fix: restrict devii user access to audit logs with read-only permissions

devplacepy/services/devii/actions/catalog.py

@@ -1044,6 +1044,49 @@ ACTIONS: tuple[Action, ...] = (
         ),
         requires_admin=True,
     ),
+    Action(
+        name="audit_log",
+        method="GET",
+        path="/admin/audit-log",
+        summary="Query the platform audit trail with filters (admin only)",
+        description=(
+            "Returns JSON: a paginated, newest-first list of audit events (every state-changing "
+            "action on the platform, with actor, origin, target, old/new value, and result), plus "
+            "pagination, the active filters, and an 'options' object listing every available value "
+            "for each filter (category, event_key, actor_role, origin, result) so you can both "
+            "filter and discover valid filter values from a single call. Use this for any audit, "
+            "history, 'who did X', 'what changed', or 'show denied/failed actions' question. Filter "
+            "by event_key (exact), category, actor_role, actor_uid, origin (web, api, devii, cli, "
+            "service, scheduler), or result (success, failure, denied); narrow by date_from/date_to "
+            "(ISO date bounds, inclusive) or free-text q over summary, event key, and target."
+        ),
+        params=(
+            query("page", "Page number (1-based)."),
+            query("event_key", "Filter by exact event key (e.g. admin.setting.update)."),
+            query("category", "Filter by category (auth, content, admin, container, ...)."),
+            query("actor_role", "Filter by actor role at action time."),
+            query("actor_uid", "Filter by acting user uid."),
+            query("origin", "Filter by origin (web, api, devii, cli, service, scheduler)."),
+            query("result", "Filter by result (success, failure, denied)."),
+            query("q", "Free-text search over summary, event key, and target."),
+            query("date_from", "ISO date lower bound (inclusive)."),
+            query("date_to", "ISO date upper bound (inclusive)."),
+        ),
+        requires_admin=True,
+    ),
+    Action(
+        name="audit_event",
+        method="GET",
+        path="/admin/audit-log/{uid}",
+        summary="Get one audit event with its related-object links (admin only)",
+        description=(
+            "Returns JSON: the full audit event row plus every related-object link (actor, target, "
+            "parent, project, instance, setting, ...). Use after audit_log to inspect a single event "
+            "in detail."
+        ),
+        params=(path("uid", "Audit event uid."),),
+        requires_admin=True,
+    ),
     Action(
         name="admin_list_users",
         method="GET",

devplacepy/services/devii/agent.py

@@ -76,7 +76,11 @@ SYSTEM_PROMPT = (
     "member totals, active users over 24h/7d/30d, signups, content totals, and top authors in a "
     "single call. Never page through admin_list_users or any list_* endpoint to count records: "
     "fanning out paginated calls wastes the context window and is forbidden. When the user actually "
-    "wants items (not a count), page with the cursor and stop as soon as you have enough.\n\n"
+    "wants items (not a count), page with the cursor and stop as soon as you have enough. "
+    "For any audit, history, 'who did X', 'what changed', or 'show denied/failed actions' question, "
+    "call audit_log - filter by event_key/category/actor_uid/origin/result or a date range, or use q "
+    "for free text, and read the response's options object for the valid filter values; use "
+    "audit_event for one event's full detail and related links.\n\n"
     "NEVER GUESS - CHECK THE DOCS FIRST\n"
     "When you are unsure about a route, endpoint, parameter, capability, or whether a page or "
     "feature exists, call search_docs first (the documentation lists every route and endpoint), and "