feat(hub): usage fact breakdown API + admin usage/session UI + release v0.0.34

Expose UsageFact kind/capability rollups on org and project usage reports,
and add admin pages that separate model tokens from external-capability meters.

AGENTS.md

@@ -36,10 +36,6 @@
   `/compact` 只能由卡片动作以未经包装的精确 prompt 转发。
   `settingSources: []` 继续禁用项目/用户配置加载，不得把任意 workspace `.claude` 配置变成
   运行时能力(见 ADR-0018)。
-  skill/role 的管理面分组由一棵 org 内共用、可嵌套的 folder 树承载：透明组织节点，
-  不进入身份、解析与授权——name/roleId 仍 org 内唯一，role→skill 绑定、run 加载与
-  slash 命令均不引用 folder;folder 归属变更是 label 类变更,不归档会话;仅空 folder
-  可删(见 ADR-0028 / `Spec.System.AgentRole`)。
 - 项目发现由 `ProjectDiscovery` 模块统一承载：PostgreSQL `pg_trgm` 搜索派生文档、项目编号
   归一化、完整 Folder breadcrumb、MANAGE 授权过滤与分页都在该模块内；飞书卡片只是 adapter。
   `Project`/`Folder` 仍是事实来源，搜索文档必须可重建且由数据库触发器同步，禁止调用方双写。

docs/adr/0028-agent-config-folder-tree.md

@@ -1,81 +0,0 @@
-# ADR 0028: Agent Configuration Folder Tree
-
-## Status
-
-Accepted.
-
-## Context
-
-ADR-0017/0018 made Agent roles and skills Organization-scoped dynamic runtime
-configuration, managed without process restarts. The org admin surfaces for
-them (`/admin/roles` and `/admin/skills`) render every
-role/skill as one large editor card in a single flat list. As an Organization
-accumulates roles and skills, the management pages degrade into an endless
-scroll with no grouping affordance.
-
-The project explorer already solves the analogous problem for projects with
-transparent folders (ADR-0021): org-scoped navigation nodes that are not
-permission resources. Roles and skills need the same affordance, but their
-semantics differ from projects in one crucial way: skill names and role IDs
-are referenced by role→skill bindings, run-time skill snapshot loading, and
-Feishu slash commands. Any grouping mechanism must not leak into those
-resolution paths.
-
-## Decision
-
-Introduce an Organization-scoped folder tree shared by Agent roles and Agent
-skills:
-
-- One folder tree per Organization is shared by both roles and skills (e.g. a
-  "高三化学组" folder groups that team's roles and its skills together). It is
-  a distinct entity from the project explorer `Folder` of ADR-0021 — the two
-  trees are managed independently and never reference each other.
-- Folders are **transparent organization nodes**, following the ADR-0021
-  project-folder precedent: they exist for management-surface navigation and
-  grouping only, are not permission resources, and hold no grants.
-- Folder membership is **not part of role/skill identity or resolution**:
-  - skill `name` and role `roleId` remain unique per Organization regardless
-    of folder membership;
-  - role→skill bindings, run admission's frozen role snapshot, run-scoped
-    skill loading, and Feishu slash commands never reference folders.
-- Each role/skill sits in at most one folder; membership is optional
-  (unfiled items remain first-class). Folders nest arbitrarily.
-- Folder assignment is a label-class change in the ADR-0017 sense: it never
-  archives Agent sessions, because the execution surface (model, prompt,
-  tools, skill content) is untouched.
-- A folder can be deleted only when empty — no child folders, no roles, no
-  skills. Relocating items out of a folder is an explicit user action, so no
-  orphan-placement rule is needed yet.
-- Admin web renders both pages as a left folder tree plus the item list of
-  the selected folder ("all" and "unfiled" included). The host-console CLI is
-  unchanged: folder management lives in the web surface, and CLI
-  `upsert-role`/`install-skill` never touch folder assignment.
-
-## Consequences
-
-- New DB entity `OrganizationAgentConfigFolder` (org-scoped, self-nesting via
-  `parentId`, delete restricted while referenced) plus nullable `folderId` on
-  `OrganizationAgentRole` and `OrganizationAgentSkill` (SetNull on folder
-  delete, though the service refuses to delete non-empty folders).
-- The spec pins the transparency and single-membership semantics in
-  `Spec.System.AgentRole` (`AgentConfigFolder`), so future implementors do
-  not re-derive them differently (e.g. path-style names or per-folder
-  uniqueness).
-- Org admin APIs gain folder CRUD plus role/skill folder-assignment endpoints
-  that skip session archival by construction.
-- Moving a role/skill between folders changes nothing about authorization,
-  run resolution, or audit-visible configuration lineage beyond the folder
-  assignment event itself.
-
-## Open Questions / Deferred
-
-- Drag-and-drop assignment and bulk moves are deferred; assignment is a
-  per-item select for now.
-- Folder-level usage aggregation for roles/skills is deferred (project
-  folders already aggregate usage under ADR-0021; agent configuration has no
-  usage dimension yet).
-- CLI flags for folder assignment are deferred until a console workflow asks
-  for them.
-- Folder-scoped default-role policies (e.g. per-folder defaults) are rejected
-  for now: the Organization keeps exactly one active default role
-  (ADR-0017/0018 invariant) regardless of folder structure.

hub/admin-web/src/lib/api.ts

@@ -317,7 +317,6 @@ export interface AgentRoleRow {
 	createdAt: string;
 	updatedAt: string;
 	skillNames: readonly string[];
-	folderId: string | null;
 }
 
 export interface AgentSkillRow {
@@ -330,14 +329,6 @@ export interface AgentSkillRow {
 	createdAt: string;
 	updatedAt: string;
 	boundRoleIds: readonly string[];
-	folderId: string | null;
-}
-
-/** ADR-0028 transparent folder node shared by agent roles and skills. */
-export interface AgentConfigFolderRow {
-	id: string;
-	name: string;
-	parentId: string | null;
 }
 
 export interface SkillFileEntry {
@@ -524,21 +515,4 @@ export const api = {
 	patchAgentSkill: (slug: string, name: string, body: { description?: string; disabled?: boolean }) =>
 		patch(`${orgBase(slug)}/agent-skills/${encodeURIComponent(name)}`, body) as Promise<{ disabled?: boolean; updated?: boolean }>,
 	agentModels: (slug: string) => get(`${orgBase(slug)}/agent-models`) as Promise<{ models: AgentModelRow[] }>,
-
-	agentConfigFolders: (slug: string) =>
-		get(`${orgBase(slug)}/agent-config-folders`) as Promise<{ folders: AgentConfigFolderRow[] }>,
-	createAgentConfigFolder: (slug: string, body: { name: string; parentId?: string }) =>
-		post(`${orgBase(slug)}/agent-config-folders`, body) as Promise<AgentConfigFolderRow>,
-	patchAgentConfigFolder: (slug: string, folderId: string, body: { name?: string; parentId?: string | null }) =>
-		patch(`${orgBase(slug)}/agent-config-folders/${encodeURIComponent(folderId)}`, body) as Promise<AgentConfigFolderRow>,
-	deleteAgentConfigFolder: (slug: string, folderId: string) =>
-		del(`${orgBase(slug)}/agent-config-folders/${encodeURIComponent(folderId)}`) as Promise<{ deleted: boolean }>,
-	setAgentRoleFolder: (slug: string, roleId: string, folderId: string | null) =>
-		patch(`${orgBase(slug)}/agent-roles/${encodeURIComponent(roleId)}/folder`, { folderId }) as Promise<{
-			folderId: string | null;
-		}>,
-	setAgentSkillFolder: (slug: string, name: string, folderId: string | null) =>
-		patch(`${orgBase(slug)}/agent-skills/${encodeURIComponent(name)}/folder`, { folderId }) as Promise<{
-			folderId: string | null;
-		}>,
 };

hub/admin-web/src/lib/components/AgentConfigFolderNav.svelte

@@ -1,160 +0,0 @@
-<script lang="ts">
-	import type { AgentConfigFolderRow } from '$lib/api';
-	import Icon from './Icon.svelte';
-
-	/**
-	 * ADR-0028 left folder-tree nav for the agent config pages (roles/skills).
-	 * Transparent grouping only: selection filters the item list, it never
-	 * affects role/skill identity or run resolution.
-	 */
-	let {
-		folders,
-		selected,
-		counts,
-		totalCount,
-		unfiledCount,
-		onselect,
-		oncreate,
-		onrename,
-		ondelete,
-	}: {
-		folders: AgentConfigFolderRow[];
-		/** 'all' | 'unfiled' | folder id */
-		selected: string;
-		/** item count per folder id (roles or skills, depending on the page) */
-		counts: Record<string, number>;
-		totalCount: number;
-		unfiledCount: number;
-		onselect: (id: string) => void;
-		oncreate: (parentId: string | null) => void;
-		onrename: (folder: AgentConfigFolderRow) => void;
-		ondelete: (folder: AgentConfigFolderRow) => void;
-	} = $props();
-
-	type Row = { folder: AgentConfigFolderRow; depth: number; hasChildren: boolean };
-
-	let collapsed = $state<ReadonlySet<string>>(new Set());
-
-	function flatten(list: AgentConfigFolderRow[], collapsedSet: ReadonlySet<string>): Row[] {
-		const rows: Row[] = [];
-		const walk = (parentId: string | null, depth: number) => {
-			const siblings = list
-				.filter((f) => f.parentId === parentId)
-				.sort((a, b) => a.name.localeCompare(b.name));
-			for (const folder of siblings) {
-				const hasChildren = list.some((f) => f.parentId === folder.id);
-				rows.push({ folder, depth, hasChildren });
-				if (hasChildren && !collapsedSet.has(folder.id)) walk(folder.id, depth + 1);
-			}
-		};
-		walk(null, 0);
-		return rows;
-	}
-
-	const rows = $derived(flatten(folders, collapsed));
-
-	function toggleCollapse(folderId: string) {
-		const next = new Set(collapsed);
-		if (next.has(folderId)) next.delete(folderId);
-		else next.add(folderId);
-		collapsed = next;
-	}
-
-	function childFolderCount(folderId: string): number {
-		return folders.filter((f) => f.parentId === folderId).length;
-	}
-
-	const rowClass = (active: boolean) =>
-		`group flex w-full items-center gap-1.5 px-2 py-1.5 text-left text-sm transition hover:bg-surface-100 ${
-			active ? 'bg-primary-100 font-medium text-primary-900' : 'text-surface-800'
-		}`;
-</script>
-
-<nav class="saas-card p-2" aria-label="文件夹导航">
-	<div class="flex items-center justify-between px-2 py-1.5">
-		<span class="text-xs font-semibold uppercase tracking-wide text-surface-600">文件夹</span>
-		<button
-			type="button"
-			class="text-xs text-primary-700 hover:text-primary-900"
-			onclick={() => oncreate(null)}
-		>
-			+ 新建
-		</button>
-	</div>
-
-	<button type="button" class={rowClass(selected === 'all')} onclick={() => onselect('all')}>
-		<span class="w-3.5"></span>
-		<span class="min-w-0 flex-1 truncate">全部</span>
-		<span class="saas-badge-neutral">{totalCount}</span>
-	</button>
-	<button type="button" class={rowClass(selected === 'unfiled')} onclick={() => onselect('unfiled')}>
-		<span class="w-3.5"></span>
-		<span class="min-w-0 flex-1 truncate">未分类</span>
-		<span class="saas-badge-neutral">{unfiledCount}</span>
-	</button>
-
-	{#each rows as row (row.folder.id)}
-		{@const itemCount = counts[row.folder.id] ?? 0}
-		{@const childCount = childFolderCount(row.folder.id)}
-		<div class={rowClass(selected === row.folder.id)} style:padding-left="{0.5 + row.depth * 1}rem">
-			{#if row.hasChildren}
-				<button
-					type="button"
-					class="w-3.5 shrink-0 text-center text-xs text-surface-600"
-					aria-label={collapsed.has(row.folder.id) ? '展开' : '折叠'}
-					onclick={(e) => {
-						e.stopPropagation();
-						toggleCollapse(row.folder.id);
-					}}
-				>
-					{collapsed.has(row.folder.id) ? '▸' : '▾'}
-				</button>
-			{:else}
-				<span class="w-3.5 shrink-0"></span>
-			{/if}
-			<button type="button" class="flex min-w-0 flex-1 items-center gap-1.5 text-left" onclick={() => onselect(row.folder.id)}>
-				<Icon name="folder" class="h-3.5 w-3.5 shrink-0 opacity-60" />
-				<span class="min-w-0 flex-1 truncate">{row.folder.name}</span>
-				{#if itemCount > 0}
-					<span class="saas-badge-neutral">{itemCount}</span>
-				{/if}
-			</button>
-			<span
-				class="flex shrink-0 items-center gap-0.5 opacity-0 transition group-hover:opacity-100 focus-within:opacity-100"
-			>
-				<button
-					type="button"
-					class="flex h-5 w-5 items-center justify-center text-surface-500 hover:text-primary-700"
-					title="在此新建子文件夹"
-					aria-label="在 {row.folder.name} 内新建子文件夹"
-					onclick={() => oncreate(row.folder.id)}
-				>
-					<Icon name="folder-plus" class="h-3.5 w-3.5" />
-				</button>
-				<button
-					type="button"
-					class="flex h-5 w-5 items-center justify-center text-surface-500 hover:text-primary-700"
-					title="重命名 / 移动"
-					aria-label="重命名或移动 {row.folder.name}"
-					onclick={() => onrename(row.folder)}
-				>
-					✎
-				</button>
-				<button
-					type="button"
-					class="flex h-5 w-5 items-center justify-center text-surface-500 hover:text-error-700 disabled:cursor-not-allowed disabled:opacity-30"
-					title={itemCount > 0 || childCount > 0 ? '仅可删除空文件夹' : '删除文件夹'}
-					aria-label="删除 {row.folder.name}"
-					disabled={itemCount > 0 || childCount > 0}
-					onclick={() => ondelete(row.folder)}
-				>
-					×
-				</button>
-			</span>
-		</div>
-	{/each}
-
-	{#if folders.length === 0}
-		<p class="px-2 py-3 text-xs text-surface-600">还没有文件夹。新建一个来分组管理。</p>
-	{/if}
-</nav>

