RepoPilot

yagcioglutoprak/dusty

Free, open-source CleanMyMac alternative for macOS that frees disk space without deleting anything it shouldn't.

Healthy

Healthy across all four use cases

HealthyDependency

Permissive license, no critical CVEs, actively maintained — safe to depend on.

HealthyFork & modify

Has a license, tests, and CI — clean foundation to fork and modify.

HealthyLearn from

Documented and popular — useful reference codebase to read through.

HealthyDeploy as-is

No critical CVEs, sane security posture — runnable as-is.

  • ⚠Small team — 2 contributors active in recent commits
  • ⚠Concentrated ownership — top contributor handles 59% of recent commits
  • ⚠Scorecard: default branch unprotected (0/10)
  • ✓Last commit today
  • ✓2 active contributors
  • ✓MIT licensed
  • ✓CI configured
  • ✓Tests present

Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard

Informational only. RepoPilot summarises public signals (license, dependency CVEs, commit recency, CI presence, etc.) at the time of analysis. Signals can be incomplete or stale. Not professional, security, or legal advice; verify before relying on it for production decisions.

Want this for your own repo?

Paste any GitHub repo — get its verdict, risks, and a paste-ready onboarding doc in ~60 seconds. Free, no sign-up.

Embed the "Healthy" badge

Paste into your README — live-updates from the latest cached analysis.

Variant:
RepoPilot: Healthy
[![RepoPilot: Healthy](https://repopilot.app/api/badge/yagcioglutoprak/dusty)](https://repopilot.app/r/yagcioglutoprak/dusty)

Paste at the top of your README.md — renders inline like a shields.io badge.

▸Preview social card

This card auto-renders when someone shares https://repopilot.app/r/yagcioglutoprak/dusty on X, Slack, or LinkedIn.

Ask AI about yagcioglutoprak/dusty

Grounded in the actual source code. Pick a starter question or write your own.

What does this repo do, in one paragraph?How would I get started using it?What are the main alternatives?Show me the entry point.
Or write your own question

Onboarding doc

Onboarding: yagcioglutoprak/dusty

Generated by RepoPilot · 2026-07-25 · Source

Verdict

Healthy — Healthy across all four use cases

  • Last commit today
  • 2 active contributors
  • MIT licensed
  • CI configured
  • Tests present
  • ⚠ Small team — 2 contributors active in recent commits
  • ⚠ Concentrated ownership — top contributor handles 59% of recent commits
  • ⚠ Scorecard: default branch unprotected (0/10)

Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard

TL;DR

Dusty is a free, open-source macOS disk cleanup utility written in Swift that identifies and safely deletes reclaimable disk space (caches, logs, Xcode DerivedData, simulators, package manager artifacts) across three safety levels without deleting user data. It runs as a menu bar application that scans in the background and only deletes from a fixed allowlist, providing visibility into every file before deletion. Two-layer architecture: CleanerEngine (Swift Package at CleanerEngine/) is the core scanning and deletion logic with CleanupTarget abstractions and SafetyValidator guards; Dusty/ (Xcode project) is the SwiftUI/AppKit menu bar frontend that consumes CleanerEngine. Tests live in CleanerEngine/Tests/CleanerEngineTests/ with integration tests (EngineHardeningTests.swift) validating end-to-end safety.

LLM-derived; treat as a starting point, not verified fact.

Who it's for

macOS users (especially developers with Xcode, iOS simulators, and package managers) who want a free alternative to CleanMyMac; developers comfortable with Swift and interested in building system utilities or contributing to open-source macOS applications.

LLM-derived; treat as a starting point, not verified fact.

Maturity & risk

Actively developed and production-ready: the project has CI/CD workflows (ci.yml, release.yml), comprehensive test coverage in CleanerEngine/Tests/ with specific test files (SafetyValidatorTests.swift, DeletionBehaviorTests.swift, EngineHardeningTests.swift), signed/notarized releases via Homebrew, and a clear architectural separation between engine and UI. Verdict: mature enough for daily use with active maintenance.

