v1.21.0

Added

• devp caches clear npm,uv,pip empties exactly the caches you name. The target
  now takes a comma-separated list, a one-time whitelist with no configuration
  involved. The mirror image is devp caches clear all --except npm,uv: everything
  goes except the names given, for the day one cache is the only one worth keeping
  warm. --except only pairs with all (a list already says exactly what to clear),
  and a container engine never appears in either form: naming an engine alone remains
  the consent to touch it. Flags, exit codes and the maven rule are in
  the CLI reference.

Changed

• A prunable declaration is now checked against the manifest its rebuild command
  would read, not just against your PATH. "rebuild": "npm run build" used to pass
  the moment npm was installed — even in a project whose package.json has no build
  script. dev-prune would call the directory recoverable, delete it, and the command
  meant to put it back would fail. It now reads the manifest and refuses instead:

  ! `site/dist` is declared prunable, rebuilt by `npm run build`, but `package.json`
    defines no `build` script — refusing to delete something that command cannot put
    back. Add a `build` script to `package.json`, or fix the command.
  

  Covered where a manifest in the tree can answer: npm/pnpm/yarn run <script>
  and the bare pnpm <script> / yarn <script> forms, honouring --prefix, -C,
  --dir and --cwd so npm --prefix docs run build reads docs/package.json;
  make <target> against the Makefile, honouring -C and -f; uv run <script>
  against [project.scripts] in pyproject.toml; and cargo <subcommand> for names
  that are neither cargo's own nor any installed cargo-<name> plugin.

  Two things this deliberately does not do. It never runs the rebuild command, or any
  part of it — every check is a read of a file already in the tree. And a command shape
  it cannot resolve is allowed through rather than guessed at: a shell pipeline, a
  target held in a variable, a tool with no manifest behind it, or a manifest that is
  absent or unparseable all fall back to the tool check alone, because a false refusal
  blocks a prune that was safe.

  One gotcha worth naming: [tool.uv.scripts] is not a table uv reads. A script
  declared only there does nothing, so uv run <that script> is refused, and the
  message says to move it to [project.scripts].

• devp caches clear now ends with the reinstall command for browser bundles.
  Playwright, Puppeteer and Cypress binaries do not come back with the next
  npm install; they only return when their own installer runs. Clearing one of those
  caches now prints the command that brings it back (npx playwright install,
  npx puppeteer browsers install, npx cypress install) right where you cleared it,
  instead of leaving the next broken test run to say it later.

Fixed

• A read-only file no longer stops the whole delete on Windows. go mod writes
  module directories read-only on purpose, and the odd npm package ships a read-only
  file too; a single one used to fail the prune with Access Denied partway through.
  dev-prune now clears the attribute the way rimraf does and retries. A delete that
  still fails after that is reported honestly, as before.
• Dropping an ignore.devprune.json marker no longer resets the idle clock.
  Creating the marker is bookkeeping, not work, but its timestamp used to count as
  project activity: un-ignore a repository later and it looked freshly touched, waiting
  out idle_days all over again. The marker now sits beside .devprune.json and
  project.devprune.json in the activity walk's exclusion list.

---

Which download do I want?

Most people want none of them. The installers below verify the SHA-256
sidecar, put the binary somewhere already on PATH, and create the devp
alias — three things unzipping an archive does not do.

You are on	Run this
Windows (PowerShell)	iwr -useb https://devprune.vkrishna04.me/install.ps1 | iex
Windows (Command Prompt)	powershell -NoProfile -ExecutionPolicy Bypass -Command "iwr -useb https://devprune.vkrishna04.me/install.ps1 | iex"
macOS / Linux	curl -fsSL https://devprune.vkrishna04.me/install.sh | sh
Python tooling	uv tool install dev-prune==1.21.0 / pipx install dev-prune==1.21.0
Rust, no compile	cargo binstall dev-prune@1.21.0
Rust, from source	cargo install dev-prune --version 1.21.0 (needs Rust 1.88+)

The PyPI packages contain these same binaries rather than downloading one
afterwards, so they work behind a registry mirror and offline. cargo install
is the only channel that compiles on your machine; cargo binstall reaches
for the archives on this page instead.

