disk-space-saviour 0.20.0 → 0.22.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.22.0
+
+### Minor Changes
+
+- a63f8ca: Add `dss usage`, which shows where the space of a whole volume goes (largest directories and files, what dss can free or has blocked inside each, APFS volumes, snapshots and unread space), list APFS clones that share their blocks with an installed app under `SHARED WITH INSTALLED APPS`, search Git worktree folders at full depth, keep per-app macOS Library folders while a process of the owning app runs, name the process and app holding a busy path, group blocked space by the condition that frees it in a `WARNING:` line and a `FREEABLE ON CONDITIONS` section, scan again when a process that blocked items has exited, warn when a clean plan rests on an incomplete scan, and collapse access errors inside directories this user cannot enter into one line.
+
+## 0.21.0
+
+### Minor Changes
+
+- Keep a Chromium code-sign clone while any process runs its hard-linked main executable, under the installed path or the clone's, at scan time and right before deletion; a clone that still shares its blocks with the installed app reports no reclaimable space.
+
+  Warn when swap grows, nearly fills, or outgrows the free disk space, naming the processes holding the memory and how much each grew since earlier scans (with Linux `VmSwap` support), and offer Git clones in temporary directories as safe once every worktree is clean and `git ls-remote` shows the remote still holds every local commit.
+
+  Keep a Playwright browser revision while an installed Playwright package recorded in the registry's `.links` still launches it (rechecked right before deletion), offer Playwright installs and downloads left in temporary directories, offer unused nvm Node versions while naming the global packages they take with them, and limit Telegram downloaded media to the cloud files Telegram downloads again, never its media database or files the user sent.
+
 ## 0.20.0
 
 ### Minor Changes

package/README.md

@@ -57,6 +57,7 @@ dss scan [paths...] [--docker] [--depth N] [--json]      # report only
 dss clean [paths...] --tier safe|moderate [--yes] [--older-than 1h]
 dss emergency --free 20G | --until 80% [--path /] [--yes]
 dss docker scan|clean [--container ID] [--recursive]
+dss usage [paths...] [--min-size 1G] [--json]            # where space goes
 ```
 
 | Exit code | Meaning                                  |
@@ -85,6 +86,22 @@ Run `dss --help` for every option. The most useful ones:
   Recent reports authenticated by this installation are reused; older, unsigned
   or edited reports require discovery again. Changing discovery or action options
   also rebuilds the plan. Every deletion still gets fresh checks.
+- `dss usage` shows where the space of a whole volume goes, including data
+  no rule covers. One read-only `du -axk` pass walks the macOS Data volume
+  (`/Users`, `/Applications`, `/private`, `/opt`, ...) or `/` on Linux, or
+  the given paths, staying on their filesystem. It prints a tree of the
+  largest directories (1% of the walk and up, or `--min-size`), the largest
+  files, and for each directory what the latest dss scan or clean found
+  inside it (`[dss: 1.2 GiB freeable, 3.4 GiB blocked]`). On macOS it adds
+  the APFS volumes a walk cannot see (system, VM swap, Preboot, Recovery),
+  local snapshots and the part of the Data volume left unread. It needs
+  `du`, so it runs on macOS and Linux; a full walk takes minutes.
+- APFS clones that share every block with an installed app, such as Chrome's
+  code-sign clones, free nothing when deleted, so they are never offered. The
+  scan lists them under `SHARED WITH INSTALLED APPS` and `dss usage` marks
+  them, because `du` and Finder count them at full size.
+- Git worktree folders (`.worktrees`, `worktrees`) restart the project search
+  depth, so dependencies of nested worktrees are found below `--max-depth`.
 - `clean` automatically reuses a matching scan from the last 30 minutes.
   `--fresh` bypasses this plan and the discovery/size index; `--cache-dir DIR`
   chooses the state location (default `$XDG_STATE_HOME/disk-space-saviour`, or
@@ -97,11 +114,11 @@ ranked by how recently it was used: a cache, build output or dependency
 directory is `safe` and is held back only while something uses it (see
 [Safety](#safety)).
