Print long or short version

Write a string to the user on stdout

try to get a VM with few clients

Checks all usable guests, and whether they should have connectivity. If they don't, then mark them for deletion.

Creates guests until the pool has the allotted amount

Loops over 'unavailable' guests, and invokes qemu to destroy the corresponding domain

Checks recently-booted guests ('created' state), and whether they are accepting SSH or Telnet connections, which indicates they are r

Checks timed-out VMs and acquires lock to safely mark for deletion

Removes guests marked as destroyed (so no qemu domain existing) and simply removes their object from the list

Parse a ``&>`` / ``&>>`` token into (append, inline target). Returns None if the token is not an ``&>`` redirection. ``&>`` truncates

Redirect both stdout and stderr (``&>file`` == ``>file 2>&1``).

Handle one redirection token and append it to the ops list.

Return payload dict with one embed representing the event.

Build HTTP headers with authentication.

Run a function body with $1.. , $#, $@ and $* bound to ``args``. Only the positional parameters for this call ($1..$len(args)) are saved

Run one command in this capture shell and return its captured stdout. The command's words are expanded against the capture shell's live

Run statements in this capture shell, concatenating their stdout and honoring &&/|| short-circuit between them (a subshell's gate covers the

Remove expired entries from all keys.

Create a new backing file for a redirected output target.

Reproduce the production flow against a non-answering client. telnet_User -> willChain(ECHO); the client never answers, so the negoti

Hash and store the artifact on every exit path - called via addBoth. Artifact.close() computes the sha256 and renames the temp file to its

Convert a Cowrie ISO-8601 UTC timestamp (e.g. '2026-06-23T14:15:26.253618Z') to epoch milliseconds, the integer form OCSF uses for time field

Reconstruct bash's reported token for a misplaced ``(``. bash points at the ``(`` together with the run of non-space characters that

Evaluate a word to its final string, or None if it should be dropped. A word is dropped when it is exactly an unquoted reference to an unset

Parse a combined redirection token into (op, fd, inline target).

Walk the cached tree to find the entry at virtual_path. Follows T_LINK entries (both intermediate and terminal) up to a fixed depth, treating

Structure the request body for the LLM API. Anthropic Messages API requires the system prompt as a top-level parameter; OpenAI uses a

Format event into a simplified, readable message with Slack formatting

Start retrieving file over FTP

Returns True if the domain looks like a real DNS name.

Detect ``name ()`` at command position (the "()" lexes as LPAR RPAR, or as an empty subshell when separated by a space).

Build the transport.session.conn.transport chain insults expects.

Decide whether to create a fresh real file for redirection target.

Return the first file descriptor in ``op`` that exceeds the open-file limit, which bash rejects with "Bad file descriptor", or None.

Read ``pat[|pat]*)`` and return the raw pattern strings.

Parse a field specification like '1,3' or '2-4' or '1,3-' into ranges. Returns a list of (start, end) tuples where indices are 0-based.

Gather one simple command / pipeline up to the next statement end.

Pass data to the next command in the pipeline if present.

Resolve and ready an output file, returning metadata for writing.

Load stdin from a redirected file path into input_data.

Process a command by sending it to the LLM and writing the response to the terminal.

Process an exec command with the LLM and return the result. Used when commands are passed directly to SSH (e.g., ssh user@host 'comma

Send next queued item if not already sending.

Append parsed statements to ``cmdpending`` for sequential execution. A subshell is queued as one unit so its join operator (e.g. the || in

Quit FTP connection

Serialize the original Cowrie event to a compact JSON string for OCSF's raw_data field. The live event from Twisted carries internal bookkeep

Report a syntax error nested anywhere inside a subshell, since the whole line is rejected at parse time. Returns False once reported.

Remove keys with the oldest activity when tracker gets too large.

Reuse an existing backing file, truncating if needed.

``case WORD in PATTERN) BODY ;; ... esac`` -- first match wins.

``for VAR in WORDS; do BODY; done`` over the expanded word list.

``if COND; then BODY; [elif ...] [else ...] fi``.

``while COND; do BODY; done`` (``until`` inverts the test).

Select fields based on the parsed field specification.

Send request to the LLM API.

The join operator a separator implies: && / || keep their meaning; ``;``, a newline and ``&`` all sequence without gating.

Process redirection operations to build the FD table.

Drop tokens up to (not including) the next statement separator.

Start file retrieval