Fix

v0.11.2 unconditionally ad-hoc signed the watch bundle on install. That was the right fallback for end users (who don't have my Developer ID cert), but wrong on machines that do — and "always ad-hoc when we have a real cert sitting in the keychain" is the kind of laziness that shows up in System Settings as a half-built tool.

What changed

`diskspace watch install` now runs `security find-identity -v -p codesigning` and signs the bundle with the first Developer ID Application identity it finds (with hardened runtime + Apple timestamp). No `--deep` flag, so the inner Mach-O's existing notarized signature is preserved — codesign only seals the bundle wrapper. Falls back to ad-hoc when no Developer ID is available.

Result

• On the developer's machine (or any Mac with a Developer ID Application cert): bundle is now Developer-ID signed with a real `TeamIdentifier`, hardened runtime, and Apple-anchored timestamp. Gatekeeper now rejects with "Unnotarized Developer ID" instead of "unidentified developer" — same daemon behavior, but the dialog the user might encounter is much friendlier and overridable.
• On a Mac without the cert: identical to v0.11.2 (ad-hoc fallback).

Open follow-up

The cleanest fix is to sign + notarize the bundle at release time and ship a pre-cleared bundle as a release artifact. That eliminates Gatekeeper rejection entirely. Tracking for v0.12.

Upgrade

```bash
brew upgrade diskspace
diskspace watch uninstall
diskspace watch install
```

Fix

v0.11.1 materialized the `DiskspaceWatch.app` bundle but didn't sign the bundle as a unit. The inner Mach-O kept its Developer ID signature, but Info.plist and Resources weren't sealed — so the moment macOS Gatekeeper saw the bundle being launched interactively, it threw "DiskspaceWatch.app is damaged and can't be opened. You should move it to the Trash."

The background launchd agent kept ticking fine (launchd bypasses Gatekeeper), but the interactive surface was broken.

What changed

`diskspace watch install` now ad-hoc signs the bundle (`codesign --force --deep --sign -`) after materializing it. The bundle gets a valid local signature that seals Info.plist + Resources + binary together. No Developer ID cert required on the user's machine.

Gatekeeper will still reject ad-hoc-signed apps for click-launch — that's policy, not signature validity — but the dialog wording shifts from "damaged" to "unidentified developer," which is cancellable and non-destructive. Realistically, nobody should be clicking the .app anyway; it's a launchd-managed background agent.

Upgrade

```bash
brew upgrade diskspace
diskspace watch uninstall
diskspace watch install # re-materializes the bundle with the ad-hoc signature
```

Universal binary, Developer ID signed (Xoder PR LLC), notarized.

What's new

App icon + .app bundle wrapper for the watch agent

Until now, the launchd agent installed by `diskspace watch install` pointed directly at the raw `diskspace` Mach-O binary. That meant macOS had no `Info.plist` or icon to display, so the System Settings → Login Items / Background Items tile rendered blank — unprofessional and a real trust hit for a tool that lives and dies by trust.

This release fixes that. `diskspace watch install` now materializes a minimal `.app` bundle:

```
~/Library/Application Support/diskspace/DiskspaceWatch.app/
├── Contents/
│ ├── Info.plist (CFBundleIdentifier = com.tymrtn.diskspace.watch, LSUIElement = true)
│ ├── MacOS/
│ │ └── DiskspaceWatch (self-contained copy of the running diskspace binary)
│ └── Resources/
│ └── AppIcon.icns (embedded in the diskspace binary via include_bytes!)
```

The launchd plist points at the bundle's binary, so macOS now has an actual app identity to display in System Settings — including the new app icon: a charcoal rounded-square with a cream disk ring and a 70° amber wedge representing reclaimed space.

Re-running `watch install` refreshes the bundle

If you upgrade diskspace via brew or cargo, just run `diskspace watch install` again — the bundle is rebuilt from the running binary with the latest version metadata and icon.

Install / upgrade

```bash
brew upgrade diskspace
diskspace watch install # re-run to refresh the bundle if you previously installed v0.11.0
```

Universal binary, code-signed (Developer ID Application: Xoder PR LLC), notarized.

What's new

diskspace watch — the always-on companion

Background launchd-backed disk-pressure monitor:

• diskspace watch install — register the launchd agent
• diskspace watch uninstall — remove it
• diskspace watch status — last check, level, threshold
• diskspace watch run — one tick (also what launchd calls)

Checks every 5 minutes. 10% free triggers a soft macOS notification suggesting `diskspace detect`; 5% free flips to urgent and recommends `diskspace doctor`. State is deduped so you don't get pinged every 5 minutes once you've already been told.

No auto-delete in v0.11.0 — diskspace nudges; you decide.

Chromium-family on-device AI model rules

Six new rules covering Chrome, Edge, Brave, Arc, Chromium, and the Windows-shape `OptGuideOnDeviceModel` layout. The consequence block tells you the important part: the browser re-downloads these unless you first disable on-device AI in Settings (or via `chrome://flags`). Confidence is intentionally low (0.55) so the rule recommends `airlock` rather than `reclaim`.

Install / upgrade

```bash
brew upgrade diskspace # if already installed via tymrtn/diskspace tap
brew install tymrtn/diskspace/diskspace # first install
cargo install diskspace-cli # via crates.io
```

Universal binary, code-signed and notarized.

What's new

diskspace undo

Friendlier wrapper around restore. Reads the receipts ledger, finds the most recent reversible action, and reverses it. No need to copy/paste an airlock id.

