@datasynx/agentic-ai-cartography 0.9.2 → 1.1.0

package/dist/cli.js

@@ -12,6 +12,7 @@ import {
   IS_MAC,
   IS_WIN,
   PLATFORM,
+  cleanupTempFiles,
   commandExists,
   dbScanDirs,
   findFiles,
@@ -20,7 +21,7 @@ import {
   scanAllHistory,
   scanWindowsDbServices,
   scanWindowsPrograms
-} from "./chunk-3NVQ3ND6.js";
+} from "./chunk-QKNYI3SU.js";
 
 // src/cli.ts
 import { Command } from "commander";
@@ -66,6 +67,83 @@ function checkPrerequisites() {
 import Database from "better-sqlite3";
 import { mkdirSync } from "fs";
 import { dirname } from "path";
+import { z } from "zod";
+var SessionRowSchema = z.object({
+  id: z.string(),
+  mode: z.literal("discover"),
+  started_at: z.string(),
+  completed_at: z.string().nullable().optional(),
+  config: z.string()
+});
+var NodeRowSchema = z.object({
+  id: z.string(),
+  session_id: z.string(),
+  type: z.enum(NODE_TYPES),
+  name: z.string(),
+  discovered_via: z.string().nullable().optional(),
+  discovered_at: z.string(),
+  path_id: z.string().nullable().optional(),
+  depth: z.number().default(0),
+  confidence: z.number().default(0.5),
+  metadata: z.string().default("{}"),
+  tags: z.string().default("[]"),
+  domain: z.string().nullable().optional(),
+  sub_domain: z.string().nullable().optional(),
+  quality_score: z.number().nullable().optional()
+});
+var EdgeRowSchema = z.object({
+  id: z.string(),
+  session_id: z.string(),
+  source_id: z.string(),
+  target_id: z.string(),
+  relationship: z.enum(EDGE_RELATIONSHIPS),
+  evidence: z.string().nullable().optional(),
+  confidence: z.number().default(0.5),
+  discovered_at: z.string()
+});
+var EventRowSchema = z.object({
+  id: z.string(),
+  session_id: z.string(),
+  task_id: z.string().nullable().optional(),
+  timestamp: z.string(),
+  event_type: z.string(),
+  process: z.string(),
+  pid: z.number(),
+  target: z.string().nullable().optional(),
+  target_type: z.string().nullable().optional(),
+  port: z.number().nullable().optional(),
+  duration_ms: z.number().nullable().optional()
+});
+var TaskRowSchema = z.object({
+  id: z.string(),
+  session_id: z.string(),
+  description: z.string().nullable().optional(),
+  started_at: z.string(),
+  completed_at: z.string().nullable().optional(),
+  steps: z.string().default("[]"),
+  involved_services: z.string().default("[]"),
+  status: z.enum(["active", "completed", "cancelled"])
+});
+var WorkflowRowSchema = z.object({
+  id: z.string(),
+  session_id: z.string(),
+  name: z.string().nullable().optional(),
+  pattern: z.string(),
+  task_ids: z.string().default("[]"),
+  occurrences: z.number().default(1),
+  first_seen: z.string(),
+  last_seen: z.string(),
+  avg_duration_ms: z.number().nullable().optional(),
+  involved_services: z.string().default("[]")
+});
+var ConnectionRowSchema = z.object({
+  id: z.string(),
+  session_id: z.string(),
+  source_asset_id: z.string(),
+  target_asset_id: z.string(),
+  type: z.string().nullable().optional(),
+  created_at: z.string()
+});
 var SCHEMA = `
 PRAGMA journal_mode = WAL;
 PRAGMA foreign_keys = ON;
@@ -230,12 +308,13 @@ var CartographyDB = class {
     return rows.map((r) => this.mapSession(r));
   }
   mapSession(r) {
+    const v = SessionRowSchema.parse(r);
     return {
-      id: r["id"],
-      mode: r["mode"],
-      startedAt: r["started_at"],
-      completedAt: r["completed_at"] ?? void 0,
-      config: r["config"]
+      id: v.id,
+      mode: v.mode,
+      startedAt: v.started_at,
+      completedAt: v.completed_at ?? void 0,
+      config: v.config
     };
   }
   // ── Nodes ───────────────────────────────
@@ -266,21 +345,22 @@ var CartographyDB = class {
     return rows.map((r) => this.mapNode(r));
   }
   mapNode(r) {
+    const v = NodeRowSchema.parse(r);
     return {
-      id: r["id"],
-      sessionId: r["session_id"],
-      type: r["type"],
-      name: r["name"],
-      discoveredVia: r["discovered_via"],
-      discoveredAt: r["discovered_at"],
-      depth: r["depth"],
-      confidence: r["confidence"],
-      metadata: JSON.parse(r["metadata"]),
-      tags: JSON.parse(r["tags"]),
-      pathId: r["path_id"],
-      domain: r["domain"] ?? void 0,
-      subDomain: r["sub_domain"] ?? void 0,
-      qualityScore: r["quality_score"] ?? void 0
+      id: v.id,
+      sessionId: v.session_id,
+      type: v.type,
+      name: v.name,
+      discoveredVia: v.discovered_via ?? "",
+      discoveredAt: v.discovered_at,
+      depth: v.depth,