hub/admin-web/src/lib/components/FolderTree.svelte

@@ -33,7 +33,7 @@
 <div class="space-y-0.5">
 	{#each childProjects as p (p.id)}
 		<a
-			href={`/admin/projects/${p.id}`}
+			href={`/admin/org/${slug}/projects/${p.id}`}
 			class="flex items-center gap-2.5 px-3 py-2.5 text-sm transition hover:bg-surface-100"
 		>
 			<span class="flex h-7 w-7 items-center justify-center border border-primary-200 bg-primary-50 text-primary-700">

hub/admin-web/src/lib/components/RoleCard.svelte

@@ -5,7 +5,6 @@
 	import { fmtDate } from '$lib/format';
 	import { TOOL_OPTIONS } from '$lib/constants';
 	import SelectField from '$lib/components/SelectField.svelte';
-	import SearchableSelectField from '$lib/components/SearchableSelectField.svelte';
 	import CheckboxControl from '$lib/components/CheckboxControl.svelte';
 	import Icon from '$lib/components/Icon.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
@@ -15,20 +14,15 @@
 		models,
 		skills,
 		slug,
-		folderItems,
 		onupdated,
 		onskillschanged,
-		onfolderchanged,
 	}: {
 		r: AgentRoleRow;
 		models: AgentModelRow[];
 		skills: AgentSkillRow[];
 		slug: string;
-		/** ADR-0028 folder choices ('' = 未分类); transparent grouping only */
-		folderItems: { value: string; label: string }[];
 		onupdated: (updated: AgentRoleRow) => void;
 		onskillschanged: (roleId: string, skillNames: string[]) => void;
-		onfolderchanged: (roleId: string, folderId: string | null) => void;
 	} = $props();
 
 	const initial = {
@@ -50,8 +44,6 @@
 	let isDefault = $state(initial.isDefault);
 	let selectedSkills = $state<string[]>([...initial.skillNames]);
 	let saving = $state(false);
-	let folderValue = $state(r.folderId ?? '');
-	let savingFolder = $state(false);
 
 	const groupedTools = TOOL_OPTIONS.reduce(
 		(acc, t) => {
@@ -61,15 +53,10 @@
 		{} as Record<string, typeof TOOL_OPTIONS>,
 	);
 
-	const modelItems = $derived.by(() => {
-		const fromCatalog = models.map((m) => ({ value: m.id, label: `${m.label}（${m.id}）` }));
-		const items = [{ value: '', label: '（使用平台默认模型）' }, ...fromCatalog];
-		// Keep a previously saved model selectable even if it left the live catalog.
-		if (defaultModel !== '' && !items.some((item) => item.value === defaultModel)) {
-			items.push({ value: defaultModel, label: `${defaultModel}（当前已存，不在目录中）` });
-		}
-		return items;
-	});
+	const modelItems = $derived([
+		{ value: '', label: '（使用平台默认模型）' },
+		...models.map((m) => ({ value: m.id, label: `${m.label}（${m.id}）` })),
+	]);
 
 	const skillItems = $derived(skills.map((s) => ({ value: s.name, label: s.name })));
 
@@ -118,24 +105,6 @@
 	function sortKeyDirty(): boolean {
 		return Number(sortOrder) !== r.sortOrder;
 	}
-
-	// ADR-0028: folder assignment is a label-class change — instant-apply, no
-	// session archival, independent of the configuration save button.
-	async function saveFolder(next: string) {
-		const folderId = next === '' ? null : next;
-		if (folderId === r.folderId) return;
-		savingFolder = true;
-		try {
-			await api.setAgentRoleFolder(slug, r.roleId, folderId);
-			onfolderchanged(r.roleId, folderId);
-			toastSuccess('已更新所属文件夹');
-		} catch (err) {
-			folderValue = r.folderId ?? '';
-			toastError(err instanceof Error ? err.message : String(err));
-		} finally {
-			savingFolder = false;
-		}
-	}
 </script>
 
 <div class="saas-card-pad">
@@ -145,12 +114,6 @@
 		{#if r.isDefault}
 			<span class="saas-badge-success">默认</span>
 		{/if}
-		<div class="ml-auto flex items-center gap-2">
-			<span class="text-xs text-surface-600">文件夹</span>
-			<div class="w-44">
-				<SelectField items={folderItems} bind:value={folderValue} disabled={savingFolder} onchange={saveFolder} />
-			</div>
-		</div>
 	</div>
 
 	<div class="grid grid-cols-1 gap-4 md:grid-cols-2">
@@ -166,13 +129,7 @@
 
 	<div class="mt-4">
 		<p class="saas-label">默认模型</p>
-		<SearchableSelectField
-			items={modelItems}
-			bind:value={defaultModel}
-			placeholder="选择模型…"
-			searchPlaceholder="搜索模型名称或 ID"
-			emptyText="无匹配模型"
-		/>
+		<SelectField items={modelItems} bind:value={defaultModel} />
 	</div>
 
 	<div class="mt-4">

hub/admin-web/src/lib/components/SearchableSelectField.svelte

@@ -1,102 +0,0 @@
-<script lang="ts">
-	import { Combobox } from 'bits-ui';
-	import Icon from './Icon.svelte';
-	import type { SelectItem } from './SelectField.svelte';
-
-	let {
-		items,
-		value = $bindable(''),
-		class: className = '',
-		disabled = false,
-		placeholder = '请选择…',
-		searchPlaceholder = '搜索…',
-		emptyText = '无匹配项',
-		onchange,
-	}: {
-		items: SelectItem[];
-		value?: string;
-		class?: string;
-		disabled?: boolean;
-		placeholder?: string;
-		searchPlaceholder?: string;
-		emptyText?: string;
-		onchange?: (value: string) => void;
-	} = $props();
-
-	let searchValue = $state('');
-
-	const filteredItems = $derived.by(() => {
-		const q = searchValue.trim().toLowerCase();
-		if (q === '') return items;
-		return items.filter(
-			(item) => item.label.toLowerCase().includes(q) || item.value.toLowerCase().includes(q),
-		);
-	});
-</script>
-
-<Combobox.Root
-	type="single"
-	{items}
-	{disabled}
-	{value}
-	allowDeselect={false}
-	onValueChange={(next) => {
-		value = next;
-		onchange?.(next);
-	}}
-	onOpenChangeComplete={(open) => {
-		if (!open) searchValue = '';
-	}}
->
-	<div class="relative {className}">
-		<Combobox.Input
-			class="saas-combobox-input"
-			{disabled}
-			{placeholder}
-			aria-label={searchPlaceholder}
-			oninput={(e) => {
-				searchValue = e.currentTarget.value;
-			}}
-		/>
-		<Combobox.Trigger
-			class="absolute inset-y-0 right-0 flex w-9 items-center justify-center text-surface-600 disabled:cursor-not-allowed disabled:opacity-55"
-			{disabled}
-			aria-label="展开选项"
-		>
-			<svg
-				class="h-4 w-4 shrink-0"
-				viewBox="0 0 24 24"
-				fill="none"
-				stroke="currentColor"
-				stroke-width="1.75"
-				aria-hidden="true"
-			>
-				<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 15l3.75 3.75L15.75 15" />
-				<path stroke-linecap="round" stroke-linejoin="round" d="M8.25 9l3.75-3.75L15.75 9" />
-			</svg>
-		</Combobox.Trigger>
-	</div>
-	<Combobox.Portal>
-		<Combobox.Content class="saas-select-content" sideOffset={6} collisionPadding={8}>
-			<Combobox.Viewport class="max-h-72 overflow-y-auto p-1">
-				{#each filteredItems as item (item.value)}
-					<Combobox.Item
-						class="saas-select-item"
-						value={item.value}
-						label={item.label}
-						disabled={item.disabled}
-					>
-						{#snippet children({ selected })}
-							<span class="min-w-0 flex-1 truncate">{item.label}</span>
-							{#if selected}
-								<Icon name="check" class="ml-2 h-4 w-4 shrink-0 text-primary-600" />
-							{/if}
-						{/snippet}
-					</Combobox.Item>
-				{:else}
-					<div class="px-2 py-2 text-sm text-surface-600">{emptyText}</div>
-				{/each}
-			</Combobox.Viewport>
-		</Combobox.Content>
-	</Combobox.Portal>
-</Combobox.Root>

hub/admin-web/src/lib/components/SkillEditor.svelte

@@ -3,24 +3,18 @@
 	import { api } from '$lib/api';
 	import { fmtDate } from '$lib/format';
 	import Icon from '$lib/components/Icon.svelte';
-	import SelectField from '$lib/components/SelectField.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
 	let {
 		slug,
 		skill,
-		folderItems,
 		oninstalled,
 		ondisabled,
-		onfolderchanged,
 	}: {
 		slug: string;
 		skill: AgentSkillRow;
-		/** ADR-0028 folder choices ('' = 未分类); transparent grouping only */
-		folderItems: { value: string; label: string }[];
 		oninstalled: (result: { id: string; name: string; contentDigest: string }) => void;
 		ondisabled: (name: string) => void;
-		onfolderchanged: (name: string, folderId: string | null) => void;
 	} = $props();
 
 	type FileNode = { path: string; content: string };
@@ -34,8 +28,6 @@
 	let dirty = $state(false);
 	let newFilePath = $state('');
 	let showNewFile = $state(false);
-	let folderValue = $state(skill.folderId ?? '');
-	let savingFolder = $state(false);
 
 	const selectedFile = $derived(files.find((f) => f.path === selectedPath) ?? null);
 	const hasManifest = $derived(files.some((f) => f.path === 'SKILL.md'));
@@ -160,24 +152,6 @@
 		dirty = true;
 	}
 
-	// ADR-0028: folder assignment is a label-class change — instant-apply, no
-	// session archival, independent of the content save button.
-	async function saveFolder(next: string) {
-		const folderId = next === '' ? null : next;
-		if (folderId === skill.folderId) return;
-		savingFolder = true;
-		try {
-			await api.setAgentSkillFolder(slug, skill.name, folderId);
-			onfolderchanged(skill.name, folderId);
-			toastSuccess('已更新所属文件夹');
-		} catch (err) {
-			folderValue = skill.folderId ?? '';
-			toastError(err instanceof Error ? err.message : String(err));
-		} finally {
-			savingFolder = false;
-		}
-	}
-
 	function updateFrontmatter(content: string, key: string, value: string): string {
 		const regex = new RegExp(`^(${key}:\\s*)(.*?)(\\s*)$`, 'm');
 		if (regex.test(content)) {
@@ -204,12 +178,6 @@
 		{#if skill.disabledAt}
 			<span class="saas-badge-error">已禁用</span>
 		{/if}
-		<div class="ml-auto flex items-center gap-2">
-			<span class="text-xs text-surface-600">文件夹</span>
-			<div class="w-44">
-				<SelectField items={folderItems} bind:value={folderValue} disabled={savingFolder} onchange={saveFolder} />
-			</div>
-		</div>
 	</div>
 
 	<div class="mb-4 grid grid-cols-1 gap-4 md:grid-cols-2">

hub/admin-web/src/lib/org.ts

@@ -1,40 +0,0 @@
-import type { MeResponse, OrgMembership } from './api';
-
-/** Alpha Silo host prefix: <slug>.educraft[.dev].… */
-export function hostOrgSlug(hostname: string = typeof window !== 'undefined' ? window.location.hostname : ''): string | null {
-	const host = hostname.toLowerCase();
-	const m = host.match(/^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.educraft(?:-dev)?\./);
-	return m?.[1] ?? null;
-}
-
-export function isOrgAdmin(org: OrgMembership | null | undefined): boolean {
-	if (!org) return false;
-	const role = String(org.role ?? '').toUpperCase();
-	return role === 'OWNER' || role === 'ADMIN';
-}
-
-/**
- * Resolve the tenancy for this browser session.
- * Prefers hostname slug (silo), then ?org=, then first admin membership, then first membership.
- */
-export function resolveOrg(me: MeResponse | null | undefined, search: string = ''): OrgMembership | null {
-	if (!me || me.organizations.length === 0) return null;
-	const host = hostOrgSlug();
-	if (host) {
-		const byHost = me.organizations.find((o) => o.slug === host);
-		if (byHost) return byHost;
-	}
-	const q = new URLSearchParams(search).get('org')?.trim();
-	if (q) {
-		const byQuery = me.organizations.find((o) => o.slug === q);
-		if (byQuery) return byQuery;
-	}
-	const admin = me.organizations.find((o) => isOrgAdmin(o));
-	return admin ?? me.organizations[0] ?? null;
-}
-
-/** SPA paths no longer embed org slug (subdomain carries tenancy). */
-export function adminPath(rest: string = ''): string {
-	const cleaned = rest.replace(/^\/+/, '');
-	return cleaned === '' ? '/admin' : `/admin/${cleaned}`;
-}

hub/admin-web/src/lib/session.ts

@@ -35,9 +35,12 @@ export async function loadSession(): Promise<void> {
 /**
  * Resolve org slug for org-scoped Feishu OAuth (`GET /auth/feishu/:orgSlug`).
  * Unscoped `/auth/feishu` is disabled unless allowLegacyFeishuOAuth is on.
- * Path no longer carries tenancy: prefer hostname silo slug, then ?org=.
  */
 export function resolveLoginOrgSlug(): string | null {
+	const path = window.location.pathname.split('/').filter(Boolean);
+	if (path[0] === 'admin' && path[1] === 'org' && path[2]) {
+		return decodeURIComponent(path[2]);
+	}
 	const q = new URLSearchParams(window.location.search).get('org');
 	if (q && q.trim() !== '') return q.trim();
 
