English | 中文
The Windows C-drive cleaner that explains every file before it deletes — Recycle Bin only, never permanent. (AI optional, on-demand, advisory.)
📸 More screenshots / demo GIF coming soon — suggested recording: scan → space map → explorer tree → right-click "Move to Recycle Bin / Move to another drive". 更多截图与演示 GIF 即将补充。
CleanScope scans your disk and explains every file/directory by its origin, ownership, dependencies and risk, gives graded recommendations, and leaves the final delete decision entirely to you. It prioritizes answering "what is this, who owns it, what happens if I delete it"; when you confirm a cleanup, it only moves cleanable items (A/B) to the Recycle Bin (recoverable) — never permanent deletion, never touching system-critical files.
Three ways to free up your C: drive, all from one app: (1) safely delete cleanable junk (Recycle Bin only), (2) one-click official Windows methods (disable hibernation, empty Recycle Bin, Disk Cleanup, DISM component cleanup), and (3) move the bulky-but-undeletable app folders to another drive + a directory junction so the app keeps working as if nothing moved.
- AI never deletes important C-drive files — AI only explains/investigates; it can never trigger deletion.
- Explain first — surface a file's origin / dependencies / risk rather than acting on it directly.
- The user makes the final delete decision (deletion requires an explicit click + two-step confirmation).
- The product must be safe, explainable, testable, extensible.
Deletion model (S-E): the single disk-mutating safety gate only admits items in the "cleanable" bucket (A/B) that are non-system-critical, non-container and not in use, and deletion only moves them to the Recycle Bin (recoverable) — there is no permanent-delete API anywhere in the codebase (the one Recycle-Bin delete is isolated in a single file, with a static test positively asserting "Recycle Bin only, never permanent", gated in CI). At its core it remains an analyzer: scan → evidence → rules → attribution → risk → decision → report.
- A single "shallow → deep" cleaning main line — the overview is reorganized into three guided steps instead of competing buttons: ① one-click safe clean (A/B), ② deep-clean by software (WeChat / QQ / browsers / IDEs… each with its footprint and what's cleanable), ③ deep free-up (migrate big folders / browse the directory tree, with official Windows tools below). The old standalone "Free up space" wizard is folded into this line, and AI is demoted to a small optional "let AI read this result" link.
- Per-software "deep clean" — each software group on the By software page gets a Clean cleanables button that moves all of that app's safe-to-clean (A/B) items to the Recycle Bin in one confirmed, gated, undoable batch — no more opening files one by one. (The directory tree stays the fine-grained, any-risk picker, so the two pages no longer overlap.)
- Consistent delete entry on detail pages — the By software / Space Map detail page now offers a single Move-to-Recycle-Bin entry covering every risk level, matching the directory tree: A/B with a normal confirm, C–E behind a red strong-confirm (the safety gate still rejects system-critical / container / in-use even on override; still Recycle-Bin-only, fully undoable).
- "Cleanable list" renamed "Directory browse" — the page was always the whole-disk directory tree, not a fixed list; the name now says so. Its "other files in this folder" remainder is now expandable (reads the real folder on demand so every file is reachable).
- Truthful recycle history — the report's recycle history now checks the actual Recycle Bin: items you've already emptied are honestly marked "permanently removed" instead of still claiming "restorable".
- By-software page & row polish — removed the stray border on every list row (hover-only accent now), added a clean custom expander (rotating chevron, no dashed focus box), and tidied the home page's recent-scans layout.
- One-click safe clean + a guided "Free up space" wizard — the overview now leads with a Recommended actions card whose top action is one-click clean of every "safe-to-clean (A/B)" item (one confirm → batched to the Recycle Bin, each item still re-checked by the safety gate, fully undoable). A novice-friendly wizard walks you through it in three steps: safe-to-clean → migrate a big undeletable folder → official Windows tools.
- Multi-select batch in the directory tree — you no longer have to flip to "Cleanable only": tick items anywhere in the whole-disk tree to batch Move-to-Recycle-Bin or batch AI-identify them.
- Lifetime "cleaned" tally — CleanScope now remembers how much it has cleaned for you across sessions ("cleaned N items · ~X" on the overview); undo rolls it back so it stays honest.
- Optimize Drives (defrag / SSD TRIM) — a new official action launches Windows' own Optimize Drives, which auto-detects the disk type (TRIM for SSDs, defrag for HDDs) — it never force-defragments an SSD.
- AI cleanup advice — fixed and sharper — fixed the action plan occasionally showing raw/half JSON (bigger token budget + partial-plan salvage + a clean retry message instead of dumping braces); the plan now leads with the one-click safe clean and names concrete big items; per-item AI advice now keeps every suggested action inside CleanScope (no more "go open a terminal / another app"); plus you can batch-AI-identify selected items at once.
- Dark mode + one-click theme switch — a full light/dark theme system: toggle from the title bar, remembered across sessions, every surface (cards, inputs, the Space Map treemap, dialogs) re-colors live. Risk colors are tuned per-theme so the map sits calmly on a dark background instead of glowing.
- First-run onboarding — a themed welcome screen explains what CleanScope does and its safety promises (Recycle Bin only, never permanent, never touches system-critical), shown once on first launch.
- Hand-drawn vector icon system — every emoji in the UI is replaced by a crisp vector icon set that scales and recolors with the theme, so the app reads as designed rather than assembled.
- One-click undo of the last recycle — after you move items to the Recycle Bin, an Undo toast restores them to their original location (Shell-based restore, with an open-Recycle-Bin fallback). Still zero permanent deletion.
