disk-space-saviour 0.11.30 → 0.12.0

package/CHANGELOG.md

@@ -1,5 +1,86 @@
 # Changelog
 
+## 0.12.0
+
+### Minor Changes
+
+- Add `disk-space-saviour` (`dss`): a CLI and library that safely reclaims disk
+  space. `dss scan` reports caches and build outputs of 20+ ecosystems, version
+  managers, browser/IDE/AI caches, agent snapshots, system logs and forgotten
+  projects, and recurses into Docker: host daemons, running containers (scanned
+  through `docker exec`, never stopped), stopped containers (inspected with
+  `docker cp`, git-verified, never removed without confirmation) and nested
+  Docker-in-Docker daemons. `dss clean --tier safe|moderate|aggressive` deletes
+  with liveness and git re-checks before every item, and `dss emergency --free
+20G | --until 80%` escalates tiers until the goal is met. Every run writes a
+  JSON audit log.
+
+  Liveness detection matches tools by executable name as well as process name,
+  so a Node.js tool whose main thread is renamed (for example `MainThread`) is
+  still seen as running. A Docker-in-Docker CI job (`npm run test:dind`) checks
+  recursion two daemons deep, cleaning inside running containers, and the
+  approval, Git and log-backup rules for stopped containers.
+
+  Open files are matched through symlinks (a scan of `/var/...` sees files that
+  `lsof` reports under `/private/var/...` on macOS), and process working
+  directories are read with `lsof` on macOS, so a tool running elsewhere does not
+  block a project it is not using.
+
+  The Security workflow checks that the repository's dependency graph is enabled
+  before the dependency review. When it is disabled, the review is skipped with a
+  warning that links to the setting, and `npm audit` still fails on high-severity
+  advisories in every lock. Before, every pull request failed on this setting.
+
+  Fix every open CI correctness and resilience issue in the pipeline: scope the
+  Docker buildx cache, retry transient fetch and download failures, make the
+  budget wrapper escalate to SIGKILL, add a terminal status gate to every
+  workflow with supersede detection, verify the husky install, make the jscpd
+  gate analyse real files, guard the package manager declaration, turn on
+  command-stream errexit, gate staged formatting before release commits, add
+  release-preflight credential checks, and sweep zizmor/actionlint/persisted
+  credentials/link-recheck fixes across the workflows.
+
+  Find more regenerable data on developer Macs. New rules cover app updates
+  staged by Sparkle and Squirrel (ShipIt), Chrome, Yandex Browser and Firefox
+  HTTP caches, the Discord cache, Cursor, Windsurf and Qoder caches, the
+  TypeScript type acquisition cache, the rust-script cache, old playwright-go
+  drivers, Claude Code MCP logs and abandoned Codex runtime installs. Each
+  browser and updater has its own busy check, so a running Chrome does not hold
+  back the Firefox cache. Browser, editor and Claude Code paths are also listed
+  for Linux (`~/.cache`, `~/.config`) and Windows (`%LOCALAPPDATA%`, `%APPDATA%`).
+
+  Extension folders of VS Code forks (`.windsurf`, `.codeium`, `.qoder`, `.kiro`,
+  `.trae`) are no longer searched for projects: their bundled `node_modules`
+  were reported as removable, and deleting them breaks the extension.
+
+  Restore the `cargo-superseded` rule and prune Rust leaf artifacts while cargo runs, keeping library artifacts. `dss clean` watches PID 1, agents and build tools in every environment and stops cleaning it when one of them disappears. Stopped containers show their owning session, task URL, exit code, OOM flag and end time; containers kept for investigation are removed only with `--remove-container ID`. Unused tagged images show size, creation date and last user, and are removed only with `--remove-image REF` or an interactive yes per image; `--remove-unused-images` is rejected.
+
+  List the browser HTTP caches, VS Code fork caches, Discord cache and staged
+  macOS app updates in the README's coverage summary.
+
+  Fix the release job: the formatting check before the release commit no longer
+  passes the changesets that `changeset version` deleted to prettier, which
+  failed on the missing files and stopped every release.
+
+  The `bin` paths in `package.json` drop the leading `./`, so `npm publish` no
+  longer warns that the `dss` commands were "invalid and removed" (npm only
+  normalized them; the commands were always installed).
+
+  Report fixes from #7: `dss docker scan` lists a layer shared by several
+  images and tags once, with every tag on one line; the summary counts items
+  that need `--remove-image` or another explicit consent as `needs explicit
+consent` instead of adding them to the tier totals; and a container is no
+  longer labelled with a session taken from a counter or flag such as `1`.
+
+  Recheck Git, liveness, Docker mounts, browser revisions, and saved scan reports before cleanup. Protect uncommitted work in stopped containers and agent snapshots, and limit emergency cleanup to the target filesystem.
+
+  Make protected-branch release fallbacks wait for real pull-request checks with
+  a dedicated automation token, and pin every Linux CI job to Ubuntu 24.04.
+
+  Harden CI verdicts, Docker manifest publication, timeout cleanup, broken-link
+  rechecks, and contributor-authored workflow logs, and refresh vulnerable
+  transitive development dependencies.
+
 ## 0.11.30
 
