#!/bin/bash
# =============================================================================
#  junk.report  -  a read-only report of where your Mac's disk space went.
#
#  Run it:   curl -fsSL https://junk.report/scan | bash
#  Or read it first (recommended):
#            curl -fsSL https://junk.report/scan -o scan.sh && less scan.sh && bash scan.sh
#
#  WHAT IT DOES
#   1. Measures well-known space hogs in YOUR home folder using built-in
#      macOS tools only: du, find, stat, df, awk, sed, sort, dd, tail, md5, open, nc.
#      To spot duplicate copies it reads big files that have the exact same size
#      and compares their fingerprints (md5). Reading only; nothing is changed.
#   2. Writes ONE report: ~/junk-report.html (only you can read it), opens it.
#      Also saves a small snapshot (sizes of the items in the report, plus free
#      space) in ~/.junk-report/, so next time it can show you what you freed.
#   3. Keeps a tiny helper running on 127.0.0.1 (this Mac only, never the
#      network) so the report's "Show in Finder" buttons work. It only reveals
#      paths that are listed in the report, needs a random secret, and stops by
#      itself after 30 minutes or when you press Control-C.
#
#  WHAT IT NEVER DOES
#   - delete, move, rename or change any of your files
#   - upload or send anything anywhere (no network calls at all)
#   - ask for your password / use sudo
#   - need Python, Homebrew or Xcode
#
#  OPTIONS (environment variables, e.g.  JR_NO_HELPER=1 bash scan.sh)
#   JR_NO_HELPER=1   don't start the helper; buttons copy the path instead
#   JR_MINUTES=30    how long the helper stays up (1-120)
#   JR_NO_OPEN=1     don't open the report automatically
#   JR_OUT=path      write the report somewhere else
#   JR_NO_SNAPSHOT=1    don't save or compare snapshots (~/.junk-report)
#   JR_DUPE_MIN_MB=50   smallest file size checked for duplicates
#   JR_DUPE_SECONDS=120 time limit for the duplicate check
#   JR_FIND_SECONDS=150 time limit for the big-file search
#   JR_TEST=1        Linux test mode (with JR_HOME=fake home); see test/
# =============================================================================

# Everything lives in functions and runs from the last line, so a download that
# gets cut off halfway can't run half a script.

jr_say() { printf '%s\n' "$*" >&2; }

jr_setup() {
  TAB=$(printf '\t')
  NL='
'
  H="${JR_HOME:-$HOME}"
  H="${H%/}"
  TEST="${JR_TEST:-0}"
  OUT="${JR_OUT:-$H/junk-report.html}"
  MINUTES="${JR_MINUTES:-30}"
  case "$MINUTES" in ''|*[!0-9]*) MINUTES=30 ;; esac
  [ "$MINUTES" -lt 1 ] && MINUTES=1
  [ "$MINUTES" -gt 120 ] && MINUTES=120
  TOPN=25
  DUPE_MIN_MB="${JR_DUPE_MIN_MB:-50}";   case "$DUPE_MIN_MB" in ''|*[!0-9]*) DUPE_MIN_MB=50 ;; esac
  [ "$DUPE_MIN_MB" -lt 1 ] && DUPE_MIN_MB=1
  DUPE_SECONDS="${JR_DUPE_SECONDS:-120}"; case "$DUPE_SECONDS" in ''|*[!0-9]*) DUPE_SECONDS=120 ;; esac
  FIND_SECONDS="${JR_FIND_SECONDS:-150}"; case "$FIND_SECONDS" in ''|*[!0-9]*) FIND_SECONDS=150 ;; esac
  BIG_BLOCKS=204800            # 100 MB, in find's 512-byte -size units (same on BSD and GNU find)
  if [ "$TEST" = 1 ]; then
    APP_DIRS="${JR_APPS:-$H/_Applications}"
  else
    APP_DIRS="/Applications${NL}/Applications/Utilities${NL}$H/Applications${NL}/System/Applications${NL}/System/Applications/Utilities"
  fi
  umask 077
  TMP=$(mktemp -d "${TMPDIR:-/tmp}/junkreport.XXXXXX") || { jr_say "Couldn't make a temp folder."; exit 1; }
  REC="$TMP/records.tsv"; ALLOW="$TMP/allow"
  : > "$REC"; : > "$ALLOW"
  NEXT_ID=0
  HELPER_PID=""
}

jr_cleanup() {
  [ -n "${HELPER_PID:-}" ] && kill "$HELPER_PID" 2>/dev/null
  # shellcheck disable=SC2046
  kill $(jobs -p) 2>/dev/null
  [ -n "${TMP:-}" ] && [ -d "$TMP" ] && rm -rf "$TMP"
}

# ---- portability shims ------------------------------------------------------
# du: macOS du reports space actually used on disk. In Linux test mode the
# sample files are sparse, so we ask GNU du for their apparent size instead.
# Test mode also enforces macOS du's rule that -a, -s and -d can't be combined
# (Apple's du prints its usage message and measures nothing). v1 broke on exactly that.
jr_du() {
  if [ "$TEST" = 1 ]; then
    _fa=0; _fs=0; _fd=0
    for _arg in "$@"; do
      case "$_arg" in /*) continue ;; -*) ;; *) continue ;; esac
      case "$_arg" in -*a*) _fa=1 ;; esac
      case "$_arg" in -*s*) _fs=1 ;; esac
      case "$_arg" in -*d*) _fd=1 ;; esac
    done
    if [ $((_fa + _fs + _fd)) -gt 1 ]; then echo "du: macOS du refuses -a/-s/-d together" >&2; return 64; fi
    du --apparent-size "$@"
  else du "$@"; fi
}
# Size of every direct child of a folder (files and folders), one "KB<tab>path" line each.
jr_du_children() {
  if [ "$TEST" = 1 ]; then find "$1" -mindepth 1 -maxdepth 1 -print0 | xargs -0 -r du --apparent-size -sk
  else find "$1" -mindepth 1 -maxdepth 1 -print0 | xargs -0 du -sk; fi
}

# reads NUL-separated paths on stdin, prints "<KB><tab><path>" for each.
# macOS: blocks actually used on disk (512-byte units). Test mode: apparent size.
jr_stat_kb() {
  if [ "$TEST" = 1 ]; then xargs -0 stat -c '%s %n' 2>/dev/null | awk '{s=$1; sub(/^[0-9]+ /,""); printf "%d\t%s\n", s/1024, $0}'
  else xargs -0 stat -f '%b %N' 2>/dev/null | awk '{s=$1; sub(/^[0-9]+ /,""); printf "%d\t%s\n", s/2, $0}'
  fi
}

# reads NUL-separated paths, prints "bytes<tab>512-byte-blocks<tab>device:inode<tab>path"
jr_stat_full() {
  if [ "$TEST" = 1 ]; then xargs -0 -r stat -c '%s %b %d:%i %n' 2>/dev/null
  else xargs -0 stat -f '%z %b %d:%i %N' 2>/dev/null
  fi | awk '{b=$1; k=$2; n=$3; sub(/^[0-9]+ [0-9]+ [0-9]+:[0-9]+ /,""); printf "%s\t%s\t%s\t%s\n", b, k, n, $0}'
}
# fingerprints: md5 of first + last 1 MB (quick), md5 of the whole file (sure)
jr_qhash() {
  { dd if="$1" bs=1048576 count=1 2>/dev/null; tail -c 1048576 "$1" 2>/dev/null; } |
    if [ "$TEST" = 1 ]; then md5sum | awk '{print $1}'; else md5 | awk '{print $NF}'; fi
}
jr_fhash() {
  if [ "$TEST" = 1 ]; then md5sum < "$1" 2>/dev/null | awk '{print $1}'; else md5 -q "$1" 2>/dev/null; fi
}

jr_open() {
  if [ "$TEST" = 1 ]; then printf 'open %s\n' "$*" >> "${JR_TEST_LOG:-$TMP/open.log}"; return 0; fi
  open "$@" >/dev/null 2>&1
}

# Run a command, but stop it after N seconds (macOS has no `timeout`).
# Returns 124 if it had to be stopped.
jr_killtree() {
  for _c in $(pgrep -P "$1" 2>/dev/null); do jr_killtree "$_c"; done
  kill "$1" 2>/dev/null
}
jr_timeout() {
  _secs=$1; shift
  "$@" &
  _pid=$!
  ( trap 'kill $_s 2>/dev/null; exit 0' TERM
    sleep "$_secs" & _s=$!; wait $_s
    : > "$TMP/timedout.$_pid"; jr_killtree "$_pid" ) >/dev/null 2>&1 &
  _dog=$!
  wait "$_pid" 2>/dev/null; _rc=$?
  kill "$_dog" 2>/dev/null; wait "$_dog" 2>/dev/null
  if [ -e "$TMP/timedout.$_pid" ]; then rm -f "$TMP/timedout.$_pid"; return 124; fi
  return $_rc
}

# ---- recording results --------------------------------------------------------
# Every path that appears in the report gets an id. The helper will only ever
# reveal paths from this list (the allow-list).
jr_add_path() {
  REPLY_ID=-1
  case "$1" in *"$NL"*|*"$TAB"*|'') return 1 ;; esac
  printf '%s\n' "$1" >> "$ALLOW"
  printf 'P\t%s\t%s\n' "$NEXT_ID" "$1" >> "$REC"
  REPLY_ID=$NEXT_ID
  NEXT_ID=$((NEXT_ID + 1))
}
# category: key verdict kb partial(0/1/2=timed out) [path]
jr_cat() {
  _cid=-1
  if [ -n "${5:-}" ]; then jr_add_path "$5"; _cid=$REPLY_ID; fi
  printf 'C\t%s\t%s\t%s\t%s\t%s\n' "$1" "$2" "${3:-0}" "${4:-0}" "$_cid" >> "$REC"
}
# item: key kb path label [flag]
jr_item() {
  jr_add_path "$3" || return 0
  printf 'I\t%s\t%s\t%s\t%s\t%s\n' "$1" "$2" "$REPLY_ID" "${5:-}" "$4" >> "$REC"
}
jr_meta() { printf 'M\t%s\t%s\n' "$1" "$2" >> "$REC"; }

# ---- measuring ----------------------------------------------------------------
# Measure a folder and its direct children in one pass.
# Sets M_TOTAL (KB), M_PARTIAL (1 if macOS privacy blocked some of it, 2 if it
# took too long) and leaves "KB<tab>path" child lines in $TMP/kids, biggest first.
jr_measure() {
  M_TOTAL=0; M_PARTIAL=0
  : > "$TMP/kids"
  [ -d "$1" ] || return 1
  jr_timeout "${2:-120}" jr_du_children "$1" > "$TMP/m.out" 2> "$TMP/m.err" < /dev/null
  [ $? -eq 124 ] && M_PARTIAL=2
  [ "$M_PARTIAL" = 0 ] && [ -s "$TMP/m.err" ] && M_PARTIAL=1
  awk -F'\t' '$1 ~ /^[0-9]+$/ && NF >= 2' "$TMP/m.out" | sort -t "$TAB" -k1,1nr > "$TMP/kids"
  M_TOTAL=$(awk -F'\t' '{s+=$1} END{print s+0}' "$TMP/kids")
  return 0
}
jr_size() {
  S_KB=0; S_PARTIAL=0
  [ -e "$1" ] || return 1
  jr_timeout "${2:-120}" jr_du -sk "$1" > "$TMP/s.out" 2> "$TMP/s.err" < /dev/null
  [ $? -eq 124 ] && S_PARTIAL=2
  [ "$S_PARTIAL" = 0 ] && [ -s "$TMP/s.err" ] && S_PARTIAL=1
  S_KB=$(awk -F'\t' 'END{print $1+0}' "$TMP/s.out")
  return 0
}
jr_kid_kb() { awk -F'\t' -v p="$1" '$2==p{print $1; exit}' "$TMP/kids"; }

