rea-agents 1.4.0 → 1.5.0

package/dist/application/EvidenceLedger.js

@@ -85,7 +85,7 @@ export class EvidenceLedger {
     }
     /** Export records in deterministic, semantically irrelevant ID order. */
     export() {
-        return createEvidenceBundle([...this.#records.values()], [...this.#unknownRevisions.values()]);
+        return structuredClone(createEvidenceBundle([...this.#records.values()], [...this.#unknownRevisions.values()]));
     }
     /** Check whether one immutable Evidence ID is present in this ledger. */
     has(evidenceId) {
@@ -162,7 +162,7 @@ export class EvidenceLedger {
         if (!checked.ok)
             return checked;
         this.#commit(pendingRecords, pendingUnknowns, checked.value);
-        return ok(unknown);
+        return ok(structuredClone(unknown));
     }
     /** Apply one approved full-state update using optimistic revision matching. */
     updateUnknown(input, mutationEvidence) {
@@ -187,7 +187,8 @@ export class EvidenceLedger {
             (filters.severity === undefined ||
                 unknown.severity === filters.severity) &&
             (filters.domain === undefined || unknown.domain === filters.domain))
-            .sort((left, right) => left.unknown_id.localeCompare(right.unknown_id));
+            .sort((left, right) => left.unknown_id.localeCompare(right.unknown_id))
+            .map((unknown) => structuredClone(unknown));
     }
     /** Return current resolution validity; imported invalid states are rejected. */
     verifyUnknownResolution(unknownId) {
@@ -197,7 +198,7 @@ export class EvidenceLedger {
         return ok({
             valid: unknown.status === "resolved",
             truthVerified: unknown.resolution?.disposition === "verified",
-            unknown,
+            unknown: structuredClone(unknown),
         });
     }
     /** Clear records when the owning session closes. */
@@ -225,7 +226,7 @@ export class EvidenceLedger {
         if (!checked.ok)
             return checked;
         this.#commit(pendingRecords, pendingUnknowns, checked.value);
-        return ok(unknown);
+        return ok(structuredClone(unknown));
     }
     #validateCandidate(records, unknowns) {
         if (records.size + unknowns.size > this.limits.maxRecords)

package/dist/application/InvestigationWorkspaceStore.js

@@ -1,6 +1,7 @@
 import { lstat, open, readFile, realpath, unlink, } from "node:fs/promises";
 import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
 import writeFileAtomic from "write-file-atomic";
+import { isJsonWithinLimits } from "../domain/jsonLimits.js";
 import { InvestigationWorkspaceError } from "../domain/errors.js";
 import { parseInvestigationWorkspace, serializeInvestigationWorkspace, } from "../domain/investigationWorkspace.js";
 import { err, ok } from "../domain/result.js";
@@ -97,7 +98,7 @@ const readWorkspaceFile = async (destination, policy) => {
     catch (cause) {
         return err(new InvestigationWorkspaceError("read", "invalid-json", { cause }));
     }
-    if (!withinJsonLimits(decoded, policy))
+    if (!isJsonWithinLimits(decoded, policy))
         return err(new InvestigationWorkspaceError("read", "too-large"));
     try {
         return ok(parseInvestigationWorkspace(decoded));
@@ -182,31 +183,6 @@ const validateNextRevision = (current, next, expectedRevision) => {
         ? ok(null)
         : err(new InvestigationWorkspaceError("update", "revision-conflict"));
 };
-const withinJsonLimits = (root, policy) => {
-    const pending = [
-        { value: root, depth: 0 },
-    ];
-    let nodes = 0;
-    while (pending.length > 0) {
-        const current = pending.pop();
-        if (current === undefined)
-            break;
-        nodes += 1;
-        if (nodes > policy.maxNodes || current.depth > policy.maxDepth)
-            return false;
-        if (typeof current.value === "string" &&
-            current.value.length > policy.maxStringLength)
-            return false;
-        if (typeof current.value !== "object" || current.value === null)
-            continue;
-        for (const [key, value] of Object.entries(current.value)) {
-            if (key.length > policy.maxStringLength)
-                return false;
-            pending.push({ value, depth: current.depth + 1 });
-        }
-    }
-    return true;
-};
 const isFileNotFound = (cause) => errorCode(cause) === "ENOENT";
 const isAlreadyExists = (cause) => errorCode(cause) === "EEXIST";
 const errorCode = (cause) => typeof cause === "object" && cause !== null && "code" in cause