Full instructions: https://devprune.vkrishna04.me/#install

The assets, then

Take one only if you are packaging dev-prune yourself, air-gapping it, or
pinning it into a container image.

Asset	For
dev-prune-v1.21.0-windows-x64.zip	Windows on Intel/AMD — almost every Windows PC
dev-prune-v1.21.0-windows-arm64.zip	Windows on ARM — Surface Pro X, Snapdragon laptops, Windows in a Mac VM
dev-prune-v1.21.0-windows-x86.zip	32-bit Windows — locked-down corporate images, older industrial machines
dev-prune-v1.21.0-darwin-arm64.tar.gz	Apple Silicon Macs — M1 and later
dev-prune-v1.21.0-darwin-x64.tar.gz	Intel Macs — 2020 and earlier
dev-prune-v1.21.0-linux-x64.tar.gz	Linux on Intel/AMD
dev-prune-v1.21.0-linux-arm64.tar.gz	Linux on ARM — Raspberry Pi 4/5, Graviton, ARM CI runners

Both Linux builds are statically linked against musl, so they run on any
distribution including Alpine, with no glibc floor.

32-bit is published for Windows only. There is no 32-bit Linux, no 32-bit
macOS and no 32-bit ARM build on any platform; the install scripts refuse
rather than guess when they meet one.

There is no .vsix on this page. The VS Code extension has its own
version and its own release cadence, so it ships from its own tags:
the extension's releases.
Install it by name instead — VKrishna04.dev-prune, on the
VS Code Marketplace
and on Open VSX.

Windows: the binaries are not code-signed, and two separate features react
to that.

Windows protected your PC is SmartScreen, and it only challenges files
carrying a Mark of the Web — which your browser attaches to the download and
File Explorer copies onto everything it extracts. Clear the mark on the archive
before extracting and nothing inside it is ever marked:

Unblock-File .\dev-prune-v1.21.0-windows-x64.zip

The installers above already do this for you, on the archive and on both
installed copies.

A refusal with no dialog and no "run anyway" is something else: Smart App
Control, which blocks unsigned executables outright and never looks at the mark.
It is on by default on clean installs of Windows 11 22H2+ and always off on
upgraded ones, which is why the same release runs on one machine and not the
next. Unblock-File does not help, and neither does building from source.
The troubleshooting guide
covers what your options actually are.

Every archive ships a .sha256 sidecar. Check it before you trust it:

sha256sum -c dev-prune-v1.21.0-linux-x64.tar.gz.sha256

(Get-FileHash dev-prune-v1.21.0-windows-x64.zip).Hash -eq (Get-Content dev-prune-v1.21.0-windows-x64.zip.sha256).Split(' ')[0].ToUpper()

An archive's hash stops meaning anything the moment you unpack it, and the
unpacked files are the only ones your antivirus ever looks at. So each Windows
zip also ships a .zip.contents.sha256 listing the digest of every file inside
it — run this in the folder you extracted to, from Git Bash (sha256sum ships
with Git for Windows, and is what reads this format):

sha256sum -c dev-prune-v1.21.0-windows-x64.zip.contents.sha256

dev-prune.exe and devp.exe are one file under two names and share a digest
on purpose, so a scanner builds one reputation record instead of two.
devpw.exe — the console-free build the scheduled task runs — is compiled
separately and legitimately has a different one. devp trust prints the same
three digests for the copies already installed on your machine, so you can
compare them against this file without downloading anything again.

That sidecar proves the file was not altered in transit. It does not prove
where it came from — the same hand that swaps an archive swaps its sidecar.
Every archive on this page is also signed by GitHub's build provenance, which
binds it to this repository, this workflow and the commit it was built from:

gh attestation verify dev-prune-v1.21.0-linux-x64.tar.gz --repo Life-Experimentalist/dev-prune

gh attestation verify dev-prune-v1.21.0-windows-x64.zip --repo Life-Experimentalist/dev-prune

Full Changelog: v1.20.0...v1.21.0