diff --git a/bin/optimize.sh b/bin/optimize.sh
index 3a5e0f1..6dbaaec 100755
--- a/bin/optimize.sh
+++ b/bin/optimize.sh
@@ -139,12 +139,12 @@ show_optimization_summary() {
 show_system_health() {
     local health_json="$1"
 
-    local mem_used=$(echo "$health_json" | jq -r '.memory_used_gb // 0' 2>/dev/null || echo "0")
-    local mem_total=$(echo "$health_json" | jq -r '.memory_total_gb // 0' 2>/dev/null || echo "0")
-    local disk_used=$(echo "$health_json" | jq -r '.disk_used_gb // 0' 2>/dev/null || echo "0")
-    local disk_total=$(echo "$health_json" | jq -r '.disk_total_gb // 0' 2>/dev/null || echo "0")
-    local disk_percent=$(echo "$health_json" | jq -r '.disk_used_percent // 0' 2>/dev/null || echo "0")
-    local uptime=$(echo "$health_json" | jq -r '.uptime_days // 0' 2>/dev/null || echo "0")
+    local mem_used=$(echo "$health_json" | jq -r '.memory_used_gb // 0' 2> /dev/null || echo "0")
+    local mem_total=$(echo "$health_json" | jq -r '.memory_total_gb // 0' 2> /dev/null || echo "0")
+    local disk_used=$(echo "$health_json" | jq -r '.disk_used_gb // 0' 2> /dev/null || echo "0")
+    local disk_total=$(echo "$health_json" | jq -r '.disk_total_gb // 0' 2> /dev/null || echo "0")
+    local disk_percent=$(echo "$health_json" | jq -r '.disk_used_percent // 0' 2> /dev/null || echo "0")
+    local uptime=$(echo "$health_json" | jq -r '.uptime_days // 0' 2> /dev/null || echo "0")
 
     mem_used=${mem_used:-0}
     mem_total=${mem_total:-0}
@@ -159,7 +159,7 @@ show_system_health() {
 
 parse_optimizations() {
     local health_json="$1"
-    echo "$health_json" | jq -c '.optimizations[]' 2>/dev/null
+    echo "$health_json" | jq -c '.optimizations[]' 2> /dev/null
 }
 
 announce_action() {
@@ -177,12 +177,12 @@ announce_action() {
 
 touchid_configured() {
     local pam_file="/etc/pam.d/sudo"
-    [[ -f "$pam_file" ]] && grep -q "pam_tid.so" "$pam_file" 2>/dev/null
+    [[ -f "$pam_file" ]] && grep -q "pam_tid.so" "$pam_file" 2> /dev/null
 }
 
 touchid_supported() {
-    if command -v bioutil >/dev/null 2>&1; then
-        if bioutil -r 2>/dev/null | grep -qi "Touch ID"; then
+    if command -v bioutil > /dev/null 2>&1; then
+        if bioutil -r 2> /dev/null | grep -qi "Touch ID"; then
             return 0
         fi
     fi
@@ -272,7 +272,7 @@ ask_for_security_fixes() {
     echo ""
     echo -e "${BLUE}SECURITY FIXES${NC}"
     for entry in "${SECURITY_FIXES[@]}"; do
-        IFS='|' read -r _ label <<<"$entry"
+        IFS='|' read -r _ label <<< "$entry"
         echo -e "  ${ICON_LIST} $label"
     done
     echo ""
@@ -299,7 +299,7 @@ ask_for_security_fixes() {
 }
 
 apply_firewall_fix() {
-    if sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on >/dev/null 2>&1; then
+    if sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on > /dev/null 2>&1; then
         echo -e "  ${GREEN}${ICON_SUCCESS}${NC} Firewall enabled"
         FIREWALL_DISABLED=false
         return 0
@@ -309,7 +309,7 @@ apply_firewall_fix() {
 }
 
 apply_gatekeeper_fix() {
-    if sudo spctl --master-enable 2>/dev/null; then
+    if sudo spctl --master-enable 2> /dev/null; then
         echo -e "  ${GREEN}${ICON_SUCCESS}${NC} Gatekeeper enabled"
         GATEKEEPER_DISABLED=false
         return 0
@@ -333,17 +333,17 @@ perform_security_fixes() {
 
     local applied=0
     for entry in "${SECURITY_FIXES[@]}"; do
-        IFS='|' read -r action _ <<<"$entry"
+        IFS='|' read -r action _ <<< "$entry"
         case "$action" in
-        firewall)
-            apply_firewall_fix && ((applied++))
-            ;;
-        gatekeeper)
-            apply_gatekeeper_fix && ((applied++))
-            ;;
-        touchid)
-            apply_touchid_fix && ((applied++))
-            ;;
+            firewall)
+                apply_firewall_fix && ((applied++))
+                ;;
+            gatekeeper)
+                apply_gatekeeper_fix && ((applied++))
+                ;;
+            touchid)
+                apply_touchid_fix && ((applied++))
+                ;;
         esac
     done
 
