Free MIT-licensed Tauri 2 desktop app (Rust + React 19) for developer-machine hygiene from solo dev 'felix bear' (linux.do 摇摆熊): scans project dirs for dev artifacts (node_modules, target, logs, caches), removes per-project AI-tool leftovers (chat history, sessions, debug files) while sparing active configs, manages installed dev tools and global packages plus 25 AI CLIs (install/update), and runs a local security scan (non-localhost ports, credentials in config files, MCP server exposure/SSRF patterns). Ships Windows (.msi/NSIS/portable), macOS (.dmg, unsigned), Linux (AppImage/deb/rpm); signed Tauri auto-updater. Launched Jan 2026 on linux.do as 'Your Vibe Coding Toolkit' - a cleaner for the mess vibe coding leaves behind; 864 stars.
Solo author cocojojo5213 (linux.do Jojo_Coco/摇摆熊); dependabot files the dependency PRs. Active through 2026-10-14; several dependabot PRs sit open since Aug-Sep 2026.
License
MIT
MIT
Price
Free
Free and open source
Launched
repo_created_at
Repo created
GitHub stars
864 (as of 2026-11-02)
First release
Last seen alive
Checks
Mechanical checks derived from the fields above. Each row is one fact; "not yet checked" means exactly that, not a failure. There is no composite score; read them together.
Track record
291 days ago
Source published
Yes
Release signing
Mixed
Security contact
Yes
Reproducible builds
Not yet checked
Telemetry
None
Runs elevated
Never
Auto-update channel
Signed
Recent activity
Last seen yesterday
MIT source with full public git history since first commit 2026-01-16 (v1.0.0 Electron, rebuilt to Tauri at v2.0.0).
Every release asset carries a minisign .sig (Tauri updater pubkey in tauri.conf.json), but the macOS dmg is unsigned - README says first launch needs 'Right Click > Open' for Gatekeeper - and Windows installers show no Authenticode evidence.
SECURITY.md: private email cocojojo5213@gmail.com, 'usually acknowledge new reports within 5 business days', coordinated disclosure.
Tauri plugin-updater checks a signed latest.json on GitHub releases and installs + relaunches in-app (Windows passive install mode); 'add signed app updates' landed in v2.5.0 (PR #47, 2026-07-21).
No telemetry/analytics dependencies in package.json (radix-ui, tauri plugins, i18next, react, zustand only); network calls are the update check and user-initiated package/tool operations.
User-space desktop app: no privileged helper, setuid, or service in docs or source; deletes only user-owned dev artifacts.
Same linux.do wave of Chinese community cleanup tools (catalog entry c-cleaner-plus): Kiowx's C:-drive cleaner launched there Feb 2026, a month after Dev-Janitor. The same forum also produced dengyuwu/dev-tools and zekertop's CliJanitor AI-session cleaner.
Research notes
Born inside the vibe-coding workflow it cleans: repo created 2026-01-16, first linux.do mention Jan 25 ('back to debugging this project'), first dedicated promotion Jan 27 riding the viral Clawdbot/OpenClaw moment with a new AI-assistant security-scan module - author: '不蹭白不蹭' ('might as well ride the hype').
Author's stated motivation (linux.do post '为Vibe Coding打造的环境清理工具！', Feb 2026): AI-assisted dev piles up dependencies, AI CLIs, and open ports - 'careful review at first, then yes yes yes... who cleans up the battlefield?'
Electron first, Tauri second: shipped as v1.0.0 '开发清道夫' on repo-creation day, rebuilt to Tauri 2 + React + Rust, and re-released as v2.0.0 eight days later (changelog claims <25MB bundle vs ~150MB Electron; author cites a <2MB installer).
Machine-gun but documented cadence: 31 releases Jan 24-Sep 8 (v2.0.0-v2.5.1) including v2.0.0-v2.0.4 in 48h and v2.4.0->v2.4.1 two hours apart; release notes carry CI run ids and per-asset validation receipts.
Deletion safety is engineered, not just claimed: cache and AI-cleanup paths pass through canonicalize_existing_path which refuses symlink targets before remove_dir_all ('Refusing to delete symlink path'), and active AI-tool configs (.claude/settings.json, .codex/config.toml, .goosehints, .junie/AGENTS.md) are whitelisted out of junk matching.
Solo dev on a GitHub account six months old at launch; Chinese-first bilingual output and +0900 commit timezone; also ships phonics-app, the cancel-me linux.do filter extension, and agent tooling (rea, pi-luna-workflow).
Earliest author promotion found: casual linux.do post ('went out for food, back to debugging this project') already linking the repo - one day after the v2.0.0 Tauri rebuild release, nine days after repo creation. linux.do is invite-only; topics 404 logged-out, text captured via search index.
First dedicated product promotion found: launched the AI-assistant security-scan module into the viral Clawdbot (now OpenClaw) moment; repo tagline at the time was 'Your Vibe Coding Toolkit'.
工具你用起来爽，用不了多久你电脑就千疮百孔了，到时候你的24小时助手就变成别人的24小时仆人了 (The tool feels great to use, but soon your computer is full of holes and your 24-hour assistant becomes someone else's 24-hour servant) — Problem statement