package/dist/application/ProcessCaptureAuthority.js

@@ -1,14 +1,15 @@
 import { realpath } from "node:fs/promises";
 import { ProcessCaptureError, processCaptureCancelled, } from "./ProcessCaptureError.js";
+import { canonicalizeConfiguredRoots } from "./ConfiguredRoots.js";
 const isWithin = (candidate, root) => candidate === root ||
     candidate.startsWith(`${root.endsWith("/") ? root.slice(0, -1) : root}/`);
 export const assertRealPathAuthority = async (scenario, policy) => {
     const executable = await realpath(scenario.executable);
-    const executableRoots = await Promise.all(policy.executableRoots.map((root) => realpath(root)));
+    const executableRoots = await canonicalizeConfiguredRoots(policy.executableRoots);
     if (!executableRoots.some((root) => isWithin(executable, root)))
         throw new ProcessCaptureError("resolved executable is outside approved roots");
     const workingDirectory = await realpath(scenario.working_directory);
-    const workingRoots = await Promise.all(policy.workingRoots.map((root) => realpath(root)));
+    const workingRoots = await canonicalizeConfiguredRoots(policy.workingRoots);
     if (!workingRoots.some((root) => isWithin(workingDirectory, root)))
         throw new ProcessCaptureError("resolved working directory is outside approved roots");
     for (const root of scenario.filesystem_roots) {

package/dist/application/ProcessCaptureLifecycle.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { mkdtemp, rm } from "node:fs/promises";
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { authorizeProcessScenario, digestProcessCommitment, processComparisonContract, processScenarioCommitment, } from "../domain/processCapture.js";
@@ -219,7 +219,6 @@ export const captureTerminalFrames = (options) => {
     let outputBytes = 0;
     let truncated = false;
     options.terminal.onData((data) => {
-        options.onFirstOutput();
         options.onOutput();
         const bytes = Buffer.byteLength(data);
         if (options.frames.length >= options.scenario.limits.frames ||
@@ -256,7 +255,7 @@ export const resolveProcessResult = (capture, executionFailure, cleanupFailure)
         throw new ProcessCaptureError("process capture produced no result");
     return capture;
 };
-export const prepareProcessCapture = async (scenario, policy, signal) => {
+export const prepareProcessCapture = async (scenario, policy, signal, host = systemProcessPreparationHost) => {
     const decision = authorizeProcessScenario(scenario, policy);
     if (!decision.allowed)
         throw new ProcessCaptureError(decision.reason, {
@@ -266,11 +265,22 @@ export const prepareProcessCapture = async (scenario, policy, signal) => {
     await assertRealPathAuthority(scenario, policy);
     assertNotCancelled(signal);
     const before = await snapshotRoots(scenario, signal);
-    const temporaryRoot = await mkdtemp(join(tmpdir(), "rea-process-"));
-    const runId = randomUUID();
-    const home = join(temporaryRoot, "home");
-    await import("node:fs/promises").then(({ mkdir }) => mkdir(home));
-    return { temporaryRoot, runId, home, before };
+    const temporaryRoot = await host.createTemporaryRoot();
+    try {
+        const runId = randomUUID();
+        const home = join(temporaryRoot, "home");
+        await host.createHome(home);
+        return { temporaryRoot, runId, home, before };
+    }
+    catch (cause) {
+        await host.cleanup(temporaryRoot);
+        throw cause;
+    }
+};
+const systemProcessPreparationHost = {
+    createTemporaryRoot: () => mkdtemp(join(tmpdir(), "rea-process-")),
+    createHome: (path) => mkdir(path),
+    cleanup: (path) => rm(path, { recursive: true, force: true }),
 };
 const processPolicyMessage = (reason) => {
     if (reason === "process capture is disabled")

package/dist/application/ProcessCheckpoints.js

@@ -105,7 +105,7 @@ export class ProcessCheckpoints {
             effects: classifyFilesystemEffects(previous, after.files),
             truncated: after.truncated,
         });
-        return this.#captures;
+        return structuredClone(this.#captures);
     }
     /** Cancel scheduled captures and await any snapshot already in progress. */
     async dispose() {

