * - `.` (current directory)
  * - `./foo`, `../foo` (relative paths)
  * - `/foo` (absolute paths)
- * - `~/foo` (home directory paths)
+ * - `~` or `~/foo` (home directory paths)
  *
  * Bare names like `my-org` or `my-project` never match, which is what makes
  * this useful for disambiguating positional arguments that could be either
  * a filesystem path or an org/project target.
  *
+ * Note: `~` is only matched as `~` alone or `~/...`, not `~foo`. This avoids
+ * false positives on slugs that happen to start with tilde (valid in Sentry slugs).
+ * Shell expansion of `~/foo` happens before the CLI sees the argument, so a literal
+ * `~/foo` reaching this function means the shell didn't expand it (e.g., it was quoted).
+ *
  * @param arg - CLI argument string to check
  * @returns true if the string looks like a filesystem path
  *
@@ -104,16 +109,19 @@ export function looksLikeIssueShortId(str: string): boolean {
  * looksLikePath("../parent")   // true
  * looksLikePath("/absolute")   // true
  * looksLikePath("~/home")      // true
+ * looksLikePath("~")           // true
+ * looksLikePath("~foo")        // false (could be a slug)
  * looksLikePath("my-project")  // false
  * looksLikePath("acme/app")    // false
  */
 export function looksLikePath(arg: string): boolean {
   return (
     arg === "." ||
+    arg === "~" ||
     arg.startsWith("./") ||
     arg.startsWith("../") ||
     arg.startsWith("/") ||
-    arg.startsWith("~")
+    arg.startsWith("~/")
   );
 }
 

test/commands/init.test.ts

@@ -179,7 +179,7 @@ describe("init command func", () => {
       expect(capturedArgs?.org).toBeUndefined();
     });
 
-    test("~/home resolves relative to cwd", async () => {
+    test("~/path treated as literal path (no shell expansion)", async () => {
       const ctx = makeContext("/projects/app");
       await func.call(ctx, DEFAULT_FLAGS, "~/projects/other");
       expect(capturedArgs?.directory).toBe(