@@ -45,12 +48,6 @@ export function resolveLoginOrgSlug(): string | null {
 	const host = window.location.hostname.toLowerCase();
 	const m = host.match(/^([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)\.educraft(?:-dev)?\./);
 	if (m?.[1]) return m[1];
-
-	// Legacy path while old bookmarks still land briefly before redirect.
-	const path = window.location.pathname.split('/').filter(Boolean);
-	if (path[0] === 'admin' && path[1] === 'org' && path[2]) {
-		return decodeURIComponent(path[2]);
-	}
 	return null;
 }
 

hub/admin-web/src/routes/+layout.svelte

@@ -5,7 +5,6 @@
 	import { page } from '$app/state';
 	import { session, loadSession, logout, redirectToLogin } from '$lib/session';
 	import type { OrgMembership } from '$lib/api';
-	import { adminPath, isOrgAdmin, resolveOrg } from '$lib/org';
 	import { orgRoleLabel } from '$lib/format';
 	import Icon from '$lib/components/Icon.svelte';
 	import ToastHost from '$lib/components/ToastHost.svelte';
@@ -33,36 +32,56 @@
 		{ key: 'capabilities', label: '能力', icon: 'provider' as const },
 	];
 
+	function isAdmin(org: OrgMembership): boolean {
+		const role = String(org.role ?? '').toUpperCase();
+		return role === 'OWNER' || role === 'ADMIN';
+	}
+
+	function orgSlugFromPath(): string | null {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		if (parts[0] === 'admin' && parts[1] === 'org' && parts[2]) {
+			return decodeURIComponent(parts[2]);
+		}
+		return null;
+	}
+
+	function isOnProjectRoute(): boolean {
+		const parts = page.url.pathname.split('/').filter(Boolean);
+		return parts[0] === 'admin' && parts[1] === 'org' && parts[3] === 'projects';
+	}
+
 	function memberships(): OrgMembership[] {
 		return $session.me?.organizations ?? [];
 	}
 
 	function adminOrgs(): OrgMembership[] {
-		return memberships().filter((o) => isOrgAdmin(o));
+		return memberships().filter(isAdmin);
 	}
 
 	function currentOrg(): OrgMembership | null {
-		return resolveOrg($session.me, page.url.search);
+		const slug = orgSlugFromPath();
+		if (!slug) return null;
+		return memberships().find((o) => o.slug === slug) ?? null;
 	}
 
-	function isOnProjectRoute(): boolean {
-		const parts = page.url.pathname.split('/').filter(Boolean);
-		// /admin/projects or /admin/projects/:id
-		return parts[0] === 'admin' && parts[1] === 'projects';
+	function pickHomeOrg(): OrgMembership | null {
+		const admin = adminOrgs()[0];
+		if (admin) return admin;
+		return memberships()[0] ?? null;
 	}
 
 	function activeKey(): string {
 		const parts = page.url.pathname.split('/').filter(Boolean);
-		if (parts[0] !== 'admin') return '';
-		// /admin → overview; /admin/usage → usage; /admin/projects/x → projects
-		return parts[1] ?? 'overview';
+		if (parts[0] !== 'admin' || parts[1] !== 'org' || !parts[2]) return '';
+		return parts[3] ?? 'overview';
 	}
 
 	function navHref(key: string): string {
-		if (key === 'overview') return adminPath();
-		return adminPath(key);
+		const slug = currentOrg()?.slug ?? pickHomeOrg()?.slug;
+		if (!slug) return '/';
+		if (key === 'overview') return `/admin/org/${slug}`;
+		return `/admin/org/${slug}/${key}`;
 	}
-
 	function pageTitle(): string {
 		const key = activeKey();
 		if (key === 'overview' || key === '') return '概览';
@@ -72,10 +91,7 @@
 
 	function switchOrg(nextSlug: string) {
 		if (!nextSlug || nextSlug === currentOrg()?.slug) return;
-		// Path is tenancy-free; keep optional ?org= for local multi-membership debugging.
-		const url = new URL(page.url.href);
-		url.searchParams.set('org', nextSlug);
-		void goto(`${url.pathname}${url.search}`, { replaceState: true });
+		void goto(`/admin/org/${nextSlug}`);
 	}
 
 	function handleLogout(e: Event) {
@@ -98,23 +114,33 @@
 	$effect(() => {
 		if ($session.loading || !$session.me) return;
 
-		const path = page.url.pathname;
-		// Legacy /admin/org/:slug… is handled by admin/org/[...path] page.
+		const slug = orgSlugFromPath();
+		const matched = slug ? memberships().find((o) => o.slug === slug) : null;
 
-		const org = currentOrg();
+		// Org admins: route to their first admin org if none matched as admin.
 		const admins = adminOrgs();
-
-		if (org && isOrgAdmin(org)) {
+		if (matched && isAdmin(matched)) {
 			redirecting = false;
 			return;
 		}
+		if (!matched && admins.length > 0) {
+			const target = `/admin/org/${admins[0].slug}`;
+			if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
+				redirecting = true;
+				void goto(target, { replaceState: true });
+			}
+			return;
+		}
 
-		// Member only: allow project routes; bounce admin-only surfaces to projects.
-		if (org && !isOrgAdmin(org)) {
+		// Members (non-admin): project pages are open to project MANAGE holders;
+		// the org overview and other admin-only surfaces are not for them.
+		if (matched && !isAdmin(matched)) {
 			redirecting = false;
-			if (!isOnProjectRoute()) {
-				const target = adminPath('projects');
-				if (path !== target) {
+			const parts = page.url.pathname.split('/').filter(Boolean);
+			const onOverview = parts.length === 3; // /admin/org/:slug
+			if (onOverview) {
+				const target = `/admin/org/${matched.slug}/projects`;
+				if (page.url.pathname !== target) {
 					redirecting = true;
 					void goto(target, { replaceState: true });
 				}
@@ -122,11 +148,12 @@
 			return;
 		}
 
-		// No org resolved but user has memberships → land on first org's projects/overview via resolveOrg next tick
-		if (!org && memberships().length > 0) {
-			const home = admins[0] ?? memberships()[0]!;
-			const target = isOrgAdmin(home) ? adminPath() : adminPath('projects');
-			if (path !== target && !path.startsWith(`${target}/`)) {
+		// No matched org and no admin orgs: route a member to their first org's
+		// projects page so they can reach project MANAGE surfaces.
+		if (!matched && memberships().length > 0) {
+			const home = memberships()[0];
+			const target = `/admin/org/${home.slug}/projects`;
+			if (page.url.pathname !== target && !page.url.pathname.startsWith(`${target}/`)) {
 				redirecting = true;
 				void goto(target, { replaceState: true });
 			}
@@ -147,14 +174,14 @@
 					d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"
 				></path>
 			</svg>
-			<p class="text-sm">加载中…</p>
+			<p class="text-sm">{redirecting ? '正在进入组织…' : '正在加载会话…'}</p>
 		</div>
 	</div>
 {:else if $session.error}
 	<div class="saas-status-panel">
 		<div class="saas-status-card">
 			<div
-				class="mx-auto mb-3 flex h-12 w-12 items-center justify-center border border-error-200 bg-error-50 text-error-700"
+				class="mx-auto mb-4 flex h-12 w-12 items-center justify-center border border-error-300 bg-error-100 text-error-700 font-bold"
 			>
 				!
 			</div>
@@ -167,7 +194,7 @@
 	<div class="saas-status-panel">
 		<div class="saas-status-card">
 			<div
-				class="mx-auto mb-4 flex h-12 w-12 items-center justify-center border border-primary-700 bg-primary-600 text-sm font-bold text-white"
+				class="mx-auto mb-5 flex h-12 w-12 items-center justify-center border border-primary-700 bg-primary-600 text-white font-bold"
 			>
 				CPH
 			</div>
@@ -176,7 +203,7 @@
 			<button class="saas-btn-primary w-full" onclick={() => redirectToLogin()}>使用飞书登录</button>
 		</div>
 	</div>
-{:else if currentOrg() && isOrgAdmin(currentOrg()!)}
+{:else if currentOrg() && isAdmin(currentOrg()!)}
 	{@const org = currentOrg()!}
 	{@const me = $session.me!}
 	<div class="saas-shell">
@@ -201,19 +228,17 @@
 				</div>
 				<div class="min-w-0">
 					<div class="truncate text-sm font-semibold text-surface-900">组织后台</div>
-					<div class="truncate text-xs text-surface-600">{org.name}</div>
+					<div class="truncate text-xs text-surface-600">Curriculum Hub</div>
 				</div>
 			</div>
 
-			{#if me.organizations.length > 1}
-				<div class="px-3 pb-3">
-					<div class="mb-1.5 flex items-center gap-1.5 text-xs font-medium text-surface-700">
-						<Icon name="org" class="h-3.5 w-3.5" />
-						组织
-					</div>
-					<SelectField items={orgSelectItems(me.organizations)} value={org.slug} onchange={switchOrg} />
+			<div class="px-3 pb-3">
+				<div class="mb-1.5 flex items-center gap-1.5 text-xs font-medium text-surface-700">
+					<Icon name="org" class="h-3.5 w-3.5" />
+					组织
 				</div>
-			{/if}
+				<SelectField items={orgSelectItems(me.organizations)} value={org.slug} onchange={switchOrg} />
+			</div>
 
 			<nav class="flex-1 space-y-0.5 overflow-y-auto px-2 pb-3">
 				<p class="px-3 pb-1 pt-2 text-[11px] font-semibold uppercase tracking-wider text-surface-600">工作台</p>
@@ -283,13 +308,13 @@
 			</main>
 		</div>
 	</div>
-{:else if currentOrg() && !isOrgAdmin(currentOrg()!) && isOnProjectRoute()}
+{:else if currentOrg() && !isAdmin(currentOrg()!) && isOnProjectRoute()}
 	{@const org = currentOrg()!}
 	{@const me = $session.me!}
 	<div class="saas-shell">
 		<div class="saas-main">
 			<header class="saas-topbar">
-				<a href={adminPath('projects')} class="saas-btn-ghost px-2!" aria-label="返回项目列表">
+				<a href={`/admin/org/${org.slug}/projects`} class="saas-btn-ghost px-2!" aria-label="返回项目列表">
 					<Icon name="menu" class="h-5 w-5" />
 				</a>
 				<div class="min-w-0">
@@ -318,7 +343,7 @@
 			</main>
 		</div>
 	</div>
-{:else if currentOrg() && !isOrgAdmin(currentOrg()!)}
+{:else if currentOrg() && !isAdmin(currentOrg()!)}
 	{@const denied = currentOrg()!}
 	<div class="saas-status-panel">
 		<div class="saas-status-card">
@@ -327,7 +352,7 @@
 				组织 <strong>{denied.name}</strong>（/{denied.slug}）中你的角色是
 				<span class="saas-badge-neutral mx-1">{orgRoleLabel(denied.role)}</span>。普通成员仅可访问自己有授权的项目。
 			</p>
-			<a class="saas-btn-primary" href={adminPath('projects')}>查看我的项目</a>
+			<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>查看我的项目</a>
 			{#if memberships().length > 1}
 				<p class="saas-label text-left mb-1.5 mt-3">切换到其他组织</p>
 				<div class="mb-4">
@@ -338,14 +363,14 @@
 		</div>
 	</div>
 {:else if memberships().length > 0}
-	{@const denied = resolveOrg($session.me) ?? memberships()[0]!}
+	{@const denied = pickHomeOrg()!}
 	<div class="saas-status-panel">
 		<div class="saas-status-card">
 			<h2 class="mb-2 text-lg font-semibold">正在跳转…</h2>
 			<p class="mb-5 text-sm text-surface-700">
 				即将进入 <strong>{denied.name}</strong>（/{denied.slug}）的项目。
 			</p>
-			<a class="saas-btn-primary" href={adminPath('projects')}>立即进入</a>
+			<a class="saas-btn-primary" href={`/admin/org/${denied.slug}/projects`}>立即进入</a>
 			<button class="saas-btn-ghost mt-3" onclick={handleLogout}>退出登录</button>
 		</div>
 	</div>

hub/admin-web/src/routes/+page.svelte

@@ -11,7 +11,7 @@
 			return r === 'OWNER' || r === 'ADMIN';
 		});
 		const target = admin ?? me.organizations[0];
-		return target ? `/admin` : null;
+		return target ? `/admin/org/${target.slug}` : null;
 	}
 
 	onMount(() => {

hub/admin-web/src/routes/admin/org/[...path]/+page.svelte

@@ -1,23 +0,0 @@
-<script lang="ts">
-	/**
-	 * Legacy bookmarks: /admin/org/:slug[/...] → /admin[/...]
-	 * Tenancy lives on the silo host, not the path.
-	 */
-	import { onMount } from 'svelte';
-	import { goto } from '$app/navigation';
-	import { page } from '$app/state';
-
-	onMount(() => {
-		const raw = page.params.path ?? '';
-		const segments = raw.split('/').filter(Boolean);
-		// Drop the old org slug (first segment) when present.
-		const rest = segments.length > 0 ? segments.slice(1).join('/') : '';
-		const target = rest === '' ? '/admin' : `/admin/${rest}`;
-		const q = page.url.search;
-		void goto(`${target}${q}`, { replaceState: true });
-	});
-</script>
-
-<div class="saas-status-panel">
-	<p class="text-sm text-surface-600">正在重定向到新地址…</p>
-</div>

hub/admin-web/src/routes/admin/org/[slug]/+page.svelte

@@ -2,7 +2,6 @@
 	import { page } from '$app/state';
 	import { api, type OrgMembership } from '$lib/api';
 	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import { fmtCost, fmtNum, orgRoleLabel } from '$lib/format';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import StatCard from '$lib/components/StatCard.svelte';
@@ -11,8 +10,7 @@
 	import SwitchControl from '$lib/components/SwitchControl.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
-	const orgFromSession = $derived(resolveOrg($session.me, page.url.search));
-	let orgSlug = $derived(orgFromSession?.slug ?? '');
+	let orgSlug = $derived(page.params.slug ?? '');
 	let org = $derived($session.me?.organizations.find((o) => o.slug === orgSlug) as OrgMembership | undefined);
 
 	let settings = $state<{ membersCanCreateProjects: boolean } | null>(null);
@@ -98,7 +96,7 @@
 			<h2 class="saas-section-title">用量概览</h2>
 			<p class="saas-muted">totals 含全部 UsageFact；分账明细见用量页。</p>
 		</div>
-		<a class="saas-btn-secondary py-1.5! text-sm" href={`/admin/usage`}>完整用量报告</a>
+		<a class="saas-btn-secondary py-1.5! text-sm" href={`/admin/org/${orgSlug}/usage`}>完整用量报告</a>
 	</div>
 
