feat(admin): restore org Agent role/skill management and fix 404 after project create

- explorer POST /projects now returns {id,name} matching the SPA contract
  (previously returned ProjectOnboardingResult.projectId, so res.id was
  undefined and the redirect to /projects/undefined 404'd)
- add OrganizationAgentConfiguration.listRoles/listSkills + AgentRoleRow/
  AgentSkillRow exports; upsertRole now returns the full row
- new agentConfigRoutes: GET/PUT /agent-roles, PUT /agent-roles/:id/skills,
  GET /agent-skills, GET /agent-models (env-default picker)
- restore admin-web roles page + RoleCard rewired to ADR-0017/0018 backend
  (label, defaultModel, tools whitelist, skill binding, systemPrompt,
  sortOrder, default toggle); add 角色 nav item + roles icon
- skill installation stays out-of-band (CLI/seed) per spec; the surface only
  lists installed skills and binds them to roles

hub/admin-web/src/lib/api.ts

@@ -226,6 +226,39 @@ export interface CapacityPolicyView {
 	dimensions: CapacityDimensionRow[];
 }
 
+export interface AgentRoleRow {
+	id: string;
+	roleId: string;
+	label: string;
+	defaultModel: string | null;
+	systemPrompt: string | null;
+	tools: readonly string[] | null;
+	sortOrder: number;
+	isDefault: boolean;
+	disabledAt: string | null;
+	createdAt: string;
+	updatedAt: string;
+	skillNames: readonly string[];
+}
+
+export interface AgentSkillRow {
+	id: string;
+	name: string;
+	version: string;
+	description: string | null;
+	contentDigest: string;
+	disabledAt: string | null;
+	createdAt: string;
+	updatedAt: string;
+	boundRoleIds: readonly string[];
+}
+
+export interface AgentModelRow {
+	id: string;
+	label: string;
+	toolCapable: boolean;
+}
+
 // --- API ---
 
 export const api = {
@@ -261,8 +294,7 @@ export const api = {
 		post(`${orgBase(slug)}/teams/${teamId}/members/${userId}/revoke`),
 
 	explorer: (slug: string) => get(`${orgBase(slug)}/explorer`) as Promise<ExplorerData>,
-	myProjects: (slug: string) =>
+	myProjects: (slug: string) => get(`${orgBase(slug)}/my-projects`) as Promise<{ projects: ExplorerProject[] }>,
-		get(`${orgBase(slug)}/my-projects`) as Promise<{ projects: ExplorerProject[] }>,
 	createFolder: (slug: string, body: { name: string; parentId?: string; sortKey?: string }) =>
 		post(`${orgBase(slug)}/folders`, body) as Promise<{
 			id: string;
@@ -338,8 +370,27 @@ export const api = {
 	disableFeishuApplication: (slug: string) =>
 		del(`${orgBase(slug)}/feishu-application-connection`) as Promise<FeishuApplicationConnection>,
 
-	capacityPolicy: (slug: string) =>
+	capacityPolicy: (slug: string) => get(`${orgBase(slug)}/capacity-policy`) as Promise<CapacityPolicyView>,
-		get(`${orgBase(slug)}/capacity-policy`) as Promise<CapacityPolicyView>,
 	setCapacityPolicy: (slug: string, body: { limits: Partial<Record<CapacityDimension, number | null>> }) =>
 		put(`${orgBase(slug)}/capacity-policy`, body) as Promise<CapacityPolicyView>,
+
+	agentRoles: (slug: string) => get(`${orgBase(slug)}/agent-roles`) as Promise<{ roles: AgentRoleRow[] }>,
+	upsertAgentRole: (
+		slug: string,
+		roleId: string,
+		body: {
+			label: string;
+			defaultModel?: string | null;
+			systemPrompt?: string | null;
+			tools?: readonly string[] | null;
+			sortOrder?: number;
+			isDefault?: boolean;
+		},
+	) => put(`${orgBase(slug)}/agent-roles/${encodeURIComponent(roleId)}`, body) as Promise<AgentRoleRow>,
+	setAgentRoleSkills: (slug: string, roleId: string, skillNames: readonly string[]) =>
+		put(`${orgBase(slug)}/agent-roles/${encodeURIComponent(roleId)}/skills`, { skillNames }) as Promise<{
+			skillNames: string[];
+		}>,
+	agentSkills: (slug: string) => get(`${orgBase(slug)}/agent-skills`) as Promise<{ skills: AgentSkillRow[] }>,
+	agentModels: (slug: string) => get(`${orgBase(slug)}/agent-models`) as Promise<{ models: AgentModelRow[] }>,
 };

