devtrim 0.7.0

Added

• devtrim status reports read-only machine vitals — uptime, load, memory, disk, battery, thermals, cumulative network, busiest processes — and a health score that names every input it could not read instead of scoring over the gap. Each value comes from a fixed-argv system tool through a parser that fails closed on malformed input. Disk is measured on the writable Data volume rather than the sealed root, because df / reports a nearly full machine as 17% used; memory used is stated as active + wired + compressed, because counting reclaimable inactive pages reports a healthy machine at 96%
• devtrim analyze [path] is an interactive, read-only disk explorer: it measures each child on a worker thread and streams results in as they land, so a directory that takes minutes to size never freezes the interface, and leaving a directory cancels its in-flight walk. Symbolic links are reported at their own size rather than followed, a different device is never entered, and unreadable entries are disclosed as (partial) lower bounds. --json emits one document; every mutation flag is rejected
• The terminal interface honors NO_COLOR, degrading every style to a modifier that preserves the same distinction — the danger ladder stays ordered as dim, plain, bold, bold+reversed — so the interface remains usable with color stripped entirely
• ? opens a full keybinding reference over any screen, deliberately except the confirmation prompt, where a second overlay would obscure the plan being approved; the footer keeps only the few keys that apply to the current screen
• clean installers reclaims downloaded installer archives (dmg, pkg, mpkg, iso, xip) left as direct children of Downloads and Desktop after the configured active window, refusing symlinks, nested copies inside extracted project trees, and any target outside those two directories at apply time

Changed

• Terminal styling moved from 30 inline color literals to semantic tokens in src/theme.rs, so call sites name what a span means and one module decides how it looks; colors remain named ANSI rather than RGB so they keep resolving through the user's own terminal theme
• Every tracked *.sh plus the pre-commit hook now pass shellcheck before local commits and in CI through one fail-closed, NUL-safe helper; CI installs the official ShellCheck 0.11.0 arm64 asset only after checksum verification
• CI and non-Intel release jobs move from the deprecated macos-14 image to the supported macos-15 arm64 image with exact runner-policy checks; the deterministic x86 release gate remains on macos-15-intel
• Ordinary PR/main CI now installs checksum-verified arm64 Gitleaks 8.30.1 and TruffleHog 3.97.1, proves Gitleaks detects a non-allowlisted synthetic PAT, then runs the same full-history secret scans that release gates already run

Fixed

• clean docker under-reported reclaimable space by roughly 7x because docker system df measures only inside the guest: the host-side OrbStack/Docker Desktop VM disk image is now disclosed as a report-only finding measured in allocated blocks, with a note stating that pruning frees guest space but never shrinks that sparse file until the runtime compacts it
• The Docker VM disk image is now reported even when the daemon is not running, which is the one state where it is invisible to docker and still occupying the host; a refused remote endpoint and a malformed docker response remain hard errors
• Artifact scanning and apply now both refuse targets below every ASCII-case variant of node_modules, closing the sibling dependency-namespace deletion path with an end-to-end surviving-sentinel regression
• trash-empty now warns and leaves a direct .git case variant in place without letting that protected item block other exact previewed Trash children
• Permanent and Trash preflight reuse each directory listing for Git-marker checks instead of enumerating every directory twice, while retaining the final mutation-time recheck
• Git-backed unit fixtures now disable ambient commit signing and hooks, so maintainer Git configuration cannot make the Rust suite fail
• Release policy now proves the Gitleaks positive control runs before the scanner directory reaches PATH, and both workflows syntax-check that control script explicitly
• node-modules apply now reasserts the scanner's exact target shape before deletion, refusing non-directory and symlink targets, symlinked category ancestors, forged non-node_modules leaves, plus ASCII-case-insensitive .git and outer node_modules ancestors and non-normal paths
• The landing page and packaged manual now declare a compact project favicon instead of generating a browser-level /favicon.ico 404 on every fresh visit
• The landing-page hero caption now keeps readable contrast over every part of its image instead of combining muted text with a translucent overlay
• The ShellCheck helper now fails before linting with an actionable error when shellcheck is unavailable, and release policy proves that path does not invoke ShellCheck
• CODING_STANDARDS.md no longer tells review to skip gates that run only at release (cmp -s AGENTS.md CLAUDE.md, the fuzz targets, actionlint), and now lists the video/, shell, and secret-scanning merge gates it had omitted, so a reviewer no longer spends the budget on checks that already block
• CODING_STANDARDS.md corrects an S1 precedent that no search could find, S12's incomplete list of approved dynamic call sites, S6's unstated denylist, and the ast-grep escape hatches sanctioned by the deletion-sink rule
• The binary entry point now carries the //! module contract that S4 requires of every file under src/

Security

• Git metadata is now denied ASCII-case-insensitively by project scanners, ownership and category checks, target validation, and open-handle Trash/permanent preflight, closing actionable .GIT findings on case-insensitive macOS filesystems
• Common local environment, private-key, and signing-material files are ignored, while checksum-pinned full-history Gitleaks and TruffleHog scans now block ordinary PR/main CI as well as releases
• CI and release refuse a Gitleaks binary that cannot trip a runtime positive control, so a version string and clean scan cannot mask a no-op detector