+      confidence: v.confidence,
+      metadata: JSON.parse(v.metadata),
+      tags: JSON.parse(v.tags),
+      pathId: v.path_id ?? void 0,
+      domain: v.domain ?? void 0,
+      subDomain: v.sub_domain ?? void 0,
+      qualityScore: v.quality_score ?? void 0
     };
   }
   deleteNode(sessionId, nodeId) {
@@ -309,16 +389,19 @@ var CartographyDB = class {
   }
   getEdges(sessionId) {
     const rows = this.db.prepare("SELECT * FROM edges WHERE session_id = ?").all(sessionId);
-    return rows.map((r) => ({
-      id: r["id"],
-      sessionId: r["session_id"],
-      sourceId: r["source_id"],
-      targetId: r["target_id"],
-      relationship: r["relationship"],
-      evidence: r["evidence"],
-      confidence: r["confidence"],
-      discoveredAt: r["discovered_at"]
-    }));
+    return rows.map((r) => {
+      const v = EdgeRowSchema.parse(r);
+      return {
+        id: v.id,
+        sessionId: v.session_id,
+        sourceId: v.source_id,
+        targetId: v.target_id,
+        relationship: v.relationship,
+        evidence: v.evidence ?? "",
+        confidence: v.confidence,
+        discoveredAt: v.discovered_at
+      };
+    });
   }
   // ── Events ──────────────────────────────
   insertEvent(sessionId, event, taskId) {
@@ -342,19 +425,22 @@ var CartographyDB = class {
   }
   getEvents(sessionId, since) {
     const rows = since ? this.db.prepare("SELECT * FROM activity_events WHERE session_id = ? AND timestamp > ? ORDER BY timestamp").all(sessionId, since) : this.db.prepare("SELECT * FROM activity_events WHERE session_id = ? ORDER BY timestamp").all(sessionId);
-    return rows.map((r) => ({
-      id: r["id"],
-      sessionId: r["session_id"],
-      taskId: r["task_id"],
-      timestamp: r["timestamp"],
-      eventType: r["event_type"],
-      process: r["process"],
-      pid: r["pid"],
-      target: r["target"],
-      targetType: r["target_type"],
-      port: r["port"],
-      durationMs: r["duration_ms"]
-    }));
+    return rows.map((r) => {
+      const v = EventRowSchema.parse(r);
+      return {
+        id: v.id,
+        sessionId: v.session_id,
+        taskId: v.task_id ?? void 0,
+        timestamp: v.timestamp,
+        eventType: v.event_type,
+        process: v.process,
+        pid: v.pid,
+        target: v.target ?? void 0,
+        targetType: v.target_type ?? void 0,
+        port: v.port ?? void 0,
+        durationMs: v.duration_ms ?? void 0
+      };
+    });
   }
   // ── Tasks ───────────────────────────────
   startTask(sessionId, description) {
@@ -388,15 +474,16 @@ var CartographyDB = class {
     return rows.map((r) => this.mapTask(r));
   }
   mapTask(r) {
+    const v = TaskRowSchema.parse(r);
     return {
-      id: r["id"],
-      sessionId: r["session_id"],
-      description: r["description"],
-      startedAt: r["started_at"],
-      completedAt: r["completed_at"],
-      steps: r["steps"],
-      involvedServices: r["involved_services"],
-      status: r["status"]
+      id: v.id,
+      sessionId: v.session_id,
+      description: v.description ?? void 0,
+      startedAt: v.started_at,
+      completedAt: v.completed_at ?? void 0,
+      steps: v.steps,
+      involvedServices: v.involved_services,
+      status: v.status
     };
   }
   // ── Workflows ───────────────────────────
@@ -422,18 +509,21 @@ var CartographyDB = class {
   }
   getWorkflows(sessionId) {
     const rows = this.db.prepare("SELECT * FROM workflows WHERE session_id = ?").all(sessionId);
-    return rows.map((r) => ({
-      id: r["id"],
-      sessionId: r["session_id"],
-      name: r["name"],
-      pattern: r["pattern"],
-      taskIds: r["task_ids"],
-      occurrences: r["occurrences"],
-      firstSeen: r["first_seen"],
-      lastSeen: r["last_seen"],
-      avgDurationMs: r["avg_duration_ms"],
-      involvedServices: r["involved_services"]
-    }));
+    return rows.map((r) => {
+      const v = WorkflowRowSchema.parse(r);
+      return {
+        id: v.id,
+        sessionId: v.session_id,
+        name: v.name ?? void 0,
+        pattern: v.pattern,
+        taskIds: v.task_ids,
+        occurrences: v.occurrences,
+        firstSeen: v.first_seen,
+        lastSeen: v.last_seen,
+        avgDurationMs: v.avg_duration_ms ?? 0,
+        involvedServices: v.involved_services
+      };
+    });
   }
   // ── Connections (user-created hex map links) ─────────────────────────────
   upsertConnection(sessionId, conn) {