hub/admin-web/src/lib/components/Icon.svelte

@@ -18,7 +18,8 @@
 			| 'arrow-left'
 			| 'folder'
 			| 'file'
-			| 'check';
+			| 'check'
+			| 'roles';
 		class?: string;
 	} = $props();
 </script>
@@ -103,11 +104,7 @@
 	</svg>
 {:else if name === 'arrow-left'}
 	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
-		<path
+		<path stroke-linecap="round" stroke-linejoin="round" d="M10.5 19.5L3 12m0 0l7.5-7.5M3 12h18" />
-			stroke-linecap="round"
-			stroke-linejoin="round"
-			d="M10.5 19.5L3 12m0 0l7.5-7.5M3 12h18"
-		/>
 	</svg>
 {:else if name === 'folder'}
 	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
@@ -129,4 +126,12 @@
 	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
 		<path stroke-linecap="round" stroke-linejoin="round" d="M4.5 12.75l6 6 9-13.5" />
 	</svg>
+{:else if name === 'roles'}
+	<svg class={className} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75">
+		<path
+			stroke-linecap="round"
+			stroke-linejoin="round"
+			d="M9.813 15.904L9 18.75l-.813-2.846a4.5 4.5 0 00-3.09-3.09L2.25 12l2.847-.813a4.5 4.5 0 003.09-3.09L9 5.25l.813 2.846a4.5 4.5 0 003.09 3.09L15.75 12l-2.847.813a4.5 4.5 0 00-3.09 3.09zM18.259 8.715L18 9.75l-.259-1.035a3.375 3.375 0 00-2.456-2.456L14.25 6l1.035-.259a3.375 3.375 0 002.456-2.456L18 2.25l.259 1.035a3.375 3.375 0 002.456 2.456L21.75 6l-1.035.259a3.375 3.375 0 00-2.456 2.456zM16.894 20.567L16.5 21.75l-.394-1.183a2.25 2.25 0 00-1.423-1.423L13.5 18.75l1.183-.394a2.25 2.25 0 001.423-1.423l.394-1.183.394 1.183a2.25 2.25 0 001.423 1.423l1.183.394-1.183.394a2.25 2.25 0 00-1.423 1.423z"
+		/>
+	</svg>
 {/if}