# A folder as one category, its biggest children as items.
# usage: jr_dir_cat key verdict dir max_items [child-to-exclude ...]
jr_dir_cat() {
  _key=$1; _ver=$2; _dir=$3; _max=$4; shift 4
  jr_measure "$_dir" || return 0
  _total=$M_TOTAL
  : > "$TMP/excl"
  for _ex in "$@"; do
    _ek=$(jr_kid_kb "$_ex"); _total=$((_total - ${_ek:-0})); printf '%s\n' "$_ex" >> "$TMP/excl"
  done
  [ "$_total" -gt 0 ] || return 0
  jr_cat "$_key" "$_ver" "$_total" "$M_PARTIAL" "$_dir"
  _n=0
  while IFS="$TAB" read -r _kb _p; do
    [ "$_n" -ge "$_max" ] && break
    [ "$_kb" -lt 10240 ] && break                     # skip anything under 10 MB
    grep -qxF -- "$_p" "$TMP/excl" && continue
    jr_item "$_key" "$_kb" "$_p" "${_p##*/}"
    _n=$((_n + 1))
  done < "$TMP/kids"
}

# Several separate paths as one category.  usage: jr_paths_cat key verdict label|path ...
jr_paths_cat() {
  _key=$1; _ver=$2; shift 2
  _total=0; _part=0; : > "$TMP/pc"
  for _lp in "$@"; do
    _label=${_lp%%|*}; _path=${_lp#*|}
    jr_size "$_path" || continue
    [ "$S_KB" -gt 0 ] || continue
    _total=$((_total + S_KB)); [ "$S_PARTIAL" -gt "$_part" ] && _part=$S_PARTIAL
    printf '%s\t%s\t%s\n' "$S_KB" "$_path" "$_label" >> "$TMP/pc"
  done
  [ "$_total" -gt 0 ] || return 0
  jr_cat "$_key" "$_ver" "$_total" "$_part" ""
  sort -t "$TAB" -k1,1nr "$TMP/pc" > "$TMP/pc.s"
  while IFS="$TAB" read -r _kb _p _l; do jr_item "$_key" "$_kb" "$_p" "$_l"; done < "$TMP/pc.s"
}

# ---- "is the app for this folder still installed?" -----------------------------
jr_load_apps() {
  printf '%s\n' "$APP_DIRS" | while IFS= read -r _d; do
    [ -d "$_d" ] || continue
    for _a in "$_d"/*.app "$_d"/*/*.app; do
      [ -e "$_a" ] || continue
      _a=${_a##*/}; printf '%s\n' "${_a%.app}"
    done
  done | tr '[:upper:]' '[:lower:]' | sort -u > "$TMP/apps"
}
# returns 0 if we could NOT find an app that matches this support folder
jr_looks_leftover() {
  _ln=$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')
  case "$_ln" in
    com.apple.*|apple|addressbook|callhistory*|clouddocs|crashreporter|dock|icdd|knowledge|mobilesync|\
    networkserviceproxy|fileprovider|icloud|syncservices|quicklook|siri|spotlight|ubiquity*|\
    accessibility|animoji|homekit|cloudkit|familycircle|identityservices|com.crashlytics|\
    google|microsoft|mozilla|jetbrains|dmd|tmp|cache|caches|logs|*.savedstate|.*) return 1 ;;
  esac
  _ltok=$_ln
  case "$_ln" in *.*.*) _ltok=${_ln##*.} ;; esac        # com.tinyspeck.slackmacgap -> slackmacgap
  [ ${#_ltok} -lt 3 ] && return 1
  awk -v n="$_ln" -v t="$_ltok" '
    index($0, t) || index(t, $0) && length($0) >= 4 || index(n, $0) && length($0) >= 4 { found=1; exit }
    END { exit found ? 0 : 1 }' "$TMP/apps" && return 1
  if [ "$TEST" != 1 ] && command -v mdfind >/dev/null 2>&1; then
    # shellcheck disable=SC1003
    case "$1" in *"'"*|*'"'*|*'\'*) ;; *)
      [ -n "$(mdfind "kMDItemCFBundleIdentifier == '$1'c" 2>/dev/null < /dev/null | head -n 1)" ] && return 1 ;;
    esac
  fi
  return 0
}

# ---- duplicates -------------------------------------------------------------------
# Same size -> same first+last MB -> same whole-file md5 = duplicate copies.
# Hard links (same device:inode) are one file with two names, so they count once.
jr_dupes() {
  jr_say "  - checking same-size big files for duplicates (stops after $DUPE_SECONDS seconds)"
  _dend=$(( $(date +%s) + DUPE_SECONDS )); _dpart=0
  _minbytes=$((DUPE_MIN_MB * 1048576))
  # 1. candidates: big enough, not inside app-managed places (in ~/Library only iCloud Drive counts)
  # Files stored only in iCloud (or other cloud storage) use almost no disk; reading them would make
  # macOS download them, so anything using less than a quarter of its size on disk is skipped.
  _alloc=1; [ "$TEST" = 1 ] && _alloc=${JR_TEST_ALLOC:-0}     # test sparse files look "not downloaded"
  awk -F'\t' -v min="$_minbytes" -v lib="$L/" -v icloud="$L/Mobile Documents/" -v alloc="$_alloc" '
    $1 + 0 < min { next }
    alloc == 1 && $2 * 512 < $1 / 4 { next }
    index($4, lib) == 1 && index($4, icloud) != 1 { next }
    $4 ~ /\/node_modules\/|\/\.git\/|\.app\/|\.photoslibrary\/|\.fcpbundle\/|\.imovielibrary\/|\.logicx\/|\.musiclibrary\/|\/\.Trash\// { next }
    { print }' "$TMP/fstat" > "$TMP/d.cand"
  # 2. drop extra names of hard-linked files, keep sizes that occur 2+ times, biggest first
  awk -F'\t' '!seen[$3]++' "$TMP/d.cand" > "$TMP/d.uniq"
  jr_meta dupe_hardlinks "$(( $(wc -l < "$TMP/d.cand") - $(wc -l < "$TMP/d.uniq") ))"
  awk -F'\t' 'NR == FNR { n[$1]++; next } n[$1] > 1 { printf "%s\t%s\n", $1, $4 }' "$TMP/d.uniq" "$TMP/d.uniq" \
    | sort -t "$TAB" -k1,1nr > "$TMP/d.size"
  # 3. quick fingerprint (first + last 1 MB)
  : > "$TMP/d.q"
  while IFS="$TAB" read -r _b _p; do
    if [ "$(date +%s)" -ge "$_dend" ]; then _dpart=1; break; fi
    _q=$(jr_qhash "$_p" < /dev/null)
    [ -n "$_q" ] && printf '%s\t%s\t%s\n' "$_b" "$_q" "$_p" >> "$TMP/d.q"
  done < "$TMP/d.size"
  awk -F'\t' 'NR == FNR { n[$1 FS $2]++; next } n[$1 FS $2] > 1' "$TMP/d.q" "$TMP/d.q" | sort -t "$TAB" -k1,1nr > "$TMP/d.q2"
  # 4. whole-file fingerprint, only for files whose quick fingerprints matched
  : > "$TMP/d.f"
  while IFS="$TAB" read -r _b _q _p; do
    _left=$(( _dend - $(date +%s) ))
    if [ "$_left" -le 0 ]; then _dpart=1; break; fi
    jr_timeout "$_left" jr_fhash "$_p" > "$TMP/d.h" 2>/dev/null < /dev/null
    if [ $? -eq 124 ]; then _dpart=1; break; fi
    _h=$(awk 'NR == 1 && /^[0-9a-f]+$/ {print; exit}' "$TMP/d.h")
    [ -n "$_h" ] && printf '%s\t%s\t%s\n' "$_b" "$_h" "$_p" >> "$TMP/d.f"
  done < "$TMP/d.q2"
  # 5. sets of 2+ identical files, biggest possible savings first
  awk -F'\t' 'NR == FNR { n[$1 FS $2]++; next } n[$1 FS $2] > 1 { printf "%d\t%s\t%s\t%s\n", $1 * (n[$1 FS $2] - 1), $1, $2, $3 }' \
    "$TMP/d.f" "$TMP/d.f" | sort -t "$TAB" -k1,1nr -k3,3 -k4,4 > "$TMP/d.sets"
  _set=0; _last=""
  while IFS="$TAB" read -r _save _b _h _p; do
    if [ "$_h" != "$_last" ]; then _set=$((_set + 1)); _last=$_h; fi
    [ "$_set" -gt 40 ] && break
    jr_add_path "$_p" && printf 'D\t%s\t%s\t%s\n' "$_set" "$((_b / 1024))" "$REPLY_ID" >> "$REC"
  done < "$TMP/d.sets"
  jr_meta dupes_ran 1; jr_meta dupe_min_mb "$DUPE_MIN_MB"; jr_meta dupes_partial "$_dpart"
}

