fix: bound blob cache during restore with LRU eviction to prevent OOM

The restore operation cached every downloaded blob in an unbounded map, which could exhaust system memory when restoring large backups with many unique blobs (each up to 10GB). Replaced with an LRU cache bounded to 1 GiB by default, evicting least-recently-used blobs when the limit is exceeded.
2026-02-08 12:04:50 -08:00
17 changed files with 272 additions and 914 deletions
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,8 +0,0 @@
-.git
-.gitea
-*.md
-LICENSE
-vaultik
-coverage.out
-coverage.html
-.DS_Store
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -1,14 +0,0 @@
-name: check
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      # actions/checkout v4, 2024-09-16
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - name: Build and check
-        run: docker build .
--- a/61
+++ b/61
@@ -1,61 +0,0 @@
-# Lint stage
-# golangci/golangci-lint:v2.11.3-alpine, 2026-03-17
-FROM golangci/golangci-lint:v2.11.3-alpine@sha256:b1c3de5862ad0a95b4e45a993b0f00415835d687e4f12c845c7493b86c13414e AS lint
-
-RUN apk add --no-cache make build-base
-
-WORKDIR /src
-
-# Copy go mod files first for better layer caching
-COPY go.mod go.sum ./
-RUN go mod download
-
-# Copy source code
-COPY . .
-
-# Run formatting check and linter
-RUN make fmt-check
-RUN make lint
-
-# Build stage
-# golang:1.26.1-alpine, 2026-03-17
-FROM golang:1.26.1-alpine@sha256:2389ebfa5b7f43eeafbd6be0c3700cc46690ef842ad962f6c5bd6be49ed82039 AS builder
-
-# Depend on lint stage passing
-COPY --from=lint /src/go.sum /dev/null
-
-ARG VERSION=dev
-
-# Install build dependencies for CGO (mattn/go-sqlite3) and sqlite3 CLI (tests)
-RUN apk add --no-cache make build-base sqlite
-
-WORKDIR /src
-
-# Copy go mod files first for better layer caching
-COPY go.mod go.sum ./
-RUN go mod download
-
-# Copy source code
-COPY . .
-
-# Run tests
-RUN make test
-
-# Build with CGO enabled (required for mattn/go-sqlite3)
-RUN CGO_ENABLED=1 go build -ldflags "-X 'git.eeqj.de/sneak/vaultik/internal/globals.Version=${VERSION}' -X 'git.eeqj.de/sneak/vaultik/internal/globals.Commit=$(git rev-parse HEAD 2>/dev/null || echo unknown)'" -o /vaultik ./cmd/vaultik
-
-# Runtime stage
-# alpine:3.21, 2026-02-25
-FROM alpine:3.21@sha256:c3f8e73fdb79deaebaa2037150150191b9dcbfba68b4a46d70103204c53f4709
-
-RUN apk add --no-cache ca-certificates sqlite
-
-# Copy binary from builder
-COPY --from=builder /vaultik /usr/local/bin/vaultik
-
-# Create non-root user
-RUN adduser -D -H -s /sbin/nologin vaultik
-
-USER vaultik
-
-ENTRYPOINT ["/usr/local/bin/vaultik"]
--- a/40
+++ b/40
@@ -1,4 +1,4 @@
-.PHONY: test fmt lint fmt-check check build clean all docker hooks
+.PHONY: test fmt lint build clean all

 # Version number
 VERSION := 0.0.1
@@ -14,12 +14,21 @@ LDFLAGS := -X 'git.eeqj.de/sneak/vaultik/internal/globals.Version=$(VERSION)' \
 all: vaultik

 # Run tests
-test:
-	go test -race -timeout 30s ./...
+test: lint fmt-check
+	@echo "Running tests..."
+	@if ! go test -v -timeout 10s ./... 2>&1; then \
+		echo ""; \
+		echo "TEST FAILURES DETECTED"; \
+		echo "Run 'go test -v ./internal/database' to see database test details"; \
+		exit 1; \
+	fi

-# Check if code is formatted (read-only)
+# Check if code is formatted
 fmt-check:
-	@test -z "$$(gofmt -l .)" || (echo "Files not formatted:" && gofmt -l . && exit 1)
+	@if [ -n "$$(go fmt ./...)" ]; then \
+		echo "Error: Code is not formatted. Run 'make fmt' to fix."; \
+		exit 1; \
+	fi

 # Format code
 fmt:
@@ -27,7 +36,7 @@ fmt:

 # Run linter
 lint:
-	golangci-lint run ./...
+	golangci-lint run

 # Build binary
 vaultik: internal/*/*.go cmd/vaultik/*.go
@@ -38,6 +47,11 @@ clean:
 	rm -f vaultik
 	go clean

+# Install dependencies
+deps:
+	go mod download
+	go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
+
 # Run tests with coverage
 test-coverage:
 	go test -v -coverprofile=coverage.out ./...
@@ -53,17 +67,3 @@ local:

 install: vaultik
 	cp ./vaultik $(HOME)/bin/
-
-# Run all checks (formatting, linting, tests) without modifying files
-check: fmt-check lint test
-
-# Build Docker image
-docker:
-	docker build -t vaultik .
-
-# Install pre-commit hook
-hooks:
-	@printf '#!/bin/sh\nset -e\n' > .git/hooks/pre-commit
-	@printf 'go mod tidy\ngo fmt ./...\ngit diff --exit-code -- go.mod go.sum || { echo "go mod tidy changed files; please stage and retry"; exit 1; }\n' >> .git/hooks/pre-commit
-	@printf 'make check\n' >> .git/hooks/pre-commit
-	@chmod +x .git/hooks/pre-commit
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module git.eeqj.de/sneak/vaultik

-go 1.26.1
+go 1.24.4

 require (
 	filippo.io/age v1.2.1
--- a/internal/blobgen/compress.go
+++ b/internal/blobgen/compress.go
@@ -51,13 +51,7 @@ func CompressStream(dst io.Writer, src io.Reader, compressionLevel int, recipien
 	if err != nil {
 		return 0, "", fmt.Errorf("creating writer: %w", err)
 	}
-
-	closed := false
-	defer func() {
-		if !closed {
-			_ = w.Close()
-		}
-	}()
+	defer func() { _ = w.Close() }()

 	// Copy data
 	if _, err := io.Copy(w, src); err != nil {
@@ -68,7 +62,6 @@ func CompressStream(dst io.Writer, src io.Reader, compressionLevel int, recipien
 	if err := w.Close(); err != nil {
 		return 0, "", fmt.Errorf("closing writer: %w", err)
 	}
-	closed = true

 	return w.BytesWritten(), hex.EncodeToString(w.Sum256()), nil
 }
--- a/internal/blobgen/compress_test.go
+++ b/internal/blobgen/compress_test.go
@@ -1,64 +0,0 @@
-package blobgen
-
-import (
-	"bytes"
-	"crypto/rand"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// testRecipient is a static age recipient for tests.
-const testRecipient = "age1cplgrwj77ta54dnmydvvmzn64ltk83ankxl5sww04mrtmu62kv3s89gmvv"
-
-// TestCompressStreamNoDoubleClose is a regression test for issue #28.
-// It verifies that CompressStream does not panic or return an error due to
-// double-closing the underlying blobgen.Writer. Before the fix in PR #33,
-// the explicit Close() on the happy path combined with defer Close() would
-// cause a double close.
-func TestCompressStreamNoDoubleClose(t *testing.T) {
-	input := []byte("regression test data for issue #28 double-close fix")
-	var buf bytes.Buffer
-
-	written, hash, err := CompressStream(&buf, bytes.NewReader(input), 3, []string{testRecipient})
-	require.NoError(t, err, "CompressStream should not return an error")
-	assert.True(t, written > 0, "expected bytes written > 0")
-	assert.NotEmpty(t, hash, "expected non-empty hash")
-	assert.True(t, buf.Len() > 0, "expected non-empty output")
-}
-
-// TestCompressStreamLargeInput exercises CompressStream with a larger payload
-// to ensure no double-close issues surface under heavier I/O.
-func TestCompressStreamLargeInput(t *testing.T) {
-	data := make([]byte, 512*1024) // 512 KB
-	_, err := rand.Read(data)
-	require.NoError(t, err)
-
-	var buf bytes.Buffer
-	written, hash, err := CompressStream(&buf, bytes.NewReader(data), 3, []string{testRecipient})
-	require.NoError(t, err)
-	assert.True(t, written > 0)
-	assert.NotEmpty(t, hash)
-}
-
-// TestCompressStreamEmptyInput verifies CompressStream handles empty input
-// without double-close issues.
-func TestCompressStreamEmptyInput(t *testing.T) {
-	var buf bytes.Buffer
-	_, hash, err := CompressStream(&buf, strings.NewReader(""), 3, []string{testRecipient})
-	require.NoError(t, err)
-	assert.NotEmpty(t, hash)
-}
-
-// TestCompressDataNoDoubleClose mirrors the stream test for CompressData,
-// ensuring the explicit Close + error-path Close pattern is also safe.
-func TestCompressDataNoDoubleClose(t *testing.T) {
-	input := []byte("CompressData regression test for double-close")
-	result, err := CompressData(input, 3, []string{testRecipient})
-	require.NoError(t, err)
-	assert.True(t, result.CompressedSize > 0)
-	assert.True(t, result.UncompressedSize == int64(len(input)))
-	assert.NotEmpty(t, result.SHA256)
-}
--- a/internal/vaultik/blob_fetch_stub.go
+++ b/internal/vaultik/blob_fetch_stub.go
@@ -1,55 +0,0 @@
-package vaultik
-
-import (
-	"context"
-	"fmt"
-	"io"
-
-	"filippo.io/age"
-	"git.eeqj.de/sneak/vaultik/internal/blobgen"
-)
-
-// FetchAndDecryptBlobResult holds the result of fetching and decrypting a blob.
-type FetchAndDecryptBlobResult struct {
-	Data []byte
-}
-
-// FetchAndDecryptBlob downloads a blob, decrypts it, and returns the plaintext data.
-func (v *Vaultik) FetchAndDecryptBlob(ctx context.Context, blobHash string, expectedSize int64, identity age.Identity) (*FetchAndDecryptBlobResult, error) {
-	rc, _, err := v.FetchBlob(ctx, blobHash, expectedSize)
-	if err != nil {
-		return nil, err
-	}
-	defer func() { _ = rc.Close() }()
-
-	reader, err := blobgen.NewReader(rc, identity)
-	if err != nil {
-		return nil, fmt.Errorf("creating blob reader: %w", err)
-	}
-	defer func() { _ = reader.Close() }()
-
-	data, err := io.ReadAll(reader)
-	if err != nil {
-		return nil, fmt.Errorf("reading blob data: %w", err)
-	}
-
-	return &FetchAndDecryptBlobResult{Data: data}, nil
-}
-
-// FetchBlob downloads a blob and returns a reader for the encrypted data.
-func (v *Vaultik) FetchBlob(ctx context.Context, blobHash string, expectedSize int64) (io.ReadCloser, int64, error) {
-	blobPath := fmt.Sprintf("blobs/%s/%s/%s", blobHash[:2], blobHash[2:4], blobHash)
-
-	rc, err := v.Storage.Get(ctx, blobPath)
-	if err != nil {
-		return nil, 0, fmt.Errorf("downloading blob %s: %w", blobHash[:16], err)
-	}
-
-	info, err := v.Storage.Stat(ctx, blobPath)
-	if err != nil {
-		_ = rc.Close()
-		return nil, 0, fmt.Errorf("stat blob %s: %w", blobHash[:16], err)
-	}
-
-	return rc, info.Size, nil
-}
--- a/internal/vaultik/blobcache.go
+++ b/internal/vaultik/blobcache.go
@@ -1,207 +1,83 @@
 package vaultik