hub/admin-web/src/lib/components/RoleCard.svelte

@@ -0,0 +1,208 @@
+<script lang="ts">
+	import { Checkbox, Label } from 'bits-ui';
+	import type { AgentRoleRow, AgentModelRow, AgentSkillRow } from '$lib/api';
+	import { api } from '$lib/api';
+	import { fmtDate } from '$lib/format';
+	import { TOOL_OPTIONS } from '$lib/constants';
+	import SelectField from '$lib/components/SelectField.svelte';
+	import CheckboxControl from '$lib/components/CheckboxControl.svelte';
+	import Icon from '$lib/components/Icon.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	let {
+		r,
+		models,
+		skills,
+		slug,
+		onupdated,
+		onskillschanged,
+	}: {
+		r: AgentRoleRow;
+		models: AgentModelRow[];
+		skills: AgentSkillRow[];
+		slug: string;
+		onupdated: (updated: AgentRoleRow) => void;
+		onskillschanged: (roleId: string, skillNames: string[]) => void;
+	} = $props();
+
+	const initial = {
+		label: r.label,
+		defaultModel: r.defaultModel ?? '',
+		systemPrompt: r.systemPrompt ?? '',
+		unrestricted: r.tools === null,
+		tools: r.tools ?? [],
+		sortOrder: String(r.sortOrder),
+		isDefault: r.isDefault,
+		skillNames: r.skillNames,
+	};
+	let label = $state(initial.label);
+	let defaultModel = $state(initial.defaultModel);
+	let systemPrompt = $state(initial.systemPrompt);
+	let unrestricted = $state(initial.unrestricted);
+	let selectedTools = $state<string[]>([...initial.tools]);
+	let sortOrder = $state(initial.sortOrder);
+	let isDefault = $state(initial.isDefault);
+	let selectedSkills = $state<string[]>([...initial.skillNames]);
+	let saving = $state(false);
+
+	const groupedTools = TOOL_OPTIONS.reduce(
+		(acc, t) => {
+			(acc[t.group] ??= []).push(t);
+			return acc;
+		},
+		{} as Record<string, typeof TOOL_OPTIONS>,
+	);
+
+	const modelItems = $derived([
+		{ value: '', label: '（使用平台默认模型）' },
+		...models.map((m) => ({ value: m.id, label: `${m.label}（${m.id}）` })),
+	]);
+
+	const skillItems = $derived(skills.map((s) => ({ value: s.name, label: s.name })));
+
+	function skillsDirty(): boolean {
+		const a = [...selectedSkills].sort();
+		const b = [...r.skillNames].sort();
+		return a.length !== b.length || a.some((v, i) => v !== b[i]);
+	}
+
+	async function save() {
+		const trimmedLabel = label.trim();
+		if (trimmedLabel === '') {
+			toastError('显示名不能为空');
+			return;
+		}
+		const order = Number(sortOrder);
+		if (sortKeyDirty() && (!Number.isSafeInteger(order) || order < 0)) {
+			toastError('排序必须为非负整数');
+			return;
+		}
+		saving = true;
+		const tools = unrestricted ? null : selectedTools;
+		try {
+			const updated = await api.upsertAgentRole(slug, r.roleId, {
+				label: trimmedLabel,
+				defaultModel: defaultModel === '' ? null : defaultModel,
+				systemPrompt: systemPrompt === '' ? null : systemPrompt,
+				tools,
+				...(sortKeyDirty() ? { sortOrder: order } : {}),
+				isDefault,
+			});
+			onupdated(updated);
+			if (skillsDirty()) {
+				const res = await api.setAgentRoleSkills(slug, r.roleId, selectedSkills);
+				selectedSkills = [...res.skillNames];
+				onskillschanged(r.roleId, res.skillNames);
+			}
+			toastSuccess('角色已保存');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			saving = false;
+		}
+	}
+
+	function sortKeyDirty(): boolean {
+		return Number(sortOrder) !== r.sortOrder;
+	}
+</script>
+
+<div class="saas-card-pad">
+	<div class="mb-4 flex flex-wrap items-center gap-2">
+		<span class="saas-badge-primary font-mono">/{r.roleId}</span>
