avorelo 0.1.0

package/scripts/lib/agent-security/enforcement-engine.js

@@ -0,0 +1,1129 @@
+"use strict";
+
+const crypto = require("crypto");
+const { safeReadJson, safeWriteJson } = require("../fsx");
+const {
+  ENFORCEMENT_CAPABILITIES_REL_PATH,
+  resolveAgentSecurityAdapter,
+  writeEnforcementCapabilityMatrix,
+} = require("./adapter-registry");
+const { normalizeAgentSecurityAction } = require("./action-evaluator");
+const {
+  contentHashFromAction,
+  normalizeTargetPath,
+  targetHashFromAction,
+} = require("./file-write-rules");
+const { argsHashFromAction, targetHashFromMcpAction } = require("./mcp-action-rules");
+
+const ENFORCEMENT_SUMMARY_REL_PATH = ".claude/cco/security/agent-enforcement-summary.json";
+const JIT_GRANTS_REL_PATH = ".claude/cco/security/agent-jit-grants.json";
+const ONE_TIME_GRANTS_REL_PATH = ".claude/cco/security/agent-one-time-grants.json";
+const ENFORCEMENT_AUDIT_LOG_REL_PATH = ".claude/cco/audit/agent-security-enforcement.jsonl";
+const DEFAULT_GRANT_TTL_SECONDS = 1800;
+
+function sha256(value) {
+  return crypto.createHash("sha256").update(String(value || "")).digest("hex");
+}
+
+function shortHash(value) {
+  return sha256(value).slice(0, 12);
+}
+
+function appendJsonl(cwd, relPath, entry) {
+  const fs = require("fs");
+  const path = require("path");
+  const absPath = path.join(cwd, relPath);
+  fs.mkdirSync(path.dirname(absPath), { recursive: true });
+  fs.appendFileSync(absPath, `${JSON.stringify(entry)}\n`, "utf8");
+}
+
+function toIso(dateLike) {
+  return new Date(dateLike).toISOString();
+}
+
+function addSeconds(timestamp, seconds) {
+  return toIso(Date.parse(timestamp) + (Number(seconds) * 1000));
+}
+
+function commandHash(command) {
+  return sha256(String(command || ""));
+}
+
+function ttlSecondsFromRecommendation(value) {
+  const normalized = String(value || "").toLowerCase();
+  if (normalized.includes("30 minute")) return 1800;
+  if (normalized.includes("15 minute")) return 900;
+  if (normalized.includes("this session")) return 14400;
+  if (normalized.includes("once")) return DEFAULT_GRANT_TTL_SECONDS;
+  return DEFAULT_GRANT_TTL_SECONDS;
+}
+
+function normalizeGrant(grant) {
+  if (!grant || typeof grant !== "object") return null;
+  const ttlSeconds = Number(grant.ttlSeconds);
+  return {
+    grantId: String(grant.grantId || `grant-${shortHash(JSON.stringify(grant))}`),
+    grantType: "jit_permission",
+    decision: String(grant.decision || "approve_once"),
+    actionId: grant.actionId || null,
+    componentId: grant.componentId || null,
+    componentType: grant.componentType || null,
+    actionType: grant.actionType || null,
+    adapterId: grant.adapterId || null,
+    commandHash: grant.commandHash || null,
+    targetHash: grant.targetHash || null,
+    contentHash: grant.contentHash || null,
+    argsHash: grant.argsHash || null,
+    scope: {
+      cwd: String(grant.scope?.cwd || ""),
+      paths: Array.isArray(grant.scope?.paths) ? grant.scope.paths : [],
+      repo: String(grant.scope?.repo || "current"),
+      branchPrefix: String(grant.scope?.branchPrefix || "wuz/"),
+      allowedCommands: Array.isArray(grant.scope?.allowedCommands) ? grant.scope.allowedCommands : [],
+      allowedTargets: Array.isArray(grant.scope?.allowedTargets) ? grant.scope.allowedTargets : [],
+      packageManager: grant.scope?.packageManager || null,
+      scriptName: grant.scope?.scriptName || null,
+      packageName: grant.scope?.packageName || null,
+      mcpServer: grant.scope?.mcpServer || null,
+      toolName: grant.scope?.toolName || null,
+    },
+    allowedActions: Array.isArray(grant.allowedActions) ? grant.allowedActions : [],
+    deniedActions: Array.isArray(grant.deniedActions) ? grant.deniedActions : [],
+    ttlSeconds: Number.isFinite(ttlSeconds) && ttlSeconds > 0 ? ttlSeconds : DEFAULT_GRANT_TTL_SECONDS,
+    createdAt: grant.createdAt || null,
+    expiresAt: grant.expiresAt || null,
+    singleUse: grant.singleUse !== false,
+    consumedAt: grant.consumedAt || null,
+    reason: String(grant.reason || ""),
+    enforcementAvailable: grant.enforcementAvailable === true,
+  };
+}
+
+function loadJitGrantStore(cwd) {
+  const preferred = safeReadJson(cwd, JIT_GRANTS_REL_PATH, null);
+  const legacy = preferred ? null : safeReadJson(cwd, ONE_TIME_GRANTS_REL_PATH, null);
+  const source = preferred || legacy;
+  if (!source || typeof source !== "object") {
+    return {
+      grantsVersion: 2,
+      what: "Agent Security JIT Permission Grants.",
+      generatedAt: null,
+      grants: [],
+    };
+  }
+
+  return {
+    grantsVersion: 2,
+    what: "Agent Security JIT Permission Grants.",
+    generatedAt: source.generatedAt || null,
+    grants: (Array.isArray(source.grants) ? source.grants : [])
+      .map((grant) => normalizeGrant(grant))
+      .filter(Boolean),
+  };
+}
+
+function saveJitGrantStore(cwd, store) {
+  const normalized = {
+    grantsVersion: 2,
+    what: "Agent Security JIT Permission Grants.",
+    generatedAt: store.generatedAt || null,
+    grants: (Array.isArray(store.grants) ? store.grants : []).map((grant) => normalizeGrant(grant)).filter(Boolean),
+  };
+  safeWriteJson(cwd, JIT_GRANTS_REL_PATH, normalized);
+  safeWriteJson(cwd, ONE_TIME_GRANTS_REL_PATH, normalized);
+  return normalized;
+}
+
+function isGrantExpired(grant, timestamp) {
+  const expiresAt = Date.parse(grant?.expiresAt || "");
+  const comparedAt = Date.parse(timestamp || "");
+  if (!Number.isFinite(expiresAt) || !Number.isFinite(comparedAt)) return true;
+  return expiresAt <= comparedAt;
+}
+
+function countActiveJitGrants(store, timestamp) {
+  return (store?.grants || []).filter((grant) => grant && !grant.consumedAt && !isGrantExpired(grant, timestamp)).length;
+}
+
+function matchesGrantAction(grant, action, cwd) {
+  if (!grant || !action) return false;
+  if (grant.actionType !== action.actionType) return false;
+  if ((grant.componentId || null) !== (action.componentId || null)) return false;
+  if (String(grant.scope?.cwd || "") !== String(cwd || "")) return false;
+  if (grant.actionType === "filesystem.write") {
+    const targetHash = targetHashFromAction(action);
