Open source · macOS · Rust + Tauri 2
Tidy is Mole's open-source macOS desktop app. Cleaning, uninstalling, optimizing, and disk analysis all put the full candidate list in front of you first. Whatever you tick is exactly what gets removed — the architecture makes one extra file impossible.
macOS 11+Universal (Intel & Apple silicon)English / 中文Version 0.1.0 · 17 MB
0.1.0 is the first public release. The installer is signed with a Developer ID and notarized by Apple, so it opens without the "unidentified developer" warning. The app checks for its own updates and sends anonymous usage statistics — both can be turned off in Settings, and the privacy page lists every field collected. All releases
clippy.toml bans every std::fs::remove_* outside mole-core::sink through disallowed-methods. The workspace contains exactly one #[allow], inside the sink; new destructive behavior has to go through a DeletionPlan.
plan_* commands scan and store the preview in a PlanStore; execute_plan accepts only (plan_id, your selected subset). Nothing is re-scanned after confirmation, so the UI cannot execute anything it never previewed.
Removals go through NSFileManager into the Trash. operations.log and deletions.log are byte-compatible with the Mole CLI and pinned by golden tests, so mo history reads both surfaces.
The interface
The Uninstall view lists every app on the machine and what it occupies; expand any row to see everything that app left behind. Whatever you tick is the entire set that moves to the Trash — nothing is re-scanned after you confirm.
Workflows
Before: you know ~/Library/Caches is huge but will not delete it wholesale.
Before: drag to Trash, leave Application Support, containers, and LaunchAgents behind.
Before: open each app and click Check for Updates.
Before: paste a command from the internet and hope you know what it changes.
Five modules
Reclaimable space grouped by origin.
Uninstall, Updates, and Login Items.
One bounded maintenance pass.
A treemap of the disk or the current folder.
What this Mac is busy with right now.
Language, whitelist, history.
Safety boundary
This is code structure, not a copywriting promise: each destructive feature builds a DeletionPlan and can only execute through the single sink. Whitelist checks, session markers, logging, and progress reporting therefore cannot diverge between features.
Shared state lives in ~/.config/mole; operation and deletion history in ~/Library/Logs/mole. The repository contains no analytics, telemetry, or crash-reporting code, and the window CSP is default-src 'self'.
An update scan reaches Apple's bundle-ID lookup, an app's own Sparkle feed, and the GitHub release API, and reads local Homebrew output. A scan expires after 15 minutes, and update buttons carry only opaque backend-issued IDs.
build.rs parses app_protection_data.sh into Rust constants and fails the build on any unrecognized line. The list's DATA_SHA256 is surfaced in the About row so it can be checked.
The helper's in-helper re-validation and mutable-ancestor refusal already ship in the repository, but the SMAppService/XPC transport does not. System-scope actions therefore refuse with requires_admin rather than falling back to a shell elevation prompt.
Getting it
For most people the DMG is all you need. If you would rather verify for yourself exactly what it deletes, the source lives in the desktop/ directory of github.com/rambocode/tidy; you need Rust stable and Node ≥ 20.
git clone https://github.com/rambocode/tidy.git
cd tidy/desktop
# backend checks
cargo test --workspace
cargo clippy --workspace -- -D warnings
# run the desktop app
cd ui && npm install && npx tauri dev
Known caveat: the mole-core test dangerous_paths_corpus_all_rejected reads an adversarial corpus from the parent repository. In a checkout containing only desktop/, that one test fails, and that is expected.
FAQ
Yes. Download the 0.1.0 DMG (17 MB, Universal, runs on both Intel and Apple silicon, needs macOS 11 or later). It is signed with a Developer ID and notarized by Apple, so it opens without a Gatekeeper prompt. The app also checks for its own updates.
User-scope deletions all go to the Trash through NSFileManager and can be restored from there. System-scope actions are not executed at all right now — they refuse with requires_admin — so there is no path that quietly removes a system file. Every run is written to ~/Library/Logs/mole.
The repository has no analytics, telemetry, or crash-reporting code, and the window CSP is limited to default-src 'self'. The only outbound requests happen when you deliberately check for software updates: Apple's bundle-ID lookup, an app's own Sparkle feed, and the GitHub release API.
Tidy is Mole's desktop surface, and its safety layer is a Rust port of the CLI's. Public product copy uses Tidy; internal crate names, compatibility events, and shared logs keep the Mole name. operations.log and deletions.log stay byte-compatible, so mo history reads both.
The interface names the cause: unchanged (target missing or already healthy), apps_running (close the named app first), probe_failed (the step could not be proven safe), requires_admin (needs the unreleased privileged helper), skipped (whitelisted or blocked by another safety condition). Disabled controls keep their label and expose the reason instead of just dimming.
Not currently. The adapter layer is mole-macos and depends on NSFileManager Trash semantics and the macOS privileged-helper model; no other platform implementation exists yet.
Feedback
There is no installer yet, so there are no public user reviews — which is why this page carries no testimonials. The one feedback channel today is GitHub Issues. Paste the refusal code you saw (probe_failed, requires_admin, and so on) together with the matching lines from ~/Library/Logs/mole; that locates a problem far faster than a description of the symptom.
Source, safety boundary, and log formats are all public and checkable.