Safety reinforcement

lib/clean/brew.sh

@@ -34,6 +34,8 @@ clean_orphaned_casks() {
     else
         # Rebuild cache: query all installed casks and extract app names
         mkdir -p "$cache_dir"
+        # Remove stale cache if it exists but has permission issues
+        rm -f "$cask_cache" 2> /dev/null || true
         true > "$cask_cache"
 
         while IFS= read -r cask; do

lib/core/common.sh

@@ -241,7 +241,7 @@ safe_find_delete() {
     fi
 
     # Execute find with safety limits
-    find "$base_dir" \
+    find -- "$base_dir" \
         -maxdepth 3 \
         -name "$pattern" \
         -type "$type_filter" \
@@ -277,7 +277,7 @@ safe_sudo_find_delete() {
     fi
 
     # Execute find with safety limits
-    sudo find "$base_dir" \
+    sudo find -- "$base_dir" \
         -maxdepth 3 \
         -name "$pattern" \
         -type "$type_filter" \
@@ -1150,7 +1150,7 @@ clean_tool_cache() {
 get_path_size_kb() {
     local path="$1"
     local result
-    result=$(du -sk "$path" 2> /dev/null | awk '{print $1}')
+    result=$(du -sk -- "$path" 2> /dev/null | awk '{print $1}')
     echo "${result:-0}"
 }