@@ -354,7 +354,7 @@ perform_security_fixes() {
 }
 
 cleanup_all() {
-    stop_inline_spinner 2>/dev/null || true
+    stop_inline_spinner 2> /dev/null || true
     stop_sudo_session
     cleanup_temp_files
     # Log session end
@@ -373,16 +373,16 @@ main() {
     local health_json
     for arg in "$@"; do
         case "$arg" in
-        "--debug")
-            export MO_DEBUG=1
-            ;;
-        "--dry-run")
-            export MOLE_DRY_RUN=1
-            ;;
-        "--whitelist")
-            manage_whitelist "optimize"
-            exit 0
-            ;;
+            "--debug")
+                export MO_DEBUG=1
+                ;;
+            "--dry-run")
+                export MOLE_DRY_RUN=1
+                ;;
+            "--whitelist")
+                manage_whitelist "optimize"
+                exit 0
+                ;;
         esac
     done
 
@@ -401,13 +401,13 @@ main() {
         echo -e "${YELLOW}${ICON_DRY_RUN} DRY RUN MODE${NC}, No files will be modified\n"
     fi
 
-    if ! command -v jq >/dev/null 2>&1; then
+    if ! command -v jq > /dev/null 2>&1; then
         echo -e "${YELLOW}${ICON_ERROR}${NC} Missing dependency: jq"
         echo -e "${GRAY}Install with: ${GREEN}brew install jq${NC}"
         exit 1
     fi
 
-    if ! command -v bc >/dev/null 2>&1; then
+    if ! command -v bc > /dev/null 2>&1; then
         echo -e "${YELLOW}${ICON_ERROR}${NC} Missing dependency: bc"
         echo -e "${GRAY}Install with: ${GREEN}brew install bc${NC}"
         exit 1
@@ -417,7 +417,7 @@ main() {
         start_inline_spinner "Collecting system info..."
     fi
 
-    if ! health_json=$(generate_health_json 2>/dev/null); then
+    if ! health_json=$(generate_health_json 2> /dev/null); then
         if [[ -t 1 ]]; then
             stop_inline_spinner
         fi
@@ -426,7 +426,7 @@ main() {
         exit 1
     fi
 
-    if ! echo "$health_json" | jq empty 2>/dev/null; then
+    if ! echo "$health_json" | jq empty 2> /dev/null; then
         if [[ -t 1 ]]; then
             stop_inline_spinner
         fi
@@ -458,7 +458,7 @@ main() {
     local -a confirm_items=()
     local opts_file
     opts_file=$(mktemp_file)
-    parse_optimizations "$health_json" >"$opts_file"
+    parse_optimizations "$health_json" > "$opts_file"
 
     while IFS= read -r opt_json; do
         [[ -z "$opt_json" ]] && continue
@@ -476,7 +476,7 @@ main() {
         else
             confirm_items+=("$item")
         fi
-    done <"$opts_file"
+    done < "$opts_file"
 
     echo ""
     if [[ "${MOLE_DRY_RUN:-0}" != "1" ]]; then
@@ -486,7 +486,7 @@ main() {
     export FIRST_ACTION=true
     if [[ ${#safe_items[@]} -gt 0 ]]; then
         for item in "${safe_items[@]}"; do
-            IFS='|' read -r name desc action path <<<"$item"
+            IFS='|' read -r name desc action path <<< "$item"
             announce_action "$name" "$desc" "safe"
             execute_optimization "$action" "$path"
         done
@@ -494,7 +494,7 @@ main() {
 