 import (
-	"fmt"
-	"os"
-	"path/filepath"
+	"container/list"
 	"sync"
 )

-// blobDiskCacheEntry tracks a cached blob on disk.
-type blobDiskCacheEntry struct {
+// defaultMaxBlobCacheBytes is the default maximum size of the blob cache (1 GB).
+const defaultMaxBlobCacheBytes = 1 << 30 // 1 GiB
+
+// blobCacheEntry is an entry in the LRU blob cache.
+type blobCacheEntry struct {
 	key  string
-	size int64
-	prev *blobDiskCacheEntry
-	next *blobDiskCacheEntry
+	data []byte
 }

-// blobDiskCache is an LRU cache that stores blobs on disk instead of in memory.
-// Blobs are written to a temp directory keyed by their hash. When total size
-// exceeds maxBytes, the least-recently-used entries are evicted (deleted from disk).
-type blobDiskCache struct {
+// blobLRUCache is a simple LRU cache for downloaded blob data, bounded by
+// total byte size to prevent memory exhaustion during large restores.
+type blobLRUCache struct {
 	mu       sync.Mutex
-	dir      string
 	maxBytes int64
 	curBytes int64
-	items    map[string]*blobDiskCacheEntry
-	head     *blobDiskCacheEntry // most recent
-	tail     *blobDiskCacheEntry // least recent
+	ll       *list.List
+	items    map[string]*list.Element
 }

-// newBlobDiskCache creates a new disk-based blob cache with the given max size.
-func newBlobDiskCache(maxBytes int64) (*blobDiskCache, error) {
-	dir, err := os.MkdirTemp("", "vaultik-blobcache-*")
-	if err != nil {
-		return nil, fmt.Errorf("creating blob cache dir: %w", err)
-	}
-	return &blobDiskCache{
-		dir:      dir,
+// newBlobLRUCache creates a new LRU blob cache with the given maximum size in bytes.
+func newBlobLRUCache(maxBytes int64) *blobLRUCache {
+	return &blobLRUCache{
 		maxBytes: maxBytes,
-		items:    make(map[string]*blobDiskCacheEntry),
-	}, nil
-}
-
-func (c *blobDiskCache) path(key string) string {
-	return filepath.Join(c.dir, key)
-}
-
-func (c *blobDiskCache) unlink(e *blobDiskCacheEntry) {
-	if e.prev != nil {
-		e.prev.next = e.next
-	} else {
-		c.head = e.next
-	}
-	if e.next != nil {
-		e.next.prev = e.prev
-	} else {
-		c.tail = e.prev
-	}
-	e.prev = nil
-	e.next = nil
-}
-
-func (c *blobDiskCache) pushFront(e *blobDiskCacheEntry) {
-	e.prev = nil
-	e.next = c.head
-	if c.head != nil {
-		c.head.prev = e
-	}
-	c.head = e
-	if c.tail == nil {
-		c.tail = e
+		ll:       list.New(),
+		items:    make(map[string]*list.Element),
 	}
 }

-func (c *blobDiskCache) evictLRU() {
-	if c.tail == nil {
-		return
+// Get returns the blob data for the given key, or nil if not cached.
+func (c *blobLRUCache) Get(key string) ([]byte, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if ele, ok := c.items[key]; ok {
+		c.ll.MoveToFront(ele)
+		return ele.Value.(*blobCacheEntry).data, true
 	}
-	victim := c.tail
-	c.unlink(victim)
-	delete(c.items, victim.key)
-	c.curBytes -= victim.size
-	_ = os.Remove(c.path(victim.key))
+	return nil, false
 }

-// Put writes blob data to disk cache. Entries larger than maxBytes are silently skipped.
-func (c *blobDiskCache) Put(key string, data []byte) error {
+// Put adds a blob to the cache, evicting least-recently-used entries if needed.
+func (c *blobLRUCache) Put(key string, data []byte) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
 	entrySize := int64(len(data))

-	c.mu.Lock()
-	defer c.mu.Unlock()
-
+	// If this single entry exceeds max, don't cache it
 	if entrySize > c.maxBytes {
-		return nil
+		return
 	}

-	// Remove old entry if updating
-	if e, ok := c.items[key]; ok {
-		c.unlink(e)
-		c.curBytes -= e.size
-		_ = os.Remove(c.path(key))
-		delete(c.items, key)
+	// If already present, update in place
+	if ele, ok := c.items[key]; ok {
+		c.ll.MoveToFront(ele)
+		old := ele.Value.(*blobCacheEntry)
+		c.curBytes += entrySize - int64(len(old.data))
+		old.data = data
+	} else {
+		ele := c.ll.PushFront(&blobCacheEntry{key: key, data: data})
+		c.items[key] = ele
+		c.curBytes += entrySize
 	}

