Add Automation write-audit resource types

apps/web/src/i18n/locales/en/keys.ts

@@ -210,6 +210,8 @@ export const keys = {
       vault: "Vault",
       credential: "Credential",
       artifact: "Artifact",
+      automation: "Automation",
+      automation_invocation: "Automation invocation",
     },
   },
 } as const;

apps/web/src/i18n/locales/zh-CN/keys.ts

@@ -212,6 +212,8 @@ export const keys: TranslationShape<typeof english> = {
       vault: "Vault",
       credential: "Credential",
       artifact: "产物",
+      automation: "Automation",
+      automation_invocation: "Automation 调用",
     },
   },
 };

contracts/agents-api/admin-api.md

@@ -184,10 +184,12 @@ Core records which Project API key made each successful public write, in the sam
 | Source File upload, delete | `create`, `delete` | `file` |
 | Vault create, delete | `create`, `delete` | `vault` |
 | Credential create, replace, delete (static and OAuth) | `create`, `update`, `delete` | `credential` (`vault`) |
+| Automation create, update, pause, resume, delete | `create`, `update`, `delete` | `automation` |
+| Manual Automation invocation | `create` | `automation_invocation` (`automation`) |
 
 Both routes accept only the parameters listed; an unknown, repeated or empty parameter returns 400, and a missing Project 404.
 
-`GET /projects/{project_id}/resource-owners?resource_type=agent&resource_ids=id1,id2` returns the creating key of 1–100 resources of one type, in request order. `resource_type` is `agent`, `session`, `environment`, `environment_template`, `skill`, `skill_version`, `file`, `vault`, `credential` or `artifact`.
+`GET /projects/{project_id}/resource-owners?resource_type=agent&resource_ids=id1,id2` returns the creating key of 1–100 resources of one type, in request order. `resource_type` is `agent`, `session`, `environment`, `environment_template`, `skill`, `skill_version`, `file`, `vault`, `credential`, `artifact`, `automation` or `automation_invocation`.
 
 ```json
 {"data":[

contracts/agents-api/core.openapi.yaml

@@ -4177,6 +4177,8 @@ definitions:
       - vault
       - credential
       - artifact
+      - automation
+      - automation_invocation
     type: string
     x-enum-varnames:
       - ResourceAgent
@@ -4189,6 +4191,8 @@ definitions:
       - ResourceVault
       - ResourceCredential
       - ResourceArtifact
+      - ResourceAutomation
+      - ResourceAutomationInvocation
 info:
   contact: {}
   description: Deployment and operations routes under /core/v1 for Core Web's server and operator scripts. Every operation requires the Core key; Project API keys and machine credentials are not accepted.

contracts/agents-api/zh/admin-api.md

@@ -1,7 +1,7 @@
 ---
 title: "Core 管理 API"
 source: contracts/agents-api/admin-api.md
-source_hash: 0b0be1a0a0d85119e047330c178258481e71f645d577554b5619d3a9b201a794
+source_hash: 664b5d01759bf29735e4e062739843b48c8130b302002b7a3c0e53b2306e7057
 ---
 
 Core 管理 API（`/core/v1`）用于管理安装实例：项目及其 API 密钥、项目资源的读取和删除、执行器凭据、部署默认模型、沙箱部署及其节点、监控和审计。Web 的[控制台服务器](../../../docs/zh/web/console-server.md#forwarding-to-core)会为已登录的管理员调用它；运维人员则从 Core 主机上的脚本调用它（[编写 Core API 脚本](../../../docs/zh/getting-started/operations.md#script-the-core-api)）。生成的架构是 [core.openapi.yaml](../core.openapi.yaml)，所有错误都使用 [Core 错误封装](core-errors.md)。
@@ -186,10 +186,12 @@ Core 会记录是哪个项目 API 密钥完成了每次成功的公共写入；
 | Source File 上传、删除 | `create`、`delete` | `file` |
 | Vault 创建、删除 | `create`、`delete` | `vault` |
 | Credential 创建、替换、删除（静态和 OAuth） | `create`、`update`、`delete` | `credential`（`vault`） |
+| Automation 创建、更新、暂停、恢复、删除 | `create`、`update`、`delete` | `automation` |
+| Automation 手动调用 | `create` | `automation_invocation`（`automation`） |
 
 上述两条路由仅接受列出的参数；未知、重复或空参数会返回 400，项目不存在则返回 404。
 
-`GET /projects/{project_id}/resource-owners?resource_type=agent&resource_ids=id1,id2` 按请求顺序返回同一类型下 1–100 个资源的创建密钥。`resource_type` 可以是 `agent`、`session`、`environment`、`environment_template`、`skill`、`skill_version`、`file`、`vault`、`credential` 或 `artifact`。
+`GET /projects/{project_id}/resource-owners?resource_type=agent&resource_ids=id1,id2` 按请求顺序返回同一类型下 1–100 个资源的创建密钥。`resource_type` 可以是 `agent`、`session`、`environment`、`environment_template`、`skill`、`skill_version`、`file`、`vault`、`credential`、`artifact`、`automation` 或 `automation_invocation`。
 
