Emit error via callback (only once).

Ensure folder path exists, creating any missing folders. Args: folder_path: Materialized path format, e.g. '/security/detections/

Evaluate whether required secret names/keys are configured.

Execute a task.

Purely execute a task and manage the results. Prelude ------ - Before this point, we've already evaluated conditional branch

Extract error message from structured error format. The MCP proxy server returns errors as JSON: {"success": false, "error": "..."} This is a

Validate the authenticated user exists in Tracecat before issuing a session token.

Flatten nested secrets dict to KEY__SUBKEY format.

Check if a folder path exists.

Format list of dictionaries into csv table.

Generate a unique slug for an MCP integration.

Extract HTTPS base URL from MCP server URI.

Fetch manifest and build impl index (cached with TTL). This function handles its own DB session and caching via aiocache.

Get existing platform repo or create new one. The conftest pre-seeds platform registry for executor tests, so these tests need to handle the

Get the Redis client used for workflow file artifact metadata.

Ensure the Redis connection pool is initialized.

Build stream sink for this session.

Return True for expected writer-close errors during teardown.

Load repository module into memory. Args: repo_url (str): The URL of the repository module_name (str): The name of the

Create a test manifest with given action names.

Create a trigger node for the graph.

Normalize non-JSON-safe values from temporal exceptions.

Coerce row inputs to the expected SQL types.

Craft a targeted prompt to help the model satisfy the output_type.

Release a worker back to the pool. Decrements active_tasks and recycles the worker if it has completed max_tasks_per_worker and has n

Require case add-ons entitlement for reply/thread capabilities.

Resolve the logical preset ID for a session assignment.

Resolve MCP integrations into MCP server configs.

Resolve the pinned preset version for a session assignment.

Run alembic command with proper environment.

Remove dashes from GUID-like substrings within a URL.

Convert registry secret objects to public requirement metadata.

Create minimal metadata tables used by legacy internal rename helpers.

Get the Redis key for an organization's semaphore.

Serialize dropdown UUID values to strings for JSON transport.

Update last stream ID for reconnection support.

Set up a platform registry with the given actions.

Stream events from Redis until a stop condition is met. Continuously reads messages from the Redis stream and yields them as StreamEv

Build a Responses API message item with text content.

Return the deepest nested Temporal cause and best-effort message.

Update the field schema for a specific field. Args: field_id: The field name/id field_def: The field definition dict

Validate that the connection URL does not point to Tracecat's internal database. We only compare against the configured internal database endpoin

Return the expiry timestamp for a staged workflow artifact.

Serialize a workflow tag definition.

Register a callable to run after this session commits. The callable may be sync or async. If async, it will be scheduled onto the event loop

Extract the canonical Anthropic tool definition from a normalized tool.

Authenticate local email/password and enforce platform/org policy.

Build search attributes for scheduled workflows.

Build a complete venv with all dependencies and compress as tarball. This creates a portable venv tarball that can be extracted and used dire

Download blob with caching by SHA-256 hash. Uses content-addressed caching: the SHA-256 hash is the cache key since objects are immutable. Ca

Clear the current registry context.

Batch create multiple approval records.

Create a new agent preset scoped to the current workspace.

Create a custom scope for the organization. Args: name: Scope name in format resource:action description: Optional de