- Recent scans + remembered state — the home page lists recent scan targets for one-click re-scan; window size/position and your last scan target / admin-mode are restored on launch.
- Cross-session AI cache — once you've identified an item with AI, the result is cached locally (SQLite) and reused for free in later sessions; changing the model or sanitization level re-enables a fresh identify.
- Structured AI cleanup plan + progress feedback — the AI plan is now progressive-disclosure cards (estimated saving / difficulty / where, with a "why" toggle) instead of a wall of text, with a loading spinner so you can tell it isn't stuck.
- Keyboard shortcuts, in-app log & themed dialogs — Esc to go back, F5 to re-scan, Ctrl+F to focus search, plus screen-reader names on icon buttons; the AI diagnostic log is now viewable inside the app (no file digging); crash/startup error dialogs are self-drawn and theme-consistent (no raw Windows MessageBox).
- Explanation-first workspace — the cleanable list is now master + a persistent explanation panel on the right: select any item and its origin / purpose / risk / suggested action appear instantly, no more jumping to a separate page. Explanation, not deletion, is the focus.
- A–E risk grade badges (signature visual) — risk shows as lettered grade badges (A "safe to clear" … E "system-critical, keep") with plain-language labels, consistent across the list, the detail panel and the Space Map — replacing the generic red/yellow/green dots.
- AI action plan personalized by sanitization level — generating the cleanup plan now respects your 3-level toggle: Off attaches your real top items (full paths) for targeted advice, Balanced sends names only (no full path/username), Strict stays aggregate-only. Markdown emphasis now renders as actual bold.
- Personal files no longer all red — unidentified files in user areas (data drives, your own folders) are now graded C "personal file, your call" instead of E, so a drive full of your documents isn't painted high-risk red; unknown files in system areas (Windows, Recovery…) still stay E. Safety is unchanged — C is still non-cleanable with no delete button, and the safety gate still vets every action independently.
- Native, integrated UI — flat pivot tabs (instead of floating pills), a workbench home that leads with results after a scan (the value pitch only shows pre-scan), a slimmer title bar, thin modern scrollbars and calmer card depth — it now reads as one app, not several embedded windows.
- Scan the whole computer in one click — a new "Scan whole computer" runs the same scan/evidence/risk pipeline across every fixed drive and merges them under one virtual "This PC" root (inaccessible drives are skipped). Explorer, Space Map and the overview all work on the combined result.
- Empty Recycle Bin no longer false-fails — a suppressed PowerShell error still makes
powershell.exeexit 1, so an already-empty bin was wrongly reported as "command failed (exit 1)". An empty bin is the intended end state; the command now swallows that and reports honestly, with freed space measured before/after. - Visible progress for official cleanup — managed actions (empty Recycle Bin, disable hibernation, DISM…) now show an in-app progress bar while running, instead of a single static line.
- AI privacy made discoverable, default Balanced — AI Settings moved out of the numbered ①–⑤ workflow into a dedicated config entry; the 3-level cloud-sanitization control is now a prominent radio group, the current level is shown in the always-on badge, and new installs default to Balanced (sends folder/app names, hides username) so AI actually recognizes software instead of seeming weak. File contents are still never sent.
- Re-identify after changing model/sanitization — once you've run "AI identify" on an item it locks; changing the model or sanitization level now re-enables it so you can re-identify under the new settings.
- Simpler home page — removed the TopN box and the AppData-only quick scan (everyday users don't need them).
- Offline ground-truth attribution (works on any machine) — directories with no registry/AppData match are attributed by reading the embedded vendor/product/signature of a representative binary inside them, so portable apps and custom install locations stop showing up as "unknown".
- Git-updatable software feature pack (
signatures/known-software.json) — normalizes vendor names, covers pure-data folders, and adds one-line "what is this software" descriptions (e.g. Steam → game platform, Zed → code editor). Fully local, no network; PRs welcome. - 3-level AI privacy — choose Strict / Balanced / Off in AI Settings; trade folder-name privacy for identification quality, with each level's pros/cons shown. File contents are never sent.
- Manual recycle for high-risk items — for your own unidentifiable folders, an explicit checkbox-gated confirm lets you move C-E items to the Recycle Bin; system-critical / container / in-use are still refused, still recycle-bin-only.
- Clearer official cleanup — each action now states what it does, the consequence, and whether/how it can be undone, with a "reversible / irreversible" badge and a confirm dialog.
| CleanScope | CCleaner | WizTree | BleachBit | |
|---|---|---|---|---|
| Explains each file's origin & purpose | ✅ | ❌ size only | ||
| Can it permanently delete? | ❌ Recycle Bin only | ✅ | — (viewer) | ✅ |
| Risk grading A–E + system-critical blacklist | ✅ | ❌ | ||
| Whole-disk tree (WizTree-style) | ✅ | ❌ | ✅ | ❌ |
| One-click official methods (disable hibernation, empty Recycle Bin, DISM, Disk Cleanup) | ✅ | ❌ | ❌ | |
| Move bulky apps to another drive + junction (free C: without deleting) | ✅ | ❌ | ❌ | ❌ |
| AI explanations (on-demand, advisory, never deletes) | ✅ | ❌ | ❌ | ❌ |
| Local-only by default (no telemetry) | ✅ | ❌ | ✅ | ✅ |
| Open source | ✅ MIT | ❌ | ❌ | ✅ |
WizTree is a fast size viewer, not a cleaner; CCleaner/BleachBit do delete permanently. CleanScope's niche is safe + explainable: it tells you what each thing is and physically can't permanently delete.