# ---- before/after snapshots --------------------------------------------------------
# Each run saves the sizes of the items and duplicate copies in the report, plus free
# space, to ~/.junk-report/snapshot-DATE-TIME.tsv (only you can read it). If there's an
# earlier snapshot of the same home folder, we compare: an item counts as "freed" only if
# it got at least 10 MB smaller or is gone.
jr_snapshot() {
  [ "${JR_NO_SNAPSHOT:-0}" = 1 ] && return 0
  SNAPDIR="${JR_SNAPDIR:-$H/.junk-report}"
  LC_ALL=C awk -F'\t' -v home="$H" '
    BEGIN { print "#junk-report-snapshot\t1"; print "H\t" home }
    $1 == "P" { p[$2] = $3; next }
    $1 == "M" && ($2 == "free_kb" || $2 == "disk_kb" || $2 == "when") { print "M\t" $2 "\t" $3; next }
    $1 == "C" { print "C\t" $2 "\t" $4 "\t" $5; next }
    $1 == "I" && ($4 in p) { print "I\t" $2 "\t" $3 "\t" p[$4]; next }
    $1 == "D" && ($4 in p) { print "D\t" $2 "\t" $3 "\t" p[$4]; next }' "$REC" > "$TMP/snap.new"
  _prev=""
  if [ -d "$SNAPDIR" ]; then
    for _f in "$SNAPDIR"/snapshot-*.tsv; do [ -f "$_f" ] && _prev=$_f; done      # newest sorts last
  fi
  if [ -n "$_prev" ] && [ "$(awk -F'\t' '$1 == "H" { print $2; exit }' "$_prev")" = "$H" ]; then
    jr_say "  - comparing with your last report"
    awk -F'\t' '$1 == "M" { print "M\tsince_" $2 "\t" $3 }' "$_prev" >> "$REC"
    # previous items and copies, with their size now ("?" = not in this report, look it up)
    awk -F'\t' '
      NR == FNR { if ($1 == "I" || $1 == "D") cur[$4] = $3; if ($1 == "C" && $4 != 0) part[$2] = 1; next }
      $1 == "C" && $4 != 0 { part[$2] = 1; next }
      ($1 == "I" || $1 == "D") && !seen[$4]++ {
        now = ($4 in cur) ? cur[$4] : "?"
        if ($1 == "I" && ($2 in part) && now != "?") next        # privacy settings changed what we could see
        print $1 "\t" $2 "\t" $3 "\t" now "\t" $4 }' "$TMP/snap.new" "$_prev" > "$TMP/snap.cmp"
    _n=0
    while IFS="$TAB" read -r _kind _key _before _now _p; do
      _n=$((_n + 1)); [ "$_n" -gt 300 ] && break
      if [ "$_now" = "?" ]; then
        if [ -e "$_p" ]; then
          jr_size "$_p" 30; [ "$S_PARTIAL" = 0 ] || continue; _now=$S_KB
        else
          # Only call it gone if we can actually look inside the nearest folder that still
          # exists. (macOS privacy settings can make a file look missing when it isn't.)
          _d=${_p%/*}
          while [ -n "$_d" ] && [ ! -e "$_d" ]; do _d=${_d%/*}; done
          if [ -z "$_d" ] || ! ls "$_d" >/dev/null 2>&1; then continue; fi
          _now=0
        fi
      fi
      if [ $((_before - _now)) -ge 10240 ]; then
        [ "$_kind" = D ] && _key=dupe
        jr_add_path "$_p" && printf 'G\t%s\t%s\t%s\t%s\n' "$_key" "$_before" "$_now" "$REPLY_ID" >> "$REC"
      fi
    done < "$TMP/snap.cmp"
  fi
  mkdir -p "$SNAPDIR" 2>/dev/null && chmod 700 "$SNAPDIR" 2>/dev/null || return 0
  _snapf="$SNAPDIR/snapshot-$(date +%Y%m%d-%H%M%S).tsv"
  cp "$TMP/snap.new" "$_snapf" 2>/dev/null && chmod 600 "$_snapf" && jr_meta snapshot_saved 1
  return 0
}

# ---- the scan -----------------------------------------------------------------
jr_scan() {
  L="$H/Library"
  jr_say "junk.report: looking around (read-only). This usually takes a few minutes."
  jr_say "macOS may ask whether Terminal can access some folders. 'Don't Allow' is fine; that folder just gets skipped."
  jr_load_apps

  jr_say "  - caches";       jr_dir_cat caches safe "$L/Caches" 8 "$L/Caches/Homebrew"
  jr_say "  - Homebrew";     jr_paths_cat homebrew safe "Homebrew downloads|$L/Caches/Homebrew"
  jr_say "  - Xcode";        jr_dir_cat derived safe "$L/Developer/Xcode/DerivedData" 8
                             jr_dir_cat devicesupport safe "$L/Developer/Xcode/iOS DeviceSupport" 8
                             jr_dir_cat archives review "$L/Developer/Xcode/Archives" 8
                             jr_dir_cat simulators review "$L/Developer/CoreSimulator" 6
  jr_say "  - device backups"
  jr_measure "$L/Application Support/MobileSync/Backup"
  if [ "$M_TOTAL" -gt 0 ]; then
    jr_cat ios_backups review "$M_TOTAL" "$M_PARTIAL" "$L/Application Support/MobileSync/Backup"
    while IFS="$TAB" read -r _kb _p; do
      _name=$(awk '/<key>Device Name<\/key>/{getline; gsub(/.*<string>|<\/string>.*/,""); print; exit}' "$_p/Info.plist" 2>/dev/null)
      jr_item ios_backups "$_kb" "$_p" "${_name:-Backup ${_p##*/}}"
    done < "$TMP/kids"
  fi
  jr_say "  - Downloads, Movies, Photos"
  jr_dir_cat downloads review "$H/Downloads" 10
  jr_dir_cat movies review "$H/Movies" 8
  _ph=""; for _x in "$H/Pictures"/*.photoslibrary; do [ -d "$_x" ] && _ph="$_ph${_ph:+$NL}${_x##*/}|$_x"; done
  if [ -n "$_ph" ]; then
    _old=$IFS; IFS=$NL; set -f
    # shellcheck disable=SC2086
    jr_paths_cat photos keep $_ph
    set +f; IFS=$_old
  fi
  jr_say "  - iCloud Drive";  jr_dir_cat icloud keep "$L/Mobile Documents" 6
  jr_say "  - Docker / VMs";  jr_paths_cat docker review \
      "Docker Desktop|$L/Containers/com.docker.docker" "OrbStack|$H/.orbstack" "Colima|$H/.colima" \
      "Podman|$H/.local/share/containers"
  jr_say "  - AI models";     jr_paths_cat ai_models review \
      "Ollama|$H/.ollama/models" "Hugging Face|$H/.cache/huggingface" \
      "LM Studio|$H/.lmstudio" "LM Studio (older)|$H/.cache/lm-studio"
  jr_say "  - developer caches"
  jr_paths_cat dev_caches safe "npm|$H/.npm/_cacache" "Yarn|$H/.yarn/berry/cache" "Yarn (classic)|$L/Caches/Yarn" \
      "pnpm|$L/pnpm/store" "Gradle|$H/.gradle/caches" "Cargo (Rust)|$H/.cargo/registry" "Go modules|$H/go/pkg/mod" \
      "CocoaPods|$H/.cocoapods/repos" "pip|$L/Caches/pip" "Maven|$H/.m2/repository" "Bun|$H/.bun/install/cache"
  jr_say "  - Trash";         jr_dir_cat trash safe "$H/.Trash" 8
  jr_say "  - Mail";          jr_paths_cat mail_downloads safe "Mail Downloads|$L/Containers/com.apple.mail/Data/Library/Mail Downloads"
                              jr_paths_cat mail keep "Mail|$L/Mail"

  jr_say "  - app support files"
  jr_measure "$L/Application Support"
  _total=$M_TOTAL
  _ek=$(jr_kid_kb "$L/Application Support/MobileSync"); _total=$((_total - ${_ek:-0}))
  if [ "$_total" -gt 0 ]; then
    jr_cat app_support keep "$_total" "$M_PARTIAL" "$L/Application Support"
    _n=0
    while IFS="$TAB" read -r _kb _p; do
      [ "$_n" -ge 12 ] && break; [ "$_kb" -lt 51200 ] && break
      _b=${_p##*/}
      [ "$_b" = MobileSync ] && continue
      _flag=""; jr_looks_leftover "$_b" && _flag=leftover
      jr_item app_support "$_kb" "$_p" "$_b" "$_flag"; _n=$((_n + 1))
    done < "$TMP/kids"
  fi
  jr_say "  - sandboxed app data"
  jr_dir_cat containers keep "$L/Containers" 10 "$L/Containers/com.docker.docker" "$L/Containers/com.apple.mail"

  jr_say "  - biggest files, duplicates and node_modules (search stops after $FIND_SECONDS seconds)"
  # One walk of the home folder. Skipped: app-managed areas with huge numbers of
  # files that the categories above already cover, and online-only cloud folders.
  _minb=$((DUPE_MIN_MB * 2048)); [ "$_minb" -gt "$BIG_BLOCKS" ] && _minb=$BIG_BLOCKS
  jr_timeout "$FIND_SECONDS" find "$H" -xdev \
      \( -path "$L/CloudStorage" -o -path "$L/Caches" -o -path "$L/Containers" -o -path "$L/Group Containers" \
         -o -path "$L/Mail" -o -path "$L/Developer" -o -path "$L/Application Support/MobileSync" -o -path "$L/pnpm" \
         -o -path "$H/.npm" -o -path "$H/.Trash" -o -path "$H/go/pkg" -o -path "$H/.cargo/registry" \
         -o -name '*.photoslibrary' -o -name .git \) -prune -o \
      \( -type d -name node_modules -prune -print \) -o \
      \( -type f -size +"$_minb" -print \) > "$TMP/found" 2>/dev/null < /dev/null
  [ $? -eq 124 ] && jr_meta find_timeout 1
  # node_modules: skip ones inside Library or hidden folders (apps and editor extensions need those)
  grep '/node_modules$' "$TMP/found" | grep -v -e "^$L/" -e '/\.' | head -n 60 > "$TMP/nm"
  : > "$TMP/nmsizes"
  while IFS= read -r _p; do
    [ -d "$_p" ] || continue
    jr_size "$_p" 30 && [ "$S_KB" -gt 0 ] && printf '%s\t%s\n' "$S_KB" "$_p" >> "$TMP/nmsizes"
  done < "$TMP/nm"
  if [ -s "$TMP/nmsizes" ]; then
    jr_cat node_modules safe "$(awk -F'\t' '{s+=$1} END{print s+0}' "$TMP/nmsizes")" 0 ""
    sort -t "$TAB" -k1,1nr "$TMP/nmsizes" | head -n 12 > "$TMP/nm.s"
    while IFS="$TAB" read -r _kb _p; do
      _proj=${_p%/node_modules}; jr_item node_modules "$_kb" "$_p" "${_proj##*/}"
    done < "$TMP/nm.s"
  fi
  # -type f never matches symlinks, so links are never counted twice.
  grep -v '/node_modules$' "$TMP/found" | tr '\n' '\0' | jr_stat_full > "$TMP/fstat"
  # report size: on a Mac, space actually used on disk; in test mode, the sparse files' apparent size
  awk -F'\t' -v t="$TEST" '{ printf "%d\t%s\n", (t == 1 ? $1 / 1024 : $2 / 2), $4 }' "$TMP/fstat" | awk -F'\t' -v min=102400 '$1 >= min' | sort -t "$TAB" -k1,1nr | head -n "$TOPN" > "$TMP/top"
  while IFS="$TAB" read -r _kb _p; do
    jr_add_path "$_p" && printf 'F\t%s\t%s\n' "$_kb" "$REPLY_ID" >> "$REC"
  done < "$TMP/top"
  jr_dupes
  # disk totals. On modern macOS your files live on the "Data" volume.
  if [ "$TEST" = 1 ]; then
    _disk=${JR_DISK_KB:-482344960}; _free=${JR_FREE_KB:-40148992}
    _host="${JR_TEST_HOST:-Sample Mac (test data)}"; _os="test"
  else
    _vol=/; [ -d /System/Volumes/Data ] && _vol=/System/Volumes/Data
    _disk=$(df -kP "$_vol" 2>/dev/null | awk 'NR==2{print $2}'); _free=$(df -kP "$_vol" 2>/dev/null | awk 'NR==2{print $4}')
    _host=$(scutil --get ComputerName 2>/dev/null); _os=$(sw_vers -productVersion 2>/dev/null)
  fi
  jr_meta disk_kb "${_disk:-0}"; jr_meta free_kb "${_free:-0}"
  jr_meta host "${_host:-This Mac}"; jr_meta os "${_os:-}"
  jr_meta when "$(date +%s)"; jr_meta home "$H"
}

