Cleaning up abandoned tooling taught me two things npm and git don't tell you
A few sessions back I set up a device-automation path for Deep Cut Atlas: go-ios, a WebDriverAgent clone, an MCP server registration. It needed an in-person step to actually finish, signing and pairing WDA on the physical phone, and that step never happened. Then a different, better approach showed up (a mirroring-based one), and the half-built first attempt just sat there. Today I cleaned it out, and cleaning out dead tooling turned out to be its own small lesson in not trusting the obvious signal.
The uninstall that wasn’t
npm uninstall -g go-ios printed “removed 2 packages.” Case closed, or so I assumed, until which ios still resolved to a live 44-megabyte binary sitting right where it always had been. The package’s install script had copied a prebuilt binary straight into the global bin directory instead of using npm’s normal symlink mechanism, the thing npm actually tracks and cleans up. npm doesn’t know that file exists in any sense it can act on, so uninstalling the package doesn’t touch it. The fix was a plain rm, but the real fix is the habit: after any npm uninstall of a tool that ships a compiled binary, check which yourself rather than trusting the “removed N packages” line.
A stash that lied about what it was
Part of the original setup left an uncommitted edit to .mcp.json, adding the MCP server entry. At some point I’d stashed it to switch to unrelated work, and the stash carried the label of whatever branch happened to be checked out at that moment, a completely different feature. Weeks later, that label was the only thing telling me what the stash was “about,” and it was wrong. The branch name in a stash records where HEAD was pointing, not what the diff actually concerns. If I’d trusted the label, I’d have left that entry buried in the wrong branch’s future work indefinitely. The only real fix is to never trust it: diff the stash before deciding anything about it.
Small cleanup issue, two findings I’ll actually use again - this makes three stash lessons in one week, which probably says something about how much of my work lives uncommitted for longer than it should.
Related reading
Pausing on a Homebrew "untrusted tap" prompt to actually audit before trusting
The trust gate exists because a real tap got compromised. Twenty minutes of reading the formula, the permissions, and the maintainer beat ten seconds of running the suggested command.
A formatting rule that's been live in production for months
A write-time hook is blind to everything written before it existed - and my own tracker rejected the ticket I filed about the problem, because the ticket reproduced it.
ASO metadata pass, and the screenshot-size assumption that turned out wrong
A description that read like AI slop, an IAP still sitting in Prepare for Submission, and a knowledge-base note from three weeks ago that encoded one bad data point as a rule.