attenu-guard 0.4.0 → 0.5.0

package/dist/cjs/version.d.ts

@@ -6,5 +6,5 @@
  * itself imported BY index.ts, so index.ts cannot be the source: `guard.ts -> index.ts ->
  * guard.ts` would be circular. A one-constant leaf module has nothing to be circular with.
  */
-export declare const VERSION = "0.3.0";
+export declare const VERSION = "0.5.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/cjs/version.js

@@ -9,5 +9,5 @@ exports.VERSION = void 0;
  * itself imported BY index.ts, so index.ts cannot be the source: `guard.ts -> index.ts ->
  * guard.ts` would be circular. A one-constant leaf module has nothing to be circular with.
  */
-exports.VERSION = "0.3.0";
+exports.VERSION = "0.5.0";
 //# sourceMappingURL=version.js.map

package/dist/esm/adapters/langgraph.d.ts

@@ -51,6 +51,69 @@
  * adapter behaves exactly as it did before 0.9.0: no `capture`/`authorizedParams`, no
  * `recordOutcome` call. Every other framework adapter is unchanged in this release.
  *
+ * ## Adversarial review: the Python batch-1/batch-2 defect classes, checked against this
+ * adapter specifically (not assumed absent by analogy)
+ *
+ * The Python `attenu-guard` adapters went through two rounds of adversarial review that found
+ * several defect classes across their (many) framework adapters. This TS package ships exactly
+ * ONE adapter surface (this file — verified against `package.json`'s own `exports` map, which
+ * declares nothing besides `.` and `./adapters/langgraph`), so each class was checked against
+ * THIS adapter specifically, not inherited by assumption:
+ *
+ * - **Composable middleware / sibling short-circuit or retry** (a sibling wrapper positioned
+ *   closer to the tool body than this one, able to fabricate or repeat what it observes) — NOT
+ *   APPLICABLE. Verified directly against pinned `@langchain/core@1.2.9` and
+ *   `@langchain/langgraph@1.4.13` (installed and grepped, not read off documentation): zero
+ *   `"middleware"` hits anywhere near tool invocation in either package, and
+ *   `ToolNode.prototype.runTool` (`dist/prebuilt/tool_node.js`) calls `tool.invoke(toolCall,
+ *   runtime)` directly — `guardTool`'s `Proxy` IS what gets called, nothing sits between it and
+ *   `ToolNode`. Neither framework has a composable per-call hook chain the way LangChain-Python's
+ *   `create_agent(middleware=[...])` or AG2's `FunctionTool.register()` do.
+ * - **Double authorization via a second, independent gate** (e.g. Python's `claude_sdk`
+ *   adapter's `can_use_tool` calling `authorize()` a second time for the same call) — NOT
+ *   APPLICABLE. There is no second entry point here: `guardNode`/`guardTool` are each the ONLY
+ *   caller-facing wrapper for their call, and there is nothing in either framework analogous to
+ *   a second permission callback for a call this adapter already gated.
+ * - **Snapshot double-evaluation / narrow-projection commitment** — NOT APPLICABLE in the
+ *   double-evaluation shape (`snapshotParams`/`snapshotToolParams` already compute ONE snapshot,
+ *   reused unchanged for both `authorizedParams` and `invokedParams`), but a DIFFERENT,
+ *   TS-specific gap in the same family was found and fixed — see `freeze()`'s own doc comment
+ *   above and the CHANGELOG.
+ * - **Correlation-key collision across hooks** (e.g. Python's `claude_sdk` `tool_use_id`
+ *   collision) — NOT APPLICABLE. `guard.recordOutcome` is called synchronously inside the same
+ *   closure that owns the whole call, from `authorize()`'s own returned `Decision.callId` — no
+ *   external pending-map keyed by a framework-supplied correlation id exists to collide on.
+ * - **Lazy-result detection gaps** (e.g. Python's `smolagents` adapter missing a coroutine or a
+ *   `concurrent.futures.Future`) — `isDeferredResult` catches generators (an object with its own
+ *   `.next` AND `[Symbol.iterator]` — "self-iterating", the shape a native generator has, but
+ *   deliberately NOT the shape a plain `Array`/`Set`/`Map` has, since those implement
+ *   `[Symbol.iterator]` too without an own `.next`, and their contents are already fully
+ *   computed), a genuine ASYNC ITERABLE (anything implementing a callable
+ *   `[Symbol.asyncIterator]`, self-iterating async generators included — see the RELEASE-GATE
+ *   CORRECTION on this function's own body for why this does NOT require an own `.next` the way
+ *   the sync branch does), and anything thenable. A plain (non-`async`) function that manually
+ *   returns a bare `Promise` is also caught correctly, via the thenable check, in the sync
+ *   branch of both wrappers. This is NOT a claim of covering "the whole lazy-result landscape" —
+ *   only what this function's own checks actually implement, listed above; a class implementing
+ *   some OTHER deferred-consumption protocol this function does not check for would not be
+ *   caught.
+ * - **Lost-terminal-event / "fires unconditionally" false claims** (e.g. Python's `strands`
+ *   adapter's before-hook interrupt paths) — NOT APPLICABLE. There is no external, multi-phase
+ *   hook-dispatch loop for an event to be lost across; one wrapper function's own `try`/`catch`
+ *   (or `await`ed async path) owns authorize-through-`recordOutcome` for the whole call
+ *   synchronously. Structurally this adapter was already closest to Python's own `langgraph.py`
+ *   reference wiring, not any of the adapters that needed this class of fix.
+ * - **Unbounded correlation cache** (Python's `claude_sdk` `_recentVerdicts`) — NOT APPLICABLE,
+ *   for the same reason as the correlation-collision point above: no cache or pending-map exists
+ *   in this adapter to bound.