# ---- writing the report ---------------------------------------------------------
# Turns the records into a JavaScript object. Every string is escaped so a file
# named like </script><script>... is just text in the report, never code.
jr_data_js() {
  LC_ALL=C awk -F'\t' '
  function js(s,   o, i, c, n) {
    if (s !~ /[\\"<>&]/ && s !~ /[[:cntrl:]]/) return "\"" s "\""
    o = ""; n = length(s)
    for (i = 1; i <= n; i++) {
      c = substr(s, i, 1)
      if (c == "\\") o = o "\\\\"
      else if (c == "\"") o = o "\\\""
      else if (c == "<") o = o "\\u003c"
      else if (c == ">") o = o "\\u003e"
      else if (c == "&") o = o "\\u0026"
      else if (c ~ /[[:cntrl:]]/) o = o " "
      else o = o c
    }
    return "\"" o "\""
  }
  function num(x) { return (x ~ /^-?[0-9]+$/) ? x : 0 }
  $1=="P" { paths = paths (np++ ? "," : "") "\n" js($3) }
  $1=="C" { cats = cats (nc++ ? "," : "") "\n{key:" js($2) ",verdict:" js($3) ",kb:" num($4) ",partial:" num($5) ",id:" num($6) "}" }
  $1=="I" { items = items (ni++ ? "," : "") "\n{cat:" js($2) ",kb:" num($3) ",id:" num($4) ",flag:" js($5) ",label:" js($6) "}" }
  $1=="F" { files = files (nf++ ? "," : "") "\n{kb:" num($2) ",id:" num($3) "}" }
  $1=="D" { dupes = dupes (nd++ ? "," : "") "\n{set:" num($2) ",kb:" num($3) ",id:" num($4) "}" }
  $1=="G" { freed = freed (ng++ ? "," : "") "\n{key:" js($2) ",before:" num($3) ",now:" num($4) ",id:" num($5) "}" }
  $1=="M" { meta = meta (nm++ ? "," : "") js($2) ":" js($3) }
  END { printf "{meta:{%s},\ncats:[%s],\nitems:[%s],\nfiles:[%s],\ndupes:[%s],\nfreed:[%s],\npaths:[%s]}", meta, cats, items, files, dupes, freed, paths }
  ' "$REC"
}

jr_write_report() {
  _tmp_out="$OUT.part.$$"
  { jr_template_head; printf 'const JR = '; jr_data_js; printf ';\n'; jr_template_tail; } > "$_tmp_out" || return 1
  chmod 600 "$_tmp_out" 2>/dev/null
  mv -f "$_tmp_out" "$OUT"
}

# ---- the "Show in Finder" helper ---------------------------------------------------
# A browser page can't open Finder. So, for a limited time, we answer requests
# from the report on 127.0.0.1 (this Mac only) using the stock `nc` tool:
#   GET /?t=SECRET            -> the report itself
#   GET /reveal?t=SECRET&id=N -> `open -R` on path number N from the report
#   GET /ping?t=SECRET        -> "I'm still here"
# Anything else, a wrong secret, or a request not addressed to 127.0.0.1 gets refused.
jr_reply() { # status content-type file-or-empty [extra-header]
  _len=0; [ -n "$3" ] && _len=$(wc -c < "$3" | tr -d ' ')
  printf 'HTTP/1.1 %s\r\nContent-Type: %s\r\nContent-Length: %s\r\nCache-Control: no-store\r\nX-Content-Type-Options: nosniff\r\nReferrer-Policy: no-referrer\r\nConnection: close\r\n%s\r\n' \
    "$1" "$2" "$_len" "${4:-}"
  [ -n "$3" ] && cat "$3"
}
# Handles one request. Returns 1 when it's time to stop.
jr_handle() {
  _acc=""
  while :; do
    _line=""
    if IFS= read -r -t 2 _line; then _line="$_acc$_line"; break; fi
    _acc="$_acc$_line"           # newer bash keeps half a line if the timeout hit mid-line
    kill -0 "$NC_PID" 2>/dev/null || return 1                  # nc is gone
    [ -z "$_acc" ] && [ "$(date +%s)" -ge "$HELPER_END" ] && return 1   # time's up
  done
  _line=${_line%"$CR"}
  [ -n "${JR_DEBUG:-}" ] && printf 'DEBUG request line: [%s]\n' "$_line" >&2
  [ -z "$_line" ] && return 0
  _host=""
  while IFS= read -r -t 5 _h; do
    _h=${_h%"$CR"}; [ -z "$_h" ] && break
    case "$_h" in [Hh][Oo][Ss][Tt]:*) _host=${_h#*:}; _host=${_host# } ;; esac
  done
  _method=${_line%% *}; _rest=${_line#* }; _target=${_rest%% *}
  _path=${_target%%\?*}; _query=""
  case "$_target" in *\?*) _query=${_target#*\?} ;; esac
  _t=""; _id=""
  _old=$IFS; IFS='&'
  for _kv in $_query; do case "$_kv" in t=*) _t=${_kv#t=} ;; id=*) _id=${_kv#id=} ;; esac; done
  IFS=$_old
  if [ "$_method" != GET ]; then jr_reply "405 Method Not Allowed" text/plain ""; return 0; fi
  if [ "$_host" != "127.0.0.1:$PORT" ] && [ "$_host" != "localhost:$PORT" ]; then jr_reply "403 Forbidden" text/plain ""; return 0; fi
  if [ "$_t" != "$TOKEN" ]; then jr_reply "403 Forbidden" text/plain ""; return 0; fi
  case "$_path" in
    /) jr_reply "200 OK" "text/html; charset=utf-8" "$OUT" \
         "Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'; img-src data:; form-action 'none'; frame-ancestors 'none'${CR}${NL}" ;;
    /ping) jr_reply "204 No Content" text/plain "" ;;
    /reveal)
      case "$_id" in ''|*[!0-9]*) jr_reply "400 Bad Request" text/plain ""; return 0 ;; esac
      if [ "${#_id}" -gt 6 ] || [ "$_id" -ge "$NEXT_ID" ]; then jr_reply "404 Not Found" text/plain ""; return 0; fi
      _p=$(sed -n "$((_id + 1))p" "$ALLOW")
      if [ -z "$_p" ] || [ ! -e "$_p" ]; then jr_reply "410 Gone" text/plain ""; return 0; fi
      jr_open -R "$_p"
      printf '  Showing in Finder: %s\n' "$_p" >&2
      jr_reply "204 No Content" text/plain "" ;;
    *) jr_reply "404 Not Found" text/plain "" ;;
  esac
  return 0
}
jr_serve() { set -f; while jr_handle; do :; done; }

jr_helper() {
  CR=$(printf '\r')
  command -v nc >/dev/null 2>&1 || return 1
  PORT=""
  _i=0
  while [ $_i -lt 20 ]; do
    _p=$((20000 + RANDOM % 40000))
    if ! nc -z 127.0.0.1 "$_p" >/dev/null 2>&1 < /dev/null; then PORT=$_p; break; fi
    _i=$((_i + 1))
  done
  [ -n "$PORT" ] || return 1
  TOKEN=$(od -An -N16 -tx1 /dev/urandom | tr -d ' \n')
  [ ${#TOKEN} -eq 32 ] || return 1
  REQ="$TMP/req"; RESP="$TMP/resp"
  mkfifo "$REQ" "$RESP" || return 1
  HELPER_END=$(( $(date +%s) + MINUTES * 60 ))
  URL="http://127.0.0.1:$PORT/?t=$TOKEN"
  # One listener for the whole session (-k), bound to 127.0.0.1 only.
  # Requests come out of nc into $REQ; our answers go back in through $RESP.
  # (The two fifos are opened in the same order on both sides, so neither waits forever.)
  nc -lk 127.0.0.1 "$PORT" > "$REQ" < "$RESP" 2>/dev/null &
  NC_PID=$!; HELPER_PID=$NC_PID
  [ -n "${JR_URL_FILE:-}" ] && printf '%s\n' "$URL" > "$JR_URL_FILE"
  if [ "${JR_NO_OPEN:-0}" != 1 ]; then ( sleep 1; jr_open "$URL" ) & fi
  jr_say ""
  jr_say "Your report is open in your browser."
  jr_say "Keep this window open while you use the 'Show in Finder' buttons."
  jr_say "They switch off by themselves in $MINUTES minutes, or press Control-C now."
  jr_say "(The report is also saved at $OUT. Without this window its buttons copy paths instead.)"
  jr_serve < "$REQ" > "$RESP"
  kill "$NC_PID" 2>/dev/null; HELPER_PID=""
  jr_say "Show in Finder is now off. Your report is still at $OUT"
  return 0
}

jr_main() {
  jr_setup
  trap jr_cleanup EXIT
  trap 'exit 130' INT TERM
  if [ "$TEST" != 1 ] && [ "$(uname -s)" != Darwin ]; then
    jr_say "junk.report is for macOS. (Developers: JR_TEST=1 JR_HOME=/some/fake/home runs a test scan.)"; exit 1
  fi
  jr_scan
  jr_snapshot
  jr_write_report || { jr_say "Couldn't write $OUT"; exit 1; }
  jr_say ""; jr_say "Done. Report saved to $OUT"
  if [ "${JR_NO_HELPER:-0}" = 1 ] || ! jr_helper; then
    [ "${JR_NO_OPEN:-0}" != 1 ] && jr_open "$OUT"
    jr_say "Opened the report. Its buttons copy paths you can paste into Finder (Go > Go to Folder)."
  fi
}

