dev-prune-windows-x86 1.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/LICENSE.md ADDED
@@ -0,0 +1,201 @@
1
+ Apache License
2
+ Version 2.0, January 2004
3
+ http://www.apache.org/licenses/
4
+
5
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
6
+
7
+ 1. Definitions.
8
+
9
+ "License" shall mean the terms and conditions for use, reproduction,
10
+ and distribution as defined by Sections 1 through 9 of this document.
11
+
12
+ "Licensor" shall mean the copyright owner or entity authorized by
13
+ the copyright owner that is granting the License.
14
+
15
+ "Legal Entity" shall mean the union of the acting entity and all
16
+ other entities that control, are controlled by, or are under common
17
+ control with that entity. For the purposes of this definition,
18
+ "control" means (i) the power, direct or indirect, to cause the
19
+ direction or management of such entity, whether by contract or
20
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
21
+ outstanding shares, or (iii) beneficial ownership of such entity.
22
+
23
+ "You" (or "Your") shall mean an individual or Legal Entity
24
+ exercising permissions granted by this License.
25
+
26
+ "Source" form shall mean the preferred form for making modifications,
27
+ including but not limited to software source code, documentation
28
+ source, and configuration files.
29
+
30
+ "Object" form shall mean any form resulting from mechanical
31
+ transformation or translation of a Source form, including but
32
+ not limited to compiled object code, generated documentation,
33
+ and conversions to other media types.
34
+
35
+ "Work" shall mean the work of authorship, whether in Source or
36
+ Object form, made available under the License, as indicated by a
37
+ copyright notice that is included in or attached to the work
38
+ (an example is provided in the Appendix below).
39
+
40
+ "Derivative Works" shall mean any work, whether in Source or Object
41
+ form, that is based on (or derived from) the Work and for which the
42
+ editorial revisions, annotations, elaborations, or other modifications
43
+ represent, as a whole, an original work of authorship. For the purposes
44
+ of this License, Derivative Works shall not include works that remain
45
+ separable from, or merely link (or bind by name) to the interfaces of,
46
+ the Work and Derivative Works thereof.
47
+
48
+ "Contribution" shall mean any work of authorship, including
49
+ the original version of the Work and any modifications or additions
50
+ to that Work or Derivative Works thereof, that is intentionally
51
+ submitted to Licensor for inclusion in the Work by the copyright owner
52
+ or by an individual or Legal Entity authorized to submit on behalf of
53
+ the copyright owner. For the purposes of this definition, "submitted"
54
+ means any form of electronic, verbal, or written communication sent
55
+ to the Licensor or its representatives, including but not limited to
56
+ communication on electronic mailing lists, source code control systems,
57
+ and issue tracking systems that are managed by, or on behalf of, the
58
+ Licensor for the purpose of discussing and improving the Work, but
59
+ excluding communication that is conspicuously marked or otherwise
60
+ designated in writing by the copyright owner as "Not a Contribution."
61
+
62
+ "Contributor" shall mean Licensor and any individual or Legal Entity
63
+ on behalf of whom a Contribution has been received by Licensor and
64
+ subsequently incorporated within the Work.
65
+
66
+ 2. Grant of Copyright License. Subject to the terms and conditions of
67
+ this License, each Contributor hereby grants to You a perpetual,
68
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
69
+ copyright license to reproduce, prepare Derivative Works of,
70
+ publicly display, publicly perform, sublicense, and distribute the
71
+ Work and such Derivative Works in Source or Object form.
72
+
73
+ 3. Grant of Patent License. Subject to the terms and conditions of
74
+ this License, each Contributor hereby grants to You a perpetual,
75
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
76
+ (except as stated in this section) patent license to make, have made,
77
+ use, offer to sell, sell, import, and otherwise transfer the Work,
78
+ where such license applies only to those patent claims licensable
79
+ by such Contributor that are necessarily infringed by their
80
+ Contribution(s) alone or by combination of their Contribution(s)
81
+ with the Work to which such Contribution(s) was submitted. If You
82
+ institute patent litigation against any entity (including a
83
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
84
+ or a Contribution incorporated within the Work constitutes direct
85
+ or contributory patent infringement, then any patent licenses
86
+ granted to You under this License for that Work shall terminate
87
+ as of the date such litigation is filed.
88
+
89
+ 4. Redistribution. You may reproduce and distribute copies of the
90
+ Work or Derivative Works thereof in any medium, with or without
91
+ modifications, and in Source or Object form, provided that You
92
+ meet the following conditions:
93
+
94
+ (a) You must give any other recipients of the Work or
95
+ Derivative Works a copy of this License; and
96
+
97
+ (b) You must cause any modified files to carry prominent notices
98
+ stating that You changed the files; and
99
+
100
+ (c) You must retain, in the Source form of any Derivative Works
101
+ that You distribute, all copyright, patent, trademark, and
102
+ attribution notices from the Source form of the Work,
103
+ excluding those notices that do not pertain to any part of
104
+ the Derivative Works; and
105
+
106
+ (d) If the Work includes a "NOTICE" text file as part of its
107
+ distribution, then any Derivative Works that You distribute must
108
+ include a readable copy of the attribution notices contained
109
+ within such NOTICE file, excluding those notices that do not
110
+ pertain to any part of the Derivative Works, in at least one
111
+ of the following places: within a NOTICE text file distributed
112
+ as part of the Derivative Works; within the Source form or
113
+ documentation, if provided along with the Derivative Works; or,
114
+ within a display generated by the Derivative Works, if and
115
+ wherever such third-party notices normally appear. The contents
116
+ of the NOTICE file are for informational purposes only and
117
+ do not modify the License. You may add Your own attribution
118
+ notices within Derivative Works that You distribute, alongside
119
+ or as an addendum to the NOTICE text from the Work, provided
120
+ that such additional attribution notices cannot be construed
121
+ as modifying the License.
122
+
123
+ You may add Your own copyright statement to Your modifications and
124
+ may provide additional or different license terms and conditions
125
+ for use, reproduction, or distribution of Your modifications, or
126
+ for any such Derivative Works as a whole, provided Your use,
127
+ reproduction, and distribution of the Work otherwise complies with
128
+ the conditions stated in this License.
129
+
130
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
131
+ any Contribution intentionally submitted for inclusion in the Work
132
+ by You to the Licensor shall be under the terms and conditions of
133
+ this License, without any additional terms or conditions.
134
+ Notwithstanding the above, nothing herein shall supersede or modify
135
+ the terms of any separate license agreement you may have executed
136
+ with Licensor regarding such Contributions.
137
+
138
+ 6. Trademarks. This License does not grant permission to use the trade
139
+ names, trademarks, service marks, or product names of the Licensor,
140
+ except as required for reasonable and customary use in describing the
141
+ origin of the Work and reproducing the content of the NOTICE file.
142
+
143
+ 7. Disclaimer of Warranty. Unless required by applicable law or
144
+ agreed to in writing, Licensor provides the Work (and each
145
+ Contributor provides its Contributions) on an "AS IS" BASIS,
146
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147
+ implied, including, without limitation, any warranties or conditions
148
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149
+ PARTICULAR PURPOSE. You are solely responsible for determining the
150
+ appropriateness of using or redistributing the Work and assume any
151
+ risks associated with Your exercise of permissions under this License.
152
+
153
+ 8. Limitation of Liability. In no event and under no legal theory,
154
+ whether in tort (including negligence), contract, or otherwise,
155
+ unless required by applicable law (such as deliberate and grossly
156
+ negligent acts) or agreed to in writing, shall any Contributor be
157
+ liable to You for damages, including any direct, indirect, special,
158
+ incidental, or consequential damages of any character arising as a
159
+ result of this License or out of the use or inability to use the
160
+ Work (including but not limited to damages for loss of goodwill,
161
+ work stoppage, computer failure or malfunction, or any and all
162
+ other commercial damages or losses), even if such Contributor
163
+ has been advised of the possibility of such damages.
164
+
165
+ 9. Accepting Warranty or Additional Liability. While redistributing
166
+ the Work or Derivative Works thereof, You may choose to offer,
167
+ and charge a fee for, acceptance of support, warranty, indemnity,
168
+ or other liability obligations and/or rights consistent with this
169
+ License. However, in accepting such obligations, You may act only
170
+ on Your own behalf and on Your sole responsibility, not on behalf
171
+ of any other Contributor, and only if You agree to indemnify,
172
+ defend, and hold each Contributor harmless for any liability
173
+ incurred by, or claims asserted against, such Contributor by reason
174
+ of your accepting any such warranty or additional liability.