package/dist/application/ProcessCli.js

@@ -79,7 +79,13 @@ export const compareProcessEvidenceFiles = async (leftPath, rightPath) => {
     }
 };
 const parseCaptureEvidence = (input) => {
-    const evidence = parseEvidence(input);
+    let evidence;
+    try {
+        evidence = parseEvidence(input);
+    }
+    catch {
+        throw invalidCaptureEvidence();
+    }
     if (evidence.operation !== "capture_process_scenario" ||
         evidence.predicate_type !== "rea.process-capture/v4" ||
         evidence.provider.id !== PROCESS_PROVIDER.id ||
@@ -88,11 +94,17 @@ const parseCaptureEvidence = (input) => {
             throw new ProcessCliFailure("invalid_input", LEGACY_PROCESS_CAPTURE_MESSAGE);
         throw new ProcessCliFailure("invalid_input", "Capture evidence is not from the current process-capture workflow. Create new capture evidence, then try again.");
     }
-    return {
-        id: evidence.evidence_id,
-        capture: parseProcessCapture(evidence.normalized_result),
-    };
+    try {
+        return {
+            id: evidence.evidence_id,
+            capture: parseProcessCapture(evidence.normalized_result),
+        };
+    }
+    catch {
+        throw invalidCaptureEvidence();
+    }
 };
+const invalidCaptureEvidence = () => new ProcessCliFailure("invalid_input", "Capture evidence is malformed. Create new capture evidence, then try again.");
 const readJson = async (path) => {
     let bytes;
     try {

package/dist/application/ProcessHarness.js

@@ -81,16 +81,6 @@ const scheduleScenarioEvents = (options) => {
         timers.add(timer);
     }
 };
-const startScenarioEvents = (options) => {
-    let eventsStarted = false;
-    return () => {
-        if (eventsStarted)
-            return;
-        eventsStarted = true;
-        scheduleScenarioEvents(options);
-    };
-};
-const eventsRequireReadiness = (scenario) => scenario.events.some((event) => event.type === "input" || event.type === "resize");
 const cleanupFailedStartup = async (options) => {
     options.terminal?.kill("SIGKILL");
     const cleanupFailure = await releaseProcessResources({
@@ -134,23 +124,20 @@ const startCaptureRuntime = async (options) => {
             rows: scenario.terminal.rows,
             name: "xterm-256color",
         });
-        const startEvents = startScenarioEvents({
-            ...options,
-            getTerminal: () => terminal,
-            renderer,
-            started,
-        });
-        if (!eventsRequireReadiness(scenario))
-            startEvents();
         const framesTruncated = captureTerminalFrames({
             ...options,
             terminal,
             started,
             onOutput: () => (lastOutput = Date.now()),
-            onFirstOutput: startEvents,
             renderer,
             checkpoints,
         });
+        scheduleScenarioEvents({
+            ...options,
+            getTerminal: () => terminal,
+            renderer,
+            started,
+        });
         const stopSampler = startProcessSampler(terminal.pid, started, scenario.limits.processes, options.samples);
         return {
             replay,

package/dist/application/ProcessNormalization.js

@@ -14,7 +14,7 @@ export const normalizeProcessText = (value, scenario, temporaryRoot, pid) => {
             normalized = normalized.replaceAll(root, `<filesystem-root-${String(index)}>`);
     }
     if (scenario.normalization.pids)
-        normalized = normalized.replaceAll(String(pid), "<pid>");
+        normalized = normalizePidTokens(normalized, [pid]);
     if (scenario.normalization.ports)
         normalized = normalized.replaceAll(/(?<=[:=])\d{2,5}\b/g, "<port>");
     for (const pattern of scenario.normalization.patterns)
@@ -35,6 +35,12 @@ export const normalizeProcessSamples = (samples, scenario, rootPid) => {
     for (const identifier of identifiers)
         if (identifier > 0 && !mapping.has(identifier))
             mapping.set(identifier, mapping.size + 1);
+    const normalizeCommand = (command) => {
+        const normalized = normalizeProcessText(command, scenario, "<no-temporary-root>", rootPid);
+        return scenario.normalization.pids
+            ? normalizePidTokens(normalized, identifiers)
+            : normalized;
+    };
     return samples.map((sample) => ({
         at_ms: Math.floor(sample.at_ms / scenario.normalization.time_bucket_ms) *
             scenario.normalization.time_bucket_ms,
@@ -44,9 +50,18 @@ export const normalizeProcessSamples = (samples, scenario, rootPid) => {
             ? null
             : (mapping.get(sample.process_group_id) ?? 0),
         session_id: sample.session_id === null ? null : (mapping.get(sample.session_id) ?? 0),
-        command: normalizeProcessText(sample.command, scenario, "<no-temporary-root>", rootPid),
+        command: normalizeCommand(sample.command),
     }));
 };
+const normalizePidTokens = (value, identifiers) => {
+    const tokens = [...new Set(identifiers)]
+        .filter((identifier) => Number.isSafeInteger(identifier) && identifier > 0)
+        .sort((left, right) => right - left)
+        .map(String);
+    if (tokens.length === 0)
+        return value;
+    return value.replace(new RegExp(`(?<!\\d)(?:${tokens.join("|")})(?!\\d)`, "gu"), "<pid>");
+};
 export const redactProtocolEvents = (events, scenario) => events.map((event) => ({
     ...event,
     data: normalizeProcessText(event.data, scenario, "<no-temporary-root>", -1),

