Luman

The challenge

Disk-cleanup tools either hide why a file is safe to remove or make deletion too easy. Developers need an explanation for every recommendation, a dry-run default, and a hard line between scanning the disk and changing it.

Collaboration

I created Luman and shipped it myself: the safety model, the Tauri shell, the scan and cleanup services, and the confirmation gate every destructive action has to pass. There was no separate client. The product rule — scans are read-only, cleanup is always explicit — was the thing I took from the first design through to a desktop app.

From discovery to production

• Dashboard, smart scan, space lens, large files, applications, cleanup, and history in one offline app
• Read-only scans, with a filesystem port that cannot delete
• A confirmation gate on every destructive plan, defaulting to dry-run
• A path guard that refuses protected locations — home, Documents, Photos, System — even when a finding looks safe
• A written reason for each cleanup, instead of a hidden heuristic

How it was solved

The UI talks to application services. Those services talk to the domain — a scan, a finding, a cleanup action — and the domain talks to infrastructure. The scanner's filesystem port can only stat, list a directory, check existence, and resolve a real path. Deletion is not expressible there. PathGuard admits a path only when both its lexical path and its symlink-resolved path sit inside an allowed root and outside protected locations. SQLite stores history and settings. The safety gate treats a missing mode as dry-run.

Key technical decisions

• 01Layered packages so the UI cannot touch the filesystem or own the cleanup rules.
• 02Fail closed. If the mode is omitted, the plan is a dry-run. Execute is never the default.
• 03A read-only filesystem port, so a scanner cannot delete even by accident.
• 04SQLite for history and settings, with event payloads that stay serializable across the Tauri bridge.

Screenshots

Impact

• Every recommendation explains why it is safe, instead of hiding the reason.
• A scan cannot delete. Cleanup requires an explicit confirmation.
• Protected locations stay protected even when a finding looks safe.
• The app is offline-first: dashboard, scan, lens, cleanup, and history ship as one product.