# ---- the report page (static HTML + CSS + JS; your data is inserted in the middle) ----
jr_template_head() { cat <<'JR_HTML'
<!doctype html>
<html lang="en"><head><meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; connect-src 'self'; img-src data:; form-action 'none'">
<meta name="referrer" content="no-referrer">
<link rel="icon" href="data:,">
<title>Your junk.report</title>
<style>
:root{--bg:#fbfaf6;--card:#fff;--ink:#0b0b0a;--muted:#3d3c37;--soft:#6a685f;--line:#d6d2c6;
--safe:#0b6b3a;--safe-bg:#e3f2e8;--look:#8a4600;--look-bg:#fbeedb;--keep:#46453f;--keep-bg:#ecebe6;--other:#b9b5a8;--free:#fff}
*{box-sizing:border-box;margin:0;padding:0}
html{-webkit-text-size-adjust:100%}
body{background:var(--bg);color:var(--ink);font:16px/1.5 -apple-system,BlinkMacSystemFont,"Helvetica Neue",Arial,sans-serif;overflow-wrap:anywhere}
.wrap{max-width:60rem;margin:0 auto;padding:0 1.5rem}
code,.mono{font-family:ui-monospace,"SF Mono",Menlo,monospace;font-size:.875em}
header .wrap{display:flex;justify-content:space-between;align-items:baseline;gap:1rem;flex-wrap:wrap;padding-top:1.25rem;padding-bottom:1.25rem;border-bottom:2px solid var(--ink)}
.logo{font-weight:800;font-size:1.125rem;letter-spacing:-.01em}.logo span{font-weight:400}
.when{color:var(--muted);font-size:.875rem}
.status{font-size:.875rem;padding:.5rem .75rem;margin-top:1rem;border:1px solid var(--line);background:var(--card);display:flex;gap:.5rem;align-items:center}
.dot{width:.6rem;height:.6rem;border-radius:50%;background:var(--other);flex:none}.status.on .dot{background:var(--safe)}
.hero{padding:2.5rem 0 1.5rem}
h1{font-size:2.5rem;line-height:1.1;letter-spacing:-.02em;font-weight:800}
h1 .n{border-bottom:.12em solid var(--safe)}
.sub{font-size:1.25rem;margin-top:.5rem}.sub .n{font-weight:700;color:var(--look)}
.calm{color:var(--muted);margin-top:.75rem}
.disk{margin:1.5rem 0 .5rem;background:var(--card);border:1px solid var(--line);padding:1.25rem}
.disk h2{font-size:1rem;margin-bottom:.75rem}
.bar{display:flex;height:1.75rem;border:2px solid var(--ink);background:var(--free)}
.bar i{display:block;height:100%}
.b-safe{background:var(--safe)}.b-look{background:#d98a1e}.b-other{background:var(--other)}
.legend{display:flex;flex-wrap:wrap;gap:.25rem 1.25rem;margin-top:.75rem;font-size:.875rem}
.legend b{font-weight:700}.sw{display:inline-block;width:.75rem;height:.75rem;border:1px solid var(--ink);margin-right:.35rem;vertical-align:-1px}
.group{margin-top:2.5rem}
.group>h2{font-size:1.5rem;letter-spacing:-.01em}
.group>p{color:var(--muted);margin:.25rem 0 1rem}
.cat{background:var(--card);border:1px solid var(--line);border-left:6px solid var(--keep);padding:1.25rem;margin-bottom:1rem}
.cat.safe{border-left-color:var(--safe)}.cat.review{border-left-color:#d98a1e}
.cat-h{display:flex;justify-content:space-between;align-items:baseline;gap:1rem;flex-wrap:wrap}
.cat-h h3{font-size:1.25rem}
.size{font-weight:800;font-size:1.25rem;font-variant-numeric:tabular-nums;white-space:nowrap}
.chip{display:inline-block;font-size:.75rem;font-weight:700;letter-spacing:.04em;text-transform:uppercase;padding:.1rem .45rem;margin-left:.5rem;vertical-align:2px}
.chip.safe{background:var(--safe-bg);color:var(--safe)}.chip.review{background:var(--look-bg);color:var(--look)}.chip.keep{background:var(--keep-bg);color:var(--keep)}
dl{display:grid;grid-template-columns:8.5rem 1fr;gap:.35rem 1rem;margin-top:.75rem;font-size:.9375rem}
dt{font-weight:700}dd{color:var(--ink)}
.cmd{display:inline-flex;gap:.5rem;align-items:center;margin-top:.35rem;background:#f1efe8;border:1px solid var(--line);padding:.2rem .2rem .2rem .5rem}
.warn{margin-top:.75rem;font-size:.875rem;background:var(--look-bg);color:#5a2e00;padding:.5rem .75rem}
ul.items{list-style:none;margin-top:1rem;border-top:1px solid var(--line)}
ul.items li{display:grid;grid-template-columns:1fr auto auto;gap:.25rem 1rem;align-items:center;padding:.6rem 0;border-bottom:1px solid var(--line)}
.nm{font-weight:600}.pth{display:block;font-size:.8125rem;color:var(--soft);font-weight:400}
.isz{font-variant-numeric:tabular-nums;font-weight:700;text-align:right;min-width:5.5rem}
.mini{grid-column:1/-1;height:4px;background:#efede6}.mini i{display:block;height:100%;background:var(--ink)}
.flag{display:inline-block;font-size:.75rem;font-weight:700;background:#fde5e8;color:#8f0b20;padding:.05rem .4rem;margin-left:.4rem}
button{font:inherit;font-size:.8125rem;font-weight:700;color:var(--ink);background:var(--card);border:2px solid var(--ink);padding:.3rem .6rem;cursor:pointer;white-space:nowrap}
button:hover{background:var(--ink);color:#fff}button:focus-visible{outline:3px solid #2563eb;outline-offset:2px}
button.small{font-size:.75rem;padding:.15rem .45rem;border-width:1px}
.tip{margin-top:1rem;border-left:6px solid var(--look);background:var(--look-bg);padding:.75rem 1rem;font-size:.9375rem}
.files li .nm{font-weight:600}
.since{margin-top:1.25rem;background:#26301a;color:#fff;padding:1.25rem 1.5rem}
.since .label{font-size:.75rem;letter-spacing:.12em;text-transform:uppercase;font-weight:700;color:#e6d9a8}
.since-big{font-size:2rem;font-weight:800;letter-spacing:-.01em;margin:.25rem 0}
.since .fine,.since .pth{color:#e6e2d3}.since ul.items{border-top-color:rgba(255,255,255,.3)}
.since ul.items li{border-bottom-color:rgba(255,255,255,.3);grid-template-columns:1fr auto auto}
.since.quiet{background:var(--card);color:var(--ink);border:1px solid var(--line);margin-top:2.5rem}.since.quiet .fine{color:var(--muted)}
.counter{margin-top:1rem;padding-top:1rem;border-top:1px solid rgba(255,255,255,.3)}.since.quiet .counter{border-top:0;margin-top:0;padding-top:0}
.counter h3{font-size:1rem;margin-bottom:.5rem}.counter code{font-size:.8125rem}.counter .btn{margin-bottom:.75rem}
.btn{display:inline-block;font:inherit;font-weight:700;font-size:.9375rem;background:#f4efe3;color:#0d0d0a;border:2px solid #0d0d0a;padding:.55rem 1rem;text-decoration:none;cursor:pointer}
.since .btn{border-color:#f4efe3}.btn:hover{background:#0d0d0a;color:#fff}.btn[disabled]{opacity:.55;cursor:not-allowed}
.btn.ghost{background:transparent}
.heroacts{margin-top:1rem}
.cardpanel{margin-top:1rem;background:var(--card);border:2px solid var(--ink);padding:1.25rem}
.cardpanel h2{font-size:1.25rem}
.cardpanel canvas{display:block;width:100%;max-width:720px;height:auto;margin:.75rem 0;border:1px solid var(--line)}
.checks{display:grid;grid-template-columns:repeat(auto-fill,minmax(16rem,1fr));gap:.25rem 1rem;font-size:.9375rem}
.acts{display:flex;flex-wrap:wrap;gap:.5rem;margin:.75rem 0}.tweet{margin-top:.5rem}
.cat.dupe{border-left-color:#5b4bc4}.cat.dupe .size{font-size:1.0625rem}
.meta{margin-top:.25rem;color:var(--muted);font-size:.9375rem}
.fine{font-size:.875rem;color:var(--muted);margin-top:.25rem}
.sub .n.dup{color:#4c3db0}
.notes{margin:2.5rem 0 1rem;font-size:.9375rem;color:var(--muted)}
.notes h2{font-size:1.125rem;color:var(--ink);margin-bottom:.5rem}.notes li{margin:.25rem 0 .25rem 1.25rem}
footer .wrap{border-top:2px solid var(--ink);padding-top:1rem;padding-bottom:3rem;font-size:.875rem;color:var(--muted)}
.toast{position:fixed;left:50%;bottom:1.5rem;transform:translateX(-50%);background:var(--ink);color:#fff;padding:.7rem 1rem;font-size:.9375rem;max-width:90vw;opacity:0;transition:opacity .2s;pointer-events:none}
.toast.show{opacity:1}
@media (max-width:40rem){h1{font-size:1.875rem}dl{grid-template-columns:1fr}dt{margin-top:.35rem}ul.items li{grid-template-columns:1fr auto}ul.items li button{grid-column:1/-1;justify-self:start}}
</style></head><body>
<header><div class="wrap"><div class="logo">junk<span>.report</span></div><div class="when" id="when"></div></div></header>
<main class="wrap" id="app"><noscript><p style="padding:2rem 0">This report needs JavaScript turned on to draw itself. Nothing in it connects to the internet.</p></noscript></main>
<footer><div class="wrap" id="foot"></div></footer>
<div class="toast" id="toast" role="status" aria-live="polite"></div>
<script>
JR_HTML
}

jr_template_tail() { cat <<'JR_HTML'
(function () {
  "use strict";
  var CAT = {
    trash: {t: "Trash", what: "Things you already deleted but haven't emptied yet.", safe: "Yes. That's what it's for. Emptying it is permanent, so take a quick look first.", how: "Finder menu > Empty Trash."},
    caches: {t: "App caches", what: "Temporary files apps keep so they open and load faster: thumbnails, web data, downloaded updates.", safe: "Usually yes. Apps rebuild what they need, so things may be a little slower the first time.", how: "Quit the app first, then move its folder to the Trash. Leave folders for apps you're running."},
    homebrew: {t: "Homebrew downloads", what: "Installer files Homebrew downloaded for packages you've already installed.", safe: "Yes.", how: "Run this in Terminal:", cmd: "brew cleanup --prune=all"},
    derived: {t: "Xcode build files (DerivedData)", what: "Build products and search indexes Xcode makes for every project you've opened.", safe: "Yes. Xcode rebuilds them; your next build of each project will just take longer.", how: "Quit Xcode, then trash the folders for projects you're done with (or all of them)."},
    devicesupport: {t: "Xcode device support", what: "Debug files Xcode copies from every iPhone and iPad system version you've plugged in.", safe: "Yes for old versions. Xcode copies them again if you connect a device running that version.", how: "Trash the folders for iOS versions you no longer test on."},
    archives: {t: "Xcode archives", what: "Every app build you archived for TestFlight or the App Store.", safe: "Be careful. Keep archives of versions people still use; Xcode needs them to make sense of crash reports.", how: "Xcode > Window > Organizer > Archives, then delete old builds."},
    simulators: {t: "iPhone & iPad simulators", what: "Simulated devices, with their apps and data, plus simulator caches.", safe: "Mostly. Simulators for old iOS versions can go.", how: "Run this in Terminal to remove ones Xcode can't use anymore:", cmd: "xcrun simctl delete unavailable"},
    ios_backups: {t: "iPhone & iPad backups", what: "Full local backups of your devices, made by Finder or iTunes.", safe: "Only if that device is backed up somewhere else (like iCloud) or you don't have it anymore. A deleted backup can't be brought back.", how: "Connect any device, select it in the Finder sidebar, click Manage Backups..., pick an old backup and click Delete Backup."},
    downloads: {t: "Downloads", what: "Everything you've downloaded: installers, zip files, videos, PDFs.", safe: "Your call. Installers (.dmg, .pkg, .xip) and zips you've already opened are usually fine to delete.", how: "Open the folder, switch to list view and sort by Size."},
    movies: {t: "Movies", what: "Videos, screen recordings and video projects.", safe: "These are your files, so it's your call.", how: "Move big videos you want to keep to an external drive or cloud storage."},
    photos: {t: "Photos library", what: "Your Photos app library, including the originals stored on this Mac.", safe: "Keep it. Never delete files from inside the library folder.", how: "If you use iCloud Photos, Photos > Settings > iCloud > Optimize Mac Storage keeps smaller copies here."},
    icloud: {t: "iCloud Drive (downloaded copies)", what: "iCloud Drive files currently downloaded to this Mac.", safe: "Don't delete them; that deletes them everywhere. You can remove just this Mac's copy.", how: "In Finder, Control-click a big file or folder and choose Remove Download. It stays in iCloud."},
    docker: {t: "Docker and container VMs", what: "The virtual disk where Docker Desktop, OrbStack, Colima or Podman keep images, containers and volumes.", safe: "Partly. Unused images and build cache can go. Volumes may hold databases you care about.", how: "With Docker running, this removes stopped containers, unused networks and build cache:", cmd: "docker system prune"},
    ai_models: {t: "AI models", what: "Local AI models downloaded by Ollama, LM Studio or Hugging Face tools. Each one is often several GB.", safe: "Yes for models you don't use anymore. You can always download them again.", how: "For Ollama, list your models, then remove one with ollama rm <name>:", cmd: "ollama list"},
    dev_caches: {t: "Developer package caches", what: "Download caches for tools like npm, Yarn, pnpm, Gradle, Cargo, Go, CocoaPods, pip and Maven.", safe: "Yes. The tools download what they need again.", how: "Use each tool's own clean command (for npm: npm cache clean --force), or trash the folder."},
    node_modules: {t: "node_modules folders", what: "Packages installed for JavaScript projects. Each project gets its own copy.", safe: "Yes. Running npm install (or yarn / pnpm install) in the project brings them back.", how: "Trash node_modules in projects you aren't working on right now."},
    mail_downloads: {t: "Mail attachments you opened", what: "Copies Mail makes when you open an attachment. The original stays in the email.", safe: "Yes.", how: "Trash the files inside this folder."},
    mail: {t: "Mail", what: "Your downloaded email and attachments.", safe: "Keep. Delete big emails inside the Mail app instead.", how: "In Mail, find messages with big attachments and delete the ones you don't need."},
    app_support: {t: "App support files", what: "Data apps keep for themselves: settings, libraries, offline content, databases.", safe: "Keep folders for apps you use. Folders left behind by apps you deleted are fair game.", how: "Remove an app together with its support files rather than deleting folders by hand."},
    containers: {t: "Sandboxed app data", what: "Private data folders for App Store and other sandboxed apps.", safe: "Keep. Clear space from inside each app, or remove the app.", how: "If an app here is one you don't use, remove the app itself."}
  };
  var GROUPS = [
    {v: "safe", h: "Safe to clear", p: "These rebuild themselves or are already-deleted leftovers."},
    {v: "review", h: "Worth a look", p: "Could be big wins, but only you know if you still need them."},
    {v: "keep", h: "Keep, just so you know", p: "Real data. Shown so you know where the space is, not so you delete it."}
  ];
  var meta = JR.meta || {}, home = meta.home || "";
  var params = new URLSearchParams(location.search);
  var token = params.get("t");
  var live = location.protocol === "http:" && /^[0-9a-f]{32}$/.test(token || "");
  var helperOn = false;