+    const contentHash = contentHashFromAction(action);
+    if (!grant.targetHash || !targetHash || grant.targetHash !== targetHash) return false;
+    if (grant.contentHash && contentHash !== grant.contentHash) return false;
+    return true;
+  }
+  if (grant.actionType === "package.install" || grant.actionType === "package.run" || grant.actionType === "package.script") {
+    if (!grant.commandHash || grant.commandHash !== commandHash(action.command || "")) return false;
+    if (grant.scope?.packageManager && grant.scope.packageManager !== (action.packageManager || null)) return false;
+    if (grant.scope?.scriptName && grant.scope.scriptName !== (action.scriptName || null)) return false;
+    if (grant.scope?.packageName && grant.scope.packageName !== (action.packageName || null)) return false;
+    return true;
+  }
+  if (
+    grant.actionType === "mcp.read" ||
+    grant.actionType === "mcp.write" ||
+    grant.actionType === "mcp.delete" ||
+    grant.actionType === "mcp.admin" ||
+    grant.actionType === "mcp.externalMutation" ||
+    grant.actionType === "mcp.unknown"
+  ) {
+    if (grant.scope?.mcpServer && grant.scope.mcpServer !== (action.mcpServer || null)) return false;
+    if (grant.scope?.toolName && grant.scope.toolName !== (action.toolName || null)) return false;
+    if (grant.targetHash && grant.targetHash !== targetHashFromMcpAction(action)) return false;
+    if (grant.argsHash && grant.argsHash !== argsHashFromAction(action)) return false;
+    return true;
+  }
+  if (grant.actionId && action.actionId && grant.actionId === action.actionId) return true;
+  if (grant.commandHash && grant.commandHash === commandHash(action.command || "")) return true;
+  return false;
+}
+
+function buildGrantScope(action, limitPlan, cwd) {
+  const scope = limitPlan?.scope || {};
+  const normalizedTarget = normalizeTargetPath(action?.target || "");
+  return {
+    cwd: String(cwd || ""),
+    paths: Array.isArray(scope.allowedPaths)
+      ? scope.allowedPaths.slice(0, 10)
+      : normalizedTarget
+        ? [normalizedTarget]
+        : [],
+    repo: "current",
+    branchPrefix: "wuz/",
+    allowedCommands: Array.isArray(scope.allowedCommands) ? scope.allowedCommands.slice(0, 5) : [],
+    allowedTargets: Array.isArray(scope.allowedTargets) ? scope.allowedTargets.slice(0, 10) : [],
+    packageManager: scope.packageManager || action?.packageManager || null,
+    scriptName: scope.scriptName || action?.scriptName || null,
+    packageName: scope.packageName || action?.packageName || null,
+    mcpServer: scope.mcpServer || action?.mcpServer || null,
+    toolName: scope.toolName || action?.toolName || null,
+  };
+}
+
+function buildJitGrant(action, decisionRecord, limitPlan, enforcementContext = {}) {
+  const decision = String(decisionRecord?.decision || "");
+  const effectiveBehavior = String(enforcementContext.effectiveBehavior || "");
+  const enforcementAvailable = enforcementContext.enforcementAvailable === true;
+  const timestamp = enforcementContext.timestamp;
+
+  if (!decision || decision === "deny") {
+    return {
+      grantCreated: false,
+      grant: null,
+      effectiveBehavior: enforcementAvailable ? "blocked" : "recommended_only",
+      reason: decision === "deny"
+        ? (enforcementAvailable ? "User denied this action." : "User denial was recorded, but no enforcement adapter is available.")
+        : "No JIT grant was requested.",
+    };
+  }
+
+  if (!enforcementAvailable) {
+    return {
+      grantCreated: false,
+      grant: null,
+      effectiveBehavior: decision === "let_wuz_limit" ? "recommended_only" : "recommended_only",
+      reason: "No enforcement adapter is available for this action type.",
+    };
+  }
+
+  if (effectiveBehavior === "blocked" || effectiveBehavior === "recommended_only") {
+    return {
+      grantCreated: false,
+      grant: null,
+      effectiveBehavior,
+      reason: enforcementContext.reason || "This action was not allowed, so no JIT grant was created.",
+    };
+  }
+
+  if (decision === "let_wuz_limit" && limitPlan?.recommendedMode !== "limited") {
+    return {
+      grantCreated: false,
+      grant: null,
+      effectiveBehavior: limitPlan?.recommendedMode === "deny" ? "blocked" : "limit_plan_only",
+      reason: limitPlan?.reason || "No safe limited version found. Recommended: deny.",
+    };
+  }
+
+  const ttlSeconds = decision === "let_wuz_limit"
+    ? ttlSecondsFromRecommendation(limitPlan?.ttlRecommendation || "30 minutes")
+    : Number.isFinite(Number(decisionRecord?.ttlSeconds)) && Number(decisionRecord?.ttlSeconds) > 0
+      ? Number(decisionRecord.ttlSeconds)
+      : DEFAULT_GRANT_TTL_SECONDS;
+
+  const grant = normalizeGrant({
+    grantId: `grant-${shortHash(`${timestamp}:${action?.actionId}:${decision}:${action?.command || action?.target || ""}`)}`,
+    grantType: "jit_permission",
+    decision,
+    actionId: action?.actionId || null,
+    componentId: action?.componentId || null,
+    componentType: action?.componentType || null,
+    actionType: action?.actionType || null,
+    adapterId: enforcementContext.adapterId || null,
+    commandHash: action?.command ? commandHash(action.command) : null,
+    targetHash: action?.actionType === "filesystem.write"
+      ? targetHashFromAction(action)
+      : (String(action?.actionType || "").startsWith("mcp.") ? targetHashFromMcpAction(action) : null),
+    contentHash: action?.actionType === "filesystem.write" ? contentHashFromAction(action) : null,
+    argsHash: String(action?.actionType || "").startsWith("mcp.") ? argsHashFromAction(action) : null,
+    scope: buildGrantScope(action, limitPlan, enforcementContext.cwd),
+    allowedActions: decision === "let_wuz_limit"
+      ? (Array.isArray(limitPlan?.wouldAllow) ? limitPlan.wouldAllow.slice(0, 10) : [])
+      : [
+        action?.actionType === "filesystem.write"
+          ? "write exact file once"
+          : action?.actionType === "package.install" || action?.actionType === "package.run" || action?.actionType === "package.script"
+            ? "run exact package command once"
+            : String(action?.actionType || "").startsWith("mcp.")