-	if err := os.WriteFile(c.path(key), data, 0600); err != nil {
-		return fmt.Errorf("writing blob to cache: %w", err)
-	}
-
-	e := &blobDiskCacheEntry{key: key, size: entrySize}
-	c.pushFront(e)
-	c.items[key] = e
-	c.curBytes += entrySize
-
-	for c.curBytes > c.maxBytes && c.tail != nil {
-		c.evictLRU()
-	}
-
-	return nil
-}
-
-// Get reads a cached blob from disk. Returns data and true on hit.
-func (c *blobDiskCache) Get(key string) ([]byte, bool) {
-	c.mu.Lock()
-	e, ok := c.items[key]
-	if !ok {
-		c.mu.Unlock()
-		return nil, false
-	}
-	c.unlink(e)
-	c.pushFront(e)
-	c.mu.Unlock()
-
-	data, err := os.ReadFile(c.path(key))
-	if err != nil {
-		c.mu.Lock()
-		if e2, ok2 := c.items[key]; ok2 && e2 == e {
-			c.unlink(e)
-			delete(c.items, key)
-			c.curBytes -= e.size
+	// Evict from back until under limit
+	for c.curBytes > c.maxBytes && c.ll.Len() > 0 {
+		oldest := c.ll.Back()
+		if oldest == nil {
+			break
 		}
-		c.mu.Unlock()
-		return nil, false
+		entry := oldest.Value.(*blobCacheEntry)
+		c.ll.Remove(oldest)
+		delete(c.items, entry.key)
+		c.curBytes -= int64(len(entry.data))
 	}
-	return data, true
-}
-
-// ReadAt reads a slice of a cached blob without loading the entire blob into memory.
-func (c *blobDiskCache) ReadAt(key string, offset, length int64) ([]byte, error) {
-	c.mu.Lock()
-	e, ok := c.items[key]
-	if !ok {
-		c.mu.Unlock()
-		return nil, fmt.Errorf("key %q not in cache", key)
-	}
-	if offset+length > e.size {
-		c.mu.Unlock()
-		return nil, fmt.Errorf("read beyond blob size: offset=%d length=%d size=%d", offset, length, e.size)
-	}
-	c.unlink(e)
-	c.pushFront(e)
-	c.mu.Unlock()
-
-	f, err := os.Open(c.path(key))
-	if err != nil {
-		return nil, err
-	}
-	defer func() { _ = f.Close() }()
-
-	buf := make([]byte, length)
-	if _, err := f.ReadAt(buf, offset); err != nil {
-		return nil, err
-	}
-	return buf, nil
-}
-
-// Has returns whether a key exists in the cache.
-func (c *blobDiskCache) Has(key string) bool {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	_, ok := c.items[key]
-	return ok
-}
-
-// Size returns current total cached bytes.
-func (c *blobDiskCache) Size() int64 {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return c.curBytes
-}
-
-// Len returns number of cached entries.
-func (c *blobDiskCache) Len() int {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	return len(c.items)
-}
-
-// Close removes the cache directory and all cached blobs.
-func (c *blobDiskCache) Close() error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	c.items = nil
-	c.head = nil
-	c.tail = nil
-	c.curBytes = 0
-	return os.RemoveAll(c.dir)
 }
--- a/internal/vaultik/blobcache_test.go
+++ b/internal/vaultik/blobcache_test.go
@@ -1,189 +0,0 @@
-package vaultik
-
-import (
-	"bytes"
-	"crypto/rand"
-	"fmt"
-	"testing"
-)
-
-func TestBlobDiskCache_BasicGetPut(t *testing.T) {
-	cache, err := newBlobDiskCache(1 << 20)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = cache.Close() }()
-
-	data := []byte("hello world")
-	if err := cache.Put("key1", data); err != nil {
-		t.Fatal(err)
-	}
-
-	got, ok := cache.Get("key1")
-	if !ok {
-		t.Fatal("expected cache hit")
-	}
-	if !bytes.Equal(got, data) {
-		t.Fatalf("got %q, want %q", got, data)
-	}
-
-	_, ok = cache.Get("nonexistent")
-	if ok {
-		t.Fatal("expected cache miss")
-	}
-}
-
-func TestBlobDiskCache_EvictionUnderPressure(t *testing.T) {
-	maxBytes := int64(1000)
-	cache, err := newBlobDiskCache(maxBytes)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = cache.Close() }()
-
-	for i := 0; i < 5; i++ {
-		data := make([]byte, 300)
-		if err := cache.Put(fmt.Sprintf("key%d", i), data); err != nil {
-			t.Fatal(err)
-		}
-	}
-
-	if cache.Size() > maxBytes {
-		t.Fatalf("cache size %d exceeds max %d", cache.Size(), maxBytes)
-	}
-
-	if !cache.Has("key4") {
-		t.Fatal("expected key4 to be cached")
-	}
-	if cache.Has("key0") {
-		t.Fatal("expected key0 to be evicted")
-	}
-}
-
-func TestBlobDiskCache_OversizedEntryRejected(t *testing.T) {
-	cache, err := newBlobDiskCache(100)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = cache.Close() }()
-
-	data := make([]byte, 200)
-	if err := cache.Put("big", data); err != nil {
-		t.Fatal(err)
-	}
-
-	if cache.Has("big") {
-		t.Fatal("oversized entry should not be cached")
-	}
-}
-
-func TestBlobDiskCache_UpdateInPlace(t *testing.T) {
-	cache, err := newBlobDiskCache(1 << 20)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = cache.Close() }()
-
-	if err := cache.Put("key1", []byte("v1")); err != nil {
-		t.Fatal(err)
-	}
-	if err := cache.Put("key1", []byte("version2")); err != nil {
-		t.Fatal(err)
-	}
-
-	got, ok := cache.Get("key1")
-	if !ok {
-		t.Fatal("expected hit")
-	}
-	if string(got) != "version2" {
-		t.Fatalf("got %q, want %q", got, "version2")
-	}
-	if cache.Len() != 1 {
-		t.Fatalf("expected 1 entry, got %d", cache.Len())
-	}
-	if cache.Size() != int64(len("version2")) {
-		t.Fatalf("expected size %d, got %d", len("version2"), cache.Size())
-	}
-}
-
-func TestBlobDiskCache_ReadAt(t *testing.T) {
-	cache, err := newBlobDiskCache(1 << 20)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = cache.Close() }()
-
-	data := make([]byte, 1024)
-	if _, err := rand.Read(data); err != nil {
-		t.Fatal(err)
-	}
-	if err := cache.Put("blob1", data); err != nil {
-		t.Fatal(err)
-	}
-
-	chunk, err := cache.ReadAt("blob1", 100, 200)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !bytes.Equal(chunk, data[100:300]) {
-		t.Fatal("ReadAt returned wrong data")
-	}
-
-	_, err = cache.ReadAt("blob1", 900, 200)
-	if err == nil {
-		t.Fatal("expected error for out-of-bounds read")
-	}
-
-	_, err = cache.ReadAt("missing", 0, 10)
-	if err == nil {
-		t.Fatal("expected error for missing key")
-	}
-}
-
-func TestBlobDiskCache_Close(t *testing.T) {
-	cache, err := newBlobDiskCache(1 << 20)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if err := cache.Put("key1", []byte("data")); err != nil {
-		t.Fatal(err)
-	}
-	if err := cache.Close(); err != nil {
-		t.Fatal(err)
-	}
-}
-
-func TestBlobDiskCache_LRUOrder(t *testing.T) {
-	cache, err := newBlobDiskCache(200)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = cache.Close() }()
-
-	d := make([]byte, 100)
-	if err := cache.Put("a", d); err != nil {
-		t.Fatal(err)
-	}
-	if err := cache.Put("b", d); err != nil {
-		t.Fatal(err)
-	}
-
-	// Access "a" to make it most recently used
-	cache.Get("a")
-
-	// Adding "c" should evict "b" (LRU), not "a"
-	if err := cache.Put("c", d); err != nil {
-		t.Fatal(err)
-	}
-
-	if !cache.Has("a") {
-		t.Fatal("expected 'a' to survive")
-	}
-	if !cache.Has("c") {
-		t.Fatal("expected 'c' to be present")
-	}
-	if cache.Has("b") {
-		t.Fatal("expected 'b' to be evicted")
-	}
-}
--- a/internal/vaultik/info.go
+++ b/internal/vaultik/info.go
@@ -15,99 +15,99 @@ import (
 // ShowInfo displays system and configuration information
 func (v *Vaultik) ShowInfo() error {
 	// System Information
-	v.printfStdout("=== System Information ===\n")
-	v.printfStdout("OS/Architecture: %s/%s\n", runtime.GOOS, runtime.GOARCH)
-	v.printfStdout("Version:         %s\n", v.Globals.Version)
-	v.printfStdout("Commit:          %s\n", v.Globals.Commit)
-	v.printfStdout("Go Version:      %s\n", runtime.Version())
-	v.printlnStdout()
+	fmt.Printf("=== System Information ===\n")
+	fmt.Printf("OS/Architecture: %s/%s\n", runtime.GOOS, runtime.GOARCH)
+	fmt.Printf("Version:         %s\n", v.Globals.Version)
+	fmt.Printf("Commit:          %s\n", v.Globals.Commit)
+	fmt.Printf("Go Version:      %s\n", runtime.Version())
+	fmt.Println()

 	// Storage Configuration
-	v.printfStdout("=== Storage Configuration ===\n")
-	v.printfStdout("S3 Bucket:       %s\n", v.Config.S3.Bucket)
+	fmt.Printf("=== Storage Configuration ===\n")
+	fmt.Printf("S3 Bucket:       %s\n", v.Config.S3.Bucket)
 	if v.Config.S3.Prefix != "" {
-		v.printfStdout("S3 Prefix:       %s\n", v.Config.S3.Prefix)
+		fmt.Printf("S3 Prefix:       %s\n", v.Config.S3.Prefix)
 	}
-	v.printfStdout("S3 Endpoint:     %s\n", v.Config.S3.Endpoint)
-	v.printfStdout("S3 Region:       %s\n", v.Config.S3.Region)
-	v.printlnStdout()
+	fmt.Printf("S3 Endpoint:     %s\n", v.Config.S3.Endpoint)
+	fmt.Printf("S3 Region:       %s\n", v.Config.S3.Region)
+	fmt.Println()

 	// Backup Settings
-	v.printfStdout("=== Backup Settings ===\n")
+	fmt.Printf("=== Backup Settings ===\n")

 	// Show configured snapshots
-	v.printfStdout("Snapshots:\n")
+	fmt.Printf("Snapshots:\n")
 	for _, name := range v.Config.SnapshotNames() {
 		snap := v.Config.Snapshots[name]
-		v.printfStdout("  %s:\n", name)
+		fmt.Printf("  %s:\n", name)
 		for _, path := range snap.Paths {
-			v.printfStdout("    - %s\n", path)
+			fmt.Printf("    - %s\n", path)
 		}
 		if len(snap.Exclude) > 0 {
-			v.printfStdout("    exclude: %s\n", strings.Join(snap.Exclude, ", "))
+			fmt.Printf("    exclude: %s\n", strings.Join(snap.Exclude, ", "))
 		}
 	}

 	// Global exclude patterns
 	if len(v.Config.Exclude) > 0 {
-		v.printfStdout("Global Exclude:  %s\n", strings.Join(v.Config.Exclude, ", "))
+		fmt.Printf("Global Exclude:  %s\n", strings.Join(v.Config.Exclude, ", "))
 	}

-	v.printfStdout("Compression:     zstd level %d\n", v.Config.CompressionLevel)
-	v.printfStdout("Chunk Size:      %s\n", humanize.Bytes(uint64(v.Config.ChunkSize)))
-	v.printfStdout("Blob Size Limit: %s\n", humanize.Bytes(uint64(v.Config.BlobSizeLimit)))
-	v.printlnStdout()
+	fmt.Printf("Compression:     zstd level %d\n", v.Config.CompressionLevel)
+	fmt.Printf("Chunk Size:      %s\n", humanize.Bytes(uint64(v.Config.ChunkSize)))
+	fmt.Printf("Blob Size Limit: %s\n", humanize.Bytes(uint64(v.Config.BlobSizeLimit)))
+	fmt.Println()

 	// Encryption Configuration
-	v.printfStdout("=== Encryption Configuration ===\n")
-	v.printfStdout("Recipients:\n")
+	fmt.Printf("=== Encryption Configuration ===\n")
+	fmt.Printf("Recipients:\n")
 	for _, recipient := range v.Config.AgeRecipients {
-		v.printfStdout("  - %s\n", recipient)
+		fmt.Printf("  - %s\n", recipient)
 	}
-	v.printlnStdout()
+	fmt.Println()

 	// Daemon Settings (if applicable)
 	if v.Config.BackupInterval > 0 || v.Config.MinTimeBetweenRun > 0 {
-		v.printfStdout("=== Daemon Settings ===\n")
+		fmt.Printf("=== Daemon Settings ===\n")
 		if v.Config.BackupInterval > 0 {
-			v.printfStdout("Backup Interval: %s\n", v.Config.BackupInterval)
+			fmt.Printf("Backup Interval: %s\n", v.Config.BackupInterval)
 		}
 		if v.Config.MinTimeBetweenRun > 0 {
-			v.printfStdout("Minimum Time:    %s\n", v.Config.MinTimeBetweenRun)
+			fmt.Printf("Minimum Time:    %s\n", v.Config.MinTimeBetweenRun)
 		}
-		v.printlnStdout()
+		fmt.Println()
 	}

 	// Local Database
-	v.printfStdout("=== Local Database ===\n")
-	v.printfStdout("Index Path:      %s\n", v.Config.IndexPath)
+	fmt.Printf("=== Local Database ===\n")
+	fmt.Printf("Index Path:      %s\n", v.Config.IndexPath)

 	// Check if index file exists and get its size
 	if info, err := v.Fs.Stat(v.Config.IndexPath); err == nil {
-		v.printfStdout("Index Size:      %s\n", humanize.Bytes(uint64(info.Size())))
+		fmt.Printf("Index Size:      %s\n", humanize.Bytes(uint64(info.Size())))