- Windows 10/11 (some capabilities rely on Win32: registry, Restart Manager in-use detection, Authenticode signature reading)
- .NET 8 SDK (
dotnet --version≥ 8.0) - The WPF desktop app needs the Windows Desktop Runtime (installed together with the .NET 8 SDK)
git clone https://github.com/David-Chen31/CleanScope.git
cd CleanScope
dotnet build CleanScope.sln -c ReleaseCleanScope is an open-source app and is not code-signed (a trusted certificate costs money). So the first time you run a downloaded .exe, Windows may show "Windows protected your PC" (SmartScreen) with an Unknown publisher note. This is expected for any unsigned app — it is not a virus warning about CleanScope specifically.
To run it:
- On the SmartScreen dialog, click More info.
- Then click Run anyway.
If you prefer to verify integrity first, check the SHA-256 hash against the value published in the release notes:
Get-FileHash .\CleanScope.exe -Algorithm SHA256Compare the printed hash with the one in the release. If they match, the file is exactly what was published. You can also build it yourself from source (see above) to avoid the download entirely — the source is fully open.
Why not just sign it? A signing certificate (or Azure Trusted Signing) has a recurring cost; this is on the roadmap but not done yet. Until then, the steps above are the safe, free way to run it.
The fastest way to see the core value: scan a path, output graded risk and a Markdown report. Read-only throughout — deletes nothing.
# Scan the user cache dir, print graded stats and Top 10
dotnet run --project src/CleanScope.App.Console -- scan "%LocalAppData%"
# Scan and export a Markdown report
dotnet run --project src/CleanScope.App.Console -- scan "C:\SomeFolder" --report report.md --top 200
# Enable AI explanations (desensitized before leaving the machine; requires a key, see below)
dotnet run --project src/CleanScope.App.Console -- scan "%LocalAppData%" --ai --report report.mdOptions:
| Option | Description |
|---|---|
scan <path> |
Root path to scan (required) |
--report <file> |
Export a Markdown report to the given file |
--top <N> |
Keep the top N largest items (default 100) |
--admin |
Admin mode, widens scan coverage (run the terminal as administrator) |
--sanitize |
Desensitize usernames in report paths (for sharing) |
--ai |
Enable AI explanations (needs a key; skipped automatically if unconfigured — pure local rules/risk) |
--rules <dir> |
Rule-pack directory (defaults to rules/ next to the output dir or repo root) |
Exit codes: 0 success / 2 usage error / 3 rule load failure / 4 path error / 1 other error.
dotnet run --project src/CleanScope.App.WpfMain pages:
- Overview / Scan — disk-first entry (pick a drive, full or quick AppData scan); afterwards shows root usage, cleanable estimate, high-risk count, the biggest cleanable items and one-click official Windows methods (disable hibernation / empty Recycle Bin / Disk Cleanup / DISM).
- Explorer / Cleanable List (whole-disk tree) — browse the entire disk like a directory tree, or flip to "Cleanable only" for a flat, checkbox-selectable batch worklist (select-all, sort, batch Move-to-Recycle-Bin). Per-node origin/purpose/risk; right-click or the selected-item detail pane to copy path, open location, identify with AI, add-to-ignore, migrate to another drive, or recycle. Deletes elsewhere sync here live.
- Space Map — treemap (area = size, color = risk) to drill into "where did my space go".
- By Software — aggregate "who took my space and how much is cleanable" per owning app.
- Detail — properties, risk assessment, evidence chain (facts vs AI guesses, visually distinguished), attribution candidates, and on-demand AI explanation (only when you click); cleanable items (A/B) offer "🗑 Move to Recycle Bin (recoverable)" — two-step confirm + gate re-check + audit-first, Recycle Bin only; high-risk (D/E) / container / system-critical have no delete entry, only the reason.
- Report / Ignore List — export Markdown reports; manage the global ignore list (local only).
- AI Settings — configure AI in-app: enter Base URL + key, discover models (
/models), pick one, test, and save — takes effect instantly (no restart). The key is stored DPAPI-encrypted under your user profile, never committed.
The desktop app creates a local SQLite database at %LocalAppData%\CleanScope\cleanscope.db for the audit log and ignore list (local only, never uploaded).
| Level | Meaning |
|---|---|
| A | Safe to clean (e.g. user temp files, thumbnail cache) |
| B | Clean via the official method (e.g. browser cache, via the app's own cleanup) |
| C | Confirm before acting (the default bucket; personal data or insufficient info) |
| D | Not recommended (matches the system-critical blacklist, forced ≥ D) |
| E | Cannot determine, do not delete (fail-safe worst-case fallback) |
The rule and risk engines are authoritative: AI can never lower a risk level (the validator takes max(AI, engine)).
CleanScope runs fully without AI (pure local rules + risk explanations). To enable cloud AI explanations:
-
In the desktop app (recommended) — open AI Settings, enter your Base URL + API key, click Discover models (
GET {baseUrl}/models), pick a model, Test, then Save. It takes effect immediately (no restart). The key is saved DPAPI-encrypted under%LocalAppData%\CleanScope— never in plaintext, never committed. -
Or via config file / env vars (for the CLI or headless use):
cp appsettings.ai.example.json appsettings.ai.local.json # then fill: baseUrl / apiKey / model / "cloudEnabled": trueCLEANSCOPE_AI_BASEURL CLEANSCOPE_AI_KEY CLEANSCOPE_AI_MODEL CLEANSCOPE_AI_CLOUD=1
🔒 The key never leaves your machine in plaintext: the desktop app encrypts it with DPAPI;
appsettings.ai.local.jsonis excluded by.gitignore. Only the key-freeappsettings.ai.example.jsontemplate is checked in.
