From e517bf4a3effc0371e2715c5a4327683c9c376ea Mon Sep 17 00:00:00 2001
From: Tw93 <tw93@qq.com>
Date: Tue, 25 Nov 2025 17:25:13 +0800
Subject: [PATCH] format

---
 bin/check.sh              |   1 -
 bin/clean.sh              | 476 +++++++++++++++++++-------------------
 bin/optimize.sh           |   4 +-
 bin/uninstall.sh          |   4 +-
 lib/autofix_manager.sh    |   8 +-
 lib/check_config.sh       |   8 +-
 lib/check_health.sh       |  12 +-
 lib/check_security.sh     |   8 +-
 lib/check_updates.sh      |  30 +--
 lib/common.sh             |  38 +--
 lib/menu_paginated.sh     |   6 +-
 lib/menu_simple.sh        |   6 +-
 lib/optimization_tasks.sh |  33 +--
 lib/sudo_manager.sh       |   2 +-
 lib/update_manager.sh     |  15 +-
 tests/whitelist.bats      |   6 +-
 16 files changed, 331 insertions(+), 326 deletions(-)

diff --git a/bin/check.sh b/bin/check.sh
index 361337d..abd9141 100755
--- a/bin/check.sh
+++ b/bin/check.sh
@@ -90,5 +90,4 @@ main() {
     printf '\n'
 }
 
-
 main "$@"
diff --git a/bin/clean.sh b/bin/clean.sh
index 1569014..a443144 100755
--- a/bin/clean.sh
+++ b/bin/clean.sh
@@ -666,8 +666,8 @@ perform_cleanup() {
         fi
 
         # Mark permissions as granted (won't prompt again)
-        mkdir -p "$(dirname "$permission_flag")" 2>/dev/null || true
-        touch "$permission_flag" 2>/dev/null || true
+        mkdir -p "$(dirname "$permission_flag")" 2> /dev/null || true
+        touch "$permission_flag" 2> /dev/null || true
     fi
 
     # Show whitelist info if patterns are active
@@ -730,7 +730,7 @@ perform_cleanup() {
 
             # Check if cache is valid (less than 2 days old)
             if [[ -f "$cask_cache" ]]; then
-                local cache_age=$(( $(date +%s) - $(stat -f%m "$cask_cache") ))
+                local cache_age=$(($(date +%s) - $(stat -f%m "$cask_cache")))
                 if [[ $cache_age -lt 172800 ]]; then
                     use_cache=true
                 fi
@@ -750,7 +750,7 @@ perform_cleanup() {
                 while IFS= read -r cask; do
                     # Get app path from cask info
                     local cask_info
-                    cask_info=$(brew info --cask "$cask" 2>/dev/null || true)
+                    cask_info=$(brew info --cask "$cask" 2> /dev/null || true)
 
                     # Extract app name from "AppName.app (App)" format
                     local app_name
@@ -764,13 +764,13 @@ perform_cleanup() {
 
                     # Check if app exists
                     [[ ! -e "/Applications/$app_name" ]] && orphaned_casks+=("$cask")
-                done < <(brew list --cask 2>/dev/null || true)
+                done < <(brew list --cask 2> /dev/null || true)
             fi
 
             # Remove orphaned casks if found
             if [[ ${#orphaned_casks[@]} -gt 0 ]]; then
                 # Check if sudo session is still valid (without prompting)
-                if sudo -n true 2>/dev/null; then
+                if sudo -n true 2> /dev/null; then
                     if [[ -t 1 ]]; then
                         stop_inline_spinner
                         MOLE_SPINNER_PREFIX="  " start_inline_spinner "Cleaning orphaned casks..."
@@ -1041,7 +1041,7 @@ perform_cleanup() {
 
             if [[ -f "$brew_cache_file" ]]; then
                 local last_cleanup
-                last_cleanup=$(cat "$brew_cache_file" 2>/dev/null || echo "0")
+                last_cleanup=$(cat "$brew_cache_file" 2> /dev/null || echo "0")
                 local current_time
                 current_time=$(date +%s)
                 local time_diff=$((current_time - last_cleanup))
@@ -1058,73 +1058,73 @@ perform_cleanup() {
 
                 local timeout_seconds=${MO_BREW_TIMEOUT:-120}
 
-            # Run brew cleanup and autoremove in parallel
-            local brew_tmp_file autoremove_tmp_file
-            brew_tmp_file=$(create_temp_file)
-            autoremove_tmp_file=$(create_temp_file)
+                # Run brew cleanup and autoremove in parallel
+                local brew_tmp_file autoremove_tmp_file
+                brew_tmp_file=$(create_temp_file)
+                autoremove_tmp_file=$(create_temp_file)
 
-            (brew cleanup > "$brew_tmp_file" 2>&1) &
-            local brew_pid=$!
+                (brew cleanup > "$brew_tmp_file" 2>&1) &
+                local brew_pid=$!
 
-            (brew autoremove > "$autoremove_tmp_file" 2>&1) &
-            local autoremove_pid=$!
+                (brew autoremove > "$autoremove_tmp_file" 2>&1) &
+                local autoremove_pid=$!
 
-            local elapsed=0
-            local brew_done=false
-            local autoremove_done=false
+                local elapsed=0
+                local brew_done=false
+                local autoremove_done=false
 
-            # Wait for both to complete or timeout
-            while [[ "$brew_done" == "false" ]] || [[ "$autoremove_done" == "false" ]]; do
-                if [[ $elapsed -ge $timeout_seconds ]]; then
-                    kill -TERM $brew_pid $autoremove_pid 2> /dev/null || true
-                    break
-                fi
-
-                kill -0 $brew_pid 2> /dev/null || brew_done=true
-                kill -0 $autoremove_pid 2> /dev/null || autoremove_done=true
-
-                sleep 1
-                ((elapsed++))
-            done
-
-            # Wait for processes to finish
-            wait $brew_pid 2> /dev/null && local brew_success=true || local brew_success=false
-            wait $autoremove_pid 2> /dev/null && local autoremove_success=true || local autoremove_success=false
-
-            if [[ -t 1 ]]; then stop_inline_spinner; fi
-
-            # Process cleanup output
-            if [[ "$brew_success" == "true" && -f "$brew_tmp_file" ]]; then
-                local brew_output
-                brew_output=$(cat "$brew_tmp_file" 2> /dev/null || echo "")
-                local removed_count freed_space
-                removed_count=$(printf '%s\n' "$brew_output" | grep -c "Removing:" 2> /dev/null || true)
-                freed_space=$(printf '%s\n' "$brew_output" | grep -o "[0-9.]*[KMGT]B freed" 2> /dev/null | tail -1 || true)
-
-                if [[ $removed_count -gt 0 ]] || [[ -n "$freed_space" ]]; then
-                    if [[ -n "$freed_space" ]]; then
-                        echo -e "  ${GREEN}${ICON_SUCCESS}${NC} Homebrew cleanup ${GREEN}($freed_space)${NC}"
-                    else
-                        echo -e "  ${GREEN}${ICON_SUCCESS}${NC} Homebrew cleanup (${removed_count} items)"
+                # Wait for both to complete or timeout
+                while [[ "$brew_done" == "false" ]] || [[ "$autoremove_done" == "false" ]]; do
+                    if [[ $elapsed -ge $timeout_seconds ]]; then
+                        kill -TERM $brew_pid $autoremove_pid 2> /dev/null || true
+                        break
                     fi
-                fi
-            elif [[ $elapsed -ge $timeout_seconds ]]; then
-                echo -e "  ${YELLOW}${ICON_WARNING}${NC} Homebrew cleanup timed out (run ${GRAY}brew cleanup${NC} manually)"
-            fi
 