 		// Get snapshot count from database
 		query := `SELECT COUNT(*) FROM snapshots WHERE completed_at IS NOT NULL`
 		var snapshotCount int
 		if err := v.DB.Conn().QueryRowContext(v.ctx, query).Scan(&snapshotCount); err == nil {
-			v.printfStdout("Snapshots:       %d\n", snapshotCount)
+			fmt.Printf("Snapshots:       %d\n", snapshotCount)
 		}

 		// Get blob count from database
 		query = `SELECT COUNT(*) FROM blobs`
 		var blobCount int
 		if err := v.DB.Conn().QueryRowContext(v.ctx, query).Scan(&blobCount); err == nil {
-			v.printfStdout("Blobs:           %d\n", blobCount)
+			fmt.Printf("Blobs:           %d\n", blobCount)
 		}

 		// Get file count from database
 		query = `SELECT COUNT(*) FROM files`
 		var fileCount int
 		if err := v.DB.Conn().QueryRowContext(v.ctx, query).Scan(&fileCount); err == nil {
-			v.printfStdout("Files:           %d\n", fileCount)
+			fmt.Printf("Files:           %d\n", fileCount)
 		}
 	} else {
-		v.printfStdout("Index Size:      (not created)\n")
+		fmt.Printf("Index Size:      (not created)\n")
 	}

 	return nil
@@ -157,15 +157,15 @@ func (v *Vaultik) RemoteInfo(jsonOutput bool) error {
 	result.StorageLocation = storageInfo.Location

 	if !jsonOutput {
-		v.printfStdout("=== Remote Storage ===\n")
-		v.printfStdout("Type:     %s\n", storageInfo.Type)
-		v.printfStdout("Location: %s\n", storageInfo.Location)
-		v.printlnStdout()
+		fmt.Printf("=== Remote Storage ===\n")
+		fmt.Printf("Type:     %s\n", storageInfo.Type)
+		fmt.Printf("Location: %s\n", storageInfo.Location)
+		fmt.Println()
 	}

 	// List all snapshot metadata
 	if !jsonOutput {
-		v.printfStdout("Scanning snapshot metadata...\n")
+		fmt.Printf("Scanning snapshot metadata...\n")
 	}

 	snapshotMetadata := make(map[string]*SnapshotMetadataInfo)
@@ -210,7 +210,7 @@ func (v *Vaultik) RemoteInfo(jsonOutput bool) error {

 	// Download and parse all manifests to get referenced blobs
 	if !jsonOutput {
-		v.printfStdout("Downloading %d manifest(s)...\n", len(snapshotIDs))
+		fmt.Printf("Downloading %d manifest(s)...\n", len(snapshotIDs))
 	}

 	referencedBlobs := make(map[string]int64) // hash -> compressed size
@@ -260,7 +260,7 @@ func (v *Vaultik) RemoteInfo(jsonOutput bool) error {

 	// List all blobs on remote
 	if !jsonOutput {
-		v.printfStdout("Scanning blobs...\n")
+		fmt.Printf("Scanning blobs...\n")
 	}

 	allBlobs := make(map[string]int64) // hash -> size from storage
@@ -298,14 +298,14 @@ func (v *Vaultik) RemoteInfo(jsonOutput bool) error {
 	}

 	// Human-readable output
-	v.printfStdout("\n=== Snapshot Metadata ===\n")
+	fmt.Printf("\n=== Snapshot Metadata ===\n")
 	if len(result.Snapshots) == 0 {
-		v.printfStdout("No snapshots found\n")
+		fmt.Printf("No snapshots found\n")
 	} else {
-		v.printfStdout("%-45s %12s %12s %12s %10s %12s\n", "SNAPSHOT", "MANIFEST", "DATABASE", "TOTAL", "BLOBS", "BLOB SIZE")
-		v.printfStdout("%-45s %12s %12s %12s %10s %12s\n", strings.Repeat("-", 45), strings.Repeat("-", 12), strings.Repeat("-", 12), strings.Repeat("-", 12), strings.Repeat("-", 10), strings.Repeat("-", 12))
+		fmt.Printf("%-45s %12s %12s %12s %10s %12s\n", "SNAPSHOT", "MANIFEST", "DATABASE", "TOTAL", "BLOBS", "BLOB SIZE")
+		fmt.Printf("%-45s %12s %12s %12s %10s %12s\n", strings.Repeat("-", 45), strings.Repeat("-", 12), strings.Repeat("-", 12), strings.Repeat("-", 12), strings.Repeat("-", 10), strings.Repeat("-", 12))
 		for _, info := range result.Snapshots {
-			v.printfStdout("%-45s %12s %12s %12s %10s %12s\n",
+			fmt.Printf("%-45s %12s %12s %12s %10s %12s\n",
 				truncateString(info.SnapshotID, 45),
 				humanize.Bytes(uint64(info.ManifestSize)),
 				humanize.Bytes(uint64(info.DatabaseSize)),
@@ -314,23 +314,23 @@ func (v *Vaultik) RemoteInfo(jsonOutput bool) error {
 				humanize.Bytes(uint64(info.BlobsSize)),
 			)
 		}
-		v.printfStdout("%-45s %12s %12s %12s %10s %12s\n", strings.Repeat("-", 45), strings.Repeat("-", 12), strings.Repeat("-", 12), strings.Repeat("-", 12), strings.Repeat("-", 10), strings.Repeat("-", 12))
-		v.printfStdout("%-45s %12s %12s %12s\n", fmt.Sprintf("Total (%d snapshots)", result.TotalMetadataCount), "", "", humanize.Bytes(uint64(result.TotalMetadataSize)))
+		fmt.Printf("%-45s %12s %12s %12s %10s %12s\n", strings.Repeat("-", 45), strings.Repeat("-", 12), strings.Repeat("-", 12), strings.Repeat("-", 12), strings.Repeat("-", 10), strings.Repeat("-", 12))
+		fmt.Printf("%-45s %12s %12s %12s\n", fmt.Sprintf("Total (%d snapshots)", result.TotalMetadataCount), "", "", humanize.Bytes(uint64(result.TotalMetadataSize)))
 	}

-	v.printfStdout("\n=== Blob Storage ===\n")
-	v.printfStdout("Total blobs on remote:      %s (%s)\n",
+	fmt.Printf("\n=== Blob Storage ===\n")
+	fmt.Printf("Total blobs on remote:      %s (%s)\n",
 		humanize.Comma(int64(result.TotalBlobCount)),
 		humanize.Bytes(uint64(result.TotalBlobSize)))
-	v.printfStdout("Referenced by snapshots:    %s (%s)\n",
+	fmt.Printf("Referenced by snapshots:    %s (%s)\n",
 		humanize.Comma(int64(result.ReferencedBlobCount)),
 		humanize.Bytes(uint64(result.ReferencedBlobSize)))
-	v.printfStdout("Orphaned (unreferenced):    %s (%s)\n",
+	fmt.Printf("Orphaned (unreferenced):    %s (%s)\n",
 		humanize.Comma(int64(result.OrphanedBlobCount)),
 		humanize.Bytes(uint64(result.OrphanedBlobSize)))

 	if result.OrphanedBlobCount > 0 {
-		v.printfStdout("\nRun 'vaultik prune --remote' to remove orphaned blobs.\n")
+		fmt.Printf("\nRun 'vaultik prune --remote' to remove orphaned blobs.\n")
 	}

 	return nil
--- a/internal/vaultik/prune.go
+++ b/internal/vaultik/prune.go
@@ -3,6 +3,7 @@ package vaultik
 import (
 	"encoding/json"
 	"fmt"
+	"os"
 	"strings"

 	"git.eeqj.de/sneak/vaultik/internal/log"
@@ -120,29 +121,29 @@ func (v *Vaultik) PruneBlobs(opts *PruneOptions) error {
 	if len(unreferencedBlobs) == 0 {
 		log.Info("No unreferenced blobs found")
 		if opts.JSON {
-			return v.outputPruneBlobsJSON(result)
+			return outputPruneBlobsJSON(result)
 		}
-		v.printlnStdout("No unreferenced blobs to remove.")
+		fmt.Println("No unreferenced blobs to remove.")
 		return nil
 	}

 	// Show what will be deleted
 	log.Info("Found unreferenced blobs", "count", len(unreferencedBlobs), "total_size", humanize.Bytes(uint64(totalSize)))
 	if !opts.JSON {
-		v.printfStdout("Found %d unreferenced blob(s) totaling %s\n", len(unreferencedBlobs), humanize.Bytes(uint64(totalSize)))
+		fmt.Printf("Found %d unreferenced blob(s) totaling %s\n", len(unreferencedBlobs), humanize.Bytes(uint64(totalSize)))
 	}

 	// Confirm unless --force is used (skip in JSON mode - require --force)
 	if !opts.Force && !opts.JSON {
-		v.printfStdout("\nDelete %d unreferenced blob(s)? [y/N] ", len(unreferencedBlobs))
+		fmt.Printf("\nDelete %d unreferenced blob(s)? [y/N] ", len(unreferencedBlobs))
 		var confirm string
-		if _, err := v.scanStdin(&confirm); err != nil {
+		if _, err := fmt.Scanln(&confirm); err != nil {
 			// Treat EOF or error as "no"
-			v.printlnStdout("Cancelled")
+			fmt.Println("Cancelled")
 			return nil
 		}
 		if strings.ToLower(confirm) != "y" {
-			v.printlnStdout("Cancelled")
+			fmt.Println("Cancelled")
 			return nil
 		}
 	}
@@ -184,20 +185,20 @@ func (v *Vaultik) PruneBlobs(opts *PruneOptions) error {
 	)

 	if opts.JSON {
-		return v.outputPruneBlobsJSON(result)
+		return outputPruneBlobsJSON(result)
 	}