     if [[ ${#confirm_items[@]} -gt 0 ]]; then
         for item in "${confirm_items[@]}"; do
-            IFS='|' read -r name desc action path <<<"$item"
+            IFS='|' read -r name desc action path <<< "$item"
             announce_action "$name" "$desc" "confirm"
             execute_optimization "$action" "$path"
         done
diff --git a/lib/core/file_ops.sh b/lib/core/file_ops.sh
index a083433..33a9126 100644
--- a/lib/core/file_ops.sh
+++ b/lib/core/file_ops.sh
@@ -42,7 +42,7 @@ validate_path_for_deletion() {
     # Check symlink target if path is a symbolic link
     if [[ -L "$path" ]]; then
         local link_target
-        link_target=$(readlink "$path" 2>/dev/null) || {
+        link_target=$(readlink "$path" 2> /dev/null) || {
             log_error "Cannot read symlink: $path"
             return 1
         }
@@ -52,16 +52,16 @@ validate_path_for_deletion() {
         if [[ "$link_target" != /* ]]; then
             local link_dir
             link_dir=$(dirname "$path")
-            resolved_target=$(cd "$link_dir" 2>/dev/null && cd "$(dirname "$link_target")" 2>/dev/null && pwd)/$(basename "$link_target") || resolved_target=""
+            resolved_target=$(cd "$link_dir" 2> /dev/null && cd "$(dirname "$link_target")" 2> /dev/null && pwd)/$(basename "$link_target") || resolved_target=""
         fi
 
         # Validate resolved target against protected paths
         if [[ -n "$resolved_target" ]]; then
             case "$resolved_target" in
-            /System/* | /usr/bin/* | /usr/lib/* | /bin/* | /sbin/* | /private/etc/*)
-                log_error "Symlink points to protected system path: $path -> $resolved_target"
-                return 1
-                ;;
+                /System/* | /usr/bin/* | /usr/lib/* | /bin/* | /sbin/* | /private/etc/*)
+                    log_error "Symlink points to protected system path: $path -> $resolved_target"
+                    return 1
+                    ;;
             esac
         fi
     fi
@@ -88,48 +88,48 @@ validate_path_for_deletion() {
 
     # Allow deletion of coresymbolicationd cache (safe system cache that can be rebuilt)
     case "$path" in
-    /System/Library/Caches/com.apple.coresymbolicationd/data | /System/Library/Caches/com.apple.coresymbolicationd/data/*)
-        return 0
-        ;;
+        /System/Library/Caches/com.apple.coresymbolicationd/data | /System/Library/Caches/com.apple.coresymbolicationd/data/*)
+            return 0
+            ;;
     esac
 
     # Allow known safe paths under /private
     case "$path" in
-    /private/tmp | /private/tmp/* | \
-        /private/var/tmp | /private/var/tmp/* | \
-        /private/var/log | /private/var/log/* | \
-        /private/var/folders | /private/var/folders/* | \
-        /private/var/db/diagnostics | /private/var/db/diagnostics/* | \
-        /private/var/db/DiagnosticPipeline | /private/var/db/DiagnosticPipeline/* | \
-        /private/var/db/powerlog | /private/var/db/powerlog/* | \
-        /private/var/db/reportmemoryexception | /private/var/db/reportmemoryexception/* | \
-        /private/var/db/receipts/*.bom | /private/var/db/receipts/*.plist)
-        return 0
-        ;;
+        /private/tmp | /private/tmp/* | \
+            /private/var/tmp | /private/var/tmp/* | \
+            /private/var/log | /private/var/log/* | \
+            /private/var/folders | /private/var/folders/* | \
+            /private/var/db/diagnostics | /private/var/db/diagnostics/* | \
+            /private/var/db/DiagnosticPipeline | /private/var/db/DiagnosticPipeline/* | \
+            /private/var/db/powerlog | /private/var/db/powerlog/* | \
+            /private/var/db/reportmemoryexception | /private/var/db/reportmemoryexception/* | \
+            /private/var/db/receipts/*.bom | /private/var/db/receipts/*.plist)
+            return 0
+            ;;
     esac
 
     # Check path isn't critical system directory
     case "$path" in
-    / | /bin | /bin/* | /sbin | /sbin/* | /usr | /usr/bin | /usr/bin/* | /usr/sbin | /usr/sbin/* | /usr/lib | /usr/lib/* | /System | /System/* | /Library/Extensions)
-        log_error "Path validation failed: critical system directory: $path"
-        return 1
-        ;;
-    /private)
-        log_error "Path validation failed: critical system directory: $path"
-        return 1
-        ;;
-    /etc | /etc/* | /private/etc | /private/etc/*)
-        log_error "Path validation failed: /etc contains critical system files: $path"
-        return 1
-        ;;
-    /var | /var/db | /var/db/* | /private/var | /private/var/db | /private/var/db/*)
-        log_error "Path validation failed: /var/db contains system databases: $path"
-        return 1
-        ;;
+        / | /bin | /bin/* | /sbin | /sbin/* | /usr | /usr/bin | /usr/bin/* | /usr/sbin | /usr/sbin/* | /usr/lib | /usr/lib/* | /System | /System/* | /Library/Extensions)
+            log_error "Path validation failed: critical system directory: $path"
+            return 1
+            ;;
+        /private)
+            log_error "Path validation failed: critical system directory: $path"
+            return 1
+            ;;
+        /etc | /etc/* | /private/etc | /private/etc/*)
+            log_error "Path validation failed: /etc contains critical system files: $path"
+            return 1
+            ;;
+        /var | /var/db | /var/db/* | /private/var | /private/var/db | /private/var/db/*)
+            log_error "Path validation failed: /var/db contains system databases: $path"
+            return 1
+            ;;
     esac
 