 
-| Tier         | What it removes                                                                                                                                                                                                                                                                                                           |
-| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `safe`       | Everything regenerable: download, runtime and application caches, idle package-runner entries, old browser revisions, `node_modules`, `vendor`, `target/`, `.venv`, `build/` and similar folders of any project, dangling Docker images and build cache.                                                                  |
-| `moderate`   | Data that is disposable but not regenerated by a tool: old agent scratch and Telegram downloaded media (secret-chat media may be irreplaceable), unused toolchain versions (never one holding globally installed packages or virtual environments), tagged images and stopped containers (both require explicit consent). |
-| `aggressive` | Accepted by `dss emergency` for compatibility; currently the same as `moderate`.                                                                                                                                                                                                                                          |
+| Tier         | What it removes                                                                                                                                                                                                                                                                                                                                                |
+| ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `safe`       | Everything regenerable: download, runtime and application caches, idle package-runner entries, old browser revisions, `node_modules`, `vendor`, `target/`, `.venv`, `build/` and similar folders of any project, dangling Docker images and build cache.                                                                                                       |
+| `moderate`   | Data that is disposable but not regenerated by a tool: old agent scratch and Telegram downloaded media (secret-chat media may be irreplaceable), unused toolchain versions no process runs from (the item names the global packages it removes; never one holding virtual environments), tagged images and stopped containers (both require explicit consent). |
+| `aggressive` | Accepted by `dss emergency` for compatibility; currently the same as `moderate`.                                                                                                                                                                                                                                                                               |
 
 Covered ecosystems: JavaScript/TypeScript (npm, yarn, pnpm, bun, deno,
 framework build caches), Python, Rust, JVM (Gradle, Maven, Kotlin, Android),
@@ -115,15 +132,21 @@ LibreWolf, Waterfox, Zen and Floorp, IDE caches (JetBrains, VS Code, Cursor,
 Windsurf, Qoder), AI agent caches and logs, the Discord cache, macOS app
 updates staged by Sparkle and Squirrel, package manager archives, trash, crash
 reports, core dumps and journald logs. Application downloads are covered too:
-Chrome bundle clones left by exited browsers, Chromium on-device AI models
+Chrome bundle clones left by exited browsers (kept while any browser runs the
+clone's hard-linked executable, and counted as free when they still share
+their blocks with the installed app), Chromium on-device AI models
 (downloaded again when a page uses built-in AI), Google Updater installers, ChatGPT Atlas and Codex app caches,
 Electron and electron-builder archives, the Bun transpiler cache, Docker
 Desktop and Warp staged updates (kept while the app runs), Zed language
 servers, tree-sitter toolchains, Codex plugin staging, the Clang module cache
 and processed Crashpad reports. Telegram pure caches, Safari/WebKit,
 Chromium code/GPU/Dawn/service-worker caches and marker-validated Electron
-caches are included. Telegram databases, browser profiles and Playwright MCP
-profiles are preserved. macOS access failures explain when Full Disk Access
+caches are included. Old Playwright browser revisions are kept while a
+Playwright package recorded in the registry's `.links` still launches them or
+a browser runs from them; Playwright installs and downloads left in temporary
+directories are removed once untouched. Telegram caches are removed only
+while Telegram is not running. Telegram databases, browser profiles and
+Playwright MCP profiles are preserved. macOS access failures explain when Full Disk Access
 is needed. Agent scratch cleanup requires inactivity and Git safety checks.
 
 ## Safety
@@ -143,6 +166,24 @@ is needed. Agent scratch cleanup requires inactivity and Git safety checks.
   cache, while `bun install`, `bunx` or an auto-installing script does.
   A directory on the `PATH` of a running process is kept too: the process
   may still start programs from it.
+- **Per-app macOS folders stay while their app runs.** Caches, containers
+  and other folders under `~/Library/<kind>/<bundle-id>` belong to the app
+  with that bundle identifier, read from the `Info.plist` of every bundle a
+  running process starts from. Such a folder is blocked while that app, a
+  helper or an updater of it runs (for example the WebKit cache of Music,
+  Telegram's group container), even when no rule names the app's process.
+  A path held open names its holder: `in use: <path> (pid N, App)`.
+- **Blocked space is grouped by what frees it.** A `WARNING:` line and the
+  `FREEABLE ON CONDITIONS` section total blocked space by the condition that
+  clears every blocker of an item: quit an app, a process or Claude Code
+  session ending, files closing, the activity window passing, a container
+  stopping or a later scan finishing what this one ran out of time for.
+  Items kept for Git state, protected installs or unverifiable records are
+  counted apart. `clean` repeats the summary after the plan. Rerun dss once
+  a condition is met; it rechecks everything before deleting. `clean` scans
+  again instead of reusing a saved scan when a process named by its blockers
+  has exited, and warns when the scan behind its plan stopped early (for
+  example at `--scan-budget`), since items it never reached are not planned.