 ### Patch Changes

package/README.md

@@ -148,7 +148,9 @@ three kinds of Docker data:
   of containers dss removed), when known. No tier removes them, emergency
   mode included: approve each one with `--remove-image REF` (`repo:tag`,
   `repo` for `:latest`, or an id prefix of at least 12 characters) or an
-  interactive yes for that image.
+  interactive yes for that image. The summary line counts them, and
+  stopped containers that need consent, as `needs explicit consent`, so
+  the tier totals match what `clean --tier … --yes` removes.
 - **Running containers** are never stopped, restarted or removed. They are
   scanned and cleaned from the inside through `docker exec`, with the same
   rules and liveness checks as the host.

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "disk-space-saviour",
-  "version": "0.11.30",
+  "version": "0.12.0",
   "description": "Safely reclaims disk space: caches and build outputs of 20+ ecosystems, forgotten projects, and Docker (running, stopped and nested containers), with an emergency mode",
   "type": "module",
   "main": "src/index.js",
   "types": "src/index.d.ts",
   "bin": {
-    "dss": "./bin/dss.js",
-    "disk-space-saviour": "./bin/dss.js"
+    "dss": "bin/dss.js",
+    "disk-space-saviour": "bin/dss.js"
   },
   "files": [
     "bin/",

package/src/docker/containers.js

@@ -108,12 +108,19 @@ export function ownerOf(ps, inspected) {
   };
 }
 
+/** Counters and flags such as `1` or `true` are not session ids. */
+function sessionLike(value) {
+  const text = String(value).trim();
+  return text !== '' && !/^(\d+|true|false|yes|no)$/i.test(text);
+}
+
 function sessionOf(hints, name) {
-  const entries = Object.entries(hints);
+  const entries = Object.entries(hints).filter(([, value]) =>
+    sessionLike(value)
+  );
   const found =
     entries.find(([key]) => /HIVE_MIND_PARENT_SESSION_ID$/.test(key)) ??
-    entries.find(([key]) => /session/i.test(key)) ??
-    entries[0];
+    entries.find(([key]) => /session/i.test(key));
   if (found) {
     return found;
   }