     # Check if path is protected (keychains, system settings, etc)
-    if declare -f should_protect_path >/dev/null 2>&1; then
+    if declare -f should_protect_path > /dev/null 2>&1; then
         if should_protect_path "$path"; then
             if [[ "${MO_DEBUG:-0}" == "1" ]]; then
                 log_warning "Path validation: protected path skipped: $path"
@@ -172,16 +172,16 @@ safe_remove() {
 
             if [[ -e "$path" ]]; then
                 local size_kb
-                size_kb=$(get_path_size_kb "$path" 2>/dev/null || echo "0")
+                size_kb=$(get_path_size_kb "$path" 2> /dev/null || echo "0")
                 if [[ "$size_kb" -gt 0 ]]; then
                     file_size=$(bytes_to_human "$((size_kb * 1024))")
                 fi
 
                 if [[ -f "$path" || -d "$path" ]] && ! [[ -L "$path" ]]; then
                     local mod_time
-                    mod_time=$(stat -f%m "$path" 2>/dev/null || echo "0")
+                    mod_time=$(stat -f%m "$path" 2> /dev/null || echo "0")
                     local now
-                    now=$(date +%s 2>/dev/null || echo "0")
+                    now=$(date +%s 2> /dev/null || echo "0")
                     if [[ "$mod_time" -gt 0 && "$now" -gt 0 ]]; then
                         file_age=$(((now - mod_time) / 86400))
                     fi
@@ -202,9 +202,9 @@ safe_remove() {
     local size_human=""
     if oplog_enabled; then
         if [[ -e "$path" ]]; then
-            size_kb=$(get_path_size_kb "$path" 2>/dev/null || echo "0")
+            size_kb=$(get_path_size_kb "$path" 2> /dev/null || echo "0")
             if [[ "$size_kb" =~ ^[0-9]+$ ]] && [[ "$size_kb" -gt 0 ]]; then
-                size_human=$(bytes_to_human "$((size_kb * 1024))" 2>/dev/null || echo "${size_kb}KB")
+                size_human=$(bytes_to_human "$((size_kb * 1024))" 2> /dev/null || echo "${size_kb}KB")
             fi
         fi
     fi
@@ -265,18 +265,18 @@ safe_sudo_remove() {
             local file_size=""
             local file_age=""
 
-            if sudo test -e "$path" 2>/dev/null; then
+            if sudo test -e "$path" 2> /dev/null; then
                 local size_kb
-                size_kb=$(sudo du -sk "$path" 2>/dev/null | awk '{print $1}' || echo "0")
+                size_kb=$(sudo du -sk "$path" 2> /dev/null | awk '{print $1}' || echo "0")
                 if [[ "$size_kb" -gt 0 ]]; then
                     file_size=$(bytes_to_human "$((size_kb * 1024))")
                 fi
 
-                if sudo test -f "$path" 2>/dev/null || sudo test -d "$path" 2>/dev/null; then
+                if sudo test -f "$path" 2> /dev/null || sudo test -d "$path" 2> /dev/null; then
                     local mod_time
-                    mod_time=$(sudo stat -f%m "$path" 2>/dev/null || echo "0")
+                    mod_time=$(sudo stat -f%m "$path" 2> /dev/null || echo "0")
                     local now
-                    now=$(date +%s 2>/dev/null || echo "0")
+                    now=$(date +%s 2> /dev/null || echo "0")
                     if [[ "$mod_time" -gt 0 && "$now" -gt 0 ]]; then
                         file_age=$(((now - mod_time) / 86400))
                     fi
@@ -296,16 +296,16 @@ safe_sudo_remove() {
     local size_kb=0
     local size_human=""
     if oplog_enabled; then
-        if sudo test -e "$path" 2>/dev/null; then
-            size_kb=$(sudo du -sk "$path" 2>/dev/null | awk '{print $1}' || echo "0")
+        if sudo test -e "$path" 2> /dev/null; then
+            size_kb=$(sudo du -sk "$path" 2> /dev/null | awk '{print $1}' || echo "0")
             if [[ "$size_kb" =~ ^[0-9]+$ ]] && [[ "$size_kb" -gt 0 ]]; then
-                size_human=$(bytes_to_human "$((size_kb * 1024))" 2>/dev/null || echo "${size_kb}KB")
+                size_human=$(bytes_to_human "$((size_kb * 1024))" 2> /dev/null || echo "${size_kb}KB")
             fi
         fi
     fi
 
