Disk Space Audit

A repeatable workflow for auditing disk space on Windows and macOS (with Linux references). The output is a categorized report that tells the user exactly where their bytes went and what's safe to clean. Cleanup is a separate, explicitly-confirmed phase — the audit itself never touches anything.

Core principles

1. Audit is read-only. The scan-and-report phase never deletes, moves, or modifies files. Cleanup only begins when the user explicitly asks, and even then every item requires individual confirmation.
2. Ambiguous intent → ask, don't assume. If the user says "clean some stuff" without specifying what, or "delete the caches" without saying which, you MUST ask a focused clarifying question before acting. Never round up ambiguous approval into a broad deletion. When in doubt, ask one more question — not one fewer.
3. Surface potential issues mid-cleanup. If during a confirmed cleanup you notice something that looks wrong (a path resolves to more than expected, a cache is actively being written to, a folder belongs to a still-running app, a symlink points somewhere unexpected), STOP and ask before continuing — even if the user already said "yes" to that item. Confirmation is not a blank check; new information resets it.
4. Value over vanity. The goal is NOT to maximize "GB cleaned". Clearing 50GB of useful cache to show a big number is harmful. A cache that saves 30 minutes of download time is worth keeping. Every recommendation must weigh re-acquisition cost (time, bandwidth, availability) against space saved.
5. Network environment awareness. Many users (especially in China) have slow or unreliable internet. Re-downloading a 10GB cache can take hours. Always state the re-download cost when recommending cache deletion. If the user is on a slow connection, lean toward keeping caches.
6. Speed matters. Naive Get-ChildItem -Recurse / du on directories with millions of small files (caches, node_modules, uv cache) or NTFS junctions/reparse points will hang for tens of minutes or forever. Use MFT-reading tools on Windows, parallel Rust tools elsewhere.
7. Investigate before judging. Folders with cryptic names (e.g. onetFile, Huorong, MineLogin) must be identified via web search + content inspection before being labeled "safe to delete". Don't guess.
8. Categorize, don't just list. A flat list of 500 folders is useless. Group by: system vs user, cache vs data, active app vs uninstalled residue. Rank cleanup candidates by (size × safety).

Workflow

Phase 1 — Recon (2 min)