Rewrite known noisy server validation messages in place on each response dict.

Remove the registry file for a tunnel (defaults to current PID).

Remove a tunnel session by tube_id (thread-safe)

True when stored rotation schedule matches PAM config default (Web Vault parity).

Validate command list against available Keeper Commander commands.

Validate domain name format. Args: domain: Domain name to validate require_tld: If True, requires a

Validate file path to prevent directory traversal attacks. Args: file_path (str): Path to validate base_dir (str, option

Initialize a TunnelError. Args: message: Description of the tunnel error. code: Optional Guacamole status co

Reconstruct the CLI command from kwargs, redacting secrets.

Patch the response-builder so we can assert on outbound SharedRecord protos.

Close the shell pane and return to normal view

Converts on/off/default|any to True/False/None

Create AD user via Gateway's rm-create-user action (KC-1035). Sends the create-user action to the PAM Gateway which calls Ac

Discover shared folder names from an existing PAM config's KSM app. Returns (resources_folder_name, users_folder_name) or (None, None).

Display folder details with clickable fields for copy-on-click

Display data in JSON format.

Encrypt a string value with the record key, return base64.

Extract Kubernetes-specific settings from pamSettings.connection (record JSON).

Extract SSH-specific settings from pamSettings.connection (record JSON).

TTL (seconds) for the (host, endpoint) feature-disabled cache. Default 300s (5 min). `KEEPER_DAG_LB_FEATURE_CACHE_TTL=0` disables caching ent

Get a Docker container's IP address from its network settings. Returns the first non-empty IP, or '' if unavailable.

Return the appropriate icon for a folder based on its type and sharing status. Icon mapping (matches Keeper desktop client): - Lega

Get record output using Commander's get command (cached for performance)

Clear module DPI cache when the TTL has expired.

Whether KEEPER_DAG_LB_FALLBACK env var opts INTO legacy fallback. **Default OFF (strict mode)** — the mature Layer-B endpoints (`configure_re

Build a minimal RouterRotationInfo mock.

Mock for the underlying Connection that discovery_common uses.

Interactive gateway selection. Returns PAM config UID or None. Flow: --gateway <uid/name> → find matching gateway, find its config

Validate inputs and resolve record_key + config_uid. Returns (record_key, config_uid) or None on failure. Shared by the new and legacy paths so b

Run execute() with AWS internals mocked. *secret_meta* is a list of {'name', 'tags'} dicts (the normalised format returned b

True if logger name is from Rust/webrtc/turn so we treat its messages as DEBUG-only.

Send multiple ICE candidates in a single HTTP POST. The gateway already iterates ``for candidate in ice_candidates`` inside ``WebRTCS

Press modifiers, press+release main key, release modifiers (remote TTY paste).

Setup the folder tree structure with records as children

Share PAM User record directly to a user's vault (KC-1035). Uses ShareRecordCommand to grant vault-to-vault access. The recipient

Store DPI and refresh cache timestamp.

Update the user and device info displays in the search bar area

Validate delivery section (KC-1035: direct vault sharing).

Validate user section (employee information).

Log command errors and return True when execution must stop.

Walk Nested Share Folder membership tables to collect record UIDs in *folder_uid*. Nested Share Folder does not store ``record_uids`` / ``childre

Create instance of class from rules string rule_string: comma separated integer character counts of [length,] uppercase, lowercase, numbers,

Decrypt AES-256 bytes. Allowed ciphers are: :ecb, :cbc. If for :ecb iv is not used and should be set to "".

Guesses AES cipher (EBC or CBD) from the length of the base64 encoded data.

DPI for Guacamole text-terminal handshake (matches ``screen_info['dpi']`` when mode is unset). Resolved from ``KEEPER_GUAC_PIXEL_MODE`` and :data

Encrypt *plaintext_key* with the recipient's public key.

Launch the SuperShell TUI - handles login if needed

Fetch all CyberArk vault users (excluding component / service accounts). Returns a list of dicts: ``{"id", "username", "email", "type

Find existing config record by exact title match using vault search.

Find all top Shared Folders that will contain this record. Record can be in more than two folders by having a "link" which will present a