     # Perform the deletion
-    if sudo rm -rf "$path" 2>/dev/null; then # SAFE: safe_sudo_remove implementation
+    if sudo rm -rf "$path" 2> /dev/null; then # SAFE: safe_sudo_remove implementation
         log_operation "${MOLE_CURRENT_COMMAND:-clean}" "REMOVED" "$path" "$size_human"
         return 0
     else
@@ -356,7 +356,7 @@ safe_find_delete() {
             continue
         fi
         safe_remove "$match" true || true
-    done < <(command find "$base_dir" "${find_args[@]}" -print0 2>/dev/null || true)
+    done < <(command find "$base_dir" "${find_args[@]}" -print0 2> /dev/null || true)
 
     return 0
 }
@@ -369,12 +369,12 @@ safe_sudo_find_delete() {
     local type_filter="${4:-f}"
 
     # Validate base directory (use sudo for permission-restricted dirs)
-    if ! sudo test -d "$base_dir" 2>/dev/null; then
+    if ! sudo test -d "$base_dir" 2> /dev/null; then
         debug_log "Directory does not exist, skipping: $base_dir"
         return 0
     fi
 
-    if sudo test -L "$base_dir" 2>/dev/null; then
+    if sudo test -L "$base_dir" 2> /dev/null; then
         log_error "Refusing to search symlinked directory: $base_dir"
         return 1
     fi
@@ -398,7 +398,7 @@ safe_sudo_find_delete() {
             continue
         fi
         safe_sudo_remove "$match" || true
-    done < <(sudo find "$base_dir" "${find_args[@]}" -print0 2>/dev/null || true)
+    done < <(sudo find "$base_dir" "${find_args[@]}" -print0 2> /dev/null || true)
 
     return 0
 }
@@ -418,7 +418,7 @@ get_path_size_kb() {
     # Use || echo 0 to ensure failure in du (e.g. permission error) doesn't exit script under set -e
     # Pipefail would normally cause the pipeline to fail if du fails, but || handle catches it.
     local size
-    size=$(command du -sk "$path" 2>/dev/null | awk 'NR==1 {print $1; exit}' || true)
+    size=$(command du -sk "$path" 2> /dev/null | awk 'NR==1 {print $1; exit}' || true)
 
     # Ensure size is a valid number (fix for non-numeric du output)
     if [[ "$size" =~ ^[0-9]+$ ]]; then
@@ -439,7 +439,7 @@ calculate_total_size() {
             size_kb=$(get_path_size_kb "$file")
             ((total_kb += size_kb))
         fi
-    done <<<"$files"
+    done <<< "$files"
 
     echo "$total_kb"
 }
diff --git a/lib/core/log.sh b/lib/core/log.sh
index 2268d84..cc933cd 100644
--- a/lib/core/log.sh
+++ b/lib/core/log.sh
@@ -45,7 +45,7 @@ rotate_log_once() {
 
     local max_size="$LOG_MAX_SIZE_DEFAULT"
     if [[ -f "$LOG_FILE" ]] && [[ $(get_file_size "$LOG_FILE") -gt "$max_size" ]]; then
-        mv "$LOG_FILE" "${LOG_FILE}.old" 2>/dev/null || true
+        mv "$LOG_FILE" "${LOG_FILE}.old" 2> /dev/null || true
         ensure_user_file "$LOG_FILE"
     fi
 