-            # Process autoremove output - only show if packages were removed
-            if [[ "$autoremove_success" == "true" && -f "$autoremove_tmp_file" ]]; then
-                local autoremove_output
-                autoremove_output=$(cat "$autoremove_tmp_file" 2> /dev/null || echo "")
-                local removed_packages
-                removed_packages=$(printf '%s\n' "$autoremove_output" | grep -c "^Uninstalling" 2> /dev/null || true)
+                    kill -0 $brew_pid 2> /dev/null || brew_done=true
+                    kill -0 $autoremove_pid 2> /dev/null || autoremove_done=true
 
-                if [[ $removed_packages -gt 0 ]]; then
-                    echo -e "  ${GREEN}${ICON_SUCCESS}${NC} Removed orphaned dependencies (${removed_packages} packages)"
+                    sleep 1
+                    ((elapsed++))
+                done
+
+                # Wait for processes to finish
+                wait $brew_pid 2> /dev/null && local brew_success=true || local brew_success=false
+                wait $autoremove_pid 2> /dev/null && local autoremove_success=true || local autoremove_success=false
+
+                if [[ -t 1 ]]; then stop_inline_spinner; fi
+
+                # Process cleanup output
+                if [[ "$brew_success" == "true" && -f "$brew_tmp_file" ]]; then
+                    local brew_output
+                    brew_output=$(cat "$brew_tmp_file" 2> /dev/null || echo "")
+                    local removed_count freed_space
+                    removed_count=$(printf '%s\n' "$brew_output" | grep -c "Removing:" 2> /dev/null || true)
+                    freed_space=$(printf '%s\n' "$brew_output" | grep -o "[0-9.]*[KMGT]B freed" 2> /dev/null | tail -1 || true)
+
+                    if [[ $removed_count -gt 0 ]] || [[ -n "$freed_space" ]]; then
+                        if [[ -n "$freed_space" ]]; then
+                            echo -e "  ${GREEN}${ICON_SUCCESS}${NC} Homebrew cleanup ${GREEN}($freed_space)${NC}"
+                        else
+                            echo -e "  ${GREEN}${ICON_SUCCESS}${NC} Homebrew cleanup (${removed_count} items)"
+                        fi
+                    fi
+                elif [[ $elapsed -ge $timeout_seconds ]]; then
+                    echo -e "  ${YELLOW}${ICON_WARNING}${NC} Homebrew cleanup timed out (run ${GRAY}brew cleanup${NC} manually)"
+                fi
+
+                # Process autoremove output - only show if packages were removed
+                if [[ "$autoremove_success" == "true" && -f "$autoremove_tmp_file" ]]; then
+                    local autoremove_output
+                    autoremove_output=$(cat "$autoremove_tmp_file" 2> /dev/null || echo "")
+                    local removed_packages
+                    removed_packages=$(printf '%s\n' "$autoremove_output" | grep -c "^Uninstalling" 2> /dev/null || true)
+
+                    if [[ $removed_packages -gt 0 ]]; then
+                        echo -e "  ${GREEN}${ICON_SUCCESS}${NC} Removed orphaned dependencies (${removed_packages} packages)"
+                    fi
+                elif [[ $elapsed -ge $timeout_seconds ]]; then
+                    echo -e "  ${YELLOW}${ICON_WARNING}${NC} Autoremove timed out (run ${GRAY}brew autoremove${NC} manually)"
                 fi
-            elif [[ $elapsed -ge $timeout_seconds ]]; then
-                echo -e "  ${YELLOW}${ICON_WARNING}${NC} Autoremove timed out (run ${GRAY}brew autoremove${NC} manually)"
-            fi
 
                 # Update cache timestamp on successful completion
                 if [[ "$brew_success" == "true" || "$autoremove_success" == "true" ]]; then
@@ -1185,16 +1185,16 @@ perform_cleanup() {
     local find_timeout=10
     local elapsed=0
 
-    while kill -0 $find_pid 2>/dev/null && [[ $elapsed -lt $find_timeout ]]; do
+    while kill -0 $find_pid 2> /dev/null && [[ $elapsed -lt $find_timeout ]]; do
         sleep 1
         ((elapsed++))
     done
 
-    if kill -0 $find_pid 2>/dev/null; then
-        kill -TERM $find_pid 2>/dev/null || true
-        wait $find_pid 2>/dev/null || true
+    if kill -0 $find_pid 2> /dev/null; then
+        kill -TERM $find_pid 2> /dev/null || true
+        wait $find_pid 2> /dev/null || true
     else
-        wait $find_pid 2>/dev/null || true
+        wait $find_pid 2> /dev/null || true
     fi
 
     while IFS= read -r next_dir; do
@@ -1226,16 +1226,16 @@ perform_cleanup() {
     local find_timeout=10
     local elapsed=0
 
-    while kill -0 $find_pid 2>/dev/null && [[ $elapsed -lt $find_timeout ]]; do
+    while kill -0 $find_pid 2> /dev/null && [[ $elapsed -lt $find_timeout ]]; do
         sleep 1
         ((elapsed++))
     done
 
-    if kill -0 $find_pid 2>/dev/null; then
-        kill -TERM $find_pid 2>/dev/null || true
-        wait $find_pid 2>/dev/null || true
+    if kill -0 $find_pid 2> /dev/null; then
+        kill -TERM $find_pid 2> /dev/null || true
+        wait $find_pid 2> /dev/null || true
     else
-        wait $find_pid 2>/dev/null || true
+        wait $find_pid 2> /dev/null || true
     fi
 
     while IFS= read -r pycache; do
@@ -1467,29 +1467,29 @@ perform_cleanup() {
     # Use simple ls test instead of find to avoid hanging
     if [[ -d "$HOME/Library/Application Support" ]] && ls "$HOME/Library/Application Support" > /dev/null 2>&1; then
 
-    # Clean log directories for apps that store logs in Application Support
-    for app_dir in ~/Library/Application\ Support/*; do
-        [[ -d "$app_dir" ]] || continue
-        app_name=$(basename "$app_dir")
+        # Clean log directories for apps that store logs in Application Support
+        for app_dir in ~/Library/Application\ Support/*; do
+            [[ -d "$app_dir" ]] || continue
+            app_name=$(basename "$app_dir")
 
-        # Skip system and protected apps
-        case "$app_name" in
-            com.apple.* | Adobe* | JetBrains* | 1Password | Claude | *ClashX* | *clash* | mihomo* | *Surge* | iTerm* | *iterm* | Warp* | Kitty* | Alacritty* | WezTerm* | Ghostty*)
-                continue
-                ;;
-        esac
+            # Skip system and protected apps
+            case "$app_name" in
+                com.apple.* | Adobe* | JetBrains* | 1Password | Claude | *ClashX* | *clash* | mihomo* | *Surge* | iTerm* | *iterm* | Warp* | Kitty* | Alacritty* | WezTerm* | Ghostty*)
+                    continue
+                    ;;
+            esac
 
-        # Clean common log directories
-        if [[ -d "$app_dir/log" ]]; then
-            safe_clean "$app_dir/log"/* "App logs: $app_name"
-        fi
-        if [[ -d "$app_dir/logs" ]]; then
-            safe_clean "$app_dir/logs"/* "App logs: $app_name"
-        fi
-        if [[ -d "$app_dir/activitylog" ]]; then
-            safe_clean "$app_dir/activitylog"/* "Activity logs: $app_name"
-        fi
-    done
+            # Clean common log directories
+            if [[ -d "$app_dir/log" ]]; then
+                safe_clean "$app_dir/log"/* "App logs: $app_name"
+            fi
+            if [[ -d "$app_dir/logs" ]]; then
+                safe_clean "$app_dir/logs"/* "App logs: $app_name"
+            fi
+            if [[ -d "$app_dir/activitylog" ]]; then
+                safe_clean "$app_dir/activitylog"/* "Activity logs: $app_name"
+            fi
+        done
 
     else
         note_activity
@@ -1516,173 +1516,173 @@ perform_cleanup() {
         echo -e "  ${GRAY}Tip: Grant 'Full Disk Access' to iTerm2/Terminal in System Settings${NC}"
     else
 
