devtrim 0.8.0-beta1

Security

• The demo-video dependency graph moves fast-uri from 3.1.5 to 3.1.6, clearing four high-severity advisories (host confusion via skipped IDN canonicalization and via percent-encoded scheme normalization, plus SSRF via malformed IPv6 normalization and via repeated hostname percent-decoding). It reaches the tree four levels down, through @remotion/cli to webpack to schema-utils to ajv, and does not enter the shipped binary — but the video graph is a release gate, so the advisory blocked the release until fixed

Added

• devtrim optimize runs macOS maintenance tasks as typed commands with fixed argv and no caller-supplied data: QuickLook thumbnail cache, user font caches, and the Launch Services database. --apply requires an explicit --task, because plan_danger takes the maximum and one confirmation must not authorize unrelated work. A task that cannot do what its name says is not offered: root-requiring or hours-long ones, and DNS, because dscacheutil -flushcache does not clear the mDNSResponder resolver cache it would advertise
• devtrim status --watch is a live dashboard: sampling runs on a worker thread and the interface redraws when a report lands, so a slow probe delays the numbers rather than the keyboard. Every metric keeps a fixed row slot and an unreadable one renders as unavailable, so a number never moves because a probe failed once. Quitting does not join the sampler: the stop flag is only observed between samples, so joining would make q wait out an in-flight probe and a hung system command would block the exit entirely. It has no JSON form and says so instead of ignoring the flag
• devtrim uninstall <app> lists the paths macOS keys by an application's exact bundle identifier, read from the bundle's own Info.plist: support directories, caches, containers, preferences, saved state, HTTP storages, WebKit data, and launch agents. Matching is exact — com.example.thing never selects com.example.thingy, and a display name never selects by word — which is why it works at all: Amazon Kindle is com.amazon.Lassen. It is a conservative report rather than an inventory, and says so: an app storing data under a product name is invisible to identifier matching, and group containers are omitted because their names come from an arbitrary entitlement. Report-only, because safety::is_protected refuses /Applications and everything under ~/Library outside a four-entry allowlist, and widening that would weaken every command rather than only this one