@@ -53,7 +53,7 @@ rotate_log_once() {
     if [[ "${MO_NO_OPLOG:-}" != "1" ]]; then
         local oplog_max_size="$OPLOG_MAX_SIZE_DEFAULT"
         if [[ -f "$OPERATIONS_LOG_FILE" ]] && [[ $(get_file_size "$OPERATIONS_LOG_FILE") -gt "$oplog_max_size" ]]; then
-            mv "$OPERATIONS_LOG_FILE" "${OPERATIONS_LOG_FILE}.old" 2>/dev/null || true
+            mv "$OPERATIONS_LOG_FILE" "${OPERATIONS_LOG_FILE}.old" 2> /dev/null || true
             ensure_user_file "$OPERATIONS_LOG_FILE"
         fi
     fi
@@ -67,9 +67,9 @@ rotate_log_once() {
 log_info() {
     echo -e "${BLUE}$1${NC}"
     local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
-    echo "[$timestamp] INFO: $1" >>"$LOG_FILE" 2>/dev/null || true
+    echo "[$timestamp] INFO: $1" >> "$LOG_FILE" 2> /dev/null || true
     if [[ "${MO_DEBUG:-}" == "1" ]]; then
-        echo "[$timestamp] INFO: $1" >>"$DEBUG_LOG_FILE" 2>/dev/null || true
+        echo "[$timestamp] INFO: $1" >> "$DEBUG_LOG_FILE" 2> /dev/null || true
     fi
 }
 
@@ -77,9 +77,9 @@ log_info() {
 log_success() {
     echo -e "  ${GREEN}${ICON_SUCCESS}${NC} $1"
     local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
-    echo "[$timestamp] SUCCESS: $1" >>"$LOG_FILE" 2>/dev/null || true
+    echo "[$timestamp] SUCCESS: $1" >> "$LOG_FILE" 2> /dev/null || true
     if [[ "${MO_DEBUG:-}" == "1" ]]; then
-        echo "[$timestamp] SUCCESS: $1" >>"$DEBUG_LOG_FILE" 2>/dev/null || true
+        echo "[$timestamp] SUCCESS: $1" >> "$DEBUG_LOG_FILE" 2> /dev/null || true
     fi
 }
 
@@ -87,9 +87,9 @@ log_success() {
 log_warning() {
     echo -e "${YELLOW}$1${NC}"
     local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
-    echo "[$timestamp] WARNING: $1" >>"$LOG_FILE" 2>/dev/null || true
+    echo "[$timestamp] WARNING: $1" >> "$LOG_FILE" 2> /dev/null || true
     if [[ "${MO_DEBUG:-}" == "1" ]]; then
-        echo "[$timestamp] WARNING: $1" >>"$DEBUG_LOG_FILE" 2>/dev/null || true
+        echo "[$timestamp] WARNING: $1" >> "$DEBUG_LOG_FILE" 2> /dev/null || true
     fi
 }
 
@@ -97,9 +97,9 @@ log_warning() {
 log_error() {
     echo -e "${YELLOW}${ICON_ERROR}${NC} $1" >&2
     local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
-    echo "[$timestamp] ERROR: $1" >>"$LOG_FILE" 2>/dev/null || true
+    echo "[$timestamp] ERROR: $1" >> "$LOG_FILE" 2> /dev/null || true
     if [[ "${MO_DEBUG:-}" == "1" ]]; then
-        echo "[$timestamp] ERROR: $1" >>"$DEBUG_LOG_FILE" 2>/dev/null || true
+        echo "[$timestamp] ERROR: $1" >> "$DEBUG_LOG_FILE" 2> /dev/null || true
     fi
 }
 
@@ -107,7 +107,7 @@ log_error() {
 debug_log() {
     if [[ "${MO_DEBUG:-}" == "1" ]]; then
         echo -e "${GRAY}[DEBUG]${NC} $*" >&2
-        echo "[$(date '+%Y-%m-%d %H:%M:%S')] DEBUG: $*" >>"$DEBUG_LOG_FILE" 2>/dev/null || true
+        echo "[$(date '+%Y-%m-%d %H:%M:%S')] DEBUG: $*" >> "$DEBUG_LOG_FILE" 2> /dev/null || true
     fi
 }
 
@@ -144,7 +144,7 @@ log_operation() {
     local log_line="[$timestamp] [$command] $action $path"
     [[ -n "$detail" ]] && log_line+=" ($detail)"
 
-    echo "$log_line" >>"$OPERATIONS_LOG_FILE" 2>/dev/null || true
+    echo "$log_line" >> "$OPERATIONS_LOG_FILE" 2> /dev/null || true
 }
 
 # Log session start marker
@@ -159,7 +159,7 @@ log_operation_session_start() {
     {
         echo ""
         echo "# ========== $command session started at $timestamp =========="
-    } >>"$OPERATIONS_LOG_FILE" 2>/dev/null || true
+    } >> "$OPERATIONS_LOG_FILE" 2> /dev/null || true
 }
 