+		<span class="text-sm text-surface-700">{label || r.label}</span>
+		{#if r.isDefault}
+			<span class="saas-badge-success">默认</span>
+		{/if}
+	</div>
+
+	<div class="grid grid-cols-1 gap-4 md:grid-cols-2">
+		<div>
+			<Label.Root for="role-label-{r.id}" class="saas-label">显示名</Label.Root>
+			<input id="role-label-{r.id}" class="saas-input" bind:value={label} />
+		</div>
+		<div>
+			<Label.Root for="role-sort-{r.id}" class="saas-label">排序</Label.Root>
+			<input id="role-sort-{r.id}" class="saas-input" type="number" min="0" bind:value={sortOrder} />
+		</div>
+	</div>
+
+	<div class="mt-4">
+		<p class="saas-label">默认模型</p>
+		<SelectField items={modelItems} bind:value={defaultModel} />
+	</div>
+
+	<div class="mt-4">
+		<span class="saas-label">工具白名单</span>
+		<label class="mb-3 flex cursor-pointer items-center gap-2 border border-surface-300 bg-surface-100 px-3 py-2">
+			<CheckboxControl bind:checked={unrestricted} />
+			<span class="text-sm">不限（使用全部注册工具）</span>
+		</label>
+		<div class="space-y-3 {unrestricted ? 'pointer-events-none opacity-40' : ''}">
+			<Checkbox.Group bind:value={selectedTools} disabled={unrestricted}>
+				{#each Object.entries(groupedTools) as [group, tools]}
+					<div>
+						<p class="mb-1.5 text-xs font-semibold uppercase tracking-wide text-surface-600">{group}</p>
+						<div class="grid grid-cols-1 gap-1.5 sm:grid-cols-2">
+							{#each tools as t}
+								<label class="flex cursor-pointer items-center gap-2 px-2 py-1.5 text-sm hover:bg-surface-100">
+									<Checkbox.Root class="saas-checkbox" value={t.id} id={`tool-${r.id}-${t.id}`}>
+										{#snippet children({ checked })}
+											{#if checked}
+												<Icon name="check" class="h-3.5 w-3.5" />
+											{/if}
+										{/snippet}
+									</Checkbox.Root>
+									<span>{t.label}</span>
+								</label>
+							{/each}
+						</div>
+					</div>
+				{/each}
+			</Checkbox.Group>
+		</div>
+	</div>
+
+	<div class="mt-4">
+		<span class="saas-label">技能绑定</span>
+		{#if skills.length === 0}
+			<p class="text-sm text-surface-600">组织内暂无已安装技能。技能通过 CLI / seed 安装（ADR-0018）。</p>
+		{:else}
+			<div class="grid grid-cols-1 gap-1.5 sm:grid-cols-2">
+				{#each skillItems as s}
+					<label class="flex cursor-pointer items-center gap-2 px-2 py-1.5 text-sm hover:bg-surface-100">
+						<CheckboxControl
+							checked={selectedSkills.includes(s.value)}
+							onchange={(checked) => {
+								selectedSkills = checked ? [...selectedSkills, s.value] : selectedSkills.filter((x) => x !== s.value);
+							}}
+						/>
+						<span class="font-mono text-xs">{s.label}</span>
+					</label>
+				{/each}
+			</div>
+		{/if}
+	</div>
+
+	<div class="mt-4">
+		<Label.Root for="role-prompt-{r.id}" class="saas-label">系统提示词</Label.Root>
+		<textarea
+			id="role-prompt-{r.id}"
+			class="saas-textarea"
+			rows="4"
+			placeholder="系统提示词（可选）。会话开始时注入，定义智能体人格/指令。"
+			bind:value={systemPrompt}></textarea>
+	</div>
+
+	<div class="mt-4 flex flex-wrap items-center gap-3 border-t border-surface-100 pt-4">
+		<label class="flex cursor-pointer items-center gap-2">
+			<CheckboxControl bind:checked={isDefault} />
+			<span class="text-sm">设为组织默认角色</span>
+		</label>
+		<span class="text-xs text-surface-600">更新于 {fmtDate(r.updatedAt)}</span>
+		<div class="flex-1"></div>
+		<button class="saas-btn-primary" onclick={save} disabled={saving}>
+			{saving ? '保存中…' : '保存'}
+		</button>
+	</div>
+</div>