package/dist/application/ProcessOwnership.js

@@ -2,9 +2,10 @@ import { execFile } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
-const parseEnvironment = (value) => Object.fromEntries(value
+/** Parse the NUL-delimited Linux process environment without nameless keys. */
+export const parseProcessEnvironment = (value) => Object.fromEntries(value
     .split("\0")
-    .filter((entry) => entry.includes("="))
+    .filter((entry) => entry.indexOf("=") > 0)
     .map((entry) => {
     const separator = entry.indexOf("=");
     return [entry.slice(0, separator), entry.slice(separator + 1)];
@@ -31,7 +32,7 @@ const systemHost = {
     },
     async environment(pid) {
         if (process.platform === "linux") {
-            return parseEnvironment(await readFile(`/proc/${pid}/environ`, "utf8"));
+            return parseProcessEnvironment(await readFile(`/proc/${pid}/environ`, "utf8"));
         }
         const { stdout } = await execFileAsync("ps", ["eww", "-p", String(pid)]);
         const environment = {};

package/dist/application/ProcessSampling.js

@@ -1,5 +1,5 @@
 import { execFile } from "node:child_process";
-import { readFile } from "node:fs/promises";
+import { readFile, readdir } from "node:fs/promises";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
 const PROC_READ_CONCURRENCY = 64;
@@ -67,23 +67,58 @@ const readProcessCommand = async (pid, signal) => {
         return handleProcReadFailure(cause);
     }
 };
-const readLinuxChildren = async (pid, signal) => {
-    let text;
-    try {
-        text = await readFile(`/proc/${String(pid)}/task/${String(pid)}/children`, {
-            encoding: "utf8",
-            signal,
-        });
-    }
-    catch (cause) {
-        return handleProcReadFailure(cause);
+const systemLinuxChildrenHost = {
+    async taskIds(pid, signal) {
+        try {
+            signal.throwIfAborted();
+            const entries = await readdir(`/proc/${String(pid)}/task`);
+            signal.throwIfAborted();
+            return entries
+                .filter((entry) => /^\d+$/.test(entry))
+                .map(Number)
+                .filter((taskId) => Number.isSafeInteger(taskId) && taskId > 0)
+                .sort((left, right) => left - right);
+        }
+        catch (cause) {
+            return handleProcReadFailure(cause);
+        }
+    },
+    async children(pid, taskId, signal) {
+        try {
+            return await readFile(`/proc/${String(pid)}/task/${String(taskId)}/children`, { encoding: "utf8", signal });
+        }
+        catch (cause) {
+            return handleProcReadFailure(cause);
+        }
+    },
+};
+/** Read the deduplicated children created by every thread in a Linux process. */
+export const readLinuxChildren = async (pid, signal, host = systemLinuxChildrenHost) => {
+    const taskIds = await host.taskIds(pid, signal);
+    if (taskIds === undefined)
+        return undefined;
+    const children = new Set();
+    let successfulReads = 0;
+    for (let offset = 0; offset < taskIds.length; offset += PROC_READ_CONCURRENCY) {
+        const texts = await Promise.all(taskIds
+            .slice(offset, offset + PROC_READ_CONCURRENCY)
+            .map((taskId) => host.children(pid, taskId, signal)));
+        for (const text of texts) {
+            if (text === undefined)
+                continue;
+            successfulReads += 1;
+            for (const value of text.trim().split(/\s+/)) {
+                if (!/^\d+$/.test(value))
+                    continue;
+                const child = Number(value);
+                if (Number.isSafeInteger(child) && child > 0)
+                    children.add(child);
+            }
+        }
     }
-    return text
-        .trim()
-        .split(/\s+/)
-        .filter((value) => /^\d+$/.test(value))
-        .map(Number)
-        .filter((child) => Number.isSafeInteger(child) && child > 0);
+    return successfulReads === 0
+        ? undefined
+        : [...children].sort((left, right) => left - right);
 };
 const inspectProcess = async (pid, expectedParent, signal, identities) => {
     const before = await readProcessStat(pid, signal);