+ * - **Wrong dependency declaration** (Python's `semantic-kernel` `protobuf` lesson: check what
+ *   the RESOLVED version actually requires, not what is assumed) — checked: `src/` imports only
+ *   `@langchain/langgraph` (lazily, in `isLangGraphAvailable()`); it never imports
+ *   `@langchain/core` at all (only this file's own tests do, to build fixtures). `package.json`
+ *   declares zero `dependencies` and no `peerDependencies` — matching the README's own "zero
+ *   runtime dependencies" claim — and both `@langchain/core`/`@langchain/langgraph` are correctly
+ *   `devDependencies`-only. Nothing this package's `src/` needs at runtime is undeclared.
+ *
  * ## Delegation
  *
  * Handing work to a sub-agent is the delegation moment. `delegateTo` mints the
@@ -67,6 +130,7 @@
  */
 import { type Guard } from "../guard.js";
 import type { Authority } from "../authority.js";
+import type { Json } from "../canonical.js";
 import type { Context } from "../ceilings.js";
 import { type Decision } from "../reasons.js";
 /** Options shared by every guarded wrapper. */
@@ -90,6 +154,129 @@ export type GuardedNode<F extends (...args: any[]) => any> = F & {
     readonly toolScope: string;
     readonly unwrapped: F;
 };
+/**
+ * A private, freeze()-only sentinel for "could not be represented as a JSON leaf" — a Proxy, an
+ * accessor property, a genuine cycle, a boxed primitive, a TypedArray, a function, or anything
+ * else this module does not know how to rebuild as plain JSON. NEVER a JSON-representable
+ * value (a string, `null`, …): a second release-gate finding showed a literal string sentinel
+ * (`"<accessor>"`) genuinely COLLIDES — a real getter-bearing object and a plain object holding
+ * the literal string `"<accessor>"` produced the IDENTICAL `authorizedParamsHash`, an
+ * evidence-integrity ambiguity in a supposedly cryptographic commitment (two materially
+ * different inputs, one commitment). A fresh, private `Symbol` cannot equal any real call
+ * argument, so it cannot collide with one — and it makes the SAME degradation apply uniformly
+ * everywhere this function cannot represent something, rather than inventing a new
+ * JSON-shaped sentinel (with its own collision risk) per case.
+ *
+ * Declared as `Json` even though a `Symbol` is not one — a deliberate escape from that type's
+ * nominal domain, not an oversight: `canonical.ts`'s own JCS `serialize()` already runtime-checks
+ * `typeof` for exactly this reason (its switch handles `"undefined"`/`"bigint"`/`"symbol"`/
+ * `"function"` despite `CJson`'s declared type not admitting any of them either), because the
+ * type system cannot fully describe this module's actual runtime domain. Once this sentinel
+ * reaches `params.ts`'s `commit()` — inside a plain object or array, same as any other frozen
+ * leaf — `canonicalBytes` hits that `"symbol"` case, throws `UnsupportedTypeError`, and `commit()`
+ * turns that into `paramsHashReason: "unsupported"` for the WHOLE params value, never a partial
+ * or per-field one: there is no such thing as "this one nested field is unsupported," only
+ * "this whole call's arguments are, or are not, representable."
+ *
+ * Exported for the same reason `freeze` itself is: not part of this adapter's semantic
+ * contract, but its own tests need to assert directly that a given leaf became this exact
+ * sentinel (by identity — nothing else can equal it) rather than inferring it indirectly.
+ */
+export declare const FREEZE_UNSUPPORTED: Json;
+/**
+ * A genuinely immutable, fully decoupled rebuild of `value` — the ONE, UNCONDITIONAL sanitizer
+ * every snapshot in this adapter goes through. Safe JSON-primitive leaves
+ * (`string`/`number`/`boolean`/`null`) pass through verbatim; plain objects and arrays are
+ * rebuilt fresh, recursively, by inspecting their REAL own property descriptors directly
+ * (`Object.getOwnPropertyDescriptor`), never by invoking anything the value itself controls (a
+ * getter, an iterator, a copy protocol, a Proxy trap, a `toString`/`valueOf`/`Symbol.toPrimitive`
+ * override); anything this function cannot represent becomes `UNSUPPORTED` (above) — never a
+ * string, never the live object.
+ *
+ * RELEASE-GATE CORRECTION (CRITICAL): this used to run ONLY as a fallback, after
+ * `structuredClone` had already been tried and had THROWN — the previous revision of this
+ * comment documented that carefully, but never asked whether `structuredClone` SUCCEEDING was
+ * itself a sufficient guarantee. It is not, on three counts, each reproduced directly before
+ * that fix: (1) a circular object clones successfully — `structuredClone` handles cycles
+ * natively — so this function never ran on it at all, and the circularity later reached
+ * `params.ts`'s own cycle-guard-less hash walk and crashed with `RangeError`; (2) a sparse
+ * array clones successfully too, bypassing this function's own densification; (3) a
+ * `SharedArrayBuffer` clones to a DISTINCT wrapper object sharing the SAME underlying memory —
+ * a "successful" clone that is not independent at all. Fixed by making this function the ONLY
+ * snapshot path, unconditionally — `structuredClone` is not called anywhere in this adapter.
