List every engagement on this machine, newest activity first.

Counts and metadata for the engagement. Call this first: it reports how many hosts, credentials, unvalidated credentials, successful and failed authentications, findings by status, open tasks, hosts with no service recorded, and entities carrying unverified values exist -- which tells you which further queries are worth making.

List entities of a type, optionally filtered. type is one of host, service, identity, credential, domain, share, artifact, web_endpoint. filter accepts {"validated": false} for credentials never successfully used, {"unverified": true} for entities whose values did not appear verbatim in the source, or any data field as an exact match.

Everything known about one entity, including its attributes, identity keys, relationships, authentication attempts, and the segments its evidence came from. Accepts an entity id, an identity key, or a plain name such as FILE01 or an IP address.

Search captured terminal output and entities for an exact value -- an IP address, hostname, username, filename, or secret. scope is segments, entities, or all.

The recorded terminal output of one segment, with its pane, timestamp, and exact raw byte range. Set raw=true to get the original bytes including escape sequences rather than the normalized text.

Trace a fact back to its evidence: the observations that support an entity or finding, and for each the segment, terminal, timestamp, and exact byte range it came from. This answers 'where did this credential come from'.

What happened recently, newest first: captured terminal activity with a preview of each segment. Use minutes for a relative window.

Authentication attempts and their outcomes. Filter by result ('success' or 'failure'), by target, or by credential id. This is what shows which credentials work where, and what has already been tried.

Findings, optionally filtered by status (candidate, confirmed, rejected, resolved). Automated extraction only ever creates candidates.

One finding with its affected entities and evidence references.

Tasks implied by engagement state, optionally filtered by status.

Record something the operator saw or concluded that is not in captured terminal output -- a note, a hypothesis, a credential seen inside a GUI, or a correction. kind is one of host, domain, service, identity, credential, auth_attempt, share, artifact, web_endpoint, observation, relationship, note, task, finding_candidate, or correction. Use kind='correction' with data={"separate": ["", ""]} to assert that two identity keys are NOT the same thing; the entities separate on the next rebuild. All writes are attributed to the operator or agent, never to extraction.

Set a finding's status or fields. Use status='confirmed' to accept a candidate and status='rejected' to dismiss it; a rejected finding is not recreated by later extraction.

Set a task's status or fields. status is open, in_progress, done, or dismissed; a dismissed task is not recreated by later extraction.