hub/admin-web/src/routes/+layout.svelte

@@ -25,6 +25,7 @@
 		{ key: 'projects', label: '项目', icon: 'projects' as const },
 		{ key: 'capacity', label: '容量', icon: 'overview' as const },
 		{ key: 'provider', label: '供应方', icon: 'provider' as const },
+		{ key: 'roles', label: '角色', icon: 'roles' as const },
 		{ key: 'feishu', label: '飞书', icon: 'feishu' as const },
 	];
 
@@ -310,11 +311,7 @@
 	<div class="saas-shell">
 		<div class="saas-main">
 			<header class="saas-topbar">
-				<a
+				<a href={`/admin/org/${org.slug}/projects`} class="saas-btn-ghost px-2!" aria-label="返回项目列表">
-					href={`/admin/org/${org.slug}/projects`}
-					class="saas-btn-ghost px-2!"
-					aria-label="返回项目列表"
-				>
 					<Icon name="menu" class="h-5 w-5" />
 				</a>
 				<div class="min-w-0">

hub/admin-web/src/routes/admin/org/[slug]/roles/+page.svelte

@@ -0,0 +1,124 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type AgentRoleRow, type AgentModelRow, type AgentSkillRow } from '$lib/api';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import RoleCard from '$lib/components/RoleCard.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	let roles = $state<AgentRoleRow[]>([]);
+	let models = $state<AgentModelRow[]>([]);
+	let skills = $state<AgentSkillRow[]>([]);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let newRoleId = $state('');
+	let newLabel = $state('');
+	let adding = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const [r, m, s] = await Promise.all([api.agentRoles(slug), api.agentModels(slug), api.agentSkills(slug)]);
+			roles = r.roles;
+			models = m.models;
+			skills = s.skills;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function add() {
+		const roleId = newRoleId.trim();
+		const label = newLabel.trim();
+		if (roleId === '' || label === '') {
+			toastError('角色 ID 与显示名均为必填');
+			return;
+		}
+		if (roles.some((r) => r.roleId === roleId)) {
+			toastError(`角色 ID 已存在：${roleId}`);
+			return;
+		}
+		adding = true;
+		try {
+			const created = await api.upsertAgentRole(slug, roleId, { label });
+			roles = [...roles, created];
+			newRoleId = '';
+			newLabel = '';
+			toastSuccess('角色已创建');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			adding = false;
+		}
+	}
+
+	function onRoleUpdated(updated: AgentRoleRow) {
+		roles = roles.map((x) => (x.roleId === updated.roleId ? { ...updated, skillNames: x.skillNames } : x));
+		if (updated.isDefault) {
+			roles = roles.map((x) => (x.roleId === updated.roleId ? x : { ...x, isDefault: false }));
+		}
+	}
+
+	function onRoleSkillsChanged(roleId: string, skillNames: string[]) {
+		roles = roles.map((x) => (x.roleId === roleId ? { ...x, skillNames } : x));
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader
+	title="角色"
+	description="角色是组织级数据：组合默认模型、系统提示词、工具白名单与已绑定技能。角色 ID 即飞书斜杠命令（如 /draft）。"
+/>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	<div class="saas-card-pad mb-6">
+		<h2 class="saas-section-title mb-4">新建角色</h2>
+		<div class="grid gap-3 sm:grid-cols-[10rem_1fr_auto]">
+			<input
+				class="saas-input font-mono text-sm"
+				placeholder="角色 ID（如 draft）"
+				bind:value={newRoleId}
+				onkeydown={(e) => {
+					if (e.key === 'Enter') add();
+				}}
+			/>
+			<input
+				class="saas-input"
+				placeholder="显示名（如 草稿）"
+				bind:value={newLabel}
+				onkeydown={(e) => {
+					if (e.key === 'Enter') add();
+				}}
+			/>
+			<button class="saas-btn-primary" onclick={add} disabled={adding}>新建</button>
+		</div>
+		<p class="mt-2 text-xs text-surface-600">角色 ID 仅允许小写字母、数字、下划线与连字符，且以字母或数字开头。</p>
+	</div>
+
+	{#if roles.length === 0}
+		<div class="saas-card">
+			<EmptyState title="暂无角色" description="组织必须且只能有一个启用中的默认角色；新建第一个角色将自动成为默认。" />
+		</div>
+	{:else}
+		<div class="space-y-4">
+			{#each roles as r (r.roleId)}
+				<RoleCard {r} {models} {skills} {slug} onupdated={onRoleUpdated} onskillschanged={onRoleSkillsChanged} />
+			{/each}
+		</div>
+	{/if}
+{/if}

