synapse 2.225.0__tar.gz → 2.226.0__tar.gz

{synapse-2.225.0/synapse.egg-info → synapse-2.226.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: synapse
-Version: 2.225.0
+Version: 2.226.0
 Summary: Synapse Intelligence Analysis Framework
 Author-email: The Vertex Project LLC <root@vertex.link>
 License-Expression: Apache-2.0

{synapse-2.225.0 → synapse-2.226.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = 'setuptools.build_meta'
 
 [project]
 name = 'synapse'
-version = '2.225.0'
+version = '2.226.0'
 authors = [
     { name = 'The Vertex Project LLC', email = 'root@vertex.link'},
 ]

{synapse-2.225.0 → synapse-2.226.0}/synapse/cortex.py

@@ -1538,11 +1538,9 @@ class Cortex(s_oauth.OAuthMixin, s_cell.Cell):  # type: ignore
              'desc': 'Controls access to deleting storm packages.'},
 
             {'perm': ('storm', 'asroot', 'cmd', '<cmdname>'), 'gate': 'cortex',
-            'desc': 'Controls running storm commands requiring root privileges.',
-             'ex': 'storm.asroot.cmd.movetag'},
+            'desc': 'Deprecated. Please use Storm modules to implement functionality requiring root privileges.'},
             {'perm': ('storm', 'asroot', 'mod', '<modname>'), 'gate': 'cortex',
-            'desc': 'Controls importing modules requiring root privileges.',
-             'ex': 'storm.asroot.cmd.synapse-misp.privsep'},
+            'desc': 'Deprecated. Storm modules should use the asroot:perms key to specify the permissions they require.'},
 
             {'perm': ('storm', 'graph', 'add'), 'gate': 'cortex',
              'desc': 'Controls access to add a storm graph.',
@@ -6914,7 +6912,7 @@ class Cortex(s_oauth.OAuthMixin, s_cell.Cell):  # type: ignore
         Delete a cron job
 
         Args:
-            iden (bytes):  The iden of the cron job to be deleted
+            iden (str):  The iden of the cron job to be deleted
         '''
         await self._killCronTask(iden)
         try:
@@ -6931,7 +6929,7 @@ class Cortex(s_oauth.OAuthMixin, s_cell.Cell):  # type: ignore
         Change an existing cron job's query
 
         Args:
-            iden (bytes):  The iden of the cron job to be changed
+            iden (str):  The iden of the cron job to be changed
         '''
         await self.agenda.mod(iden, query)
         await self.feedBeholder('cron:edit:query', {'iden': iden, 'query': query}, gates=[iden])
@@ -6942,7 +6940,7 @@ class Cortex(s_oauth.OAuthMixin, s_cell.Cell):  # type: ignore
         Enable a cron job
 
         Args:
-            iden (bytes):  The iden of the cron job to be changed
+            iden (str):  The iden of the cron job to be changed
         '''
         await self.agenda.enable(iden)
         await self.feedBeholder('cron:enable', {'iden': iden}, gates=[iden])
@@ -6954,7 +6952,7 @@ class Cortex(s_oauth.OAuthMixin, s_cell.Cell):  # type: ignore
         Enable a cron job
 
         Args:
-            iden (bytes):  The iden of the cron job to be changed
+            iden (str):  The iden of the cron job to be changed
         '''
         await self.agenda.disable(iden)
         await self._killCronTask(iden)

{synapse-2.225.0 → synapse-2.226.0}/synapse/lib/agenda.py

@@ -430,6 +430,9 @@ class _Appt:
 
             if name == 'lasterrs' and not isinstance(valu, list):
                 valu = list(valu)
+            elif name == 'nexttime' and valu is None:
+                self.recs.clear()
+                self.stor._delete_appt_from_heap(self)
 
             setattr(self, name, valu)
 
@@ -469,7 +472,6 @@ class Agenda(s_base.Base):
         self.apptheap = []
         self.appts = {}
 