package/dist/application/ProjectPermissionStore.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
-import { mkdir, readFile, realpath, stat } from "node:fs/promises";
+import { lstat, mkdir, open, readFile, realpath, stat, unlink, } from "node:fs/promises";
 import { dirname } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 import writeFileAtomic from "write-file-atomic";
 import { z } from "zod";
 import { err, ok } from "../domain/result.js";
@@ -8,6 +9,7 @@ const grantSchema = z.object({
     grant_id: z.string().min(1),
     capability: z.enum([
         "process_capture",
+        "browser_observe",
         "evidence_read",
         "evidence_write",
         "investigation_input",
@@ -22,6 +24,7 @@ const grantSchema = z.object({
     roots: z.array(z.string()),
     executables: z.array(z.string()),
     environment_names: z.array(z.string()),
+    origins: z.array(z.string()).optional(),
     network: z.enum(["none", "loopback", "external"]),
     mount: z.boolean(),
     lifetime: z.literal("project"),
@@ -65,7 +68,15 @@ export const readProjectPermissionStore = async (path, projectRoot) => {
         const metadata = await stat(path);
         if ((metadata.mode & 0o077) !== 0)
             return err(new ProjectPermissionStoreError("not_owner_only"));
-        const parsed = storeSchema.safeParse(JSON.parse(await readFile(path, "utf8")));
+        const encoded = await readFile(path, "utf8");
+        let decoded;
+        try {
+            decoded = JSON.parse(encoded);
+        }
+        catch (cause) {
+            return err(new ProjectPermissionStoreError("invalid", { cause }));
+        }
+        const parsed = storeSchema.safeParse(decoded);
         if (!parsed.success ||
             parsed.data.project_id !== project.value.id ||
             parsed.data.project_root !== project.value.root)
@@ -107,4 +118,96 @@ export const writeProjectPermissionStore = async (path, projectRoot, grants) =>
         return err(new ProjectPermissionStoreError("io", { cause }));
     }
 };
-const isNotFound = (cause) => cause instanceof Error && "code" in cause && cause.code === "ENOENT";
+/** Revoke one grant while serializing the complete read-modify-write cycle. */
+export const revokeProjectPermissionGrant = async (path, projectRoot, grantId) => {
+    let lock;
+    try {
+        await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+        const acquired = await acquirePermissionStoreLock(path);
+        if (!acquired.ok)
+            return acquired;
+        lock = acquired.value;
+        const current = await readProjectPermissionStore(path, projectRoot);
+        if (!current.ok)
+            return current;
+        const grants = current.value?.grants ?? [];
+        const retained = grants.filter(({ grant_id }) => grant_id !== grantId);
+        if (retained.length === grants.length)
+            return ok(false);
+        const written = await writeProjectPermissionStore(path, projectRoot, retained);
+        return written.ok ? ok(true) : written;
+    }
+    catch (cause) {
+        return err(new ProjectPermissionStoreError("io", { cause }));
+    }
+    finally {
+        if (lock !== undefined)
+            await releasePermissionStoreLock(lock);
+    }
+};
+const acquirePermissionStoreLock = async (destination) => {
+    const path = `${destination}.lock`;
+    for (let attempt = 0; attempt < 100; attempt += 1) {
+        try {
+            return ok(await createPermissionStoreLock(path));
+        }
+        catch (cause) {
+            if (!isAlreadyExists(cause))
+                return err(new ProjectPermissionStoreError("io", { cause }));
+            if (await removeStalePermissionStoreLock(path))
+                continue;
+            if (attempt === 99)
+                return err(new ProjectPermissionStoreError("locked", { cause }));
+            await delay(10);
+        }
+    }
+    return err(new ProjectPermissionStoreError("locked"));
+};
+const createPermissionStoreLock = async (path) => {
+    const handle = await open(path, "wx", 0o600);
+    try {
+        await handle.writeFile(`${String(process.pid)}\n`, "utf8");
+        await handle.sync();
+        return { path, handle };
+    }
+    catch (cause) {
+        await handle.close().catch(() => undefined);
+        await unlink(path).catch(() => undefined);
+        throw cause;
+    }
+};
+const removeStalePermissionStoreLock = async (path) => {
+    try {
+        const metadata = await lstat(path);
+        if (!metadata.isFile() || metadata.isSymbolicLink() || metadata.size > 32)
+            return false;
+        const encoded = (await readFile(path, "utf8")).trim();
+        if (!/^[1-9][0-9]{0,9}$/u.test(encoded))
+            return false;
+        if (processIsAlive(Number(encoded)))
+            return false;
+        await unlink(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const processIsAlive = (pid) => {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (cause) {
+        return errorCode(cause) !== "ESRCH";
+    }
+};
+const releasePermissionStoreLock = async (lock) => {
+    await lock.handle.close().catch(() => undefined);
+    await unlink(lock.path).catch(() => undefined);
+};
+const isNotFound = (cause) => errorCode(cause) === "ENOENT";
+const isAlreadyExists = (cause) => errorCode(cause) === "EEXIST";
+const errorCode = (cause) => typeof cause === "object" && cause !== null && "code" in cause
+    ? cause.code
+    : undefined;

