Agent Residue Check — Are Session Files Committed to Your Repo?
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.
What the issue is
Agent session state, scratch directories, and backup files committed to the repository do not belong to the app. They bloat every clone, hint that the repo is being used as a working surface, and a revived stale copy is a fresh source of drift.
Why AI tools generate it
An agent keeps its working files exactly where the project lives — a session directory, a scratch copy before a risky edit, a `.bak` of the file being rewritten — and those end up in the same commit as the app code.
How DevMeth detects it
The scan walks the committed file tree and flags agent state directories (`.claude/`, `.cursor/`, `.windsurf/`, `.codeium/`, `.copilot/`), scratch/backup directories (`old/`, `backups/`, `scratch/`), and backup or copy file patterns (`.bak`, `.orig`, `.rej`, `~`, `-backup1.`, `name (2).tsx`).
Agent session files and scratch directories are committed to your repository
WHAT WE FOUND
.claude/settings.local.json — agent session state committed to the repo
The fix, in three steps
Delete the residue, add the patterns to your ignore rules, and untrack anything already committed with `git rm --cached`. The ignore file alone does not stop a tracked file from coming back.
Run a free scan and each finding carries a paste-ready fix prompt you can act on.
Maintainability findings ship in the Rescue Report — bundled with the Launch Pack or available on its own.
Try a free scanFAQ
Is a single `.bak` file really worth a finding?
Yes — not for its size, but for what it proves: no cleanup step runs before commits, which is exactly how session files multiply into a repo that ships its own working debris.
Which patterns count as residue?
Agent state directories (`.claude/`, `.cursor/`, `.windsurf/`, `.codeium/`, `.copilot/`), scratch/backup directories (`old/`, `backups/`, `scratch/`, `junk/`, `trash/`), and backup-style files (`.bak`, `.orig`, `.rej`, trailing `~`, `-backup1.`, `-copy2.`, `name (2).tsx`).
How do I stop this from coming back?
Add the patterns to your ignore rules AND untrack anything already committed with `git rm --cached`. The second step is what actually removes tracked residue — the ignore file alone is not enough.
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.