-        to_delete = []
         for iden, info in self.apptdefs.items():
             try:
                 appt = _Appt.unpack(self, info)
@@ -479,18 +481,30 @@ class Agenda(s_base.Base):
                 self._next_indx = max(self._next_indx, appt.indx + 1)
             except (s_exc.InconsistentStorage, s_exc.BadStorageVersion, s_exc.BadTime, TypeError, KeyError,
                     UnicodeDecodeError) as e:
-                logger.warning('Invalid appointment %r found in storage: %r.  Removing.', iden, e)
-                to_delete.append(iden)
-                continue
-
-        for iden in to_delete:
-            self.apptdefs.pop(iden)
+                logger.warning('Invalid appointment %r found in storage: %r. This appointment will be removed.', iden, e)
 
         # Make sure we don't assign the same index to 2 appointments
         if self.appts:
             maxindx = max(appt.indx for appt in self.appts.values())
             self._next_indx = maxindx + 1
 
+    async def _clear_invalid(self):
+
+        to_delete = []
+        for iden, info in self.apptdefs.items():
+            try:
+                appt = _Appt.unpack(self, info)
+                if appt.iden != iden:
+                    raise s_exc.InconsistentStorage(mesg='iden inconsistency')
+
+            except (s_exc.InconsistentStorage, s_exc.BadStorageVersion, s_exc.BadTime, TypeError, KeyError,
+                    UnicodeDecodeError) as e:
+                logger.warning('Removing invalid appointment %r.', iden)
+                to_delete.append(iden)
+
+        for iden in to_delete:
+            await self.core.delCronJob(iden)
+
     def _addappt(self, iden, appt):
         '''
         Updates the data structures to add an appointment
@@ -685,14 +699,13 @@ class Agenda(s_base.Base):
         '''
         Delete an appointment
         '''
-        appt = self.appts.get(iden)
-        if appt is None:
+        if not self.apptdefs.delete(iden):
             mesg = f'No cron job with iden: {iden}'
             raise s_exc.NoSuchIden(iden=iden, mesg=mesg)
 
-        self._delete_appt_from_heap(appt)
-        del self.appts[iden]
-        self.apptdefs.delete(iden)
+        if (appt := self.appts.get(iden)) is not None:
+            self._delete_appt_from_heap(appt)
+            del self.appts[iden]
 
     def _delete_appt_from_heap(self, appt):
         try:
@@ -729,14 +742,14 @@ class Agenda(s_base.Base):
                 await self.core.addCronEdits(appt.iden, edits)
                 await self.core.feedBeholder('cron:stop', {'iden': appt.iden})
 
-                if appt.nexttime is None:
-                    self._delete_appt_from_heap(appt)
-
     async def runloop(self):
         '''
         Task loop to issue query tasks at the right times.
         '''
         await self.clearRunningStatus()
+
+        await self._clear_invalid()
+
         while not self.isfini:
 
             timeout = None

{synapse-2.225.0 → synapse-2.226.0}/synapse/lib/ast.py

@@ -3452,10 +3452,6 @@ class PropValue(Value):
                 raise self.kids[0].addExcInfo(exc)
 
             valu = path.node.get(name)
-            if isinstance(valu, (dict, list, tuple)):
-                # these get special cased because changing them affects the node
-                # while it's in the pipeline but the modification doesn't get stored
-                valu = s_msgpack.deepcopy(valu)
             return prop, valu
 
         # handle implicit pivot properties
@@ -3479,10 +3475,6 @@ class PropValue(Value):
                 raise self.kids[0].addExcInfo(exc)
 
             if i >= imax:
-                if isinstance(valu, (dict, list, tuple)):
-                    # these get special cased because changing them affects the node
-                    # while it's in the pipeline but the modification doesn't get stored
-                    valu = s_msgpack.deepcopy(valu)
                 return prop, valu
 
             form = runt.model.forms.get(prop.type.name)
@@ -3495,6 +3487,10 @@ class PropValue(Value):
 
     async def compute(self, runt, path):
         prop, valu = await self.getPropAndValu(runt, path)
+
+        if prop:
+            valu = await prop.type.tostorm(valu)
+
         return valu
 
 class RelPropValue(PropValue):