Single-maintainer risk (yagcioglutoprak namespace), but mitigated by MIT license and open-source contribution path (CONTRIBUTING.md present). No vendored dependencies visible in the file list—leverages Swift Package Manager (CleanerEngine/Package.swift), reducing supply-chain risk. System-level file deletion logic requires careful validation, which is evidenced by dedicated SafetyValidator.swift and comprehensive deletion behavior tests.

LLM-derived; treat as a starting point, not verified fact.

Active areas of work

No recent PR/issue data visible in file list, but the presence of new_target.yml issue template suggests ongoing community requests for new cleanup targets. The DeletionLog.swift and AutoScanPolicy.swift indicate active work on background scanning and audit logging features.

LLM-derived; treat as a starting point, not verified fact.

Get running

git clone https://github.com/yagcioglutoprak/dusty.git
cd dusty
open Dusty/Dusty.xcodeproj

Then build/run via Xcode (no external dependency management visible—pure Swift Package Manager). Or: brew install --cask yagcioglutoprak/tap/dusty to use the prebuilt binary.

Daily commands: Open Dusty/Dusty.xcodeproj in Xcode and press Cmd+R, or xcodebuild -scheme Dusty -configuration Release from CLI. The menu bar app launches to your macOS menu bar automatically.

Map of the codebase

How to make changes

Adding a new cleanup target: Create a new file in CleanerEngine/Sources/CleanerEngine/ implementing the CleanupTarget protocol (see structure mirrored in CleanupTargetRegistry.swift), add tests in CleanerEngine/Tests/CleanerEngineTests/, update the registry. UI changes: Edit Dusty/Dusty/ Swift files (check xcassets for icon/asset changes). Safety logic: Modify SafetyValidator.swift and write tests in SafetyValidatorTests.swift.

Traps & gotchas

File system sandboxing: The app may require special entitlements to access certain ~/Library/ paths on modern macOS (sandboxing issues). Time Machine snapshots: TimeMachineSnapshotHelper.swift has special logic—removing snapshots requires specific APIs and permissions. Simulator cleanup: SimulatorHelper.swift logic depends on Xcode installation path and simulator state database locations, which can vary. Concurrency: BoundedConcurrency.swift limits parallel scans; monitor performance on large drives. Test isolation: Deletion tests must work in-memory or use temp directories; no obvious test fixtures directory visible.

Concepts to learn

  • Allowlist-based deletion — Dusty's core safety model—only deletes from a pre-approved list of paths rather than pattern-matching; understanding this prevents accidental data loss in SafetyValidator.swift
  • Bounded concurrency / semaphore pooling — BoundedConcurrency.swift limits parallel file system scans to prevent I/O thrashing on large disks; critical for responsive UX during background scanning
  • Menu bar application (status item) — Dusty lives in the macOS menu bar showing free space in real-time; requires understanding NSStatusBar and app lifecycle, not typical document-based apps
  • Swift Package Manager (SPM) modular architecture — CleanerEngine is packaged as an SPM library separate from the UI app; enables reusable, testable core logic and potential CLI tool development
  • File system metadata caching / SizeCache — SizeCache.swift avoids redundant file stat() calls during rescans; trade-off between accuracy and performance in disk space calculation
  • macOS code signing and notarization — The release.yml workflow signs and notarizes the DMG; required for Gatekeeper bypass on modern macOS and distribution via Homebrew
  • Registry pattern (CleanupTargetRegistry) — Dynamically registers cleanup targets by safety level; enables adding new targets (browser caches, app-specific junk) without modifying core logic

Related repos

  • freespace/freespace — Lightweight disk space analyzer for macOS; alternative cleanup approach focusing on visualization rather than automatic deletion
  • Homebrew/brew — Package manager that Dusty integrates with (manages homebrew caches); critical dependency for many of Dusty's package manager cleanup targets
  • mas-cli/mas — Mac App Store CLI; complements Dusty for managing app updates and cleanup workflows on macOS
  • xcpretty/xcpretty — Xcode build output formatter; relevant to developers using Dusty who want cleaner build logs alongside cache cleanup

PR ideas

Click to expand

To work on one of these in Claude Code or Cursor, paste: Implement the "<title>" PR idea from CLAUDE.md, working through the checklist as the task list.