@@ -450,14 +540,17 @@ var CartographyDB = class {
   }
   getConnections(sessionId) {
     const rows = this.db.prepare("SELECT * FROM connections WHERE session_id = ?").all(sessionId);
-    return rows.map((r) => ({
-      id: r["id"],
-      sessionId: r["session_id"],
-      sourceAssetId: r["source_asset_id"],
-      targetAssetId: r["target_asset_id"],
-      type: r["type"] ?? void 0,
-      createdAt: r["created_at"]
-    }));
+    return rows.map((r) => {
+      const v = ConnectionRowSchema.parse(r);
+      return {
+        id: v.id,
+        sessionId: v.session_id,
+        sourceAssetId: v.source_asset_id,
+        targetAssetId: v.target_asset_id,
+        type: v.type ?? void 0,
+        createdAt: v.created_at
+      };
+    });
   }
   deleteConnection(sessionId, connectionId) {
     this.db.prepare("DELETE FROM connections WHERE session_id = ? AND id = ?").run(sessionId, connectionId);
@@ -472,6 +565,31 @@ var CartographyDB = class {
     const row = this.db.prepare("SELECT action FROM node_approvals WHERE pattern = ?").get(pattern);
     return row?.action;
   }
+  // ── Pruning ──────────────────────────────
+  /**
+   * Delete a session and all its associated data (nodes, edges, events, tasks, workflows, connections).
+   */
+  deleteSession(sessionId) {
+    this.db.prepare("DELETE FROM connections WHERE session_id = ?").run(sessionId);
+    this.db.prepare("DELETE FROM workflows WHERE session_id = ?").run(sessionId);
+    this.db.prepare("DELETE FROM activity_events WHERE session_id = ?").run(sessionId);
+    this.db.prepare("DELETE FROM tasks WHERE session_id = ?").run(sessionId);
+    this.db.prepare("DELETE FROM edges WHERE session_id = ?").run(sessionId);
+    this.db.prepare("DELETE FROM nodes WHERE session_id = ?").run(sessionId);
+    this.db.prepare("DELETE FROM sessions WHERE id = ?").run(sessionId);
+  }
+  /**
+   * Prune sessions older than the given ISO date string. Returns count of deleted sessions.
+   */
+  pruneSessions(olderThan) {
+    const rows = this.db.prepare(
+      "SELECT id FROM sessions WHERE started_at < ?"
+    ).all(olderThan);
+    for (const row of rows) {
+      this.deleteSession(row.id);
+    }
+    return rows.length;
+  }
   // ── Stats ───────────────────────────────
   getStats(sessionId) {
     const nodes = this.db.prepare("SELECT COUNT(*) as c FROM nodes WHERE session_id = ?").get(sessionId).c;
@@ -483,7 +601,23 @@ var CartographyDB = class {
 };
 
 // src/tools.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
+function createScanRunner(runFn, opts = {}) {
+  const threshold = opts.threshold ?? 3;
+  let consecutiveFailures = 0;
+  let tripped = false;
+  return (cmd) => {
+    if (tripped) return "(skipped \u2014 circuit breaker: too many consecutive failures)";
+    const result = runFn(cmd, { timeout: opts.timeout ?? 2e4, env: opts.env });
+    if (!result) {
+      consecutiveFailures++;
+      if (consecutiveFailures >= threshold) tripped = true;
+      return "(error or not available)";
+    }
+    consecutiveFailures = 0;
+    return result;
+  };
+}
 function stripSensitive(target) {
   try {
     const url = new URL(target.startsWith("http") ? target : `tcp://${target}`);
@@ -496,16 +630,16 @@ async function createCartographyTools(db, sessionId, opts = {}) {
   const { tool, createSdkMcpServer } = await import("@anthropic-ai/claude-agent-sdk");
   const tools = [
     tool("save_node", "Save an infrastructure node to the catalog", {
-      id: z.string(),
-      type: z.enum(NODE_TYPES),
-      name: z.string(),
-      discoveredVia: z.string(),
-      confidence: z.number().min(0).max(1),
-      metadata: z.record(z.string(), z.unknown()).optional(),
-      tags: z.array(z.string()).optional(),
-      domain: z.string().optional().describe('Business domain, e.g. "Marketing", "Finance"'),
-      subDomain: z.string().optional().describe('Sub-domain, e.g. "Forecast client orders"'),
-      qualityScore: z.number().min(0).max(100).optional().describe("Data quality score 0\u2013100")
+      id: z2.string(),
+      type: z2.enum(NODE_TYPES),
+      name: z2.string(),
+      discoveredVia: z2.string(),
+      confidence: z2.number().min(0).max(1),
+      metadata: z2.record(z2.string(), z2.unknown()).optional(),
+      tags: z2.array(z2.string()).optional(),
+      domain: z2.string().optional().describe('Business domain, e.g. "Marketing", "Finance"'),
+      subDomain: z2.string().optional().describe('Sub-domain, e.g. "Forecast client orders"'),