175
+
176
+ END OF TERMS AND CONDITIONS
177
+
178
+ APPENDIX: How to apply the Apache License to your work.
179
+
180
+ To apply the Apache License to your work, attach the following
181
+ boilerplate notice, with the fields enclosed by brackets "[]"
182
+ replaced with your own identifying information. (Don't include
183
+ the brackets!) The text should be enclosed in the appropriate
184
+ comment syntax for the file format. We also recommend that a
185
+ file or class name and description of purpose be included on the
186
+ same "printed page" as the copyright notice for easier
187
+ identification within third-party archives.
188
+
189
+ Copyright 2026 VKrishna04
190
+
191
+ Licensed under the Apache License, Version 2.0 (the "License");
192
+ you may not use this file except in compliance with the License.
193
+ You may obtain a copy of the License at
194
+
195
+ http://www.apache.org/licenses/LICENSE-2.0
196
+
197
+ Unless required by applicable law or agreed to in writing, software
198
+ distributed under the License is distributed on an "AS IS" BASIS,
199
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
200
+ See the License for the specific language governing permissions and
201
+ limitations under the License.
package/README.md ADDED
@@ -0,0 +1,813 @@
1
+ # dev-prune-windows-x86
2
+
3
+ **Do not install this package.** Install [`dev-prune`](https://www.npmjs.com/package/dev-prune):
4
+
5
+ ```sh
6
+ npm install -g dev-prune
7
+ ```
8
+
9
+ This package holds nothing but the prebuilt `dev-prune` binary for **windows x86**.
10
+ It exists because npm has no other way to ship a per-platform executable: `dev-prune`
11
+ lists all seven platform packages as optional dependencies, and npm installs only the one
12
+ matching your machine. Installing this one directly gives you a binary with no launcher
13
+ and no upgrade path.
14
+
15
+ Documentation: <https://devprune.vkrishna04.me>
16
+
17
+ ---
18
+
19
+ What follows is the dev-prune README, so this page describes the tool rather than just
20
+ refusing to be installed. Every command in it is run through the dispatcher package,
21
+ not through this one.
22
+
23
+ ---
24
+
25
+ <div align="center">
26
+
27
+ <img src="assets/github-readme-banner.png" alt="dev-prune — gigabytes back, nothing you can't rebuild" width="820" />
28
+
29
+ # `dev-prune`
30
+
31
+ ### Gigabytes back. Nothing you can't rebuild.
32
+
33
+ **Reclaim the disk space your idle repositories are sitting on — without ever deleting
34
+ something a lockfile cannot put back.**
35
+
36
+ [![crates.io](https://img.shields.io/crates/v/dev-prune.svg?logo=rust)](https://crates.io/crates/dev-prune) [![PyPI](https://img.shields.io/pypi/v/dev-prune.svg?logo=pypi&logoColor=white)](https://pypi.org/project/dev-prune/) [![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE.md) [![Rust](https://img.shields.io/badge/rust-1.88%2B-orange.svg)](https://www.rust-lang.org/) [![Platforms](https://img.shields.io/badge/platforms-Windows%20%7C%20macOS%20%7C%20Linux-lightgrey.svg)](docs/RELEASES_AND_MANUAL_INSTALL.md)
37
+
38
+ [![CI](https://github.com/Life-Experimentalist/dev-prune/actions/workflows/ci.yml/badge.svg)](https://github.com/Life-Experimentalist/dev-prune/actions/workflows/ci.yml) [![Pages](https://github.com/Life-Experimentalist/dev-prune/actions/workflows/pages.yml/badge.svg)](https://devprune.vkrishna04.me/) [![npm](https://img.shields.io/npm/v/dev-prune.svg?logo=npm)](https://www.npmjs.com/package/dev-prune)
39
+
40
+ [**Website**](https://devprune.vkrishna04.me/) · [**Documentation**](docs/README.md) · [**CLI reference**](docs/CLI_REFERENCE.md) · [**Safety invariants**](docs/SAFETY_INVARIANTS.md) · [**Changelog**](CHANGELOG.md)
41
+
42
+ `devp` is the same binary under a shorter name&nbsp; ·&nbsp; Windows, macOS and Linux&nbsp; ·&nbsp; Apache-2.0&nbsp; ·&nbsp; by [VKrishna04](https://vkrishna04.me)
43
+
44
+ </div>
45
+
46
+ ---
47
+
48
+ `node_modules`, `.venv`, `target` and `vendor` are the largest directories on most
49
+ developers' machines, and the least valuable: every byte in them is described by a
50
+ lockfile that is already committed. A project you have not opened since March is holding
51
+ gigabytes hostage for a build you are not running.
52
+
53
+ `dev-prune` finds those directories across every Git repository you register, and deletes
54
+ them — but only after proving the exact command that puts them back would succeed. It is
55
+ a single Rust binary, installs its own background schedule, and answers to two names:
56
+ `dev-prune` and `devp`.
57
+
58
+ > [!IMPORTANT]
59
+ > **The rule the whole tool is built around:** nothing is deleted unless dev-prune has
60
+ > just verified, read-only, that its lockfile can rebuild it. There is no flag to skip
61
+ > that check. `--ignore-idle` lifts the idle-day wait and *nothing else*.
62
+
63
+ ---
64
+
65
+ ## Contents
66
+
67
+ <div align="center">
68
+
69
+ **Start here**&nbsp;&nbsp; [Install](#install) · [Editors](#in-your-editor) · [60-second tour](#60-second-tour) · [What it looks like](#what-it-looks-like)
70
+
71
+ **How it thinks**&nbsp;&nbsp; [Why it is safe](#why-it-is-safe) · [Features](#features) · [Commands](#commands) · [Ecosystems](#supported-ecosystems) · [Monorepos](#repositories-with-more-than-one-ecosystem)
72
+
73
+ **Running it**&nbsp;&nbsp; [Configuration](#configuration) · [Automation](#background-automation) · [Comparison](#how-it-compares) · [Architecture](#architecture) · [Docs](#documentation)
74
+
75
+ </div>
76
+
77
+ ---
78
+
79
+ ## Install
80
+
81
+ ### One-liner
82
+
83
+ Pick the line for the shell you are actually typing into. Pasting the first one into a
84
+ Command Prompt is the most common install failure there is — it answers
85
+ `'sh' is not recognized as an internal or external command`, because `sh` is a Unix shell
86
+ and Windows does not ship one.
87
+
88
+ **Linux, macOS, or a Unix shell on Windows** — Git Bash, MSYS2, Cygwin, WSL:
89
+
90
+ ```bash
91
+ curl -fsSL https://devprune.vkrishna04.me/install.sh | sh
92
+ ```
93
+
94
+ **Windows PowerShell** — the blue or black `PS>` prompt, and Windows Terminal's default:
95
+
96
+ ```powershell
97
+ iwr -useb https://devprune.vkrishna04.me/install.ps1 | iex
98
+ ```
99
+
100
+ **Windows Command Prompt** — the `C:\>` prompt, which has no `iwr` of its own:
101
+
102
+ ```bat
103
+ powershell -NoProfile -ExecutionPolicy Bypass -Command "iwr -useb https://devprune.vkrishna04.me/install.ps1 | iex"
104
+ ```
105
+
106
+ All three download the prebuilt binary for your platform, verify its published SHA-256,
107
+ put it on `PATH`, and run `dev-prune setup`. Pass `--no-auto-setup` / `-NoAutoSetup` to
108
+ skip that last step.
109
+
110
+ Re-run any of them whenever you like. An install that is already current, complete and on
111
+ `PATH` is left exactly as it is and exits `0` without downloading; an older one is updated
112
+ in place; a newer one is not downgraded. `--force` / `-Force` writes it again regardless.
113
+
114
+ The Command Prompt form installs identically to the PowerShell one, but `cmd` cannot
115
+ inherit the `PATH` the installer sets in its own process, so `devp` resolves in the *next*
116
+ Command Prompt you open rather than the current one. PowerShell does not have that
117
+ problem.