On-demand only (zero default token cost): even with AI configured, scanning and browsing make no cloud calls. AI fires only when you explicitly click — "✨ Explain with AI" on a file detail, "🧭 Generate AI advice" on the overview, or right-click "Identify with AI" in the Explorer. Deterministic rules / risk / name-heuristics cover the rest for free, so token-averse users pay nothing (and those who don't configure AI run fully local).
Privacy boundary: AI only goes to the cloud after desensitization (username → %USER%, filename → %FILE%), and file contents are never uploaded; with the cloud off, everything stays local with no remote calls. The desensitization gateway is the only outbound channel.
Classification knowledge lives as declarative data in rules/ (12 packs, 60 rules), not hardcoded. Extend recognition by editing JSON, no code changes needed. System-critical directories are forced into a non-deletable blacklist in 00-system-critical.json.
dotnet test CleanScope.sln- 412 tests, including safety red-line tests (only A/B cleanable items are deletable and only to the Recycle Bin; C-E/container/blacklist/in-use/symlink must be rejected; manual high-risk override still cannot touch blacklist/container/in-use; no permanent-delete API — the Recycle-Bin delete is isolated in one file with a positive assertion; AI never lowers risk or triggers deletion; desensitized before cloud; audit written before execution …).
- Architecture dependency tests (NetArchTest) guard the layering: Core/Domain don't depend on WPF, AI doesn't reference Safety, SQLite stays in Infrastructure.
- These are hard CI gates (.github/workflows/ci.yml, windows-latest): any failure blocks merge/release.
src/
CleanScope.Domain Domain entities/enums/contracts (zero deps, innermost)
CleanScope.Core Decision chain: scan/evidence/rules/attribution/risk/decision
CleanScope.Safety Safety gate (only disk-mutating path) + executor (Recycle Bin only, no permanent-delete code)
CleanScope.Ai AI sidecar: desensitize → explain → validate (advisory only)
CleanScope.Infrastructure Win32 access, SQLite storage, rule loading (net8.0-windows)
CleanScope.Reporting Markdown report export
CleanScope.Application Use-case orchestration (wires the decision chain via abstractions)
CleanScope.App.Console CLI host + composition root
CleanScope.App.Wpf WPF desktop (MVVM) + composition root
tests/ xUnit tests (incl. safety red-lines and architecture guards)
rules/ Declarative rule packs (*.json)
Architecture: Clean Architecture + "AI sidecar + single safety gate". AI is advisory only; the only disk-mutating path is the Safety gate.
- No permanent-delete API exists in the codebase: the only deletion is "move to Recycle Bin (recoverable)", isolated in a single file, with a static test positively asserting it uses only the Recycle-Bin API.
- The only disk-mutating path is the safety gate: it admits only "cleanable" (A/B) items that are non-system-critical, non-container and not in use; C-E/container/blacklist/in-use are all rejected.
- Deletion needs an explicit user click + two-step confirmation, with an audit written before execution (log first, then act).
- AI cannot bypass the rule engine, cannot lower risk, cannot trigger deletion; when uncertain it outputs "cannot determine, do not delete".
- File contents are never uploaded; cloud is reached only after desensitization; with cloud off everything stays local.
- Every action writes its audit before executing; if the audit write fails, the action aborts.
CleanScope is free, open-source software provided "as is", without warranty of any kind, express or implied. By using it you agree that:
- You are responsible for your own data. Although CleanScope is designed to be safe (recycle-bin only, never permanent delete, system-critical blacklist), disk cleanup is inherently risky. Always make sure you have backups of anything important before deleting.
- Attribution, risk levels, size estimates and AI explanations are best-effort, not guarantees. They can be wrong or incomplete. The final decision to delete, migrate, or run any official cleanup command is always yours.
- "Official cleanup" actions launch Windows' own tools (powercfg / DISM / cleanmgr / Storage Sense, etc.). Their effects and any irreversibility are determined by Windows, not by CleanScope; read each action's description and confirm before running.
- The authors and contributors accept no liability for any data loss, system issues, or other damages arising from use of this software, to the maximum extent permitted by law. See the LICENSE for the full terms.
- The optional AI feature sends desensitized metadata only (never file contents) to the third-party endpoint you configure; you are responsible for that endpoint's privacy and terms. With AI off, everything stays local.
If you do not agree, do not use the software.