 	<div class="mb-6 grid gap-3 sm:grid-cols-2 lg:grid-cols-3">
@@ -117,7 +115,7 @@
 					<h3 class="text-sm font-semibold text-surface-800">消费来源（Top）</h3>
 					<p class="saas-muted text-xs">模型完成 vs 外部能力，按成本降序前 5</p>
 				</div>
-				<a class="text-sm text-primary-700 hover:underline" href={`/admin/usage`}>查看全部分账</a>
+				<a class="text-sm text-primary-700 hover:underline" href={`/admin/org/${orgSlug}/usage`}>查看全部分账</a>
 			</div>
 			<div class="overflow-x-auto">
 				<table class="data-table">
@@ -169,7 +167,7 @@
 						{#each usage.projects as p}
 							<tr>
 								<td class="font-medium">
-									<a class="hover:text-primary-700 hover:underline" href={`/admin/projects/${p.projectId}`}>
+									<a class="hover:text-primary-700 hover:underline" href={`/admin/org/${orgSlug}/projects/${p.projectId}`}>
 										{p.projectName}
 									</a>
 								</td>

hub/admin-web/src/routes/admin/org/[slug]/capabilities/+page.svelte

@@ -1,8 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type CapabilityConnection } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import { fmtDate } from '$lib/format';
 	import { Label } from 'bits-ui';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -10,8 +8,7 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');
 
 	const KNOWN_CAPABILITIES = [
 		{ id: 'pdf_to_md_bundle', label: 'PDF → Markdown', description: '将 PDF 转换为带图片的 Markdown bundle（阿里云文档智能，含公式 LaTeX 识别）' },

hub/admin-web/src/routes/admin/org/[slug]/capacity/+page.svelte

@@ -1,16 +1,13 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type CapacityDimension, type CapacityDimensionRow, type CapacityPolicyView } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import LoadingState from '$lib/components/LoadingState.svelte';
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import EmptyState from '$lib/components/EmptyState.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');
 
 	// Friendlier, user-facing labels. No spec jargon (墙钟 → 运行时长, etc.).
 	const DIMENSION_LABELS: Record<CapacityDimension, string> = {

hub/admin-web/src/routes/admin/org/[slug]/feishu/+page.svelte

@@ -1,8 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type FeishuApplicationConnection } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import { fmtDate } from '$lib/format';
 	import { Label } from 'bits-ui';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -10,8 +8,7 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');
 
 	let connection = $state<FeishuApplicationConnection | null>(null);
 	let loading = $state(true);

hub/admin-web/src/routes/admin/org/[slug]/members/+page.svelte

@@ -1,8 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type OrgMember } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import { fmtDate } from '$lib/format';
 	import { ORG_ROLES, ORG_ROLE_LABELS, PERMISSION_ROLE_LABELS } from '$lib/constants';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -12,8 +10,7 @@
 	import SelectField from '$lib/components/SelectField.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');
 	const roleItems = ORG_ROLES.map((r) => ({ value: r, label: ORG_ROLE_LABELS[r] }));
 	const permHint = Object.values(PERMISSION_ROLE_LABELS).join(' / ');
 

hub/admin-web/src/routes/admin/org/[slug]/projects/+page.svelte

@@ -2,7 +2,6 @@
 	import { page } from '$app/state';
 	import { api, type ExplorerData, type ExplorerFolder, type ExplorerProject, type OrgMembership } from '$lib/api';
 	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import FolderTree from '$lib/components/FolderTree.svelte';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import LoadingState from '$lib/components/LoadingState.svelte';
@@ -14,8 +13,8 @@
 	import { fmtDate } from '$lib/format';
 	import { toastError, toastSuccess } from '$lib/toast';
 
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');
+	const org = $derived(($session.me?.organizations.find((o) => o.slug === slug) as OrgMembership | undefined) ?? null);
 	const isAdmin = $derived(!!org && (org.role === 'OWNER' || org.role === 'ADMIN'));
 
 	let data = $state<ExplorerData | null>(null);
@@ -88,7 +87,7 @@
 			projectName = '';
 			projectFolder = '';
 			showProjectModal = false;
-			window.location.href = `/admin/projects/${res.id}`;
+			window.location.href = `/admin/org/${slug}/projects/${res.id}`;
 		} catch (err) {
 			toastError(err instanceof Error ? err.message : String(err));
 		}
@@ -208,7 +207,7 @@
 				</thead>
 				<tbody>
 					{#each myProjects as p}
-						<tr class="cursor-pointer" onclick={() => (window.location.href = `/admin/projects/${p.id}`)}>
+						<tr class="cursor-pointer" onclick={() => (window.location.href = `/admin/org/${slug}/projects/${p.id}`)}>
 							<td class="font-medium">{p.name}</td>
 							<td class="font-mono text-xs">{p.binding ? `群 ${p.binding.chatId}` : '—'}</td>
 							<td class="text-surface-700">{fmtDate(p.createdAt)}</td>

hub/admin-web/src/routes/admin/org/[slug]/projects/[projectId]/+page.svelte

@@ -9,8 +9,6 @@
 		type ExplorerData,
 		type ProjectUsageReport,
 	} from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import {
 		fmtCost,
 		fmtDate,
@@ -29,8 +27,7 @@
 	import Icon from '$lib/components/Icon.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');
 	const projectId = $derived(page.params.projectId ?? '');
 	const roleItems = PERMISSION_ROLES.map((r) => ({ value: r, label: PERMISSION_ROLE_LABELS[r] }));
 	const roleChain = `${PERMISSION_ROLE_LABELS.READ} ⊂ ${PERMISSION_ROLE_LABELS.EDIT} ⊂ ${PERMISSION_ROLE_LABELS.MANAGE}`;
@@ -112,7 +109,7 @@
 		if (!confirm(`归档项目 ${proj?.name}?`)) return;
 		try {
 			await api.archiveProject(slug, projectId);
-			window.location.href = `/admin/projects`;
+			window.location.href = `/admin/org/${slug}/projects`;
 		} catch (err) {
 			toastError(err instanceof Error ? err.message : String(err));
 		}
@@ -173,7 +170,7 @@
 {:else if proj}
 	<div class="mb-2">
 		<a
-			href={`/admin/projects`}
+			href={`/admin/org/${slug}/projects`}
 			class="inline-flex items-center gap-1 text-sm text-surface-700 hover:text-primary-600"
 		>
 			<Icon name="arrow-left" class="h-4 w-4" />
@@ -296,7 +293,7 @@
 							{fmtTokens(projectUsage.inputTokens, projectUsage.outputTokens)}
 						</p>
 					</div>
-					<a class="text-sm text-primary-700 hover:underline" href={`/admin/usage`}>组织报告</a>
+					<a class="text-sm text-primary-700 hover:underline" href={`/admin/org/${slug}/usage`}>组织报告</a>
 				</div>
 				{#if projectUsage.breakdown.length === 0}
 					<div class="px-5 py-4 text-sm text-surface-600">尚无 UsageFact。</div>
@@ -371,7 +368,7 @@
 								<td class="text-right">
 									<a
 										class="text-sm text-primary-700 hover:underline"
-										href={`/admin/sessions/${s.id}`}
+										href={`/admin/org/${slug}/sessions/${s.id}`}
 									>
 										详情
 									</a>

hub/admin-web/src/routes/admin/org/[slug]/provider/+page.svelte

@@ -1,8 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type ProviderConnectionRow } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import { fmtDate, providerModeLabel } from '$lib/format';
 	import { Label } from 'bits-ui';
 	import PageHeader from '$lib/components/PageHeader.svelte';
@@ -10,8 +8,7 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');
 
 	let connections = $state<ProviderConnectionRow[]>([]);
 	let loading = $state(true);

hub/admin-web/src/routes/admin/org/[slug]/roles/+page.svelte

@@ -0,0 +1,129 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type AgentRoleRow, type AgentModelRow, type AgentSkillRow } from '$lib/api';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import RoleCard from '$lib/components/RoleCard.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	let roles = $state<AgentRoleRow[]>([]);
+	let models = $state<AgentModelRow[]>([]);
+	let skills = $state<AgentSkillRow[]>([]);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let newRoleId = $state('');
+	let newLabel = $state('');
+	let adding = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const [r, s] = await Promise.all([api.agentRoles(slug), api.agentSkills(slug)]);
+			roles = r.roles;
+			skills = s.skills;
+			// Model fetch hits the provider API and may fail or be slow; load it
+			// independently so roles remain editable even without a model list.
+			models = [];
+			api.agentModels(slug)
+				.then((m) => { models = m.models; })
+				.catch((err) => { toastError(`模型列表加载失败：${err instanceof Error ? err.message : String(err)}`); });
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function add() {
+		const roleId = newRoleId.trim();
+		const label = newLabel.trim();
+		if (roleId === '' || label === '') {
+			toastError('角色 ID 与显示名均为必填');
+			return;
+		}
+		if (roles.some((r) => r.roleId === roleId)) {
+			toastError(`角色 ID 已存在：${roleId}`);
+			return;
+		}
+		adding = true;
+		try {
+			const created = await api.upsertAgentRole(slug, roleId, { label });
+			roles = [...roles, created];
+			newRoleId = '';
+			newLabel = '';
+			toastSuccess('角色已创建');
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			adding = false;
+		}
+	}
+
+	function onRoleUpdated(updated: AgentRoleRow) {
+		roles = roles.map((x) => (x.roleId === updated.roleId ? { ...updated, skillNames: x.skillNames } : x));
+		if (updated.isDefault) {
+			roles = roles.map((x) => (x.roleId === updated.roleId ? x : { ...x, isDefault: false }));
+		}
+	}
+
+	function onRoleSkillsChanged(roleId: string, skillNames: string[]) {
+		roles = roles.map((x) => (x.roleId === roleId ? { ...x, skillNames } : x));
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader
+	title="角色"
+	description="角色是组织级数据：组合默认模型、系统提示词、工具白名单与已绑定技能。角色 ID 即飞书斜杠命令（如 /draft）。"
+/>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	<div class="saas-card-pad mb-6">
+		<h2 class="saas-section-title mb-4">新建角色</h2>
+		<div class="grid gap-3 sm:grid-cols-[10rem_1fr_auto]">
+			<input
+				class="saas-input font-mono text-sm"
+				placeholder="角色 ID（如 draft）"
+				bind:value={newRoleId}
+				onkeydown={(e) => {
+					if (e.key === 'Enter') add();
+				}}
+			/>
+			<input
+				class="saas-input"
+				placeholder="显示名（如 草稿）"
+				bind:value={newLabel}
+				onkeydown={(e) => {
+					if (e.key === 'Enter') add();
+				}}
+			/>
+			<button class="saas-btn-primary" onclick={add} disabled={adding}>新建</button>
+		</div>
+		<p class="mt-2 text-xs text-surface-600">角色 ID 仅允许小写字母、数字、下划线与连字符，且以字母或数字开头。</p>
+	</div>
+
+	{#if roles.length === 0}
+		<div class="saas-card">
+			<EmptyState title="暂无角色" description="组织必须且只能有一个启用中的默认角色；新建第一个角色将自动成为默认。" />
+		</div>
+	{:else}
+		<div class="space-y-4">
+			{#each roles as r (r.roleId)}
+				<RoleCard {r} {models} {skills} {slug} onupdated={onRoleUpdated} onskillschanged={onRoleSkillsChanged} />
+			{/each}
+		</div>
+	{/if}
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/sessions/[sessionId]/+page.svelte

@@ -1,8 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type SessionDetail, type SessionRunRow, type UsageFactRow } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import {
 		fmtCost,
 		fmtDate,
@@ -18,8 +16,7 @@
 	import EmptyState from '$lib/components/EmptyState.svelte';
 	import Icon from '$lib/components/Icon.svelte';
 