{synapse-2.225.0 → synapse-2.226.0}/synapse/lib/platforms/linux.py

@@ -112,7 +112,9 @@ def getSysctls():
         ('vm.dirty_expire_centisecs', '/proc/sys/vm/dirty_expire_centisecs', int),
         ('vm.dirty_writeback_centisecs', '/proc/sys/vm/dirty_writeback_centisecs', int),
         ('vm.dirty_background_ratio', '/proc/sys/vm/dirty_background_ratio', int),
+        ('vm.dirty_background_bytes', '/proc/sys/vm/dirty_background_bytes', int),
         ('vm.dirty_ratio', '/proc/sys/vm/dirty_ratio', int),
+        ('vm.dirty_bytes', '/proc/sys/vm/dirty_bytes', int),
     )
     ret = {}
     for key, fp, func in _sysctls:

{synapse-2.225.0 → synapse-2.226.0}/synapse/lib/storm.py

@@ -2521,9 +2521,17 @@ class PureCmd(Cmd):
         perm = ('storm', 'asroot', 'cmd') + tuple(name.split('.'))
 
         asroot = runt.allowed(perm)
-        if self.asroot and not asroot:
-            mesg = f'Command ({name}) elevates privileges.  You need perm: storm.asroot.cmd.{name}'
-            raise s_exc.AuthDeny(mesg=mesg, user=runt.user.iden, username=runt.user.name)
+        if self.asroot:
+            mesg = f'Command ({name}) requires asroot permission which is deprecated and will be removed in v3.0.0. ' \
+                    'Functionality which requires elevated permissions should be implemented in Storm modules and use ' \
+                    'asroot:perms to specify the required permissions.'
+
+            s_common.deprecated('Storm command asroot key', curv='2.226.0', eolv='3.0.0')
+            await runt.warnonce(mesg, log=False)
+
+            if not asroot:
+                mesg = f'Command ({name}) elevates privileges.  You need perm: storm.asroot.cmd.{name}'
+                raise s_exc.AuthDeny(mesg=mesg, user=runt.user.iden, username=runt.user.name)
 
         # if a command requires perms, check em!
         # ( used to create more intuitive perm boundaries )

{synapse-2.225.0 → synapse-2.226.0}/synapse/lib/stormlib/aha.py

@@ -740,10 +740,10 @@ The ready column indicates that a service has entered into the realtime change w
                     $info = $cell_infos.$svcname
                     $cell_info = $info.cell
                     $status.nexs_indx = $cell_info.nexsindx
-                    if ($cell_info.uplink) {
-                        $status.role = 'follower'
-                    } else {
+                    if ($cell_info.active) {
                         $status.role = 'leader'
+                    } else {
+                        $status.role = 'follower'
                     }
                     $status.version = $info.cell.verstring
                     $status.synapse_version = $info.synapse.verstring

{synapse-2.225.0 → synapse-2.226.0}/synapse/lib/stormtypes.py

@@ -1499,9 +1499,16 @@ class LibBase(Lib):
             perm = ('storm', 'asroot', 'mod') + tuple(name.split('.'))
             asroot = self.runt.allowed(perm)
 
-            if mdef.get('asroot', False) and not asroot:
-                mesg = f'Module ({name}) elevates privileges.  You need perm: storm.asroot.mod.{name}'
-                raise s_exc.AuthDeny(mesg=mesg, user=self.runt.user.iden, username=self.runt.user.name)
+            if mdef.get('asroot', False):
+                mesg = f'Module ({name}) requires asroot permission but does not specify any asroot:perms. ' \
+                        'storm.asroot.mod.<modname> style permissons are deprecated and will be removed in v3.0.0.'
+
+                s_common.deprecated('Storm module asroot key', curv='2.226.0', eolv='3.0.0')
+                await self.runt.warnonce(mesg, log=False)
+
+                if not asroot:
+                    mesg = f'Module ({name}) elevates privileges.  You need perm: storm.asroot.mod.{name}'
+                    raise s_exc.AuthDeny(mesg=mesg, user=self.runt.user.iden, username=self.runt.user.name)
 
         modr = await self.runt.getModRuntime(query, opts={'vars': {'modconf': modconf}})
         modr.asroot = asroot

