Fail-closed disk cleaner for macOS developers. Scanning never authorizes deletion. UNKNOWN = KEEP.
DevClean finds regenerable junk in project trees: Rust target/, node_modules, Xcode DerivedData, agent worktrees, and package-manager caches. Auto Clean, One-Click, and Review share one engine. Auto Clean is a stricter policy on the same scanner.
Cleanup moves to Trash. Nothing is unlinked.
Needs Rust and Xcode command-line tools.
git clone <this-repo>
cd DevClean
./scripts/install-menubar.sh
That builds the CLI, writes ~/Applications/DevClean.app, and launches a menu-bar extra.
CLI only:
cargo run -p devclean-cli -- status
cargo run -p devclean-cli -- scan
cargo run -p devclean-cli -- plan --mode one-click
--execute moves eligible items to Trash. Auto --execute is refused until Observe Mode has been reviewed.
| Layer | Examples | One-Click |
|---|---|---|
| Delete | target/, .turbo, DerivedData, .next/cache |
Yes |
| Safe | Cheap regenerable caches | Yes |
| Warning | node_modules, .venv |
No (Review) |
| Danger | Git worktrees, git-ai state, AI models/sessions | Never |
Every unattended move must satisfy: known type, high confidence, rebuildable, allowed by policy, inside trusted scope, not protected, not active, activity verified, effects fully known, filesystem identity unchanged, path validation successful. Otherwise skip.
Hard rules:
- Symlinks and path traversal are refused
- Process running or process state unknown → skip
- Cloud and external volumes off for Auto
- Git worktrees and AI conversation state are Danger / Review only
cargo test --workspace
cargo clippy --workspace --all-targets -- -D warnings
Layout:
crates/devclean-core— enginecrates/devclean-cli—devcleanbinarymacos/— menu-bar extrascripts/install-menubar.sh— local install
GitHub Releases build DevClean-macos-arm64.zip and a devclean CLI when you publish a tag.
git tag v0.1.0
git push origin v0.1.0
gh release create v0.1.0 --generate-notes
The zip is ad-hoc signed. Other Macs need Control-click → Open until a Developer ID cert is added.
License: MIT. See SECURITY.md to report bugs that would move the wrong path.