Add pam launch with NSF support

[mtyagi-ks]

Summary

• Add the pam launch / pam l command to open an interactive terminal session to a PAM resource through the gateway (WebRTC + Guacamole), aligned with Web Vault launch behavior.
• Support classic vault and NSF records for lookup, credentials, and connection settings.
• Extend pam connection edit for NSF records and fix SSH private-key credential handling so launches work when auth is key-based (including empty password + PEM key).

What's included

pam launch

• Launch terminal protocols: ssh, telnet, mysql, postgresql, sql-server (and related machine/directory/database PAM types).
• Resolve the target by UID, path, title, or hostname substring; multi-match prompts on a TTY.
• Opens a secure WebRTC tunnel to the PAM gateway, then runs an interactive Guacamole CLI session in the local terminal.
• Credential options: linked pamUser, --credential, host override via --host / --host-record (when allowSupplyHost is set).
• Session options: --stdin (pipe mode), --normalize-crlf / -n, --scale, trickle ICE control (--no-trickle-ice).
• Workflow-aware flags when access control applies: --reason, --ticket, --auto-checkout, --wait, --wait-timeout.
• UX helpers: connect spinner, launch cache, terminal resize/reset, Windows console input handling.

Related fixes

• pam connection edit: load/save connection settings for NSF PAM records (not only classic vault).
• SSH credentials: accept keepersdk + compat TypedRecord types; correctly extract private keys so launch does not fail with “no usable auth” when the record has login + SSH key (and empty password).
• NSF metadata / record load paths used by launch and connection edit include custom fields where needed.

Usage examples

pam launch <record-uid-or-title>
pam launch prod-db --credential <pamUser-uid>
pam launch <uid> --host 10.0.0.5:22
pam launch <uid> -n --scale 100
pam connection edit <resource-uid> -c <config-uid> --connections on --protocol ssh --launch-user <pamUser-uid>

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​keeper-secrets-manager-core@​17.3.0
	pypi/​keeper-pam-webrtc-rs@​2.1.21

View full report