-    local -r ORPHAN_AGE_THRESHOLD=60 # 60 days - good balance between safety and cleanup
+        local -r ORPHAN_AGE_THRESHOLD=60 # 60 days - good balance between safety and cleanup
 
-    # Build list of installed application bundle identifiers
-    MOLE_SPINNER_PREFIX="  " start_inline_spinner "Scanning installed applications..."
-    local installed_bundles=$(create_temp_file)
+        # Build list of installed application bundle identifiers
+        MOLE_SPINNER_PREFIX="  " start_inline_spinner "Scanning installed applications..."
+        local installed_bundles=$(create_temp_file)
 
-    # Simplified: only scan primary locations (reduces scan time by ~70%)
-    local -a search_paths=(
-        "/Applications"
-        "$HOME/Applications"
-    )
+        # Simplified: only scan primary locations (reduces scan time by ~70%)
+        local -a search_paths=(
+            "/Applications"
+            "$HOME/Applications"
+        )
 
-    # Scan for .app bundles with timeout protection
-    for search_path in "${search_paths[@]}"; do
-        [[ -d "$search_path" ]] || continue
-        while IFS= read -r app; do
-            [[ -f "$app/Contents/Info.plist" ]] || continue
-            bundle_id=$(defaults read "$app/Contents/Info.plist" CFBundleIdentifier 2> /dev/null || echo "")
-            [[ -n "$bundle_id" ]] && echo "$bundle_id" >> "$installed_bundles"
-        done < <(run_with_timeout 10 find "$search_path" -maxdepth 2 -type d -name "*.app" 2> /dev/null || true)
-    done
+        # Scan for .app bundles with timeout protection
+        for search_path in "${search_paths[@]}"; do
+            [[ -d "$search_path" ]] || continue
+            while IFS= read -r app; do
+                [[ -f "$app/Contents/Info.plist" ]] || continue
+                bundle_id=$(defaults read "$app/Contents/Info.plist" CFBundleIdentifier 2> /dev/null || echo "")
+                [[ -n "$bundle_id" ]] && echo "$bundle_id" >> "$installed_bundles"
+            done < <(run_with_timeout 10 find "$search_path" -maxdepth 2 -type d -name "*.app" 2> /dev/null || true)
+        done
 
-    # Get running applications and LaunchAgents with timeout protection
-    local running_apps=$(run_with_timeout 5 osascript -e 'tell application "System Events" to get bundle identifier of every application process' 2> /dev/null || echo "")
-    echo "$running_apps" | tr ',' '\n' | sed -e 's/^ *//;s/ *$//' -e '/^$/d' >> "$installed_bundles"
+        # Get running applications and LaunchAgents with timeout protection
+        local running_apps=$(run_with_timeout 5 osascript -e 'tell application "System Events" to get bundle identifier of every application process' 2> /dev/null || echo "")
+        echo "$running_apps" | tr ',' '\n' | sed -e 's/^ *//;s/ *$//' -e '/^$/d' >> "$installed_bundles"
 
-    run_with_timeout 5 find ~/Library/LaunchAgents /Library/LaunchAgents \
-        -name "*.plist" -type f 2> /dev/null | while IFS= read -r plist; do
-        basename "$plist" .plist
-    done >> "$installed_bundles" 2> /dev/null || true
+        run_with_timeout 5 find ~/Library/LaunchAgents /Library/LaunchAgents \
+            -name "*.plist" -type f 2> /dev/null | while IFS= read -r plist; do
+            basename "$plist" .plist
+        done >> "$installed_bundles" 2> /dev/null || true
 
-    # Deduplicate
-    sort -u "$installed_bundles" -o "$installed_bundles"
+        # Deduplicate
+        sort -u "$installed_bundles" -o "$installed_bundles"
 
-    local app_count=$(wc -l < "$installed_bundles" 2> /dev/null | tr -d ' ')
-    stop_inline_spinner
-    echo -e "  ${GREEN}${ICON_SUCCESS}${NC} Found $app_count active/installed apps"
+        local app_count=$(wc -l < "$installed_bundles" 2> /dev/null | tr -d ' ')
+        stop_inline_spinner
+        echo -e "  ${GREEN}${ICON_SUCCESS}${NC} Found $app_count active/installed apps"
 
-    # Track statistics
-    local orphaned_count=0
-    local total_orphaned_kb=0
+        # Track statistics
+        local orphaned_count=0
+        local total_orphaned_kb=0
 
-    # Check if bundle is orphaned - conservative approach
-    is_orphaned() {
-        local bundle_id="$1"
-        local directory_path="$2"
+        # Check if bundle is orphaned - conservative approach
+        is_orphaned() {
+            local bundle_id="$1"
+            local directory_path="$2"
 
-        # Skip system-critical and protected apps
-        if should_protect_data "$bundle_id"; then
-            return 1
-        fi
-
-        # Check if app exists in our scan
-        if grep -q "^$bundle_id$" "$installed_bundles" 2> /dev/null; then
-            return 1
-        fi
-
-        # Extra check for system bundles
-        case "$bundle_id" in
-            com.apple.* | loginwindow | dock | systempreferences | finder | safari)
-                return 1
-                ;;
-        esac
-
-        # Skip major vendors
-        case "$bundle_id" in
-            com.adobe.* | com.microsoft.* | com.google.* | org.mozilla.* | com.jetbrains.* | com.docker.*)
-                return 1
-                ;;
-        esac
-
-        # Check file age - only clean if 60+ days inactive
-        # Use modification time (mtime) instead of access time (atime)
-        # because macOS disables atime updates by default for performance
-        if [[ -e "$directory_path" ]]; then
-            local last_modified_epoch=$(stat -f%m "$directory_path" 2> /dev/null || echo "0")
-            local current_epoch=$(date +%s)
-            local days_since_modified=$(((current_epoch - last_modified_epoch) / 86400))
-
-            if [[ $days_since_modified -lt $ORPHAN_AGE_THRESHOLD ]]; then
+            # Skip system-critical and protected apps
+            if should_protect_data "$bundle_id"; then
                 return 1
             fi
-        fi
 
-        return 0
-    }
+            # Check if app exists in our scan
+            if grep -q "^$bundle_id$" "$installed_bundles" 2> /dev/null; then
+                return 1
+            fi
 
-    # Unified orphaned resource scanner (caches, logs, states, webkit, HTTP, cookies)
-    MOLE_SPINNER_PREFIX="  " start_inline_spinner "Scanning orphaned app resources..."
+            # Extra check for system bundles
+            case "$bundle_id" in
+                com.apple.* | loginwindow | dock | systempreferences | finder | safari)
+                    return 1
+                    ;;
+            esac
 
-    # Define resource types to scan
-    local -a resource_types=(
-        "$HOME/Library/Caches|Caches|com.*:org.*:net.*:io.*"
-        "$HOME/Library/Logs|Logs|com.*:org.*:net.*:io.*"
-        "$HOME/Library/Saved Application State|States|*.savedState"
-        "$HOME/Library/WebKit|WebKit|com.*:org.*:net.*:io.*"
-        "$HOME/Library/HTTPStorages|HTTP|com.*:org.*:net.*:io.*"
-        "$HOME/Library/Cookies|Cookies|*.binarycookies"
-    )
+            # Skip major vendors
+            case "$bundle_id" in
+                com.adobe.* | com.microsoft.* | com.google.* | org.mozilla.* | com.jetbrains.* | com.docker.*)
+                    return 1
+                    ;;
+            esac
 