hub/src/admin/routes/agentConfigRoutes.ts

@@ -0,0 +1,129 @@
+/**
+ * Org-admin Agent configuration routes (ADR-0017 / ADR-0018).
+ *
+ * Surface for browsing and editing Organization-scoped Agent roles and the
+ * skills bound to them. Roles are org-owned data; the default-model picker is
+ * constrained to the env-default model registry (ADR-0017: there is no
+ * org-scoped model list — `OrganizationAgentRole.defaultModel` selects from the
+ * platform-enabled set). Skill *installation* is out of band (CLI / seed) per
+ * spec `Skill 管理是 org-scoped; 存储机制 OPEN`; this route only lists installed
+ * skills and binds them to roles.
+ */
+import type { PrismaClient } from "@prisma/client";
+import type { FastifyInstance } from "fastify";
+import { OrganizationAgentConfiguration } from "../../agent/configuration.js";
+import { createDefaultModelRegistry } from "../../settings/runtime.js";
+import { requireOrgRole, type GuardDeps } from "../auth/guards.js";
+import { handleRouteError } from "../errors.js";
+
+export interface AgentConfigRouteConfig {
+  readonly prisma: PrismaClient;
+  readonly sessionSecret: string;
+}
+
+export async function registerAgentConfigRoutes(
+  app: FastifyInstance,
+  config: AgentConfigRouteConfig,
+): Promise<void> {
+  const guardDeps: GuardDeps = { prisma: config.prisma, sessionSecret: config.sessionSecret };
+  // skillStoreRoot is null: this surface does not install skills (see header).
+  const agentConfig = new OrganizationAgentConfiguration(config.prisma, null);
+
+  app.get("/api/org/:orgSlug/agent-roles", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const roles = await agentConfig.listRoles({ organizationId: auth.organization.id });
+      return { roles };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.put("/api/org/:orgSlug/agent-roles/:roleId", async (request, reply) => {
+    try {
+      const { orgSlug, roleId } = request.params as { orgSlug: string; roleId: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const body = request.body as {
+        label?: unknown;
+        defaultModel?: unknown;
+        systemPrompt?: unknown;
+        tools?: unknown;
+        sortOrder?: unknown;
+        isDefault?: unknown;
+      };
+      if (typeof body.label !== "string" || body.label.trim() === "") {
+        return reply.status(400).send({
+          error: { code: "bad_request", message: "label is required" },
+        });
+      }
+      const role = await agentConfig.upsertRole({
+        organizationId: auth.organization.id,
+        roleId,
+        label: body.label,
+        ...(body.defaultModel === null || typeof body.defaultModel === "string"
+          ? { defaultModel: body.defaultModel as string | null }
+          : {}),
+        ...(body.systemPrompt === null || typeof body.systemPrompt === "string"
+          ? { systemPrompt: body.systemPrompt as string | null }
+          : {}),
+        ...(body.tools === null || Array.isArray(body.tools)
+          ? { tools: body.tools as readonly string[] | null }
+          : {}),
+        ...(typeof body.sortOrder === "number" ? { sortOrder: body.sortOrder } : {}),
+        ...(typeof body.isDefault === "boolean" ? { isDefault: body.isDefault } : {}),
+      });
+      return role;
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.put("/api/org/:orgSlug/agent-roles/:roleId/skills", async (request, reply) => {
+    try {
+      const { orgSlug, roleId } = request.params as { orgSlug: string; roleId: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const body = request.body as { skillNames?: unknown };
+      if (!Array.isArray(body.skillNames) || body.skillNames.some((n) => typeof n !== "string")) {
+        return reply.status(400).send({
+          error: { code: "bad_request", message: "skillNames must be a string array" },
+        });
+      }
+      await agentConfig.setRoleSkills({
+        organizationId: auth.organization.id,
+        roleId,
+        skillNames: body.skillNames as readonly string[],
+      });
+      return { skillNames: body.skillNames as string[] };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.get("/api/org/:orgSlug/agent-skills", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const skills = await agentConfig.listSkills({ organizationId: auth.organization.id });
+      return { skills };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+
+  app.get("/api/org/:orgSlug/agent-models", async (request, reply) => {
+    try {
+      const { orgSlug } = request.params as { orgSlug: string };
+      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
+      if (auth === null) return;
+      const registry = createDefaultModelRegistry(process.env);
+      return { models: registry.listModels() };
+    } catch (err) {
+      return handleRouteError(reply, err);
+    }
+  });
+}