 # Log session end with summary
@@ -175,14 +175,14 @@ log_operation_session_end() {
 
     local size_human=""
     if [[ "$size" =~ ^[0-9]+$ ]] && [[ "$size" -gt 0 ]]; then
-        size_human=$(bytes_to_human "$((size * 1024))" 2>/dev/null || echo "${size}KB")
+        size_human=$(bytes_to_human "$((size * 1024))" 2> /dev/null || echo "${size}KB")
     else
         size_human="0B"
     fi
 
     {
         echo "# ========== $command session ended at $timestamp, $items items, $size_human =========="
-    } >>"$OPERATIONS_LOG_FILE" 2>/dev/null || true
+    } >> "$OPERATIONS_LOG_FILE" 2> /dev/null || true
 }
 
 # Enhanced debug logging for operations
@@ -200,7 +200,7 @@ debug_operation_start() {
             echo ""
             echo "=== $operation_name ==="
             [[ -n "$operation_desc" ]] && echo "Description: $operation_desc"
-        } >>"$DEBUG_LOG_FILE" 2>/dev/null || true
+        } >> "$DEBUG_LOG_FILE" 2> /dev/null || true
     fi
 }
 
@@ -214,7 +214,7 @@ debug_operation_detail() {
         echo -e "${GRAY}[DEBUG] $detail_type: $detail_value${NC}" >&2
 
         # Also log to file
-        echo "$detail_type: $detail_value" >>"$DEBUG_LOG_FILE" 2>/dev/null || true
+        echo "$detail_type: $detail_value" >> "$DEBUG_LOG_FILE" 2> /dev/null || true
     fi
 }
 
@@ -234,7 +234,7 @@ debug_file_action() {
         echo -e "${GRAY}[DEBUG] $action: $msg${NC}" >&2
 
         # Also log to file
-        echo "$action: $msg" >>"$DEBUG_LOG_FILE" 2>/dev/null || true
+        echo "$action: $msg" >> "$DEBUG_LOG_FILE" 2> /dev/null || true
     fi
 }
 
@@ -246,16 +246,16 @@ debug_risk_level() {
     if [[ "${MO_DEBUG:-}" == "1" ]]; then
         local color="$GRAY"
         case "$risk_level" in
-        LOW) color="$GREEN" ;;
-        MEDIUM) color="$YELLOW" ;;
-        HIGH) color="$RED" ;;
+            LOW) color="$GREEN" ;;
+            MEDIUM) color="$YELLOW" ;;
+            HIGH) color="$RED" ;;
         esac
 
         # Output to stderr with color
         echo -e "${GRAY}[DEBUG] Risk Level: ${color}${risk_level}${GRAY}, $reason${NC}" >&2
 
         # Also log to file
-        echo "Risk Level: $risk_level, $reason" >>"$DEBUG_LOG_FILE" 2>/dev/null || true
+        echo "Risk Level: $risk_level, $reason" >> "$DEBUG_LOG_FILE" 2> /dev/null || true
     fi
 }
 
@@ -267,7 +267,7 @@ log_system_info() {
 
     # Reset debug log file for this new session
     ensure_user_file "$DEBUG_LOG_FILE"
-    if ! : >"$DEBUG_LOG_FILE" 2>/dev/null; then
+    if ! : > "$DEBUG_LOG_FILE" 2> /dev/null; then
         echo -e "${YELLOW}${ICON_WARNING}${NC} Debug log not writable: $DEBUG_LOG_FILE" >&2
     fi
 
@@ -280,19 +280,19 @@ log_system_info() {
         echo "Hostname: $(hostname)"
         echo "Architecture: $(uname -m)"
         echo "Kernel: $(uname -r)"
-        if command -v sw_vers >/dev/null; then
+        if command -v sw_vers > /dev/null; then
             echo "macOS: $(sw_vers -productVersion), $(sw_vers -buildVersion)"
         fi
         echo "Shell: ${SHELL:-unknown}, ${TERM:-unknown}"
 
         # Check sudo status non-interactively
-        if sudo -n true 2>/dev/null; then
+        if sudo -n true 2> /dev/null; then
             echo "Sudo Access: Active"
         else
             echo "Sudo Access: Required"
         fi
         echo "----------------------------------------------------------------------"
-    } >>"$DEBUG_LOG_FILE" 2>/dev/null || true
+    } >> "$DEBUG_LOG_FILE" 2> /dev/null || true
 