{synapse-2.225.0 → synapse-2.226.0}/synapse/lib/types.py

@@ -32,6 +32,8 @@ class Type:
     # ( due to hot-loop needs in the storm runtime )
     isarray = False
 
+    ismutable = False
+
     def __init__(self, modl, name, info, opts):
         '''
         Construct a new Type object.
@@ -369,6 +371,17 @@ class Type:
         topt.update(opts)
         return self.__class__(self.modl, self.name, self.info, topt)
 
+    async def tostorm(self, valu):
+        '''
+        Allows type-specific modifications to values to make them safe for use in the runtime.
+
+        Args:
+            valu (any): The valu to update.
+        '''
+        if self.ismutable:
+            return s_msgpack.deepcopy(valu, use_list=True)
+        return valu
+
     def __eq__(self, othr):
         if self.name != othr.name:
             return False
@@ -415,6 +428,7 @@ class Bool(Type):
 class Array(Type):
 
     isarray = True
+    ismutable = True
 
     def postTypeInit(self):
 
@@ -534,6 +548,9 @@ class Comp(Type):
 
             _type = self.tcache[name]
 
+            if _type.ismutable:
+                self.ismutable = True
+
             norm, info = _type.norm(valu[i])
 
             subs[name] = norm
@@ -1623,6 +1640,8 @@ class TimeEdge(Edge):
 
 class Data(Type):
 
+    ismutable = True
+
     stortype = s_layer.STOR_TYPE_MSGP
 
     def postTypeInit(self):
@@ -1643,6 +1662,7 @@ class Data(Type):
 
 class NodeProp(Type):
 
+    ismutable = True
     stortype = s_layer.STOR_TYPE_MSGP
 
     def postTypeInit(self):

{synapse-2.225.0 → synapse-2.226.0}/synapse/lib/version.py

@@ -223,6 +223,6 @@ def reqVersion(valu, reqver,
 ##############################################################################
 # The following are touched during the release process by bumpversion.
 # Do not modify these directly.
-version = (2, 225, 0)
+version = (2, 226, 0)
 verstring = '.'.join([str(x) for x in version])
-commit = 'd2ab923e3df9fe64611ac05b6ffdd7e8c2dc1b22'
+commit = '90a28a430a0b2b1f8cc74af240f55bfcf717b582'

{synapse-2.225.0 → synapse-2.226.0}/synapse/models/base.py

@@ -176,6 +176,9 @@ class BaseModule(s_module.CoreModule):
                 ((None, 'refs', None), {
                     'doc': 'The source node contains a reference to the target node.'}),
 
+                ((None, 'linked', None), {
+                    'doc': 'The source node is linked to the target node.'}),
+
                 (('meta:source', 'seen', None), {
                     'doc': 'The meta:source observed the target node.'}),
 

{synapse-2.225.0 → synapse-2.226.0}/synapse/models/inet.py

@@ -1550,13 +1550,23 @@ class InetModule(s_module.CoreModule):
                     ('inet:ssl:jarmsample', ('comp', {'fields': (('server', 'inet:server'), ('jarmhash', 'inet:ssl:jarmhash'))}), {
                         'doc': 'A JARM hash sample taken from a server.'}),
 
+                    ('inet:service:platform:type:taxonomy', ('taxonomy', {}), {
+                        'interfaces': ('meta:taxonomy',),
+                        'doc': 'A service platform type taxonomy.'}),
+
                     ('inet:service:platform', ('guid', {}), {
                         'doc': 'A network platform which provides services.'}),
 