+      qualityScore: z2.number().min(0).max(100).optional().describe("Data quality score 0\u2013100")
     }, async (args) => {
       const node = {
         id: stripSensitive(args["id"]),
@@ -523,11 +657,11 @@ async function createCartographyTools(db, sessionId, opts = {}) {
       return { content: [{ type: "text", text: `\u2713 Node: ${node.id}` }] };
     }),
     tool("save_edge", "Save a relationship (edge) between two nodes \u2014 ALWAYS save edges when connections are clear", {
-      sourceId: z.string(),
-      targetId: z.string(),
-      relationship: z.enum(EDGE_RELATIONSHIPS),
-      evidence: z.string(),
-      confidence: z.number().min(0).max(1)
+      sourceId: z2.string(),
+      targetId: z2.string(),
+      relationship: z2.enum(EDGE_RELATIONSHIPS),
+      evidence: z2.string(),
+      confidence: z2.number().min(0).max(1)
     }, async (args) => {
       db.insertEdge(sessionId, {
         sourceId: args["sourceId"],
@@ -539,7 +673,7 @@ async function createCartographyTools(db, sessionId, opts = {}) {
       return { content: [{ type: "text", text: `\u2713 ${args["sourceId"]}\u2192${args["targetId"]}` }] };
     }),
     tool("get_catalog", "Get the current catalog \u2014 use before save_node to avoid duplicates", {
-      includeEdges: z.boolean().default(true)
+      includeEdges: z2.boolean().default(true)
     }, async (args) => {
       const nodes = db.getNodes(sessionId);
       const edges = args["includeEdges"] ? db.getEdges(sessionId) : [];
@@ -554,8 +688,8 @@ async function createCartographyTools(db, sessionId, opts = {}) {
       };
     }),
     tool("ask_user", "Ask the user a question \u2014 for clarifications, missing context, or consent (e.g. before scanning browser history)", {
-      question: z.string().describe("The question for the user (clear and specific)"),
-      context: z.string().optional().describe("Optional context explaining why this is relevant")
+      question: z2.string().describe("The question for the user (clear and specific)"),
+      context: z2.string().optional().describe("Optional context explaining why this is relevant")
     }, async (args) => {
       const question = args["question"];
       const context = args["context"];
@@ -568,7 +702,7 @@ async function createCartographyTools(db, sessionId, opts = {}) {
       };
     }),
     tool("scan_bookmarks", "Scan all browser bookmarks \u2014 hostnames only, no personal data (Chrome, Chromium, Edge, Brave, Vivaldi, Opera, Firefox)", {
-      minConfidence: z.number().min(0).max(1).default(0.5).optional()
+      minConfidence: z2.number().min(0).max(1).default(0.5).optional()
     }, async () => {
       const hosts = await scanAllBookmarks();
       return {
@@ -588,7 +722,7 @@ async function createCartographyTools(db, sessionId, opts = {}) {
       };
     }),
     tool("scan_browser_history", "Scan browser history \u2014 anonymized hostnames + visit frequency. ALWAYS call ask_user for consent before using this tool.", {
-      minVisits: z.number().min(1).default(3).optional().describe("Minimum visit count to include a host (filters rarely-visited sites)")
+      minVisits: z2.number().min(1).default(3).optional().describe("Minimum visit count to include a host (filters rarely-visited sites)")
     }, async (args) => {
       const minVisits = args["minVisits"] ?? 3;
       const hosts = await scanAllHistory();
@@ -610,7 +744,7 @@ async function createCartographyTools(db, sessionId, opts = {}) {
       };
     }),
     tool("scan_local_databases", "Scan for local database files and running DB servers \u2014 PostgreSQL databases, MySQL, SQLite files from installed apps", {
-      deep: z.boolean().default(false).optional().describe("Also search home directory recursively for SQLite/DB files (slower)")
+      deep: z2.boolean().default(false).optional().describe("Also search home directory recursively for SQLite/DB files (slower)")
     }, async (args) => {
       const deep = args["deep"] ?? false;
       const results = {};
@@ -682,14 +816,11 @@ ${v}`).join("\n\n");
       return { content: [{ type: "text", text: out }] };
     }),
     tool("scan_k8s_resources", "Scan Kubernetes cluster via kubectl \u2014 100% readonly (get, describe)", {
-      namespace: z.string().optional().describe("Filter by namespace \u2014 empty = all namespaces")
+      namespace: z2.string().optional().describe("Filter by namespace \u2014 empty = all namespaces")