 - **Toolchain versions are kept while anything may need them.** The
   manager's default and aliases, versions pinned by a project (`.nvmrc`,
   `rust-toolchain.toml`, ...) and the newest install stay. A partial nvm pin
@@ -241,10 +282,27 @@ and sizes. Safe cleanup also rechecks source activity. Explicit moderate cleanup
 preserves the ability to remove ignored dependencies when only source changed.
 Library callers opt into state with `cacheDir`.
 
-On macOS, reports include `sysctl vm.swapusage` and the largest resident/compressed
-memory consumers from `top`. These are memory diagnostics, not verified per-process
-swap ownership. When Docker Desktop consumes memory, saving work and restarting it
-or lowering its VM memory limit can help. dss never deletes swap files.
+On macOS, reports include `sysctl vm.swapusage` and the largest memory consumers
+from `top` (memory includes compressed and swapped pages). These are memory
+diagnostics, not verified per-process swap ownership. On Linux, reports include
+`/proc/meminfo` swap and the processes with the most swapped memory (`VmSwap`).
+Each scan records swap usage and its largest holders in the state directory, so
+the next scan shows how much both grew during the last week. A `WARNING:` line
+appears when swap grew by 1 GiB or more, is at least 75% full, or exceeds the free
+disk space it can grow into, naming the processes holding the memory and their
+growth. Long-running AI agent sessions keep their history in memory: quitting and
+resuming them (`codex resume <session-id>`, `claude --resume`) releases it. When
+Docker Desktop consumes memory, saving work and restarting it or lowering its VM
+memory limit can help. dss never deletes swap files.
+
+Git clones in temporary directories (`{TMP}/*` and `{TMP}/*/*`) are safe to remove
+once untouched for the activity window when every worktree sharing the repository
+is clean, none lives outside the clone, nothing is stashed, and every commit
+reachable from `HEAD`, a branch or a worktree is advertised by an https or ssh
+remote. That last check runs `git ls-remote` against the remote rather than
+trusting remote-tracking refs, outside any repository, with only the https and
+ssh transports and no prompts. Clones of local paths and clones whose `.git` is a
+symlink are left alone, and cleanup repeats every check right before deleting.
 
 Cache discovery honors tool configuration before default paths, including
 `GOMODCACHE`, `GOPATH`, `GOCACHE`, `CARGO_HOME`, `RUSTUP_HOME`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "disk-space-saviour",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "Safely reclaims disk space: caches and build outputs of 20+ ecosystems, forgotten projects, and Docker (running, stopped and nested containers), with an emergency mode",
   "type": "module",
   "main": "src/index.js",

package/src/app-owners.js

@@ -0,0 +1,87 @@
+/**
+ * macOS apps that own per-app Library folders.
+ *
+ * Caches, containers and other per-app data under `~/Library/<kind>/` are
+ * named after the owning app's bundle identifier
+ * (`~/Library/Caches/com.apple.Music/WebKit`, group containers carry a
+ * team prefix: `6N38VWS5BX.ru.keepcoder.Telegram`). A running app may read
+ * or write such a folder at any moment without holding a file open, so a
+ * folder stays while a process runs from a bundle of its owner. This
+ * covers apps a rule's process names do not list, such as every app that
+ * embeds WebKit.
+ */
+
+const OWNED =
+  /\/Library\/(Caches|Containers|Group Containers|HTTPStorages|WebKit|Saved Application State|Application Scripts|Application Support|Logs|Cookies)\/([^/]+)/;
+const BUNDLE_ID = /^[A-Za-z0-9-]+(?:\.[A-Za-z0-9_-]+)+$/;
+
+/** Bundle identifier owning `target`, or null outside per-app folders. */
+export function ownerBundleId(target) {
+  const match = OWNED.exec(target);
+  if (!match) {
+    return null;
+  }
+  let id = match[2].replace(/\.(savedState|binarycookies)$/, '');
+  if (match[1] === 'Group Containers') {
+    id = id.replace(/^(?:[A-Z0-9]{10}\.|group\.)/, '');
+  }
+  return BUNDLE_ID.test(id) ? id : null;
+}
+
+/** Bundles (`.app`, `.appex`, `.xpc`) an executable runs from, outermost first. */
+export function bundleRoots(executable) {
+  const roots = [];
+  const parts = (executable ?? '').split('/');
+  for (let index = 1; index < parts.length - 1; index++) {
+    if (/\.(app|appex|xpc)$/.test(parts[index])) {
+      roots.push(parts.slice(0, index + 1).join('/'));
+    }
+  }
+  return roots;
+}
+
+/** `CFBundleIdentifier` of an XML property list, or null. */
+export function parseBundleIdentifier(plist) {
+  return (
+    /<key>CFBundleIdentifier<\/key>\s*<string>([^<]+)<\/string>/
+      .exec(plist ?? '')?.[1]
+      ?.trim() || null
+  );
+}
+
+/**
+ * Whether a running bundle belongs to the owner of a folder: the same
+ * identifier, or one nested under the other (helpers such as
+ * `com.google.Chrome.helper`, updaters such as `….ShipIt`).