+              ? "run exact MCP action once"
+          : (action?.actionType || "requested-action"),
+      ],
+    deniedActions: decision === "let_wuz_limit"
+      ? (Array.isArray(limitPlan?.wouldDeny) ? limitPlan.wouldDeny.slice(0, 10) : [])
+      : (
+        action?.actionType === "filesystem.write"
+          ? ["sensitive file access", "workflow modification", "path traversal", "outside project root"]
+          : action?.actionType === "package.install" || action?.actionType === "package.run" || action?.actionType === "package.script"
+            ? ["remote script execution", "global install", "lifecycle script execution", "sensitive file access", "outside project root"]
+            : String(action?.actionType || "").startsWith("mcp.")
+              ? ["delete actions", "push to main", "workflow modification", "secrets modification", "admin actions"]
+          : []
+      ),
+    ttlSeconds,
+    createdAt: timestamp,
+    expiresAt: addSeconds(timestamp, ttlSeconds),
+    singleUse: true,
+    consumedAt: null,
+    reason: decision === "let_wuz_limit"
+      ? (limitPlan?.reason || "Wuz limited this action to the current task.")
+      : "Approved once for this exact action.",
+    enforcementAvailable: true,
+  });
+
+  return {
+    grantCreated: true,
+    grant,
+    effectiveBehavior,
+    reason: grant.reason,
+  };
+}
+
+function recordGrant(cwd, grant, timestamp) {
+  const store = loadJitGrantStore(cwd);
+  store.generatedAt = timestamp;
+  store.grants = [normalizeGrant(grant), ...(store.grants || [])].slice(0, 100);
+  saveJitGrantStore(cwd, store);
+  return normalizeGrant(grant);
+}
+
+function consumeGrant(cwd, grantId, timestamp) {
+  const store = loadJitGrantStore(cwd);
+  let consumedGrant = null;
+  store.grants = (store.grants || []).map((grant) => {
+    if (grant?.grantId !== grantId) return grant;
+    consumedGrant = normalizeGrant({
+      ...grant,
+      consumedAt: timestamp,
+    });
+    return consumedGrant;
+  });
+  if (consumedGrant) {
+    store.generatedAt = timestamp;
+    saveJitGrantStore(cwd, store);
+  }
+  return consumedGrant;
+}
+
+function loadEnforcementSummary(cwd) {
+  return safeReadJson(cwd, ENFORCEMENT_SUMMARY_REL_PATH, null);
+}
+
+function saveEnforcementSummary(cwd, summary) {
+  safeWriteJson(cwd, ENFORCEMENT_SUMMARY_REL_PATH, summary);
+  return summary;
+}
+
+function baseEnforcementCounts(previousCounts, payload) {
+  return {
+    attempted: Number(previousCounts?.attempted || 0) + 1,
+    blocked: Number(previousCounts?.blocked || 0),
+    approvedOnce: Number(previousCounts?.approvedOnce || 0),
+    limited: Number(previousCounts?.limited || 0),
+    unavailable: Number(previousCounts?.unavailable || 0),
+    fileWritesBlocked: Number(previousCounts?.fileWritesBlocked || 0),
+    fileWritesLimited: Number(previousCounts?.fileWritesLimited || 0),
+    fileWritesApprovedOnce: Number(previousCounts?.fileWritesApprovedOnce || 0),
+    packageActionsBlocked: Number(previousCounts?.packageActionsBlocked || 0),
+    packageActionsLimited: Number(previousCounts?.packageActionsLimited || 0),
+    packageActionsApprovedOnce: Number(previousCounts?.packageActionsApprovedOnce || 0),
+    mcpActionsBlocked: Number(previousCounts?.mcpActionsBlocked || 0),
+    mcpActionsLimited: Number(previousCounts?.mcpActionsLimited || 0),
+    mcpActionsApprovedOnce: Number(previousCounts?.mcpActionsApprovedOnce || 0),
+    jitGrantsCreated: Number(previousCounts?.jitGrantsCreated || 0),
+    jitGrantsConsumed: Number(previousCounts?.jitGrantsConsumed || 0),
+    jitGrantsExpired: Number(previousCounts?.jitGrantsExpired || 0),
+    activeJitGrants: Number.isFinite(Number(payload.activeJitGrants))
+      ? Number(payload.activeJitGrants)
+      : Number(previousCounts?.activeJitGrants || 0),
+    autoLimited: Number(previousCounts?.autoLimited || 0),
+    autoDenied: Number(previousCounts?.autoDenied || 0),
+    autoRequiresApproval: Number(previousCounts?.autoRequiresApproval || 0),
+    autoRecommendedOnly: Number(previousCounts?.autoRecommendedOnly || 0),
+    autoLimitPlanOnly: Number(previousCounts?.autoLimitPlanOnly || 0),
+  };
+}
+
+function updateEnforcementSummary(cwd, payload) {
+  const mode = String(payload.mode || "warn");
+  const previous = loadEnforcementSummary(cwd) || {
+    enforcementSummaryVersion: 2,
+    what: "Agent Security enforcement summary.",
+    generatedAt: null,
+    mode,
+    counts: {
+      attempted: 0,
+      blocked: 0,
+      approvedOnce: 0,
+      limited: 0,
+      unavailable: 0,
+      fileWritesBlocked: 0,
+      fileWritesLimited: 0,
+      fileWritesApprovedOnce: 0,
+      packageActionsBlocked: 0,
+      packageActionsLimited: 0,
+      packageActionsApprovedOnce: 0,
+      mcpActionsBlocked: 0,
+      mcpActionsLimited: 0,
+      mcpActionsApprovedOnce: 0,
+      jitGrantsCreated: 0,
+      jitGrantsConsumed: 0,
+      jitGrantsExpired: 0,
+      activeJitGrants: 0,
+      autoLimited: 0,
+      autoDenied: 0,
+      autoRequiresApproval: 0,
+      autoRecommendedOnly: 0,
+      autoLimitPlanOnly: 0,
+    },
+    latestEnforcement: null,
+    recentEnforcements: [],
+  };
+
+  const counts = baseEnforcementCounts(previous.counts, payload);
+
+  if (payload.effectiveBehavior === "blocked") counts.blocked += 1;
+  if (payload.effectiveBehavior === "limited") counts.limited += 1;
+  if (payload.decision === "approve_once" && (payload.effectiveBehavior === "allowed" || payload.effectiveBehavior === "dry_run_only")) {
+    counts.approvedOnce += 1;
+  }
+  if (payload.actionType === "filesystem.write" && payload.effectiveBehavior === "blocked") counts.fileWritesBlocked += 1;
+  if (payload.actionType === "filesystem.write" && payload.effectiveBehavior === "limited") counts.fileWritesLimited += 1;
+  if (
+    payload.actionType === "filesystem.write" &&
+    payload.decision === "approve_once" &&
+    (payload.effectiveBehavior === "allowed" || payload.effectiveBehavior === "dry_run_only")