-	v.printfStdout("\nDeleted %d blob(s) totaling %s\n", deletedCount, humanize.Bytes(uint64(deletedSize)))
+	fmt.Printf("\nDeleted %d blob(s) totaling %s\n", deletedCount, humanize.Bytes(uint64(deletedSize)))
 	if deletedCount < len(unreferencedBlobs) {
-		v.printfStdout("Failed to delete %d blob(s)\n", len(unreferencedBlobs)-deletedCount)
+		fmt.Printf("Failed to delete %d blob(s)\n", len(unreferencedBlobs)-deletedCount)
 	}

 	return nil
 }

 // outputPruneBlobsJSON outputs the prune result as JSON
-func (v *Vaultik) outputPruneBlobsJSON(result *PruneBlobsResult) error {
-	encoder := json.NewEncoder(v.Stdout)
+func outputPruneBlobsJSON(result *PruneBlobsResult) error {
+	encoder := json.NewEncoder(os.Stdout)
 	encoder.SetIndent("", "  ")
 	return encoder.Encode(result)
 }
--- a/internal/vaultik/restore.go
+++ b/internal/vaultik/restore.go
@@ -22,13 +22,6 @@ import (
 	"golang.org/x/term"
 )

-const (
-	// progressBarWidth is the character width of the progress bar display.
-	progressBarWidth = 40
-	// progressBarThrottle is the minimum interval between progress bar redraws.
-	progressBarThrottle = 100 * time.Millisecond
-)
-
 // RestoreOptions contains options for the restore operation
 type RestoreOptions struct {
 	SnapshotID string
@@ -116,20 +109,7 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {

 	// Step 5: Restore files
 	result := &RestoreResult{}
-	blobCache, err := newBlobDiskCache(4 * v.Config.BlobSizeLimit.Int64())
-	if err != nil {
-		return fmt.Errorf("creating blob cache: %w", err)
-	}
-	defer func() { _ = blobCache.Close() }()
-
-	// Calculate total bytes for progress bar
-	var totalBytesExpected int64
-	for _, file := range files {
-		totalBytesExpected += file.Size
-	}
-
-	// Create progress bar if output is a terminal
-	bar := v.newProgressBar("Restoring", totalBytesExpected)
+	blobCache := newBlobLRUCache(defaultMaxBlobCacheBytes) // LRU cache bounded to ~1 GiB

 	for i, file := range files {
 		if v.ctx.Err() != nil {
@@ -138,21 +118,11 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {

 		if err := v.restoreFile(v.ctx, repos, file, opts.TargetDir, identity, chunkToBlobMap, blobCache, result); err != nil {
 			log.Error("Failed to restore file", "path", file.Path, "error", err)
-			result.FilesFailed++
-			result.FailedFiles = append(result.FailedFiles, file.Path.String())
-			// Update progress bar even on failure
-			if bar != nil {
-				_ = bar.Add64(file.Size)
-			}
+			// Continue with other files
 			continue
 		}

-		// Update progress bar
-		if bar != nil {
-			_ = bar.Add64(file.Size)
-		}
-
-		// Progress logging (for non-terminal or structured logs)
+		// Progress logging
 		if (i+1)%100 == 0 || i+1 == len(files) {
 			log.Info("Restore progress",
 				"files", fmt.Sprintf("%d/%d", i+1, len(files)),
@@ -161,10 +131,6 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {
 		}
 	}

-	if bar != nil {
-		_ = bar.Finish()
-	}
-
 	result.Duration = time.Since(startTime)

 	log.Info("Restore complete",
@@ -175,19 +141,12 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {
 		"duration", result.Duration,
 	)

-	v.printfStdout("Restored %d files (%s) in %s\n",
+	_, _ = fmt.Fprintf(v.Stdout, "Restored %d files (%s) in %s\n",
 		result.FilesRestored,
 		humanize.Bytes(uint64(result.BytesRestored)),
 		result.Duration.Round(time.Second),
 	)

-	if result.FilesFailed > 0 {
-		_, _ = fmt.Fprintf(v.Stdout, "\nWARNING: %d file(s) failed to restore:\n", result.FilesFailed)
-		for _, path := range result.FailedFiles {
-			_, _ = fmt.Fprintf(v.Stdout, "  - %s\n", path)
-		}
-	}
-
 	// Run verification if requested
 	if opts.Verify {
 		if err := v.verifyRestoredFiles(v.ctx, repos, files, opts.TargetDir, result); err != nil {
@@ -195,23 +154,19 @@ func (v *Vaultik) Restore(opts *RestoreOptions) error {
 		}

 		if result.FilesFailed > 0 {
-			v.printfStdout("\nVerification FAILED: %d files did not match expected checksums\n", result.FilesFailed)
+			_, _ = fmt.Fprintf(v.Stdout, "\nVerification FAILED: %d files did not match expected checksums\n", result.FilesFailed)
 			for _, path := range result.FailedFiles {
-				v.printfStdout("  - %s\n", path)
+				_, _ = fmt.Fprintf(v.Stdout, "  - %s\n", path)
 			}
 			return fmt.Errorf("%d files failed verification", result.FilesFailed)
 		}

-		v.printfStdout("Verified %d files (%s)\n",
+		_, _ = fmt.Fprintf(v.Stdout, "Verified %d files (%s)\n",
 			result.FilesVerified,
 			humanize.Bytes(uint64(result.BytesVerified)),
 		)
 	}

-	if result.FilesFailed > 0 {
-		return fmt.Errorf("%d file(s) failed to restore", result.FilesFailed)
-	}
-
 	return nil
 }

@@ -344,7 +299,7 @@ func (v *Vaultik) restoreFile(
 	targetDir string,
 	identity age.Identity,
 	chunkToBlobMap map[string]*database.BlobChunk,
-	blobCache *blobDiskCache,
+	blobCache *blobLRUCache,
 	result *RestoreResult,
 ) error {
 	// Calculate target path - use full original path under target directory
@@ -428,7 +383,7 @@ func (v *Vaultik) restoreRegularFile(
 	targetPath string,
 	identity age.Identity,
 	chunkToBlobMap map[string]*database.BlobChunk,
-	blobCache *blobDiskCache,
+	blobCache *blobLRUCache,
 	result *RestoreResult,
 ) error {
 	// Get file chunks in order
@@ -468,9 +423,7 @@ func (v *Vaultik) restoreRegularFile(
 			if err != nil {
 				return fmt.Errorf("downloading blob %s: %w", blobHashStr[:16], err)
 			}
-			if putErr := blobCache.Put(blobHashStr, blobData); putErr != nil {
-				log.Debug("Failed to cache blob on disk", "hash", blobHashStr[:16], "error", putErr)
-			}
+			blobCache.Put(blobHashStr, blobData)
 			result.BlobsDownloaded++
 			result.BytesDownloaded += blob.CompressedSize
 		}
@@ -558,13 +511,28 @@ func (v *Vaultik) verifyRestoredFiles(
 		"files", len(regularFiles),
 		"bytes", humanize.Bytes(uint64(totalBytes)),
 	)
-	v.printfStdout("\nVerifying %d files (%s)...\n",
+	_, _ = fmt.Fprintf(v.Stdout, "\nVerifying %d files (%s)...\n",
 		len(regularFiles),
 		humanize.Bytes(uint64(totalBytes)),
 	)

 	// Create progress bar if output is a terminal
-	bar := v.newProgressBar("Verifying", totalBytes)
+	var bar *progressbar.ProgressBar
+	if isTerminal() {
+		bar = progressbar.NewOptions64(
+			totalBytes,
+			progressbar.OptionSetDescription("Verifying"),
+			progressbar.OptionSetWriter(os.Stderr),
+			progressbar.OptionShowBytes(true),
+			progressbar.OptionShowCount(),
+			progressbar.OptionSetWidth(40),
+			progressbar.OptionThrottle(100*time.Millisecond),
+			progressbar.OptionOnCompletion(func() {
+				fmt.Fprint(os.Stderr, "\n")
+			}),
+			progressbar.OptionSetRenderBlankState(true),
+		)
+	}

 	// Verify each file
 	for _, file := range regularFiles {
@@ -658,37 +626,7 @@ func (v *Vaultik) verifyFile(
 	return bytesVerified, nil
 }

-// newProgressBar creates a terminal-aware progress bar with standard options.
-// It returns nil if stdout is not a terminal.
-func (v *Vaultik) newProgressBar(description string, total int64) *progressbar.ProgressBar {
-	if !v.isTerminal() {
-		return nil
-	}
-	return progressbar.NewOptions64(
-		total,
-		progressbar.OptionSetDescription(description),
-		progressbar.OptionSetWriter(v.Stderr),
-		progressbar.OptionShowBytes(true),
-		progressbar.OptionShowCount(),
-		progressbar.OptionSetWidth(progressBarWidth),
-		progressbar.OptionThrottle(progressBarThrottle),
-		progressbar.OptionOnCompletion(func() {
-			v.printfStderr("\n")
-		}),
-		progressbar.OptionSetRenderBlankState(true),
-	)
-}
-
-// isTerminal returns true if stdout is a terminal.
-// It checks whether v.Stdout implements Fd() (i.e. is an *os.File),
-// and falls back to false for non-file writers (e.g. in tests).
-func (v *Vaultik) isTerminal() bool {
-	type fder interface {
-		Fd() uintptr
-	}
-	f, ok := v.Stdout.(fder)
-	if !ok {
-		return false
-	}
-	return term.IsTerminal(int(f.Fd()))
+// isTerminal returns true if stdout is a terminal
+func isTerminal() bool {
+	return term.IsTerminal(int(os.Stdout.Fd()))
 }
--- a/internal/vaultik/snapshot.go
+++ b/internal/vaultik/snapshot.go
@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
-	"regexp"
 	"sort"
 	"strings"
 	"text/tabwriter"
@@ -87,25 +86,7 @@ func (v *Vaultik) CreateSnapshot(opts *SnapshotCreateOptions) error {

