feat(audit): record user action events across gateway and channels

src/daemon/routing.test.ts

@@ -8,6 +8,7 @@ import { CommandRegistry, registerBuiltinCommands } from '../commands/index.js';
 import { ComponentRegistry } from '../intents/index.js';
 import { RoutingPolicy } from '../routing/index.js';
 import type { OutboundMessage } from '../channels/index.js';
+import { initAuditLogger } from '../audit/index.js';
 
 type MessageRouterDeps = Parameters<typeof createMessageRouter>[0];
 type MessageRouterInput = Parameters<ReturnType<typeof createMessageRouter>['handler']>[0];
@@ -144,6 +145,77 @@ describe('daemon command fast-path integration', () => {
     expect(session.deleteConfig).toHaveBeenCalledWith('modelTier');
   });
 
+  it('emits user.action audit events for channel messages', async () => {
+    const mockAuditLogger = {
+      userAction: vi.fn(),
+    };
+    initAuditLogger(mockAuditLogger as any);
+
+    const session = {
+      id: 'telegram:user-audit',
+      addMessage: vi.fn(),
+      getHistory: vi.fn(() => []),
+      clear: vi.fn(),
+      replaceHistory: vi.fn(),
+      getConfig: vi.fn(() => undefined),
+      setConfig: vi.fn(),
+      deleteConfig: vi.fn(),
+    };
+
+    const commandRegistry = new CommandRegistry();
+    registerBuiltinCommands(commandRegistry);
+
+    const router = createMessageRouter({
+      sessionManager: {
+        getSession: vi.fn(() => session),
+      } as unknown as MessageRouterDeps['sessionManager'],
+      modelRouter: {
+        getAvailableTiers: () => ['fast', 'default', 'complex', 'local'],
+        getAllLabels: () => ({ fast: 'fast', default: 'default', complex: 'complex', local: 'local' }),
+        getLabel: (tier: string) => tier,
+      } as unknown as MessageRouterDeps['modelRouter'],
+      systemPrompt: 'test prompt',
+      toolRegistry: {
+        clone() { return this; },
+        register: vi.fn(),
+      } as unknown as MessageRouterDeps['toolRegistry'],
+      toolExecutor: {} as unknown as MessageRouterDeps['toolExecutor'],
+      config: {
+        agents: {
+          primary_tier: 'default',
+          delegation: {
+            compaction: 'fast',
+            memory_extraction: 'fast',
+            classification: 'fast',
+            tool_summarisation: 'fast',
+            complex_reasoning: 'complex',
+          },
+          max_delegation_depth: 3,
+          max_iterations: 10,
+        },
+        compaction: { enabled: false },
+        models: { default: { provider: 'anthropic', model: 'claude' } },
+      } as unknown as MessageRouterDeps['config'],
+      commandRegistry,
+    });
+
+    await router.handler({
+      id: 'm-audit',
+      channel: 'telegram',
+      senderId: 'user-audit',
+      text: '/reset',
+      metadata: { isCommand: true, command: 'reset' },
+    } as unknown as MessageRouterInput, vi.fn(async (_: OutboundMessage) => {}));
+
+    expect(mockAuditLogger.userAction).toHaveBeenCalledWith(
+      expect.objectContaining({
+        source: 'channel',
+        action_type: 'command',
+        channel: 'telegram',
+      }),
+    );
+  });
+
   it('handles model command via fast-path and persists tier override', async () => {
     const processSpy = vi.spyOn(AgentOrchestrator.prototype, 'process');
     const setModelTierSpy = vi.spyOn(AgentOrchestrator.prototype, 'setModelTier');

src/daemon/routing.ts

@@ -350,6 +350,20 @@ export function createMessageRouter(deps: {
     const commandInput = msg.metadata?.isCommand && typeof msg.metadata.command === 'string'
       ? `/${msg.metadata.command}${msg.metadata.commandArgs ? ` ${msg.metadata.commandArgs}` : ''}`
       : incomingText;
+    const metadataCommand = typeof msg.metadata?.command === 'string' ? msg.metadata.command : undefined;
+    const parsedCommand = msg.metadata?.isCommand
+      ? metadataCommand
+      : commandInput.startsWith('/') ? commandInput.slice(1).split(/\s+/, 1)[0] : undefined;
+    auditLogger?.userAction({
+      session_id: `${msg.channel}:${msg.senderId}`,
+      channel: msg.channel,
+      sender: msg.senderId,
+      source: 'channel',
+      action_type: parsedCommand ? 'command' : 'message',
+      content_length: commandInput.length,
+      attachments_count: msg.attachments?.length ?? 0,
+      command: parsedCommand,
+    });
 
     if (deps.commandRegistry && deps.commandRegistry.isCommand(commandInput)) {
       const session = deps.sessionManager.getSession(msg.channel, msg.senderId);