+ */
+export function ownsFolder(running, owner) {
+  const a = running.toLowerCase();
+  const b = owner.toLowerCase();
+  return a === b || a.startsWith(`${b}.`) || b.startsWith(`${a}.`);
+}
+
+/**
+ * Identifiers a process runs under. A bundle without a readable identifier
+ * falls back to its name, which still matches an owner ending in it
+ * (`Telegram.app` and `ru.keepcoder.Telegram`).
+ * @param {string[]} roots bundle paths of the process
+ * @param {Map<string, string|null>} ids bundle path → identifier
+ */
+export function processBundles(roots, ids) {
+  return roots.map((root) => ({
+    id: ids.get(root) ?? null,
+    name: root
+      .split('/')
+      .at(-1)
+      .replace(/\.(app|appex|xpc)$/, ''),
+  }));
+}
+
+/** Whether one of `bundles` owns the folder of bundle identifier `owner`. */
+export function bundlesOwn(bundles, owner) {
+  return bundles.some((bundle) =>
+    bundle.id
+      ? ownsFolder(bundle.id, owner)
+      : owner.toLowerCase().split('.').at(-1) === bundle.name.toLowerCase()
+  );
+}

package/src/clean.js

@@ -39,6 +39,7 @@ import { GitInspector } from './git.js';
 import { HealthWatch } from './health.js';
 import { consentFlag, dropNested, selectByTier, tierRank } from './items.js';
 import { LivenessProbe } from './liveness.js';
+import { playwrightBlocker } from './playwright-registry.js';
 import { resolveOptions } from './options.js';
 import { isWithin } from './paths.js';
 import { OTHER_RULES } from './rules/other.js';
@@ -132,6 +133,11 @@ async function browserRevisionBlocker(env, item) {
     if (!newer) {
       return `${target} is now the newest installed browser revision`;
     }
+    const needed =
+      rule.registry === 'playwright' && (await playwrightBlocker(env, target));
+    if (needed) {
+      return needed;
+    }
   }
   return null;
 }
@@ -432,6 +438,7 @@ export class Cleaner {
   async #safetyBlocker(ctx, item, type) {
     await ctx.liveness.refresh(true);
     await ctx.liveness.resolve(item.paths);
+    await ctx.liveness.resolveExecutables(item.checks?.executables);
     const busy = ctx.liveness.busyReason(item);
     if (busy) {
       return `busy: ${busy}`;
@@ -475,6 +482,11 @@ export class Cleaner {
   }
 
   async #gitBlocker(ctx, item) {
+    if (item.recheck?.type === 'clone') {
+      ctx.git.invalidate();
+      const blockers = await ctx.git.cloneBlockers(item.path);
+      return blockers.length > 0 ? blockers.join('; ') : null;
+    }
     if (
       item.project ||
       item.rule === 'gh-issue-solver-workdirs' ||
@@ -667,6 +679,7 @@ export class Cleaner {
       return `stopped before ${target}: ${stopped}`;
     }
     await ctx.liveness.resolve([target]);
+    await ctx.liveness.resolveExecutables(item.checks?.executables);
     const busy = ctx.liveness.busyReason({ ...item, paths: [target] });
     return busy ? `stopped before ${target}: busy: ${busy}` : null;
   }
@@ -1000,6 +1013,17 @@ export async function finishAudit(audit, report, options) {
     .filter((e) => e.status === 'planned')
     .reduce((sum, e) => sum + e.plannedBytes, 0);
   audit.environments = environmentTotals(report, audit.entries);
+  // What the run had to leave, grouped by the condition that frees it.
+  audit.blocked = report.totals?.blocked ?? null;
+  // Scanners an incomplete scan never reached contribute no items at all.