 	// Print overall summary if multiple snapshots
 	if len(snapshotNames) > 1 {
-		v.printfStdout("\nAll %d snapshots completed in %s\n", len(snapshotNames), time.Since(overallStartTime).Round(time.Second))
-	}
-
-	// Prune old snapshots and unreferenced blobs if --prune was specified
-	if opts.Prune {
-		log.Info("Pruning enabled - deleting old snapshots and unreferenced blobs")
-		v.printlnStdout("\nPruning old snapshots (keeping latest)...")
-
-		if err := v.PurgeSnapshots(true, "", true); err != nil {
-			return fmt.Errorf("prune: purging old snapshots: %w", err)
-		}
-
-		v.printlnStdout("Pruning unreferenced blobs...")
-
-		if err := v.PruneBlobs(&PruneOptions{Force: true}); err != nil {
-			return fmt.Errorf("prune: removing unreferenced blobs: %w", err)
-		}
-
-		log.Info("Pruning complete")
+		_, _ = fmt.Fprintf(v.Stdout, "\nAll %d snapshots completed in %s\n", len(snapshotNames), time.Since(overallStartTime).Round(time.Second))
 	}

 	return nil
@@ -118,7 +99,7 @@ func (v *Vaultik) createNamedSnapshot(opts *SnapshotCreateOptions, hostname, sna
 	snapConfig := v.Config.Snapshots[snapName]

 	if total > 1 {
-		v.printfStdout("\n=== Snapshot %d/%d: %s ===\n", idx, total, snapName)
+		_, _ = fmt.Fprintf(v.Stdout, "\n=== Snapshot %d/%d: %s ===\n", idx, total, snapName)
 	}

 	// Resolve source directories to absolute paths
@@ -171,7 +152,7 @@ func (v *Vaultik) createNamedSnapshot(opts *SnapshotCreateOptions, hostname, sna
 		return fmt.Errorf("creating snapshot: %w", err)
 	}
 	log.Info("Beginning snapshot", "snapshot_id", snapshotID, "name", snapName)
-	v.printfStdout("Beginning snapshot: %s\n", snapshotID)
+	_, _ = fmt.Fprintf(v.Stdout, "Beginning snapshot: %s\n", snapshotID)

 	for i, dir := range resolvedDirs {
 		// Check if context is cancelled
@@ -183,7 +164,7 @@ func (v *Vaultik) createNamedSnapshot(opts *SnapshotCreateOptions, hostname, sna
 		}

 		log.Info("Scanning directory", "path", dir)
-		v.printfStdout("Beginning directory scan (%d/%d): %s\n", i+1, len(resolvedDirs), dir)
+		_, _ = fmt.Fprintf(v.Stdout, "Beginning directory scan (%d/%d): %s\n", i+1, len(resolvedDirs), dir)
 		result, err := scanner.Scan(v.ctx, dir, snapshotID)
 		if err != nil {
 			return fmt.Errorf("failed to scan %s: %w", dir, err)
@@ -294,35 +275,40 @@ func (v *Vaultik) createNamedSnapshot(opts *SnapshotCreateOptions, hostname, sna
 	}

 	// Print comprehensive summary
-	v.printfStdout("=== Snapshot Complete ===\n")
-	v.printfStdout("ID: %s\n", snapshotID)
-	v.printfStdout("Files: %s examined, %s to process, %s unchanged",
+	_, _ = fmt.Fprintf(v.Stdout, "=== Snapshot Complete ===\n")
+	_, _ = fmt.Fprintf(v.Stdout, "ID: %s\n", snapshotID)
+	_, _ = fmt.Fprintf(v.Stdout, "Files: %s examined, %s to process, %s unchanged",
 		formatNumber(totalFiles),
 		formatNumber(totalFilesChanged),
 		formatNumber(totalFilesSkipped))
 	if totalFilesDeleted > 0 {
-		v.printfStdout(", %s deleted", formatNumber(totalFilesDeleted))
+		_, _ = fmt.Fprintf(v.Stdout, ", %s deleted", formatNumber(totalFilesDeleted))
 	}
-	v.printlnStdout()
-	v.printfStdout("Data: %s total (%s to process)",
+	_, _ = fmt.Fprintln(v.Stdout)
+	_, _ = fmt.Fprintf(v.Stdout, "Data: %s total (%s to process)",
 		humanize.Bytes(uint64(totalBytesAll)),
 		humanize.Bytes(uint64(totalBytesChanged)))
 	if totalBytesDeleted > 0 {
-		v.printfStdout(", %s deleted", humanize.Bytes(uint64(totalBytesDeleted)))
+		_, _ = fmt.Fprintf(v.Stdout, ", %s deleted", humanize.Bytes(uint64(totalBytesDeleted)))
 	}
-	v.printlnStdout()
+	_, _ = fmt.Fprintln(v.Stdout)
 	if totalBlobsUploaded > 0 {
-		v.printfStdout("Storage: %s compressed from %s (%.2fx)\n",
+		_, _ = fmt.Fprintf(v.Stdout, "Storage: %s compressed from %s (%.2fx)\n",
 			humanize.Bytes(uint64(totalBlobSizeCompressed)),
 			humanize.Bytes(uint64(totalBlobSizeUncompressed)),
 			compressionRatio)
-		v.printfStdout("Upload: %d blobs, %s in %s (%s)\n",
+		_, _ = fmt.Fprintf(v.Stdout, "Upload: %d blobs, %s in %s (%s)\n",
 			totalBlobsUploaded,
 			humanize.Bytes(uint64(totalBytesUploaded)),
 			formatDuration(uploadDuration),
 			avgUploadSpeed)
 	}
-	v.printfStdout("Duration: %s\n", formatDuration(snapshotDuration))
+	_, _ = fmt.Fprintf(v.Stdout, "Duration: %s\n", formatDuration(snapshotDuration))
+
+	if opts.Prune {
+		log.Info("Pruning enabled - will delete old snapshots after snapshot")
+		// TODO: Implement pruning
+	}

 	return nil
 }
@@ -436,13 +422,13 @@ func (v *Vaultik) ListSnapshots(jsonOutput bool) error {

 	if jsonOutput {
 		// JSON output
-		encoder := json.NewEncoder(v.Stdout)
+		encoder := json.NewEncoder(os.Stdout)
 		encoder.SetIndent("", "  ")
 		return encoder.Encode(snapshots)
 	}

 	// Table output
-	w := tabwriter.NewWriter(v.Stdout, 0, 0, 3, ' ', 0)
+	w := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)

 	// Show configured snapshots from config file
 	if _, err := fmt.Fprintln(w, "CONFIGURED SNAPSHOTS:"); err != nil {
@@ -541,14 +527,14 @@ func (v *Vaultik) PurgeSnapshots(keepLatest bool, olderThan string, force bool)
 	}

 	if len(toDelete) == 0 {
-		v.printlnStdout("No snapshots to delete")
+		fmt.Println("No snapshots to delete")
 		return nil
 	}

 	// Show what will be deleted
-	v.printfStdout("The following snapshots will be deleted:\n\n")
+	fmt.Printf("The following snapshots will be deleted:\n\n")
 	for _, snap := range toDelete {
-		v.printfStdout("  %s (%s, %s)\n",
+		fmt.Printf("  %s (%s, %s)\n",
 			snap.ID,
 			snap.Timestamp.Format("2006-01-02 15:04:05"),
 			formatBytes(snap.CompressedSize))
@@ -556,19 +542,19 @@ func (v *Vaultik) PurgeSnapshots(keepLatest bool, olderThan string, force bool)

 	// Confirm unless --force is used
 	if !force {
-		v.printfStdout("\nDelete %d snapshot(s)? [y/N] ", len(toDelete))
+		fmt.Printf("\nDelete %d snapshot(s)? [y/N] ", len(toDelete))
 		var confirm string
-		if _, err := v.scanStdin(&confirm); err != nil {
+		if _, err := fmt.Scanln(&confirm); err != nil {
 			// Treat EOF or error as "no"
-			v.printlnStdout("Cancelled")
+			fmt.Println("Cancelled")
 			return nil
 		}
 		if strings.ToLower(confirm) != "y" {
-			v.printlnStdout("Cancelled")
+			fmt.Println("Cancelled")
 			return nil
 		}
 	} else {
-		v.printfStdout("\nDeleting %d snapshot(s) (--force specified)\n", len(toDelete))
+		fmt.Printf("\nDeleting %d snapshot(s) (--force specified)\n", len(toDelete))
 	}

 	// Delete snapshots (both local and remote)
@@ -583,10 +569,10 @@ func (v *Vaultik) PurgeSnapshots(keepLatest bool, olderThan string, force bool)
 		}
 	}

-	v.printfStdout("Deleted %d snapshot(s)\n", len(toDelete))
+	fmt.Printf("Deleted %d snapshot(s)\n", len(toDelete))

 	// Note: Run 'vaultik prune' separately to clean up unreferenced blobs
-	v.printlnStdout("\nNote: Run 'vaultik prune' to clean up unreferenced blobs.")
+	fmt.Println("\nNote: Run 'vaultik prune' to clean up unreferenced blobs.")

 	return nil
 }
@@ -627,11 +613,11 @@ func (v *Vaultik) VerifySnapshotWithOptions(snapshotID string, opts *VerifyOptio
 	}

 	if !opts.JSON {
-		v.printfStdout("Verifying snapshot %s\n", snapshotID)
+		fmt.Printf("Verifying snapshot %s\n", snapshotID)
 		if !snapshotTime.IsZero() {
-			v.printfStdout("Snapshot time: %s\n", snapshotTime.Format("2006-01-02 15:04:05 MST"))
+			fmt.Printf("Snapshot time: %s\n", snapshotTime.Format("2006-01-02 15:04:05 MST"))
 		}
-		v.printlnStdout()
+		fmt.Println()
 	}

 	// Download and parse manifest
@@ -649,18 +635,18 @@ func (v *Vaultik) VerifySnapshotWithOptions(snapshotID string, opts *VerifyOptio
 	result.TotalSize = manifest.TotalCompressedSize

 	if !opts.JSON {
-		v.printfStdout("Snapshot information:\n")
-		v.printfStdout("  Blob count:   %d\n", manifest.BlobCount)
-		v.printfStdout("  Total size:   %s\n", humanize.Bytes(uint64(manifest.TotalCompressedSize)))
+		fmt.Printf("Snapshot information:\n")
+		fmt.Printf("  Blob count:   %d\n", manifest.BlobCount)
+		fmt.Printf("  Total size:   %s\n", humanize.Bytes(uint64(manifest.TotalCompressedSize)))
 		if manifest.Timestamp != "" {
 			if t, err := time.Parse(time.RFC3339, manifest.Timestamp); err == nil {
-				v.printfStdout("  Created:      %s\n", t.Format("2006-01-02 15:04:05 MST"))
+				fmt.Printf("  Created:      %s\n", t.Format("2006-01-02 15:04:05 MST"))
 			}
 		}
-		v.printlnStdout()
+		fmt.Println()