Add comprehensive integration tests for CleanupTargetRegistry and target selection logic

The repo has unit tests for SelectionLogicTests.swift and SafetyValidatorTests.swift, but CleanupTargetRegistry.swift (the core registry managing all cleanup targets) lacks dedicated test coverage. Given the safety-critical nature of file deletion, integration tests ensuring targets are properly registered, prioritized, and selected across different CleanupLevel values would prevent regressions in target behavior.

  • [ ] Create CleanerEngine/Tests/CleanerEngineTests/CleanupTargetRegistryTests.swift
  • [ ] Add tests for target registration, retrieval by level (Safe/Developer/Deep), and conflict detection
  • [ ] Test interaction between CleanupTargetRegistry and SafetyValidator to ensure unsafe targets can't be selected
  • [ ] Add tests verifying all cleanup targets are properly initialized and discoverable

Add automated test coverage for DiskSpaceMonitor and SizeCache edge cases

SizeCacheTests.swift exists, but DiskSpaceMonitor.swift (responsible for tracking available disk space) has no dedicated tests. Given the app's core function of monitoring and reclaiming disk space, tests for threshold detection, cache invalidation, and concurrent access patterns would improve reliability.

  • [ ] Create CleanerEngine/Tests/CleanerEngineTests/DiskSpaceMonitorTests.swift
  • [ ] Add tests for low disk space threshold detection and notifications
  • [ ] Add thread-safety tests for concurrent read/write access to disk space data
  • [ ] Add tests verifying cache invalidation triggers correctly when space changes

Implement GitHub Actions workflow for building and signing macOS .app releases

The repo has ci.yml and release.yml workflows, but no apparent automated macOS .app build/signing pipeline. The release workflow likely creates a GitHub Release, but contributors and users cannot easily build signed binaries. Adding a workflow to build, notarize, and create a distributable .dmg would match the repository's stated goal of being free and open-source.

  • [ ] Create .github/workflows/macos-build.yml with steps to build Dusty.xcodeproj in Release configuration
  • [ ] Add code signing for macOS using provisioning profiles or ad-hoc signing
  • [ ] Add notarization step using notarytool (required for macOS 13+, as per README badge)
  • [ ] Generate .dmg distribution package and upload as release artifact
  • [ ] Document build prerequisites (Xcode version, signing certificates) in CONTRIBUTING.md

Good first issues

  • Add tests for SizeCalculator.swift (visible in file list but no corresponding test file)—implement unit tests covering edge cases like symlinks, hard links, and zero-byte files
  • Document the CleanupTarget protocol with inline examples in CleanupTarget.swift; add a code sample showing how to implement a new target (e.g., custom app cache)
  • Create integration tests for the AutoScanPolicy.swift background scanning policy (tests exist but may be incomplete)—cover timer behavior, policy switching, and scan interruption

Top contributors

Click to expand

Recent commits

Click to expand
  • c9f3fb6 — docs: clarify cleanmymac alternative positioning (yagcioglutoprak)
  • 858b3aa — seo: target cleanmymac alternative intent (yagcioglutoprak)
  • 87c8b7b — seo: add software structured data (yagcioglutoprak)
  • d9692f8 — seo: align dusty canonical url (yagcioglutoprak)
  • b53b6e3 — docs: link safety writeup from README (yagcioglutoprak)
  • b127be3 — Bust the README image cache for the new demo GIF (yagcioglutoprak)
  • c8502d5 — Move security policy to .github so GitHub detects it (yagcioglutoprak)
  • b04f9e9 — Refresh the demo GIF to match the current app (yagcioglutoprak)
  • 08e7908 — README: link the security policy from the trust section (yagcioglutoprak)
  • 4d269c5 — Add a security policy with private vulnerability reporting (toprakbugbounty-arch)

Security observations

Click to expand

Dusty appears to be a well-structured macOS cleaning utility with a security-conscious architecture (SafetyValidator, DeletionLog, test suites). However, the security posture cannot be fully assessed without reviewing actual source code contents. Primary concerns are: (1) insufficient visibility into dependency security, (2) unvalidated file system operations that could enable symlink attacks or path traversal, (3) potential privilege escalation risks from cleanup operations, and (4) incomplete security policy documentation. The project demonstrates good security practices through dedicated safety validators and comprehensive testing, but implementation details require code-level review. Recommend: code audit focusing on file operations, dependency scanning, and enhanced security documentation.