+  ) {
+    counts.fileWritesApprovedOnce += 1;
+  }
+  if (
+    (payload.actionType === "package.install" || payload.actionType === "package.run" || payload.actionType === "package.script") &&
+    payload.effectiveBehavior === "blocked"
+  ) {
+    counts.packageActionsBlocked += 1;
+  }
+  if (
+    (payload.actionType === "package.install" || payload.actionType === "package.run" || payload.actionType === "package.script") &&
+    payload.effectiveBehavior === "limited"
+  ) {
+    counts.packageActionsLimited += 1;
+  }
+  if (
+    (payload.actionType === "package.install" || payload.actionType === "package.run" || payload.actionType === "package.script") &&
+    payload.decision === "approve_once" &&
+    (payload.effectiveBehavior === "allowed" || payload.effectiveBehavior === "dry_run_only")
+  ) {
+    counts.packageActionsApprovedOnce += 1;
+  }
+  if (String(payload.actionType || "").startsWith("mcp.") && payload.effectiveBehavior === "blocked") counts.mcpActionsBlocked += 1;
+  if (String(payload.actionType || "").startsWith("mcp.") && payload.effectiveBehavior === "limited") counts.mcpActionsLimited += 1;
+  if (
+    String(payload.actionType || "").startsWith("mcp.") &&
+    payload.decision === "approve_once" &&
+    (payload.effectiveBehavior === "allowed" || payload.effectiveBehavior === "dry_run_only")
+  ) {
+    counts.mcpActionsApprovedOnce += 1;
+  }
+  if (payload.enforcementAvailable === false || payload.effectiveBehavior === "recommended_only") {
+    counts.unavailable += 1;
+  }
+  if (mode === "auto") {
+    if (payload.autoDecision === "auto_allow_limited") counts.autoLimited += 1;
+    if (payload.autoDecision === "auto_deny") counts.autoDenied += 1;
+    if (payload.autoDecision === "require_approval") counts.autoRequiresApproval += 1;
+    if (payload.autoDecision === "recommended_only") counts.autoRecommendedOnly += 1;
+    if (payload.autoDecision === "limit_plan_only") counts.autoLimitPlanOnly += 1;
+  }
+  if (payload.jitGrantCreated) counts.jitGrantsCreated += 1;
+  if (payload.jitGrantConsumed) counts.jitGrantsConsumed += 1;
+  if (payload.jitGrantExpired) counts.jitGrantsExpired += 1;
+
+  const latestEnforcement = {
+    actionId: payload.actionId,
+    componentId: payload.componentId || null,
+    componentType: payload.componentType || null,
+    actionType: payload.actionType,
+    target: payload.target || null,
+    commandHash: payload.command ? commandHash(payload.command) : null,
+    packageManager: payload.packageManager || null,
+    scriptName: payload.scriptName || null,
+    packageName: payload.packageName || null,
+    mcpServer: payload.mcpServer || null,
+    toolName: payload.toolName || null,
+    targetHash: String(payload.actionType || "").startsWith("mcp.") ? targetHashFromMcpAction(payload) : null,
+    argsHash: String(payload.actionType || "").startsWith("mcp.") ? argsHashFromAction(payload) : null,
+    decision: payload.decision || null,
+    autoDecision: payload.autoDecision || null,
+    adapterId: payload.adapterId || null,
+    enforcementAvailable: payload.enforcementAvailable === true,
+    effectiveBehavior: payload.effectiveBehavior,
+    executed: payload.executed === true,
+    reason: payload.reason || "",
+    timestamp: payload.timestamp,
+  };
+
+  const recentEnforcements = [latestEnforcement, ...(Array.isArray(previous.recentEnforcements) ? previous.recentEnforcements : [])]
+    .slice(0, 5);
+
+  return saveEnforcementSummary(cwd, {
+    enforcementSummaryVersion: 2,
+    what: "Agent Security enforcement summary.",
+    generatedAt: payload.timestamp,
+    mode,
+    counts,
+    latestEnforcement,
+    recentEnforcements,
+  });
+}
+
+function writeGrantAuditEvent(cwd, eventType, payload, grant) {
+  const mode = String(payload.mode || "warn");
+  appendJsonl(cwd, ENFORCEMENT_AUDIT_LOG_REL_PATH, {
+    eventType,
+    mode,
+    grantId: grant?.grantId || null,
+    actionId: payload.actionId,
+    componentId: payload.componentId || null,
+    componentType: payload.componentType || null,
+    actionType: payload.actionType,
+    target: payload.target || null,
+    commandHash: payload.command ? commandHash(payload.command) : null,
+    packageManager: payload.packageManager || null,
+    scriptName: payload.scriptName || null,
+    packageName: payload.packageName || null,
+    mcpServer: payload.mcpServer || null,
+    toolName: payload.toolName || null,
+    targetHash: String(payload.actionType || "").startsWith("mcp.") ? targetHashFromMcpAction(payload) : null,
+    argsHash: String(payload.actionType || "").startsWith("mcp.") ? argsHashFromAction(payload) : null,
+    decision: payload.decision || null,
+    autoDecision: payload.autoDecision || null,
+    confidence: payload.confidence || null,
+    adapterId: payload.adapterId || null,
+    effectiveBehavior: payload.effectiveBehavior,
+    enforcementAvailable: payload.enforcementAvailable === true,
+    executed: payload.executed === true,
+    ttlSeconds: grant?.ttlSeconds || null,
+    reason: payload.reason || "",
+    timestamp: payload.timestamp,
+  });
+}
+
+function writeEnforcementAuditEvents(cwd, payload) {
+  const mode = String(payload.mode || "warn");
+  appendJsonl(cwd, ENFORCEMENT_AUDIT_LOG_REL_PATH, {
+    eventType: "agent_security_enforcement_attempt",
+    mode,
+    grantId: payload.jitGrant?.grantId || payload.jitGrantConsumed?.grantId || payload.jitGrantExpired?.grantId || null,
+    actionId: payload.actionId,
+    componentId: payload.componentId || null,
+    componentType: payload.componentType || null,
+    actionType: payload.actionType,
+    target: payload.target || null,
+    commandHash: payload.command ? commandHash(payload.command) : null,
+    packageManager: payload.packageManager || null,
+    scriptName: payload.scriptName || null,
+    packageName: payload.packageName || null,
+    mcpServer: payload.mcpServer || null,