+ *
+ * A SECOND release-gate pass then found that "pure introspection" was not fully true either —
+ * three more code-execution paths, all reproduced directly before this fix:
+ *
+ *   1. A `Proxy` is not inert under reflection. `Object.getPrototypeOf`, `Object.keys`
+ *      (`[[OwnPropertyKeys]]` + a `[[GetOwnProperty]]` per key to check enumerability), and
+ *      `Object.getOwnPropertyDescriptor` are each real, user-definable traps — reproduced
+ *      directly: walking an ordinary handler-tracked Proxy through the OLD version of this
+ *      function fired four separate traps before authorization was ever decided. `Array.isArray`
+ *      is worse: called on a REVOKED Proxy, it throws `TypeError` outright (its spec algorithm,
+ *      `IsArray`, unwraps `[[ProxyTarget]]`, which does not exist on a revoked handle) —
+ *      reproduced directly. Fixed: `require("node:util").types.isProxy(value)` recognizes a
+ *      Proxy — live OR revoked — via an internal engine slot, invoking NOTHING (verified
+ *      directly: zero trap calls, no throw on a revoked handle either) — checked FIRST, before
+ *      `Array.isArray` or any other reflection, and routed straight to `UNSUPPORTED`.
+ *   2. The bottom fallback used `String(value)` for anything not a plain object/array — a boxed
+ *      primitive (`new Number(...)`) with a hostile `Symbol.toPrimitive`, or a `TypedArray` with
+ *      a hostile own `toString`, each ran attacker code exactly once per snapshot, reproduced
+ *      directly both ways — BEFORE `Guard.check` had decided allow or deny. The same is true, in
+ *      principle, of ANY object-typed exotic value (a function's own `.toString` is just as
+ *      overridable) — there is no way to distinguish "safe to stringify" from "hostile" by
+ *      inspection alone, so none of them are stringified any more. Fixed: every value that is
+ *      not a safe JSON primitive and not a plain object/array — a Proxy, a boxed primitive, a
+ *      TypedArray/`ArrayBuffer`/`SharedArrayBuffer`/`DataView`, a `Map`/`Set`/`Date`/`RegExp`, a
+ *      function, a `Symbol`, a `BigInt`, anything else — becomes `UNSUPPORTED` (never `String()`,
+ *      never any other protocol) — see the confirmed-good note above: stringification itself
+ *      was never unsafe as a RESULT (a `SharedArrayBuffer` never retained live memory as a
+ *      string), the defect was invoking attacker-controlled code to PRODUCE that string before
+ *      authorization ran, and `UNSUPPORTED` avoids that entirely rather than picking a "safer"
+ *      string.
+ *   3. Any OTHER reflection failure — an exotic value this pass did not specifically anticipate,
+ *      still throwing from `Object.getPrototypeOf`/`Object.keys`/`Object.getOwnPropertyDescriptor`
+ *      despite the Proxy check above — must degrade the same way, not propagate an exception out
+ *      of a snapshot taken before authorization. The whole reflective walk (everything past the
+ *      Proxy/primitive fast paths) runs inside one `try`/`catch`; any throw there becomes
+ *      `UNSUPPORTED` too.
+ *
+ * `active` is the PATH-ACTIVE cycle guard: the set of containers on the CURRENT recursion path,
+ * passed as a NEW `Set` at each recursive call rather than mutated in place and shared across
+ * sibling branches (an earlier revision DID share one mutable `WeakSet` across the whole call,
+ * which meant a DAG's repeated reference — the SAME object appearing twice as sibling values,
+ * never as its own ancestor — was wrongly flagged on its second occurrence; reproduced directly
+ * before that fix too). A genuine cycle's own leaf value is `UNSUPPORTED`, not a literal string
+ * `"<circular>"` — audited for the same collision class as `"<accessor>"` below, and it has the
+ * identical problem: a self-referential object and a plain object holding the literal string
+ * `"<circular>"` would otherwise produce the same commitment. There is no position-based reason
+ * a cycle's collision is any less real than an accessor's, so it gets the same fix.
+ *
+ * The property-descriptor walk ALSO closes a separate, protocol-driven gap: the previous
+ * revision used `Array.from`/`.map()` (which invoke `[Symbol.iterator]()` — a hostile array's
+ * own override can yield ANYTHING regardless of its real indexed properties; reproduced
+ * directly: `[1, , 3]` with a hostile iterator froze as `[999]`) and `Object.entries()` (which
+ * reads each property's VALUE directly, invoking a getter if one is defined there — reproduced
+ * directly: a getter with a side effect was observed three times across the old clone-attempt/
+ * freeze/body sequence, and the committed snapshot was the SECOND of three observations, not the
+ * first). `Object.getOwnPropertyDescriptor` and a `.length`-bounded index loop are pure
+ * introspection — they never invoke user code — and an accessor property (`.get`/`.set` present)
+ * becomes `UNSUPPORTED` rather than read at all: a getter can have arbitrary side effects, throw,
+ * or return something different on every call, so there is no single "correct" observation of it
+ * to commit, and (release-gate correction) the earlier `"<accessor>"` string sentinel this
+ * function used instead genuinely collided — reproduced directly: a real getter-bearing object
+ * and a plain object holding the literal string `"<accessor>"` produced the identical
+ * `authorizedParamsHash`. Both now degrade the same commitment to `unsupported` via `UNSUPPORTED`
+ * (see its own doc comment above), never a JSON-representable stand-in.
+ *
+ * Exported — not part of this adapter's semantic contract (it is an internal sanitizer, not a
+ * feature callers configure), but its own aliasing-safety invariant is worth a direct unit
+ * test in isolation, the same way every Python adapter's `_freeze()` is imported directly by
+ * its own tests: the audit log never exposes the raw snapshot value it produces (only its
+ * hash — see `params.ts`'s own doc comment), so "does this alias a live mutable object" is
+ * not otherwise observable from outside this module.
+ */
+export declare function freeze(value: unknown, active?: ReadonlySet<unknown>): Json;
 /**
  * Wrap a callable so every call is authorized through `guard` first.