118
+
119
+ ### From a package manager
120
+
121
+ ```bash
122
+ uv tool install dev-prune # or: uvx dev-prune status
123
+ pipx install dev-prune
124
+ pip install dev-prune
125
+ cargo binstall dev-prune # fetches the prebuilt release archive
126
+ cargo install dev-prune # builds from source, needs Rust 1.88+
127
+ ```
128
+
129
+ The PyPI packages **contain the binary** — there is no download step at install time,
130
+ so they work behind a registry mirror and offline. Everything but `cargo install` ships
131
+ a prebuilt executable.
132
+
133
+ crates.io stores source and nothing else, so `cargo install` has no binary to fetch and
134
+ always compiles. [`cargo binstall`](https://github.com/cargo-bins/cargo-binstall) is the
135
+ one that downloads: `Cargo.toml` tells it where this project's release archives live, so
136
+ it unpacks the same executable the installers use, with no toolchain involved.
137
+
138
+ Homebrew and Scoop each have a one-file tap and bucket, which exist so that upgrades keep
139
+ arriving:
140
+
141
+ ```bash
142
+ brew tap Life-Experimentalist/tap
143
+ brew install dev-prune
144
+ ```
145
+
146
+ ```powershell
147
+ scoop bucket add life-experimentalist https://github.com/Life-Experimentalist/scoop-bucket
148
+ scoop install dev-prune
149
+ ```
150
+
151
+ Both also install straight from a URL with nothing tapped or added, because the file
152
+ carries the SHA-256 of the archive it installs — but a formula that belongs to no tap is
153
+ one `brew upgrade` will never look at again:
154
+
155
+ ```bash
156
+ brew install https://raw.githubusercontent.com/Life-Experimentalist/dev-prune/main/packaging/homebrew/dev-prune.rb
157
+ ```
158
+
159
+ ```powershell
160
+ scoop install https://raw.githubusercontent.com/Life-Experimentalist/dev-prune/main/packaging/scoop/dev-prune.json
161
+ ```
162
+
163
+ WinGet is [submitted and in review](https://github.com/microsoft/winget-pkgs/pull/422809);
164
+ `winget install VKrishna04.dev-prune` starts resolving when that pull request merges.
165
+
166
+ The two Python entry points differ in where they land. `pip install` follows whichever
167
+ environment is active, so inside a virtualenv `devp` lives in that venv's `Scripts`/`bin`
168
+ and disappears with it; `pip install --user`, `pipx` and `uv tool install` are the
169
+ machine-wide forms. [Where each one puts the executables](docs/troubleshooting/INSTALLATION_ISSUES.md#6-uv-tool-install-put-the-executables-somewhere-unexpected).
170
+
171
+ ### Direct download
172
+
173
+ Seven checksummed archives per release on
174
+ [GitHub Releases](https://github.com/Life-Experimentalist/dev-prune/releases) — Windows,
175
+ macOS and Linux on x64 and arm64, plus a 32-bit `windows-x86` build for machines with no
176
+ 64-bit mode. The Linux binaries are statically linked against musl, so one file per
177
+ architecture runs on every distribution including Alpine.
178
+
179
+ Manual install and build-from-source:
180
+ [docs/RELEASES_AND_MANUAL_INSTALL.md](docs/RELEASES_AND_MANUAL_INSTALL.md).
181
+
182
+ ### In your editor
183
+
184
+ There is a companion extension. It validates `.devprune.json` as you type — every key,
185
+ every adapter name, every enum, from the schema bundled inside it rather than fetched — and
186
+ puts the workspace's reclaimable size in the status bar, so you can see what a repository
187
+ is holding without leaving the window.
188
+
189
+ [![VS Code Marketplace](https://img.shields.io/visual-studio-marketplace/v/VKrishna04.dev-prune?logo=visualstudiocode&label=VS%20Code%20Marketplace)](https://marketplace.visualstudio.com/items?itemName=VKrishna04.dev-prune) [![Open VSX](https://img.shields.io/open-vsx/v/VKrishna04/dev-prune?logo=eclipseide&label=Open%20VSX)](https://open-vsx.org/extension/VKrishna04/dev-prune)
190
+
191
+ ```bash
192
+ code --install-extension VKrishna04.dev-prune
193
+ ```
194
+
195
+ Open VSX is the same extension for the editors that cannot reach Microsoft's marketplace —
196
+ VSCodium, Cursor, Windsurf, Positron, Kiro. You do not have to pick: `devp setup` offers
197
+ to install it once, at a terminal, into whichever of those it finds, each from its own
198
+ registry.
199
+
200
+ **JetBrains IDEs need no extension at all.** The config schema is registered with
201
+ [SchemaStore](https://www.schemastore.org/), so IntelliJ, PyCharm, WebStorm, GoLand,
202
+ RubyMine and Rider validate `.devprune.json` out of the box — as do Visual Studio, Neovim
203
+ and Zed.
204
+
205
+ **And your coding agent gets the same treatment.** `devp skill --agent <editor>` writes the
206
+ rules file that editor actually reads — `.github/copilot-instructions.md`, `.cursor/rules/`,
207
+ `CLAUDE.md`, `.junie/guidelines.md` and the rest — so an agent working in the repository
208
+ knows what dev-prune will and will not delete before it suggests anything.
209
+
210
+ Everything about editors, in one place:
211
+ [docs/IDE_INTEGRATION.md](docs/IDE_INTEGRATION.md).
212
+
213
+ ### Let an AI assistant do it
214
+
215
+ Copy the prompt below and paste it to Claude Code, Cursor, GitHub Copilot, Windsurf, or
216
+ any terminal-capable agent — it installs, verifies, and registers your projects for you.
217
+ [More detail and per-tool notes.](docs/AI_SETUP_PROMPT.md)
218
+
219
+ ````text
220
+ Install and set up `dev-prune` (binary name `devp`), a lockfile-safe workspace cleaner,
221
+ on this machine. Follow these steps exactly and do not improvise beyond them.
222
+
223
+ 1. Detect the OS and run the matching official installer, nothing else:
224
+ - macOS or Linux:
225
+ curl -fsSL https://devprune.vkrishna04.me/install.sh | sh
226
+ - Windows (PowerShell):
227
+ iwr -useb https://devprune.vkrishna04.me/install.ps1 | iex
228
+ - If a Rust toolchain is already present and you cannot reach the network, you may
229
+ instead run: cargo install dev-prune
230
+ Do NOT download binaries from anywhere other than devprune.vkrishna04.me or the
231
+ project's GitHub releases, and do NOT edit PATH, the registry, or any OS scheduler by
232
+ hand — the installer and `devp setup` do all of that themselves.
233
+
234
+ 2. Open a NEW terminal (so the updated PATH is in effect) and verify:
235
+ devp --version
236
+ devp doctor
237
+ `devp doctor` must exit 0. If it prints warnings, read them out to me; do not try to
238
+ "fix" the scheduler or hooks yourself — they are self-installing.
239
+
240
+ 3. Ask me which project directories to keep clean, then register each one:
241
+ devp init <path>
242
+ Do not register directories I did not name. `devp init` only records a directory; it
243
+ never deletes anything on its own.
244
+
245
+ 4. Show me the result and stop:
246
+ devp status
247
+
248
+ Notes you should rely on, not work around:
249
+ - Installation already registered a background pass (every 2 days) and, on Windows, a
250
+ windowless task that never flashes a console window. You do not need to configure any
251
+ of this.
252
+ - Nothing is ever deleted unless a lockfile can rebuild it, the repo has been idle past
253
+ the threshold, and (interactively) I confirm. Run `devp run --dry-run` if I want a
254
+ preview.
255
+ - To undo the whole thing later: `devp uninstall`.
256
+ ````
257
+
258
+ Every install channel in detail: [docs/DISTRIBUTION.md](docs/DISTRIBUTION.md).
259
+
260
+ > [!TIP]
261
+ > **`devp` is a real executable, not a shell alias.** Installation puts a second binary
262
+ > next to `dev-prune`, so the short name works in cmd, PowerShell, bash, fish, an IDE
263
+ > terminal and a scheduled task alike — with no profile to re-source, and no chance of an
264
+ > upgrade leaving `devp` on the old version.