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');
 	const sessionId = $derived(page.params.sessionId ?? '');
 
 	let detail = $state<SessionDetail | null>(null);
@@ -95,7 +92,7 @@
 	<div class="mb-2">
 		<a
 			class="inline-flex items-center gap-1 text-sm text-surface-700 hover:text-primary-700"
-			href={`/admin/projects/${detail.project.id}`}
+			href={`/admin/org/${slug}/projects/${detail.project.id}`}
 		>
 			<Icon name="arrow-left" class="h-4 w-4" />
 			返回项目 {detail.project.name}
@@ -116,7 +113,7 @@
 			<div>
 				<dt class="text-surface-600">项目</dt>
 				<dd class="mt-0.5">
-					<a class="text-primary-700 hover:underline" href={`/admin/projects/${detail.project.id}`}>
+					<a class="text-primary-700 hover:underline" href={`/admin/org/${slug}/projects/${detail.project.id}`}>
 						{detail.project.name}
 					</a>
 				</dd>

hub/admin-web/src/routes/admin/org/[slug]/skills/+page.svelte

@@ -0,0 +1,141 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { api, type AgentSkillRow, type SkillFileEntry } from '$lib/api';
+	import PageHeader from '$lib/components/PageHeader.svelte';
+	import LoadingState from '$lib/components/LoadingState.svelte';
+	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
+	import EmptyState from '$lib/components/EmptyState.svelte';
+	import SkillEditor from '$lib/components/SkillEditor.svelte';
+	import { toastError, toastSuccess } from '$lib/toast';
+
+	const slug = $derived(page.params.slug ?? '');
+
+	let skills = $state<AgentSkillRow[]>([]);
+	let loading = $state(true);
+	let error = $state<string | null>(null);
+
+	let showNewSkill = $state(false);
+	let newSkillName = $state('');
+	let newSkillVersion = $state('0.1.0');
+	let newSkillDescription = $state('');
+	let creating = $state(false);
+
+	async function load() {
+		loading = true;
+		error = null;
+		try {
+			const res = await api.agentSkills(slug);
+			skills = res.skills;
+		} catch (err) {
+			error = err instanceof Error ? err.message : String(err);
+		} finally {
+			loading = false;
+		}
+	}
+
+	async function createSkill() {
+		const name = newSkillName.trim();
+		if (name === '') {
+			toastError('技能名称不能为空');
+			return;
+		}
+		if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(name)) {
+			toastError('技能名称仅允许小写字母、数字和连字符，且以字母或数字开头');
+			return;
+		}
+		const version = newSkillVersion.trim();
+		if (version === '') {
+			toastError('版本号不能为空');
+			return;
+		}
+		creating = true;
+		try {
+			const manifest = buildManifest(name, newSkillDescription.trim());
+			const files: SkillFileEntry[] = [{ path: 'SKILL.md', content: manifest }];
+			const result = await api.installAgentSkill(slug, name, { version, files });
+			toastSuccess(`技能 ${result.name} 已创建`);
+			newSkillName = '';
+			newSkillDescription = '';
+			showNewSkill = false;
+			await load();
+		} catch (err) {
+			toastError(err instanceof Error ? err.message : String(err));
+		} finally {
+			creating = false;
+		}
+	}
+
+	function buildManifest(name: string, description: string): string {
+		const desc = description === '' ? name : description;
+		return `---\nname: ${name}\ndescription: ${desc}\n---\n# ${name}\n\n`;
+	}
+
+	function onInstalled(_result: { id: string; name: string; contentDigest: string }) {
+		load();
+	}
+
+	function onDisabled(_name: string) {
+		load();
+	}
+
+	$effect(() => {
+		if (slug) load();
+	});
+</script>
+
+<PageHeader
+	title="技能"
+	description="技能是组织级 Agent 能力包：一个包含 SKILL.md manifest 的目录。技能内容按 SHA-256 content-addressed 存储，变更后绑定角色的活跃会话自动归档。"
+/>
+
+{#if loading}
+	<LoadingState />
+{:else if error}
+	<ErrorBanner message={error} onretry={load} />
+{:else}
+	<div class="saas-card-pad mb-6">
+		<div class="flex items-center justify-between">
+			<h2 class="saas-section-title">新建技能</h2>
+			<button class="text-sm text-primary-700 hover:text-primary-900" onclick={() => (showNewSkill = !showNewSkill)}>
+				{showNewSkill ? '取消' : '+ 新建'}
+			</button>
+		</div>
+		{#if showNewSkill}
+			<div class="mt-4 grid gap-3 sm:grid-cols-[12rem_8rem_1fr_auto]">
+				<input
+					class="saas-input font-mono text-sm"
+					placeholder="技能名（如 typst-help）"
+					bind:value={newSkillName}
+				/>
+				<input
+					class="saas-input text-sm"
+					placeholder="版本号"
+					bind:value={newSkillVersion}
+				/>
+				<input
+					class="saas-input text-sm"
+					placeholder="描述"
+					bind:value={newSkillDescription}
+				/>
+				<button class="saas-btn-primary" onclick={createSkill} disabled={creating}>
+					{creating ? '创建中…' : '创建'}
+				</button>
+			</div>
+			<p class="mt-2 text-xs text-surface-600">
+				技能名称仅允许小写字母、数字和连字符，且以字母或数字开头。创建后会生成 SKILL.md 模板。
+			</p>
+		{/if}
+	</div>
+
+	{#if skills.length === 0}
+		<div class="saas-card">
+			<EmptyState title="暂无技能" description="新建一个技能，然后在角色管理中绑定到角色。" />
+		</div>
+	{:else}
+		<div class="space-y-4">
+			{#each skills as skill (skill.id)}
+				<SkillEditor {slug} {skill} oninstalled={onInstalled} ondisabled={onDisabled} />
+			{/each}
+		</div>
+	{/if}
+{/if}

hub/admin-web/src/routes/admin/org/[slug]/teams/+page.svelte

@@ -2,8 +2,6 @@
 	import { Collapsible } from 'bits-ui';
 	import { page } from '$app/state';
 	import { api, type TeamRow, type TeamMemberRow } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import { fmtDate } from '$lib/format';
 	import PageHeader from '$lib/components/PageHeader.svelte';
 	import LoadingState from '$lib/components/LoadingState.svelte';
@@ -11,8 +9,7 @@
 	import EmptyState from '$lib/components/EmptyState.svelte';
 	import { toastError, toastSuccess } from '$lib/toast';
 
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');
 
 	let teams = $state<TeamRow[]>([]);
 	let loading = $state(true);

hub/admin-web/src/routes/admin/org/[slug]/usage/+page.svelte

@@ -1,8 +1,6 @@
 <script lang="ts">
 	import { page } from '$app/state';
 	import { api, type UsageReport, type UsageBreakdownRow } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
 	import {
 		fmtCost,
 		fmtDateOnly,
@@ -17,8 +15,7 @@
 	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
 	import EmptyState from '$lib/components/EmptyState.svelte';
 
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
+	const slug = $derived(page.params.slug ?? '');
 
 	let usage = $state<UsageReport | null>(null);
 	let loading = $state(true);
@@ -227,7 +224,7 @@
 								<td class="tabular-nums text-surface-600">{fmtTokens(p.inputTokens, p.outputTokens)}</td>
 								<td class="tabular-nums">{fmtCost(p.costUsd)}</td>
 								<td class="text-right">
-									<a class="text-sm text-primary-700 hover:underline" href={`/admin/projects/${p.projectId}`}>
+									<a class="text-sm text-primary-700 hover:underline" href={`/admin/org/${slug}/projects/${p.projectId}`}>
 										查看项目
 									</a>
 								</td>

hub/admin-web/src/routes/admin/roles/+page.svelte

@@ -1,327 +0,0 @@
-<script lang="ts">
-	import { page } from '$app/state';
-	import { api, type AgentConfigFolderRow, type AgentModelRow, type AgentRoleRow, type AgentSkillRow } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
-	import PageHeader from '$lib/components/PageHeader.svelte';
-	import LoadingState from '$lib/components/LoadingState.svelte';
-	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
-	import EmptyState from '$lib/components/EmptyState.svelte';
-	import RoleCard from '$lib/components/RoleCard.svelte';
-	import AgentConfigFolderNav from '$lib/components/AgentConfigFolderNav.svelte';
-	import Modal from '$lib/components/Modal.svelte';
-	import SelectField from '$lib/components/SelectField.svelte';
-	import { toastError, toastSuccess } from '$lib/toast';
-
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
-
-	let roles = $state<AgentRoleRow[]>([]);
-	let models = $state<AgentModelRow[]>([]);
-	let skills = $state<AgentSkillRow[]>([]);
-	let folders = $state<AgentConfigFolderRow[]>([]);
-	let loading = $state(true);
-	let error = $state<string | null>(null);
-
-	/** 'all' | 'unfiled' | folder id (ADR-0028: transparent grouping filter) */
-	let selectedFolder = $state<string>('all');
-
-	let newRoleId = $state('');
-	let newLabel = $state('');
-	let adding = $state(false);
-
-	let showFolderModal = $state(false);
-	let folderModalMode = $state<'create' | 'rename'>('create');
-	let folderModalId = $state<string | null>(null);
-	let folderName = $state('');
-	let folderParent = $state('');
-	let savingFolder = $state(false);
-
-	async function load() {
-		loading = true;
-		error = null;
-		try {
-			const [r, s, f] = await Promise.all([api.agentRoles(slug), api.agentSkills(slug), api.agentConfigFolders(slug)]);
-			roles = r.roles;
-			skills = s.skills;
-			folders = f.folders;
-			// Model fetch hits the provider API and may fail or be slow; load it
-			// independently so roles remain editable even without a model list.
-			models = [];
-			api.agentModels(slug)
-				.then((m) => { models = m.models; })
-				.catch((err) => { toastError(`模型列表加载失败：${err instanceof Error ? err.message : String(err)}`); });
-		} catch (err) {
-			error = err instanceof Error ? err.message : String(err);
-		} finally {
-			loading = false;
-		}
-	}
-
-	const counts = $derived.by(() => {
-		const map: Record<string, number> = {};
-		for (const r of roles) {
-			if (r.folderId) map[r.folderId] = (map[r.folderId] ?? 0) + 1;
-		}
-		return map;
-	});
-	const unfiledCount = $derived(roles.filter((r) => !r.folderId).length);
-	const visibleRoles = $derived(
-		selectedFolder === 'all'
-			? roles
-			: selectedFolder === 'unfiled'
-				? roles.filter((r) => !r.folderId)
-				: roles.filter((r) => r.folderId === selectedFolder),
-	);
-
-	function folderPath(f: AgentConfigFolderRow): string {
-		const parts: string[] = [f.name];
-		let cur: AgentConfigFolderRow | undefined = f;
-		while (cur?.parentId) {
-			const parent = folders.find((x) => x.id === cur!.parentId);
-			if (!parent) break;
-			parts.unshift(parent.name);
-			cur = parent;
-		}
-		return parts.join(' / ');
-	}
-
-	/** Self + descendant ids of a folder — excluded as move targets in the rename modal. */
-	function subtreeIds(folderId: string): Set<string> {
-		const ids = new Set<string>([folderId]);
-		let grew = true;
-		while (grew) {
-			grew = false;
-			for (const f of folders) {
-				if (f.parentId && ids.has(f.parentId) && !ids.has(f.id)) {
-					ids.add(f.id);
-					grew = true;
-				}
-			}
-		}
-		return ids;
-	}
-
-	const folderItems = $derived([
-		{ value: '', label: '（未分类）' },
-		...folders.map((f) => ({ value: f.id, label: folderPath(f) })),
-	]);
-
-	const moveTargetItems = $derived.by(() => {
-		if (folderModalMode !== 'rename' || folderModalId === null) {
-			return [{ value: '', label: '（根）' }, ...folders.map((f) => ({ value: f.id, label: folderPath(f) }))];
-		}
-		const excluded = subtreeIds(folderModalId);
-		return [
-			{ value: '', label: '（根）' },
-			...folders.filter((f) => !excluded.has(f.id)).map((f) => ({ value: f.id, label: folderPath(f) })),
-		];
-	});
-
-	async function add() {
-		const roleId = newRoleId.trim();
-		const label = newLabel.trim();
-		if (roleId === '' || label === '') {
-			toastError('角色 ID 与显示名均为必填');
-			return;
-		}
-		if (roles.some((r) => r.roleId === roleId)) {
-			toastError(`角色 ID 已存在：${roleId}`);
-			return;
-		}
-		adding = true;
-		try {
-			const created = await api.upsertAgentRole(slug, roleId, { label });
-			let folderId: string | null = null;
-			if (selectedFolder !== 'all' && selectedFolder !== 'unfiled') {
-				await api.setAgentRoleFolder(slug, roleId, selectedFolder);
-				folderId = selectedFolder;
-			}
-			roles = [...roles, { ...created, folderId }];
-			newRoleId = '';
-			newLabel = '';
-			toastSuccess('角色已创建');
-		} catch (err) {
-			toastError(err instanceof Error ? err.message : String(err));
-		} finally {
-			adding = false;
-		}
-	}
-
-	function onRoleUpdated(updated: AgentRoleRow) {
-		roles = roles.map((x) => (x.roleId === updated.roleId ? { ...updated, skillNames: x.skillNames } : x));
-		if (updated.isDefault) {
-			roles = roles.map((x) => (x.roleId === updated.roleId ? x : { ...x, isDefault: false }));
-		}
-	}
-
-	function onRoleSkillsChanged(roleId: string, skillNames: string[]) {
-		roles = roles.map((x) => (x.roleId === roleId ? { ...x, skillNames } : x));
-	}
-
-	function onRoleFolderChanged(roleId: string, folderId: string | null) {
-		roles = roles.map((x) => (x.roleId === roleId ? { ...x, folderId } : x));
-	}
-
-	function openCreateFolder(parentId: string | null) {
-		folderModalMode = 'create';
-		folderModalId = null;
-		folderName = '';
-		folderParent = parentId ?? '';
-		showFolderModal = true;
-	}
-
-	function openRenameFolder(folder: AgentConfigFolderRow) {
-		folderModalMode = 'rename';
-		folderModalId = folder.id;
-		folderName = folder.name;
-		folderParent = folder.parentId ?? '';
-		showFolderModal = true;
-	}
-
-	async function submitFolderModal() {
-		const name = folderName.trim();
-		if (name === '') {
-			toastError('文件夹名称不能为空');
-			return;
-		}
-		savingFolder = true;
-		try {
-			if (folderModalMode === 'create') {
-				await api.createAgentConfigFolder(slug, {
-					name,
-					...(folderParent !== '' ? { parentId: folderParent } : {}),
-				});
-				toastSuccess('文件夹已创建');
-			} else if (folderModalId !== null) {
-				await api.patchAgentConfigFolder(slug, folderModalId, {
-					name,
-					parentId: folderParent === '' ? null : folderParent,
-				});
-				toastSuccess('文件夹已更新');
-			}
-			showFolderModal = false;
-			await load();
-		} catch (err) {
-			toastError(err instanceof Error ? err.message : String(err));
-		} finally {
-			savingFolder = false;
-		}
-	}
-
-	async function deleteFolder(folder: AgentConfigFolderRow) {
-		if (!confirm(`删除文件夹「${folder.name}」? 仅空文件夹可删除。`)) return;
-		try {
-			await api.deleteAgentConfigFolder(slug, folder.id);
-			if (selectedFolder === folder.id) selectedFolder = 'all';
-			toastSuccess('文件夹已删除');
-			await load();
-		} catch (err) {
-			toastError(err instanceof Error ? err.message : String(err));
-		}
-	}
-
-	$effect(() => {
-		if (slug) load();
-	});
-</script>
-
-<PageHeader
-	title="角色"
-	description="角色是组织级数据：组合默认模型、系统提示词、工具白名单与已绑定技能。文件夹仅作管理分组，不影响角色解析与默认角色约束。"
-/>
-
-{#if loading}
-	<LoadingState />
-{:else if error}
-	<ErrorBanner message={error} onretry={load} />
-{:else}
-	<div class="grid gap-4 lg:grid-cols-[15rem_1fr]">
-		<div class="h-fit lg:sticky lg:top-4">
-			<AgentConfigFolderNav
-				{folders}
-				selected={selectedFolder}
-				{counts}
-				totalCount={roles.length}
-				{unfiledCount}
-				onselect={(id) => (selectedFolder = id)}
-				oncreate={openCreateFolder}
-				onrename={openRenameFolder}
-				ondelete={deleteFolder}
-			/>
-		</div>
-
-		<div>
-			<div class="saas-card-pad mb-6">
-				<h2 class="saas-section-title mb-4">新建角色</h2>
-				<div class="grid gap-3 sm:grid-cols-[10rem_1fr_auto]">
-					<input
-						class="saas-input font-mono text-sm"
-						placeholder="角色 ID（如 draft）"
-						bind:value={newRoleId}
-						onkeydown={(e) => {
-							if (e.key === 'Enter') add();
-						}}
-					/>
-					<input
-						class="saas-input"
-						placeholder="显示名（如 草稿）"
-						bind:value={newLabel}
-						onkeydown={(e) => {
-							if (e.key === 'Enter') add();
-						}}
-					/>
-					<button class="saas-btn-primary" onclick={add} disabled={adding}>新建</button>
-				</div>
-				<p class="mt-2 text-xs text-surface-600">角色 ID 仅允许小写字母、数字、下划线与连字符，且以字母或数字开头；当前选中文件夹时新角色会自动归入其中。</p>
-			</div>
-
-			{#if roles.length === 0}
-				<div class="saas-card">
-					<EmptyState title="暂无角色" description="组织必须且只能有一个启用中的默认角色；新建第一个角色将自动成为默认。" />
-				</div>
-			{:else if visibleRoles.length === 0}
-				<div class="saas-card">
-					<EmptyState title="此分类下暂无角色" description="在角色卡片上可将其移入当前文件夹。" />
-				</div>
-			{:else}
-				<div class="space-y-4">
-					{#each visibleRoles as r (r.roleId)}
-						<RoleCard
-							{r}
-							{models}
-							{skills}
-							{slug}
-							{folderItems}
-							onupdated={onRoleUpdated}
-							onskillschanged={onRoleSkillsChanged}
-							onfolderchanged={onRoleFolderChanged}
-						/>
-					{/each}
-				</div>
-			{/if}
-		</div>
-	</div>
-
-	<Modal bind:open={showFolderModal} title={folderModalMode === 'create' ? '新建文件夹' : '重命名 / 移动文件夹'}>
-		<label class="saas-label" for="agent-folder-name">名称</label>
-		<input
-			id="agent-folder-name"
-			class="saas-input mb-4"
-			bind:value={folderName}
-			onkeydown={(e) => {
-				if (e.key === 'Enter') submitFolderModal();
-			}}
-		/>
-		<p class="saas-label">父文件夹</p>
-		<div class="mb-4">
-			<SelectField items={moveTargetItems} bind:value={folderParent} />
-		</div>
-		<div class="flex justify-end gap-2">
-			<button class="saas-btn-ghost" onclick={() => (showFolderModal = false)}>取消</button>
-			<button class="saas-btn-primary" onclick={submitFolderModal} disabled={savingFolder}>
-				{savingFolder ? '保存中…' : '保存'}
-			</button>
-		</div>
-	</Modal>
-{/if}

