SWEEPLING

A Claude Code session starts dev servers, file watchers and little scripts, and when it ends many of them keep running, holding ports and memory and blocking the next npm run dev. Windows doesn’t clean them up, and Task Manager lists them as bare node.exe, tail.exe and grep.exe rows. The first scan of one machine found next dev holding port 3001 for 35 hours with nothing connected, and 20 watchers Claude Code had started. Sweepling sits in the tray, counts the leftovers of sessions that have ended and notifies when the count rises. Its review window says what each one is in words, with its project folder, age, port and memory, and closes a whole group with one click; strays of a session that is still running get their own section and are never ticked.

Every 5 seconds it takes a Toolhelp32 snapshot and keeps a family tree for each Claude Code session. Windows doesn’t reparent orphans, so a parent counts as gone when its PID no longer exists or now belongs to a process that started after the child. A stray is tied to its session three ways, strongest first: the family tree Sweepling watched form, the CLAUDE_PID Claude Code puts in the environment of everything it starts, then command-line rules. It is offered only when its parent has been gone for a 60-second grace period, nothing in its group has an established TCP connection or is a windowed app, and it isn’t protected, and a session Sweepling can’t prove has ended counts as running. Right before closing, it re-checks the group’s connections and each process’s start time, because Windows reuses process IDs. Agent roots, rules, the protect list and grace periods live in a rules file, so new agent behaviour needs a rules change rather than a release.

It is .NET 10 and Avalonia 12 compiled with NativeAOT, with Win32 calls through CsWin32 and its own Shell_NotifyIcon tray icon, and it renders in software, which took tray-only idle from 73.9 MB to 13.7 MB of private bytes. A signed per-user Velopack installer starts it at login and keeps it up to date; it sees only your own processes and never asks for administrator rights. There is no telemetry: the update check is its only network call, and the local log of what it closed masks command lines. Synthetic process tables test every rule, each proven by breaking it, and integration tests close a fake orphaned dev server until its port frees and refuse to close a reused PID.