-    orphaned_count=0
+            # Check file age - only clean if 60+ days inactive
+            # Use modification time (mtime) instead of access time (atime)
+            # because macOS disables atime updates by default for performance
+            if [[ -e "$directory_path" ]]; then
+                local last_modified_epoch=$(stat -f%m "$directory_path" 2> /dev/null || echo "0")
+                local current_epoch=$(date +%s)
+                local days_since_modified=$(((current_epoch - last_modified_epoch) / 86400))
 
-    for resource_type in "${resource_types[@]}"; do
-        IFS='|' read -r base_path label patterns <<< "$resource_type"
-
-        # Check both existence and permission to avoid hanging
-        if [[ ! -d "$base_path" ]]; then
-            continue
-        fi
-
-        # Quick permission check - if we can't ls the directory, skip it
-        if ! ls "$base_path" > /dev/null 2>&1; then
-            continue
-        fi
-
-        # Build file pattern array
-        local -a file_patterns=()
-        IFS=':' read -ra pattern_arr <<< "$patterns"
-        for pat in "${pattern_arr[@]}"; do
-            file_patterns+=("$base_path/$pat")
-        done
-
-        # Scan and clean orphaned items
-        for item_path in "${file_patterns[@]}"; do
-            # Use shell glob (no ls needed)
-            # Limit iterations to prevent hanging on directories with too many files
-            local iteration_count=0
-            local max_iterations=100
-
-            for match in $item_path; do
-                [[ -e "$match" ]] || continue
-
-                # Safety: limit iterations to prevent infinite loops on massive directories
-                ((iteration_count++))
-                if [[ $iteration_count -gt $max_iterations ]]; then
-                    break
+                if [[ $days_since_modified -lt $ORPHAN_AGE_THRESHOLD ]]; then
+                    return 1
                 fi
+            fi
 
-                # Extract bundle ID from filename
-                local bundle_id=$(basename "$match")
-                bundle_id="${bundle_id%.savedState}"
-                bundle_id="${bundle_id%.binarycookies}"
+            return 0
+        }
 
-                if is_orphaned "$bundle_id" "$match"; then
-                    # Use timeout to prevent du from hanging on large/problematic directories
-                    local size_kb
-                    size_kb=$(run_with_timeout 2 du -sk "$match" 2> /dev/null | awk '{print $1}' || echo "0")
-                    if [[ -z "$size_kb" || "$size_kb" == "0" ]]; then
-                        continue
+        # Unified orphaned resource scanner (caches, logs, states, webkit, HTTP, cookies)
+        MOLE_SPINNER_PREFIX="  " start_inline_spinner "Scanning orphaned app resources..."
+
+        # Define resource types to scan
+        local -a resource_types=(
+            "$HOME/Library/Caches|Caches|com.*:org.*:net.*:io.*"
+            "$HOME/Library/Logs|Logs|com.*:org.*:net.*:io.*"
+            "$HOME/Library/Saved Application State|States|*.savedState"
+            "$HOME/Library/WebKit|WebKit|com.*:org.*:net.*:io.*"
+            "$HOME/Library/HTTPStorages|HTTP|com.*:org.*:net.*:io.*"
+            "$HOME/Library/Cookies|Cookies|*.binarycookies"
+        )
+
+        orphaned_count=0
+
+        for resource_type in "${resource_types[@]}"; do
+            IFS='|' read -r base_path label patterns <<< "$resource_type"
+
+            # Check both existence and permission to avoid hanging
+            if [[ ! -d "$base_path" ]]; then
+                continue
+            fi
+
+            # Quick permission check - if we can't ls the directory, skip it
+            if ! ls "$base_path" > /dev/null 2>&1; then
+                continue
+            fi
+
+            # Build file pattern array
+            local -a file_patterns=()
+            IFS=':' read -ra pattern_arr <<< "$patterns"
+            for pat in "${pattern_arr[@]}"; do
+                file_patterns+=("$base_path/$pat")
+            done
+
+            # Scan and clean orphaned items
+            for item_path in "${file_patterns[@]}"; do
+                # Use shell glob (no ls needed)
+                # Limit iterations to prevent hanging on directories with too many files
+                local iteration_count=0
+                local max_iterations=100
+
+                for match in $item_path; do
+                    [[ -e "$match" ]] || continue
+
+                    # Safety: limit iterations to prevent infinite loops on massive directories
+                    ((iteration_count++))
+                    if [[ $iteration_count -gt $max_iterations ]]; then
+                        break
                     fi
-                    safe_clean "$match" "Orphaned $label: $bundle_id"
-                    ((orphaned_count++))
-                    ((total_orphaned_kb += size_kb))
-                fi
+
+                    # Extract bundle ID from filename
+                    local bundle_id=$(basename "$match")
+                    bundle_id="${bundle_id%.savedState}"
+                    bundle_id="${bundle_id%.binarycookies}"
+
+                    if is_orphaned "$bundle_id" "$match"; then
+                        # Use timeout to prevent du from hanging on large/problematic directories
+                        local size_kb
+                        size_kb=$(run_with_timeout 2 du -sk "$match" 2> /dev/null | awk '{print $1}' || echo "0")
+                        if [[ -z "$size_kb" || "$size_kb" == "0" ]]; then
+                            continue
+                        fi
+                        safe_clean "$match" "Orphaned $label: $bundle_id"
+                        ((orphaned_count++))
+                        ((total_orphaned_kb += size_kb))
+                    fi
+                done
             done
         done
-    done
 
-    stop_inline_spinner
+        stop_inline_spinner
 
-    if [[ $orphaned_count -gt 0 ]]; then
-        local orphaned_mb=$(echo "$total_orphaned_kb" | awk '{printf "%.1f", $1/1024}')
-        echo "  ${GREEN}${ICON_SUCCESS}${NC} Cleaned $orphaned_count items (~${orphaned_mb}MB)"
-        note_activity
-    fi
+        if [[ $orphaned_count -gt 0 ]]; then
+            local orphaned_mb=$(echo "$total_orphaned_kb" | awk '{printf "%.1f", $1/1024}')
+            echo "  ${GREEN}${ICON_SUCCESS}${NC} Cleaned $orphaned_count items (~${orphaned_mb}MB)"
+            note_activity
+        fi
 
-    rm -f "$installed_bundles"
+        rm -f "$installed_bundles"
 
     fi # end of has_library_access check
 
diff --git a/bin/optimize.sh b/bin/optimize.sh
index 2bddc15..94eb66a 100755
--- a/bin/optimize.sh
+++ b/bin/optimize.sh
@@ -73,7 +73,7 @@ run_system_checks() {
 show_optimization_summary() {
     local safe_count="${OPTIMIZE_SAFE_COUNT:-0}"
     local confirm_count="${OPTIMIZE_CONFIRM_COUNT:-0}"
-    if (( safe_count == 0 && confirm_count == 0 )) && [[ -z "${AUTO_FIX_SUMMARY:-}" ]]; then
+    if ((safe_count == 0 && confirm_count == 0)) && [[ -z "${AUTO_FIX_SUMMARY:-}" ]]; then
         return
     fi
     echo ""
@@ -104,7 +104,6 @@ show_optimization_summary() {
     print_summary_block "success" "$summary_title" "${summary_details[@]}"
 }
 
-
 show_system_health() {
     local health_json="$1"
 