hub/src/admin/routes/explorerRoutes.ts

@@ -155,7 +155,7 @@ export async function registerExplorerRoutes(
         workspaceRoot: config.projectWorkspaceRoot,
         ...(typeof body.folderId === "string" ? { folderId: body.folderId } : {}),
       });
-      return reply.status(201).send(result);
+      return reply.status(201).send({ id: result.projectId, name: body.name });
     } catch (err) {
       return handleRouteError(reply, err);
     }

hub/src/admin/routes/orgRoutes.ts

@@ -16,6 +16,7 @@ import { registerSessionsAndUsageRoutes } from "./sessionsRoutes.js";
 import { registerTeamsRoutes } from "./teamsRoutes.js";
 import { registerProviderConnectionRoutes } from "./providerConnectionRoutes.js";
 import { registerCapacityRoutes } from "./capacityRoutes.js";
+import { registerAgentConfigRoutes } from "./agentConfigRoutes.js";
 import type { LocalSecretEnvelope } from "../../security/secretEnvelope.js";
 import type { ProviderReadinessProbe } from "../../connections/providerReadiness.js";
 import type { FeishuReadinessProbe } from "../../connections/feishuReadiness.js";
@@ -110,6 +111,10 @@ export async function registerOrgRoutes(app: FastifyInstance, config: OrgRouteCo
     prisma: config.prisma,
     sessionSecret: config.sessionSecret,
   });
+  await registerAgentConfigRoutes(app, {
+    prisma: config.prisma,
+    sessionSecret: config.sessionSecret,
+  });
   await registerSessionsAndUsageRoutes(app, {
     prisma: config.prisma,
     sessionSecret: config.sessionSecret,

hub/src/agent/configuration.ts

@@ -5,6 +5,33 @@ import { importSkillDirectory } from "./skillStore.js";
 
 const ROLE_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/;
 
+export interface AgentRoleRow {
+  readonly id: string;
+  readonly roleId: string;
+  readonly label: string;
+  readonly defaultModel: string | null;
+  readonly systemPrompt: string | null;
+  readonly tools: readonly string[] | null;
+  readonly sortOrder: number;
+  readonly isDefault: boolean;
+  readonly disabledAt: string | null;
+  readonly createdAt: string;
+  readonly updatedAt: string;
+  readonly skillNames: readonly string[];
+}
+
+export interface AgentSkillRow {
+  readonly id: string;
+  readonly name: string;
+  readonly version: string;
+  readonly description: string | null;
+  readonly contentDigest: string;
+  readonly disabledAt: string | null;
+  readonly createdAt: string;
+  readonly updatedAt: string;
+  readonly boundRoleIds: readonly string[];
+}
+
 /**
  * Deep module for controlled host-console Agent configuration. It owns the
  * filesystem/DB ordering, Organization checks and role-skill composition so
@@ -13,14 +40,57 @@ const ROLE_ID_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/;
 export class OrganizationAgentConfiguration {
   constructor(
     private readonly prisma: PrismaClient,
-    private readonly skillStoreRoot: string,
+    private readonly skillStoreRoot: string | null,
   ) {}
 