+  audit.incomplete = (report.environments ?? [])
+    .filter(
+      (env) =>
+        env.scanStatus &&
+        env.scanStatus !== 'complete' &&
+        env.scanStatus !== 'goal-reached'
+    )
+    .map((env) => ({ label: env.label, status: env.scanStatus }));
   if (options.audit !== false) {
     await writeAudit(audit, options);
   }

package/src/cli.js

@@ -13,14 +13,16 @@ import { parseArgs } from 'node:util';
 
 import { startAudit, writeAudit } from './audit.js';
 import { clean } from './clean.js';
+import { exitedBlockerPids, pidAlive } from './conditions.js';
 import { emergency } from './emergency.js';
 import { setTrace } from './exec.js';
 import { resolveGoal, resolveOptions } from './options.js';
 import { formatAudit, formatReport } from './report.js';
 import { scan } from './scan.js';
+import { formatUsage, usage } from './usage.js';
 import { cleanDuringScan } from './fast-clean.js';
 import { defaultStateDirectory, loadScan } from './scan-state.js';
-import { formatBytes } from './units.js';
+import { formatBytes, parseSize } from './units.js';
 
 export const USAGE = `Usage: dss <command> [paths...] [options]
 
@@ -28,6 +30,9 @@ Commands:
   scan [paths...]            Report reclaimable space (never deletes)
   clean [paths...]           Delete what the chosen tier allows
   emergency                  Escalate tiers until a free-space goal is met
+  usage [paths...]           Show where space goes on whole volumes: the
+                             largest directories and files, what dss can
+                             free inside them, APFS volumes (never deletes)
   docker scan|clean          Only Docker: daemons, containers, nested daemons
   help, version
 
@@ -288,7 +293,7 @@ export function processIo() {
   };
 }
 
-const API = { scan, clean, emergency, cleanDuringScan };
+const API = { scan, clean, emergency, cleanDuringScan, usage };
 
 class Cli {
   constructor(io, api) {
@@ -305,6 +310,23 @@ class Cli {
     return this.printScan(report, options, values);
   }
 
+  async usage(options, values) {
+    const report = await this.api.usage({
+      roots: options.roots,
+      // Without --min-size the tree shows directories of 1% of a root.
+      minSize: values['min-size'] ? parseSize(values['min-size']) : undefined,
+      verbose: values.verbose,
+      signal: options.signal,
+      auditDir: options.auditDir,
+      onUsageProgress: (progress) =>
+        this.io.stderr(
+          `[usage] ${progress.root}: ${Math.round(progress.elapsedMs / 1000)}s, ${progress.entries.toLocaleString('en-US')} entries, at ${progress.at ?? progress.root}`
+        ),
+    });
+    this.print(values, report, () => formatUsage(report));
+    return 0;
+  }
+
   async printScan(report, options, values) {
     const audit = scanAudit(report);
     if (options.audit !== false) {
@@ -329,7 +351,12 @@ class Cli {
     const file = values.from ?? values.report;
     if (!file) {
       const recent = await loadScan(resolveOptions(options));
-      if (recent) {
+      const exited = recent ? exitedBlockerPids(recent, pidAlive) : [];
+      if (exited.length > 0) {
+        this.io.stderr(
+          `Scanning again: processes that blocked items in the scan from ${recent.createdAt} exited (pid ${exited.slice(0, 5).join(', ')}${exited.length > 5 ? ', …' : ''}).`
+        );
+      } else if (recent) {
         this.io.stderr(
           `Reusing scan from ${recent.createdAt}; planned items will be checked before deletion.`
         );
@@ -491,6 +518,8 @@ function dispatch(cli, command, options, values) {
       return cli.clean(options, values);
     case 'emergency':
       return cli.emergency(options, values);
+    case 'usage':
+      return cli.usage(options, values);
     case 'docker-scan':
       return cli.scan(dockerOnly(options, values), values);
     case 'docker-clean':

package/src/conditions.js

@@ -0,0 +1,145 @@
+/**
+ * Space that frees when a condition is met: blocked items grouped by what
+ * keeps them, so a report says "quit Telegram: 1.9 GiB" in one line for
+ * hundreds of busy items. An item frees only when every one of
+ * its blockers clears; items kept for reasons no running program explains
+ * (Git state, protected installs, unreadable records) are counted apart.