  *

package/dist/esm/adapters/langgraph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"langgraph.d.ts","sourceRoot":"","sources":["../../../src/adapters/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAAqC,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAsB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGlE,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;IACxC,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG;IAC/D,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;CACvB,CAAC;AAgEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EACzD,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,CAAC,EACL,OAAO,GAAE,YAAiB,GACzB,WAAW,CAAC,CAAC,CAAC,CAsGhB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;CACjF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAC9D,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,CAAC,EACL,OAAO,GAAE,YAAiB,GACzB,WAAW,CAAC,CAAC,CAAC,CAIhB;AAED,uEAAuE;AACvE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACtC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,QAAQ,EAC1C,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,CAAC,EACP,OAAO,GAAE,gBAAqB,GAC7B,CAAC,CAkIH;AAED,8EAA8E;AAC9E,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAC5C,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAE5C,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IACjE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,QAAQ,EAC3C,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,OAAO,GAAE,iBAAsB,GAC9B,CAAC,EAAE,CAUL;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMxD;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,GAAG,KAAK,CAEzE;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ7D"}
+{"version":3,"file":"langgraph.d.ts","sourceRoot":"","sources":["../../../src/adapters/langgraph.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiIG;AAIH,OAAO,EAAqC,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAsB,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAC;AAOlE,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;IACxC,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sDAAsD;IACtD,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,8EAA8E;AAC9E,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG;IAC/D,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;CACvB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,kBAAkB,EAA2D,IAAI,CAAC;AAG/F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4FG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,GAAE,WAAW,CAAC,OAAO,CAAa,GAAG,IAAI,CA+ErF;AA4FD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EACzD,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,CAAC,EACL,OAAO,GAAE,YAAiB,GACzB,WAAW,CAAC,CAAC,CAAC,CAsGhB;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;CACjF;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAC9D,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,CAAC,EACL,OAAO,GAAE,YAAiB,GACzB,WAAW,CAAC,CAAC,CAAC,CAIhB;AAED,uEAAuE;AACvE,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IACtC,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,gBAAiB,SAAQ,YAAY;IACpD,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC;CACpD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,QAAQ,EAC1C,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,CAAC,EACP,OAAO,GAAE,gBAAqB,GAC7B,CAAC,CA8HH;AAED,8EAA8E;AAC9E,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAC5C,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAE5C,MAAM,WAAW,iBAAkB,SAAQ,YAAY;IACrD,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IACjE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,CAAC,SAAS,QAAQ,EAC3C,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,OAAO,GAAE,iBAAsB,GAC9B,CAAC,EAAE,CAUL;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAMxD;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,SAAS,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,GAAG,KAAK,CAEzE;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ7D"}

package/dist/esm/adapters/langgraph.js

@@ -51,6 +51,69 @@
  * adapter behaves exactly as it did before 0.9.0: no `capture`/`authorizedParams`, no
  * `recordOutcome` call. Every other framework adapter is unchanged in this release.
  *
+ * ## Adversarial review: the Python batch-1/batch-2 defect classes, checked against this
+ * adapter specifically (not assumed absent by analogy)
+ *
+ * The Python `attenu-guard` adapters went through two rounds of adversarial review that found
+ * several defect classes across their (many) framework adapters. This TS package ships exactly
+ * ONE adapter surface (this file — verified against `package.json`'s own `exports` map, which
+ * declares nothing besides `.` and `./adapters/langgraph`), so each class was checked against
+ * THIS adapter specifically, not inherited by assumption:
+ *
+ * - **Composable middleware / sibling short-circuit or retry** (a sibling wrapper positioned
+ *   closer to the tool body than this one, able to fabricate or repeat what it observes) — NOT
+ *   APPLICABLE. Verified directly against pinned `@langchain/core@1.2.9` and
+ *   `@langchain/langgraph@1.4.13` (installed and grepped, not read off documentation): zero
+ *   `"middleware"` hits anywhere near tool invocation in either package, and
+ *   `ToolNode.prototype.runTool` (`dist/prebuilt/tool_node.js`) calls `tool.invoke(toolCall,
+ *   runtime)` directly — `guardTool`'s `Proxy` IS what gets called, nothing sits between it and
+ *   `ToolNode`. Neither framework has a composable per-call hook chain the way LangChain-Python's
+ *   `create_agent(middleware=[...])` or AG2's `FunctionTool.register()` do.
+ * - **Double authorization via a second, independent gate** (e.g. Python's `claude_sdk`
+ *   adapter's `can_use_tool` calling `authorize()` a second time for the same call) — NOT
+ *   APPLICABLE. There is no second entry point here: `guardNode`/`guardTool` are each the ONLY
+ *   caller-facing wrapper for their call, and there is nothing in either framework analogous to
+ *   a second permission callback for a call this adapter already gated.
+ * - **Snapshot double-evaluation / narrow-projection commitment** — NOT APPLICABLE in the
+ *   double-evaluation shape (`snapshotParams`/`snapshotToolParams` already compute ONE snapshot,
+ *   reused unchanged for both `authorizedParams` and `invokedParams`), but a DIFFERENT,
+ *   TS-specific gap in the same family was found and fixed — see `freeze()`'s own doc comment
+ *   above and the CHANGELOG.
+ * - **Correlation-key collision across hooks** (e.g. Python's `claude_sdk` `tool_use_id`
+ *   collision) — NOT APPLICABLE. `guard.recordOutcome` is called synchronously inside the same
+ *   closure that owns the whole call, from `authorize()`'s own returned `Decision.callId` — no
+ *   external pending-map keyed by a framework-supplied correlation id exists to collide on.