English | 中文
AI 辅助的 Windows C 盘清理分析工具 —— 先解释清楚，删除只进回收站。
C 盘满了怎么办？ CleanScope 是一款开源的 Windows C 盘清理工具 / 磁盘清理软件，专治 C 盘空间不足： 它扫描整个 C 盘，把每个占空间的文件夹（缓存、临时文件 %TEMP%、AppData 大目录、休眠文件、Windows.old 等） 讲清楚“从哪来、能不能删、删了会怎样”，再分级给建议。和盲目一键清理不同，它删除前先解释每个文件、且只移入回收站（可还原）， 绝不永久删除、绝不碰系统关键文件。三种省空间方式一站搞定：安全删除可清理项、一键调用 Windows 官方手段（关闭休眠、 清空回收站、磁盘清理、DISM 组件清理）、把占大头但不能删的软件目录迁移到其他盘 + 目录联接（软件照常用，实现 C 盘瘦身）。
关键词：C盘清理 · C盘清理工具 · C盘清理软件 · C盘空间不足 · C盘满了怎么办 · 磁盘清理 · AppData 清理 · C盘瘦身 · Windows 清理。
CleanScope 扫描你的磁盘，按来源、归属、依赖和风险把文件/目录讲清楚，给出分级建议， 把最终删除决定权完全交还给你。它优先解释“这是什么、属于谁、删了会怎样”；当你确认清理时， 只把可清理项 (A/B) 移入回收站 (可还原)，绝不永久删除、绝不碰系统关键文件。
- AI 不直接删除 C 盘重要文件 —— AI 只做解释/调查建议，永不触发删除。
- 优先解释文件的来源 / 依赖 / 风险，而非直接处理。
- 用户做最终删除决定（删除需显式点击 + 两步确认）。
- 产品必须安全、可解释、可测试、可扩展。
删除模型（S-E）：唯一可改盘的安全闸门仅对“可清理”桶 (A/B)、且非系统关键/非容器/未被占用的项放行， 且删除只移入回收站 (可恢复)——代码库里根本不存在永久删除 API（唯一的回收站删除集中在单一文件， 静态测试正向断言“仅回收站、绝不永久删除”，随 CI 门禁）。核心仍是分析器：扫描 → 取证 → 规则 → 归因 → 风险 → 决策 → 报告。
- 「由浅入深」一条清理主线——概览不再是一堆并列按钮，而是三步引导：① 一键放心清理（A/B）→ ② 按软件深清（微信 / QQ / 浏览器 / IDE…，各自占用与可清量一目了然）→ ③ 深度腾空间（迁移大目录 / 浏览目录树，官方手段在下方）。原独立的「腾出空间向导」收编进这条主线，AI 降为可选的「让 AI 解读这次结果」小入口。
- 按软件「专清」——「按软件」页每个软件组新增**「清理可清项」**按钮，一键把该软件名下全部「可放心清理(A/B)」项移入回收站（一次确认、逐项过闸门、可撤销），免去逐个打开。目录浏览仍是细粒度、可处理高风险的逐项选择器，两者不再重叠。
- 详情页删除入口对齐——「按软件」/「空间地图」详情页改为单一「移入回收站」入口覆盖全部风险等级，与目录浏览一致：A/B 普通确认，C–E 红色强确认（即便覆盖，安全闸门仍拒绝系统关键 / 容器 / 占用；仍只进回收站、可撤销）。
- 「可清理清单」更名「目录浏览」——这页本就是整盘目录树而非固定清单，名字如实呈现；其「本目录其它文件」余量项现在可展开（按需实读真实目录，确保每个文件都能点到）。
- 回收历史如实标注——报告里的回收历史改为查询真实回收站：你已清空的项如实标**「已永久移除」**，不再谎称「可还原」。
- 按软件页与行视觉打磨——去掉每行多余的黑边（改为仅 hover 点亮蓝边）、自绘干净的折叠分组（旋转 chevron、无虚线焦点框），首页最近扫描布局也更协调。
- 一键安全清理 + 腾出空间向导——概览改为以「推荐操作」卡领衔，首项即一键清理全部「可放心清理(A/B)」项（一次确认 → 批量移入回收站、每项仍过安全闸门、可撤销）。新增小白友好的「腾出空间向导」三步带你清：可放心清理 → 迁移占地大目录 → Windows 官方手段。
- 目录树多选批量——不必再切「只看可清理」：在整盘目录树里任意勾选，即可批量移入回收站或批量用 AI 识别。
- 累计清理战绩——跨会话记住「已累计为你清理 N 项 · 约 X」（概览展示）；撤销还原会相应回退，保持诚实。
- 优化驱动器（碎片整理 / SSD TRIM）——新增官方手段，拉起 Windows 自带「优化驱动器」，自动识别盘类型（SSD 走 TRIM、HDD 做碎片整理），绝不对 SSD 强行碎片整理。
- AI 清理建议修复并增强——修复行动计划偶发的半截 JSON（加大 token + 抢救已成型步骤 + 解析失败给可重试提示，绝不再把花括号倒给用户）；计划现在以一键安全清理领衔并点名真实大项；单项 AI 建议改为全部落在本程序内可完成（不再让你开命令行/别的软件）；并支持对勾选项批量 AI 识别。
- 暗色模式 + 一键主题切换——完整的明/暗主题系统：标题栏一键切换、跨会话记忆，所有界面（卡片、输入框、空间地图 treemap、弹窗）实时重着色。风险配色按主题分别调校，地图在深色下沉稳协调，不再发光刺眼。
- 首次启动引导——主题化的欢迎页讲清 CleanScope 做什么以及安全承诺（只进回收站、绝不永久删除、绝不碰系统关键），仅首次运行出现一次。
- 自绘矢量图标系统——界面里的 emoji 全部换成清晰的矢量图标集，随主题缩放与改色，读起来像精心设计而非拼装。
- 一键撤销上次回收——把项目移入回收站后，撤销 Toast 可将其还原回原位（基于 Shell 还原，失败兜底打开回收站）。仍然零永久删除。
- 最近扫描 + 状态记忆——首页列出最近扫描目标可一键重扫；窗口尺寸/位置、上次扫描目标 / 管理员模式在启动时恢复。