 ```json
 {"data":[

packages/agents-client/src/generated/core-api.ts

@@ -670,7 +670,7 @@ export interface ResourceOwnerList {
   data: ResourceOwner[];
 }
 export const resourceOwnerListFields = ["data"] as const;
-export const resourceTypeValues = ["agent", "session", "environment", "environment_template", "skill", "skill_version", "file", "vault", "credential", "artifact"] as const;
+export const resourceTypeValues = ["agent", "session", "environment", "environment_template", "skill", "skill_version", "file", "vault", "credential", "artifact", "automation", "automation_invocation"] as const;
 export type ResourceType = (typeof resourceTypeValues)[number];
 export interface Rollout {
   nodes: RolloutNodes | null;

services/core/internal/writeaudit/record.go

@@ -18,16 +18,18 @@ var ErrInvalidSource = errors.New("invalid write audit source")
 type ResourceType string
 
 const (
-	ResourceAgent               ResourceType = "agent"
-	ResourceSession             ResourceType = "session"
-	ResourceEnvironment         ResourceType = "environment"
-	ResourceEnvironmentTemplate ResourceType = "environment_template"
-	ResourceSkill               ResourceType = "skill"
-	ResourceSkillVersion        ResourceType = "skill_version"
-	ResourceFile                ResourceType = "file"
-	ResourceVault               ResourceType = "vault"
-	ResourceCredential          ResourceType = "credential"
-	ResourceArtifact            ResourceType = "artifact"
+	ResourceAgent                ResourceType = "agent"
+	ResourceSession              ResourceType = "session"
+	ResourceEnvironment          ResourceType = "environment"
+	ResourceEnvironmentTemplate  ResourceType = "environment_template"
+	ResourceSkill                ResourceType = "skill"
+	ResourceSkillVersion         ResourceType = "skill_version"
+	ResourceFile                 ResourceType = "file"
+	ResourceVault                ResourceType = "vault"
+	ResourceCredential           ResourceType = "credential"
+	ResourceArtifact             ResourceType = "artifact"
+	ResourceAutomation           ResourceType = "automation"
+	ResourceAutomationInvocation ResourceType = "automation_invocation"
 )
 
 type Action string
@@ -52,7 +54,7 @@ type Resource struct {
 // is closed; recording and owner queries share it.
 func ValidResourceType(value string) bool {
 	switch ResourceType(value) {
-	case ResourceAgent, ResourceSession, ResourceEnvironment, ResourceEnvironmentTemplate, ResourceSkill, ResourceSkillVersion, ResourceFile, ResourceVault, ResourceCredential, ResourceArtifact:
+	case ResourceAgent, ResourceSession, ResourceEnvironment, ResourceEnvironmentTemplate, ResourceSkill, ResourceSkillVersion, ResourceFile, ResourceVault, ResourceCredential, ResourceArtifact, ResourceAutomation, ResourceAutomationInvocation:
 		return true
 	}
 	return false