+ * - **Lazy-result detection gaps** (e.g. Python's `smolagents` adapter missing a coroutine or a
+ *   `concurrent.futures.Future`) — `isDeferredResult` catches generators (an object with its own
+ *   `.next` AND `[Symbol.iterator]` — "self-iterating", the shape a native generator has, but
+ *   deliberately NOT the shape a plain `Array`/`Set`/`Map` has, since those implement
+ *   `[Symbol.iterator]` too without an own `.next`, and their contents are already fully
+ *   computed), a genuine ASYNC ITERABLE (anything implementing a callable
+ *   `[Symbol.asyncIterator]`, self-iterating async generators included — see the RELEASE-GATE
+ *   CORRECTION on this function's own body for why this does NOT require an own `.next` the way
+ *   the sync branch does), and anything thenable. A plain (non-`async`) function that manually
+ *   returns a bare `Promise` is also caught correctly, via the thenable check, in the sync
+ *   branch of both wrappers. This is NOT a claim of covering "the whole lazy-result landscape" —
+ *   only what this function's own checks actually implement, listed above; a class implementing
+ *   some OTHER deferred-consumption protocol this function does not check for would not be
+ *   caught.
+ * - **Lost-terminal-event / "fires unconditionally" false claims** (e.g. Python's `strands`
+ *   adapter's before-hook interrupt paths) — NOT APPLICABLE. There is no external, multi-phase
+ *   hook-dispatch loop for an event to be lost across; one wrapper function's own `try`/`catch`
+ *   (or `await`ed async path) owns authorize-through-`recordOutcome` for the whole call
+ *   synchronously. Structurally this adapter was already closest to Python's own `langgraph.py`
+ *   reference wiring, not any of the adapters that needed this class of fix.
+ * - **Unbounded correlation cache** (Python's `claude_sdk` `_recentVerdicts`) — NOT APPLICABLE,
+ *   for the same reason as the correlation-collision point above: no cache or pending-map exists
+ *   in this adapter to bound.
+ * - **Wrong dependency declaration** (Python's `semantic-kernel` `protobuf` lesson: check what
+ *   the RESOLVED version actually requires, not what is assumed) — checked: `src/` imports only
+ *   `@langchain/langgraph` (lazily, in `isLangGraphAvailable()`); it never imports
+ *   `@langchain/core` at all (only this file's own tests do, to build fixtures). `package.json`
+ *   declares zero `dependencies` and no `peerDependencies` — matching the README's own "zero
+ *   runtime dependencies" claim — and both `@langchain/core`/`@langchain/langgraph` are correctly
+ *   `devDependencies`-only. Nothing this package's `src/` needs at runtime is undeclared.
+ *
  * ## Delegation
  *
  * Handing work to a sub-agent is the delegation moment. `delegateTo` mints the
@@ -65,9 +128,236 @@
  *     });
  *     const tools = guardTools(researcher, [crmQuery], { scopes: { crm_query: "crm.read" } });
  */
+import { types as nodeUtilTypes } from "node:util";
 import { AuthorityDenied } from "../guard.js";
 import { BodyState, Capture } from "../reasons.js";
 import { VERSION } from "../version.js";
+// `node:util`'s own Proxy check -- an internal engine-slot test, not a trapped operation (see
+// `freeze()`'s doc comment). Aliased for a short, self-explanatory call site.
+const isProxy = nodeUtilTypes.isProxy;
+/**
+ * A private, freeze()-only sentinel for "could not be represented as a JSON leaf" — a Proxy, an
+ * accessor property, a genuine cycle, a boxed primitive, a TypedArray, a function, or anything
+ * else this module does not know how to rebuild as plain JSON. NEVER a JSON-representable
+ * value (a string, `null`, …): a second release-gate finding showed a literal string sentinel
+ * (`"<accessor>"`) genuinely COLLIDES — a real getter-bearing object and a plain object holding
+ * the literal string `"<accessor>"` produced the IDENTICAL `authorizedParamsHash`, an
+ * evidence-integrity ambiguity in a supposedly cryptographic commitment (two materially
+ * different inputs, one commitment). A fresh, private `Symbol` cannot equal any real call
+ * argument, so it cannot collide with one — and it makes the SAME degradation apply uniformly
+ * everywhere this function cannot represent something, rather than inventing a new
+ * JSON-shaped sentinel (with its own collision risk) per case.
+ *
+ * Declared as `Json` even though a `Symbol` is not one — a deliberate escape from that type's
+ * nominal domain, not an oversight: `canonical.ts`'s own JCS `serialize()` already runtime-checks
+ * `typeof` for exactly this reason (its switch handles `"undefined"`/`"bigint"`/`"symbol"`/
+ * `"function"` despite `CJson`'s declared type not admitting any of them either), because the
+ * type system cannot fully describe this module's actual runtime domain. Once this sentinel
+ * reaches `params.ts`'s `commit()` — inside a plain object or array, same as any other frozen
+ * leaf — `canonicalBytes` hits that `"symbol"` case, throws `UnsupportedTypeError`, and `commit()`
+ * turns that into `paramsHashReason: "unsupported"` for the WHOLE params value, never a partial
+ * or per-field one: there is no such thing as "this one nested field is unsupported," only
+ * "this whole call's arguments are, or are not, representable."
+ *
+ * Exported for the same reason `freeze` itself is: not part of this adapter's semantic
+ * contract, but its own tests need to assert directly that a given leaf became this exact
+ * sentinel (by identity — nothing else can equal it) rather than inferring it indirectly.