@@ -315,7 +314,6 @@ perform_security_fixes() {
     SECURITY_FIXES=()
 }
 
-
 cleanup_all() {
     stop_sudo_session
     cleanup_temp_files
diff --git a/bin/uninstall.sh b/bin/uninstall.sh
index 376bfcf..3a4c950 100755
--- a/bin/uninstall.sh
+++ b/bin/uninstall.sh
@@ -692,7 +692,7 @@ main() {
         fi
         show_cursor
         clear_screen
-        printf '\033[2J\033[H' >&2  # Also clear stderr
+        printf '\033[2J\033[H' >&2 # Also clear stderr
         rm -f "$apps_file"
         return 0
     fi
@@ -707,7 +707,7 @@ main() {
     # Restore cursor and clear screen (output to both stdout and stderr for reliability)
     show_cursor
     clear_screen
-    printf '\033[2J\033[H' >&2  # Also clear stderr in case of mixed output
+    printf '\033[2J\033[H' >&2 # Also clear stderr in case of mixed output
     local selection_count=${#selected_apps[@]}
     if [[ $selection_count -eq 0 ]]; then
         echo "No apps selected"
diff --git a/lib/autofix_manager.sh b/lib/autofix_manager.sh
index 89bdf64..928e1f7 100644
--- a/lib/autofix_manager.sh
+++ b/lib/autofix_manager.sh
@@ -39,7 +39,7 @@ show_suggestions() {
     # Health suggestions
     if [[ -n "${CACHE_SIZE_GB:-}" ]]; then
         local cache_gb="${CACHE_SIZE_GB:-0}"
-        if (( $(echo "$cache_gb > 5" | bc -l 2>/dev/null || echo 0) )); then
+        if (($(echo "$cache_gb > 5" | bc -l 2> /dev/null || echo 0))); then
             manual_items+=("Free up ${cache_gb}GB by cleaning caches|Run: mo clean")
             has_suggestions=true
         fi
@@ -51,7 +51,7 @@ show_suggestions() {
     fi
 
     if [[ -n "${DISK_FREE_GB:-}" && "${DISK_FREE_GB:-0}" -lt 50 ]]; then
-        if [[ -z "${CACHE_SIZE_GB:-}" ]] || (( $(echo "${CACHE_SIZE_GB:-0} <= 5" | bc -l 2>/dev/null || echo 1) )); then
+        if [[ -z "${CACHE_SIZE_GB:-}" ]] || (($(echo "${CACHE_SIZE_GB:-0} <= 5" | bc -l 2> /dev/null || echo 1))); then
             manual_items+=("Low disk space (${DISK_FREE_GB}GB free)|Run: mo analyze to find large files")
             has_suggestions=true
         fi
@@ -132,7 +132,7 @@ perform_auto_fix() {
     # Fix Firewall
     if [[ -n "${FIREWALL_DISABLED:-}" && "${FIREWALL_DISABLED}" == "true" ]]; then
         echo -e "${BLUE}Enabling Firewall...${NC}"
-        if sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 1 2>/dev/null; then
+        if sudo defaults write /Library/Preferences/com.apple.alf globalstate -int 1 2> /dev/null; then
             echo -e "${GREEN}✓${NC} Firewall enabled"
             ((fixed_count++))
             fixed_items+=("Firewall enabled")
@@ -148,7 +148,7 @@ perform_auto_fix() {
         local pam_file="/etc/pam.d/sudo"
         if sudo bash -c "grep -q 'pam_tid.so' '$pam_file' 2>/dev/null || sed -i '' '2i\\
 auth       sufficient     pam_tid.so
-' '$pam_file'" 2>/dev/null; then
+' '$pam_file'" 2> /dev/null; then
             echo -e "${GREEN}✓${NC} Touch ID configured"
             ((fixed_count++))
             fixed_items+=("Touch ID configured for sudo")
diff --git a/lib/check_config.sh b/lib/check_config.sh
index 308fa12..5a9cd6e 100644
--- a/lib/check_config.sh
+++ b/lib/check_config.sh
@@ -5,13 +5,13 @@
 check_touchid_sudo() {
     # Check if Touch ID is configured for sudo
     local pam_file="/etc/pam.d/sudo"
-    if [[ -f "$pam_file" ]] && grep -q "pam_tid.so" "$pam_file" 2>/dev/null; then
+    if [[ -f "$pam_file" ]] && grep -q "pam_tid.so" "$pam_file" 2> /dev/null; then
         echo -e "  ${GREEN}✓${NC} Touch ID     Enabled for sudo"
     else
         # Check if Touch ID is supported
         local is_supported=false
         if command -v bioutil > /dev/null 2>&1; then
-            if bioutil -r 2>/dev/null | grep -q "Touch ID"; then
+            if bioutil -r 2> /dev/null | grep -q "Touch ID"; then
                 is_supported=true
             fi
         elif [[ "$(uname -m)" == "arm64" ]]; then
@@ -40,8 +40,8 @@ check_rosetta() {
 check_git_config() {
     # Check basic Git configuration
     if command -v git > /dev/null 2>&1; then
-        local git_name=$(git config --global user.name 2>/dev/null || echo "")
-        local git_email=$(git config --global user.email 2>/dev/null || echo "")
+        local git_name=$(git config --global user.name 2> /dev/null || echo "")
+        local git_email=$(git config --global user.email 2> /dev/null || echo "")
 
         if [[ -n "$git_name" && -n "$git_email" ]]; then
             echo -e "  ${GREEN}✓${NC} Git Config   Configured"
diff --git a/lib/check_health.sh b/lib/check_health.sh
index 031c096..87f4607 100644
--- a/lib/check_health.sh
+++ b/lib/check_health.sh
@@ -20,14 +20,14 @@ check_disk_space() {
 
 check_memory_usage() {
     local mem_total
-    mem_total=$(sysctl -n hw.memsize 2>/dev/null || echo "0")
+    mem_total=$(sysctl -n hw.memsize 2> /dev/null || echo "0")
     if [[ -z "$mem_total" || "$mem_total" -le 0 ]]; then
         echo -e "  ${GRAY}-${NC} Memory       Unable to determine"
         return
     fi
 
     local vm_output
-    vm_output=$(vm_stat 2>/dev/null || echo "")
+    vm_output=$(vm_stat 2> /dev/null || echo "")
 