+ */
+
+const CONDITIONS = [
+  [
+    /^(?:busy: )?(.+?) is running in (.+?) \(pid (\d+)\)$/,
+    (m) => ({
+      key: `exit:${m[3]}`,
+      action: `${m[1]} (pid ${m[3]}) in ${m[2]} exits`,
+    }),
+  ],
+  [
+    /^(?:busy: )?(.+?) is running \(pid \d+(?:, working directory unknown)?\)(?: and owns \S+)?$/,
+    (m) => ({ key: `quit:${m[1]}`, action: `quit ${m[1]}` }),
+  ],
+  [
+    /^locked by running Claude Code \(pid (\d+)/,
+    (m) => ({
+      key: `exit:${m[1]}`,
+      action: `the Claude Code session (pid ${m[1]}) ends`,
+    }),
+  ],
+  [
+    /^(?:busy: )?on the PATH of (.+?) \(pid (\d+)\)/,
+    (m) => ({ key: `exit:${m[2]}`, action: `${m[1]} (pid ${m[2]}) exits` }),
+  ],
+  [
+    /^(?:busy: )?in use: .+ \(pid (\d+)(?:, (.+))?\)$/,
+    (m) => ({
+      key: `exit:${m[1]}`,
+      action: `${m[2] ?? 'process'} (pid ${m[1]}) exits`,
+    }),
+  ],
+  [
+    /^(?:busy: )?(?:in use: |every path is in use)/,
+    () => ({ key: 'open', action: 'the programs holding the files open exit' }),
+  ],
+  [
+    /^(?:busy: )?modified .+ ago, inside the (.+) activity window$/,
+    (m) => ({
+      key: 'idle',
+      action: `they stay untouched for the ${m[1]} activity window`,
+    }),
+  ],
+  [
+    /^scan incomplete: (.+)$/,
+    (m) => ({
+      key: 'rescan',
+      action: `a later scan finishes measuring them (${m[1]})`,
+    }),
+  ],
+  [
+    /^bind-mounted by running container (\S+)/,
+    (m) => ({ key: `container:${m[1]}`, action: `container ${m[1]} stops` }),
+  ],
+];
+
+/** What must happen for `blocker` to clear, or null when nothing running explains it. */
+export function blockerCondition(blocker) {
+  for (const [pattern, condition] of CONDITIONS) {
+    const match = pattern.exec(blocker);
+    if (match) {
+      return condition(match);
+    }
+  }
+  return null;
+}
+
+/**
+ * Blocked space grouped by the conditions that free it, largest first.
+ * @param {object[]} items blocked items, nested ones already dropped
+ * @returns {{conditions: object[], other: {items: number, bytes: number}}}
+ */
+export function blockedConditions(items) {
+  const groups = new Map();
+  const other = { items: 0, bytes: 0 };
+  for (const item of items) {
+    const found = item.blockers.map(blockerCondition);
+    if (found.length === 0 || found.includes(null)) {
+      other.items += 1;
+      other.bytes += item.bytes;
+      continue;
+    }
+    // The first blocker names a process most specifically (a Claude Code
+    // lock before the files it holds open).
+    const unique = found.filter(
+      (entry, index) => found.findIndex((e) => e.key === entry.key) === index
+    );
+    const key = unique
+      .map((entry) => entry.key)
+      .sort()
+      .join('+');
+    const group = groups.get(key) ?? {
+      action: unique.map((entry) => entry.action).join(' and '),
+      items: 0,
+      bytes: 0,
+      tiers: {},
+    };
+    group.items += 1;
+    group.bytes += item.bytes;
+    group.tiers[item.tier] = (group.tiers[item.tier] ?? 0) + item.bytes;
+    groups.set(key, group);
+  }
+  return {
+    conditions: [...groups.values()].sort((a, b) => b.bytes - a.bytes),
+    other,
+  };
+}
+
+/**
+ * Host processes named by blockers of a saved scan that no longer run, so
+ * the items they blocked may be free now and the scan is stale.
+ * @param {object} report saved scan
+ * @param {(pid: number) => boolean} alive
+ * @returns {number[]}
+ */
+export function exitedBlockerPids(report, alive) {
+  const pids = new Set();
+  for (const item of report.items ?? []) {
+    if (item.env !== 'host') {
+      continue;
+    }
+    for (const blocker of item.blockers ?? []) {
+      for (const match of blocker.matchAll(/\(pid (\d+)/g)) {
+        pids.add(Number(match[1]));
+      }
+    }
+  }
+  return [...pids].filter((pid) => !alive(pid));
+}
+
+/** Whether a process with `pid` exists, including other users' processes. */
+export function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === 'EPERM';
+  }
+}