Common error handling for credential creation failures

Handle commands that produce no output but are successful.

Check if user has master password or alternate SSO master password. Args: params: KeeperParams instance

Initialize SecretsManager with proper error handling. Args: ksm_config_path (str): Path to KSM config file (optional) ks

True when input is on/off/default and resolves to default (remove key).

Return True if *accessor* matches the folder ownerInfo from sync-down.

Check if a field name indicates it contains sensitive data

Heuristically decide whether a CyberArk user dict is a service account. Accepts either the normalised dict produced by :meth:`CyberArkImporte

Return True if ``email`` looks like a real, non-CyberArk-internal mailbox.

Return normalised secret metadata: [{'name': str, 'tags': {k: v}}]. AWS tags are converted from the native list-of-dicts format

Load device info using the 'this-device' command

Load vault data from params

Load whoami info using the 'whoami' command

Audit log: existing_password was used. Takes only the UID by design; signature is enforced by a structural test to prevent log leakage.

Present the record as a pamUser with rotation configured (ROE-eligible).

Build a minimal project dict matching the structure process_data expects.

Build a successful RouterResponse wire payload.

Open the shell pane, optionally running a command immediately

True if a PAM connection clipboard flag is enabled; coerces JSON/string booleans.

For PAM machine record types only, return a valid pamSettings.connection.port if set.

Parse a RemoveResult's impact field into a dict — shared logic.

Parse 'HH:MM' to HHMM integer (hours*100 + minutes), e.g. '09:00' -> 900, '17:30' -> 1730.

Parse 'tree' command output into structured format.

Return allowed separators in Vault order (see getPasswordRules.ts).

Perform live search and update tree. Returns count of matching records.

Call set_record_rotation(recordUid=user_uid, noop=False) to permission-check an is_iam_user link write. Raises on permission denial; no fallba

Common authentication options preparation

Validate the request body and build the command to execute.

Common credential creation options preparation

Show a user-facing notice for an involuntary remote close. Stays silent for ``normal`` / ``client`` (user-initiated). Called from the inner `

Display folder permissions in a format similar to the legacy get command.

Return identifier for error messages: uid if present, else title, else login (for users).

Get the record from the Vault, normalize it, and return it. Since common code is using this method we want to flatten/abstract the K

Deep-copy JSON and replace password values with [REDACTED].

Refresh tokens if expired.

Render a complex (dict/list) key-value pair.

Render dict items for nested objects

Recursively render JSON object as clickable lines with syntax highlighting

Render list items for arrays

Render a key-value pair.

Render a single list item.

Render a single list item.

Raise CommandError if credentials are in the OS keychain rather than config.json.

Resolve a user/team identifier to (uid_bytes, label, access_type_enum).

Return the device private_key regardless of storage backend. When OS-native keychain storage is active, ``private_key`` is not presen

Resolve a single device identifier and handle multiple matches.

Submit immediate rotation request to sync password to target system. This submits a rotation job to sync the generated password stor

Run record-add with the API mocked; return the TypedRecord that would be saved.

Schedule the next keep-alive ping.

Send ack instruction for stream acknowledgment. Used by the instruction router to acknowledge pipe/blob instructions. Args:

Set expiration timestamp from expiration string (e.g., 5m, 24h, 7d). Returns True on success.

``tcgetattr``/``tcsetattr`` list: copy top-level list and the ``cc`` sub-list.

Submit a request to the queue, optionally waiting for the result.

Dispatch to legacy single-stream sync or per-graph multi-stream sync. When `read_endpoint` is set, the server uses the per-graph URL pattern

Convert a single GraphSyncResult protobuf into a SyncData pydantic model. Extracted so both single-`sync` and multi_sync code paths share

Try AES-256-GCM then AES-256-CBC with *sym_key*. Returns plaintext or None.

Validate the configuration structure.

Validate that required modules are available

Verify the authentication response with Keeper

Move cursor down (Vim j)

Move cursor up (Vim k)