     local page_size
     page_size=$(echo "$vm_output" | awk '/page size of/ {print $8}')
@@ -133,7 +133,7 @@ check_cache_size() {
     for cache_path in "${cache_paths[@]}"; do
         if [[ -d "$cache_path" ]]; then
             local size_output
-            size_output=$(du -sk "$cache_path" 2>/dev/null | awk 'NR==1 {print $1}' | tr -d '[:space:]' || echo "")
+            size_output=$(du -sk "$cache_path" 2> /dev/null | awk 'NR==1 {print $1}' | tr -d '[:space:]' || echo "")
             [[ "$size_output" =~ ^[0-9]+$ ]] || size_output=0
             cache_size_kb=$((cache_size_kb + size_output))
         fi
@@ -162,7 +162,7 @@ check_cache_size() {
 check_swap_usage() {
     # Check swap usage
     if command -v sysctl > /dev/null 2>&1; then
-        local swap_info=$(sysctl vm.swapusage 2>/dev/null || echo "")
+        local swap_info=$(sysctl vm.swapusage 2> /dev/null || echo "")
         if [[ -n "$swap_info" ]]; then
             local swap_used=$(echo "$swap_info" | grep -o "used = [0-9.]*[GM]" | awk '{print $3}' || echo "0M")
             local swap_num=$(echo "$swap_used" | sed 's/[GM]//')
@@ -184,13 +184,13 @@ check_swap_usage() {
 check_timemachine() {
     # Check Time Machine backup status
     if command -v tmutil > /dev/null 2>&1; then
-        local tm_status=$(tmutil latestbackup 2>/dev/null || echo "")
+        local tm_status=$(tmutil latestbackup 2> /dev/null || echo "")
         if [[ -z "$tm_status" ]]; then
             echo -e "  ${YELLOW}${ICON_WARNING}${NC} Time Machine No backups found"
             echo -e "    ${GRAY}Set up in System Settings → General → Time Machine (optional but recommended)${NC}"
         else
             # Get last backup time
-            local backup_date=$(tmutil latestbackup 2>/dev/null | xargs basename 2>/dev/null || echo "")
+            local backup_date=$(tmutil latestbackup 2> /dev/null | xargs basename 2> /dev/null || echo "")
             if [[ -n "$backup_date" ]]; then
                 echo -e "  ${GREEN}✓${NC} Time Machine Backup active"
             else
diff --git a/lib/check_security.sh b/lib/check_security.sh
index 037ae9d..600f1d3 100644
--- a/lib/check_security.sh
+++ b/lib/check_security.sh
@@ -5,7 +5,7 @@
 check_filevault() {
     # Check FileVault encryption status
     if command -v fdesetup > /dev/null 2>&1; then
-        local fv_status=$(fdesetup status 2>/dev/null || echo "")
+        local fv_status=$(fdesetup status 2> /dev/null || echo "")
         if echo "$fv_status" | grep -q "FileVault is On"; then
             echo -e "  ${GREEN}✓${NC} FileVault    Enabled"
         else
@@ -18,7 +18,7 @@ check_filevault() {
 check_firewall() {
     # Check firewall status
     unset FIREWALL_DISABLED
-    local firewall_status=$(defaults read /Library/Preferences/com.apple.alf globalstate 2>/dev/null || echo "0")
+    local firewall_status=$(defaults read /Library/Preferences/com.apple.alf globalstate 2> /dev/null || echo "0")
     if [[ "$firewall_status" == "1" || "$firewall_status" == "2" ]]; then
         echo -e "  ${GREEN}✓${NC} Firewall     Enabled"
     else
@@ -32,7 +32,7 @@ check_firewall() {
 check_gatekeeper() {
     # Check Gatekeeper status
     if command -v spctl > /dev/null 2>&1; then
-        local gk_status=$(spctl --status 2>/dev/null || echo "")
+        local gk_status=$(spctl --status 2> /dev/null || echo "")
         if echo "$gk_status" | grep -q "enabled"; then
             echo -e "  ${GREEN}✓${NC} Gatekeeper   Active"
             unset GATEKEEPER_DISABLED
@@ -48,7 +48,7 @@ check_gatekeeper() {
 check_sip() {
     # Check System Integrity Protection
     if command -v csrutil > /dev/null 2>&1; then
-        local sip_status=$(csrutil status 2>/dev/null || echo "")
+        local sip_status=$(csrutil status 2> /dev/null || echo "")
         if echo "$sip_status" | grep -q "enabled"; then
             echo -e "  ${GREEN}✓${NC} SIP          Enabled"
         else
diff --git a/lib/check_updates.sh b/lib/check_updates.sh
index 0db6971..090affc 100644
--- a/lib/check_updates.sh
+++ b/lib/check_updates.sh
@@ -5,14 +5,14 @@
 
 # Cache configuration
 CACHE_DIR="${HOME}/.cache/mole"
-CACHE_TTL=600  # 10 minutes in seconds
+CACHE_TTL=600 # 10 minutes in seconds
 
 # Ensure cache directory exists
-mkdir -p "$CACHE_DIR" 2>/dev/null || true
+mkdir -p "$CACHE_DIR" 2> /dev/null || true
 
 clear_cache_file() {
     local file="$1"
-    rm -f "$file" 2>/dev/null || true
+    rm -f "$file" 2> /dev/null || true
 }
 
 reset_brew_cache() {
@@ -37,7 +37,7 @@ is_cache_valid() {
         return 1
     fi
 
-    local cache_age=$(($(date +%s) - $(stat -f%m "$cache_file" 2>/dev/null || echo 0)))
+    local cache_age=$(($(date +%s) - $(stat -f%m "$cache_file" 2> /dev/null || echo 0)))
     [[ $cache_age -lt $ttl ]]
 }
 
@@ -51,7 +51,7 @@ check_homebrew_updates() {
     local cask_count=0
 
     if is_cache_valid "$cache_file"; then
-        read -r formula_count cask_count < "$cache_file" 2>/dev/null || true
+        read -r formula_count cask_count < "$cache_file" 2> /dev/null || true
         formula_count=${formula_count:-0}
         cask_count=${cask_count:-0}
     else
@@ -61,18 +61,18 @@ check_homebrew_updates() {
         fi
 
         local outdated_list=""
-        outdated_list=$(brew outdated --quiet 2>/dev/null || echo "")
+        outdated_list=$(brew outdated --quiet 2> /dev/null || echo "")
         if [[ -n "$outdated_list" ]]; then
             formula_count=$(echo "$outdated_list" | wc -l | tr -d ' ')
         fi
 
         local cask_list=""
-        cask_list=$(brew outdated --cask --quiet 2>/dev/null || echo "")
+        cask_list=$(brew outdated --cask --quiet 2> /dev/null || echo "")
         if [[ -n "$cask_list" ]]; then
             cask_count=$(echo "$cask_list" | wc -l | tr -d ' ')
         fi
 
-        echo "$formula_count $cask_count" > "$cache_file" 2>/dev/null || true
+        echo "$formula_count $cask_count" > "$cache_file" 2> /dev/null || true
 
         # Stop spinner before output
         if [[ -t 1 ]]; then
@@ -110,7 +110,7 @@ get_software_updates() {
     if [[ -z "$SOFTWARE_UPDATE_LIST" ]]; then
         # Check cache first
         if is_cache_valid "$cache_file"; then
-            SOFTWARE_UPDATE_LIST=$(cat "$cache_file" 2>/dev/null || echo "")
+            SOFTWARE_UPDATE_LIST=$(cat "$cache_file" 2> /dev/null || echo "")
         else
             # Show spinner while checking (only on first call)
             local show_spinner=false
@@ -120,9 +120,9 @@ get_software_updates() {
                 export SOFTWAREUPDATE_SPINNER_SHOWN="true"
             fi
 
-            SOFTWARE_UPDATE_LIST=$(softwareupdate -l 2>/dev/null || echo "")
+            SOFTWARE_UPDATE_LIST=$(softwareupdate -l 2> /dev/null || echo "")
             # Save to cache
-            echo "$SOFTWARE_UPDATE_LIST" > "$cache_file" 2>/dev/null || true
+            echo "$SOFTWARE_UPDATE_LIST" > "$cache_file" 2> /dev/null || true
 
             # Stop spinner
             if [[ "$show_spinner" == "true" ]]; then
@@ -208,7 +208,7 @@ check_mole_update() {
     # Auto-detect version from mole main script
     local current_version
     if [[ -f "${SCRIPT_DIR:-/usr/local/bin}/mole" ]]; then
-        current_version=$(grep '^VERSION=' "${SCRIPT_DIR:-/usr/local/bin}/mole" 2>/dev/null | head -1 | sed 's/VERSION="\(.*\)"/\1/' || echo "unknown")
+        current_version=$(grep '^VERSION=' "${SCRIPT_DIR:-/usr/local/bin}/mole" 2> /dev/null | head -1 | sed 's/VERSION="\(.*\)"/\1/' || echo "unknown")
     else
         current_version="${VERSION:-unknown}"
     fi
@@ -220,7 +220,7 @@ check_mole_update() {
 
