DiskX 1.0.3 — notarized

DiskX 1.0.3 — notarized

Same code as 1.0.2; this build is notarized by Apple.

Drag it to Applications and open it. No right-click → Open, no xattr, no
Privacy & Security detour. The ticket is stapled to both the DMG and the
app bundle inside it, so a first launch works offline too — Gatekeeper reports
source=Notarized Developer ID.

1.0.2 was Developer ID signed but unnotarized and showed the "Apple cannot check
it for malicious software" dialog. If you are on 1.0.2, this is a cosmetic
upgrade — the security fixes are identical.

Carried over from 1.0.2 (security release)

• Fixes a reproducible crash. A folder containing sparse files with absurd
  reported sizes overflowed a signed 64-bit accumulator and aborted the app.
  Sizes are now clamped at parse time and every aggregation saturates.
• Deletions are bound to file identity. Each item is captured as
  (device, inode, type) before it moves and re-verified after; if the path was
  swapped underneath, the delete is refused rather than performed on the
  substitute.
• Protected system paths stay protected at any depth. /private/var/db and
  similar subtrees were previously offered as "Yours — review" below the
  classification depth limit.
• Hardened getattrlistbulk parsing against malformed kernel buffers.

Verify

shasum -a 256 DiskX-1.0.3.dmg
cb078b922e5f68c87d68c212d5a5dd171dbfed8cb430dcfd639f8bc7960e8fbf

spctl --assess --type install --verbose=2 DiskX-1.0.3.dmg
# DiskX-1.0.3.dmg: accepted
# source=Notarized Developer ID

Universal (Apple Silicon + Intel), macOS 14 Sonoma or later. 54 tests passing.

DiskX 1.0.2 — security release

Security release. Fixes a reproducible crash that lets any scanned folder kill the app, plus a set of deletion-safety hardening changes. Everyone on 1.0.0 or 1.0.1 should update.

Fixed

Crash on hostile file sizes (denial of service). File sizes reported by the filesystem were summed with trapping arithmetic. 1,200 sparse files of 2^53 bytes — which occupy zero disk, cost nothing to create and travel happily inside a zip, disk image or network share — overflow Int64 and abort DiskX mid-scan with SIGTRAP. The payload is invisible in Finder and du, and it kills the app on every retry, permanently denying you the ability to scan that location. Sizes are now clamped when parsed and every aggregate saturates instead of trapping.

Deletions are now bound to file identity. A path is not a handle. Nothing tied the row you approved in the confirmation sheet to the file that actually got deleted, and the pre-flight check only asked whether something existed at that path. DiskX now captures (device, inode, type) when the plan is built and re-verifies it immediately before acting, refusing any item whose identity changed in between.

Trash results are verified. trashItem reports success for an item that already lives in the Trash, so DiskX detached the row and credited bytes that were never reclaimed. It now confirms the item actually moved before reporting it.

Protected system paths stay protected. The system-path check stopped applying below two directory levels, so /private/var/db and everything beneath it was offered for deletion as "Yours — review". Protection is now inherited by the entire subtree.

Scanner parser hardened. The getattrlistbulk entry walk trusted the entry length, the signed name offset and the name length from the buffer, and read the name as an unbounded C string. All are now validated against the entry and the buffer.

Also

• DISKX_TRACE — which streamed every scanned path to stderr — is compiled out of release builds entirely.
• Goal mode no longer crashes on very large input.
• A directory with hundreds of thousands of entries can no longer wedge the UI; the status bar reports how many rows are not listed.
• Bulk-trash bookkeeping no longer does O(n²) path matching on the main thread.
• Security-scoped bookmarks are released properly, resolved without UI or mounting, and no longer discarded when a volume is merely unplugged.
• The size column no longer collides with the scroll bar.

54 tests, including regression tests for the reproduced crash and the identity-swap refusal.

Install

Universal (Apple Silicon + Intel), macOS 14 Sonoma or later.

Important

This build is Developer ID signed but not notarized, unlike 1.0.1. macOS will quarantine it on first launch. Open it once with right-click → Open → Open, or clear the flag:

xattr -dr com.apple.quarantine /Applications/DiskX.app

A notarized build will follow as 1.0.2.x/1.0.3. The security fixes were considered more urgent than waiting for the notarization credentials.

To scan ~/Library and system paths, grant Full Disk Access in System Settings → Privacy & Security.

