@photostructure/fs-metadata 0.9.0 → 1.0.1

package/CHANGELOG.md

@@ -14,6 +14,21 @@ Fixed for any bug fixes.
 Security in case of vulnerabilities.
 -->
 
+## 1.0.1 - 2026-03-01
+
+### Fixed
+
+- `isHidden()` and `getHiddenMetadata()` now return `false` for root directories on all platforms. Windows root drives (e.g. `C:\`) have `FILE_ATTRIBUTE_HIDDEN` set by default as a system quirk, not user intent.
+
+## 1.0.0 - 2026-02-23
+
+### Security
+
+- Windows: add `/NXCOMPAT` (DEP) and `/HIGHENTROPYVA` (x64 high-entropy ASLR) linker flags
+- Windows: add `WarningLevel: 4` as structured MSBuild property on x64 and ARM64 targets (avoids `/W` flag ordering conflicts with node-gyp defaults)
+- Linux/macOS: add `-D_FORTIFY_SOURCE=2` and `-Wformat-security` compiler flags
+- Linux x64: add `-fcf-protection=full` (Intel CET); Linux ARM64: add `-mbranch-protection=standard` (PAC+BTI)
+
 ## 0.9.0 - 2025-12-28
 
 ### Added

package/README.md

@@ -1,4 +1,4 @@
-![PhotoStructure fs-metadata logo](https://raw.githubusercontent.com/photostructure/fs-metadata/main/doc/logo.svg)
+<img src="https://raw.githubusercontent.com/photostructure/fs-metadata/main/doc/logo.svg" alt="PhotoStructure fs-metadata logo" width="200">
 
 Cross-platform native Node.js module for filesystem metadata, mount points, and volume information. Built for and supported by [PhotoStructure](https://photostructure.com).
 
@@ -7,7 +7,7 @@ Cross-platform native Node.js module for filesystem metadata, mount points, and
 [![Node-API v9 Badge](https://raw.githubusercontent.com/nodejs/abi-stable-node/refs/heads/doc/assets/Node-API%20v9%20Badge.svg)](https://nodejs.org/dist/latest/docs/api/n-api.html#node-api-version-matrix)
 [![View on GitHub](https://img.shields.io/badge/View%20on-GitHub-blue)](https://github.com/photostructure/fs-metadata)
 
-## Quick Start
+## Quick start
 
 ```bash
 npm install @photostructure/fs-metadata
@@ -28,14 +28,14 @@ const metadata = await getVolumeMetadata("/");
 console.log(metadata);
 ```
 
-## Key Features
+## Features
 
-- **Volume Management**: List mount points, get volume metadata, space usage
-- **Hidden Files**: Get/set hidden attributes, recursive checks, cross-platform support
+- **Volume management**: List mount points, get volume metadata, space usage
+- **Hidden files**: Get/set hidden attributes, recursive checks, cross-platform support
 - **Performance**: Non-blocking async operations with timeout protection
-- **TypeScript**: Full type definitions with ESM and CommonJS support
+- **TypeScript**: Type definitions with ESM and CommonJS support
 
-## Supported Platforms
+## Supported platforms
 
 | Platform      | Architecture | Node.js | OS Version                |
 | ------------- | ------------ | ------- | ------------------------- |