- AI 识别结果跨会话缓存——对某项用 AI 识别过后，结果缓存到本地（SQLite），下次会话免费复用；改模型或脱敏档位则重新可点、可取新结果。
- 结构化 AI 清理计划 + 进度反馈——AI 计划改为渐进披露的卡片（预计可省 / 难度 / 在哪做，配「为什么」展开），不再是一堵文字墙；并带加载转圈，让你知道它没卡住。
- 键盘快捷键、应用内日志与主题化弹窗——Esc 返回、F5 重扫、Ctrl+F 聚焦搜索，图标按钮补读屏名；AI 诊断日志现可在应用内直接查看（不必自己翻文件）；崩溃/启动错误弹窗改为自绘、与主题一致（不再是原生 MessageBox）。
- 解释优先的工作区——「可清理清单」改为左侧目录树 + 右侧常驻解释面板：选中任意项，它的来源 / 用途 / 风险 / 建议立刻显示，不必再跳到单独页面。主角是“解释”，不是“删除”。
- A–E 风险等级徽章（签名视觉）——风险以带字母的等级徽章呈现（A「可放心清理」… E「系统关键·勿动」）并配人话标签，在清单、详情面板、空间地图三处完全一致，取代通用的红黄绿小点。
- AI 行动计划按脱敏档位个性化——生成清理计划现在尊重三档开关：关闭附上你的真实大项（含完整路径）给针对性建议，均衡只发名称（不含完整路径/用户名），严格仅占用汇总。Markdown 加粗现在渲染为真正的粗体。
- 个人文件不再整盘判红——用户区（数据盘、你自己的文件夹）里识别不出的项现在判为 **C「个人文件，自行判断」**而非 E，一整盘个人资料不再被染成高危红；系统区（Windows、恢复分区…）的未知项仍判 E。安全不变——C 仍非可清理、无直删入口，安全闸门照旧独立把关每一步。
- 原生、一体化的界面——扁平 pivot 标签（取代浮起药丸）、扫描后以结果为主的工作台首页（价值主张只在扫描前出现）、更轻的标题栏、现代细滚动条、收敛的卡片阴影——现在读起来是一个完整应用，而不是套了几个子窗口。
- 一键扫描整台电脑——新增「扫描整台电脑」，对每个固定磁盘跑同一套扫描/取证/风险流程，合并到一个虚拟根「整台电脑」下（不可访问的盘自动跳过）。资源管理器、空间地图、概览都按合并结果工作。
- 清空回收站不再误报失败——PowerShell 即便错误被抑制，进程退出码仍是 1，导致"本就为空的回收站"被误判为"命令未成功执行(退出码1)"。空回收站正是期望结果，现在吞掉该误判并如实反馈，释放量按前后可用空间差计算。
- 官方清理执行有进度——应用内执行的命令（清空回收站、关闭休眠、DISM…）执行期间显示进度条，不再只有一行静态文字。
- 脱敏可见、默认"均衡"——AI 设置移出 ①–⑤ 主流程，作底部独立配置入口；三档出云脱敏改为醒目的单选组，常驻徽章显示当前档位，新装默认 均衡（发送文件夹/应用名、隐去用户名），让 AI 真正认得出软件而非显得"识别力弱"。任何档位都绝不发送文件内容。
- 改模型/脱敏档位后可重新识别——对某项点过"AI 识别"后会锁定；改模型或脱敏档位后重新可点，可在新设置下再识别一次。
- 首页更精简——移除 TopN 输入框与"仅 AppData 快速扫描"（普通用户用不到）。
- 离线 ground-truth 归因（换台电脑也能认）——注册表/AppData 都匹配不到的目录，改为读取其中代表性二进制内嵌的厂商/产品/签名来归属，便携软件、自定义安装位置不再一片“未知来源”。
- 可经 git 更新的软件特征库（
signatures/known-software.json）——归一厂商名、兜底纯数据目录，并给出一句话“这是什么软件”（如 Steam→游戏平台、Zed→代码编辑器）。纯本地、不联网，欢迎 PR 扩充。 - 三档 AI 脱敏——在「AI 设置」里选 严格/均衡/关闭，用文件夹名的隐私换识别力，每档优缺点都写清。任何档位都绝不发送文件内容。
- 高风险项手动移入回收站——对你自己识别不出的文件夹，经勾选确认可把 C-E 项移入回收站；系统关键/容器/占用仍拒，且仍只进回收站。
- 官方清理更清楚——每条写明做什么、后果、能否/如何恢复，带“可恢复/不可恢复”徽章与确认弹窗。
| CleanScope | CCleaner | WizTree | BleachBit | |
|---|---|---|---|---|
| 解释每个文件的来源与用途 | ✅ | ❌ 仅大小 | ||
| 会永久删除吗？ | ❌ 仅进回收站 | ✅ | —（仅查看） | ✅ |
| 风险分级 A–E + 系统关键黑名单 | ✅ | ❌ | ||
| 整盘目录树（WizTree 式） | ✅ | ❌ | ✅ | ❌ |
| AI 解释（按需、仅建议、绝不删除） | ✅ | ❌ | ❌ | ❌ |
| 默认全程本地（无遥测） | ✅ | ❌ | ✅ | ✅ |
| 开源 | ✅ MIT | ❌ | ❌ | ✅ |
WizTree 是快速的体积查看器，不做清理；CCleaner/BleachBit 会永久删除。CleanScope 的定位是安全 + 可解释：告诉你每样东西是什么，且物理上无法永久删除。
- Windows 10/11（部分能力依赖 Win32：注册表、Restart Manager 占用检测、Authenticode 签名读取）
- .NET 8 SDK（
dotnet --version≥ 8.0） - 运行 WPF 桌面端需 Windows 桌面运行时（随 .NET 8 SDK 安装即可）
git clone https://github.com/David-Chen31/CleanScope.git