hub/admin-web/src/routes/admin/skills/+page.svelte

@@ -1,335 +0,0 @@
-<script lang="ts">
-	import { page } from '$app/state';
-	import { api, type AgentConfigFolderRow, type AgentSkillRow, type SkillFileEntry } from '$lib/api';
-	import { session } from '$lib/session';
-	import { resolveOrg } from '$lib/org';
-	import PageHeader from '$lib/components/PageHeader.svelte';
-	import LoadingState from '$lib/components/LoadingState.svelte';
-	import ErrorBanner from '$lib/components/ErrorBanner.svelte';
-	import EmptyState from '$lib/components/EmptyState.svelte';
-	import SkillEditor from '$lib/components/SkillEditor.svelte';
-	import AgentConfigFolderNav from '$lib/components/AgentConfigFolderNav.svelte';
-	import Modal from '$lib/components/Modal.svelte';
-	import SelectField from '$lib/components/SelectField.svelte';
-	import { toastError, toastSuccess } from '$lib/toast';
-
-	const org = $derived(resolveOrg($session.me, page.url.search));
-	const slug = $derived(org?.slug ?? '');
-
-	let skills = $state<AgentSkillRow[]>([]);
-	let folders = $state<AgentConfigFolderRow[]>([]);
-	let loading = $state(true);
-	let error = $state<string | null>(null);
-
-	/** 'all' | 'unfiled' | folder id (ADR-0028: transparent grouping filter) */
-	let selectedFolder = $state<string>('all');
-
-	let showNewSkill = $state(false);
-	let newSkillName = $state('');
-	let newSkillVersion = $state('0.1.0');
-	let newSkillDescription = $state('');
-	let creating = $state(false);
-
-	let showFolderModal = $state(false);
-	let folderModalMode = $state<'create' | 'rename'>('create');
-	let folderModalId = $state<string | null>(null);
-	let folderName = $state('');
-	let folderParent = $state('');
-	let savingFolder = $state(false);
-
-	async function load() {
-		loading = true;
-		error = null;
-		try {
-			const [s, f] = await Promise.all([api.agentSkills(slug), api.agentConfigFolders(slug)]);
-			skills = s.skills;
-			folders = f.folders;
-		} catch (err) {
-			error = err instanceof Error ? err.message : String(err);
-		} finally {
-			loading = false;
-		}
-	}
-
-	const counts = $derived.by(() => {
-		const map: Record<string, number> = {};
-		for (const s of skills) {
-			if (s.folderId) map[s.folderId] = (map[s.folderId] ?? 0) + 1;
-		}
-		return map;
-	});
-	const unfiledCount = $derived(skills.filter((s) => !s.folderId).length);
-	const visibleSkills = $derived(
-		selectedFolder === 'all'
-			? skills
-			: selectedFolder === 'unfiled'
-				? skills.filter((s) => !s.folderId)
-				: skills.filter((s) => s.folderId === selectedFolder),
-	);
-
-	function folderPath(f: AgentConfigFolderRow): string {
-		const parts: string[] = [f.name];
-		let cur: AgentConfigFolderRow | undefined = f;
-		while (cur?.parentId) {
-			const parent = folders.find((x) => x.id === cur!.parentId);
-			if (!parent) break;
-			parts.unshift(parent.name);
-			cur = parent;
-		}
-		return parts.join(' / ');
-	}
-
-	/** Self + descendant ids of a folder — excluded as move targets in the rename modal. */
-	function subtreeIds(folderId: string): Set<string> {
-		const ids = new Set<string>([folderId]);
-		let grew = true;
-		while (grew) {
-			grew = false;
-			for (const f of folders) {
-				if (f.parentId && ids.has(f.parentId) && !ids.has(f.id)) {
-					ids.add(f.id);
-					grew = true;
-				}
-			}
-		}
-		return ids;
-	}
-
-	const folderItems = $derived([
-		{ value: '', label: '（未分类）' },
-		...folders.map((f) => ({ value: f.id, label: folderPath(f) })),
-	]);
-
-	const moveTargetItems = $derived.by(() => {
-		if (folderModalMode !== 'rename' || folderModalId === null) {
-			return [{ value: '', label: '（根）' }, ...folders.map((f) => ({ value: f.id, label: folderPath(f) }))];
-		}
-		const excluded = subtreeIds(folderModalId);
-		return [
-			{ value: '', label: '（根）' },
-			...folders.filter((f) => !excluded.has(f.id)).map((f) => ({ value: f.id, label: folderPath(f) })),
-		];
-	});
-
-	async function createSkill() {
-		const name = newSkillName.trim();
-		if (name === '') {
-			toastError('技能名称不能为空');
-			return;
-		}
-		if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(name)) {
-			toastError('技能名称仅允许小写字母、数字和连字符，且以字母或数字开头');
-			return;
-		}
-		const version = newSkillVersion.trim();
-		if (version === '') {
-			toastError('版本号不能为空');
-			return;
-		}
-		creating = true;
-		try {
-			const manifest = buildManifest(name, newSkillDescription.trim());
-			const files: SkillFileEntry[] = [{ path: 'SKILL.md', content: manifest }];
-			const result = await api.installAgentSkill(slug, name, { version, files });
-			if (selectedFolder !== 'all' && selectedFolder !== 'unfiled') {
-				await api.setAgentSkillFolder(slug, result.name, selectedFolder);
-			}
-			toastSuccess(`技能 ${result.name} 已创建`);
-			newSkillName = '';
-			newSkillDescription = '';
-			showNewSkill = false;
-			await load();
-		} catch (err) {
-			toastError(err instanceof Error ? err.message : String(err));
-		} finally {
-			creating = false;
-		}
-	}
-
-	function buildManifest(name: string, description: string): string {
-		const desc = description === '' ? name : description;
-		return `---\nname: ${name}\ndescription: ${desc}\n---\n# ${name}\n\n`;
-	}
-
-	function onInstalled(_result: { id: string; name: string; contentDigest: string }) {
-		load();
-	}
-
-	function onDisabled(_name: string) {
-		load();
-	}
-
-	function onSkillFolderChanged(name: string, folderId: string | null) {
-		skills = skills.map((s) => (s.name === name ? { ...s, folderId } : s));
-	}
-
-	function openCreateFolder(parentId: string | null) {
-		folderModalMode = 'create';
-		folderModalId = null;
-		folderName = '';
-		folderParent = parentId ?? '';
-		showFolderModal = true;
-	}
-
-	function openRenameFolder(folder: AgentConfigFolderRow) {
-		folderModalMode = 'rename';
-		folderModalId = folder.id;
-		folderName = folder.name;
-		folderParent = folder.parentId ?? '';
-		showFolderModal = true;
-	}
-
-	async function submitFolderModal() {
-		const name = folderName.trim();
-		if (name === '') {
-			toastError('文件夹名称不能为空');
-			return;
-		}
-		savingFolder = true;
-		try {
-			if (folderModalMode === 'create') {
-				await api.createAgentConfigFolder(slug, {
-					name,
-					...(folderParent !== '' ? { parentId: folderParent } : {}),
-				});
-				toastSuccess('文件夹已创建');
-			} else if (folderModalId !== null) {
-				await api.patchAgentConfigFolder(slug, folderModalId, {
-					name,
-					parentId: folderParent === '' ? null : folderParent,
-				});
-				toastSuccess('文件夹已更新');
-			}
-			showFolderModal = false;
-			await load();
-		} catch (err) {
-			toastError(err instanceof Error ? err.message : String(err));
-		} finally {
-			savingFolder = false;
-		}
-	}
-
-	async function deleteFolder(folder: AgentConfigFolderRow) {
-		if (!confirm(`删除文件夹「${folder.name}」? 仅空文件夹可删除。`)) return;
-		try {
-			await api.deleteAgentConfigFolder(slug, folder.id);
-			if (selectedFolder === folder.id) selectedFolder = 'all';
-			toastSuccess('文件夹已删除');
-			await load();
-		} catch (err) {
-			toastError(err instanceof Error ? err.message : String(err));
-		}
-	}
-
-	$effect(() => {
-		if (slug) load();
-	});
-</script>
-
-<PageHeader
-	title="技能"
-	description="技能是组织级 Agent 能力包：一个包含 SKILL.md manifest 的目录。文件夹仅作管理分组，不影响技能解析与绑定。"
-/>
-
-{#if loading}
-	<LoadingState />
-{:else if error}
-	<ErrorBanner message={error} onretry={load} />
-{:else}
-	<div class="grid gap-4 lg:grid-cols-[15rem_1fr]">
-		<div class="h-fit lg:sticky lg:top-4">
-			<AgentConfigFolderNav
-				{folders}
-				selected={selectedFolder}
-				{counts}
-				totalCount={skills.length}
-				{unfiledCount}
-				onselect={(id) => (selectedFolder = id)}
-				oncreate={openCreateFolder}
-				onrename={openRenameFolder}
-				ondelete={deleteFolder}
-			/>
-		</div>
-
-		<div>
-			<div class="saas-card-pad mb-6">
-				<div class="flex items-center justify-between">
-					<h2 class="saas-section-title">新建技能</h2>
-					<button class="text-sm text-primary-700 hover:text-primary-900" onclick={() => (showNewSkill = !showNewSkill)}>
-						{showNewSkill ? '取消' : '+ 新建'}
-					</button>
-				</div>
-				{#if showNewSkill}
-					<div class="mt-4 grid gap-3 sm:grid-cols-[12rem_8rem_1fr_auto]">
-						<input
-							class="saas-input font-mono text-sm"
-							placeholder="技能名（如 typst-help）"
-							bind:value={newSkillName}
-						/>
-						<input
-							class="saas-input text-sm"
-							placeholder="版本号"
-							bind:value={newSkillVersion}
-						/>
-						<input
-							class="saas-input text-sm"
-							placeholder="描述"
-							bind:value={newSkillDescription}
-						/>
-						<button class="saas-btn-primary" onclick={createSkill} disabled={creating}>
-							{creating ? '创建中…' : '创建'}
-						</button>
-					</div>
-					<p class="mt-2 text-xs text-surface-600">
-						技能名称仅允许小写字母、数字和连字符，且以字母或数字开头。创建后会生成 SKILL.md 模板；当前选中文件夹时新技能会自动归入其中。
-					</p>
-				{/if}
-			</div>
-
-			{#if skills.length === 0}
-				<div class="saas-card">
-					<EmptyState title="暂无技能" description="新建一个技能，然后在角色管理中绑定到角色。" />
-				</div>
-			{:else if visibleSkills.length === 0}
-				<div class="saas-card">
-					<EmptyState title="此分类下暂无技能" description="在技能卡片上可将其移入当前文件夹。" />
-				</div>
-			{:else}
-				<div class="space-y-4">
-					{#each visibleSkills as skill (skill.id)}
-						<SkillEditor
-							{slug}
-							{skill}
-							{folderItems}
-							oninstalled={onInstalled}
-							ondisabled={onDisabled}
-							onfolderchanged={onSkillFolderChanged}
-						/>
-					{/each}
-				</div>
-			{/if}
-		</div>
-	</div>
-
-	<Modal bind:open={showFolderModal} title={folderModalMode === 'create' ? '新建文件夹' : '重命名 / 移动文件夹'}>
-		<label class="saas-label" for="agent-folder-name">名称</label>
-		<input
-			id="agent-folder-name"
-			class="saas-input mb-4"
-			bind:value={folderName}
-			onkeydown={(e) => {
-				if (e.key === 'Enter') submitFolderModal();
-			}}
-		/>
-		<p class="saas-label">父文件夹</p>
-		<div class="mb-4">
-			<SelectField items={moveTargetItems} bind:value={folderParent} />
-		</div>
-		<div class="flex justify-end gap-2">
-			<button class="saas-btn-ghost" onclick={() => (showFolderModal = false)}>取消</button>
-			<button class="saas-btn-primary" onclick={submitFolderModal} disabled={savingFolder}>
-				{savingFolder ? '保存中…' : '保存'}
-			</button>
-		</div>
-	</Modal>
-{/if}

hub/admin-web/src/routes/app.css

@@ -406,8 +406,7 @@
 		resize: vertical;
 	}
 
-	.saas-select-trigger,
-	.saas-combobox-input {
+	.saas-select-trigger {
 		display: inline-flex;
 		width: 100%;
 		align-items: center;
@@ -426,25 +425,14 @@
 		text-align: left;
 	}
 