     }, async (args) => {
       const ns = args["namespace"];
       const nsFlag = ns ? `-n ${ns}` : "--all-namespaces";
-      const runK = (cmd) => {
-        const r = run(cmd, { timeout: 15e3 });
-        return r || `(error or not available)`;
-      };
+      const runK = createScanRunner(run, { timeout: 15e3, threshold: 3 });
       const sections = IS_WIN ? [
         ["CONTEXT", "kubectl config current-context"],
         ["NODES", "kubectl get nodes -o wide"],
@@ -716,15 +847,15 @@ ${runK(c)}`).join("\n\n");
       return { content: [{ type: "text", text: out }] };
     }),
     tool("scan_aws_resources", "Scan AWS infrastructure via AWS CLI \u2014 100% readonly (describe, list)", {
-      region: z.string().optional().describe("AWS Region \u2014 default: AWS_DEFAULT_REGION or profile"),
-      profile: z.string().optional().describe("AWS CLI profile")
+      region: z2.string().optional().describe("AWS Region \u2014 default: AWS_DEFAULT_REGION or profile"),
+      profile: z2.string().optional().describe("AWS CLI profile")
     }, async (args) => {
       const region = args["region"];
       const profile = args["profile"];
       const env = { ...process.env };
       if (region) env["AWS_DEFAULT_REGION"] = region;
       const pf = profile ? `--profile ${profile}` : "";
-      const runAws = (cmd) => run(cmd, { timeout: 2e4, env }) || "(error or not available)";
+      const runAws = createScanRunner(run, { timeout: 2e4, env, threshold: 3 });
       const sections = [
         ["IDENTITY", `aws sts get-caller-identity ${pf} --output json`],
         ["EC2", `aws ec2 describe-instances ${pf} --query "Reservations[*].Instances[*].[InstanceId,InstanceType,State.Name,PublicIpAddress,PrivateIpAddress]" --output table`],
@@ -740,11 +871,11 @@ ${runAws(c)}`).join("\n\n");
       return { content: [{ type: "text", text: out }] };
     }),
     tool("scan_gcp_resources", "Scan Google Cloud Platform via gcloud CLI \u2014 100% readonly (list, describe)", {
-      project: z.string().optional().describe("GCP Project ID \u2014 default: current gcloud project")
+      project: z2.string().optional().describe("GCP Project ID \u2014 default: current gcloud project")
     }, async (args) => {
       const project = args["project"];
       const pf = project ? `--project ${project}` : "";
-      const runGcp = (cmd) => run(cmd, { timeout: 2e4 }) || "(error or not available)";
+      const runGcp = createScanRunner(run, { timeout: 2e4, threshold: 3 });
       const sections = [
         ["IDENTITY", `gcloud config list account --format="value(core.account)"`],
         ["COMPUTE_INSTANCES", `gcloud compute instances list ${pf}`],
@@ -761,14 +892,14 @@ ${runGcp(c)}`).join("\n\n");
       return { content: [{ type: "text", text: out }] };
     }),
     tool("scan_azure_resources", "Scan Azure infrastructure via az CLI \u2014 100% readonly (list, show)", {
-      subscription: z.string().optional().describe("Azure Subscription ID"),
-      resourceGroup: z.string().optional().describe("Filter by resource group")
+      subscription: z2.string().optional().describe("Azure Subscription ID"),
+      resourceGroup: z2.string().optional().describe("Filter by resource group")
     }, async (args) => {
       const sub = args["subscription"];
       const rg = args["resourceGroup"];
       const sf = sub ? `--subscription ${sub}` : "";
       const rf = rg ? `--resource-group ${rg}` : "";
-      const runAz = (cmd) => run(cmd, { timeout: 2e4 }) || "(error or not available)";
+      const runAz = createScanRunner(run, { timeout: 2e4, threshold: 3 });
       const sections = [
         ["IDENTITY", `az account show --output json ${sf}`],
         ["VMS", `az vm list ${sf} ${rf} --output table`],
@@ -785,7 +916,7 @@ ${runAz(c)}`).join("\n\n");
       return { content: [{ type: "text", text: out }] };
     }),
     tool("scan_installed_apps", "Scan all installed apps and tools \u2014 IDEs, office, dev tools, business apps, databases", {
-      searchHint: z.string().optional().describe('Optional search term to find specific tools (e.g. "hubspot windsurf cursor")')
+      searchHint: z2.string().optional().describe('Optional search term to find specific tools (e.g. "hubspot windsurf cursor")')
     }, async (args) => {
       const hint = args["searchHint"];
       const results = {};
@@ -1109,68 +1240,81 @@ Then scan_local_databases() for database servers and SQLite files.