cd CleanScope
dotnet build CleanScope.sln -c ReleaseCleanScope 是开源应用、未做代码签名（受信任的证书需要付费），所以你第一次运行下载来的 .exe 时，Windows 可能弹出 “Windows 已保护你的电脑”（SmartScreen），并标注未知发布者。这是所有未签名应用的通用提示，并不是说 CleanScope 是病毒。
运行方法：
- 在 SmartScreen 弹窗里点 更多信息（More info）。
- 再点 仍要运行（Run anyway）。
如果想先校验文件完整性，把 SHA-256 哈希和 release 发布说明里公布的值对一下：
Get-FileHash .\CleanScope.exe -Algorithm SHA256打印出的哈希与发布说明里的一致，就说明文件与发布的完全相同。你也可以自行从源码构建（见上文）来彻底避免下载——源码完全开放。
为什么不直接签名？签名证书（或 Azure Trusted Signing）有持续费用，已在规划中但尚未落地。在此之前，上面的步骤就是安全、免费的运行方式。
最快验证核心价值的方式：扫描一个路径，输出风险分级与 Markdown 报告。全程只读，不删除任何文件。
# 扫描用户缓存目录，打印分级统计与 Top10
dotnet run --project src/CleanScope.App.Console -- scan "%LocalAppData%"
# 扫描并导出 Markdown 报告
dotnet run --project src/CleanScope.App.Console -- scan "C:\SomeFolder" --report report.md --top 200
# 启用 AI 解释（脱敏后出云，需先配置密钥，见下文）
dotnet run --project src/CleanScope.App.Console -- scan "%LocalAppData%" --ai --report report.md参数：
| 参数 | 说明 |
|---|---|
scan <path> |
要扫描的根路径（必填） |
--report <file> |
导出 Markdown 报告到指定文件 |
--top <N> |
保留占用最大的前 N 项（默认 100） |
--admin |
管理员模式，扩大扫描覆盖（建议以管理员身份运行终端） |
--sanitize |
报告中对路径里的用户名脱敏（便于分享/外发） |
--ai |
启用 AI 解释（需可用密钥；未配置则自动跳过，纯本地规则/风险） |
--rules <dir> |
指定规则包目录（默认用输出目录旁或仓库根的 rules/） |
退出码：0 成功 / 2 用法错误 / 3 规则加载失败 / 4 路径错误 / 1 其它错误。
dotnet run --project src/CleanScope.App.Wpf主要页面：
- 概览 / 扫描 —— 盘符优先入口（选磁盘，完整扫描或仅扫高价值区 AppData）；完成后展示根聚合占用、可清理估算、高风险数、最大的可清理项与一键官方手段（关闭休眠 / 清空回收站 / 磁盘清理 / DISM）。
- 资源管理器 / 可清理清单（整盘目录树） —— 像目录树一样浏览整个磁盘，或切到 「只看可清理」 得到一张扁平、可勾选的批量工作清单（全选、排序、批量移入回收站）。逐节点标来源/用途/风险；右键或选中项详情面板可复制路径、打开位置、用 AI 识别、加入忽略名单、迁移到其他盘、移入回收站。别处删除会在此实时同步。
- 空间地图 —— treemap 矩形树图，面积=占用、颜色=风险，可下钻定位“空间去哪了”。
- 按软件 —— 按归属软件聚合“谁占了我的空间 + 各能清多少”，可展开看名下文件。
- 文件详情 —— 属性、风险评估、证据链（事实证据 vs AI 推测，视觉区分）、归因候选、按需 AI 解释（点击才请求）； 可清理项 (A/B) 提供「🗑 移入回收站（可还原）」——两步确认 + 闸门复核 + 先写审计，仅进回收站、可还原； 高风险（D/E）/ 容器 / 系统关键无删除入口，仅提示原因。
- 报告 / 忽略名单 —— 导出 Markdown 报告；管理全局忽略名单（增删，仅本地存储）。
- AI 设置 —— 在应用内配置 AI：填 Base URL + 密钥，检索模型（
/models），选择、测试、保存——即时生效、无需重启。密钥经 DPAPI 加密存于用户目录，绝不入库。
桌面端会在 %LocalAppData%\CleanScope\cleanscope.db 建一个本地 SQLite 库，存放审计日志与忽略名单
（仅本地，绝不上云）。
| 级别 | 含义 |
|---|---|
| A | 可安全清理（如用户临时文件、缩略图缓存） |
| B | 建议用官方方式清理（如浏览器缓存，走应用自带清理） |
| C | 需确认后处理（默认落点；个人数据、信息不足时） |
| D | 不建议删除（命中系统关键黑名单，强制 ≥D） |
| E | 无法判断，不建议删除（fail-safe 最坏情况兜底） |
规则引擎与风险引擎是权威：AI 永远不能调低风险等级（校验器以 max(AI, 引擎) 取更高者）。
CleanScope 不配置 AI 也能完整运行（纯本地规则 + 风险解释）。若要启用云端 AI 解释：
-
在桌面应用里（推荐） —— 打开 「AI 设置」，填入 Base URL + API 密钥，点 「检索模型」（