     # Notification to stderr
     echo -e "${GRAY}[DEBUG] Debug logging enabled. Session log: $DEBUG_LOG_FILE${NC}" >&2
@@ -304,7 +304,7 @@ log_system_info() {
 
 # Run command silently (ignore errors)
 run_silent() {
-    "$@" >/dev/null 2>&1 || true
+    "$@" > /dev/null 2>&1 || true
 }
 
 # Run command with error logging
@@ -312,12 +312,12 @@ run_logged() {
     local cmd="$1"
     # Log to main file, and also to debug file if enabled
     if [[ "${MO_DEBUG:-}" == "1" ]]; then
-        if ! "$@" 2>&1 | tee -a "$LOG_FILE" | tee -a "$DEBUG_LOG_FILE" >/dev/null; then
+        if ! "$@" 2>&1 | tee -a "$LOG_FILE" | tee -a "$DEBUG_LOG_FILE" > /dev/null; then
             log_warning "Command failed: $cmd"
             return 1
         fi
     else
-        if ! "$@" 2>&1 | tee -a "$LOG_FILE" >/dev/null; then
+        if ! "$@" 2>&1 | tee -a "$LOG_FILE" > /dev/null; then
             log_warning "Command failed: $cmd"
             return 1
         fi
diff --git a/lib/optimize/maintenance.sh b/lib/optimize/maintenance.sh
index 09bd3a7..0cad6b3 100644
--- a/lib/optimize/maintenance.sh
+++ b/lib/optimize/maintenance.sh
@@ -17,16 +17,16 @@ fix_broken_preferences() {
         local filename
         filename=$(basename "$plist_file")
         case "$filename" in
-        com.apple.* | .GlobalPreferences* | loginwindow.plist)
-            continue
-            ;;
+            com.apple.* | .GlobalPreferences* | loginwindow.plist)
+                continue
+                ;;
         esac
 
-        plutil -lint "$plist_file" >/dev/null 2>&1 && continue
+        plutil -lint "$plist_file" > /dev/null 2>&1 && continue
 
-        safe_remove "$plist_file" true >/dev/null 2>&1 || true
+        safe_remove "$plist_file" true > /dev/null 2>&1 || true
         ((broken_count++))
-    done < <(command find "$prefs_dir" -maxdepth 1 -name "*.plist" -type f 2>/dev/null || true)
+    done < <(command find "$prefs_dir" -maxdepth 1 -name "*.plist" -type f 2> /dev/null || true)
 
     # Check ByHost preferences.
     local byhost_dir="$prefs_dir/ByHost"
@@ -37,16 +37,16 @@ fix_broken_preferences() {
             local filename
             filename=$(basename "$plist_file")
             case "$filename" in
-            com.apple.* | .GlobalPreferences*)
-                continue
-                ;;
+                com.apple.* | .GlobalPreferences*)
+                    continue
+                    ;;
             esac
 
-            plutil -lint "$plist_file" >/dev/null 2>&1 && continue
+            plutil -lint "$plist_file" > /dev/null 2>&1 && continue
 
-            safe_remove "$plist_file" true >/dev/null 2>&1 || true
+            safe_remove "$plist_file" true > /dev/null 2>&1 || true
             ((broken_count++))
-        done < <(command find "$byhost_dir" -name "*.plist" -type f 2>/dev/null || true)
+        done < <(command find "$byhost_dir" -name "*.plist" -type f 2> /dev/null || true)
     fi
 
     echo "$broken_count"
diff --git a/lib/uninstall/brew.sh b/lib/uninstall/brew.sh
index 93cf65b..5e2f13f 100644
--- a/lib/uninstall/brew.sh
+++ b/lib/uninstall/brew.sh
@@ -184,13 +184,13 @@ brew_uninstall_cask() {
     local brew_exit=0
 
     # Calculate timeout based on app size (large apps need more time)
-    local timeout=300  # Default 5 minutes
+    local timeout=300 # Default 5 minutes
     if [[ -n "$app_path" && -d "$app_path" ]]; then
         local size_gb=$(($(get_path_size_kb "$app_path") / 1048576))
         if [[ $size_gb -gt 15 ]]; then
-            timeout=900  # 15 minutes for very large apps (Xcode, Adobe, etc.)
+            timeout=900 # 15 minutes for very large apps (Xcode, Adobe, etc.)
         elif [[ $size_gb -gt 5 ]]; then
-            timeout=600  # 10 minutes for large apps
+            timeout=600 # 10 minutes for large apps
         fi
         debug_log "App size: ${size_gb}GB, timeout: ${timeout}s"
     fi