feat(security): directory path preservation in staging, SFTP shell-free mkdir, dot-dir share exclusion, and Stages 8-9 test expansion (60/60 passed)

Author: navaranjithsai

.gitignore

@@ -23,6 +23,9 @@ Thumbs.db
 
 # Test artifacts
 test-workspace/
+test-workspace*/
+test-workspace-*/
+test-integration-*/
 test.env
 clone-test/
 playground/

cloudsync-cli/src/cli/commands/commit.js

@@ -41,13 +41,24 @@ const commitCommand = new Command('commit')
       return;
     }
 
-    const stagedFiles = readdirSync(stagingDir).filter(f => f !== 'index.json');
+    const stagedFiles = readdirSync(stagingDir).filter(f => f !== 'index.json' && !f.endsWith('.tmp'));
 
     if (stagedFiles.length === 0 && !options.amend) {
       failWith('Nothing to commit. Stage some files first: cloudsync stage <files>');
       return;
     }
 
+    // Load the staged-name -> original-path mapping recorded by `stage`.
+    // Archive entries are named with the ORIGINAL relative path so a
+    // rollback restores "data/sample.txt", not the flattened copy.
+    let stagedMap = null;
+    try {
+      const idx = safeJsonParse(readFileSync(join(stagingDir, 'index.json'), 'utf8'), {});
+      if (Array.isArray(idx.entries)) stagedMap = new Map(idx.entries.map(e => [e.staged, e.path]));
+    } catch (_) { }
+    const originalPathOf = (flatName) => (stagedMap && stagedMap.has(flatName)) ? stagedMap.get(flatName) : flatName;
+    const commitFiles = stagedFiles.map(originalPathOf);
+
     const commitMessage = (message && String(message).trim()) || '';
     if (!commitMessage) {
       failWith('Commit cancelled — message is required. Usage: cloudsync commit "<message>"');
@@ -96,7 +107,7 @@ const commitCommand = new Command('commit')
     // Create zip archive
     const archivePath = join(historyDir, `${commitId}.zip`);
     mkdirSync(historyDir, { recursive: true });
-    await createStagedArchive(stagingDir, stagedFiles, archivePath);
+    await createStagedArchive(stagingDir, stagedFiles, archivePath, originalPathOf);
 
     // Apply AES-256-GCM encryption if requested
     let isEncrypted = false;
@@ -124,7 +135,7 @@ const commitCommand = new Command('commit')
       id: commitId,
       message: commitMessage,
       timestamp,
-      files: stagedFiles,
+      files: commitFiles,
       encrypted: isEncrypted,
       author: process.env.USER || process.env.USERNAME || 'unknown'
     };
@@ -162,7 +173,7 @@ const commitCommand = new Command('commit')
     }
 
     // Display commit info
-    logOperation('commit', `Committed: ${commitMessage}`, { files: stagedFiles, commitId });
+    logOperation('commit', `Committed: ${commitMessage}`, { files: commitFiles, commitId });
     console.log(chalk.green('\nCommitted successfully!'));
     console.log(chalk.gray('-'.repeat(60)));
     console.log(chalk.cyan(`   Commit ID: ${commitId}`));
@@ -179,7 +190,7 @@ function generateCommitId() {
   return `${timestamp}-${random}`;
 }
 
-async function createStagedArchive(stagingDir, files, outputPath) {
+async function createStagedArchive(stagingDir, files, outputPath, originalPathOf) {
   return new Promise((resolve, reject) => {
     const output = createWriteStream(outputPath);
     const archive = new ZipArchive({ zlib: { level: 9 } });
@@ -189,11 +200,13 @@ async function createStagedArchive(stagingDir, files, outputPath) {
     archive.pipe(output);
 
     files.forEach(f => {
-      const safeName = f.replace(/[\\/]/g, '__');
-      const stagedFilePath = join(stagingDir, safeName);
-      const actualPath = existsSync(stagedFilePath) ? stagedFilePath : join(stagingDir, f);
-      if (existsSync(actualPath)) {
-        archive.file(actualPath, { name: f });
+      // `f` is the flat staged filename; the archive entry is named with
+      // the ORIGINAL relative path (via the staging index mapping) so
+      // rollback extracts to the real location.
+      const entryName = originalPathOf ? originalPathOf(f) : f;
+      const stagedFilePath = join(stagingDir, f);
+      if (existsSync(stagedFilePath)) {
+        archive.file(stagedFilePath, { name: entryName });
       }
     });
 