265
+
266
+ ---
267
+
268
+ ## 60-second tour
269
+
270
+ ```bash
271
+ devp init ~/Projects # register every Git repository under a tree
272
+ devp status # dashboard: what is tracked, what is reclaimable
273
+ devp run --dry-run # what a pass would delete — changes nothing
274
+ devp run # do it, after confirming
275
+ devp restore --last-run # put back exactly what that pass deleted
276
+ ```
277
+
278
+ A few more worth knowing on day one:
279
+
280
+ ```bash
281
+ devp stats # how much has been reclaimed so far, and by which repositories
282
+ devp caches # every package manager cache, sized. The report deletes nothing
283
+ devp status --drift # anything installed that the lockfiles don't record?
284
+ devp doctor . # why is this repository not being pruned?
285
+ devp doctor --fix # repair a broken integration — never a first-time install
286
+ devp -V # version, OS, architecture, config path, PATH audit
287
+ ```
288
+
289
+ ---
290
+
291
+ ## What it looks like
292
+
293
+ <details open>
294
+ <summary><b><code>devp run --dry-run</code></b> — the plan, before anything is touched</summary>
295
+
296
+ ```console
297
+ $ devp run --dry-run
298
+
299
+ dev-prune run (DRY RUN)
300
+ → Scanning 4 registered repositories for prune candidates...
301
+
302
+ Prune Candidates & Space Savings Calculation
303
+ → • ~/Code/acme-api → node_modules (412.7 MiB) [pnpm]
304
+ → • ~/Code/acme-api → services/worker/.venv (188.2 MiB) [uv]
305
+ → • ~/Code/render-farm → target (2.14 GiB) [cargo]
306
+ → • ~/Code/edge-proxy → vendor (96.4 MiB) [go]
307
+
308
+ Summary (Dry Run)
309
+ → Would free 2.82 GiB across 4 bloat directories.
310
+ ```
311
+
312
+ </details>
313
+
314
+ <details>
315
+ <summary><b><code>devp status</code></b> — the dashboard, or a plain table with no TTY</summary>
316
+
317
+ ```console
318
+ $ devp status
319
+
320
+ → Global Config Location: ~/.config/dev-prune/registry.json
321
+ → Background OS Daemon: Installed
322
+ → Background Git Hooks: Installed
323
+ → Global Command Timeout: 600s (10m)
324
+ → Tracked Repositories: 4
325
+ → Historical Space Saved: 6.31 GiB across 9 prune passes
326
+
327
+ dev-prune status
328
+
329
+ # Repository Status / Reason Adapters Bloat Last Activity Last Pruned
330
+ ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
331
+ 1 acme-api Candidate pnpm+uv 600.9 MiB 2026-04-02 Never
332
+ 2 render-farm Candidate cargo 2.14 GiB 2026-03-11 2026-01-08
333
+ 3 edge-proxy Candidate go 96.4 MiB 2026-05-19 Never
334
+ 4 dashboard Active (not idle) npm 314.0 MiB 2026-08-12 2026-06-30
335
+ ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
336
+ → Total: 4 repos | 3 candidates | 3.13 GiB reclaimable
337
+ ```
338
+
339
+ Keys: `↑`/`↓` move, `p` pre-selects every candidate, `Space` deselects the one you are
340
+ keeping, `Enter` prunes the rest, `i` toggles ignore for a repository, `q` exits.
341
+
342
+ </details>
343
+
344
+ <details>
345
+ <summary><b><code>devp caches</code></b> — where the rest of the disk went</summary>
346
+
347
+ ```console
348
+ $ devp caches
349
+
350
+ Package manager caches
351
+
352
+ npm cache 9.98 GiB ~/.npm
353
+ clear: npm cache clean --force
354
+ npm is used by 18 of 46 registered repositories · 567.75 MiB each
355
+
356
+ uv cache 6.22 GiB ~/.cache/uv
357
+ clear: uv cache prune
358
+ uv is used by 7 of 46 registered repositories · 909.77 MiB each
359
+
360
+ pnpm store 2.07 GiB /mnt/data/.pnpm-store
361
+ clear: pnpm store prune --store-dir /mnt/data/.pnpm-store
362
+ one store per filesystem, because a hardlink into node_modules cannot cross one
363
+ pnpm is used by 1 of 46 registered repositories · 2.09 GiB each
364
+
365
+ nuget global packages 1.44 GiB ~/.nuget/packages
366
+ clear: dotnet nuget locals global-packages --clear
367
+ every .NET project on the machine restores from here; re-downloaded on the next restore
368
+
369
+ … (pip, bun, both go caches, gradle wrapper distributions, both cargo
370
+ registry caches, and the pnpm store beside your home directory)
371
+
372
+ Total 21.99 GiB across 12 caches
373
+
374
+ → Nothing above was deleted, and dev-prune never deletes any of it.
375
+ ```
376
+
377
+ A cache lives outside every repository and is shared by all of them, so no single
378
+ lockfile can prove it recoverable — and it is what makes `devp restore` fast. `devp
379
+ caches` reports and prints the clear command; running it is your decision.
380
+
381
+ pnpm gets a row per filesystem rather than a single row. It hardlinks its store into
382
+ every `node_modules` it fills, and a hardlink cannot cross a filesystem, so projects
383
+ kept off the system disk have a store of their own at the root of *that* filesystem —
384
+ `V:\.pnpm-store` on a second Windows drive, `/mnt/data/.pnpm-store` on Linux,
385
+ `/Volumes/Work/.pnpm-store` on macOS. `pnpm store path` only ever answers for the
386
+ filesystem it is run on, so dev-prune looks at the root of every filesystem that holds
387
+ a registered repository, and each such row names its store in the command it prints.
388
+
389
+ </details>
390
+
391
+ <details>
392
+ <summary><b><code>devp doctor .</code></b> — the one reason a repository is being skipped</summary>
393
+
394
+ ```console
395
+ $ devp doctor .
396
+
397
+ dev-prune doctor (~/Code/dashboard)
398
+
399
+ Repository
400
+ Git repository ✓ yes
401
+ Registered ✓ yes, since 2026-04-11
402
+ .devprune.json parses; idle_days 20
403
+ Opt-out none
404
+ Activity 2026-08-12 (0 days ago), threshold 20 — active
405
+ Size floor none — every recognised directory counts
406
+ Scan depth 6 levels below the root
407
+
408
+ Projects
409
+
410
+ . (npm)
411
+ Lockfile ✓ package-lock.json present
412
+ Bloat ✓ node_modules (314.0 MiB)
413
+
414
+ Verdict
415
+ ✗ Would `devp run` prune this? No — active within the last 20 days.
416
+ `devp --ignore-idle run ~/Code/dashboard` overrides exactly that check and nothing else.
417
+ ```
418
+
419
+ It runs no package manager and repairs nothing, so it is safe to run twice — once to see
420
+ the problem, once to confirm the fix. Without a path it audits the installation instead:
421
+ binary location and `PATH`, the registry and every setting in it, the integrations, which
422
+ package managers are reachable, and the release-check state.
423
+
424
+
425
+
426
+ </details>
427
+
428
+ ---
429
+
430
+ ## Why it is safe
431
+
432
+ Seven invariants, enforced in code rather than by convention, none of which has a bypass
433
+ flag. Full detail and the reasoning behind each in
434
+ [docs/SAFETY_INVARIANTS.md](docs/SAFETY_INVARIANTS.md).
