[guhcostan]

What does this PR do?

Adds Mac Cleaner, a downloadable macOS menu bar app in desktop/. It is built with Electron and bundles the CLI's scanners straight from ../src, so the categories, safety levels and protected-path checks are the same as the CLI's.

• Menu bar icon: a minimal monochrome sparkle (template image, so it follows the light/dark menu bar). Click it to open a popover; right-click for a quick menu. There is no Dock icon (LSUIElement). The app icon uses the same mint sparkle on a light squircle. All icons are generated by desktop/scripts/make-icons.py.
• Daily automatic clean at a time you set (default 10:00). If the Mac was asleep at that time, it runs on wake. It never runs twice in one day, and it waits for the first scheduled time after install instead of cleaning right away. Default categories: temp-files, browser-cache, homebrew, system-logs. You can change them in Settings, but risky categories are blocked in the main process.
• Clean Now: runs the same selection on demand.
• Deep Clean (hard delete): scans more categories, including risky ones if you opt in, and shows a preview per category with its largest items. Nothing is deleted until you tick categories and confirm. If the preview is more than 15 minutes old, it rescans first.
• Shows what was removed: history with space freed per category and any errors, a total freed so far, and a notification after automatic runs.
• Launch at login, disk usage bar, Full Disk Access banner with a shortcut to System Settings.
• Security: sandboxed renderer with no Node access, a strict CSP, a minimal preload API, and IPC accepted only from the bundled page.

Packaging: electron-builder produces .dmg and .zip files for arm64 and x64. The build is ad-hoc signed by default. It is signed and notarized automatically when the optional secrets are set (listed in desktop/README.md). The new .github/workflows/desktop.yml workflow builds on macOS, uploads the artifacts, and attaches them to GitHub releases.

The root lint script now also covers desktop/src.

Type of change

• Bug fix
• New feature (new scanner, command, or option)
• Improvement to existing feature
• Chore / dependency update
• Documentation

Related issue

N/A

Checklist

• bun run lint passes
• bun run test passes (no regressions): 344 root tests, plus 38 new desktop tests (scheduler, settings validation, store, clean engine, controller)
• bun run build succeeds (CLI and desktop bundle)
• New tests added for new behavior
• I've tested this on macOS locally: not yet. It was verified on Linux: the real Electron app (dev and packaged) runs under Xvfb, IPC works, the real scanners run, and state is persisted. The UI was screenshot-tested in Chromium in light and dark mode. The .dmg is built by the macOS CI job.

Notes for reviewer

• Worth checking on a real Mac: tray icon rendering, popover position under the icon, vibrancy, notifications, launch at login, and the Full Disk Access flow.
• Why Electron instead of Swift: it reuses the TypeScript scanners as they are, and the logic can be tested on any OS. The cost is a download of about 100 MB.
• Unsigned builds show a Gatekeeper warning. The workaround is described in desktop/README.md.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QnDqAyRdicRYnwAAXydYoB

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8be49492a4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".