Store a config value in ~/.arkana/config.json.

Return a snapshot of all user-mutable state for persistence to a project overlay. Includes notes, tool history, artifacts, renames, custom ty

Launch the enrichment coordinator as a background daemon thread. Safe to call from any context (async or sync). If enrichment is disabled vi

Add or remove tags.

Apply the same metadata patch to many artifacts in one locked pass. Returns ``{artifact_id: updated_dict_or_None}``. Patch semantics

Update the function_count column after streaming inserts.

Validate query syntax without evaluating. Returns None on success, or an error message string on failure.

Validate sequence syntax without evaluating. Returns None on success, or an error message string on failure.

If an active on-disk project is bound, copy/link the artifact into it. Returns the new in-project path, or None if no real project is active

Post-hoc analysis of captured API calls for memory allocation patterns. Returns structured memory operation timeline and flags suspicious pattern

Apply search and sort to a file listing.

Return a JSON-serialisable summary of an artifact for tool responses.

Auto-recover from unmapped/exception errors on x64 by unwinding to caller. When a DLL function crashes on unmapped memory or an unhandled CPU exc

Build minimal but realistic PE binary bytes for tool testing.

Build a length-prefixed null-terminated string: uint32_le(len+1) | chars | null.

Build the NETReactorSlayer CLI command line (self-contained binary).

Build a small CFG around *target_addr* without a full-binary scan. Uses ``CFGFast(regions=..., function_starts=...)`` to restrict analysis to

Score and rank all functions synchronously. No MCP overhead. Returns a list of scored function dicts sorted by score descending. Used by the

Build rule-based next-action suggestions from current session state. Shared logic used by both suggest_next_action (full detail) and get_prog

Sample KB function count and error rate periodically during CFGFast. Writes snapshots to task metadata so the overtime loop can detect stalls

Core classification logic using the current state proxy.

Remove expired entries across all instances (caller must hold _global_lock). H3-v8: WeakSet iteration is safe — dead refs are automatically s

Extract and truncate API call entries from a speakeasy report.

Extract and truncate API call entries from a Speakeasy report.

Extract IOCs mentioned in analysis notes.

Extract IOCs from cached triage results.

Equality comparison with hex-aware coercion.

Compute similarity hashes synchronously. No MCP overhead.

Return a human-readable confidence label for a score.

Open an SSE session.

Open a streamable-http session.

Correlates string usage with Capa's behavioral findings by checking if a string's referencing function is also flagged by a Capa rule. Mo