     # Check cache first
     if is_cache_valid "$cache_file"; then
-        latest_version=$(cat "$cache_file" 2>/dev/null || echo "")
+        latest_version=$(cat "$cache_file" 2> /dev/null || echo "")
     else
         # Show spinner while checking
         if [[ -t 1 ]]; then
@@ -229,10 +229,10 @@ check_mole_update() {
 
         # Try to get latest version from GitHub
         if command -v curl > /dev/null 2>&1; then
-            latest_version=$(curl -fsSL https://api.github.com/repos/tw93/mole/releases/latest 2>/dev/null | grep '"tag_name"' | sed -E 's/.*"v?([^"]+)".*/\1/' || echo "")
+            latest_version=$(curl -fsSL https://api.github.com/repos/tw93/mole/releases/latest 2> /dev/null | grep '"tag_name"' | sed -E 's/.*"v?([^"]+)".*/\1/' || echo "")
             # Save to cache
             if [[ -n "$latest_version" ]]; then
-                echo "$latest_version" > "$cache_file" 2>/dev/null || true
+                echo "$latest_version" > "$cache_file" 2> /dev/null || true
             fi
         fi
 
diff --git a/lib/common.sh b/lib/common.sh
index da5a439..367ff06 100755
--- a/lib/common.sh
+++ b/lib/common.sh
@@ -532,14 +532,14 @@ is_clamshell_mode() {
 
     # Check if lid is closed; ignore pipeline failures so set -e doesn't exit
     local clamshell_state=""
-    clamshell_state=$( (ioreg -r -k AppleClamshellState -d 4 2>/dev/null \
-        | grep "AppleClamshellState" \
-        | head -1) || true )
+    clamshell_state=$( (ioreg -r -k AppleClamshellState -d 4 2> /dev/null |
+        grep "AppleClamshellState" |
+        head -1) || true)
 
     if [[ "$clamshell_state" =~ \"AppleClamshellState\"\ =\ Yes ]]; then
-        return 0  # Lid is closed
+        return 0 # Lid is closed
     fi
-    return 1  # Lid is open
+    return 1 # Lid is open
 }
 
 # Manual password input (no Touch ID)
@@ -549,7 +549,7 @@ _request_password() {
     local show_hint=true
 
     # Extra safety: ensure sudo cache is cleared before password input
-    sudo -k 2>/dev/null
+    sudo -k 2> /dev/null
 
     while ((attempts < 3)); do
         local password=""
@@ -635,13 +635,13 @@ request_sudo_access() {
 
     # Wait for sudo to complete or timeout (5 seconds)
     local elapsed=0
-    local timeout=50  # 50 * 0.1s = 5 seconds
+    local timeout=50 # 50 * 0.1s = 5 seconds
     while ((elapsed < timeout)); do
-        if ! kill -0 "$sudo_pid" 2>/dev/null; then
+        if ! kill -0 "$sudo_pid" 2> /dev/null; then
             # Process exited
-            wait "$sudo_pid" 2>/dev/null
+            wait "$sudo_pid" 2> /dev/null
             local exit_code=$?
-            if [[ $exit_code -eq 0 ]] && sudo -n true 2>/dev/null; then
+            if [[ $exit_code -eq 0 ]] && sudo -n true 2> /dev/null; then
                 # Touch ID succeeded
                 return 0
             fi
@@ -655,13 +655,13 @@ request_sudo_access() {
     # Touch ID failed/cancelled - clean up thoroughly before password input
 
     # Kill the sudo process if still running
-    if kill -0 "$sudo_pid" 2>/dev/null; then
-        kill -9 "$sudo_pid" 2>/dev/null
-        wait "$sudo_pid" 2>/dev/null || true
+    if kill -0 "$sudo_pid" 2> /dev/null; then
+        kill -9 "$sudo_pid" 2> /dev/null
+        wait "$sudo_pid" 2> /dev/null || true
     fi
 
     # Clear sudo state immediately
-    sudo -k 2>/dev/null
+    sudo -k 2> /dev/null
 
     # IMPORTANT: Wait longer for macOS to fully close Touch ID UI and SecurityAgent
     # Without this delay, subsequent sudo calls may re-trigger Touch ID
@@ -702,17 +702,17 @@ update_via_homebrew() {
     # Use background process to allow interruption
     local brew_update_timeout="${MO_BREW_UPDATE_TIMEOUT:-300}"
     local brew_tmp_file
-    brew_tmp_file=$(mktemp -t mole-brew-update 2>/dev/null || echo "/tmp/mole-brew-update.$$")
+    brew_tmp_file=$(mktemp -t mole-brew-update 2> /dev/null || echo "/tmp/mole-brew-update.$$")
 
     (brew update > "$brew_tmp_file" 2>&1) &
     local brew_pid=$!
     local elapsed=0
 
     # Wait for completion or timeout
-    while kill -0 $brew_pid 2>/dev/null; do
+    while kill -0 $brew_pid 2> /dev/null; do
         if [[ $elapsed -ge $brew_update_timeout ]]; then
-            kill -TERM $brew_pid 2>/dev/null || true
-            wait $brew_pid 2>/dev/null || true
+            kill -TERM $brew_pid 2> /dev/null || true
+            wait $brew_pid 2> /dev/null || true
             if [[ -t 1 ]]; then stop_inline_spinner; fi
             rm -f "$brew_tmp_file"
             log_error "Homebrew update timed out (${brew_update_timeout}s)"
@@ -722,7 +722,7 @@ update_via_homebrew() {
         ((elapsed++))
     done
 
-    wait $brew_pid 2>/dev/null || {
+    wait $brew_pid 2> /dev/null || {
         if [[ -t 1 ]]; then stop_inline_spinner; fi
         rm -f "$brew_tmp_file"
         log_error "Homebrew update failed"
diff --git a/lib/menu_paginated.sh b/lib/menu_paginated.sh
index 2578c6b..37db717 100755
--- a/lib/menu_paginated.sh
+++ b/lib/menu_paginated.sh
@@ -22,13 +22,13 @@ _pm_get_terminal_height() {
     # Try stty size first (most reliable, real-time)
     # Use </dev/tty to ensure we read from terminal even if stdin is redirected
     if [[ -t 0 ]] || [[ -t 2 ]]; then
-        height=$(stty size </dev/tty 2>/dev/null | awk '{print $1}')
+        height=$(stty size < /dev/tty 2> /dev/null | awk '{print $1}')
     fi
 
     # Fallback to tput
     if [[ -z "$height" || $height -le 0 ]]; then
         if command -v tput > /dev/null 2>&1; then
-            height=$(tput lines 2>/dev/null || echo "24")
+            height=$(tput lines 2> /dev/null || echo "24")
         else
             height=24
         fi
@@ -40,7 +40,7 @@ _pm_get_terminal_height() {
 # Calculate dynamic items per page based on terminal height
 _pm_calculate_items_per_page() {
     local term_height=$(_pm_get_terminal_height)
-    local reserved=6  # header(2) + footer(3) + spacing(1)
+    local reserved=6 # header(2) + footer(3) + spacing(1)
     local available=$((term_height - reserved))
 
     # Ensure minimum and maximum bounds
diff --git a/lib/menu_simple.sh b/lib/menu_simple.sh
index 83135e0..4151e82 100755
--- a/lib/menu_simple.sh
+++ b/lib/menu_simple.sh
@@ -14,13 +14,13 @@ _ms_get_terminal_height() {
     # Try stty size first (most reliable, real-time)
     # Use </dev/tty to ensure we read from terminal even if stdin is redirected
     if [[ -t 0 ]] || [[ -t 2 ]]; then
-        height=$(stty size </dev/tty 2>/dev/null | awk '{print $1}')
+        height=$(stty size < /dev/tty 2> /dev/null | awk '{print $1}')
     fi
 