 		// Check each blob exists
-		v.printfStdout("Checking blob existence...\n")
+		fmt.Printf("Checking blob existence...\n")
 	}

 	missing := 0
@@ -674,7 +660,7 @@ func (v *Vaultik) VerifySnapshotWithOptions(snapshotID string, opts *VerifyOptio
 		_, err := v.Storage.Stat(v.ctx, blobPath)
 		if err != nil {
 			if !opts.JSON {
-				v.printfStdout("  Missing: %s (%s)\n", blob.Hash, humanize.Bytes(uint64(blob.CompressedSize)))
+				fmt.Printf("  Missing: %s (%s)\n", blob.Hash, humanize.Bytes(uint64(blob.CompressedSize)))
 			}
 			missing++
 			missingSize += blob.CompressedSize
@@ -697,20 +683,20 @@ func (v *Vaultik) VerifySnapshotWithOptions(snapshotID string, opts *VerifyOptio
 		return v.outputVerifyJSON(result)
 	}

-	v.printfStdout("\nVerification complete:\n")
-	v.printfStdout("  Verified:     %d blobs (%s)\n", verified,
+	fmt.Printf("\nVerification complete:\n")
+	fmt.Printf("  Verified:     %d blobs (%s)\n", verified,
 		humanize.Bytes(uint64(manifest.TotalCompressedSize-missingSize)))
 	if missing > 0 {
-		v.printfStdout("  Missing:      %d blobs (%s)\n", missing, humanize.Bytes(uint64(missingSize)))
+		fmt.Printf("  Missing:      %d blobs (%s)\n", missing, humanize.Bytes(uint64(missingSize)))
 	} else {
-		v.printfStdout("  Missing:      0 blobs\n")
+		fmt.Printf("  Missing:      0 blobs\n")
 	}
-	v.printfStdout("  Status:       ")
+	fmt.Printf("  Status:       ")
 	if missing > 0 {
-		v.printfStdout("FAILED - %d blobs are missing\n", missing)
+		fmt.Printf("FAILED - %d blobs are missing\n", missing)
 		return fmt.Errorf("%d blobs are missing", missing)
 	} else {
-		v.printfStdout("OK - All blobs verified\n")
+		fmt.Printf("OK - All blobs verified\n")
 	}

 	return nil
@@ -718,7 +704,7 @@ func (v *Vaultik) VerifySnapshotWithOptions(snapshotID string, opts *VerifyOptio

 // outputVerifyJSON outputs the verification result as JSON
 func (v *Vaultik) outputVerifyJSON(result *VerifyResult) error {
-	encoder := json.NewEncoder(v.Stdout)
+	encoder := json.NewEncoder(os.Stdout)
 	encoder.SetIndent("", "  ")
 	if err := encoder.Encode(result); err != nil {
 		return fmt.Errorf("encoding JSON: %w", err)
@@ -802,7 +788,7 @@ func (v *Vaultik) syncWithRemote() error {
 		snapshotIDStr := snapshot.ID.String()
 		if !remoteSnapshots[snapshotIDStr] {
 			log.Info("Removing local snapshot not found in remote", "snapshot_id", snapshot.ID)
-			if err := v.deleteSnapshotFromLocalDB(snapshotIDStr); err != nil {
+			if err := v.Repositories.Snapshots.Delete(v.ctx, snapshotIDStr); err != nil {
 				log.Error("Failed to delete local snapshot", "snapshot_id", snapshot.ID, "error", err)
 			} else {
 				removedCount++
@@ -844,11 +830,11 @@ func (v *Vaultik) RemoveSnapshot(snapshotID string, opts *RemoveOptions) (*Remov
 	if opts.DryRun {
 		result.DryRun = true
 		if !opts.JSON {
-			v.printfStdout("Would remove snapshot: %s\n", snapshotID)
+			_, _ = fmt.Fprintf(v.Stdout, "Would remove snapshot: %s\n", snapshotID)
 			if opts.Remote {
-				v.printlnStdout("Would also remove from remote storage")
+				_, _ = fmt.Fprintln(v.Stdout, "Would also remove from remote storage")
 			}
-			v.printlnStdout("[Dry run - no changes made]")
+			_, _ = fmt.Fprintln(v.Stdout, "[Dry run - no changes made]")
 		}
 		if opts.JSON {
 			return result, v.outputRemoveJSON(result)
@@ -859,17 +845,17 @@ func (v *Vaultik) RemoveSnapshot(snapshotID string, opts *RemoveOptions) (*Remov
 	// Confirm unless --force is used (skip in JSON mode - require --force)
 	if !opts.Force && !opts.JSON {
 		if opts.Remote {
-			v.printfStdout("Remove snapshot '%s' from local database and remote storage? [y/N] ", snapshotID)
+			_, _ = fmt.Fprintf(v.Stdout, "Remove snapshot '%s' from local database and remote storage? [y/N] ", snapshotID)
 		} else {
-			v.printfStdout("Remove snapshot '%s' from local database? [y/N] ", snapshotID)
+			_, _ = fmt.Fprintf(v.Stdout, "Remove snapshot '%s' from local database? [y/N] ", snapshotID)
 		}
 		var confirm string
-		if _, err := v.scanStdin(&confirm); err != nil {
-			v.printlnStdout("Cancelled")
+		if _, err := fmt.Fscanln(v.Stdin, &confirm); err != nil {
+			_, _ = fmt.Fprintln(v.Stdout, "Cancelled")
 			return result, nil
 		}
 		if strings.ToLower(confirm) != "y" {
-			v.printlnStdout("Cancelled")
+			_, _ = fmt.Fprintln(v.Stdout, "Cancelled")
 			return result, nil
 		}
 	}
@@ -896,10 +882,10 @@ func (v *Vaultik) RemoveSnapshot(snapshotID string, opts *RemoveOptions) (*Remov
 	}

 	// Print summary
-	v.printfStdout("Removed snapshot '%s' from local database\n", snapshotID)
+	_, _ = fmt.Fprintf(v.Stdout, "Removed snapshot '%s' from local database\n", snapshotID)
 	if opts.Remote {
-		v.printlnStdout("Removed snapshot metadata from remote storage")
-		v.printlnStdout("\nNote: Blobs were not removed. Run 'vaultik prune' to remove orphaned blobs.")
+		_, _ = fmt.Fprintln(v.Stdout, "Removed snapshot metadata from remote storage")
+		_, _ = fmt.Fprintln(v.Stdout, "\nNote: Blobs were not removed. Run 'vaultik prune' to remove orphaned blobs.")
 	}

 	return result, nil
@@ -943,7 +929,7 @@ func (v *Vaultik) RemoveAllSnapshots(opts *RemoveOptions) (*RemoveResult, error)

 	if len(snapshotIDs) == 0 {
 		if !opts.JSON {
-			v.printlnStdout("No snapshots found")
+			_, _ = fmt.Fprintln(v.Stdout, "No snapshots found")
 		}
 		return result, nil
 	}
@@ -952,14 +938,14 @@ func (v *Vaultik) RemoveAllSnapshots(opts *RemoveOptions) (*RemoveResult, error)
 		result.DryRun = true
 		result.SnapshotsRemoved = snapshotIDs
 		if !opts.JSON {
-			v.printfStdout("Would remove %d snapshot(s):\n", len(snapshotIDs))
+			_, _ = fmt.Fprintf(v.Stdout, "Would remove %d snapshot(s):\n", len(snapshotIDs))
 			for _, id := range snapshotIDs {
-				v.printfStdout("  %s\n", id)
+				_, _ = fmt.Fprintf(v.Stdout, "  %s\n", id)
 			}
 			if opts.Remote {
-				v.printlnStdout("Would also remove from remote storage")
+				_, _ = fmt.Fprintln(v.Stdout, "Would also remove from remote storage")
 			}
-			v.printlnStdout("[Dry run - no changes made]")
+			_, _ = fmt.Fprintln(v.Stdout, "[Dry run - no changes made]")
 		}
 		if opts.JSON {
 			return result, v.outputRemoveJSON(result)
@@ -1000,10 +986,10 @@ func (v *Vaultik) RemoveAllSnapshots(opts *RemoveOptions) (*RemoveResult, error)
 		return result, v.outputRemoveJSON(result)
 	}

-	v.printfStdout("Removed %d snapshot(s)\n", len(result.SnapshotsRemoved))
+	_, _ = fmt.Fprintf(v.Stdout, "Removed %d snapshot(s)\n", len(result.SnapshotsRemoved))
 	if opts.Remote {
-		v.printlnStdout("Removed snapshot metadata from remote storage")
-		v.printlnStdout("\nNote: Blobs were not removed. Run 'vaultik prune' to remove orphaned blobs.")
+		_, _ = fmt.Fprintln(v.Stdout, "Removed snapshot metadata from remote storage")
+		_, _ = fmt.Fprintln(v.Stdout, "\nNote: Blobs were not removed. Run 'vaultik prune' to remove orphaned blobs.")
 	}

 	return result, nil
@@ -1017,16 +1003,16 @@ func (v *Vaultik) deleteSnapshotFromLocalDB(snapshotID string) error {

 	// Delete related records first to avoid foreign key constraints
 	if err := v.Repositories.Snapshots.DeleteSnapshotFiles(v.ctx, snapshotID); err != nil {
-		return fmt.Errorf("deleting snapshot files for %s: %w", snapshotID, err)
+		log.Error("Failed to delete snapshot files", "snapshot_id", snapshotID, "error", err)
 	}
 	if err := v.Repositories.Snapshots.DeleteSnapshotBlobs(v.ctx, snapshotID); err != nil {
-		return fmt.Errorf("deleting snapshot blobs for %s: %w", snapshotID, err)
+		log.Error("Failed to delete snapshot blobs", "snapshot_id", snapshotID, "error", err)
 	}
 	if err := v.Repositories.Snapshots.DeleteSnapshotUploads(v.ctx, snapshotID); err != nil {
-		return fmt.Errorf("deleting snapshot uploads for %s: %w", snapshotID, err)
+		log.Error("Failed to delete snapshot uploads", "snapshot_id", snapshotID, "error", err)
 	}
 	if err := v.Repositories.Snapshots.Delete(v.ctx, snapshotID); err != nil {
-		return fmt.Errorf("deleting snapshot record %s: %w", snapshotID, err)
+		log.Error("Failed to delete snapshot record", "snapshot_id", snapshotID, "error", err)
 	}

 	return nil
@@ -1057,7 +1043,7 @@ func (v *Vaultik) deleteSnapshotFromRemote(snapshotID string) error {