Consequence metadata expanded: 37 → 69 rules

Added consequences blocks (recovery type, time estimate, impact, recover_cmd) to 32 more rules: browser caches (Chrome, Firefox, Safari, Arc), chat apps (Slack, Discord, Zoom, Teams), design tools (Figma, Notion, Linear), iOS dev (CocoaPods, Swift PM), JetBrains, old installers (DMG/PKG/ZIP), screenshots, Mail, and more.

diskspace explain <path> and the if you delete this panel in check now have informative recovery guidance for the vast majority of common rules.

Install

cargo install diskspace-cli

Or with Homebrew:

brew install tymrtn/diskspace/diskspace

Or download the signed + notarized universal binary below.

M9 — make it work without an agent in the loop

After real-world stress testing exposed gaps and Codex did an adversarial review of the plan, six gates landed:

diskspace doctor [--need <size>]

One-shot emergency recovery. Scans, detects, pressure-tests, greedy-picks the smallest safe set that hits your free-space target, executes. Switches between airlock (reversible) and immediate-delete based on disk pressure. Reports actual df delta.

diskspace explain <path>

The trust front-door. Audit any path before deleting: matching rule, consequences, live pressure-test results, recommended command. Works even on paths no rule covers.

Per-target typed consent (replaces --force)

A global force flag would be brand-damaging. Instead, airlock --immediate <id> --unsafe-confidence and reclaim --unsafe-confidence show the consequences block and require you to retype each candidate id verbatim. The friction is the point.

Honest accounting on airlock

Same-volume rename is not "freed" — bytes stay on disk until purge. We now say staged for purge for same-volume and freed for cross-volume. JSON output includes move_kind.

Receipts ledger (~/.diskspace/history.jsonl)

Every action writes a structured entry: df_before/after, actually_freed, reversible, undo_cmd, rule_confidence, pressure-test outcome. View with diskspace receipt.

Disk-pressure threshold preference

disk_pressure_threshold_gb (default 5) — doctor switches to immediate-delete below this.

Install

cargo install diskspace-cli

Or with Homebrew:

brew install tymrtn/diskspace/diskspace

Or download the universal binary below — signed and notarized.

What's new

• Scanner cache fix: scan.json shrunk from 1.1GB to ~7MB by persisting only rule-matched entries
• 11 new rules for caches we found in the wild: ms-playwright, pnpm-store, ShipIt updaters, camoufox, Brave/Dia/Comet/Atlas/Canva caches, stale/ folder convention, _archive node_modules
• Consequence metadata now on 25 rules — diskspace check shows what happens if you delete each candidate
• Cargo.toml prepped for crates.io publish

Install

cargo install diskspace

Or grab diskspace-universal below (Apple Silicon + Intel).

Renamed: disk-space → diskspace

One word, more sci-fi connotations. data_dir() now chains migration:

• `/.disk-advisor/` → `/.diskspace/`
• `/.disk-space/` → `/.diskspace/`

Repo also renamed; GitHub redirects from old URLs.

M6 — Consequence explanations

`diskspace check` now shows what actually happens if you delete a candidate:

```
── if you delete this ──

recovery redownload · ~1 min
impact Project won't run until reinstalled. Downloads from npm (needs internet).
recover npm install (or pnpm install / yarn)
```

New `consequences` block on rules in `builtin.yaml`:

• `recovery`: auto | redownload | rebuild | recreate | manual | irreversible
• `rebuild_seconds`: rough cost-to-recover
• `impact`: human-readable description
• `recovery_cmd`: optional command to recover

Populated for the four highest-impact rules. CONTRIBUTING.md documents the field for future PRs.

Install

```bash
cargo install diskspace
```

Or grab `diskspace-universal` from the assets below.

Renamed

disk-advisor is now disk-space. The tool's job is finding dead weight in your disk's cargo hold, so the language should match.

• package, binary, data directory all renamed
• automatic one-time migration: ~/.disk-advisor/ → ~/.disk-space/ on first run
• repo renamed to tymrtn/disk-space (GitHub redirect preserves old links)

Space-themed UX

• New tagline: find the dead weight in your cargo hold
• New ASCII logo
• Welcome reorganized: ship status + flight plan
• First-run wizard reframed as crew briefing
• reclaim header: jettisoning cargo
• airlock (was quarantine): bidirectional in-between space — items can come back out or get vented

Install

cargo install disk-space

Or grab disk-space-universal below (Apple Silicon + Intel).

What's new in M5

First-run wizard

On first launch (no profile exists), disk-advisor now greets you with a short questionnaire: pick which domains describe your work (web, iOS, Rust, Go, Docker, etc.) and your profile is written automatically. Agents and scripts skip the wizard automatically when using --json, --yes, or a non-TTY.

Cloud placeholder detection

iCloud Drive evicted files and Dropbox Smart Sync online-only files no longer inflate your scan totals. The scanner checks for files with zero disk blocks allocated and skips them, reporting the skipped total separately:

☁ 51.7 GB in cloud-only files skipped (iCloud / Dropbox — not local)

Universal binary

The attached disk-advisor-universal binary runs natively on both Apple Silicon (arm64) and Intel (x86_64) Macs.

Install

cargo install disk-advisor

Or download disk-advisor-universal from the assets below.

Roadmap

• M6 — consequence explanations per candidate: recreation effort, rebuild time, performance impact while gone