package/binding.gyp

@@ -32,14 +32,32 @@
             ],
             "cflags": [
               "-fPIC",
-              "-fstack-protector-strong"
+              "-fstack-protector-strong",
+              "-D_FORTIFY_SOURCE=2",
+              "-Wformat-security"
             ],
             "cflags_cc": [
               "-fexceptions",
               "-fPIC",
-              "-fstack-protector-strong"
+              "-fstack-protector-strong",
+              "-D_FORTIFY_SOURCE=2",
+              "-Wformat-security"
             ],
             "conditions": [
+              [
+                "target_arch=='x64'",
+                {
+                  "cflags": ["-fcf-protection=full"],
+                  "cflags_cc": ["-fcf-protection=full"]
+                }
+              ],
+              [
+                "target_arch=='arm64'",
+                {
+                  "cflags": ["-mbranch-protection=standard"],
+                  "cflags_cc": ["-mbranch-protection=standard"]
+                }
+              ],
               [
                 "enable_gio=='true'",
                 {
@@ -88,6 +106,7 @@
                   ],
                   "msvs_settings": {
                     "VCCLCompilerTool": {
+                      "WarningLevel": 4,
                       "AdditionalOptions": [
                         "/Qspectre",
                         "/guard:cf",
@@ -101,6 +120,8 @@
                       "AdditionalOptions": [
                         "/guard:cf",
                         "/DYNAMICBASE",
+                        "/HIGHENTROPYVA",
+                        "/NXCOMPAT",
                         "/CETCOMPAT"
                       ]
                     }
@@ -118,6 +139,7 @@
                   ],
                   "msvs_settings": {
                     "VCCLCompilerTool": {
+                      "WarningLevel": 4,
                       "AdditionalOptions": [
                         "/guard:cf",     # Control Flow Guard (supported on ARM64)
                         "/ZH:SHA_256",   # SHA-256 hash algorithm for checksums
@@ -133,38 +155,14 @@
                     "VCLinkerTool": {
                       "AdditionalOptions": [
                         "/guard:cf",      # Control Flow Guard at link time
-                        "/DYNAMICBASE"    # ASLR (Address Space Layout Randomization)
-                        # NOTE: /CETCOMPAT omitted - Intel CET is x64-specific
+                        "/DYNAMICBASE",   # ASLR (Address Space Layout Randomization)
+                        "/NXCOMPAT"       # DEP (Data Execution Prevention)
+                        # NOTE: /HIGHENTROPYVA and /CETCOMPAT are x64-specific
                         #       ARM64 has equivalent hardware security features
                       ]
                     }
                   }
                 }
-              ],
-              [
-                "target_arch=='ia32'",
-                {
-                  "defines": [
-                    "_M_IX86"
-                  ],
-                  "msvs_settings": {
-                    "VCCLCompilerTool": {
-                      "AdditionalOptions": [
-                        "/guard:cf",
-                        "/ZH:SHA_256",
-                        "/sdl"
-                      ],
-                      "ExceptionHandling": 1,
-                      "RuntimeTypeInfo": "true"
-                    },
-                    "VCLinkerTool": {
-                      "AdditionalOptions": [
-                        "/guard:cf",
-                        "/DYNAMICBASE"
-                      ]
-                    }
-                  }
-                }
               ]
             ]
           }
@@ -183,17 +181,23 @@
               "CLANG_CXX_LIBRARY": "libc++",
               "MACOSX_DEPLOYMENT_TARGET": "10.15",
               "OTHER_CFLAGS": [
-                "-fstack-protector-strong"
+                "-fstack-protector-strong",
+                "-D_FORTIFY_SOURCE=2",
+                "-Wformat-security"
               ]
             },
             "cflags": [
               "-fexceptions",
               "-fPIC",
-              "-fstack-protector-strong"
+              "-fstack-protector-strong",
+              "-D_FORTIFY_SOURCE=2",
+              "-Wformat-security"
             ],
             "cflags_cc": [
               "-fexceptions",
-              "-fstack-protector-strong"
+              "-fstack-protector-strong",
+              "-D_FORTIFY_SOURCE=2",
+              "-Wformat-security"
             ],
             "link_settings": {
               "libraries": [

package/claude.sh

@@ -12,7 +12,10 @@ claude --append-system-prompt "$(
 # MANDATORY GUIDELINES
 - **Study your CLAUDE.md** - Every conversation begins by studying CLAUDE.md
 - **Always Start By Reading** - You must study the referenced codebase and related documentation before making any change. NEVER assume APIs or implementation details.
-- **Assume Concurrent Edits** - STOP if build errors aren't from your changes
+- **Assume Concurrent Edits** - if you encounter a compilation error that you don't think you caused, **STOP immediately**, do not try to fix it blindly, **describe the error** to the user clearly, and **use AskUserQuestion** with these options:
+   - "Build is now fixed, continue"
+   - "Please fix the build and then continue"
+
 - **Validate your work** - Does your code compile? Can we clean up compilation warnings? Do the related tests pass?
 - **Don't use git checkout to undo changes** - Instead, re-apply your diff in reverse. You have to assume that the git tree was not clean when you made edits.
 - **Ask questions** - If anything is nebulous or unclear, it is IMPERATIVE that you ask clarifying questions to maximize velocity and avoid spurious work.

package/dist/index.cjs

@@ -493,6 +493,10 @@ async function isHiddenImpl(pathname, nativeFn2) {
     throw new Error("Invalid pathname: " + JSON.stringify(pathname));
   }
   debug("Normalized path: %s", norm);
+  if (isRootDirectory(norm)) {
+    debug("Root directory, returning false");
+    return false;
+  }
   debug(
     "LocalSupport: dotPrefix=%s, systemFlag=%s",
     LocalSupport.dotPrefix,
@@ -565,6 +569,14 @@ async function getHiddenMetadataImpl(pathname, nativeFn2) {
   if (norm == null) {
     throw new Error("Invalid pathname: " + JSON.stringify(pathname));
   }
+  if (isRootDirectory(norm)) {
+    return {
+      hidden: false,
+      dotPrefix: false,
+      systemFlag: false,
+      supported: LocalSupport
+    };
+  }
   const dotPrefix = isPosixHidden(norm);
   const systemFlag = await isSystemHidden(norm, nativeFn2);
   return {