feat: Enhance clean, optimize, analyze, and status commands, and update security audit documentation.

lib/clean/dev.sh

@@ -1,11 +1,7 @@
 #!/bin/bash
 # Developer Tools Cleanup Module
 set -euo pipefail
-# Helper function to clean tool caches using their built-in commands
-# Args: $1 - description, $@ - command to execute
-# Env: DRY_RUN
-#       so we just report the action if we can't easily find a path)
-# Note: Try to estimate potential savings (many tool caches don't have a direct path,
+# Tool cache helper (respects DRY_RUN).
 clean_tool_cache() {
     local description="$1"
     shift
@@ -18,50 +14,38 @@ clean_tool_cache() {
     fi
     return 0
 }
-# Clean npm cache (command + directories)
-# Env: DRY_RUN
-# npm cache clean clears official npm cache, safe_clean handles alternative package managers
+# npm/pnpm/yarn/bun caches.
 clean_dev_npm() {
     if command -v npm > /dev/null 2>&1; then
-        # clean_tool_cache now calculates size before cleanup for better statistics
         clean_tool_cache "npm cache" npm cache clean --force
         note_activity
     fi
     # Clean pnpm store cache
     local pnpm_default_store=~/Library/pnpm/store
     if command -v pnpm > /dev/null 2>&1; then
-        # Use pnpm's built-in prune command
         clean_tool_cache "pnpm cache" pnpm store prune
-        # Get the actual store path to check if default is orphaned
         local pnpm_store_path
         start_section_spinner "Checking store path..."
         pnpm_store_path=$(run_with_timeout 2 pnpm store path 2> /dev/null) || pnpm_store_path=""
         stop_section_spinner
-        # If store path is different from default, clean the orphaned default
         if [[ -n "$pnpm_store_path" && "$pnpm_store_path" != "$pnpm_default_store" ]]; then
             safe_clean "$pnpm_default_store"/* "Orphaned pnpm store"
         fi
     else
-        # pnpm not installed, clean default location
         safe_clean "$pnpm_default_store"/* "pnpm store"
     fi
     note_activity
-    # Clean alternative package manager caches
     safe_clean ~/.tnpm/_cacache/* "tnpm cache directory"
     safe_clean ~/.tnpm/_logs/* "tnpm logs"
     safe_clean ~/.yarn/cache/* "Yarn cache"
     safe_clean ~/.bun/install/cache/* "Bun cache"
 }
-# Clean Python/pip cache (command + directories)
-# Env: DRY_RUN
-# pip cache purge clears official pip cache, safe_clean handles other Python tools
+# Python/pip ecosystem caches.
 clean_dev_python() {
     if command -v pip3 > /dev/null 2>&1; then
-        # clean_tool_cache now calculates size before cleanup for better statistics
         clean_tool_cache "pip cache" bash -c 'pip3 cache purge >/dev/null 2>&1 || true'
         note_activity
     fi
-    # Clean Python ecosystem caches
     safe_clean ~/.pyenv/cache/* "pyenv cache"
     safe_clean ~/.cache/poetry/* "Poetry cache"
     safe_clean ~/.cache/uv/* "uv cache"
@@ -76,28 +60,23 @@ clean_dev_python() {
     safe_clean ~/anaconda3/pkgs/* "Anaconda packages cache"
     safe_clean ~/.cache/wandb/* "Weights & Biases cache"
 }
-# Clean Go cache (command + directories)
-# Env: DRY_RUN
-# go clean handles build and module caches comprehensively
+# Go build/module caches.
 clean_dev_go() {
     if command -v go > /dev/null 2>&1; then
-        # clean_tool_cache now calculates size before cleanup for better statistics
         clean_tool_cache "Go cache" bash -c 'go clean -modcache >/dev/null 2>&1 || true; go clean -cache >/dev/null 2>&1 || true'
         note_activity
     fi
 }
-# Clean Rust/cargo cache directories
+# Rust/cargo caches.