cloudsync-cli/src/cli/commands/share.js

@@ -16,7 +16,7 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
 import { existsSync, writeFileSync, mkdirSync, createReadStream, statSync, createWriteStream, rmSync } from 'fs';
-import { join, basename, normalize } from 'path';
+import { join, basename, resolve } from 'path';
 import { randomBytes, randomUUID, scryptSync, timingSafeEqual } from 'crypto';
 import http from 'http';
 import url from 'url';
@@ -68,8 +68,9 @@ const shareCommand = new Command('share')
       return;
     }
 
-    // Resolve path (resolve to absolute, then normalize to defend against .. tricks)
-    const targetPath = normalize(join(process.cwd(), sharePath));
+    // resolve() handles both relative and absolute inputs correctly
+    // (unlike join(), which mangles absolute paths by prefixing cwd)
+    const targetPath = resolve(sharePath);
 
     if (!existsSync(targetPath)) {
       failWith(`❌ Path not found: ${targetPath}`);
@@ -328,7 +329,17 @@ async function startShareServer(session, options, verbose) {
             try { res.end(); } catch (_) {}
           });
           archive.pipe(res);
-          archive.directory(target, false);
+          // Exclude dot-directories — sharing "." must never leak the
+          // sender's .cloudsync/ internals (sessions, history, password hash)
+          archive.directory(target, false, (entry) => {
+            const rel = entry.name.replace(/^\.\//, '');
+            const parts = rel.split('/');
+            const first = parts[0] || '';
+            if (first.startsWith('.') && first.length > 1) {
+              return false; // drop the entire dot-directory subtree
+            }
+            return entry;
+          });
           archive.finalize().catch((e) => {
             console.error('Finalize error:', e.message);
           });

cloudsync-cli/src/cli/commands/stage.js

@@ -10,7 +10,7 @@
 
 import { Command } from 'commander';
 import chalk from 'chalk';
-import { existsSync, writeFileSync, copyFileSync, mkdirSync, readdirSync, statSync, renameSync, unlinkSync } from 'fs';
+import { existsSync, readFileSync, writeFileSync, copyFileSync, mkdirSync, readdirSync, statSync, renameSync, unlinkSync } from 'fs';
 import { join, relative, basename } from 'path';
 import { formatBytes } from '../../utils/helpers.js';
 import { safePath, isSafeFilename } from '../../utils/security.js';
@@ -115,14 +115,24 @@ const stageCommand = new Command('stage')
     }
   });
 
+/**
+ * Staged files are stored flat (subdirectory separators become "__") so the
+ * staging dir stays a single level. The original relative path is recorded in
+ * the staging index so commit can name archive entries correctly — otherwise
+ * a rollback would restore "data__sample.txt" instead of "data/sample.txt".
+ */
+function flattenName(relPath) {
+  return relPath.replace(/[\\/]/g, '__');
+}
+
 function stageFile(filePath, stagedFiles, stagingDir, verbose, rejectedFiles, originalArg) {
   try {
-    const relPath = originalArg || relative(process.cwd(), filePath);
-    const safeName = relPath.replace(/[\\/]/g, '__');
+    const relPath = (originalArg || relative(process.cwd(), filePath)).replace(/\\/g, '/');
+    const safeName = flattenName(relPath);
     const stagedPath = join(stagingDir, safeName);
 
     copyFileSync(filePath, stagedPath);
-    stagedFiles.push(relPath);
+    stagedFiles.push({ staged: safeName, path: relPath });
 
     if (verbose) {
       console.log(chalk.green(`   + ${relPath}`));
@@ -134,20 +144,34 @@ function stageFile(filePath, stagedFiles, stagingDir, verbose, rejectedFiles, or
 }
 
 function showStagedFiles(stagingDir, verbose) {
-  const files = readdirSync(stagingDir).filter(f => f !== 'index.json');
+  // Prefer the index mapping (original paths) when present; fall back to
+  // the flat directory listing for workspaces staged before the mapping.
+  let display = null;
+  try {
+    const idx = JSON.parse(readFileSync(join(stagingDir, 'index.json'), 'utf8'));
+    if (Array.isArray(idx.entries) && idx.entries.length > 0) {
+      display = idx.entries.map(e => e.path);
+    } else if (Array.isArray(idx.files)) {
+      display = idx.files;
+    }
+  } catch (_) { }
+  if (!display) {
+    display = readdirSync(stagingDir).filter(f => f !== 'index.json');
+  }
 
   console.log(chalk.cyan('\nStaged Files:'));
   console.log(chalk.gray('-'.repeat(40)));
 