+                    ('inet:service:agent', ('guid', {}), {
+                        'interfaces': ('inet:service:object',),
+                        'template': {'service:base': 'agent'},
+                        'doc': 'An instance of a deployed agent or software integration which is part of the service architecture.'}),
+
                     ('inet:service:app', ('guid', {}), {
                         'interfaces': ('inet:service:object',),
                         'template': {'service:base': 'application'},
-                        'doc': 'An application which is part of a service architecture.'}),
+                        'deprecated': True,
+                        'doc': 'Deprecated. Please use inet:service:agent for autonomous agents.'}),
 
                     ('inet:service:instance', ('guid', {}), {
                         'doc': 'An instance of the platform such as Slack or Discord instances.'}),
@@ -1795,7 +1805,8 @@ class InetModule(s_module.CoreModule):
                                 'doc': 'The service account which removed or decommissioned the {service:base}.'}),
 
                             ('app', ('inet:service:app', {}), {
-                                'doc': 'The app which contains the {service:base}.'}),
+                                'deprecated': True,
+                                'doc': 'Deprecated. Objects are no longer scoped to an application or agent.'}),
                         ),
                     }),
 
@@ -1816,7 +1827,11 @@ class InetModule(s_module.CoreModule):
                         'props': (
 
                             ('app', ('inet:service:app', {}), {
-                                'doc': 'The app which handled the action.'}),
+                                'deprecated': True,
+                                'doc': 'Deprecated. Please use :agent / inet:service:agent.'}),
+
+                            ('agent', ('inet:service:agent', {}), {
+                                'doc': 'The service agent which performed the action potentially on behalf of an account.'}),
 
                             ('time', ('time', {}), {
                                 'doc': 'The time that the account initiated the action.'}),
@@ -1851,8 +1866,12 @@ class InetModule(s_module.CoreModule):
                             ('client:host', ('it:host', {}), {
                                 'doc': 'The client host which initiated the action.'}),
 
+                            ('client:software', ('it:prod:softver', {}), {
+                                'doc': 'The client software used to initiate the action.'}),
+
                             ('client:app', ('inet:service:app', {}), {
-                                'doc': 'The client service app which initiated the action.'}),
+                                'deprecated': True,
+                                'doc': 'Deprecated. Please use :client:software.'}),
 
                             ('server', ('inet:server', {}), {
                                 'doc': 'The network address of the server which handled the action.'}),
@@ -3698,6 +3717,8 @@ class InetModule(s_module.CoreModule):
                             'ro': True,
                             'doc': 'The x509 certificate sent by the client.'})
                     )),
+
+                    ('inet:service:platform:type:taxonomy', {}, ()),
                     ('inet:service:platform', {}, (
 
                         ('id', ('str', {'strip': True}), {
@@ -3732,6 +3753,12 @@ class InetModule(s_module.CoreModule):
                             'disp': {'hint': 'text'},
                             'doc': 'A description of the service platform.'}),
 
+                        ('type', ('inet:service:platform:type:taxonomy', {}), {
+                            'doc': 'The type of service platform.'}),
+
+                        ('family', ('str', {'onespace': True, 'lower': True}), {
+                            'doc': 'A family designation for use with instanced platforms such as Slack, Discord, or Mastodon.'}),
+
                         ('parent', ('inet:service:platform', {}), {
                             'doc': 'A parent platform which owns this platform.'}),
 
@@ -3752,6 +3779,9 @@ class InetModule(s_module.CoreModule):
 
                         ('provider:name', ('ou:name', {}), {
                             'doc': 'The name of the organization which operates the platform.'}),
+
+                        ('software', ('it:prod:softver', {}), {
+                            'doc': 'The latest known software version that the platform is running.'}),
                     )),
 
                     ('inet:service:instance', {}, (
@@ -3791,7 +3821,8 @@ class InetModule(s_module.CoreModule):
                             'doc': 'The tenant which contains the instance.'}),
 
                         ('app', ('inet:service:app', {}), {
-                            'doc': 'The app which contains the instance.'}),
+                            'deprecated': True,
+                            'doc': 'Deprecated. Instances are no longer scoped to applications.'}),
                     )),
 