-	.saas-combobox-input {
-		cursor: text;
-		padding-right: 2.25rem;
-	}
-
-	.saas-combobox-input::placeholder {
-		color: var(--color-surface-500);
-	}
-
 	.saas-select-trigger:focus-visible,
-	.saas-select-trigger[data-state='open'],
-	.saas-combobox-input:focus {
+	.saas-select-trigger[data-state='open'] {
 		border-color: var(--color-primary-600);
 		box-shadow: inset 0 0 0 1px var(--color-primary-600);
 	}
 
 	.saas-select-trigger:disabled,
-	.saas-select-trigger[data-disabled],
-	.saas-combobox-input:disabled {
+	.saas-select-trigger[data-disabled] {
 		cursor: not-allowed;
 		opacity: 0.55;
 	}
@@ -455,15 +443,9 @@
 
 	.saas-select-content {
 		z-index: 70;
-		max-height: min(
-			18rem,
-			var(
-				--bits-combobox-content-available-height,
-				var(--bits-select-content-available-height, 18rem)
-			)
-		);
-		width: var(--bits-combobox-anchor-width, var(--bits-select-anchor-width));
-		min-width: var(--bits-combobox-anchor-width, var(--bits-select-anchor-width));
+		max-height: min(18rem, var(--bits-select-content-available-height, 18rem));
+		width: var(--bits-select-anchor-width);
+		min-width: var(--bits-select-anchor-width);
 		overflow: hidden;
 		border-radius: 0;
 		border: 1px solid var(--color-surface-400);

hub/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.35",
+  "version": "0.0.34",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@paradigm/hub",
-      "version": "0.0.35",
+      "version": "0.0.34",
       "dependencies": {
         "@alicloud/credentials": "^2.4.5",
         "@alicloud/docmind-api20220711": "^1.4.15",
@@ -401,6 +401,7 @@
       "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.7.tgz",
       "integrity": "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=6.9.0"
       }
@@ -423,6 +424,31 @@
         "xml2js": "^0.6.2"
       }
     },
+    "node_modules/@emnapi/core": {
+      "version": "1.11.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.11.2.tgz",
+      "integrity": "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.2",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@emnapi/runtime": {
+      "version": "1.11.2",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.11.2.tgz",
+      "integrity": "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "peer": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
     "node_modules/@emnapi/wasi-threads": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.2.tgz",
@@ -1012,6 +1038,7 @@
       "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.14.tgz",
       "integrity": "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18.14.1"
       },
@@ -1550,7 +1577,8 @@
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@stablelib/base64/-/base64-1.0.1.tgz",
       "integrity": "sha512-1bnPQqSxSuc3Ii6MhBysoWCg58j97aUjuCSZrGSmDxNqtytIi0k8utUenAwTZN4V5mXXYGsVUI9zeBqy+jBOSQ==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/@standard-schema/spec": {
       "version": "1.1.0",
@@ -1751,6 +1779,7 @@
       "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
       "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "mime-types": "^3.0.0",
         "negotiator": "^1.0.0"
@@ -1764,6 +1793,7 @@
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
       "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -1773,6 +1803,7 @@
       "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
       "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "mime-db": "^1.54.0"
       },
@@ -1908,6 +1939,7 @@
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
       "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "bytes": "^3.1.2",
         "content-type": "^2.0.0",
@@ -1932,6 +1964,7 @@
       "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
       "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -1945,6 +1978,7 @@
       "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
       "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -2090,6 +2124,7 @@
       "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz",
       "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -2103,6 +2138,7 @@
       "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
       "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2132,6 +2168,7 @@
       "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
       "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=6.6.0"
       }
@@ -2141,6 +2178,7 @@
       "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
       "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "object-assign": "^4",
         "vary": "^1"
@@ -2158,6 +2196,7 @@
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
       "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "path-key": "^3.1.0",
         "shebang-command": "^2.0.0",
@@ -2215,6 +2254,7 @@
       "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
       "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -2275,7 +2315,8 @@
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
       "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/effect": {
       "version": "3.21.0",
@@ -2303,6 +2344,7 @@
       "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
       "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -2405,7 +2447,8 @@
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
       "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/estree-walker": {
       "version": "3.0.3",
@@ -2422,6 +2465,7 @@
       "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
       "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2431,6 +2475,7 @@
       "resolved": "https://registry.npmjs.org/eventsource/-/eventsource-3.0.7.tgz",
       "integrity": "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "eventsource-parser": "^3.0.1"
       },
@@ -2462,6 +2507,7 @@
       "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
       "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "accepts": "^2.0.0",
         "body-parser": "^2.2.1",
@@ -2505,6 +2551,7 @@
       "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.5.2.tgz",
       "integrity": "sha512-5Kb34ipNX694DH48vN9irak1Qx30nb0PLYHXfJgw4YEjiC3ZEmZJhwOp+VfiCYwFzvFTdB9QkArYS5kXa2cx2A==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "ip-address": "^10.2.0"
       },
@@ -2523,6 +2570,7 @@
       "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
       "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2532,6 +2580,7 @@
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
       "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2541,6 +2590,7 @@
       "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
       "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "mime-db": "^1.54.0"
       },
@@ -2631,7 +2681,8 @@
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/fast-sha256/-/fast-sha256-1.3.0.tgz",
       "integrity": "sha512-n11RGP/lrWEFI/bWdygLxhI+pVeo1ZYIVwvvPkW7azl/rOy+F3HYRZ2K5zeE9mmkhQppyv9sQFx0JM9UabnpPQ==",
-      "license": "Unlicense"
+      "license": "Unlicense",
+      "peer": true
     },
     "node_modules/fast-uri": {
       "version": "3.1.3",
@@ -2730,6 +2781,7 @@
       "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
       "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "debug": "^4.4.0",
         "encodeurl": "^2.0.0",
@@ -2801,6 +2853,7 @@
       "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
       "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -2810,6 +2863,7 @@
       "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
       "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -2959,6 +3013,7 @@
       "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
       "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "depd": "~2.0.0",
         "inherits": "~2.0.4",
@@ -3025,6 +3080,7 @@
       "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
       "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
       },
@@ -3040,7 +3096,8 @@
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "license": "ISC"
+      "license": "ISC",
+      "peer": true
     },
     "node_modules/ini": {
       "version": "1.3.8",
@@ -3070,13 +3127,15 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
       "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/isexe": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "license": "ISC"
+      "license": "ISC",
+      "peer": true
     },
     "node_modules/jiti": {
       "version": "2.7.0",
@@ -3093,6 +3152,7 @@
       "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.3.tgz",
       "integrity": "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw==",
       "license": "MIT",
+      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/panva"
       }
@@ -3127,6 +3187,7 @@
       "resolved": "https://registry.npmjs.org/json-schema-to-ts/-/json-schema-to-ts-3.1.1.tgz",
       "integrity": "sha512-+DWg8jCJG2TEnpy7kOm/7/AxaYoaRbjVB4LFZLySZlWn8exGs3A4OLJR966cVvU26N7X9TWxl+Jsw7dzAqKT6g==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/runtime": "^7.18.3",
         "ts-algebra": "^2.0.0"
@@ -3145,7 +3206,8 @@
       "version": "8.0.2",
       "resolved": "https://registry.npmjs.org/json-schema-typed/-/json-schema-typed-8.0.2.tgz",
       "integrity": "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA==",
-      "license": "BSD-2-Clause"
+      "license": "BSD-2-Clause",
+      "peer": true
     },
     "node_modules/kitx": {
       "version": "2.2.0",
@@ -3508,6 +3570,7 @@
       "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz",
       "integrity": "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -3517,6 +3580,7 @@
       "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
       "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -3596,6 +3660,7 @@
       "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
       "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -3637,6 +3702,7 @@
       "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
       "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -3688,6 +3754,7 @@
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
       "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "ee-first": "1.1.1"
       },
@@ -3700,6 +3767,7 @@
       "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
       "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
       "license": "ISC",
+      "peer": true,
       "dependencies": {
         "wrappy": "1"
       }
@@ -3709,6 +3777,7 @@
       "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
       "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -3718,6 +3787,7 @@
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
       "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -3727,6 +3797,7 @@
       "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
       "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==",
       "license": "MIT",
+      "peer": true,
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/express"
@@ -3759,7 +3830,6 @@
       "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -3809,6 +3879,7 @@
       "resolved": "https://registry.npmjs.org/pkce-challenge/-/pkce-challenge-5.0.1.tgz",
       "integrity": "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=16.20.0"
       }
@@ -3861,7 +3932,6 @@
       "devOptional": true,
       "hasInstallScript": true,
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
         "@prisma/config": "6.19.3",
         "@prisma/engines": "6.19.3"
@@ -3925,6 +3995,7 @@
       "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
       "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "forwarded": "0.2.0",
         "ipaddr.js": "1.9.1"
@@ -3938,6 +4009,7 @@
       "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
       "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.10"
       }
@@ -3995,6 +4067,7 @@
       "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz",
       "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       },
@@ -4008,6 +4081,7 @@
       "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
       "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "bytes": "~3.1.2",
         "http-errors": "~2.0.1",
@@ -4125,6 +4199,7 @@
       "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
       "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "debug": "^4.4.0",
         "depd": "^2.0.0",
@@ -4171,7 +4246,8 @@
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/sax": {
       "version": "1.6.0",
@@ -4215,6 +4291,7 @@
       "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
       "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "debug": "^4.4.3",
         "encodeurl": "^2.0.0",
@@ -4241,6 +4318,7 @@
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
       "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -4250,6 +4328,7 @@
       "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
       "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "mime-db": "^1.54.0"
       },
@@ -4266,6 +4345,7 @@
       "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz",
       "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "encodeurl": "^2.0.0",
         "escape-html": "^1.0.3",
@@ -4290,13 +4370,15 @@
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
       "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
-      "license": "ISC"
+      "license": "ISC",
+      "peer": true
     },
     "node_modules/shebang-command": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
       "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "shebang-regex": "^3.0.0"
       },
@@ -4309,6 +4391,7 @@
       "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
       "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=8"
       }
@@ -4476,6 +4559,7 @@
       "resolved": "https://registry.npmjs.org/standardwebhooks/-/standardwebhooks-1.0.0.tgz",
       "integrity": "sha512-BbHGOQK9olHPMvQNHWul6MYlrRTAOKn03rOe4A8O3CLWhNf4YHBqq2HJKKC+sfqpxiBY52pNeesD6jIiLDz8jg==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@stablelib/base64": "^1.0.0",
         "fast-sha256": "^1.3.0"
@@ -4486,6 +4570,7 @@
       "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
       "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -4573,6 +4658,7 @@
       "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
       "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=0.6"
       }
@@ -4581,7 +4667,8 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ts-algebra/-/ts-algebra-2.0.0.tgz",
       "integrity": "sha512-FPAhNPFMrkwz76P7cdjdmiShwMynZYN6SgOujD1urY4oNm80Ou9oMdmbR45LotcKOXoy7wSmHkRFE6Mxbrhefw==",
-      "license": "MIT"
+      "license": "MIT",
+      "peer": true
     },
     "node_modules/tslib": {
       "version": "2.8.1",
@@ -4597,7 +4684,6 @@
       "integrity": "sha512-eUdUIaCr963q2h5u3+QwvYp0+eqPvn+egeqZUm0hwERCqqx1E3kK5ehbGCvqSE5MQAULr67ww0cA3jKc3YkM1w==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "esbuild": "~0.28.0"
       },
@@ -4616,6 +4702,7 @@
       "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
       "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "content-type": "^2.0.0",
         "media-typer": "^1.1.0",
@@ -4634,6 +4721,7 @@
       "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
       "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=18"
       },
@@ -4647,6 +4735,7 @@
       "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
       "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.6"
       }
@@ -4656,6 +4745,7 @@
       "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
       "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "mime-db": "^1.54.0"
       },
@@ -4673,7 +4763,6 @@
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "devOptional": true,
       "license": "Apache-2.0",
-      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -4693,6 +4782,7 @@
       "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
       "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -4702,6 +4792,7 @@
       "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
       "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">= 0.8"
       }
@@ -4712,7 +4803,6 @@
       "integrity": "sha512-Ds+gBRbj0lwRO2Y5hwnUBdxSwlAve9LeRyU4sNnAr0ewW0gWF0n5bgXgUzbgZ49MV9BVUAQUFYVcDUcilUExMA==",
       "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "lightningcss": "^1.32.0",
         "picomatch": "^4.0.4",
@@ -4880,6 +4970,7 @@
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
       "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
       "license": "ISC",
+      "peer": true,
       "dependencies": {
         "isexe": "^2.0.0"
       },
@@ -4911,7 +5002,8 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
       "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "license": "ISC"
+      "license": "ISC",
+      "peer": true
     },
     "node_modules/ws": {
       "version": "8.21.0",
@@ -4961,7 +5053,6 @@
       "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
       "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
       "license": "MIT",
-      "peer": true,
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
       }
@@ -4971,6 +5062,7 @@
       "resolved": "https://registry.npmjs.org/zod-to-json-schema/-/zod-to-json-schema-3.25.2.tgz",
       "integrity": "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==",
       "license": "ISC",
+      "peer": true,
       "peerDependencies": {
         "zod": "^3.25.28 || ^4"
       }