package/src/docker/scan.js

@@ -201,22 +201,58 @@ function layerAdvice(command, bytes) {
     : null;
 }
 
-async function imageHints(docker, verbose) {
-  const largest = [...(verbose.Images ?? [])]
-    .filter((image) => image.Containers !== '0')
-    .sort((a, b) => parseDockerSize(b.Size) - parseDockerSize(a.Size))
-    .slice(0, LAYER_HINT_IMAGES);
-  const hints = [];
-  for (const image of largest) {
+/** Every tag of each image id, largest images first. */
+function imagesById(rows) {
+  const byId = new Map();
+  for (const image of rows) {
     const name =
       image.Tag === '<none>' ? image.ID : `${image.Repository}:${image.Tag}`;
+    const entry = byId.get(image.ID) ?? { id: image.ID, names: [], image };
+    entry.names.push(name);
+    byId.set(image.ID, entry);
+  }
+  return [...byId.values()];
+}
+
+/** The same layer, whichever image's history it was read from. */
+function layerKey(layer) {
+  return layer.ID && layer.ID !== '<missing>'
+    ? layer.ID
+    : `${layer.CreatedBy ?? ''}\0${layer.Size ?? ''}`;
+}
+
+export async function imageHints(docker, verbose) {
+  const largest = imagesById(
+    [...(verbose.Images ?? [])].filter((image) => image.Containers !== '0')
+  )
+    .sort(
+      (a, b) => parseDockerSize(b.image.Size) - parseDockerSize(a.image.Size)
+    )
+    .slice(0, LAYER_HINT_IMAGES);
+  const byLayer = new Map();
+  for (const { id, names } of largest) {
+    let history;
     try {
-      hints.push(...layerHints(name, await docker.history(image.ID)));
+      history = await docker.history(id);
     } catch (error) {
-      trace('history failed', name, error.message);
+      trace('history failed', names[0], error.message);
+      continue;
+    }
+    for (const layer of history) {
+      const [hint] = layerHints(names[0], [layer]);
+      if (!hint) {
+        continue;
+      }
+      const key = layerKey(layer);
+      const shared = byLayer.get(key);
+      if (shared) {
+        shared.images.push(...names.filter((n) => !shared.images.includes(n)));
+      } else {
+        byLayer.set(key, { ...hint, images: [...names] });
+      }
     }
   }
-  return hints;
+  return [...byLayer.values()];
 }
 
 async function stoppedItem(daemon, ps, inspected, options) {

package/src/index.d.ts

@@ -151,7 +151,8 @@ export interface Report {
   options: Record<string, unknown>;
   environments: EnvironmentDescriptor[];
   items: Item[];
-  totals: Record<Tier | 'blocked', TierTotal>;
+  /** Tier totals exclude items that need explicit consent (`consent`). */
+  totals: Record<Tier | 'blocked' | 'consent', TierTotal>;
   docker: {
     daemons: Array<Record<string, unknown>>;
     containers: Array<Record<string, unknown>>;

package/src/items.js

@@ -84,13 +84,22 @@ export function block(item, reason) {
  */
 export function tierTotals(items) {
   const totals = {};
+  // A tier total is what `clean --tier <tier> --yes` removes: items that
+  // need a per-object flag or an interactive yes are counted apart.
+  const sum = (selected) => ({
+    items: selected.length,
+    bytes: selected.reduce((total, item) => total + item.bytes, 0),
+  });
   for (const tier of TIERS) {
-    const selected = selectByTier(items, tier);
-    totals[tier] = {
-      items: selected.length,
-      bytes: selected.reduce((sum, item) => sum + item.bytes, 0),
-    };
+    totals[tier] = sum(
+      selectByTier(items, tier, (item) => !item.requiresConfirmation)
+    );
   }
+  totals.consent = sum(
+    selectByTier(items, 'aggressive', (item) =>
+      Boolean(item.requiresConfirmation)
+    )
+  );
   totals.blocked = {
     items: items.filter((item) => item.blockers.length > 0).length,
     bytes: items

package/src/report.js

@@ -216,7 +216,7 @@ function dockerSection(report) {
   }
   for (const hint of docker.hints ?? []) {
     lines.push(
-      `  hint ${hint.image}: ${formatBytes(hint.bytes)} layer, ${hint.hint}`
+      `  hint ${(hint.images ?? [hint.image]).join(', ')}: ${formatBytes(hint.bytes)} layer, ${hint.hint}`
     );
   }
   for (const volume of docker.volumes ?? []) {
@@ -231,9 +231,12 @@ function totalsSection(report) {
   const parts = TIERS.map(
     (tier) => `${tier} ${formatBytes(report.totals[tier].bytes)}`
   );
+  const consent = report.totals.consent?.bytes
+    ? `; needs explicit consent ${formatBytes(report.totals.consent.bytes)}`
+    : '';
   return [
     '',
-    `Reclaimable (cumulative): ${parts.join(' · ')}; blocked ${formatBytes(report.totals.blocked.bytes)}`,
+    `Reclaimable (cumulative): ${parts.join(' · ')}${consent}; blocked ${formatBytes(report.totals.blocked.bytes)}`,
   ];
 }