+ */
+export const FREEZE_UNSUPPORTED = Symbol("attenu-guard:freeze-unsupported");
+const UNSUPPORTED = FREEZE_UNSUPPORTED;
+/**
+ * A genuinely immutable, fully decoupled rebuild of `value` — the ONE, UNCONDITIONAL sanitizer
+ * every snapshot in this adapter goes through. Safe JSON-primitive leaves
+ * (`string`/`number`/`boolean`/`null`) pass through verbatim; plain objects and arrays are
+ * rebuilt fresh, recursively, by inspecting their REAL own property descriptors directly
+ * (`Object.getOwnPropertyDescriptor`), never by invoking anything the value itself controls (a
+ * getter, an iterator, a copy protocol, a Proxy trap, a `toString`/`valueOf`/`Symbol.toPrimitive`
+ * override); anything this function cannot represent becomes `UNSUPPORTED` (above) — never a
+ * string, never the live object.
+ *
+ * RELEASE-GATE CORRECTION (CRITICAL): this used to run ONLY as a fallback, after
+ * `structuredClone` had already been tried and had THROWN — the previous revision of this
+ * comment documented that carefully, but never asked whether `structuredClone` SUCCEEDING was
+ * itself a sufficient guarantee. It is not, on three counts, each reproduced directly before
+ * that fix: (1) a circular object clones successfully — `structuredClone` handles cycles
+ * natively — so this function never ran on it at all, and the circularity later reached
+ * `params.ts`'s own cycle-guard-less hash walk and crashed with `RangeError`; (2) a sparse
+ * array clones successfully too, bypassing this function's own densification; (3) a
+ * `SharedArrayBuffer` clones to a DISTINCT wrapper object sharing the SAME underlying memory —
+ * a "successful" clone that is not independent at all. Fixed by making this function the ONLY
+ * snapshot path, unconditionally — `structuredClone` is not called anywhere in this adapter.
+ *
+ * A SECOND release-gate pass then found that "pure introspection" was not fully true either —
+ * three more code-execution paths, all reproduced directly before this fix:
+ *
+ *   1. A `Proxy` is not inert under reflection. `Object.getPrototypeOf`, `Object.keys`
+ *      (`[[OwnPropertyKeys]]` + a `[[GetOwnProperty]]` per key to check enumerability), and
+ *      `Object.getOwnPropertyDescriptor` are each real, user-definable traps — reproduced
+ *      directly: walking an ordinary handler-tracked Proxy through the OLD version of this
+ *      function fired four separate traps before authorization was ever decided. `Array.isArray`
+ *      is worse: called on a REVOKED Proxy, it throws `TypeError` outright (its spec algorithm,
+ *      `IsArray`, unwraps `[[ProxyTarget]]`, which does not exist on a revoked handle) —
+ *      reproduced directly. Fixed: `require("node:util").types.isProxy(value)` recognizes a
+ *      Proxy — live OR revoked — via an internal engine slot, invoking NOTHING (verified
+ *      directly: zero trap calls, no throw on a revoked handle either) — checked FIRST, before
+ *      `Array.isArray` or any other reflection, and routed straight to `UNSUPPORTED`.
+ *   2. The bottom fallback used `String(value)` for anything not a plain object/array — a boxed
+ *      primitive (`new Number(...)`) with a hostile `Symbol.toPrimitive`, or a `TypedArray` with
+ *      a hostile own `toString`, each ran attacker code exactly once per snapshot, reproduced
+ *      directly both ways — BEFORE `Guard.check` had decided allow or deny. The same is true, in
+ *      principle, of ANY object-typed exotic value (a function's own `.toString` is just as
+ *      overridable) — there is no way to distinguish "safe to stringify" from "hostile" by
+ *      inspection alone, so none of them are stringified any more. Fixed: every value that is
+ *      not a safe JSON primitive and not a plain object/array — a Proxy, a boxed primitive, a
+ *      TypedArray/`ArrayBuffer`/`SharedArrayBuffer`/`DataView`, a `Map`/`Set`/`Date`/`RegExp`, a
+ *      function, a `Symbol`, a `BigInt`, anything else — becomes `UNSUPPORTED` (never `String()`,
+ *      never any other protocol) — see the confirmed-good note above: stringification itself
+ *      was never unsafe as a RESULT (a `SharedArrayBuffer` never retained live memory as a
+ *      string), the defect was invoking attacker-controlled code to PRODUCE that string before
+ *      authorization ran, and `UNSUPPORTED` avoids that entirely rather than picking a "safer"
+ *      string.
+ *   3. Any OTHER reflection failure — an exotic value this pass did not specifically anticipate,
+ *      still throwing from `Object.getPrototypeOf`/`Object.keys`/`Object.getOwnPropertyDescriptor`
+ *      despite the Proxy check above — must degrade the same way, not propagate an exception out
+ *      of a snapshot taken before authorization. The whole reflective walk (everything past the
+ *      Proxy/primitive fast paths) runs inside one `try`/`catch`; any throw there becomes
+ *      `UNSUPPORTED` too.
+ *
+ * `active` is the PATH-ACTIVE cycle guard: the set of containers on the CURRENT recursion path,
+ * passed as a NEW `Set` at each recursive call rather than mutated in place and shared across
+ * sibling branches (an earlier revision DID share one mutable `WeakSet` across the whole call,
+ * which meant a DAG's repeated reference — the SAME object appearing twice as sibling values,
+ * never as its own ancestor — was wrongly flagged on its second occurrence; reproduced directly
+ * before that fix too). A genuine cycle's own leaf value is `UNSUPPORTED`, not a literal string
+ * `"<circular>"` — audited for the same collision class as `"<accessor>"` below, and it has the
+ * identical problem: a self-referential object and a plain object holding the literal string
+ * `"<circular>"` would otherwise produce the same commitment. There is no position-based reason
+ * a cycle's collision is any less real than an accessor's, so it gets the same fix.