435
+
436
+ | # | Invariant | What it prevents |
437
+ | :---: | :-------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------ |
438
+ | 1 | **`.git` boundary** — only ever operates inside a directory holding a `.git` root | Deleting a `node_modules` that belongs to no repository and has no lockfile behind it |
439
+ | 2 | **Lockfile pre-verification** — the ecosystem's own read-only check must pass first | Deleting a tree whose lockfile has drifted, leaving a reinstall that fails |
440
+ | 3 | **Hybrid activity solver** — the later of the last commit and the newest source `mtime` | Pruning a project with a week of uncommitted work in it |
441
+ | 4 | **Atomic state writes** — write to a temp file, then rename | A registry corrupted by a crash or a power cut mid-write |
442
+ | 5 | **0ms ignore fast path** — `ignore.devprune.json` short-circuits before any parsing | A repository you opted out of being scanned at all |
443
+ | 6 | **Symlink and junction refusal** | Following a link out of the repository and deleting storage it does not own |
444
+ | 7 | **Nested repository boundary** | A submodule being deleted as part of its parent instead of on its own terms |
445
+
446
+ Verification is **read-only by default**: `npm ci --dry-run`, `uv lock --locked`, `cargo
447
+ metadata --locked`, `go mod download`. Each resolves the dependency graph against the
448
+ lockfile on disk and *fails* when the two disagree, instead of quietly rewriting the
449
+ lockfile and continuing. The writing form runs in exactly two cases — when no lockfile
450
+ exists at all, and when you have asked with `devp config set allow_manifest_rewrite true`
451
+ — because a pass can be started by the OS scheduler while you are away, and a background
452
+ process that leaves a dirty working tree is a surprise.
453
+
454
+ ---
455
+
456
+ ## Features
457
+
458
+ | What you get | What it means in practice |
459
+ | :-------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
460
+ | 🔒 **Lockfile-gated deletion** | Nothing goes without a passing read-only verification against `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lock`, `uv.lock`, `requirements.txt`, `Cargo.lock` or `go.sum` |
461
+ | 🧩 **Any number of ecosystems per repository** | uv, npm and cargo in one root, or spread across `frontend/`, `services/api/` and `tools/cli/` — each discovered, verified and pruned on its own terms |
462
+ | ↩️ **One-command restore** | `devp restore .` reinstalls a tree; `devp restore --last-run` puts back exactly what the most recent pass deleted, across every repository it touched |
463
+ | 🕒 **Activity-aware** | Combines `git log` timestamps with source-file `mtime`, so uncommitted work protects a repository just as a commit does |
464
+ | 📊 **Cache report** | `devp caches` sizes every package manager cache and store on the machine — npm to cargo to conda, Maven, Gradle, NuGet, vcpkg, Conan, Composer, CocoaPods and Hex — and prints the command that clears each. The report is read-only; `devp caches clear <manager>` runs that command for you, after asking. `devp config set cache_max_gb uv=10,npm=10` says how big is too big, per manager, and marks the ones past it — `devp caches clear --over-cap all` then empties exactly those, still only when you type it. Each manager also says how many of your registered repositories use it and what that works out to per repository, and `devp caches clear --unused all` empties the ones nothing uses at all. pnpm is reported once per filesystem, because a store it hardlinks into `node_modules` cannot cross one and projects kept off the system disk get a store of their own. Nothing on a schedule ever touches a cache, and Maven's `~/.m2/repository` is never cleared at all — it holds artifacts `mvn install:install-file` put there that no remote can hand back |
465
+ | 🩺 **`devp doctor`** | One read-only pass that ends by naming the *single* reason a repository would or would not be pruned. Runs no package manager, repairs nothing, safe to run twice. `devp doctor --fix` then mends what it found — installed-but-broken only |
466
+ | 🤖 **Self-installing automation** | OS-native scheduler (Task Scheduler, LaunchAgent, systemd user timer) and non-blocking Git hooks, installed at install time and restored after an upgrade. `auto_setup`, `auto_hooks`, `auto_daemon` or `DEV_PRUNE_NO_AUTO_SETUP=1` turn it off |
467
+ | ⚡ **0ms opt-out** | An `ignore.devprune.json` in a repository root is honoured by file presence alone — no read, no parse |
468
+ | 🔌 **`--json` on every reporting command** | `run`, `status`, `stats`, `trust` and `caches` each emit one versioned document on stdout, diagnostics on stderr. Built for scripts and agents |
469
+ | 🧠 **AI agent skill** | A token-lean `SKILL.md` embedded in the binary; `devp skill` exports it and prints onboarding prompts for Claude Code, Gemini Antigravity, Cursor, Windsurf, Copilot and OpenClaw |
470
+ | 🧰 **Editor extension** | Validates `.devprune.json` as you type and shows the workspace's reclaimable size in the status bar. `devp setup` offers to install it — once, only at a terminal — into VS Code, VSCodium, Cursor, Windsurf, Positron or Kiro, each from its own registry with the release `.vsix` as fallback. [docs/IDE_INTEGRATION.md](docs/IDE_INTEGRATION.md) |
471
+ | 🖼️ **File manager icons** | `devp icon` registers `*.devprune.json` with the OS file manager — a real `shared-mime-info` type plus hicolor icons on Linux, a folder icon on Windows. It never edits your editor settings, `PATH` or shell startup files |
472
+ | 🌏 **Unicode-safe paths** | A repository at `ワークスペース/项目目录名称测试/프론트엔드` scans, verifies, prunes and restores exactly like an ASCII one, on all three platforms. Terminal tables are padded by display *column*, not by character, so full-width CJK names keep `devp status` and `devp doctor` aligned. Accented Latin, Cyrillic, Arabic and emoji directory names too |
473
+ | 🚫 **No telemetry** | One optional unauthenticated `GET` to GitHub's public releases endpoint, at most weekly, no body and no identifier. Nothing else leaves the machine |
474
+
475
+ ---
476
+
477
+ ## Commands
478
+
479
+ | Command | Also | What it does |
480
+ | :--------------------- | :------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
481
+ | `devp init [PATHS]` | `scan`, `onboard` | Crawls directory trees for Git repositories and registers them, then runs the `setup` integration pass |
482
+ | `devp link [PATH]` | :------------------------------------------------------------------ | Registers one repository |
483
+ | `devp unlink [PATH]` | `--missing` | Unregisters one; `--missing` drops every entry whose directory is gone, in one pass |
484
+ | `devp undo` | :------------------------------------------------------------------ | Reverts the most recent `init` or `link` |
485
+ | `devp run [PATH]` | `--dry-run`, `--only`, `--skip`, `--except`, `--min-size`, `--json` | Prunes every registered repository, or one target |
486
+ | `devp status` | `--top N`, `--drift`, `--json` | Interactive dashboard; a plain table when there is no TTY. `--top N` shows only the N biggest repositories; `--drift` lists every environment holding packages its lockfile never recorded |
487
+ | `devp stats` | `--json` | What has already been reclaimed: lifetime total, prune passes, the last pass, and the biggest contributors |
488
+ | `devp completions` | `bash`, `zsh`, `fish`, `powershell`, `elvish` | Prints a shell completion script to stdout, generated from the same argument definitions the binary parses with |
489
+ | `devp caches` | `clear <manager\|all>`, `--json` | Sizes every package manager cache on the machine and prints the command that clears each. The report deletes nothing and nothing on a schedule ever will; `clear` empties one when you type it, after asking |
490
+ | `devp trust` | `--json` | What dev-prune may do on this machine: the guarantees the code enforces, then the scheduler, hooks and settings read live. Read-only |
491
+ | `devp restore [PATH]` | `--last-run` | Reinstalls dependencies for every project in a tree; `--last-run` undoes the last prune pass |
492
+ | `devp doctor [PATH]` | `--fix` | Diagnoses the installation, or one repository — ending with the single reason a pass would or would not touch it. `--fix` repairs what the checks found; it never performs a first-time install |
493
+ | `devp config [ACTION]` | `get`, `set`, `show`, `wizard`, `project`, `daemon`, `hook`, `icon` | Global settings, per-repository `.devprune.json`, scheduler, Git hooks, file manager icons |
494
+ | `devp setup` | `--status` | Installs any missing integration; `--status` only reports |
495
+ | `devp update` | `--offline`, `--install` | Prints the installed version, checks GitHub for a newer release, shows the upgrade command for your install channel; `--install` runs that upgrade through the channel that owns this copy |
496
+ | `devp skill` | `--agent <editor>` | Exports `SKILL.md` and prints AI agent onboarding prompts; `--agent` writes per-repository rules for 16 editors — Cursor, Windsurf, Antigravity, Cline, Roo, Kilo Code, Continue, Amazon Q, Kiro, Trae, Junie, Gemini CLI, Zed, Copilot, Aider or `AGENTS.md` |
497
+ | `devp man` | `--dir <dir>` | The manual as man pages, generated from the same argument definitions `--help` prints; alone it emits `devp(1)` to stdout, `--dir` writes the full set |
498
+ | `devp uninstall` | `--deep` | Removes the scheduler, hooks, both binaries and every other installed copy it can find on the machine; `--deep` also clears configuration |
499
+ | `devp -V` | :------------------------------------------------------------------ | Version plus an environment audit: OS, architecture, config path, PATH activation |
500
+
501
+ `devp hook`, `devp daemon` and `devp icon` are shorthands for the `config` subcommands of
502
+ the same name, and `install` / `uninstall` / `on` / `off` work wherever `enable` /
503
+ `disable` do — so `devp hook install` and `devp config hook enable` are the same command.