+    toolName: payload.toolName || null,
+    targetHash: String(payload.actionType || "").startsWith("mcp.") ? targetHashFromMcpAction(payload) : null,
+    argsHash: String(payload.actionType || "").startsWith("mcp.") ? argsHashFromAction(payload) : null,
+    decision: payload.decision || null,
+    autoDecision: payload.autoDecision || null,
+    confidence: payload.confidence || null,
+    adapterId: payload.adapterId || null,
+    effectiveBehavior: payload.effectiveBehavior,
+    enforcementAvailable: payload.enforcementAvailable === true,
+    executed: payload.executed === true,
+    ttlSeconds: payload.jitGrant?.ttlSeconds || null,
+    reason: payload.reason || "",
+    timestamp: payload.timestamp,
+  });
+
+  if (payload.jitGrant) {
+    writeGrantAuditEvent(cwd, "agent_security_jit_grant_created", payload, payload.jitGrant);
+  }
+  if (payload.jitGrantConsumed) {
+    writeGrantAuditEvent(cwd, "agent_security_jit_grant_consumed", payload, payload.jitGrantConsumed);
+  }
+  if (payload.jitGrantExpired) {
+    writeGrantAuditEvent(cwd, "agent_security_jit_grant_expired", payload, payload.jitGrantExpired);
+  }
+
+  if (payload.enforcementAvailable === false || payload.effectiveBehavior === "recommended_only") {
+    appendJsonl(cwd, ENFORCEMENT_AUDIT_LOG_REL_PATH, {
+      eventType: mode === "auto" ? "agent_security_auto_recommended_only" : "agent_security_enforcement_unavailable",
+      mode,
+      grantId: null,
+      actionId: payload.actionId,
+      componentId: payload.componentId || null,
+      componentType: payload.componentType || null,
+      actionType: payload.actionType,
+      target: payload.target || null,
+      commandHash: payload.command ? commandHash(payload.command) : null,
+      packageManager: payload.packageManager || null,
+      scriptName: payload.scriptName || null,
+      packageName: payload.packageName || null,
+      mcpServer: payload.mcpServer || null,
+      toolName: payload.toolName || null,
+      targetHash: String(payload.actionType || "").startsWith("mcp.") ? targetHashFromMcpAction(payload) : null,
+      argsHash: String(payload.actionType || "").startsWith("mcp.") ? argsHashFromAction(payload) : null,
+      decision: payload.decision || null,
+      autoDecision: payload.autoDecision || null,
+      confidence: payload.confidence || null,
+      adapterId: payload.adapterId || null,
+      effectiveBehavior: payload.effectiveBehavior,
+      enforcementAvailable: false,
+      executed: false,
+      ttlSeconds: null,
+      reason: payload.reason || "",
+      timestamp: payload.timestamp,
+    });
+    return;
+  }
+
+  if (mode === "auto" && payload.autoDecision === "require_approval") {
+    appendJsonl(cwd, ENFORCEMENT_AUDIT_LOG_REL_PATH, {
+      eventType: "agent_security_auto_requires_approval",
+      mode,
+      grantId: null,
+      actionId: payload.actionId,
+      componentId: payload.componentId || null,
+      componentType: payload.componentType || null,
+      actionType: payload.actionType,
+      target: payload.target || null,
+      commandHash: payload.command ? commandHash(payload.command) : null,
+      packageManager: payload.packageManager || null,
+      scriptName: payload.scriptName || null,
+      packageName: payload.packageName || null,
+      mcpServer: payload.mcpServer || null,
+      toolName: payload.toolName || null,
+      targetHash: String(payload.actionType || "").startsWith("mcp.") ? targetHashFromMcpAction(payload) : null,
+      argsHash: String(payload.actionType || "").startsWith("mcp.") ? argsHashFromAction(payload) : null,
+      decision: payload.decision || null,
+      autoDecision: payload.autoDecision || null,
+      confidence: payload.confidence || null,
+      adapterId: payload.adapterId || null,
+      effectiveBehavior: payload.effectiveBehavior,
+      enforcementAvailable: payload.enforcementAvailable === true,
+      executed: false,
+      ttlSeconds: null,
+      reason: payload.reason || "",
+      timestamp: payload.timestamp,
+    });
+    return;
+  }
+
+  if (mode === "auto" && payload.autoDecision === "limit_plan_only") {
+    appendJsonl(cwd, ENFORCEMENT_AUDIT_LOG_REL_PATH, {
+      eventType: "agent_security_auto_limit_plan_only",
+      mode,
+      grantId: null,
+      actionId: payload.actionId,
+      componentId: payload.componentId || null,
+      componentType: payload.componentType || null,
+      actionType: payload.actionType,
+      target: payload.target || null,
+      commandHash: payload.command ? commandHash(payload.command) : null,
+      packageManager: payload.packageManager || null,
+      scriptName: payload.scriptName || null,
+      packageName: payload.packageName || null,
+      mcpServer: payload.mcpServer || null,
+      toolName: payload.toolName || null,
+      targetHash: String(payload.actionType || "").startsWith("mcp.") ? targetHashFromMcpAction(payload) : null,
+      argsHash: String(payload.actionType || "").startsWith("mcp.") ? argsHashFromAction(payload) : null,
+      decision: payload.decision || null,
+      autoDecision: payload.autoDecision || null,
+      confidence: payload.confidence || null,
+      adapterId: payload.adapterId || null,
+      effectiveBehavior: payload.effectiveBehavior,
+      enforcementAvailable: payload.enforcementAvailable === true,
+      executed: false,
+      ttlSeconds: null,
+      reason: payload.reason || "",
+      timestamp: payload.timestamp,
+    });
+    return;
+  }
+
+  if (payload.effectiveBehavior === "blocked") {
+    const eventType = mode === "auto"
+      ? "agent_security_auto_denied"
+      : payload.actionType === "filesystem.write"
+      ? "agent_security_file_write_blocked"
+      : (
+        payload.actionType === "package.install" || payload.actionType === "package.run" || payload.actionType === "package.script"
+          ? "agent_security_package_action_blocked"
+          : String(payload.actionType || "").startsWith("mcp.")