 clean_dev_rust() {
     safe_clean ~/.cargo/registry/cache/* "Rust cargo cache"
     safe_clean ~/.cargo/git/* "Cargo git cache"
     safe_clean ~/.rustup/downloads/* "Rust downloads cache"
 }
-# Env: DRY_RUN
-# Clean Docker cache (command + directories)
+# Docker caches (guarded by daemon check).
 clean_dev_docker() {
     if command -v docker > /dev/null 2>&1; then
         if [[ "$DRY_RUN" != "true" ]]; then
-            # Check if Docker daemon is running (with timeout to prevent hanging)
             start_section_spinner "Checking Docker daemon..."
             local docker_running=false
             if run_with_timeout 3 docker info > /dev/null 2>&1; then
@@ -107,7 +86,6 @@ clean_dev_docker() {
             if [[ "$docker_running" == "true" ]]; then
                 clean_tool_cache "Docker build cache" docker builder prune -af
             else
-                # Docker not running - silently skip without user interaction
                 debug_log "Docker daemon not running, skipping Docker cache cleanup"
             fi
         else
@@ -117,8 +95,7 @@ clean_dev_docker() {
     fi
     safe_clean ~/.docker/buildx/cache/* "Docker BuildX cache"
 }
-# Env: DRY_RUN
-# Clean Nix package manager
+# Nix garbage collection.
 clean_dev_nix() {
     if command -v nix-collect-garbage > /dev/null 2>&1; then
         if [[ "$DRY_RUN" != "true" ]]; then
@@ -129,7 +106,7 @@ clean_dev_nix() {
         note_activity
     fi
 }
-# Clean cloud CLI tools cache
+# Cloud CLI caches.
 clean_dev_cloud() {
     safe_clean ~/.kube/cache/* "Kubernetes cache"
     safe_clean ~/.local/share/containers/storage/tmp/* "Container storage temp"
@@ -137,7 +114,7 @@ clean_dev_cloud() {
     safe_clean ~/.config/gcloud/logs/* "Google Cloud logs"
     safe_clean ~/.azure/logs/* "Azure CLI logs"
 }
-# Clean frontend build tool caches
+# Frontend build caches.
 clean_dev_frontend() {
     safe_clean ~/.cache/typescript/* "TypeScript cache"
     safe_clean ~/.cache/electron/* "Electron cache"
@@ -151,40 +128,29 @@ clean_dev_frontend() {
     safe_clean ~/.cache/eslint/* "ESLint cache"
     safe_clean ~/.cache/prettier/* "Prettier cache"
 }
-# Clean mobile development tools
-# iOS simulator cleanup can free significant space (70GB+ in some cases)
-# Simulator runtime caches can grow large over time
-# DeviceSupport files accumulate for each iOS version connected
+# Mobile dev caches (can be large).
 clean_dev_mobile() {
-    # Clean Xcode unavailable simulators
-    # Removes old and unused local iOS simulator data from old unused runtimes
-    # Can free up significant space (70GB+ in some cases)
     if command -v xcrun > /dev/null 2>&1; then
         debug_log "Checking for unavailable Xcode simulators"
         if [[ "$DRY_RUN" == "true" ]]; then
             clean_tool_cache "Xcode unavailable simulators" xcrun simctl delete unavailable
         else
             start_section_spinner "Checking unavailable simulators..."
