feat(security): harden CLI security, fix ZIP extraction, upgrade dependencies to Node 18+ ESM targets

- Replaced all JSON.parse calls with safeJsonParse prototype pollution protection
- Hardened share HTTP server with rate limiting (60 req/min), CORS restriction, and security headers
- Fixed archiver v8 data descriptor ZIP extraction for commit rollback
- Upgraded dependencies (commander 15.x, archiver 8.x, esbuild 0.28.x, ssh2 1.17.x)
- Replaced deprecated pkg with @yao-pkg/pkg 6.22.0
- Verified 0 vulnerabilities across 230+ audited packages

Author: navaranjithsai

cloudsync-cli/bin/cloudsync.js

@@ -14,18 +14,27 @@ import { fileURLToPath } from 'url';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
-// ── Ensure .cloudsync directories exist ──────────────────
-const csyncDir = join(process.cwd(), '.cloudsync');
-[
-  csyncDir,
-  join(csyncDir, 'staging'),
-  join(csyncDir, 'history', 'commits'),
-  join(csyncDir, 'history', 'diffs'),
-  join(csyncDir, 'cache'),
-  join(csyncDir, 'logs'),
-].forEach((dir) => {
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-});
+// ── Ensure .cloudsync directories exist (only for real commands) ──
+function ensureDirs() {
+  const csyncDir = join(process.cwd(), '.cloudsync');
+  [
+    csyncDir,
+    join(csyncDir, 'staging'),
+    join(csyncDir, 'history', 'commits'),
+    join(csyncDir, 'history', 'diffs'),
+    join(csyncDir, 'cache'),
+    join(csyncDir, 'logs'),
+  ].forEach((dir) => {
+    if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  });
+}
+
+// Only create dirs when a real command is being run (not --help/--version)
+const helpFlags = ['--help', '-h', '--version', '-v', '-V'];
+const isHelpOrVersion = process.argv.length <= 2 || process.argv.some(a => helpFlags.includes(a));
+if (!isHelpOrVersion) {
+  ensureDirs();
+}
 
 // ── Global error handlers ────────────────────────────────
 process.on('uncaughtException', (err) => {