+            ? "agent_security_mcp_action_blocked"
+          : "agent_security_action_blocked"
+      );
+    appendJsonl(cwd, ENFORCEMENT_AUDIT_LOG_REL_PATH, {
+      eventType,
+      mode,
+      grantId: payload.jitGrant?.grantId || payload.jitGrantConsumed?.grantId || null,
+      actionId: payload.actionId,
+      componentId: payload.componentId || null,
+      componentType: payload.componentType || null,
+      actionType: payload.actionType,
+      target: payload.target || null,
+      commandHash: payload.command ? commandHash(payload.command) : null,
+      packageManager: payload.packageManager || null,
+      scriptName: payload.scriptName || null,
+      packageName: payload.packageName || null,
+      mcpServer: payload.mcpServer || null,
+      toolName: payload.toolName || null,
+      targetHash: String(payload.actionType || "").startsWith("mcp.") ? targetHashFromMcpAction(payload) : null,
+      argsHash: String(payload.actionType || "").startsWith("mcp.") ? argsHashFromAction(payload) : null,
+      decision: payload.decision || null,
+      autoDecision: payload.autoDecision || null,
+      confidence: payload.confidence || null,
+      adapterId: payload.adapterId || null,
+      effectiveBehavior: payload.effectiveBehavior,
+      enforcementAvailable: true,
+      executed: payload.executed === true,
+      ttlSeconds: payload.jitGrant?.ttlSeconds || payload.jitGrantConsumed?.ttlSeconds || null,
+      reason: payload.reason || "",
+      timestamp: payload.timestamp,
+    });
+    return;
+  }
+
+  if (payload.effectiveBehavior === "limited") {
+    const eventType = mode === "auto"
+      ? "agent_security_auto_limited"
+      : payload.actionType === "filesystem.write"
+      ? "agent_security_file_write_limited"
+      : (
+        payload.actionType === "package.install" || payload.actionType === "package.run" || payload.actionType === "package.script"
+          ? "agent_security_package_action_limited"
+          : String(payload.actionType || "").startsWith("mcp.")
+            ? "agent_security_mcp_action_limited"
+          : "agent_security_action_limited"
+      );
+    appendJsonl(cwd, ENFORCEMENT_AUDIT_LOG_REL_PATH, {
+      eventType,
+      mode,
+      grantId: payload.jitGrant?.grantId || payload.jitGrantConsumed?.grantId || null,
+      actionId: payload.actionId,
+      componentId: payload.componentId || null,
+      componentType: payload.componentType || null,
+      actionType: payload.actionType,
+      target: payload.target || null,
+      commandHash: payload.command ? commandHash(payload.command) : null,
+      packageManager: payload.packageManager || null,
+      scriptName: payload.scriptName || null,
+      packageName: payload.packageName || null,
+      mcpServer: payload.mcpServer || null,
+      toolName: payload.toolName || null,
+      targetHash: String(payload.actionType || "").startsWith("mcp.") ? targetHashFromMcpAction(payload) : null,
+      argsHash: String(payload.actionType || "").startsWith("mcp.") ? argsHashFromAction(payload) : null,
+      decision: payload.decision || null,
+      autoDecision: payload.autoDecision || null,
+      confidence: payload.confidence || null,
+      adapterId: payload.adapterId || null,
+      effectiveBehavior: payload.effectiveBehavior,
+      enforcementAvailable: true,
+      executed: payload.executed === true,
+      ttlSeconds: payload.jitGrant?.ttlSeconds || payload.jitGrantConsumed?.ttlSeconds || null,
+      reason: payload.reason || "",
+      timestamp: payload.timestamp,
+    });
+    return;
+  }
+
+  if (payload.actionType === "filesystem.write" && payload.decision === "approve_once" && payload.effectiveBehavior === "allowed") {
+    appendJsonl(cwd, ENFORCEMENT_AUDIT_LOG_REL_PATH, {
+      eventType: "agent_security_file_write_allowed_once",
+      mode,
+      grantId: payload.jitGrantConsumed?.grantId || payload.jitGrant?.grantId || null,
+      actionId: payload.actionId,
+      componentId: payload.componentId || null,
+      componentType: payload.componentType || null,
+      actionType: payload.actionType,
+      target: payload.target || null,
+      commandHash: payload.command ? commandHash(payload.command) : null,
+      packageManager: payload.packageManager || null,
+      scriptName: payload.scriptName || null,
+      packageName: payload.packageName || null,
+      decision: payload.decision || null,
+      autoDecision: payload.autoDecision || null,
+      confidence: payload.confidence || null,
+      adapterId: payload.adapterId || null,
+      effectiveBehavior: payload.effectiveBehavior,
+      enforcementAvailable: true,
+      executed: payload.executed === true,
+      ttlSeconds: payload.jitGrantConsumed?.ttlSeconds || payload.jitGrant?.ttlSeconds || null,
+      reason: payload.reason || "",
+      timestamp: payload.timestamp,
+    });
+    return;
+  }
+
+  if (
+    (payload.actionType === "package.install" || payload.actionType === "package.run" || payload.actionType === "package.script") &&
+    payload.decision === "approve_once" &&
+    payload.effectiveBehavior === "allowed"
+  ) {
+    appendJsonl(cwd, ENFORCEMENT_AUDIT_LOG_REL_PATH, {
+      eventType: "agent_security_package_action_allowed_once",
+      mode,
+      grantId: payload.jitGrantConsumed?.grantId || payload.jitGrant?.grantId || null,
+      actionId: payload.actionId,
+      componentId: payload.componentId || null,
+      componentType: payload.componentType || null,
+      actionType: payload.actionType,
+      target: payload.target || null,
+      commandHash: payload.command ? commandHash(payload.command) : null,
+      packageManager: payload.packageManager || null,
+      scriptName: payload.scriptName || null,
+      packageName: payload.packageName || null,
+      mcpServer: payload.mcpServer || null,
+      toolName: payload.toolName || null,
+      targetHash: String(payload.actionType || "").startsWith("mcp.") ? targetHashFromMcpAction(payload) : null,
