- Smart Scan: one-click full-system scan across 6 modules (cache, logs, downloads, dev junk, large files, leftovers)
- 3-layer safety engine: whitelist protection, safety classification (safe/caution), and audit logging
- Storage Map: visual disk usage breakdown with interactive donut chart
- System Data: real-time CPU, memory, disk, and battery monitoring
- Module-level detail pages: file browser with filtering, sorting, and bulk selection
- Ignore List: persistent path exclusion with glob pattern support
- Smart Rules: configurable auto-selection rules for recurring cleanup patterns
- Settings: locale (EN/ZH), delete method (trash/permanent), privacy consent management
- About page with privacy policy and terms of service (bilingual)
- AppleScript injection protection with control character filtering
- TOCTOU race condition mitigation on file deletion paths
- Shell injection prevention (direct execFile calls, no
bash -c) - Path prefix matching hardened with trailing
/validation - CORS restricted to specific localhost ports
- Module ID whitelist validation
- HOME environment variable validation at startup
- Safe tilde expansion function
- Argument terminators (
--) on allrm/mvcalls
- Toast notification system (success/warning/error)
- Reusable ErrorState and EmptyState components
- Privacy consent modal with links to full policy/terms
- Animated state transitions with Framer Motion
- Responsive layout with Tailwind CSS 4.2
- Universal binary (arm64 + x86_64) via
build.sh - Node.js runtime bundling with production dependency trimming
- DMG creation with Applications shortcut (
--dmg) - Apple notarization support (
--notarize) - Post-build verification (
--verify) - Privacy manifest (PrivacyInfo.plist) bundled into app Resources
- CLI: 19 tests across 6 modules (bash unit tests)
- GUI: 31 tests (Vitest + React Testing Library)
- Utility functions (formatSize, shortenPath, clamp)
- Store reducer (13 state management tests)
- Toast component (rendering, auto-dismiss, multiple toasts)
- Apple Privacy Manifest: File Timestamp (C617.1) + Disk Space (E174.1) API declarations
- NSPrivacyTracking = NO, no user data collection
- Bilingual privacy policy and terms of service