+ *
+ * The property-descriptor walk ALSO closes a separate, protocol-driven gap: the previous
+ * revision used `Array.from`/`.map()` (which invoke `[Symbol.iterator]()` — a hostile array's
+ * own override can yield ANYTHING regardless of its real indexed properties; reproduced
+ * directly: `[1, , 3]` with a hostile iterator froze as `[999]`) and `Object.entries()` (which
+ * reads each property's VALUE directly, invoking a getter if one is defined there — reproduced
+ * directly: a getter with a side effect was observed three times across the old clone-attempt/
+ * freeze/body sequence, and the committed snapshot was the SECOND of three observations, not the
+ * first). `Object.getOwnPropertyDescriptor` and a `.length`-bounded index loop are pure
+ * introspection — they never invoke user code — and an accessor property (`.get`/`.set` present)
+ * becomes `UNSUPPORTED` rather than read at all: a getter can have arbitrary side effects, throw,
+ * or return something different on every call, so there is no single "correct" observation of it
+ * to commit, and (release-gate correction) the earlier `"<accessor>"` string sentinel this
+ * function used instead genuinely collided — reproduced directly: a real getter-bearing object
+ * and a plain object holding the literal string `"<accessor>"` produced the identical
+ * `authorizedParamsHash`. Both now degrade the same commitment to `unsupported` via `UNSUPPORTED`
+ * (see its own doc comment above), never a JSON-representable stand-in.
+ *
+ * Exported — not part of this adapter's semantic contract (it is an internal sanitizer, not a
+ * feature callers configure), but its own aliasing-safety invariant is worth a direct unit
+ * test in isolation, the same way every Python adapter's `_freeze()` is imported directly by
+ * its own tests: the audit log never exposes the raw snapshot value it produces (only its
+ * hash — see `params.ts`'s own doc comment), so "does this alias a live mutable object" is
+ * not otherwise observable from outside this module.
+ */
+export function freeze(value, active = new Set()) {
+    if (value === null || value === undefined)
+        return null;
+    const t = typeof value;
+    if (t === "string" || t === "number" || t === "boolean")
+        return value;
+    // A Proxy is recognized FIRST, before Array.isArray or ANY reflection -- see this function's
+    // own doc comment, point 1. `util.types.isProxy` reads an internal engine slot; it invokes no
+    // trap and does not throw even on a revoked Proxy (verified directly), unlike everything below
+    // it, which would either fire real traps (a live Proxy) or throw outright (a revoked one).
+    if (isProxy(value))
+        return UNSUPPORTED;
+    try {
+        if (Array.isArray(value)) {
+            if (active.has(value))
+                return UNSUPPORTED; // a genuine cycle -- see doc comment above
+            const withSelf = new Set(active).add(value);
+            const out = [];
+            // Index-by-index via getOwnPropertyDescriptor, not Array.from/.map: those invoke
+            // `[Symbol.iterator]()`, which a hostile array can override to yield ANYTHING regardless
+            // of what its real indexed properties hold (reproduced directly: `[1, , 3]` with a
+            // hostile iterator froze as `[999]`). `.length` and getOwnPropertyDescriptor are pure
+            // introspection -- they read the array's REAL own properties without ever calling user
+            // code. A hole (no descriptor at that index) is densified to `null`, same as any other
+            // absence here.
+            for (let i = 0; i < value.length; i++) {
+                out.push(freezeDescriptor(Object.getOwnPropertyDescriptor(value, i), withSelf));
+            }
+            return out;
+        }
+        if (t === "object") {
+            const proto = Object.getPrototypeOf(value);
+            if (proto === Object.prototype || proto === null) {
+                const obj = value;
+                if (active.has(obj))
+                    return UNSUPPORTED; // a genuine cycle -- see doc comment above
+                const withSelf = new Set(active).add(obj);
+                const out = {};
+                // Object.keys + getOwnPropertyDescriptor, not Object.entries: Object.entries reads each
+                // property's VALUE directly, which invokes a getter if one is defined at that key --
+                // reproduced directly: with an unclonable sibling forcing the old fallback, a getter
+                // with a side effect was observed three times across the old clone-attempt/freeze/body
+                // path, and the committed snapshot was the SECOND of three observations, not the first.
+                // Reading the DESCRIPTOR instead never invokes anything; an accessor property
+                // (`.get`/`.set` present, no `.value`) becomes `UNSUPPORTED` -- explicitly marked, never
+                // executed -- rather than read (see `freezeDescriptor`). `Object.keys` correctly LISTS a
+                // literal `"__proto__"` key (a plain `JSON.parse('{"__proto__": {...}}')` result has it
+                // as an own, enumerable DATA property, same as any other key) -- the loop below still
+                // needs `Object.defineProperty`, not a bracket assignment, to actually WRITE it back
+                // safely.
+                for (const key of Object.keys(obj)) {
+                    // Object.defineProperty, NOT `out[key] = ...`: a bracket ASSIGNMENT to the literal key
+                    // "__proto__" does not create a data property at all -- it invokes Object.prototype's
+                    // own `__proto__` SETTER, silently changing `out`'s prototype instead and dropping the
+                    // key from its own enumerable keys entirely. defineProperty always performs a genuine
+                    // [[DefineOwnProperty]], bypassing that accessor, for "__proto__" exactly like any
+                    // other key name.
+                    Object.defineProperty(out, key, {
+                        value: freezeDescriptor(Object.getOwnPropertyDescriptor(obj, key), withSelf),
+                        enumerable: true,
+                        writable: true,
+                        configurable: true,
+                    });
+                }
+                return out;
+            }
+        }
+    }
+    catch {
+        // A reflection call above threw despite the Proxy check -- an exotic value this pass did
+        // not specifically anticipate. Degrade the same way as everything else this function
+        // cannot represent; never let a snapshot taken BEFORE authorization propagate an exception.
