[ralyodio]

dev2's root disk hit 99-100% on 2026-11-08, and supabase-db logged PANIC: No space left on device. A manual sweep freed 73 GB, mostly build output in finished checkouts. dev2/disk-clean runs that sweep nightly from crontab (30 4 * * *, under flock). It is a dry run unless given --apply.

It deletes only regenerable or provably dead things:

1. Build output (node_modules, target, .next, .turbo, .svelte-kit) under ~/src, ~/worktrees and ~/scratch, only when all of these hold:
   • it is a real build dir: next to a package.json, or a target next to a Cargo.toml or holding CACHEDIR.TAG;
   • no file in its whole repo changed in 3 days;
   • no running process has its working directory or binary there;
   • the repo is not used by a linked CLI, a cron line or a systemd unit.
2. Dead Claude job dirs: no state.json, idle 3+ days, and no running process names the job.
3. Backups: diskpush dbbackup prune applies each database's saved retention and always keeps the newest dump. .partial dumps older than 24 h that nothing has open are also removed.
4. Docker: build cache unused for 72 h and dangling images only. It never removes containers or volumes.

It never touches ~/www, database data, volumes, source files or .git. Logs go to ~/.local/state/disk-clean/. The first dry run on dev2 listed 9 idle build dirs and 3 finished job dirs.

🤖 Generated with Claude Code

[github-actions]

ThreatCrush Security Scan

41 finding(s)

HIGH/CRITICAL: 15 | MEDIUM: 12 | LOW: 14

Severity	Rule	Location
HIGH	py-ssrf-outbound-request	dev2/dev2-site:151
HIGH	py-ssrf-outbound-request	dev2/dev2-site:1099
HIGH	py-ssrf-outbound-request	dev2/dev2-site:1903
HIGH	sh-remote-script-execution	root-ubuntu.sh:3262
HIGH	sh-remote-script-execution	root-ubuntu.sh:3263
HIGH	sh-remote-script-execution	root-ubuntu.sh:5168
HIGH	sh-remote-script-execution	root-ubuntu.sh:5172
HIGH	sh-remote-script-execution	root-w3bs-os.sh:3639
HIGH	sh-remote-script-execution	root-w3bs-os.sh:3640
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5569
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5579
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5586
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5602
HIGH	sh-remote-script-execution	root-w3bs-os.sh:5607
HIGH	sh-plaintext-download	root-w3bs-os.sh:6289
MEDIUM	sql-template-interpolation	dev2/dev2-site:1334
MEDIUM	sql-template-interpolation	dev2/dev2-site:1411
MEDIUM	sh-remote-script-execution	root-ubuntu.sh:5376
MEDIUM	redos-nested-quantifier	src/domain-free.ts:56
MEDIUM	redos-nested-quantifier	src/emoji.ts:167
MEDIUM	redos-nested-quantifier	src/icon.ts:166
MEDIUM	redos-nested-quantifier	src/mail.ts:1060
MEDIUM	sql-template-interpolation	src/users-dump.ts:487
MEDIUM	sql-string-concatenation	src/users-dump.ts:507
MEDIUM	sql-template-interpolation	src/users-dump.ts:540
MEDIUM	sql-string-concatenation	src/users-dump.ts:574
MEDIUM	redos-nested-quantifier	src/wcag.ts:556
LOW	secret-generic-credential	src/credentials.ts:41
LOW	secret-generic-credential	src/credentials.ts:58
LOW	secret-generic-credential	src/credentials.ts:61
LOW	secret-generic-credential	src/credentials.ts:66
LOW	secret-generic-credential	src/user-export.ts:689
LOW	secret-generic-credential	src/user-export.ts:695
LOW	secret-generic-api-key	test/credentials.test.ts:208
LOW	secret-generic-credential	test/mail.test.ts:141
LOW	secret-generic-credential	test/proxy.test.ts:69
LOW	secret-generic-credential	test/proxy.test.ts:85
LOW	secret-generic-credential	test/shorten.test.ts:36
LOW	secret-database-url	test/users-dump.test.ts:108
LOW	secret-database-url	test/users-dump.test.ts:119
LOW	secret-database-url	test/users-dump.test.ts:120

Snippets are redacted; ThreatCrush never prints matched credential material.