  function el(tag, cls, text) { var e = document.createElement(tag); if (cls) e.className = cls; if (text != null) e.textContent = text; return e; }
  function add(parent) { for (var i = 1; i < arguments.length; i++) if (arguments[i]) parent.appendChild(typeof arguments[i] === "string" ? document.createTextNode(arguments[i]) : arguments[i]); return parent; }
  function size(kb) {
    var b = kb * 1024;
    if (b >= 1e9) return (b / 1e9).toFixed(b >= 1e11 ? 0 : 1) + " GB";
    if (b >= 1e6) return Math.round(b / 1e6) + " MB";
    return Math.max(1, Math.round(b / 1e3)) + " KB";
  }
  function pretty(p) { return home && p.indexOf(home + "/") === 0 ? "~" + p.slice(home.length) : p; }
  function pathOf(id) { return id >= 0 && id < JR.paths.length ? JR.paths[id] : ""; }
  var toastTimer;
  function toast(msg) { var t = document.getElementById("toast"); t.textContent = msg; t.classList.add("show"); clearTimeout(toastTimer); toastTimer = setTimeout(function () { t.classList.remove("show"); }, 3800); }
  function copy(text) {
    function legacy() { var ta = el("textarea"); ta.value = text; ta.setAttribute("readonly", ""); ta.style.position = "fixed"; ta.style.opacity = "0"; document.body.appendChild(ta); ta.select(); var ok = false; try { ok = document.execCommand("copy"); } catch (e) {} ta.remove(); return ok; }
    if (navigator.clipboard && window.isSecureContext) return navigator.clipboard.writeText(text).then(function () { return true; }, legacy);
    return Promise.resolve(legacy());
  }
  function copyPath(id) {
    var p = pathOf(id);
    copy(p).then(function (ok) {
      toast(ok ? "Path copied. In Finder press Shift-Command-G, paste, and press Return." : "Couldn't copy. The path is: " + p);
    });
  }
  function reveal(id) {
    if (!helperOn) return copyPath(id);
    fetch("/reveal?t=" + token + "&id=" + id, {cache: "no-store"}).then(function (r) {
      if (r.status === 204) toast("Opened in Finder.");
      else if (r.status === 410) toast("That item isn't there anymore.");
      else { setHelper(false); copyPath(id); }
    }, function () { setHelper(false); copyPath(id); });
  }
  function revealBtn(id, small) {
    var b = el("button", small ? "small" : "folder", "");
    b.className += " rv"; b.type = "button";
    b.textContent = label(b, helperOn || live);
    b.title = pathOf(id);
    b.addEventListener("click", function () { reveal(id); });
    return b;
  }
  function label(b, on) {
    var folder = b.className.indexOf("folder") >= 0;
    return on ? (folder ? "Show folder in Finder" : "Show in Finder") : (folder ? "Copy folder path" : "Copy path");
  }
  function niceLabel(it) {
    if (it.cat === "icloud") {
      if (it.label === "com~apple~CloudDocs") return "iCloud Drive";
      var m = /^iCloud~(.+)$/.exec(it.label); if (m) return "App data: " + m[1].replace(/~/g, ".");
    }
    return it.label;
  }
  function setHelper(on) {
    helperOn = on;
    var s = document.getElementById("status");
    if (s) {
      s.className = "status" + (on ? " on" : "");
      s.lastChild.textContent = on
        ? "Show in Finder is on. It works while the Terminal window that made this report stays open (up to 30 minutes)."
        : "Show in Finder is off, so buttons copy the path instead. To turn it back on, run the scan again.";
    }
    var bs = document.querySelectorAll("button.rv");
    for (var i = 0; i < bs.length; i++) bs[i].textContent = label(bs[i], on);
  }

  // ---- numbers ----
  var cats = JR.cats.slice().sort(function (a, b) { return b.kb - a.kb; });
  var itemsBy = {};
  JR.items.forEach(function (it) { (itemsBy[it.cat] = itemsBy[it.cat] || []).push(it); });
  var safeKB = 0, lookKB = 0, measured = 0;
  cats.forEach(function (c) {
    measured += c.kb;
    if (c.verdict === "safe") safeKB += c.kb;
    else if (c.verdict === "review") lookKB += c.kb;
    else (itemsBy[c.key] || []).forEach(function (it) { if (it.flag === "leftover") lookKB += it.kb; });
  });
  var dupeSets = [], dupeKB = 0;
  (JR.dupes || []).forEach(function (d) {
    var s = dupeSets[dupeSets.length - 1];
    if (!s || s.set !== d.set) { s = {set: d.set, kb: d.kb, ids: []}; dupeSets.push(s); }
    s.ids.push(d.id);
  });
  dupeSets.forEach(function (s) { s.save = s.kb * (s.ids.length - 1); dupeKB += s.save; });
  var diskKB = +meta.disk_kb || 0, freeKB = +meta.free_kb || 0, usedKB = Math.max(0, diskKB - freeKB);

  var when = new Date((+meta.when || 0) * 1000);
  document.getElementById("when").textContent = (meta.host || "This Mac") + (meta.os && meta.os !== "test" ? " \u00b7 macOS " + meta.os : "") + " \u00b7 " +
    when.toLocaleString(undefined, {dateStyle: "medium", timeStyle: "short"});

  var app = document.getElementById("app");
  var st = el("div", "status"); add(st, el("span", "dot"), el("span"));
  st.id = "status"; app.appendChild(st);

  // ---- since your last report ----
  var freedKB = 0;
  (JR.freed || []).forEach(function (g) { freedKB += g.before - g.now; });
  var CAT_NAME = {caches: "App caches", homebrew: "Homebrew cache", derived: "Xcode build files", devicesupport: "Xcode device support",
    archives: "Xcode archives", simulators: "iOS simulators", ios_backups: "iPhone & iPad backups", downloads: "Downloads", movies: "Movies",
    photos: "Photos library", icloud: "iCloud Drive", docker: "Docker", ai_models: "AI models", dev_caches: "Developer caches",
    node_modules: "node_modules", trash: "Trash", mail_downloads: "Mail attachments", mail: "Mail", app_support: "App support files",
    containers: "Sandboxed app data", dupe: "Duplicate copy"};
  function gb1(kb) { return (kb * 1024 / 1e9).toFixed(1); }
  function counterBox(parent) {
    var box = el("div", "counter");
    var gb = gb1(freedKB), ok = freedKB > 0 && +gb >= 0.1 && +gb <= 2000;
    box.appendChild(el("h3", "", "The junk.report total"));
    if (ok) {
      var url = "https://junk.report/count?gb=" + gb;
      var a = el("a", "btn", "Add my " + gb + " GB to the junk.report total");
      a.href = url; a.target = "_blank"; a.rel = "noopener noreferrer";
      box.appendChild(a);
      var p = el("p", "fine");
      add(p, "Optional. Clicking opens this address in your browser: ", el("code", "", url),
        ". The number " + gb + " is the only thing it sends. No file names, folders, computer name, username or ID. ",
        "Like any website visit, your browser connects from your IP address; the server uses it only to count each person once a day, keeps it as a scrambled code for a day, and records the day the number arrived. Nothing is sent unless you click.");
      box.appendChild(p);
    } else {
      var b = el("button", "btn", freedKB > 0 ? "Too big to count" : "Add my GB to the junk.report total"); b.disabled = true; b.type = "button";
      box.appendChild(b);
      box.appendChild(el("p", "fine", meta.since_when
        ? "Nothing in this report got smaller since last time, so there's nothing to add. Nothing is ever sent unless you click."
        : "Once you've cleared something, run junk.report again. If it freed space, you can add that one number (just the GB) to the total. Nothing is ever sent unless you click."));
    }
    parent.appendChild(box);
  }
  if (meta.since_when) {
    var sb = el("section", "since");
    var sinceDate = new Date(+meta.since_when * 1000);
    sb.appendChild(el("p", "label", "Since your last report (" + sinceDate.toLocaleString(undefined, {dateStyle: "medium", timeStyle: "short"}) + ")"));
    var big = el("p", "since-big");
    if (freedKB > 0) add(big, "You freed ", el("b", "", size(freedKB)), ".");
    else add(big, "Nothing in your last report got smaller yet.");
    sb.appendChild(big);
    var pf = +meta.since_free_kb || 0, nf = +meta.free_kb || 0;
    if (pf > 0 && nf > 0) {
      var delta = nf - pf;
      sb.appendChild(el("p", "", "Free space: " + size(pf) + " then, " + size(nf) + " now (" + (delta >= 0 ? "up " : "down ") + size(Math.abs(delta)) + ")."));
    }
    var fr = (JR.freed || []).slice().sort(function (a, b) { return (b.before - b.now) - (a.before - a.now); });
    if (fr.length) {
      var ul = el("ul", "items");
      fr.slice(0, 15).forEach(function (g) {
        var p = pathOf(g.id), slash = p.lastIndexOf("/");
        var li = el("li"), nm = el("div", "nm", p.slice(slash + 1));
        nm.appendChild(el("span", "pth mono", (CAT_NAME[g.key] || g.key) + " \u00b7 " + pretty(p.slice(0, slash)) + "/"));
        var what = g.now === 0 ? "gone, was " + size(g.before) : size(g.before) + " \u2192 " + size(g.now);
        add(li, nm, el("span", "fine", what), el("span", "isz", "\u2212" + size(g.before - g.now)));
        ul.appendChild(li);
      });
      sb.appendChild(ul);
      if (fr.length > 15) sb.appendChild(el("p", "fine", "And " + (fr.length - 15) + " more."));
    }
    sb.appendChild(el("p", "fine", "\u201cFreed\u201d only counts items from your last report that are now gone or at least 10 MB smaller. Free space also moves for other reasons (new downloads, app and macOS updates, Time Machine snapshots), so the two numbers won't match exactly. Deleted copies of duplicates may have been clones that shared space."));
    counterBox(sb);
    app.appendChild(sb);
  }