+  async listRoles(input: { readonly organizationId: string }): Promise<readonly AgentRoleRow[]> {
+    await this.requireActiveOrganization(input.organizationId);
+    const roles = await this.prisma.organizationAgentRole.findMany({
+      where: { organizationId: input.organizationId, disabledAt: null },
+      orderBy: [{ sortOrder: "asc" }, { roleId: "asc" }],
+      include: {
+        skillBindings: {
+          orderBy: [{ sortOrder: "asc" }, { agentSkillId: "asc" }],
+          select: { skill: { select: { name: true, disabledAt: true } } },
+        },
+      },
+    });
+    return roles.map((role) => toRoleRow(role));
+  }
+
+  async listSkills(input: { readonly organizationId: string }): Promise<readonly AgentSkillRow[]> {
+    await this.requireActiveOrganization(input.organizationId);
+    const skills = await this.prisma.organizationAgentSkill.findMany({
+      where: { organizationId: input.organizationId, disabledAt: null },
+      orderBy: [{ name: "asc" }],
+      include: {
+        roleBindings: {
+          where: { role: { disabledAt: null } },
+          select: { role: { select: { roleId: true } } },
+        },
+      },
+    });
+    return skills.map((skill) => ({
+      id: skill.id,
+      name: skill.name,
+      version: skill.version,
+      description: skill.description,
+      contentDigest: skill.contentDigest,
+      disabledAt: skill.disabledAt === null ? null : skill.disabledAt.toISOString(),
+      createdAt: skill.createdAt.toISOString(),
+      updatedAt: skill.updatedAt.toISOString(),
+      boundRoleIds: skill.roleBindings.map((binding) => binding.role.roleId),
+    }));
+  }
+
   async installSkill(input: {
     readonly organizationId: string;
     readonly sourceDir: string;
     readonly version: string;
   }): Promise<{ readonly id: string; readonly name: string; readonly contentDigest: string }> {
+    if (this.skillStoreRoot === null) {
+      throw new Error("skill store root is not configured for this OrganizationAgentConfiguration");
+    }
     await this.requireActiveOrganization(input.organizationId);
     const version = nonEmpty(input.version, "skill version");
     const imported = await importSkillDirectory({
@@ -90,7 +160,7 @@ export class OrganizationAgentConfiguration {
     readonly tools?: readonly string[] | null | undefined;
     readonly sortOrder?: number | undefined;
     readonly isDefault?: boolean | undefined;
-  }): Promise<{ readonly id: string; readonly roleId: string }> {
+  }): Promise<AgentRoleRow> {
     await this.requireActiveOrganization(input.organizationId);
     if (!ROLE_ID_PATTERN.test(input.roleId)) throw new Error(`invalid role id: ${input.roleId}`);
     const label = nonEmpty(input.label, "role label");
@@ -150,7 +220,12 @@ export class OrganizationAgentConfiguration {
           isDefault: effectiveIsDefault,
           disabledAt: null,
         },
-        select: { id: true, roleId: true },
+        include: {
+          skillBindings: {
+            orderBy: [{ sortOrder: "asc" }, { agentSkillId: "asc" }],
+            select: { skill: { select: { name: true, disabledAt: true } } },
+          },
+        },
       });
       const executionSurfaceChanged = previous !== null && (
         (input.defaultModel !== undefined && normalizeOptionalText(input.defaultModel) !== previous.defaultModel) ||
@@ -182,7 +257,7 @@ export class OrganizationAgentConfiguration {
           },
         },
       });
-      return role;
+      return toRoleRow(role);
     });
   }
 
@@ -295,3 +370,43 @@ function normalizeOptionalText(value: string | null | undefined): string | null
   const normalized = value.trim();
   return normalized === "" ? null : normalized;
 }
+
+function parseTools(value: Prisma.JsonValue): readonly string[] | null {
+  if (value === null) return null;
+  if (!Array.isArray(value)) return null;
+  return value.filter((t): t is string => typeof t === "string");
+}
+
+function toRoleRow(role: {
+  readonly id: string;
+  readonly roleId: string;
+  readonly label: string;
+  readonly defaultModel: string | null;
+  readonly systemPrompt: string | null;
+  readonly tools: Prisma.JsonValue;
+  readonly sortOrder: number;
+  readonly isDefault: boolean;
+  readonly disabledAt: Date | null;
+  readonly createdAt: Date;
+  readonly updatedAt: Date;
+  readonly skillBindings: ReadonlyArray<{
+    readonly skill: { readonly name: string; readonly disabledAt: Date | null };
+  }>;
+}): AgentRoleRow {
+  return {
+    id: role.id,
+    roleId: role.roleId,
+    label: role.label,
+    defaultModel: role.defaultModel,
+    systemPrompt: role.systemPrompt,
+    tools: parseTools(role.tools),
+    sortOrder: role.sortOrder,
+    isDefault: role.isDefault,
+    disabledAt: role.disabledAt === null ? null : role.disabledAt.toISOString(),
+    createdAt: role.createdAt.toISOString(),
+    updatedAt: role.updatedAt.toISOString(),
+    skillNames: role.skillBindings
+      .filter((binding) => binding.skill.disabledAt === null)
+      .map((binding) => binding.skill.name),
+  };
+}