 // outputRemoveJSON outputs the removal result as JSON
 func (v *Vaultik) outputRemoveJSON(result *RemoveResult) error {
-	encoder := json.NewEncoder(v.Stdout)
+	encoder := json.NewEncoder(os.Stdout)
 	encoder.SetIndent("", "  ")
 	return encoder.Encode(result)
 }
@@ -1131,29 +1117,21 @@ func (v *Vaultik) PruneDatabase() (*PruneResult, error) {
 	)

 	// Print summary
-	v.printfStdout("Local database prune complete:\n")
-	v.printfStdout("  Incomplete snapshots removed: %d\n", result.SnapshotsDeleted)
-	v.printfStdout("  Orphaned files removed: %d\n", result.FilesDeleted)
-	v.printfStdout("  Orphaned chunks removed: %d\n", result.ChunksDeleted)
-	v.printfStdout("  Orphaned blobs removed: %d\n", result.BlobsDeleted)
+	_, _ = fmt.Fprintf(v.Stdout, "Local database prune complete:\n")
+	_, _ = fmt.Fprintf(v.Stdout, "  Incomplete snapshots removed: %d\n", result.SnapshotsDeleted)
+	_, _ = fmt.Fprintf(v.Stdout, "  Orphaned files removed: %d\n", result.FilesDeleted)
+	_, _ = fmt.Fprintf(v.Stdout, "  Orphaned chunks removed: %d\n", result.ChunksDeleted)
+	_, _ = fmt.Fprintf(v.Stdout, "  Orphaned blobs removed: %d\n", result.BlobsDeleted)

 	return result, nil
 }

-// validTableNameRe matches table names containing only lowercase alphanumeric characters and underscores.
-var validTableNameRe = regexp.MustCompile(`^[a-z0-9_]+$`)
-
-// getTableCount returns the count of rows in a table.
-// The tableName is sanitized to only allow [a-z0-9_] characters to prevent SQL injection.
+// getTableCount returns the count of rows in a table
 func (v *Vaultik) getTableCount(tableName string) (int64, error) {
 	if v.DB == nil {
 		return 0, nil
 	}

-	if !validTableNameRe.MatchString(tableName) {
-		return 0, fmt.Errorf("invalid table name: %q", tableName)
-	}
-
 	var count int64
 	query := fmt.Sprintf("SELECT COUNT(*) FROM %s", tableName)
 	err := v.DB.Conn().QueryRowContext(v.ctx, query).Scan(&count)
--- a/internal/vaultik/snapshot_prune_test.go
+++ b/internal/vaultik/snapshot_prune_test.go
@@ -1,23 +0,0 @@
-package vaultik
-
-import (
-	"testing"
-)
-
-// TestSnapshotCreateOptions_PruneFlag verifies the Prune field exists on
-// SnapshotCreateOptions and can be set.
-func TestSnapshotCreateOptions_PruneFlag(t *testing.T) {
-	opts := &SnapshotCreateOptions{
-		Prune: true,
-	}
-	if !opts.Prune {
-		t.Error("Expected Prune to be true")
-	}
-
-	opts2 := &SnapshotCreateOptions{
-		Prune: false,
-	}
-	if opts2.Prune {
-		t.Error("Expected Prune to be false")
-	}
-}
--- a/internal/vaultik/vaultik.go
+++ b/internal/vaultik/vaultik.go
@@ -129,26 +129,12 @@ func (v *Vaultik) GetFilesystem() afero.Fs {
 	return v.Fs
 }

-// printfStdout writes formatted output to stdout.
-func (v *Vaultik) printfStdout(format string, args ...any) {
+// Outputf writes formatted output to stdout for user-facing messages.
+// This should be used for all non-log user output.
+func (v *Vaultik) Outputf(format string, args ...any) {
 	_, _ = fmt.Fprintf(v.Stdout, format, args...)
 }

-// printlnStdout writes a line to stdout.
-func (v *Vaultik) printlnStdout(args ...any) {
-	_, _ = fmt.Fprintln(v.Stdout, args...)
-}
-
-// printfStderr writes formatted output to stderr.
-func (v *Vaultik) printfStderr(format string, args ...any) {
-	_, _ = fmt.Fprintf(v.Stderr, format, args...)
-}
-
-// scanStdin reads a line of input from stdin.
-func (v *Vaultik) scanStdin(a ...any) (int, error) {
-	return fmt.Fscanln(v.Stdin, a...)
-}
-
 // TestVaultik wraps a Vaultik with captured stdout/stderr for testing
 type TestVaultik struct {
 	*Vaultik
--- a/internal/vaultik/verify.go
+++ b/internal/vaultik/verify.go
@@ -58,14 +58,14 @@ func (v *Vaultik) RunDeepVerify(snapshotID string, opts *VerifyOptions) error {
 	)

 	if !opts.JSON {
-		v.printfStdout("Deep verification of snapshot: %s\n\n", snapshotID)
+		v.Outputf("Deep verification of snapshot: %s\n\n", snapshotID)
 	}

 	// Step 1: Download manifest
 	manifestPath := fmt.Sprintf("metadata/%s/manifest.json.zst", snapshotID)
 	log.Info("Downloading manifest", "path", manifestPath)
 	if !opts.JSON {
-		v.printfStdout("Downloading manifest...\n")
+		v.Outputf("Downloading manifest...\n")
 	}

 	manifestReader, err := v.Storage.Get(v.ctx, manifestPath)
@@ -95,14 +95,14 @@ func (v *Vaultik) RunDeepVerify(snapshotID string, opts *VerifyOptions) error {
 		"manifest_total_size", humanize.Bytes(uint64(manifest.TotalCompressedSize)),
 	)
 	if !opts.JSON {
-		v.printfStdout("Manifest loaded: %d blobs (%s)\n", manifest.BlobCount, humanize.Bytes(uint64(manifest.TotalCompressedSize)))
+		v.Outputf("Manifest loaded: %d blobs (%s)\n", manifest.BlobCount, humanize.Bytes(uint64(manifest.TotalCompressedSize)))
 	}

 	// Step 2: Download and decrypt database (authoritative source)
 	dbPath := fmt.Sprintf("metadata/%s/db.zst.age", snapshotID)
 	log.Info("Downloading encrypted database", "path", dbPath)
 	if !opts.JSON {
-		v.printfStdout("Downloading and decrypting database...\n")
+		v.Outputf("Downloading and decrypting database...\n")
 	}

 	dbReader, err := v.Storage.Get(v.ctx, dbPath)
@@ -155,8 +155,8 @@ func (v *Vaultik) RunDeepVerify(snapshotID string, opts *VerifyOptions) error {
 		"db_total_size", humanize.Bytes(uint64(totalSize)),
 	)
 	if !opts.JSON {
-		v.printfStdout("Database loaded: %d blobs (%s)\n", len(dbBlobs), humanize.Bytes(uint64(totalSize)))
-		v.printfStdout("Verifying manifest against database...\n")
+		v.Outputf("Database loaded: %d blobs (%s)\n", len(dbBlobs), humanize.Bytes(uint64(totalSize)))
+		v.Outputf("Verifying manifest against database...\n")
 	}

 	// Step 4: Verify manifest matches database
@@ -171,8 +171,8 @@ func (v *Vaultik) RunDeepVerify(snapshotID string, opts *VerifyOptions) error {

 	// Step 5: Verify all blobs exist in S3 (using database as source)
 	if !opts.JSON {
-		v.printfStdout("Manifest verified.\n")
-		v.printfStdout("Checking blob existence in remote storage...\n")
+		v.Outputf("Manifest verified.\n")
+		v.Outputf("Checking blob existence in remote storage...\n")
 	}
 	if err := v.verifyBlobExistenceFromDB(dbBlobs); err != nil {
 		result.Status = "failed"
@@ -185,8 +185,8 @@ func (v *Vaultik) RunDeepVerify(snapshotID string, opts *VerifyOptions) error {

 	// Step 6: Deep verification - download and verify blob contents
 	if !opts.JSON {
-		v.printfStdout("All blobs exist.\n")
-		v.printfStdout("Downloading and verifying blob contents (%d blobs, %s)...\n", len(dbBlobs), humanize.Bytes(uint64(totalSize)))
+		v.Outputf("All blobs exist.\n")
+		v.Outputf("Downloading and verifying blob contents (%d blobs, %s)...\n", len(dbBlobs), humanize.Bytes(uint64(totalSize)))
 	}
 	if err := v.performDeepVerificationFromDB(dbBlobs, tempDB.DB, opts); err != nil {
 		result.Status = "failed"
@@ -211,10 +211,10 @@ func (v *Vaultik) RunDeepVerify(snapshotID string, opts *VerifyOptions) error {
 		"blobs_verified", len(dbBlobs),
 	)

-	v.printfStdout("\n✓ Verification completed successfully\n")
-	v.printfStdout("  Snapshot:       %s\n", snapshotID)
-	v.printfStdout("  Blobs verified: %d\n", len(dbBlobs))
-	v.printfStdout("  Total size:     %s\n", humanize.Bytes(uint64(totalSize)))
+	v.Outputf("\n✓ Verification completed successfully\n")
+	v.Outputf("  Snapshot:       %s\n", snapshotID)
+	v.Outputf("  Blobs verified: %d\n", len(dbBlobs))
+	v.Outputf("  Total size:     %s\n", humanize.Bytes(uint64(totalSize)))

 	return nil
 }
@@ -569,7 +569,7 @@ func (v *Vaultik) performDeepVerificationFromDB(blobs []snapshot.BlobInfo, db *s
 		)

 		if !opts.JSON {
-			v.printfStdout("  Verified %d/%d blobs (%d remaining) - %s/%s - elapsed %s, eta %s\n",
+			v.Outputf("  Verified %d/%d blobs (%d remaining) - %s/%s - elapsed %s, eta %s\n",
 				i+1, len(blobs), remaining,
 				humanize.Bytes(uint64(bytesProcessed)),
 				humanize.Bytes(uint64(totalBytesExpected)),