-            # Run command manually to control UI output order
             if xcrun simctl delete unavailable > /dev/null 2>&1; then
                 stop_section_spinner
                 echo -e "  ${GREEN}${ICON_SUCCESS}${NC} Xcode unavailable simulators"
             else
                 stop_section_spinner
-                # Silently fail or log error if needed, matching clean_tool_cache behavior
             fi
         fi
         note_activity
     fi
-    # Clean iOS DeviceSupport - more comprehensive cleanup
-    # DeviceSupport directories store debug symbols for each iOS version
-    # Safe to clean caches and logs, but preserve device support files themselves
+    # DeviceSupport caches/logs (preserve core support files).
     safe_clean ~/Library/Developer/Xcode/iOS\ DeviceSupport/*/Symbols/System/Library/Caches/* "iOS device symbol cache"
     safe_clean ~/Library/Developer/Xcode/iOS\ DeviceSupport/*.log "iOS device support logs"
     safe_clean ~/Library/Developer/Xcode/watchOS\ DeviceSupport/*/Symbols/System/Library/Caches/* "watchOS device symbol cache"
     safe_clean ~/Library/Developer/Xcode/tvOS\ DeviceSupport/*/Symbols/System/Library/Caches/* "tvOS device symbol cache"
-    # Clean simulator runtime caches
-    # RuntimeRoot caches can accumulate system library caches
+    # Simulator runtime caches.
     safe_clean ~/Library/Developer/CoreSimulator/Profiles/Runtimes/*/Contents/Resources/RuntimeRoot/System/Library/Caches/* "Simulator runtime cache"
     safe_clean ~/Library/Caches/Google/AndroidStudio*/* "Android Studio cache"
     safe_clean ~/Library/Caches/CocoaPods/* "CocoaPods cache"
@@ -194,14 +160,14 @@ clean_dev_mobile() {
     safe_clean ~/Library/Developer/Xcode/UserData/IB\ Support/* "Xcode Interface Builder cache"
     safe_clean ~/.cache/swift-package-manager/* "Swift package manager cache"
 }
-# Clean JVM ecosystem tools
+# JVM ecosystem caches.
 clean_dev_jvm() {
     safe_clean ~/.gradle/caches/* "Gradle caches"
     safe_clean ~/.gradle/daemon/* "Gradle daemon logs"
     safe_clean ~/.sbt/* "SBT cache"
     safe_clean ~/.ivy2/cache/* "Ivy cache"
 }
-# Clean other language tools
+# Other language tool caches.
 clean_dev_other_langs() {
     safe_clean ~/.bundle/cache/* "Ruby Bundler cache"
     safe_clean ~/.composer/cache/* "PHP Composer cache"
@@ -211,7 +177,7 @@ clean_dev_other_langs() {
     safe_clean ~/.cache/zig/* "Zig cache"
     safe_clean ~/Library/Caches/deno/* "Deno cache"
 }
-# Clean CI/CD and DevOps tools
+# CI/CD and DevOps caches.
 clean_dev_cicd() {
     safe_clean ~/.cache/terraform/* "Terraform cache"
     safe_clean ~/.grafana/cache/* "Grafana cache"
@@ -222,7 +188,7 @@ clean_dev_cicd() {
     safe_clean ~/.circleci/cache/* "CircleCI cache"
     safe_clean ~/.sonar/* "SonarQube cache"
 }
-# Clean database tools
+# Database tool caches.
 clean_dev_database() {
     safe_clean ~/Library/Caches/com.sequel-ace.sequel-ace/* "Sequel Ace cache"
     safe_clean ~/Library/Caches/com.eggerapps.Sequel-Pro/* "Sequel Pro cache"
@@ -231,7 +197,7 @@ clean_dev_database() {
     safe_clean ~/Library/Caches/com.dbeaver.* "DBeaver cache"
     safe_clean ~/Library/Caches/com.redis.RedisInsight "Redis Insight cache"
 }
-# Clean API/network debugging tools
+# API/debugging tool caches.
 clean_dev_api_tools() {
     safe_clean ~/Library/Caches/com.postmanlabs.mac/* "Postman cache"
     safe_clean ~/Library/Caches/com.konghq.insomnia/* "Insomnia cache"
@@ -240,7 +206,7 @@ clean_dev_api_tools() {
     safe_clean ~/Library/Caches/com.charlesproxy.charles/* "Charles Proxy cache"
     safe_clean ~/Library/Caches/com.proxyman.NSProxy/* "Proxyman cache"
 }
-# Clean misc dev tools
+# Misc dev tool caches.