     # Fallback to tput
     if [[ -z "$height" || $height -le 0 ]]; then
         if command -v tput > /dev/null 2>&1; then
-            height=$(tput lines 2>/dev/null || echo "24")
+            height=$(tput lines 2> /dev/null || echo "24")
         else
             height=24
         fi
@@ -33,7 +33,7 @@ _ms_get_terminal_height() {
 _ms_calculate_items_per_page() {
     local term_height=$(_ms_get_terminal_height)
     # Layout: header(1) + spacing(1) + items + spacing(1) + footer(1) + clear(1) = 5 fixed lines
-    local reserved=6  # Increased to prevent header from being overwritten
+    local reserved=6 # Increased to prevent header from being overwritten
     local available=$((term_height - reserved))
 
     # Ensure minimum and maximum bounds
diff --git a/lib/optimization_tasks.sh b/lib/optimization_tasks.sh
index e4f5383..4632cdb 100644
--- a/lib/optimization_tasks.sh
+++ b/lib/optimization_tasks.sh
@@ -4,11 +4,14 @@
 
 set -euo pipefail
 
-readonly MAIL_DOWNLOADS_MIN_KB=5120  # ~5MB threshold
+readonly MAIL_DOWNLOADS_MIN_KB=5120 # ~5MB threshold
 
 _opt_get_dir_size_kb() {
     local path="$1"
-    [[ -e "$path" ]] || { echo 0; return; }
+    [[ -e "$path" ]] || {
+        echo 0
+        return
+    }
     du -sk "$path" 2> /dev/null | awk '{print $1}' || echo 0
 }
 
@@ -352,19 +355,19 @@ execute_optimization() {
     local path="${2:-}"
 
     case "$action" in
-        system_maintenance)     opt_system_maintenance ;;
-        cache_refresh)          opt_cache_refresh ;;
-        maintenance_scripts)    opt_maintenance_scripts ;;
-        log_cleanup)            opt_log_cleanup ;;
-        recent_items)           opt_recent_items ;;
-        radio_refresh)          opt_radio_refresh ;;
-        mail_downloads)         opt_mail_downloads ;;
-        saved_state_cleanup)    opt_saved_state_cleanup ;;
-        finder_dock_refresh)    opt_finder_dock_refresh ;;
-        swap_cleanup)           opt_swap_cleanup ;;
-        startup_cache)          opt_startup_cache ;;
-        local_snapshots)        opt_local_snapshots ;;
-        developer_cleanup)      opt_developer_cleanup ;;
+        system_maintenance) opt_system_maintenance ;;
+        cache_refresh) opt_cache_refresh ;;
+        maintenance_scripts) opt_maintenance_scripts ;;
+        log_cleanup) opt_log_cleanup ;;
+        recent_items) opt_recent_items ;;
+        radio_refresh) opt_radio_refresh ;;
+        mail_downloads) opt_mail_downloads ;;
+        saved_state_cleanup) opt_saved_state_cleanup ;;
+        finder_dock_refresh) opt_finder_dock_refresh ;;
+        swap_cleanup) opt_swap_cleanup ;;
+        startup_cache) opt_startup_cache ;;
+        local_snapshots) opt_local_snapshots ;;
+        developer_cleanup) opt_developer_cleanup ;;
         *)
             echo -e "${RED}${ICON_ERROR}${NC} Unknown action: $action"
             return 1
diff --git a/lib/sudo_manager.sh b/lib/sudo_manager.sh
index 86b010b..d1fcbff 100644
--- a/lib/sudo_manager.sh
+++ b/lib/sudo_manager.sh
@@ -34,7 +34,7 @@ _start_sudo_keepalive() {
             sleep 30
             kill -0 "$$" 2> /dev/null || exit
         done
-    ) >/dev/null 2>&1 &
+    ) > /dev/null 2>&1 &
 
     local pid=$!
     [[ "${MO_DEBUG:-}" == "1" ]] && echo "DEBUG: _start_sudo_keepalive: background PID = $pid" >&2
diff --git a/lib/update_manager.sh b/lib/update_manager.sh
index d5b0543..90d6bd8 100644
--- a/lib/update_manager.sh
+++ b/lib/update_manager.sh
@@ -20,7 +20,10 @@ format_brew_update_label() {
 
     local detail_str="(${total} updates)"
     if ((${#details[@]} > 0)); then
-        detail_str="($(IFS=', '; printf '%s' "${details[*]}"))"
+        detail_str="($(
+            IFS=', '
+            printf '%s' "${details[*]}"
+        ))"
     fi
     printf "  • Homebrew %s" "$detail_str"
 }
@@ -271,7 +274,7 @@ perform_updates() {
 _perform_appstore_update() {
     echo -e "${BLUE}Updating App Store apps...${NC}"
     local appstore_log
-    appstore_log=$(mktemp -t mole-appstore 2>/dev/null || echo "/tmp/mole-appstore.log")
+    appstore_log=$(mktemp -t mole-appstore 2> /dev/null || echo "/tmp/mole-appstore.log")
 
     if [[ "$appstore_needs_fallback" == "true" ]]; then
         echo -e "  ${GRAY}Installing all available updates${NC}"
@@ -293,7 +296,7 @@ _perform_appstore_update() {
             echo -e "${RED}✗${NC} App Store update failed"
         fi
     fi
-    rm -f "$appstore_log" 2>/dev/null || true
+    rm -f "$appstore_log" 2> /dev/null || true
     reset_softwareupdate_cache
     echo ""
 }
@@ -304,7 +307,7 @@ _perform_macos_update() {
     echo -e "${YELLOW}Note:${NC} System update may require restart"
 
     local macos_log
-    macos_log=$(mktemp -t mole-macos 2>/dev/null || echo "/tmp/mole-macos.log")
+    macos_log=$(mktemp -t mole-macos 2> /dev/null || echo "/tmp/mole-macos.log")
 
     if [[ "$macos_needs_fallback" == "true" ]]; then
         if sudo softwareupdate -i -r 2>&1 | tee "$macos_log" | grep -v "^$"; then
@@ -322,11 +325,11 @@ _perform_macos_update() {
         fi
     fi
 
-    if grep -qi "restart" "$macos_log" 2>/dev/null; then
+    if grep -qi "restart" "$macos_log" 2> /dev/null; then
         echo -e "${YELLOW}${ICON_WARNING}${NC} Restart required to complete update"
     fi
 
-    rm -f "$macos_log" 2>/dev/null || true
+    rm -f "$macos_log" 2> /dev/null || true
     reset_softwareupdate_cache
     echo ""
 }
diff --git a/tests/whitelist.bats b/tests/whitelist.bats
index 3c4ef80..1c5cb94 100644
--- a/tests/whitelist.bats
+++ b/tests/whitelist.bats
@@ -108,9 +108,11 @@ setup() {
 
     run bash --noprofile --norc -c "cd '$PROJECT_ROOT'; printf \$' \\n' | HOME='$HOME' ./mo clean --whitelist"
     [ "$status" -eq 0 ]
-    ! grep -q "\\.m2/repository" "$whitelist_file"
+    run grep -q "\\.m2/repository" "$whitelist_file"
+    [ "$status" -eq 1 ]
 
     run bash --noprofile --norc -c "cd '$PROJECT_ROOT'; printf \$'\\n' | HOME='$HOME' ./mo clean --whitelist"
     [ "$status" -eq 0 ]
-    ! grep -q "\\.m2/repository" "$whitelist_file"
+    run grep -q "\\.m2/repository" "$whitelist_file"
+    [ "$status" -eq 1 ]
 }