 Then systematically scan local services, then config files.
 Finally, map all edges (Step 8 \u2014 critical!) before finishing.
 Use ask_user when you need context from the user.`;
+  const MAX_DISCOVERY_MS = 30 * 60 * 1e3;
   let turnCount = 0;
-  for await (const msg of query({
-    prompt: initialPrompt,
-    options: {
-      model: config.agentModel,
-      maxTurns: config.maxTurns,
-      systemPrompt,
-      mcpServers: { cartography: tools },
-      allowedTools: [
-        "Bash",
-        "mcp__cartograph__save_node",
-        "mcp__cartograph__save_edge",
-        "mcp__cartograph__get_catalog",
-        "mcp__cartograph__scan_bookmarks",
-        "mcp__cartograph__scan_browser_history",
-        "mcp__cartograph__scan_installed_apps",
-        "mcp__cartograph__scan_local_databases",
-        "mcp__cartograph__scan_k8s_resources",
-        "mcp__cartograph__scan_aws_resources",
-        "mcp__cartograph__scan_gcp_resources",
-        "mcp__cartograph__scan_azure_resources",
-        "mcp__cartograph__ask_user"
-      ],
-      hooks: {
-        PreToolUse: [{ matcher: "Bash", hooks: [safetyHook] }]
-      },
-      permissionMode: "bypassPermissions"
-    }
-  })) {
-    if (!onEvent) continue;
-    if (msg.type === "assistant") {
-      turnCount++;
-      onEvent({ kind: "turn", turn: turnCount });
-      for (const block of msg.message.content) {
-        if (block.type === "text") {
-          onEvent({ kind: "thinking", text: block.text });
-        }
-        if (block.type === "tool_use") {
-          onEvent({
-            kind: "tool_call",
-            tool: block.name,
-            input: block.input
-          });
+  try {
+    const startTime = Date.now();
+    for await (const msg of query({
+      prompt: initialPrompt,
+      options: {
+        model: config.agentModel,
+        maxTurns: config.maxTurns,
+        systemPrompt,
+        mcpServers: { cartography: tools },
+        allowedTools: [
+          "Bash",
+          "mcp__cartograph__save_node",
+          "mcp__cartograph__save_edge",
+          "mcp__cartograph__get_catalog",
+          "mcp__cartograph__scan_bookmarks",
+          "mcp__cartograph__scan_browser_history",
+          "mcp__cartograph__scan_installed_apps",
+          "mcp__cartograph__scan_local_databases",
+          "mcp__cartograph__scan_k8s_resources",
+          "mcp__cartograph__scan_aws_resources",
+          "mcp__cartograph__scan_gcp_resources",
+          "mcp__cartograph__scan_azure_resources",
+          "mcp__cartograph__ask_user"
+        ],
+        hooks: {
+          PreToolUse: [{ matcher: "Bash", hooks: [safetyHook] }]
+        },
+        permissionMode: "bypassPermissions"
+      }
+    })) {
+      if (Date.now() - startTime > MAX_DISCOVERY_MS) {
+        onEvent?.({ kind: "error", text: `Discovery timeout after ${MAX_DISCOVERY_MS / 6e4} minutes` });
+        onEvent?.({ kind: "done" });
+        return;
+      }
+      if (!onEvent) continue;
+      if (msg.type === "assistant") {
+        turnCount++;
+        onEvent({ kind: "turn", turn: turnCount });
+        for (const block of msg.message.content) {
+          if (block.type === "text") {
+            onEvent({ kind: "thinking", text: block.text });
+          }
+          if (block.type === "tool_use") {
+            onEvent({
+              kind: "tool_call",
+              tool: block.name,
+              input: block.input
+            });
+          }
         }
       }
-    }
-    if (msg.type === "user") {
-      const content = msg.message?.content;
-      if (Array.isArray(content)) {
-        for (const block of content) {
-          if (typeof block === "object" && block !== null && "type" in block && block.type === "tool_result") {
-            const tb = block;
-            const text = typeof tb.content === "string" ? tb.content : "";
-            onEvent({ kind: "tool_result", tool: tb.tool_use_id ?? "", output: text });
+      if (msg.type === "user") {
+        const content = msg.message?.content;