GET {baseUrl}/models），选择模型，测试连接，再 保存。即时生效、无需重启。密钥经 DPAPI（按当前用户）加密存于%LocalAppData%\CleanScope，绝不明文、绝不入库。 -
或用配置文件 / 环境变量（供 CLI 或无界面场景）：
cp appsettings.ai.example.json appsettings.ai.local.json # 再填 baseUrl / apiKey / model / "cloudEnabled": trueCLEANSCOPE_AI_BASEURL CLEANSCOPE_AI_KEY CLEANSCOPE_AI_MODEL CLEANSCOPE_AI_CLOUD=1
🔒 密钥永不以明文离开本机：桌面应用用 DPAPI 加密保存；
appsettings.ai.local.json已被.gitignore排除。只有不含密钥的appsettings.ai.example.json模板被提交。
按需触发（默认零 token 开销）：即便配置了 AI，扫描与浏览也不产生任何云端调用。AI 仅在你明确点击时触发—— 文件详情的「✨ 用 AI 解释」、概览的「🧭 生成 AI 清理建议」、资源管理器右键「用 AI 识别」。其余由确定性的 规则 / 风险 / 目录名启发免费覆盖，不想花 token 的用户零开销（不配置 AI 则全程本地）。
隐私边界：AI 只在脱敏后出云（用户名 → %USER%、文件名 → %FILE%），永不上传文件内容；
关闭云端时全程本地、不发起任何远程调用。脱敏网关是唯一出云通道。
分类知识以声明式数据形式存放在 rules/（12 个包、60 条规则），而非硬编码。
可直接增改 JSON 扩展识别能力，无需改代码。系统关键目录在 00-system-critical.json 中强制为不可删的黑名单。
dotnet test CleanScope.sln- 412 个测试，含 安全红线测试（仅 A/B 可清理项可删且只进回收站、C-E/容器/黑名单/占用/symlink 必拒、手动高风险覆盖仍不能碰黑名单/容器/占用 / 无永久删除 API（回收站删除集中单一文件并正向断言）/ AI 不放低风险、不触发删除 / 脱敏出云 / 审计先写后执行 …）。
- 架构依赖测试（NetArchTest）守护分层：Core/Domain 不依赖 WPF、AI 不引用 Safety、SQLite 仅在 Infrastructure。
- 这些测试是 CI 硬门禁（.github/workflows/ci.yml，windows-latest）：任一失败即阻断合并/发布。
src/
CleanScope.Domain 领域实体/枚举/接口契约（零依赖，最内层）
CleanScope.Core 裁决链：扫描/证据/规则/归因/风险/决策
CleanScope.Safety 安全闸门（唯一可改盘路径）+ 执行器（删除仅移入回收站，无永久删除代码）
CleanScope.Ai AI 旁路：脱敏 → 解释 → 校验（仅建议）
CleanScope.Infrastructure Win32 访问、SQLite 存储、规则加载（net8.0-windows）
CleanScope.Reporting Markdown 报告导出
CleanScope.Application 用例编排（经抽象串起裁决链）
CleanScope.App.Console CLI 宿主 + 组合根
CleanScope.App.Wpf WPF 桌面端（MVVM）+ 组合根
tests/ xUnit 测试（含安全红线与架构守护）
rules/ 声明式规则包（*.json）
架构：Clean Architecture + “AI 旁路 + 单一安全闸门”。AI 只给建议，唯一能改盘的是 Safety 闸门。
- 代码库中不存在永久删除 API：唯一的删除是“移入回收站（可还原）”，集中在单一文件，静态测试正向断言其只用回收站接口。
- 唯一可改盘路径是安全闸门：仅放行“可清理”桶 (A/B) 且非系统关键/非容器/未被占用的项；C-E/容器/黑名单/占用一律拒。
- 删除需用户显式点击 + 两步确认，执行前先写审计（先日志后执行）。
- AI 不能绕过规则引擎、不能调低风险、不触发删除；无法判断时输出“无法判断，不建议删除”。
- 不上传文件内容；脱敏后才出云；关闭云端则全程本地。
- 所有操作先写审计后执行；审计写失败即中止。
CleanScope 是免费开源软件，按“现状”提供，不附带任何明示或默示的担保。使用本软件即表示你同意：
- 你对自己的数据负责。 尽管 CleanScope 在设计上力求安全（只移入回收站、绝不永久删除、系统关键黑名单保护），磁盘清理本身存在固有风险。删除任何重要内容前，请务必先做好备份。
- 归属、风险分级、空间估算与 AI 解释都是“尽力而为”，不是保证。 它们可能出错或不完整。是否删除、迁移、或执行任何官方清理命令，最终决定权始终在你。
- “官方清理”手段启动的是 Windows 自带工具（powercfg / DISM / cleanmgr / 存储感知 等）。其效果与是否可逆由 Windows 决定，与 CleanScope 无关；执行前请阅读每条说明并确认。
- 在法律允许的最大范围内，作者与贡献者对因使用本软件导致的任何数据丢失、系统问题或其他损失不承担责任。 完整条款见 LICENSE。
- 可选的 AI 功能只会把脱敏后的元数据（绝不含文件内容）发送到你自己配置的第三方接口；该接口的隐私与条款由你自行负责。关闭 AI 则全程本地。
如果你不同意以上条款，请勿使用本软件。