504
+ A misspelled action is rejected rather than quietly reported as status.
505
+
506
+ `--help` is the manual: every command and every `config` subcommand carries long-form
507
+ help with worked examples — `devp run --help`, `devp config hook --help`, and so on at
508
+ every level — while `-h` keeps the short version.
509
+
510
+ Exit codes are a contract: `0` success, `1` failure, `2` unusable arguments. Full flag
511
+ list, every setting and the `--json` schema: **[docs/CLI_REFERENCE.md](docs/CLI_REFERENCE.md)**.
512
+
513
+ ---
514
+
515
+ ## Supported ecosystems
516
+
517
+ Adapters detect the project, verify the lockfile, and own the bloat directories:
518
+
519
+ | Ecosystem | Detected by | Bloat | Verification (read-only) | Restore |
520
+ | :---------------------------- | :------------------------------------------------------------ | :----------------------------------------- | :---------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------- |
521
+ | **npm** | `package-lock.json` | `node_modules` | `npm ci --dry-run --ignore-scripts` | `npm ci` |
522
+ | **pnpm** | `pnpm-lock.yaml` | `node_modules` | `pnpm install --lockfile-only --frozen-lockfile` | `pnpm install --frozen-lockfile` |
523
+ | **Yarn** | `yarn.lock` | `node_modules` | `yarn install --immutable --mode update-lockfile` (Berry); on Classic an existing `yarn.lock` is itself the proof | `yarn install --immutable` |
524
+ | **Bun** | `bun.lockb`, `bun.lock` | `node_modules` | `bun install --frozen-lockfile --dry-run --ignore-scripts` | `bun install --frozen-lockfile` |
525
+ | **uv** (Python) | `uv.lock`, `[tool.uv]` in `pyproject.toml` | `.venv` | `uv lock --locked` | `uv sync` |
526
+ | **Poetry** (Python) | `poetry.lock`, `[tool.poetry]` in `pyproject.toml` | `.venv` | `poetry check --lock`, plus no installed package the lockfile never recorded | `poetry install` |
527
+ | **PDM** (Python) | `pdm.lock`, `[tool.pdm]` or `pdm.backend` in `pyproject.toml` | `.venv`, `__pypackages__` | `pdm lock --check` | `pdm install` |
528
+ | **Pipenv** (Python) | `Pipfile` | `.venv` *(in-project installs only)* | `pipenv verify` | `pipenv install --deploy` |
529
+ | **venv** (Python) | `requirements.txt` + a directory containing `pyvenv.cfg` | every directory containing `pyvenv.cfg` | `requirements.txt` must exist and list at least one package | `python -m venv .venv && pip install -r requirements.txt` |
530
+ | **Cargo** (Rust) *(opt-in)* | `Cargo.toml` | `target` | `cargo metadata --locked` | *(rebuilt by the next `cargo build`)* |
531
+ | **Go** | `go.mod` | `vendor` | `go mod download` | `go mod vendor` |
532
+ | **Composer** (PHP) | `composer.json` | `vendor` | `composer validate --no-check-publish --no-check-all` | `composer install` |
533
+ | **Bundler** (Ruby) | `Gemfile` | `vendor/bundle` *(vendored installs only)* | `bundle lock --check` | `bundle install` |
534
+ | **CocoaPods** (Apple) | `Podfile` | `Pods` | `Podfile.lock` carries its `SPEC CHECKSUMS` section and is no older than the `Podfile` | `pod install` |
535
+ | **Mix** (Elixir) | `mix.exs` | `deps` | `mix.lock` is a complete Elixir map and no older than `mix.exs` | `mix deps.get` |
536
+ | **Terraform** | any `*.tf` / `*.tf.json` | `.terraform/providers` | `.terraform.lock.hcl` records at least one provider | `terraform init -backend=false` |
537
+ | **Gradle** *(opt-in)* | `build.gradle[.kts]`, `settings.gradle[.kts]` | `build`, `.gradle` | manifest present and readable — the rebuild-from-source proof | *(rebuilt by the next `./gradlew build`)* |
538
+ | **Maven** *(opt-in)* | `pom.xml` | `target` | `pom.xml` parses as a Maven manifest | *(rebuilt by the next `mvn package`)* |
539
+ | **SwiftPM** *(opt-in)* | `Package.swift` | `.build` | `Package.swift` declares a `Package(` — the rebuild-from-source proof | *(rebuilt by the next `swift build`)* |
540
+ | **Dart / Flutter** *(opt-in)* | `pubspec.yaml` | `.dart_tool` | `pubspec.lock` has a `packages:` section and is no older than `pubspec.yaml` | `dart pub get` / `flutter pub get` |
541
+ | **Mix `_build/`** *(opt-in)* | `mix.exs` | `_build` | `mix.exs` and `mix.lock` both present — the rebuild-from-source proof | *(rebuilt by the next `mix compile`)* |
542
+ | **vcpkg** (C/C++) *(opt-in)* | `vcpkg.json` | `vcpkg_installed` | `vcpkg.json` declares a non-empty `dependencies` list | *(rebuilt by the next `vcpkg install`)* |
543
+ | **CMake** (C/C++) *(opt-in)* | `CMakeLists.txt` | any tree holding a `CMakeCache.txt` | the tree's own `CMakeCache.txt` names a source directory inside this repository | *(rebuilt by the next `cmake --build`)* |
544
+
545
+ A required binary that is missing is a reason to skip, never a reason to delete: if `npm`
546
+ is not on `PATH`, the `node_modules` it owns is left exactly where it is.
547
+
548
+ The eight build-tool adapters ship **disabled**, because a build tree is regenerated
549
+ by recompiling, not downloading — it costs more to get back. `devp config set
550
+ enable_cargo true` / `enable_gradle true` / `enable_maven true` / `enable_swift true` /
551
+ `enable_dart true` / `enable_mix_build true` / `enable_vcpkg true` /
552
+ `enable_cmake_build true` switches them on, and their candidates wait for
553
+ `build_idle_days` (45 by default), applied as the *maximum* of it and `idle_days` — the
554
+ build-tool gate only ever makes pruning later, never earlier.
555
+
556
+ Any one adapter can be made to wait longer than the rest: `devp config set
557
+ adapter_idle_days cargo=90,npm=30` sets a per-adapter floor, applied as
558
+ `max(idle_days, build_idle_days, adapter_idle_days[name])`. `devp config wizard` edits
559
+ it beside the adapter checklist, grouped by language, where one heading sets the same
560
+ window for every adapter under it.
561
+
562
+ A download cache is a bet that re-downloading costs less than the disk it occupies,
563
+ and somewhere the bet stops paying. `devp config set cache_max_gb uv=10,npm=10` is
564
+ where you say where: a ceiling in gibibytes, per manager, measured against that
565
+ manager's whole footprint. A manager over its cap is **marked** in `devp caches` —
566
+ setting one deletes nothing — and `devp caches clear --over-cap all` empties exactly
567
+ what is marked, when you type it. It is keyed by the names `devp caches clear` takes
568
+ (`npm`, `pnpm`, `uv`, `pip`, `cargo`, `go`, `nuget`, …) rather than by adapter name,
569
+ because the two lists overlap without either containing the other. Empty by default:
570
+ no cache is too big until you say what too big is. The wizard sets caps as a third
571
+ column on the same checklist.