+      argsHash: String(payload.actionType || "").startsWith("mcp.") ? argsHashFromAction(payload) : null,
+      decision: payload.decision || null,
+      autoDecision: payload.autoDecision || null,
+      confidence: payload.confidence || null,
+      adapterId: payload.adapterId || null,
+      effectiveBehavior: payload.effectiveBehavior,
+      enforcementAvailable: true,
+      executed: payload.executed === true,
+      ttlSeconds: payload.jitGrantConsumed?.ttlSeconds || payload.jitGrant?.ttlSeconds || null,
+      reason: payload.reason || "",
+      timestamp: payload.timestamp,
+    });
+    return;
+  }
+
+  if (String(payload.actionType || "").startsWith("mcp.") && payload.decision === "approve_once" && payload.effectiveBehavior === "allowed") {
+    appendJsonl(cwd, ENFORCEMENT_AUDIT_LOG_REL_PATH, {
+      eventType: "agent_security_mcp_action_allowed_once",
+      mode,
+      grantId: payload.jitGrantConsumed?.grantId || payload.jitGrant?.grantId || null,
+      actionId: payload.actionId,
+      componentId: payload.componentId || null,
+      componentType: payload.componentType || null,
+      actionType: payload.actionType,
+      target: payload.target || null,
+      commandHash: payload.command ? commandHash(payload.command) : null,
+      packageManager: payload.packageManager || null,
+      scriptName: payload.scriptName || null,
+      packageName: payload.packageName || null,
+      mcpServer: payload.mcpServer || null,
+      toolName: payload.toolName || null,
+      targetHash: targetHashFromMcpAction(payload),
+      argsHash: argsHashFromAction(payload),
+      decision: payload.decision || null,
+      autoDecision: payload.autoDecision || null,
+      confidence: payload.confidence || null,
+      adapterId: payload.adapterId || null,
+      effectiveBehavior: payload.effectiveBehavior,
+      enforcementAvailable: true,
+      executed: payload.executed === true,
+      ttlSeconds: payload.jitGrantConsumed?.ttlSeconds || payload.jitGrant?.ttlSeconds || null,
+      reason: payload.reason || "",
+      timestamp: payload.timestamp,
+    });
+  }
+}
+
+function normalizeResultPreview(value) {
+  const text = String(value || "");
+  return text.length > 400 ? `${text.slice(0, 400)}...` : text;
+}
+
+function normalizeEnforcementResult(action, adapterId, timestamp, result) {
+  const normalizedAction = normalizeAgentSecurityAction(action);
+  return {
+    actionId: normalizedAction.actionId,
+    componentId: normalizedAction.componentId || null,
+    componentType: normalizedAction.componentType || null,
+    actionType: normalizedAction.actionType || null,
+    target: normalizedAction.target || null,
+    command: normalizedAction.command || "",
+    packageManager: normalizedAction.packageManager || null,
+    scriptName: normalizedAction.scriptName || null,
+    packageName: normalizedAction.packageName || null,
+    mcpServer: normalizedAction.mcpServer || null,
+    toolName: normalizedAction.toolName || null,
+    commandHash: normalizedAction.commandHash || null,
+    targetHash: normalizedAction.targetHash || null,
+    contentHash: normalizedAction.contentHash || null,
+    argsHash: normalizedAction.argsHash || null,
+    scopeKey: normalizedAction.scopeKey || null,
+    decision: result?.decision || null,
+    adapterId: adapterId || null,
+    enforcementAvailable: result?.enforcementAvailable === true,
+    effectiveBehavior: String(result?.effectiveBehavior || "recommended_only"),
+    executed: result?.executed === true,
+    exitCode: typeof result?.exitCode === "number" ? result.exitCode : null,
+    stdoutPreview: normalizeResultPreview(result?.stdoutPreview || ""),
+    stderrPreview: normalizeResultPreview(result?.stderrPreview || ""),
+    reason: String(result?.reason || ""),
+    timestamp: result?.timestamp || timestamp,
+  };
+}
+
+function buildUnavailableResult(action, timestamp, reason, decision) {
+  return normalizeEnforcementResult(action, null, timestamp, {
+    decision: decision || null,
+    adapterId: null,
+    enforcementAvailable: false,
+    effectiveBehavior: "recommended_only",
+    executed: false,
+    exitCode: null,
+    stdoutPreview: "",
+    stderrPreview: "",
+    reason,
+    timestamp,
+  });
+}
+
+function buildMatchingGrantDecisionRecord(grant, action, timestamp) {
+  return {
+    decisionId: `grant-${grant.grantId}`,
+    actionId: action?.actionId || null,
+    componentId: action?.componentId || null,
+    decision: grant.decision || "approve_once",
+    mode: "warn",
+    effectiveBehavior: grant.decision === "let_wuz_limit" ? "limited" : "allowed",
+    ttlSeconds: grant.ttlSeconds || DEFAULT_GRANT_TTL_SECONDS,
+    scope: {
+      cwd: grant.scope?.cwd || "",
+      actionType: action?.actionType || null,
+      commandHash: grant.commandHash || null,
+      targetHash: grant.targetHash || null,
+      contentHash: grant.contentHash || null,
+      allowedCommands: grant.scope?.allowedCommands || [],
+      allowedTargets: grant.scope?.allowedTargets || [],
+      allowedPaths: grant.scope?.paths || [],
+      packageManager: grant.scope?.packageManager || null,
+      scriptName: grant.scope?.scriptName || null,
+      packageName: grant.scope?.packageName || null,
+      mcpServer: grant.scope?.mcpServer || null,
+      toolName: grant.scope?.toolName || null,
+      argsHash: grant.argsHash || null,
+    },
+    denied: Array.isArray(grant.deniedActions) ? grant.deniedActions : [],
+    reason: grant.reason || "Matched an active JIT grant for this exact action.",
+    timestamp,
+  };
+}
+
+function maybeExpireGrant(cwd, grant, action, timestamp, options = {}) {
+  if (!grant || !isGrantExpired(grant, timestamp) || grant.consumedAt || options.writeEvidence === false) return null;
+  return normalizeGrant(grant);
+}
+
+function recordEnforcementOutcome(cwd, payload, options = {}) {
+  const mode = String(options.mode || payload.mode || "warn");
+  const unsupportedActionTypes = Array.isArray(options.unsupportedActionTypes) ? options.unsupportedActionTypes : [];