  // ---- shareable JunkReport card: aggregate numbers only, drawn locally on a <canvas> ----
  var ITEM_NAME = {"npm": "npm cache", "Yarn": "Yarn cache", "Yarn (classic)": "Yarn cache", "pnpm": "pnpm store", "Gradle": "Gradle cache",
    "Cargo (Rust)": "Cargo cache", "Go modules": "Go module cache", "CocoaPods": "CocoaPods cache", "pip": "pip cache", "Maven": "Maven cache",
    "Bun": "Bun cache", "Ollama": "Ollama models", "Hugging Face": "Hugging Face models", "LM Studio": "LM Studio models",
    "LM Studio (older)": "LM Studio models", "Docker Desktop": "Docker disk", "OrbStack": "OrbStack disk", "Colima": "Colima disk", "Podman": "Podman disk"};
  function topPiles() {
    // Only fixed, generic names from the two lists above. Never a file or folder name from this Mac.
    var c = [];
    cats.forEach(function (cat) {
      if (cat.verdict === "keep") return;
      var its = itemsBy[cat.key] || [];
      if (/^(dev_caches|ai_models|docker)$/.test(cat.key) && its.length) {
        its.forEach(function (it) { c.push({n: ITEM_NAME[it.label] || CAT_NAME[cat.key], kb: it.kb}); });
      } else c.push({n: CAT_NAME[cat.key] || "Other", kb: cat.kb});
    });
    c.sort(function (a, b) { return b.kb - a.kb; });
    var out = [];
    c.forEach(function (x) { if (out.indexOf(x.n) < 0 && out.length < 3) out.push(x.n); });
    return out;
  }
  var cardDate = when.toLocaleDateString(undefined, {month: "short", day: "numeric", year: "numeric"});
  var piles = topPiles();
  var LINES = [];
  if (freedKB > 0) LINES.push({k: "freed", big: size(freedKB), cap: "freed since my last report", tw: "freed " + size(freedKB) + " since my last report"});
  if (safeKB > 0) LINES.push({k: "safe", big: size(safeKB), cap: "safe to clear", tw: size(safeKB) + " safe to clear"});
  if (lookKB > 0) LINES.push({k: "look", big: size(lookKB), cap: "worth a look", tw: size(lookKB) + " worth a look"});
  if (dupeKB > 0) LINES.push({k: "dupes", big: size(dupeKB), cap: "in duplicate copies", tw: "up to " + size(dupeKB) + " in duplicate copies"});
  if (diskKB > 0) LINES.push({k: "disk", big: size(diskKB) + " disk", cap: size(freeKB) + " free", tw: size(freeKB) + " free of " + size(diskKB)});
  if (piles.length) LINES.push({k: "piles", big: "", cap: piles.join(" \u00b7 "), tw: "biggest piles: " + piles.join(", ")});
  LINES.push({k: "date", big: "", cap: cardDate, tw: ""});
  var LABELS = {freed: "Freed since last time", safe: "Safe to clear", look: "Worth a look", dupes: "Duplicates", disk: "Disk size and free space", piles: "Top 3 piles (generic names)", date: "Date"};
  var on = {}; LINES.forEach(function (l) { on[l.k] = true; });
  var JRCard = window.JRCard = {drawn: [], tweet: ""};

  function drawCard(cv) {
    var W = 1200, Hh = 630, ctx = cv.getContext("2d");
    cv.width = W; cv.height = Hh;
    var SAND = "#f4efe3", INK = "#0d0d0a", OLIVE = "#26301a", LABEL = "#e6d9a8", RED = "#a3200f", MUTED = "#4a473c";
    var FONT = '-apple-system, "Helvetica Neue", Helvetica, Arial, sans-serif';
    JRCard.drawn = [];
    function T(s, x, y, font, color, align, maxW) {
      ctx.font = font; ctx.fillStyle = color; ctx.textAlign = align || "left"; ctx.textBaseline = "alphabetic";
      var size0 = parseInt(font.match(/(\d+)px/)[1], 10), f = font;
      while (maxW && ctx.measureText(s).width > maxW && size0 > 12) { size0 -= 2; f = font.replace(/\d+px/, size0 + "px"); ctx.font = f; }
      JRCard.drawn.push(s); ctx.fillText(s, x, y);
      return ctx.measureText(s).width;
    }
    ctx.fillStyle = SAND; ctx.fillRect(0, 0, W, Hh);
    var w1 = T("junk", 64, 92, "800 40px " + FONT, INK);
    T(".report", 64 + w1, 92, "400 40px " + FONT, INK);
    if (on.date) T(cardDate, W - 64, 92, "400 26px " + FONT, MUTED, "right");
    ctx.fillStyle = INK; ctx.fillRect(64, 118, W - 128, 4);
    var shown = LINES.filter(function (l) { return on[l.k] && l.k !== "piles" && l.k !== "date"; });
    var y = 236;
    if (shown.length) {
      var h = shown[0];
      var bw = T(h.big, 64, y, "800 104px " + FONT, INK, "left", 560);
      T(h.cap, 64 + Math.min(bw, 560) + 24, y, "600 38px " + FONT, OLIVE, "left", W - 128 - Math.min(bw, 560) - 24);
      y += 70;
      shown.slice(1, 5).forEach(function (l) {
        var lw = T(l.big, 64, y, "800 38px " + FONT, INK);
        T(l.cap, 64 + lw + 14, y, "400 34px " + FONT, MUTED, "left", W - 128 - lw - 14);
        y += 52;
      });
    } else {
      T("My Mac's junk report", 64, y, "800 72px " + FONT, INK);
    }
    // stamp
    ctx.save(); ctx.translate(W - 200, 430); ctx.rotate(-0.05);
    ctx.strokeStyle = RED; ctx.lineWidth = 3; ctx.strokeRect(-120, -30, 240, 46);
    T("READ-ONLY SCAN", 0, 2, "800 22px " + FONT, RED, "center");
    ctx.restore();
    // olive band
    ctx.fillStyle = OLIVE; ctx.fillRect(0, 520, W, 110);
    if (on.piles && piles.length) {
      T("BIGGEST PILES", 64, 556, "700 18px " + FONT, LABEL);
      T(piles.join("  \u00b7  "), 64, 598, "700 32px " + FONT, "#ffffff", "left", 720);
    } else {
      T("Where did your disk space go?", 64, 588, "700 32px " + FONT, "#ffffff", "left", 720);
    }
    T("junk.report", W - 64, 568, "800 30px " + FONT, "#ffffff", "right");
    T("nothing left my Mac", W - 64, 600, "400 20px " + FONT, LABEL, "right");
    var tw = LINES.filter(function (l) { return on[l.k] && l.tw; }).map(function (l) { return l.tw; });
    JRCard.tweet = (tw.length ? "My Mac's junk.report: " + tw.join(", ") + "." : "I made a junk.report for my Mac.") + " Read-only scan, nothing left my Mac.";
    return JRCard;
  }

  function cardPanel() {
    var panel = document.getElementById("cardpanel");
    if (panel) { panel.hidden = !panel.hidden; return; }
    panel = el("section", "cardpanel"); panel.id = "cardpanel";
    panel.appendChild(el("h2", "", "Your JunkReport card"));
    panel.appendChild(el("p", "fine", "Made right here in this page. It shows totals only: no file names, folders, username or computer name. Untick anything you'd rather not share."));
    var cv = el("canvas"); cv.id = "card"; cv.setAttribute("aria-label", "Share card preview");
    var boxes = el("div", "checks");
    LINES.forEach(function (l) {
      var lab = el("label"), cb = el("input"); cb.type = "checkbox"; cb.checked = true; cb.setAttribute("data-k", l.k);
      cb.addEventListener("change", function () { on[l.k] = cb.checked; redraw(); });
      add(lab, cb, " " + LABELS[l.k] + (l.k === "date" ? "" : ": ") + (l.k === "date" ? "" : (l.big ? l.big + " " : "") + l.cap));
      boxes.appendChild(lab);
    });
    var acts = el("div", "acts");
    var dl = el("button", "btn", "Download PNG"); dl.type = "button";
    dl.addEventListener("click", function () {
      cv.toBlob(function (b) { var a = el("a"); a.href = URL.createObjectURL(b); a.download = "my-junkreport.png"; document.body.appendChild(a); a.click(); a.remove(); });
    });
    var cp = el("button", "btn ghost", "Copy post text"); cp.type = "button";
    cp.addEventListener("click", function () { copy(JRCard.tweet).then(function (ok) { toast(ok ? "Copied: " + JRCard.tweet : JRCard.tweet); }); });
    var x = el("a", "btn ghost", "Post on X"); x.target = "_blank"; x.rel = "noopener noreferrer";
    add(acts, dl, cp, x);
    var tp = el("p", "fine tweet");
    function redraw() {
      drawCard(cv);
      x.href = "https://x.com/intent/post?text=" + encodeURIComponent(JRCard.tweet) + "&url=" + encodeURIComponent("https://junk.report");
      tp.textContent = "Post text: " + JRCard.tweet;
    }
    add(panel, cv, boxes, tp, acts);
    panel.appendChild(el("p", "fine", "\u201cPost on X\u201d opens X in your browser with this text filled in; nothing is posted until you press Post there. The picture is only shared if you attach it yourself."));
    redraw();
    document.getElementById("hero").after(panel);
    panel.scrollIntoView({block: "start"});
  }

  // ---- hero ----
  var hero = el("section", "hero"); hero.id = "hero";
  var h1 = el("h1");
  if (safeKB > 0) add(h1, el("span", "n", size(safeKB)), " is safe to clear.");
  else add(h1, "Nothing big is safe to clear right now.");
  hero.appendChild(h1);
  if (lookKB > 0) { var sub = el("p", "sub"); add(sub, "Another ", el("span", "n", size(lookKB)), " is worth a look."); hero.appendChild(sub); }
  if (dupeKB > 0) { var dl1 = el("p", "sub"); add(dl1, "Plus up to ", el("span", "n dup", size(dupeKB)), " in duplicate copies."); hero.appendChild(dl1); }
  hero.appendChild(el("p", "calm", "Nothing was deleted or changed. This is just a report: what's big, what it is, and whether it's safe to clear."));
  var mk = el("button", "btn", "Make my JunkReport"); mk.type = "button"; mk.id = "makecard";
  var hb = el("p", "heroacts"); add(hb, mk, el("span", "fine", " A shareable picture with your totals only."));
  hero.appendChild(hb);
  if (!meta.since_when && meta.snapshot_saved) hero.appendChild(el("p", "fine", "This is your first report on this Mac. Run it again after you clear things out, and it will start with what you freed."));
  app.appendChild(hero);
  mk.addEventListener("click", function () { cardPanel(); });