SHA-256  e7e8f697a4a301634c4a88c98bb5131af69068424faab0b3d6367f3adc81007a

DiskX 1.0.1 — notarized

Caution

Superseded — this build contains a reproducible crash. A folder holding sparse files with very large reported sizes (zero bytes on disk, and shippable inside an archive or served by a network mount) aborts the app mid-scan and does so on every retry. Fixed in 1.0.2 — please update.

---

The first build that just opens. 1.0.0 was ad-hoc signed, so macOS quarantined it and every user had to detour through right-click → Open or an xattr command. That detour is gone.

DiskX 1.0.1 is signed with a Developer ID certificate and notarized by Apple. Both the .app and the .dmg carry stapled notarization tickets, so the first launch works even offline.

No changes to scanning, ranking or deletion — this release is about distribution, documentation and test coverage.

Fixed

• Universal builds could not be produced at all. SwiftPM keeps one llbuild database per scratch path, keyed to the last architecture built, so arm64 followed by x86_64 in the shared .build failed with command ... not registered for every auxiliary file. Each architecture now gets its own scratch path. Universal builds were advertised before this release but did not build; this DMG genuinely is universal (x86_64 arm64).

Added

• Scripts/notarize_release.sh — build → sign → notarize → staple, for both the app and the disk image. Notarizing only the DMG (the common shortcut) leaves the extracted app without its own ticket, so an offline first launch still meets Gatekeeper.
• ARCHITECTURE.md — scan engine, node tree, classification, Reclaim Sort, treemap geometry, deletion/undo, sandboxing and the release pipeline, with the reasoning behind the non-obvious parts.
• CHANGELOG.md.
• 28 new tests (17 → 45, all passing). ReclaimAnalyzer — the product's central claim — previously had zero coverage; it now has tests for staleness buckets, category→tier mapping, safe-reclaim aggregation, safe-subtree pruning, hotspot ordering and WHY-line wording.

Verifying this download

spctl --assess --type install --verbose=2 DiskX-1.0.1.dmg

should report source=Notarized Developer ID.

Full changelog: https://github.com/avantigroupai/DiskX/blob/main/CHANGELOG.md

DiskX 1.0.0 — first public release

Caution

Superseded — this build contains a reproducible crash. A folder holding sparse files with very large reported sizes (zero bytes on disk, and shippable inside an archive or served by a network mount) aborts the app mid-scan and does so on every retry. Fixed in 1.0.2 — please update.

---

The first public release of DiskX — a free, open-source macOS disk space analyzer that sorts by what's safe to delete first, not just by size.

Install

1. Download DiskX-1.0.0.dmg below, open it, drag DiskX to Applications.
2. This build is ad-hoc signed and not yet notarized (notarization requires a paid Apple Developer account), so macOS will block it on first launch. Open it once with right-click → Open → Open, or clear the quarantine flag:

xattr -dr com.apple.quarantine /Applications/DiskX.app

3. To scan ~/Library and system paths, grant Full Disk Access in System Settings → Privacy & Security. Without it DiskX shows an honest "N folders unreadable" chip rather than silently undercounting.

Requires macOS 14 Sonoma or later. Universal (Apple Silicon + Intel).

What's in it

• Reclaim Sort — the default ordering: reclaimable bytes × safety tier × staleness. Deterministic and inspectable, never AI. Every row carries a plain-language WHY line.
• Ghost-row hoisting — deep junk like DerivedData or node_modules is lifted to the top level as ↳ …/Xcode/DerivedData · 6 levels deep, so you never drill down repeatedly.
• Truth Bar — capacity accounting that reconciles with Finder, including an honest explanation of "System Data" and purgeable space.
• 100 % keyboard — jk/arrows to move, X to mark across folders, Space to Quick Look, 1–5 to re-sort, G for goal mode, ? for the cheat sheet.
• Fear-free deletion — select any mix, press Delete, confirm with Return/Y (or Esc/N to cancel). Risk-proportional: if anything is yours, Return goes inert and an explicit Y is required. Everything goes to the Trash — never a permanent delete — and ⌘Z restores the whole batch.
• Fast — 1.33M files in 45s (~29,000 files/sec), about 2.4× faster than du on the same tree; whole-tree reclaim analysis in ~1.2s.
• Private — entirely on-device. No telemetry, no network calls, no background agents.

Verify the download

SHA-256  5b8f516cde17f68f53a09946e4680332376f25faad7b88940b3d583d0b5d2c4a

Known limitations

• Not notarized yet (see install step 2). A notarized and Mac App Store build is planned.
• The sandboxed App Store variant can only scan folders you explicitly grant.
• Duplicate-file detection and scheduled baselines are not in 1.0.

Built with a multi-agent AI orchestration pipeline — see How it was built.