                     ('inet:service:app', {}, (
@@ -3816,6 +3847,25 @@ class InetModule(s_module.CoreModule):
                             'doc': 'The name of the organization which provides the application.'}),
                     )),
 
+                    ('inet:service:agent', {}, (
+
+                        ('name', ('str', {'lower': True, 'onespace': True}), {
+                            'alts': ('names',),
+                            'doc': 'The name of the service agent instance.'}),
+
+                        ('names', ('array', {'type': 'str',
+                                             'typeopts': {'onespace': True, 'lower': True},
+                                             'sorted': True, 'uniq': True}), {
+                            'doc': 'An array of alternate names for the service agent instance.'}),
+
+                        ('desc', ('str', {}), {
+                            'disp': {'hint': 'text'},
+                            'doc': 'A description of the deployed service agent instance.'}),
+
+                        ('software', ('it:prod:softver', {}), {
+                            'doc': 'The latest known software version running on the service agent instance.'}),
+                    )),
+
                     ('inet:service:account', {}, (
 
                         ('user', ('inet:user', {}), {
@@ -3911,6 +3961,9 @@ class InetModule(s_module.CoreModule):
 
                     ('inet:service:login', {}, (
 
+                        ('url', ('inet:url', {}), {
+                            'doc': 'The URL of the login endpoint used for this login attempt.'}),
+
                         ('method', ('inet:service:login:method:taxonomy', {}), {
                             'doc': 'The type of authentication used for the login. For example "password" or "multifactor.sms".'}),
 

{synapse-2.225.0 → synapse-2.226.0}/synapse/models/infotech.py

@@ -803,6 +803,9 @@ class ItModule(s_module.CoreModule):
                 ('it:dev:repo:diff', ('guid', {}), {
                     'doc': 'A diff of a file being applied in a single commit.',
                 }),
+                ('it:dev:repo:entry', ('guid', {}), {
+                    'doc': 'A file included in a repository.',
+                }),
                 ('it:dev:repo:issue:label', ('guid', {}), {
                     'interfaces': ('inet:service:object',),
                     'template': {'service:base': 'repository issue label'},
@@ -1119,6 +1122,10 @@ class ItModule(s_module.CoreModule):
                     'doc': 'The YARA rule is intended for use in detecting the target node.'}),
                 (('it:dev:repo', 'has', 'inet:url'), {
                     'doc': 'The repo has content hosted at the URL.'}),
+                (('it:dev:repo:commit', 'has', 'it:dev:repo:entry'), {
+                    'doc': 'The file entry is present in the commit version of the repository.'}),
+                (('it:log:event', 'about', None), {
+                    'doc': 'The it:log:event is about the target node.'}),
             ),
             'forms': (
                 ('it:hostname', {}, ()),
@@ -2001,6 +2008,17 @@ class ItModule(s_module.CoreModule):
                         'doc': 'The URL where the diff is hosted.'}),
                 )),
 
+                ('it:dev:repo:entry', {}, (
+
+                    ('repo', ('it:dev:repo', {}), {
+                        'doc': 'The repository which contains the file.'}),
+
+                    ('file', ('file:bytes', {}), {
+                        'doc': 'The file which the repository contains.'}),
+
+                    ('path', ('file:path', {}), {
+                        'doc': 'The path to the file in the repository.'}),
+                )),
                 ('it:dev:repo:issue', {}, (
 