  // ---- disk bar ----
  if (diskKB > 0) {
    var d = el("section", "disk");
    d.appendChild(el("h2", "", size(diskKB) + " disk \u00b7 " + size(freeKB) + " free"));
    var bar = el("div", "bar"); bar.setAttribute("role", "img");
    var otherKB = Math.max(0, usedKB - safeKB - lookKB);
    bar.setAttribute("aria-label", "Safe to clear " + size(safeKB) + ", worth a look " + size(lookKB) + ", everything else " + size(otherKB) + ", free " + size(freeKB));
    [["b-safe", safeKB], ["b-look", lookKB], ["b-other", otherKB]].forEach(function (s) {
      var i = el("i", s[0]); i.style.width = (diskKB ? Math.min(100, 100 * s[1] / diskKB) : 0) + "%"; bar.appendChild(i);
    });
    d.appendChild(bar);
    var lg = el("div", "legend");
    [["var(--safe)", "Safe to clear", safeKB], ["#d98a1e", "Worth a look", lookKB], ["var(--other)", "Everything else (apps, macOS, your files)", otherKB], ["#fff", "Free", freeKB]].forEach(function (x) {
      var s = el("span"); var sw = el("span", "sw"); sw.style.background = x[0]; add(s, sw, x[1] + " ", el("b", "", size(x[2]))); lg.appendChild(s);
    });
    d.appendChild(lg);
    app.appendChild(d);
  }

  // ---- duplicates ----
  if (meta.dupes_ran) {
    var ds = el("section", "group"); ds.id = "duplicates";
    var minMB = +meta.dupe_min_mb || 50;
    ds.appendChild(el("h2", "", "Duplicates"));
    if (dupeSets.length) {
      ds.appendChild(el("p", "", "These files are identical, byte for byte (same size, same fingerprint). Keep one copy, you choose which, and move the others to the Trash. Only files of " + minMB + " MB or more were checked."));
      dupeSets.forEach(function (s) {
        var names = s.ids.map(function (id) { var p = pathOf(id); return p.slice(p.lastIndexOf("/") + 1); });
        var name = names.slice().sort(function (a, b) {
          var ca = names.filter(function (n) { return n === a; }).length, cb = names.filter(function (n) { return n === b; }).length;
          return cb - ca || (a < b ? -1 : 1);
        })[0];
        var same = names.every(function (n) { return n === name; });
        var card = el("article", "cat dupe");
        var head = el("div", "cat-h");
        var h3 = el("h3", "", same ? name : name + " (some copies have other names)");
        add(head, h3, el("span", "size", "up to " + size(s.save)));
        card.appendChild(head);
        card.appendChild(el("p", "meta", s.ids.length + " identical copies \u00b7 " + size(s.kb) + " each \u00b7 keep one, you choose"));
        var ul = el("ul", "items");
        s.ids.forEach(function (id) {
          var p = pathOf(id), slash = p.lastIndexOf("/");
          var li = el("li"), nm = el("div", "nm", p.slice(slash + 1));
          nm.appendChild(el("span", "pth mono", pretty(p.slice(0, slash)) + "/"));
          add(li, nm, el("span", "isz", size(s.kb)), revealBtn(id, true));
          ul.appendChild(li);
        });
        card.appendChild(ul);
        ds.appendChild(card);
      });
      ds.appendChild(el("p", "fine", "Why \u201cup to\u201d? When you duplicate a file in Finder, macOS often makes a clone that shares storage with the original, so deleting the copy may free little or no space. Copies that came from downloads, other drives or other Macs do take up their full size. Two names for the very same file (hard links) aren't counted as duplicates."));
    } else {
      ds.appendChild(el("p", "", "No duplicate files of " + minMB + " MB or more found."));
    }
    if (meta.dupes_partial == 1) ds.appendChild(el("p", "warn", "We stopped checking for duplicates after the time limit, so there may be more than shown here."));
    if (meta.find_timeout) ds.appendChild(el("p", "warn", "The file search stopped early on this big home folder, so some duplicates may not have been seen."));
    app.appendChild(ds);
  }

  // ---- categories ----
  GROUPS.forEach(function (g) {
    var list = cats.filter(function (c) { return c.verdict === g.v && c.kb >= 1024; });
    if (!list.length) return;
    var sec = el("section", "group");
    add(sec, el("h2", "", g.h), el("p", "", g.p));
    list.forEach(function (c) {
      var info = CAT[c.key] || {t: c.key, what: "", safe: "", how: ""};
      var card = el("article", "cat " + c.verdict);
      var head = el("div", "cat-h");
      var h3 = el("h3", "", info.t); h3.appendChild(el("span", "chip " + c.verdict, g.h.split(",")[0]));
      add(head, h3, el("span", "size", size(c.kb)));
      card.appendChild(head);
      var dl = el("dl");
      add(dl, el("dt", "", "What it is"), el("dd", "", info.what), el("dt", "", "Safe to clear?"), el("dd", "", info.safe));
      var how = el("dd", "", info.how + " ");
      if (info.cmd) {
        var cm = el("span", "cmd"); var cmb = el("button", "small", "Copy"); cmb.type = "button";
        cmb.addEventListener("click", function () { copy(info.cmd).then(function (ok) { toast(ok ? "Copied. Paste it into Terminal." : info.cmd); }); });
        add(cm, el("code", "", info.cmd), cmb); how.appendChild(el("br")); how.appendChild(cm);
      }
      add(dl, el("dt", "", "How"), how);
      card.appendChild(dl);
      if (c.partial == 1) card.appendChild(el("p", "warn", "macOS privacy settings kept us out of part of this, so the real size may be bigger. To measure everything: System Settings > Privacy & Security > Full Disk Access > turn on Terminal, then run the scan again."));
      if (c.partial == 2) card.appendChild(el("p", "warn", "This took too long to measure completely, so treat the size as a minimum."));
      var its = itemsBy[c.key] || [];
      if (c.id >= 0 && !its.length) { var one = el("p"); one.style.marginTop = ".75rem"; add(one, el("span", "pth mono", pretty(pathOf(c.id))), revealBtn(c.id, true)); card.appendChild(one); }
      if (its.length) {
        var ul = el("ul", "items"), max = its[0].kb, left = 0;
        its.forEach(function (it) {
          var li = el("li"), nm = el("div", "nm", niceLabel(it));
          if (it.flag === "leftover") { nm.appendChild(el("span", "flag", "No matching app found")); left++; }
          nm.appendChild(el("span", "pth mono", pretty(pathOf(it.id))));
          var mini = el("div", "mini"), mi = el("i"); mi.style.width = Math.max(1, 100 * it.kb / max) + "%"; mini.appendChild(mi);
          add(li, nm, el("span", "isz", size(it.kb)), revealBtn(it.id, true), mini);
          ul.appendChild(li);
        });
        card.appendChild(ul);
        if (c.id >= 0) { var all = el("p"); all.style.marginTop = ".75rem"; add(all, revealBtn(c.id, false), " "); all.appendChild(el("span", "pth mono", pretty(pathOf(c.id)))); all.lastChild.style.display = "inline"; card.appendChild(all); }
        if (left) {
          var z = el("div", "tip");
          add(z, el("b", "", "Before you clear one: "), "Folders marked \u201cNo matching app found\u201d may be left over from apps you already deleted, or the app may just live somewhere unusual. Search for the app in Finder first. If it's really gone, move the folder to the Trash and leave it there for a week before you empty it.");
          card.appendChild(z);
        }
      }
      sec.appendChild(card);
    });
    app.appendChild(sec);
  });

  // ---- biggest files ----
  if (JR.files.length) {
    var fs = el("section", "group");
    add(fs, el("h2", "", "Your biggest files"), el("p", "", "The largest single files in your home folder (100 MB and up). Some also appear in the sections above."));
    var fc = el("div", "cat files"); var ful = el("ul", "items"); ful.style.marginTop = "0"; ful.style.borderTop = "0";
    var fmax = JR.files[0].kb;
    JR.files.forEach(function (f) {
      var p = pathOf(f.id), slash = p.lastIndexOf("/");
      var li = el("li"), nm = el("div", "nm", p.slice(slash + 1));
      nm.appendChild(el("span", "pth mono", pretty(p.slice(0, slash)) + "/"));
      var mini = el("div", "mini"), mi = el("i"); mi.style.width = Math.max(1, 100 * f.kb / fmax) + "%"; mini.appendChild(mi);
      add(li, nm, el("span", "isz", size(f.kb)), revealBtn(f.id, true), mini);
      ful.appendChild(li);
    });
    fc.appendChild(ful); fs.appendChild(fc); app.appendChild(fs);
    if (meta.find_timeout) fs.appendChild(el("p", "warn", "The file search stopped after 90 seconds, so this list may be missing some files."));
  }

  // ---- notes ----
  var notes = el("section", "notes");
  notes.appendChild(el("h2", "", "About these numbers"));
  var nl = el("ul");
  ["Sizes are space actually used on disk, counted the way Finder does (1 GB = 1,000,000,000 bytes).",
   "We measured " + size(measured) + " in the places Macs usually fill up. \u201cEverything else\u201d is macOS, your apps, and your own documents.",
   "Duplicates were checked by size first, then by an md5 fingerprint of the whole file. Hard links count once. Some copies may be clones that share space. Files that live only in iCloud weren't read, so checking never downloads anything.",
   "Space macOS lists as \u201cpurgeable\u201d and Time Machine snapshots on this disk aren't counted here; macOS frees those on its own when it needs room.",
   "Dragging an app to the Trash leaves its support files, caches and settings behind. That's where most \u201cNo matching app found\u201d folders come from.",
   "Not sure about something? Move it to the Trash and leave it there for a week before you empty it."
  ].forEach(function (t) { nl.appendChild(el("li", "", t)); });
  notes.appendChild(nl); app.appendChild(notes);

  if (!meta.since_when) { var cs = el("section", "since quiet"); counterBox(cs); app.appendChild(cs); }

  document.getElementById("foot").textContent = "Made on this Mac by junk.report. Nothing was uploaded: this page is not allowed to load anything from the internet, and the only links are ones you click. Save it, delete it, it's yours.";

  // ---- is the Show in Finder helper running? ----
  setHelper(false);
  if (live) {
    fetch("/ping?t=" + token, {cache: "no-store"}).then(function (r) { setHelper(r.status === 204); }, function () { setHelper(false); });
  } else if (location.protocol === "file:") {
    document.getElementById("status").lastChild.textContent = "Opened as a saved file, so buttons copy the path instead of opening Finder. Run the scan again to switch Show in Finder back on.";
  }
})();
</script>
</body></html>
JR_HTML
}

jr_main "$@"