+        return UNSUPPORTED;
+    }
+    // A boxed primitive (`new Number(...)`/`new String(...)`/`new Boolean(...)`), a TypedArray,
+    // `ArrayBuffer`/`SharedArrayBuffer`/`DataView`, a `Map`/`Set`/`Date`/`RegExp`, a function, a
+    // `Symbol`, a `BigInt`, or anything else that is not a plain object or array -- never
+    // stringified any more (see this function's own doc comment, point 2: a hostile
+    // `Symbol.toPrimitive`/`toString`/`valueOf` override runs attacker code before authorization
+    // has been decided, reproduced directly for a boxed primitive and a TypedArray) and never the
+    // live reference either. `UNSUPPORTED` degrades the whole commitment cleanly instead.
+    return UNSUPPORTED;
+}
+/**
+ * Reads ONE property descriptor safely: a data property's `.value` is frozen recursively; an
+ * accessor property (`.get`/`.set` present) becomes `UNSUPPORTED` WITHOUT ever calling the
+ * getter (a getter can have arbitrary side effects, throw, or return something different on
+ * each call — there is no "correct" single observation to commit, and a JSON-representable
+ * sentinel string genuinely collided with a real getter-bearing object's commitment — see
+ * `UNSUPPORTED`'s own doc comment); a missing descriptor (an array hole, or a key that no
+ * longer exists) becomes `null`, the same as any other JSON-shaped absence `freeze` produces
+ * elsewhere.
+ */
+function freezeDescriptor(desc, active) {
+    if (desc === undefined)
+        return null;
+    if (desc.get || desc.set)
+        return UNSUPPORTED;
+    return freeze(desc.value, active);
+}
 /**
  * An IMMUTABLE snapshot of the call's arguments, taken BEFORE the wrapped callable runs and
  * reused for BOTH `authorizedParams` (`check`) and `invokedParams` (`recordOutcome`) — so a
@@ -76,16 +366,10 @@ import { VERSION } from "../version.js";
  * binding" section; no `kwargs` — JavaScript has no separate keyword-argument bag).
  */
 function snapshotParams(args) {
-    const raw = { args: [...args] };
-    try {
-        return structuredClone(raw);
-    }
-    catch {
-        // Best-effort: something in here isn't structured-cloneable (a live socket, a function, ...).
-        // Fall back to the shallow copy — a residual risk only if THAT specific object is later
-        // mutated in place, a rare edge case documented here rather than silently claimed away.
-        return raw;
-    }
+    // freeze() unconditionally, not structuredClone-then-fallback: see freeze()'s own doc
+    // comment's "RELEASE-GATE CORRECTION" for why a successful structuredClone is not itself a
+    // sufficient independence guarantee (circular inputs, sparse arrays, SharedArrayBuffer).
+    return freeze({ args: [...args] });
 }
 /**
  * `true` if `result` is a generator/async-generator/promise-like value whose consumption this
@@ -99,9 +383,26 @@ function isDeferredResult(result) {
     if (result === null || typeof result !== "object")
         return false;
     const r = result;
+    // A native generator object (from `function*`) has BOTH `.next` AND `[Symbol.iterator]`
+    // (returning itself) -- "self-iterating". Requiring both here deliberately does NOT match a
+    // plain Array/Set/Map: those implement `[Symbol.iterator]` too, but the object ITSELF has no
+    // `.next` (only the SEPARATE iterator `arr[Symbol.iterator]()` produces does) -- and an
+    // array's contents are already fully computed, nothing deferred about returning one.
     if (typeof r["next"] === "function" && typeof r[Symbol.iterator] === "function")
         return true;
-    if (typeof r["next"] === "function" && typeof r[Symbol.asyncIterator] === "function")
+    // RELEASE-GATE CORRECTION (HIGH): the async branch used to require the SAME "has its own
+    // .next" shape, matching a native async generator (self-iterating, same reasoning as above)
+    // but missing the more general ASYNC ITERABLE protocol: per spec, `[Symbol.asyncIterator]`
+    // being callable is sufficient on its own -- calling it returns a SEPARATE async iterator
+    // object that has `.next`, so the ITERABLE itself need not. Reproduced directly before
+    // fixing: a plain object implementing only `[Symbol.asyncIterator]()` was recorded
+    // `BodyState.RETURNED`, not `DEFERRED`. Unlike the sync case, there is no common JavaScript
+    // built-in that implements `Symbol.asyncIterator` over ALREADY-computed values the way a
+    // plain Array does for `Symbol.iterator` (Node's own `Readable` streams implement it
+    // precisely because their data is NOT all available yet), so checking `Symbol.asyncIterator`
+    // alone does not risk the same false-positive class dropping the `.next` requirement here
+    // would raise for the sync branch.
+    if (typeof r[Symbol.asyncIterator] === "function")
         return true;
     if (typeof r["then"] === "function")
         return true;
@@ -295,13 +596,8 @@ export function guardTool(guard, tool, options = {}) {
         hookPath: `guardTool:${tool.name}`,
     };
     function snapshotToolParams(input) {
-        const raw = toolArgs(input);
-        try {
-            return structuredClone(raw);
-        }
-        catch {
-            return raw;
-        }
+        // See snapshotParams' own comment above: freeze() unconditionally, never structuredClone.
+        return freeze(toolArgs(input));
     }
     function authorize(input, config, snapshot) {
         const context = options.contextFn ? options.contextFn(input, config) : {};