                     ('repo', ('it:dev:repo', {}), {

{synapse-2.225.0 → synapse-2.226.0}/synapse/tests/test_cortex.py

@@ -9093,3 +9093,116 @@ class CortexBasicTest(s_t_utils.SynTest):
         async with self.getRegrCore('2.213.0-queue-authgates') as core:
             self.nn(await core.getAuthGate('queue:stillhere'))
             self.none(await core.getAuthGate('queue:authtest'))
+
+    async def test_cortex_prop_copy(self):
+        async with self.getTestCore() as core:
+            q = '[test:arrayprop=(ap0,) :strs=(foo, bar, baz)]'
+            self.len(1, await core.nodes(q))
+
+            q = 'test:arrayprop=(ap0,) $l=:strs $r=$l.rem(baz) return(($r, $l))'
+            valu = await core.callStorm(q)
+            self.true(valu[0])
+            self.sorteq(valu[1], ['foo', 'bar'])
+
+            # modifying the property value shouldn't update the node
+            nodes = await core.nodes('test:arrayprop=(ap0,) $l=:strs $l.rem(baz)')
+            self.len(1, nodes)
+            self.sorteq(nodes[0].get('strs'), ['foo', 'bar', 'baz'])
+
+            data = {
+                'str': 'strval',
+                'int': 1,
+                'dict': {'dictkey': 'dictval'},
+                'list': ('listval0', 'listval1'),
+                'tuple': ('tupleval0', 'tupleval1'),
+            }
+
+            opts = {
+                'vars': {
+                    'data': data,
+                }
+            }
+            q = '''
+                [ test:guid=(d0,)
+                    :data=$data
+                    :comp=(1, foo)
+                    :mutcomp=(foo, (1, 2, 3))
+                ]
+            '''
+            self.len(1, await core.nodes(q, opts=opts))
+
+            q = '''
+                test:guid=(d0,)
+                $d=:data
+                $d.list.rem(listval0)
+                $d.str = foo
+                $d.int = ($d.int + 1)
+                $d.dict.foo = bar
+                $d.tuple.append(tupleval2)
+                return($d)
+            '''
+            valu = await core.callStorm(q)
+            self.eq(valu, {
+                    'str': 'foo',
+                    'int': 2,
+                    'dict': {'dictkey': 'dictval', 'foo': 'bar'},
+                    'list': ('listval1',),
+                    'tuple': ('tupleval0', 'tupleval1', 'tupleval2'),
+            })
+
+            # modifying the property value shouldn't update the node
+            q = '''
+                test:guid=(d0,)
+                $d=:data
+                $d.dict = $lib.undef
+            '''
+            nodes = await core.nodes(q)
+            self.len(1, nodes)
+            self.eq(nodes[0].get('data')['dict'], {'dictkey': 'dictval'})
+
+            q = '''
+                test:guid=(d0,)
+                $c=:comp
+                $c.rem((1))
+                $m=:mutcomp
+                $m.1.rem((3))
+                return(($c, :comp, $m, :mutcomp))
+            '''
+            valu = await core.callStorm(q)
+            self.eq(valu, (
+                (1, 'foo'),
+                (1, 'foo'),
+                ('foo', (1, 2)),
+                ('foo', (1, 2, 3)),
+            ))
+
+            # Nodeprops could have mutable types in them so make sure modifying
+            # them doesn't cause modifications to the node
+            q = '''
+                $data = { test:guid=(d0,) return(:data) }
+                [ test:str=foobar :baz=(test:guid:data, $data) ]
+                ($prop, $valu) = :baz
+                $valu.list.rem(listval0)
+                return((:baz, $valu))
+            '''
+            valu = await core.callStorm(q)
+
+            exp = {
+                'str': 'strval',
+                'int': 1,
+                'dict': {'dictkey': 'dictval'},
+                'list': ('listval1',),
+                'tuple': ('tupleval0', 'tupleval1'),
+            }
+
+            self.eq(valu, (('test:guid:data', data), exp))
+
+            # Make sure $node.props aren't modifiable either
+            nodes = await core.nodes('test:str=foobar $node.props.baz.1.list.rem(listval0)')
+            self.len(1, nodes)
+            self.eq(nodes[0].get('baz'), ('test:guid:data', data))
+
+            # Dereferencing mutable types from $node.props should
+            # return mutable instances without mutating the original prop valu
+            valu = await core.callStorm('test:str=foobar ($prop, $valu) = :baz $valu.list.rem(listval0) return((:baz, $valu))')
+            self.eq(valu, (('test:guid:data', data), exp))