  • Medium · Missing SECURITY.md Policy Details — .github/SECURITY.md. The repository contains a .github/SECURITY.md file, but its actual content was not provided for review. Security policy files should clearly outline vulnerability disclosure procedures, supported versions, and responsible disclosure guidelines. Fix: Ensure SECURITY.md contains: (1) Clear vulnerability reporting instructions, (2) Expected response timeframes, (3) Supported versions receiving security updates, (4) PGP key for encrypted reports if applicable.
  • Medium · Insufficient Dependency Visibility — CleanerEngine/Package.swift. The Package.swift file content was not provided for analysis. Swift Package Manager dependencies could contain vulnerable libraries or unmaintained packages that pose security risks. Fix: Review and provide Package.swift contents. Implement: (1) Dependency pinning with specific versions, (2) Regular dependency audits using Swift package security tools, (3) Automated dependency update checks in CI/CD.
  • Low · File System Operations Without Validated Safety — CleanerEngine/Sources/CleanerEngine/SafetyValidator.swift, DeletionLog.swift, SimulatorHelper.swift. Files like SafetyValidator.swift, DeletionLog.swift, and SimulatorHelper.swift suggest file system operations. Without code review, potential risks include: race conditions during file deletion, symlink following attacks, or improper permission validation. Fix: Implement: (1) Proper symlink attack mitigation (use O_NOFOLLOW flags), (2) TOCTOU (Time-of-Check-Time-of-Use) protection, (3) Validate all paths before deletion, (4) Use proper file system APIs with safety guarantees.
  • Low · Insufficient Input Validation in Cleanup Targets — CleanerEngine/Sources/CleanerEngine/CleanupTarget.swift, CleanupTargetRegistry.swift. The CleanupTarget.swift and CleanupTargetRegistry.swift files handle configuration of cleanup paths. If user-configurable paths aren't properly validated, malicious inputs could target critical system files. Fix: Implement strict validation: (1) Whitelist allowed cleanup directories, (2) Reject paths to critical system locations, (3) Validate against bypass attempts (../, symlinks), (4) Add path normalization.
  • Low · Potential Privilege Escalation Risk — CleanerEngine/Sources/CleanerEngine/CleanerEngine.swift, DiskSpaceMonitor.swift. macOS disk cleanup operations may require elevated privileges. The absence of explicit privilege boundary checks in visible code suggests potential elevation of privilege (EoP) risks. Fix: Ensure: (1) Minimal necessary privileges are requested, (2) Operations don't exceed privilege scope, (3) Use XPC services for privilege separation, (4) Audit all root-level operations.
  • Low · Missing Test Security Coverage — CleanerEngine/Tests/CleanerEngineTests/. Test files exist but their content wasn't provided. Security-critical tests for deletion safety, validation logic, and edge cases may be incomplete. Fix: Ensure comprehensive test coverage: (1) SafetyValidator and DeletionBehavior tests cover bypass attempts, (2) Path validation tests include edge cases, (3) Concurrency tests validate thread safety, (4) Add fuzzing for configuration inputs.

LLM-derived; treat as a starting point, not a security audit.

Where to read next

The exported doc (Copy CLAUDE.md / Download / .cursor/rules) also includes an agent protocol and a verification script written for AI coding agents — omitted here to keep this view scannable.

Similar Swift repos

Other healthy-signal Swift repos by stars.

Embed this chat in your README

Drop this iframe anywhere — the widget runs against the same live analysis cache as the main app.

<iframe
  src="https://repopilot.app/embed/yagcioglutoprak/dusty"
  width="100%" height="500"
  style="border:1px solid #d0d7de; border-radius:8px;"
  allow="microphone"
  loading="lazy"
></iframe>