Remove a tunnel session by tube_id (thread-safe)

True when stored rotation schedule matches PAM config default (Web Vault parity).

Validate command list against available Keeper Commander commands.

Validate domain name format. Args: domain: Domain name to validate require_tld: If True, requires a

Validate file path to prevent directory traversal attacks. Args: file_path (str): Path to validate base_dir (str, option

Initialize a TunnelError. Args: message: Description of the tunnel error. code: Optional Guacamole status co

Reconstruct the CLI command from kwargs, redacting secrets.

Patch the response-builder so we can assert on outbound SharedRecord protos.

Close the shell pane and return to normal view

Coerce enforcement values to int. Server-side enforcement payloads sometimes serialize numeric fields as strings. Returns None if the value c

Converts on/off/default|any to True/False/None

Create AD user via Gateway's rm-create-user action (KC-1035). Sends the create-user action to the PAM Gateway which calls Ac

Discover shared folder names from an existing PAM config's KSM app. Returns (resources_folder_name, users_folder_name) or (None, None).

Display folder details with clickable fields for copy-on-click

Display data in JSON format.

Encrypt a string value with the record key, return base64.

Extract Kubernetes-specific settings from pamSettings.connection (record JSON).

Extract SSH-specific settings from pamSettings.connection (record JSON).

TTL (seconds) for the (host, endpoint) feature-disabled cache. Default 300s (5 min). `KEEPER_DAG_LB_FEATURE_CACHE_TTL=0` disables caching ent

Get a Docker container's IP address from its network settings. Returns the first non-empty IP, or '' if unavailable.

Return the appropriate icon for a folder based on its type and sharing status. Icon mapping (matches Keeper desktop client): - Lega

Get record output using Commander's get command (cached for performance)

Clear module DPI cache when the TTL has expired.

Whether KEEPER_DAG_LB_FALLBACK env var opts INTO legacy fallback. **Default OFF (strict mode)** — the mature Layer-B endpoints (`configure_re

Build a minimal RouterRotationInfo mock.

Mock for the underlying Connection that discovery_common uses.

Interactive gateway selection. Returns PAM config UID or None. Flow: --gateway <uid/name> → find matching gateway, find its config

Validate inputs and resolve record_key + config_uid. Returns (record_key, config_uid) or None on failure. Shared by the new and legacy paths so b

Run execute() with AWS internals mocked. *secret_meta* is a list of {'name', 'tags'} dicts (the normalised format returned b

True if logger name is from Rust/webrtc/turn so we treat its messages as DEBUG-only.

Send multiple ICE candidates in a single HTTP POST. The gateway already iterates ``for candidate in ice_candidates`` inside ``WebRTCS

Press modifiers, press+release main key, release modifiers (remote TTY paste).

Setup the folder tree structure with records as children

Share PAM User record directly to a user's vault (KC-1035). Uses ShareRecordCommand to grant vault-to-vault access. The recipient

Store DPI and refresh cache timestamp.

Update the user and device info displays in the search bar area

Validate delivery section (KC-1035: direct vault sharing).

Validate user section (employee information).

Log command errors and return True when execution must stop.

Build the ``docker-compose.yaml`` text for the playground.

Walk Nested Share Folder membership tables to collect record UIDs in *folder_uid*. Nested Share Folder does not store ``record_uids`` / ``childre

Create instance of class from rules string rule_string: comma separated integer character counts of [length,] uppercase, lowercase, numbers,

Decrypt AES-256 bytes. Allowed ciphers are: :ecb, :cbc. If for :ecb iv is not used and should be set to "".

Guesses AES cipher (EBC or CBD) from the length of the base64 encoded data.

DPI for Guacamole text-terminal handshake (matches ``screen_info['dpi']`` when mode is unset). Resolved from ``KEEPER_GUAC_PIXEL_MODE`` and :data

Encrypt *plaintext_key* with the recipient's public key.

Configure rotation settings for one or multiple PAM records. The command accepts either ``--record`` or ``--folder`` to target record

Launch the SuperShell TUI - handles login if needed

Fetch single account details including linkedAccounts. LinkedAccounts (logonAccount, reconcileAccount, enableAccount) are only availa

Fetch all CyberArk vault users (excluding component / service accounts). Returns a list of dicts: ``{"id", "username", "email", "type

Fetch the CyberArk Master Policy settings.