+        if (Array.isArray(content)) {
+          for (const block of content) {
+            if (typeof block === "object" && block !== null && "type" in block && block.type === "tool_result") {
+              const tb = block;
+              const text = typeof tb.content === "string" ? tb.content : "";
+              onEvent({ kind: "tool_result", tool: tb.tool_use_id ?? "", output: text });
+            }
           }
         }
       }
+      if (msg.type === "result") {
+        onEvent({ kind: "done" });
+        return;
+      }
     }
-    if (msg.type === "result") {
-      onEvent({ kind: "done" });
-      return;
-    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    onEvent?.({ kind: "error", text: `Discovery error: ${message}` });
+    throw err;
   }
 }
 
@@ -2704,6 +2848,33 @@ function exportAll(db, sessionId, outputDir, formats = ["mermaid", "json", "yaml
 import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
 import { resolve } from "path";
 import { createInterface } from "readline";
+
+// src/logger.ts
+var verboseMode = false;
+function setVerbose(v) {
+  verboseMode = v;
+}
+function log(level, message, context) {
+  if (level === "DEBUG" && !verboseMode) return;
+  const entry = {
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    level,
+    message,
+    ...context && Object.keys(context).length > 0 ? { context } : {}
+  };
+  process.stderr.write(JSON.stringify(entry) + "\n");
+}
+function logInfo(message, context) {
+  log("INFO", message, context);
+}
+function logWarn(message, context) {
+  log("WARN", message, context);
+}
+function logError(message, context) {
+  log("ERROR", message, context);
+}
+
+// src/cli.ts
 var bold = (s) => `\x1B[1m${s}\x1B[0m`;
 var dim = (s) => `\x1B[2m${s}\x1B[0m`;
 var cyan = (s) => `\x1B[36m${s}\x1B[0m`;
@@ -2713,23 +2884,60 @@ var magenta = (s) => `\x1B[35m${s}\x1B[0m`;
 var red = (s) => `\x1B[31m${s}\x1B[0m`;
 main();
 function main() {
+  let activeDb = null;
+  const shutdown = (signal) => {
+    logWarn(`Received ${signal}, shutting down gracefully\u2026`);
+    if (activeDb) {
+      try {
+        activeDb.close();
+      } catch {
+      }
+      activeDb = null;
+    }
+    process.exit(signal === "SIGINT" ? 130 : 0);
+  };
+  process.on("SIGTERM", () => shutdown("SIGTERM"));
+  process.on("SIGINT", () => shutdown("SIGINT"));
+  cleanupTempFiles();
   const program = new Command();
   const CMD = "datasynx-cartography";
-  const VERSION = "0.7.0";
+  const VERSION = "1.0.1";
   program.name(CMD).description("AI-powered Infrastructure Discovery & Agentic AI Cartography").version(VERSION);
   program.command("discover").description("Scan and map your infrastructure").option("--entry <hosts...>", "Entry points", ["localhost"]).option("--depth <n>", "Max crawl depth", "8").option("--max-turns <n>", "Max agent turns", "50").option("--model <m>", "Agent model", "claude-sonnet-4-5-20250929").option("--org <name>", "Organization name (for Backstage)").option("-o, --output <dir>", "Output directory", "./datasynx-output").option("--db <path>", "DB path").option("-v, --verbose", "Show agent reasoning", false).action(async (opts) => {
     checkPrerequisites();
+    const parsedDepth = parseInt(opts.depth, 10);
+    const parsedMaxTurns = parseInt(opts.maxTurns, 10);
+    if (Number.isNaN(parsedDepth) || parsedDepth < 1 || parsedDepth > 50) {
+      process.stderr.write(`\u274C Invalid --depth: "${opts.depth}" (must be 1\u201350)
+`);
+      process.exitCode = 2;
+      return;
+    }
+    if (Number.isNaN(parsedMaxTurns) || parsedMaxTurns < 1 || parsedMaxTurns > 500) {
+      process.stderr.write(`\u274C Invalid --max-turns: "${opts.maxTurns}" (must be 1\u2013500)
+`);
+      process.exitCode = 2;
+      return;
+    }
+    setVerbose(opts.verbose);
     const config = defaultConfig({
       entryPoints: opts.entry,
-      maxDepth: parseInt(opts.depth, 10),
-      maxTurns: parseInt(opts.maxTurns, 10),
+      maxDepth: parsedDepth,
+      maxTurns: parsedMaxTurns,
       agentModel: opts.model,