package/dist/application/ReferenceSourceImportPolicy.js

@@ -4,6 +4,7 @@ import ignore from "ignore";
 import { err, ok } from "../domain/result.js";
 import { withinRoot } from "../reference/ReferenceSourceReaderPaths.js";
 import { DEFAULT_REFERENCE_SOURCE_IGNORE_PATTERNS, DEFAULT_REFERENCE_SOURCE_LIMITS, } from "./ReferenceSourceImportTypes.js";
+import { canonicalizeConfiguredRoots } from "./ConfiguredRoots.js";
 const failure = (code, message) => ({
     tag: "reference-source-import",
     code,
@@ -29,8 +30,8 @@ const authorizeRoot = async (requestedRoot, approvedRoots) => {
         if (!(await stat(requestedRoot)).isDirectory())
             return err(failure("invalid-root", "Reference source root is not a directory"));
         const canonicalRoot = await realpath(resolve(requestedRoot));
-        for (const approvedRoot of approvedRoots) {
-            const canonicalApproved = await realpath(resolve(approvedRoot));
+        const canonicalApprovedRoots = await canonicalizeConfiguredRoots(approvedRoots.map((approvedRoot) => resolve(approvedRoot)));
+        for (const canonicalApproved of canonicalApprovedRoots) {
             if (withinRoot(canonicalApproved, canonicalRoot))
                 return ok(canonicalRoot);
         }

package/dist/application/TerminalRenderer.js

@@ -49,7 +49,7 @@ export class TerminalRenderer {
     /** Await all queued parsing and return immutable rendered observations. */
     async frames() {
         await this.#pending;
-        return this.#frames;
+        return structuredClone(this.#frames);
     }
     /** Whether a rendered observation exceeded its independent capture budget. */
     truncated() {

package/dist/artifacts/MachOSliceArtifactReader.js

@@ -59,7 +59,7 @@ export class MachOSliceArtifactReader {
         return Promise.resolve(createReadStream(this.path, { start: offset, end: offset + size - 1 }));
     }
     provenance() {
-        return this.#command === undefined ? [] : [this.#command];
+        return this.#command === undefined ? [] : [structuredClone(this.#command)];
     }
     close() {
         return Promise.resolve();

package/dist/artifacts/NativeDmgArtifactReader.js

@@ -67,7 +67,7 @@ export class NativeDmgArtifactReader {
         return this.#directory.open(entry, signal);
     }
     provenance() {
-        return this.#provenance;
+        return structuredClone(this.#provenance);
     }
     async close() {
         let detachFailure;

package/dist/artifacts/SafeOutputTree.js

@@ -59,7 +59,7 @@ export class SafeOutputTree {
         return this.#outputRoot;
     }
     get cleanup() {
-        return this.#cleanup;
+        return structuredClone(this.#cleanup);
     }
     /** Stream one selected regular file with exact byte and digest verification. */
     async write(relativePath, source, expectedSha256, signal) {
@@ -123,7 +123,7 @@ export class SafeOutputTree {
     /** Remove only this operation's unsealed tree and verify absence. */
     async rollback() {
         if (this.#published)
-            return this.#cleanup;
+            return structuredClone(this.#cleanup);
         await rm(this.#stagingRoot, { recursive: true, force: true });
         const absent = await isAbsent(this.#stagingRoot);
         this.#cleanup = {
@@ -133,7 +133,7 @@ export class SafeOutputTree {
         };
         if (!absent)
             throw new ArtifactReaderFailure("integrity", "Extraction output cleanup could not be verified");
-        return this.#cleanup;
+        return structuredClone(this.#cleanup);
     }
     async #prepareParent(relativePath) {
         const parts = relativePath.split("/");