-  if (files.length === 0) {
+  if (display.length === 0) {
     console.log(chalk.yellow('   No files staged'));
     console.log(chalk.gray('\n   Usage:'));
     console.log(chalk.gray('      cloudsync stage <files...>  # Stage specific files'));
     console.log(chalk.gray('      cloudsync stage --all       # Stage all'));
   } else {
-    files.forEach(f => {
+    display.forEach(f => {
       try {
-        const stat = statSync(join(stagingDir, f));
+        const flat = flattenName(f);
+        const stat = statSync(join(stagingDir, flat));
         const size = formatBytes(stat.size);
         console.log(chalk.green('   + ') + chalk.white(f) + chalk.gray(` (${size})`));
       } catch (e) {
@@ -156,27 +180,58 @@ function showStagedFiles(stagingDir, verbose) {
     });
 
     console.log(chalk.gray('-'.repeat(40)));
-    console.log(chalk.gray(`   ${files.length} file(s) staged`));
+    console.log(chalk.gray(`   ${display.length} file(s) staged`));
   }
 }
 
 function saveStagedIndex(files, verbose) {
-  const indexFile = join(process.cwd(), '.cloudsync', 'staging', 'index.json');
-  // Atomic write: temp + rename — prevents races with concurrent stage invocations
-  const tmp = indexFile + '.tmp';
+  const stagingDir = join(process.cwd(), '.cloudsync', 'staging');
+  const indexFile = join(stagingDir, 'index.json');
+
+  // Build the staged-name -> original-path mapping. Union with any entries
+  // already recorded (concurrent stage invocations), then intersect with the
+  // files that actually exist on disk right now so unstage removals stick.
+  const byStaged = new Map();
+  for (const f of files) {
+    if (f && typeof f === 'object') byStaged.set(f.staged, f.path);
+  }
+  try {
+    const existing = JSON.parse(readFileSync(indexFile, 'utf8'));
+    if (Array.isArray(existing.entries)) {
+      for (const e of existing.entries) byStaged.set(e.staged, e.path);
+    }
+    // Legacy index format (flat string list, pre-mapping) — carry over as-is
+    if (Array.isArray(existing.files)) {
+      for (const f of existing.files) byStaged.set(f, f);
+    }
+  } catch (_) { /* no index yet */ }
+
+  let onDisk;
+  try {
+    onDisk = new Set(readdirSync(stagingDir).filter(f => f !== 'index.json' && !f.endsWith('.tmp')));
+  } catch (_) {
+    onDisk = null;
+  }
+
+  const entries = [...byStaged.entries()]
+    .map(([staged, path]) => ({ staged, path }))
+    .filter(e => onDisk === null || onDisk.has(e.staged));
+
+  const tmp = indexFile + `.${process.pid}.tmp`;
   writeFileSync(tmp, JSON.stringify({
-    files,
+    entries,
+    files: entries.map(e => e.path), // backward-compatible flat view
     timestamp: new Date().toISOString()
   }, null, 2));
   try {
     renameSync(tmp, indexFile);
   } catch (e) {
-    // Fallback: just copy if rename across mount fails
-    writeFileSync(indexFile, JSON.stringify({ files, timestamp: new Date().toISOString() }, null, 2));
+    // Fallback: direct write if rename fails (e.g. across mounts)
+    writeFileSync(indexFile, JSON.stringify({ entries, files: entries.map(e => e.path), timestamp: new Date().toISOString() }, null, 2));
     try { unlinkSync(tmp); } catch (_) { }
   }
 
-  if (verbose) console.log(chalk.gray(`Staging index saved`));
+  if (verbose) console.log(chalk.gray(`Staging index saved (${entries.length} files)`));
 }
 
 export default stageCommand;