 clean_dev_misc() {
     safe_clean ~/Library/Caches/com.unity3d.*/* "Unity cache"
     safe_clean ~/Library/Caches/com.mongodb.compass/* "MongoDB Compass cache"
@@ -250,7 +216,7 @@ clean_dev_misc() {
     safe_clean ~/Library/Caches/KSCrash/* "KSCrash reports"
     safe_clean ~/Library/Caches/com.crashlytics.data/* "Crashlytics data"
 }
-# Clean shell and version control
+# Shell and VCS leftovers.
 clean_dev_shell() {
     safe_clean ~/.gitconfig.lock "Git config lock"
     safe_clean ~/.gitconfig.bak* "Git config backup"
@@ -260,28 +226,20 @@ clean_dev_shell() {
     safe_clean ~/.zsh_history.bak* "Zsh history backup"
     safe_clean ~/.cache/pre-commit/* "pre-commit cache"
 }
-# Clean network utilities
+# Network tool caches.
 clean_dev_network() {
     safe_clean ~/.cache/curl/* "curl cache"
     safe_clean ~/.cache/wget/* "wget cache"
     safe_clean ~/Library/Caches/curl/* "macOS curl cache"
     safe_clean ~/Library/Caches/wget/* "macOS wget cache"
 }
-# Clean orphaned SQLite temporary files (-shm and -wal files)
-# Strategy: Only clean truly orphaned temp files where base database is missing
-# Env: DRY_RUN
-# This is fast and safe - skip complex checks for files with existing base DB
+# Orphaned SQLite temp files (-shm/-wal). Disabled due to low ROI.
 clean_sqlite_temp_files() {
-    # Skip this cleanup due to low ROI (收益比低，经常没东西可清理)
-    # Find scan is still slow even optimized, and orphaned files are rare
     return 0
 }
-# Main developer tools cleanup function
-# Env: DRY_RUN
-# Calls all specialized cleanup functions
+# Main developer tools cleanup sequence.
 clean_developer_tools() {
     stop_section_spinner
-    # Clean SQLite temporary files first
     clean_sqlite_temp_files
     clean_dev_npm
     clean_dev_python
@@ -292,7 +250,6 @@ clean_developer_tools() {
     clean_dev_nix
     clean_dev_shell
     clean_dev_frontend
-    # Project build caches (delegated to clean_caches module)
     clean_project_caches
     clean_dev_mobile
     clean_dev_jvm
@@ -302,22 +259,17 @@ clean_developer_tools() {
     clean_dev_api_tools
     clean_dev_network
     clean_dev_misc
-    # Homebrew caches and cleanup (delegated to clean_brew module)
     safe_clean ~/Library/Caches/Homebrew/* "Homebrew cache"
-    # Clean Homebrew locks intelligently (avoid repeated sudo prompts)
+    # Clean Homebrew locks without repeated sudo prompts.
     local brew_lock_dirs=(
         "/opt/homebrew/var/homebrew/locks"
         "/usr/local/var/homebrew/locks"
     )
     for lock_dir in "${brew_lock_dirs[@]}"; do
         if [[ -d "$lock_dir" && -w "$lock_dir" ]]; then
-            # User can write, safe to clean
             safe_clean "$lock_dir"/* "Homebrew lock files"
         elif [[ -d "$lock_dir" ]]; then
-            # Directory exists but not writable. Check if empty to avoid noise.
             if find "$lock_dir" -mindepth 1 -maxdepth 1 -print -quit 2> /dev/null | grep -q .; then
-                # Only try sudo ONCE if we really need to, or just skip to avoid spam
-                # Decision: Skip strict system/root owned locks to avoid nag.
                 debug_log "Skipping read-only Homebrew locks in $lock_dir"
             fi
         fi