       organization: opts.org,
       outputDir: opts.output,
       ...opts.db ? { dbPath: opts.db } : {},
       verbose: opts.verbose
     });
+    logInfo("Discovery started", {
+      entryPoints: config.entryPoints,
+      model: config.agentModel,
+      maxTurns: config.maxTurns,
+      maxDepth: config.maxDepth
+    });
     const db = new CartographyDB(config.dbPath);
+    activeDb = db;
     const sessionId = db.createSession("discover", config);
     const w = process.stderr.write.bind(process.stderr);
     const SPINNER = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
@@ -2857,10 +3065,13 @@ function main() {
       await runDiscovery(config, db, sessionId, handleEvent, onAskUser, void 0);
     } catch (err) {
       stopSpinner();
+      const errMsg = err instanceof Error ? err.message : String(err);
+      logError("Discovery failed", { sessionId, error: errMsg });
       w(`
-  ${bold("\x1B[31m\u2717\x1B[0m")}  Discovery failed: ${err}
+  ${bold("\x1B[31m\u2717\x1B[0m")}  Discovery failed: ${errMsg}
 `);
       db.close();
+      activeDb = null;
       process.exitCode = 1;
       return;
     }
@@ -2868,6 +3079,12 @@ function main() {
     db.endSession(sessionId);
     const stats = db.getStats(sessionId);
     const totalSec = ((Date.now() - startTime) / 1e3).toFixed(1);
+    logInfo("Discovery completed", {
+      sessionId,
+      nodes: stats.nodes,
+      edges: stats.edges,
+      durationSec: parseFloat(totalSec)
+    });
     w("\n");
     w(dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n"));
     w(`  ${green(bold("DONE"))}  ${bold(String(stats.nodes))} nodes, ${bold(String(stats.edges))} edges  ${dim("in " + totalSec + "s")}
@@ -3324,7 +3541,7 @@ ${infraSummary.substring(0, 12e3)}`;
     out("\n");
   });
   program.command("bookmarks").description("View all browser bookmarks (Chrome, Chromium, Edge, Brave, Vivaldi, Opera, Firefox)").action(async () => {
-    const { scanAllBookmarks: scanAllBookmarks2 } = await import("./bookmarks-72CDYAHD.js");
+    const { scanAllBookmarks: scanAllBookmarks2 } = await import("./bookmarks-BWNVQGPG.js");
     const out = (s) => process.stdout.write(s);
     process.stderr.write("  Scanning bookmarks...\n\n");
     const hosts = await scanAllBookmarks2();
@@ -3583,6 +3800,40 @@ ${infraSummary.substring(0, 12e3)}`;
       process.exitCode = 1;
     }
   });
+  program.command("prune").description("Delete old sessions and their data").option("--older-than <days>", "Delete sessions older than N days", "30").option("--db <path>", "DB path").option("--dry-run", "Show what would be deleted without actually deleting", false).action((opts) => {
+    const days = parseInt(opts.olderThan, 10);
+    if (Number.isNaN(days) || days < 1) {
+      process.stderr.write(`Invalid --older-than: "${opts.olderThan}" (must be >= 1)
+`);
+      process.exitCode = 2;
+      return;
+    }
+    const config = defaultConfig({ ...opts.db ? { dbPath: opts.db } : {} });
+    const db = new CartographyDB(config.dbPath);
+    const cutoff = new Date(Date.now() - days * 24 * 60 * 60 * 1e3).toISOString();
+    const sessions = db.getSessions().filter((s) => s.startedAt < cutoff);
+    if (sessions.length === 0) {
+      process.stderr.write(`No sessions older than ${days} days.
+`);
+      db.close();
+      return;
+    }
+    if (opts.dryRun) {
+      process.stderr.write(`Would delete ${sessions.length} session(s) older than ${days} days:
+`);
+      for (const s of sessions) {
+        const stats = db.getStats(s.id);
+        process.stderr.write(`  ${s.id.substring(0, 8)}  ${s.startedAt.substring(0, 19)}  nodes:${stats.nodes} edges:${stats.edges}
+`);
+      }
+    } else {
+      const deleted = db.pruneSessions(cutoff);
+      logInfo("Sessions pruned", { deleted, olderThanDays: days });
+      process.stderr.write(`Deleted ${deleted} session(s) older than ${days} days.
+`);
+    }
+    db.close();
+  });
   const o = (s) => process.stderr.write(s);
   const _b = (s) => `\x1B[1m${s}\x1B[0m`;
   const _d = (s) => `\x1B[2m${s}\x1B[0m`;