572
+
573
+ The report answers one more question the disk cannot: *who still needs this*. Beside each
574
+ manager it says how many of your registered repositories use it, and what its cache works
575
+ out to per repository — two repositories sharing a 12 GiB cache is 6 GiB each and worth a
576
+ look, forty sharing the same 12 GiB is 300 MiB each and is the cache doing its job. A
577
+ manager **no** registered repository uses is the one case where a count is enough to act
578
+ on: everything in it was downloaded for projects that are not on this disk any more, so
579
+ `devp caches clear --unused all` costs no re-download for anything you still have. The
580
+ count ignores whether an adapter is switched on, because the question is which managers
581
+ your projects *use*, not which ones a prune pass would touch, and it is shown only for the
582
+ managers that are also adapter names — `pip`, `conda`, `nuget`, `conan` and `hex` get
583
+ no number rather than a guess. With nothing registered, nothing is counted and
584
+ `--unused` refuses to run.
585
+
586
+ Bundler and Pipenv claim only the install that lives *inside* the repository: the
587
+ `vendor/bundle` a project gets from `bundle config set path vendor/bundle`, and the
588
+ `.venv` that appears when `PIPENV_VENV_IN_PROJECT` is set. Both tools default to a
589
+ shared store under your home directory instead, and dev-prune does not go near those at
590
+ all: a shared gem home or virtualenv directory is where other projects' dependencies are
591
+ *installed*, not a cache, and no single lockfile could prove its contents recoverable.
592
+ For the same reason Composer leaves `vendor/` alone entirely when a `vendor/bundle` is
593
+ sitting inside it: no `composer install` puts those gems back.
594
+
595
+ Any adapter can be switched off outright with `devp config set disabled_adapters
596
+ <names>` — a disabled adapter is not detected, not counted by `stats`, not probed
597
+ for by `doctor` and never pruned, exactly as if that ecosystem were not installed.
598
+
599
+ > [!TIP]
600
+ > Adding an ecosystem is documented end to end in
601
+ > [docs/ADDING_ADAPTERS.md](docs/ADDING_ADAPTERS.md) — trait, registration, tests.
602
+
603
+ ### Repositories with more than one ecosystem
604
+
605
+ A repository is not assumed to be one project. dev-prune walks the root and up to
606
+ `scan_depth` levels below it — six by default, `devp config set scan_depth N` to change
607
+ it, or `"scan_depth"` in a repository's `.devprune.json` for just that tree. Every
608
+ directory a package manager recognises is verified and pruned on its own terms. All three
609
+ of these work:
610
+
611
+ ```
612
+ monorepo/ monorepo/ monorepo/
613
+ ├── package-lock.json ├── frontend/ ├── Cargo.toml
614
+ ├── uv.lock │ └── pnpm-lock.yaml ├── web/
615
+ └── Cargo.toml ├── services/api/ │ └── package-lock.json
616
+ │ └── uv.lock └── scripts/
617
+ three managers, one root └── tools/cli/ └── requirements.txt
618
+ └── Cargo.toml
619
+ root + nested, mixed
620
+ one manager per subtree
621
+ ```
622
+
623
+ Results are reported by repository-relative path, so a monorepo reads unambiguously:
624
+
625
+ ```
626
+ • MyMonorepo → frontend/node_modules (412.7 MiB) [pnpm]
627
+ • MyMonorepo → services/api/.venv (188.2 MiB) [uv]
628
+ • MyMonorepo → tools/cli/target (1.4 GiB) [cargo]
629
+ ```
630
+
631
+ The walk never descends into `node_modules`, `target`, `vendor`, virtual environments,
632
+ hidden directories, or nested repositories — a submodule is pruned as itself, never as
633
+ part of its parent.
634
+
635
+ When npm, pnpm, yarn and bun all claim the same `node_modules`, exactly one is chosen,
636
+ strongest signal first:
637
+
638
+ 1. the `packageManager` field in `package.json`,
639
+ 2. the bookkeeping files inside the installed tree (`node_modules/.pnpm`,
640
+ `.yarn-state.yml`, `.package-lock.json`) — whoever built what is actually on disk,
641
+ 3. the most recently written lockfile.
642
+
643
+ For Python, uv or Poetry takes the environment whenever it recognises the project —
644
+ between the two, whichever one's lockfile is actually on disk wins — and the
645
+ `requirements.txt` adapter handles everything else.
646
+
647
+ ---
648
+
649
+ ## Configuration
650
+
651
+ Global settings live in `%APPDATA%\dev-prune` (Windows),
652
+ `~/Library/Application Support/dev-prune` (macOS) and `$XDG_CONFIG_HOME/dev-prune`
653
+ (Linux). `devp config wizard` opens all of them in a full-screen configurator, and runs itself
654
+ once on a first install — so the defaults are something you agreed to rather than
655
+ inherited — and again after an upgrade adds a setting you have never been shown.
656
+
657
+ | Key | Default | Meaning |
658
+ | :--------------------------------------------------------------------------------- | :-------: | :---------------------------------------------------------------------------------- |
659
+ | `idle_days` | `15` | How long a repository must be untouched to become a candidate |
660
+ | `min_size_mb` | `0` | Smallest bloat directory worth deleting; `0` disables the floor |
661
+ | `scan_depth` | `6` | Levels below a repository root that discovery descends |
662
+ | `require_confirmation` | `true` | Whether a pass asks before deleting |
663
+ | `allow_manifest_rewrite` | `false` | Whether verification may *repair* a drifted lockfile instead of refusing |
664
+ | `command_timeout_secs` | `600` | Ceiling on any one package manager command |
665
+ | `auto_setup` · `auto_daemon` · `auto_hooks` | `true` | Whether the integration pass may run unattended, and what it may install |
666
+ | `auto_hooks_chain` | `false` | Whether it may take a `core.hooksPath` another tool holds, forwarding every hook on |
667
+ | `check_interval_days` | `2` | How often the OS scheduler runs a pass |
668
+ | `update_check` | `true` | Whether the periodic release check runs |
669
+ | `update_check_interval_days` · `update_check_timeout_secs` | `7` · `5` | Minimum gap between checks, and how long one may hang |
670
+ | `enable_cargo` … `enable_cmake_build` | `false` | Turn on an opt-in build-tool adapter; `build_idle_days` (`45`) gates all eight |
671
+ | `adapter_idle_days` | *(none)* | Per-adapter idle floors, as `cargo=90,npm=30` — each raises only its own window |
672
+ | `disabled_adapters` | *(none)* | Adapters to leave alone entirely, by name — as if that ecosystem were not installed |
673
+ | `cache_max_gb` | *(none)* | Per-manager cache caps in GiB, as `uv=10,npm=10` — the cap itself deletes nothing |
674
+
675
+ Three of them — `idle_days` (as `override_idle_days`), `min_size_mb` and `scan_depth` —
676
+ also take a per-repository form in that project's `.devprune.json`, where they win for
677
+ that tree only. The rest are deliberately global: a project can commit its
678
+ `.devprune.json`, and a repository you have never read should not be able to grant itself
679
+ permission to have its manifests rewritten during an unattended pass.
680
+
681
+ An out-of-range value is rejected with the range in the message rather than silently
682
+ clamped. `scan_depth` included: `config set` accepts `1`–`32` and refuses anything else
683
+ outright — the clamp to that range survives only as the backstop for a hand-edited
684
+ config file.
685
+
686
+ ---
687
+
688
+ ## Background automation
689
+
690
+ Installation registers an OS-native scheduler — Windows Task Scheduler, a macOS
691
+ LaunchAgent, or a systemd user timer — that runs a pass every `check_interval_days`, plus
692
+ non-blocking `post-commit`, `post-checkout` and `post-merge` Git hooks that register new
693
+ repositories as you visit them. Both are reinstated after an upgrade if anything went
694
+ missing.
695
+
696
+ ```bash
697
+ devp setup --status # what is installed, what is not, and why
698
+ devp config set auto_setup false # stop the unattended pass entirely
699
+ devp uninstall # remove the scheduler, hooks and the devp link
700
+ ```
701
+
702
+ Git allows exactly one global `core.hooksPath`, so a tool holding it shuts every other one
703
+ out machine-wide. `devp hook install --chain` takes the slot and forwards each hook on to
704
+ the tool it displaced — husky, pre-commit and lefthook keep firing, in order, with their
705
+ own exit codes. It is opt-in, because rewiring another tool's Git configuration unasked is
706
+ not something an install should do.
707
+
708
+ Full decision flow: [docs/BACKGROUND_AUTOMATION.md](docs/BACKGROUND_AUTOMATION.md).
