Try to resolve a base64-url accessor UID to a username. Checks the share-objects cache (``vault/get_share_objects``), which includes every us

Resolve user names/IDs to user objects. Returns dict {user_id: user_node}

Write service_config content from a custom field to disk.

Restore tree selection to previously selected record or folder

Retrieve the public key for a gateway. This function calls the vault/get_ksm_public_keys API to retrieve the gateway's public key needed

Retry get_public_keys with the server-stored canonical email.

Map RGB (0-255) to ANSI color code (0-15)

Run a single extend batch and capture per-record results. Parses stdout from the extend command to determine which records were creat

Safely convert string to integer with validation.

Recursively sanitize nested data structures

Save configuration as JSON.

Save configuration as YAML.

Search Nested Share Folders by name.

Search for existing PAM User records by login username. This is critical for Azure AD which only allows ONE PAM User per Azure AD us

Search records with smart partial matching. Returns set of matching record UIDs. Search logic: - Tokenizes query by

Search vault for records that might contain a DB password.

Select a specific record in the tree by its UID

Select the word at the mouse position.

Send welcome email with credentials using existing onboarding template. Args: config: Configuration dict sha

Send the complete Guacamole handshake response. Args: args_list: List of parameter names from guacd's 'args' instruction

Send a single ICE candidate immediately via HTTP POST to /send_controller_message Always sends candidates as {"candidates": [candidate]} arra

Send a keep-alive nop instruction.

Emit a key press followed by a key release.

Send *typed_records* to a regular shared folder via ``vault/records_add``.

Send *typed_records* to a nested_share_folder via ``vault/records/v3/add``.

Send onboarding email with one-time share URL. Args: params: KeeperParams session email_config_name: Email c

Send ICE restart offer via HTTP POST to /send_controller_message with encryption Similar to _send_ice_candidate_immediately but sends an offe

Send verification request to Keeper API

Set folder context for deletion object.

Set folder UID if present and valid.

Set max instances for the newly created gateway.

Set parent folder context for folder deletion.

Legacy direct DAG-write path: disconnect-old-then-link. Used as fallback only.

Legacy direct DAG-write path for JIT settings. See AI-settings analog for shape.

Legacy direct DAG-write path. Used as fallback when configure_resource is denied. Loads the resource's DAG, deactivates any prior `ai_settings` e

Set Touch ID access control for stored credential

Check and setup device registration, persistent login, and timeout

Setup legacy mode with v1 API endpoints.

Setup queue mode with native v2 and synchronous v1 compatibility endpoints.

Share the folder with the KSM app

Show error messages for failed device actions.

Show error messages for failed device rename.

Show error messages for failed device admin actions.

Show user-friendly success messages for device actions.

Show user-friendly success messages for device rename.

Show user-friendly success messages for device admin actions.

Start CLI session using PythonHandler protocol mode. In PythonHandler mode: - Python initiates connection via tube_registry.

Start Cloudflare tunnel using cloudflared binary.

Start the spinner animation in the shell prompt.

Stop all active tunnels (in-process and cross-process).

Stop sending keep-alive pings.

Store config.json content as a custom field (fallback when no file storage plan).

Store placeholder credential ID if storage is available

Store credential with Touch ID access control

Map CRLF to LF across Guacamole STDOUT **blob** boundaries. A single per-blob CRLF→LF replace misses a carriage return at the end of one blo

Drop noisy PAM fields (pamHostname, pamSettings, trafficEncryptionSeed, checkbox:*) from the legacy ``get`` output, including multi-line dict

Silence the harmless ``Executor shutdown has been called`` tracebacks.

Single-stream sync against the legacy `/sync` endpoint.

Sync password to cloud provider using PAM configuration. Args: params: KeeperParams session record: TypedRec

Returns (passed, detail, ms).

Returns (passed, detail, ms, ext_ip).

Send unauthenticated TURN Allocate; expect 401 = reachable.

Returns (reachable, ms). Timeout = no ICMP unreachable = assumed open.

Returns (passed, detail, ms, ext_ip).

HTTP Upgrade probe — any 4xx means the server is reachable.

Try all applicable methods to decrypt a single record key entry. Returns decrypted key bytes or None.

Try every available user key (symmetric then asymmetric). Returns plaintext or None.

Serialise a TypedRecord to the dict format expected by the v3 record API.