feat(audit): record user action events across gateway and channels

src/audit/logger.ts

@@ -16,6 +16,7 @@ import type {
   SessionMessageEvent,
   SessionDeleteEvent,
   SessionCompactEvent,
+  UserActionEvent,
   CronTriggerEvent,
   WebhookReceiveEvent,
   HeartbeatCycleEvent,
@@ -174,6 +175,11 @@ export class AuditLogger {
     this.write({ level: 'debug', event_type: 'session.compact', event: event as unknown as Record<string, unknown> });
   }
 
+  userAction(event: UserActionEvent): void {
+    if (!this.shouldLog('sessions', 'info')) {return;}
+    this.write({ level: 'info', event_type: 'user.action', event: event as unknown as Record<string, unknown> });
+  }
+
   sessionTransfer(from: string, to: string, messageCount: number): void {
     if (!this.shouldLog('sessions', 'debug')) {return;}
     this.write({

src/audit/types.ts

@@ -10,7 +10,7 @@ export type AuditEventType =
   // Skills installer
   | 'skills.installer.execution_blocked' | 'skills.installer.command_result' | 'skills.registry_install'
   // Session lifecycle
-  | 'session.create' | 'session.message' | 'session.delete' | 'session.transfer' | 'session.compact'
+  | 'session.create' | 'session.message' | 'session.delete' | 'session.transfer' | 'session.compact' | 'user.action'
   // Automation - Cron
   | 'cron.trigger' | 'cron.sent' | 'cron.add' | 'cron.remove'
   // Automation - Webhook
@@ -182,6 +182,17 @@ export interface SessionCompactEvent {
   tokens_after: number;
 }
 
+export interface UserActionEvent {
+  session_id: string;
+  channel: string;
+  sender: string;
+  source: 'gateway' | 'channel';
+  action_type: 'message' | 'command';
+  content_length: number;
+  attachments_count?: number;
+  command?: string;
+}
+
 export interface CronTriggerEvent {
   job_name: string;
   schedule: string;