+  const capabilityMatrix = options.writeEvidence === false
+    ? null
+    : writeEnforcementCapabilityMatrix(cwd, payload.timestamp, mode, unsupportedActionTypes);
+  const activeJitGrants = countActiveJitGrants(loadJitGrantStore(cwd), payload.timestamp);
+  const normalizedPayload = {
+    ...payload,
+    mode,
+    activeJitGrants,
+    jitGrantCreated: Boolean(payload.jitGrant),
+    jitGrantConsumed: Boolean(payload.jitGrantConsumed),
+    jitGrantExpired: Boolean(payload.jitGrantExpired),
+  };
+  const summary = options.writeEvidence === false ? null : updateEnforcementSummary(cwd, normalizedPayload);
+  if (options.writeEvidence !== false) {
+    writeEnforcementAuditEvents(cwd, normalizedPayload);
+  }
+  return {
+    ...payload,
+    mode,
+    enforcementSummary: summary,
+    capabilityMatrix,
+  };
+}
+
+function enforceAgentSecurityAction(cwd, input, options = {}) {
+  const timestamp = options.timestamp;
+  const mode = String(options.mode || input?.decisionRecord?.mode || "warn");
+  const action = normalizeAgentSecurityAction(input?.action || {});
+  const evaluation = input?.evaluation || {};
+  const limitPlan = input?.limitPlan || null;
+  const decisionRecord = input?.decisionRecord || null;
+  const adapter = resolveAgentSecurityAdapter(action?.actionType);
+  let jitGrant = null;
+  let jitGrantConsumed = null;
+  let jitGrantExpired = null;
+
+  if (!adapter) {
+    const unavailable = buildUnavailableResult(action, timestamp, "No enforcement adapter is available for this action type.", decisionRecord?.decision || null);
+    return recordEnforcementOutcome(cwd, {
+      ...unavailable,
+      mode,
+      jitGrant: null,
+      jitGrantConsumed: null,
+      jitGrantExpired: null,
+      autoDecision: options.autoDecision || null,
+      confidence: options.confidence || null,
+    }, {
+      mode,
+      writeEvidence: options.writeEvidence,
+      unsupportedActionTypes: [action?.actionType],
+    });
+  }
+
+  const store = loadJitGrantStore(cwd);
+  let matchingGrant = null;
+  for (const grant of store.grants || []) {
+    if (!matchesGrantAction(grant, action, cwd)) continue;
+    if (grant.consumedAt) continue;
+    if (isGrantExpired(grant, timestamp)) {
+      jitGrantExpired = maybeExpireGrant(cwd, grant, action, timestamp, options);
+      continue;
+    }
+    matchingGrant = grant;
+    break;
+  }
+
+  const effectiveDecision = decisionRecord?.decision || matchingGrant?.decision || null;
+
+  if (!effectiveDecision && evaluation.decisionRequired) {
+    return recordEnforcementOutcome(cwd, {
+      actionId: action?.actionId || null,
+      componentId: action?.componentId || null,
+      componentType: action?.componentType || null,
+      actionType: action?.actionType || null,
+      target: action?.target || null,
+      command: action?.command || "",
+      packageManager: action?.packageManager || null,
+      scriptName: action?.scriptName || null,
+      packageName: action?.packageName || null,
+      mcpServer: action?.mcpServer || null,
+      toolName: action?.toolName || null,
+      decision: null,
+      adapterId: adapter.adapterId,
+      enforcementAvailable: true,
+      effectiveBehavior: "blocked",
+      executed: false,
+      exitCode: null,
+      stdoutPreview: "",
+      stderrPreview: "",
+      reason: "Decision required before executing this action.",
+      timestamp,
+      mode,
+      autoDecision: options.autoDecision || null,
+      confidence: options.confidence || null,
+      jitGrantExpired,
+      jitGrant: null,
+      jitGrantConsumed: null,
+    }, {
+      mode,
+      writeEvidence: options.writeEvidence,
+    });
+  }
+
+  const adapterDecisionRecord = decisionRecord || (matchingGrant ? buildMatchingGrantDecisionRecord(matchingGrant, action, timestamp) : null);
+  const rawResult = adapter.enforce(action, adapterDecisionRecord, limitPlan, {
+    cwd,
+    execute: options.execute === true,
+    timestamp,
+    executor: options.executor,
+  });
+  const result = normalizeEnforcementResult(action, adapter.adapterId, timestamp, rawResult);
+
+  if (decisionRecord && !matchingGrant) {
+    const grantBuild = buildJitGrant(action, decisionRecord, limitPlan, {
+      cwd,
+      timestamp,
+      adapterId: adapter.adapterId,
+      enforcementAvailable: result.enforcementAvailable === true,
+      effectiveBehavior: result.effectiveBehavior,
+      reason: result.reason,
+    });
+    if (grantBuild.grantCreated && grantBuild.grant) {
+      jitGrant = recordGrant(cwd, grantBuild.grant, timestamp);
+      matchingGrant = jitGrant;
+    }
+  }
+
+  if (
+    options.execute === true &&
+    matchingGrant &&
+    matchingGrant.singleUse === true &&
+    (result.effectiveBehavior === "allowed" || result.effectiveBehavior === "limited") &&
+    result.executed === true &&
+    Number(result.exitCode) === 0
+  ) {
+    jitGrantConsumed = consumeGrant(cwd, matchingGrant.grantId, timestamp);
+  }
+
+  return recordEnforcementOutcome(cwd, {
+    ...result,
+    mode,
+    autoDecision: options.autoDecision || null,
+    confidence: options.confidence || null,
+    target: action?.target || null,
+    command: action?.command || "",
+    packageManager: action?.packageManager || null,
+    scriptName: action?.scriptName || null,
+    packageName: action?.packageName || null,
+    mcpServer: action?.mcpServer || null,
+    toolName: action?.toolName || null,
+    jitGrant,
+    jitGrantConsumed,
+    jitGrantExpired,
+  }, {
+    mode,
+    writeEvidence: options.writeEvidence,
+  });
+}
+
+module.exports = {
+  ENFORCEMENT_CAPABILITIES_REL_PATH,
+  ENFORCEMENT_SUMMARY_REL_PATH,
+  JIT_GRANTS_REL_PATH,
+  ONE_TIME_GRANTS_REL_PATH,
+  ENFORCEMENT_AUDIT_LOG_REL_PATH,
+  DEFAULT_GRANT_TTL_SECONDS,
+  commandHash,
+  ttlSecondsFromRecommendation,
+  loadJitGrantStore,
+  loadEnforcementSummary,
+  normalizeGrant,
+  normalizeEnforcementResult,
+  buildJitGrant,
+  recordEnforcementOutcome,
+  enforceAgentSecurityAction,
+};