709
+
710
+ ---
711
+
712
+ ## How it compares
713
+
714
+ | | `dev-prune` | `npkill` | `cargo-clean-all` | `pyclean` | `git clean` | `dust` / `ncdu` | BleachBit |
715
+ | :---------------------------------------- | :-------------------------: | :------: | :---------------: | :-------: | :-------------: | :-------------: | :-------: |
716
+ | Ecosystems | **JS/TS, Python, Rust, Go** | Node | Rust | Python | untracked files | — | OS caches |
717
+ | Many projects per repository | **✓** | ✗ | ✗ | ✗ | n/a | n/a | ✗ |
718
+ | `.git` boundary enforced | **✓** | ✗ | ✓ | ✗ | ✓ | ✗ | ✗ |
719
+ | Lockfile verified before deleting | **✓** | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
720
+ | Commit log **and** `mtime` activity check | **✓** | ✗ | `mtime` only | ✗ | ✗ | ✗ | ✗ |
721
+ | One-command restore | **✓** | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
722
+ | Undo the last pass | **✓** | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
723
+ | Background scheduler | **✓** | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
724
+ | Git hook auto-registration | **✓** | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
725
+ | Per-repository config + 0ms opt-out | **✓** | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
726
+ | Machine-readable `--json` | **✓** | ✗ | ✗ | ✗ | ✗ | partial | ✗ |
727
+ | AI agent skill | **✓** | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
728
+ | Runtime required | **none** (static binary) | Node.js | none | Python | none | none | Python |
729
+
730
+ Longer analysis: [docs/MARKET_ANALYSIS.md](docs/MARKET_ANALYSIS.md).
731
+
732
+ ---
733
+
734
+ ## Architecture
735
+
736
+ ```mermaid
737
+ flowchart TD
738
+ UserCLI["CLI / TUI Interface<br/>(devp / dev-prune)"] --> Registry["Global Registry<br/>(~/.config/dev-prune/registry.json)"]
739
+ UserCLI --> Engine["Prune Engine"]
740
+
741
+ Engine --> FastIgnore{ignore.devprune.json?}
742
+ FastIgnore -->|Exists| Skip["Skip Repo O(1) 0ms"]
743
+ FastIgnore -->|Missing| PerRepoConfig["Read .devprune.json"]
744
+
745
+ PerRepoConfig --> GitScanner["Git Scanner & Activity Solver<br/>(.git commits + mtime fallback)"]
746
+ Engine --> PreCheck["Required Ecosystem Binary Pre-Checker"]
747
+ Engine --> Adapters["Multi-Ecosystem Adapters"]
748
+
749
+ Adapters --> NPM["npm (package-lock.json -> node_modules)"]
750
+ Adapters --> PNPM["pnpm (pnpm-lock.yaml -> node_modules)"]
751
+ Adapters --> Yarn["yarn (yarn.lock -> node_modules)"]
752
+ Adapters --> Bun["bun (bun.lock -> node_modules)"]
753
+ Adapters --> UV["uv (uv.lock -> .venv)"]
754
+ Adapters --> Venv["venv (requirements.txt -> venv)"]
755
+ Adapters --> Cargo["cargo (Cargo.lock -> target)"]
756
+ Adapters --> Go["go (go.sum -> vendor)"]
757
+
758
+ Adapters --> LockfileCheck{"Lockfile Verification<br/>& Two-Tier Sync"}
759
+ LockfileCheck -->|Success / Present| Prune["Safe Deletion of Bloat Dirs"]
760
+ LockfileCheck -->|Failed & Missing| Abort["Abort Deletion & Log Fix Snippet"]
761
+
762
+ Daemon["OS Background Daemon Scheduler<br/>(Task Scheduler / LaunchAgent / systemd)"] -->|Every 2 Days| Engine
763
+ GitHooks["Git Auto-Registration Hooks<br/>(post-commit / post-checkout / post-merge)"] -->|On Git Activity| Registry
764
+ ```
765
+
766
+ - **Registry** — Serde-backed, written atomically, holding registered paths and settings.
767
+ - **Engine** — coordinates activity discovery, verification and space calculation.
768
+ - **FastIgnore** — presence check for `ignore.devprune.json`; no read, no parse.
769
+ - **GitScanner** — `git log` timestamps plus source-file `mtime`.
770
+ - **PreCheck** — confirms the package manager binaries a pass will actually need.
771
+ - **Adapters** — one per ecosystem, each owning detection, verification and restore.
772
+ - **LockfileCheck** — the gate; failure aborts the deletion and prints the exact fix command.
773
+ - **Daemon / GitHooks** — the unattended pass, and registration as you work.
774
+
775
+ Deeper: [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) ·
776
+ [HLD](docs/architecture/HLD.md) · [LLD](docs/architecture/LLD.md).
777
+
778
+ ---
779
+
780
+ ## Documentation
781
+
782
+ | | |
783
+ | :------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------- |
784
+ | [Documentation hub](docs/README.md) | Index of everything below |
785
+ | [CLI reference](docs/CLI_REFERENCE.md) | Every command, flag, setting, exit code and `--json` document |
786
+ | [Safety invariants](docs/SAFETY_INVARIANTS.md) | The seven guarantees, and why each exists |
787
+ | [Architecture](docs/ARCHITECTURE.md) · [HLD](docs/architecture/HLD.md) · [LLD](docs/architecture/LLD.md) | How it is built |
788
+ | [Background automation](docs/BACKGROUND_AUTOMATION.md) | Schedulers, hooks, chaining, and turning it all off |
789
+ | [IDE & editor integration](docs/IDE_INTEGRATION.md) | The extension, schema IntelliSense, and every editor it works in |
790
+ | [Adding an adapter](docs/ADDING_ADAPTERS.md) | End-to-end tutorial for a new ecosystem |
791
+ | [Releases & manual install](docs/RELEASES_AND_MANUAL_INSTALL.md) · [Distribution](docs/DISTRIBUTION.md) | Every install channel, and building from source |
792
+ | [Troubleshooting](docs/troubleshooting/README.md) | Symptom-first, with the fix for each |
793
+ | [Privacy](docs/PRIVACY.md) | The one network request, in full |
794
+ | [Market analysis](docs/MARKET_ANALYSIS.md) | Where this sits among the alternatives |
795
+ | [Contributing](CONTRIBUTING.md) · [Security policy](SECURITY.md) · [Changelog](CHANGELOG.md) | |
796
+
797
+ ---
798
+
799
+ ## License & privacy
800
+
801
+ Copyright 2026 [VKrishna04](https://vkrishna04.me). Licensed under the Apache License,
802
+ Version 2.0 — see [LICENSE.md](LICENSE.md). Every source file carries an
803
+ [SPDX](https://spdx.dev/) identifier, so automated licence scanners see the same
804
+ answer the file header does.
805
+
806
+ > [!IMPORTANT]
807
+ > **No analytics, no diagnostics, no usage data** — none collected, none sent. Your
808
+ > workspace structure, directory paths and repository names never leave the machine.
809
+ >
810
+ > `dev-prune` makes exactly one network request: an unauthenticated `GET` to GitHub's
811
+ > public releases endpoint, to tell you when a newer version exists. It has no body,
812
+ > carries no identifier, and runs at most once a week. Turn it off with `devp config set
813
+ > update_check false`. Full detail in [docs/PRIVACY.md](docs/PRIVACY.md).
Binary file
package/bin/devp.exe ADDED
Binary file
package/package.json ADDED
@@ -0,0 +1,18 @@
1
+ {
2
+ "name": "dev-prune-windows-x86",
3
+ "version": "1.7.0",
4
+ "description": "Prebuilt dev-prune binary for windows x86. Installed automatically by the 'dev-prune' package; not meant to be depended on directly.",
5
+ "os": ["win32"],
6
+ "cpu": ["ia32"],
7
+ "files": ["bin", "LICENSE.md", "README.md"],
8
+ "license": "Apache-2.0",
9
+ "author": "VKrishna04",
10
+ "homepage": "https://devprune.vkrishna04.me",
11
+ "repository": {
12
+ "type": "git",
13
+ "url": "git+https://github.com/Life-Experimentalist/dev-prune.git"
14
+ },
15
+ "bugs": {
16
+ "url": "https://github.com/Life-Experimentalist/dev-prune/issues"
17
+ }
18
+ }