hub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paradigm/hub",
-  "version": "0.0.35",
+  "version": "0.0.34",
   "private": true,
   "type": "module",
   "engines": {

hub/prisma/migrations/20260719140000_agent_config_folder_tree/migration.sql

@@ -1,33 +0,0 @@
--- ADR-0028 agent configuration folder tree. One org-scoped transparent folder
--- tree shared by Agent roles and skills (management-surface grouping only);
--- skill name / roleId uniqueness, role→skill bindings, run-time skill loading
--- and Feishu slash commands never reference folders. A folder deletes only
--- when empty (service-enforced); item `folderId` references are SetNull as
--- backstop.
-
--- CreateTable
-CREATE TABLE "OrganizationAgentConfigFolder" (
-    "id" TEXT NOT NULL,
-    "organizationId" TEXT NOT NULL,
-    "parentId" TEXT,
-    "name" TEXT NOT NULL,
-    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    "updatedAt" TIMESTAMP(3) NOT NULL,
-
-    CONSTRAINT "OrganizationAgentConfigFolder_pkey" PRIMARY KEY ("id")
-);
-
--- AlterTable
-ALTER TABLE "OrganizationAgentSkill" ADD COLUMN "folderId" TEXT;
-ALTER TABLE "OrganizationAgentRole" ADD COLUMN "folderId" TEXT;
-
--- CreateIndex
-CREATE INDEX "OrganizationAgentConfigFolder_organizationId_parentId_idx" ON "OrganizationAgentConfigFolder"("organizationId", "parentId");
-CREATE INDEX "OrganizationAgentSkill_organizationId_folderId_idx" ON "OrganizationAgentSkill"("organizationId", "folderId");
-CREATE INDEX "OrganizationAgentRole_organizationId_folderId_idx" ON "OrganizationAgentRole"("organizationId", "folderId");
-
--- AddForeignKey
-ALTER TABLE "OrganizationAgentConfigFolder" ADD CONSTRAINT "OrganizationAgentConfigFolder_organizationId_fkey" FOREIGN KEY ("organizationId") REFERENCES "Organization"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-ALTER TABLE "OrganizationAgentConfigFolder" ADD CONSTRAINT "OrganizationAgentConfigFolder_parentId_fkey" FOREIGN KEY ("parentId") REFERENCES "OrganizationAgentConfigFolder"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
-ALTER TABLE "OrganizationAgentSkill" ADD CONSTRAINT "OrganizationAgentSkill_folderId_fkey" FOREIGN KEY ("folderId") REFERENCES "OrganizationAgentConfigFolder"("id") ON DELETE SET NULL ON UPDATE CASCADE;
-ALTER TABLE "OrganizationAgentRole" ADD CONSTRAINT "OrganizationAgentRole_folderId_fkey" FOREIGN KEY ("folderId") REFERENCES "OrganizationAgentConfigFolder"("id") ON DELETE SET NULL ON UPDATE CASCADE;

hub/prisma/schema.prisma

@@ -47,7 +47,6 @@ model Organization {
   capabilityConnections        OrganizationCapabilityConnection[]
   agentSkills                  OrganizationAgentSkill[]
   agentRoles                   OrganizationAgentRole[]
-  agentConfigFolders           OrganizationAgentConfigFolder[]
   projectGroupBindings         ProjectGroupBinding[]
   auditEntries                 AuditEntry[]                             @relation("organizationAudit")
   projectSearchDocuments       ProjectSearchDocument[]
@@ -96,19 +95,16 @@ model OrganizationAgentSkill {
   version        String
   description    String?
   contentDigest  String
-  folderId       String?
   createdAt      DateTime  @default(now())
   updatedAt      DateTime  @updatedAt
   disabledAt     DateTime?
 
-  organization Organization                    @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  folder       OrganizationAgentConfigFolder?  @relation(fields: [folderId], references: [id], onDelete: SetNull)
+  organization Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   roleBindings OrganizationAgentRoleSkill[]
 
   @@unique([organizationId, name])
   @@unique([organizationId, id])
   @@index([organizationId, disabledAt])
-  @@index([organizationId, folderId])
   @@index([contentDigest])
 }
 
@@ -125,20 +121,17 @@ model OrganizationAgentRole {
   tools          Json?
   sortOrder      Int       @default(0)
   isDefault      Boolean   @default(false)
-  folderId       String?
   createdAt      DateTime  @default(now())
   updatedAt      DateTime  @updatedAt
   disabledAt     DateTime?
 
-  organization       Organization                    @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  folder             OrganizationAgentConfigFolder?  @relation(fields: [folderId], references: [id], onDelete: SetNull)
+  organization       Organization                 @relation(fields: [organizationId], references: [id], onDelete: Cascade)
   skillBindings      OrganizationAgentRoleSkill[]
   selectedByBindings ProjectGroupBinding[]        @relation("selectedAgentRole")
 
   @@unique([organizationId, roleId])
   @@unique([organizationId, id])
   @@index([organizationId, disabledAt, sortOrder])
-  @@index([organizationId, folderId])
 }
 
 /// Same-Organization join enforced by both composite foreign keys. `sortOrder`
@@ -158,29 +151,6 @@ model OrganizationAgentRoleSkill {
   @@index([organizationId, agentSkillId])
 }
 
-/// ADR-0028: org-scoped transparent folder tree shared by agent roles and
-/// skills. Management-surface navigation/grouping only — not a permission
-/// resource, and never referenced by role→skill bindings, run-time skill
-/// loading, or Feishu slash commands. Skill name and roleId stay unique per
-/// organization regardless of folder membership. A folder is deleted only
-/// when empty (service-enforced); item references are SetNull as backstop.
-model OrganizationAgentConfigFolder {
-  id             String    @id @default(cuid())
-  organizationId String
-  parentId       String?
-  name           String
-  createdAt      DateTime  @default(now())
-  updatedAt      DateTime  @updatedAt
-
-  organization Organization                    @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  parent       OrganizationAgentConfigFolder?  @relation("agentConfigFolderTree", fields: [parentId], references: [id], onDelete: Restrict)
-  children     OrganizationAgentConfigFolder[] @relation("agentConfigFolderTree")
-  skills       OrganizationAgentSkill[]
-  roles        OrganizationAgentRole[]
-
-  @@index([organizationId, parentId])
-}
-
 /// ADR-0021: org-level project onboarding policy. Ordinary Feishu users can
 /// create projects from unbound chats only when membersCanCreateProjects=true.
 model OrganizationProjectSettings {

hub/src/admin/routes/agentConfigRoutes.ts

@@ -15,10 +15,6 @@
  * `commitSkillContent`, so the web path and CLI path share one ingestion
  * pipeline and one set of safety checks (SKILL.md manifest required, 512-file
  * / 16-byte limits, symlink rejection).
- *
- * Folder tree (ADR-0028): one org-scoped transparent folder tree shared by
- * roles and skills for management-surface grouping. Folder endpoints never
- * touch session state — assignment is a label-class change (ADR-0017).
  */
 import type { PrismaClient } from "@prisma/client";
 import type { FastifyInstance } from "fastify";
@@ -247,121 +243,4 @@ export async function registerAgentConfigRoutes(
       return handleRouteError(reply, err);
     }
   });
-
-  // --- ADR-0028 shared agent-config folder tree (transparent grouping) ---
-
-  app.get("/api/org/:orgSlug/agent-config-folders", async (request, reply) => {
-    try {
-      const { orgSlug } = request.params as { orgSlug: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      const folders = await agentConfig.listFolders({ organizationId: auth.organization.id });
-      return { folders };
-    } catch (err) {
-      return handleRouteError(reply, err);
-    }
-  });
-
-  app.post("/api/org/:orgSlug/agent-config-folders", async (request, reply) => {
-    try {
-      const { orgSlug } = request.params as { orgSlug: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      const body = request.body as { name?: unknown; parentId?: unknown };
-      if (typeof body.name !== "string") {
-        return reply.status(400).send({
-          error: { code: "bad_request", message: "name is required" },
-        });
-      }
-      const folder = await agentConfig.createFolder({
-        organizationId: auth.organization.id,
-        name: body.name,
-        ...(typeof body.parentId === "string" ? { parentId: body.parentId } : {}),
-      });
-      return reply.status(201).send(folder);
-    } catch (err) {
-      return handleRouteError(reply, err);
-    }
-  });
-
-  app.patch("/api/org/:orgSlug/agent-config-folders/:folderId", async (request, reply) => {
-    try {
-      const { orgSlug, folderId } = request.params as { orgSlug: string; folderId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      const body = request.body as { name?: unknown; parentId?: unknown };
-      const folder = await agentConfig.updateFolder({
-        organizationId: auth.organization.id,
-        folderId,
-        ...(typeof body.name === "string" ? { name: body.name } : {}),
-        ...(body.parentId === null || typeof body.parentId === "string"
-          ? { parentId: body.parentId as string | null }
-          : {}),
-      });
-      return folder;
-    } catch (err) {
-      return handleRouteError(reply, err);
-    }
-  });
-
-  app.delete("/api/org/:orgSlug/agent-config-folders/:folderId", async (request, reply) => {
-    try {
-      const { orgSlug, folderId } = request.params as { orgSlug: string; folderId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      await agentConfig.deleteFolder({
-        organizationId: auth.organization.id,
-        folderId,
-      });
-      return { deleted: true };
-    } catch (err) {
-      return handleRouteError(reply, err);
-    }
-  });
-
-  // Folder assignment is a label-class change (ADR-0017): these endpoints
-  // never archive Agent sessions (ADR-0028).
-  app.patch("/api/org/:orgSlug/agent-roles/:roleId/folder", async (request, reply) => {
-    try {
-      const { orgSlug, roleId } = request.params as { orgSlug: string; roleId: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      const body = request.body as { folderId?: unknown };
-      if (body.folderId !== null && typeof body.folderId !== "string") {
-        return reply.status(400).send({
-          error: { code: "bad_request", message: "folderId must be a string or null" },
-        });
-      }
-      await agentConfig.setRoleFolder({
-        organizationId: auth.organization.id,
-        roleId,
-        folderId: body.folderId as string | null,
-      });
-      return { folderId: body.folderId as string | null };
-    } catch (err) {
-      return handleRouteError(reply, err);
-    }
-  });
-
-  app.patch("/api/org/:orgSlug/agent-skills/:name/folder", async (request, reply) => {
-    try {
-      const { orgSlug, name } = request.params as { orgSlug: string; name: string };
-      const auth = await requireOrgRole(request, reply, guardDeps, { orgSlug });
-      if (auth === null) return;
-      const body = request.body as { folderId?: unknown };
-      if (body.folderId !== null && typeof body.folderId !== "string") {
-        return reply.status(400).send({
-          error: { code: "bad_request", message: "folderId must be a string or null" },
-        });
-      }
-      await agentConfig.setSkillFolder({
-        organizationId: auth.organization.id,
-        name,
-        folderId: body.folderId as string | null,
-      });
-      return { folderId: body.folderId as string | null };
-    } catch (err) {
-      return handleRouteError(reply, err);
-    }
-  });
 }

hub/src/admin/routes/authRoutes.ts

@@ -432,16 +432,16 @@ async function resolvePostLoginRedirect(
       select: { organization: { select: { slug: true, name: true } } },
     });
     if (intended === null) return "/admin?error=not_an_active_org_member";
-    const orgRoot = "/admin";
+    const orgRoot = `/admin/org/${intended.organization.slug}`;
     // Default / missing returnTo sanitizes to "/admin". Always land in the org
     // admin SPA (not the legacy static "close this tab" complete page).
     if (returnTo === "/admin") {
       return orgRoot;
     }
-    return normalizeAdminReturnTo(returnTo) ?? orgRoot;
+    return returnTo === orgRoot || returnTo.startsWith(`${orgRoot}/`) ? returnTo : orgRoot;
   }
   if (returnTo !== "/admin" && returnTo.startsWith("/admin")) {
-    return normalizeAdminReturnTo(returnTo) ?? "/admin";
+    return returnTo;
   }
   const membership = await prisma.organizationMembership.findFirst({
     where: {
@@ -454,7 +454,7 @@ async function resolvePostLoginRedirect(
     orderBy: { createdAt: "asc" },
   });
   if (membership !== null) {
-    return "/admin";
+    return `/admin/org/${membership.organization.slug}`;
   }
   // Member-only or no org: still land on a shell page (SPA will explain).
   const any = await prisma.organizationMembership.findFirst({
@@ -463,7 +463,7 @@ async function resolvePostLoginRedirect(
     orderBy: { createdAt: "asc" },
   });
   if (any !== null) {
-    return "/admin/projects";
+    return `/admin/org/${any.organization.slug}`;
   }
   return "/admin/login?error=no_organization";
 }
@@ -489,18 +489,7 @@ export function sanitizeReturnTo(raw: string): string {
   if (!raw.startsWith("/admin")) {
     return "/admin";
   }
-  return normalizeAdminReturnTo(raw) ?? "/admin";
-}
-
-/** Map legacy `/admin/org/:slug[...]` bookmarks onto slugless `/admin[...]` paths. */
-export function normalizeAdminReturnTo(path: string): string | null {
-  if (!path.startsWith("/admin")) return null;
-  const legacy = path.match(/^\/admin\/org\/[^/]+(\/.*)?$/);
-  if (legacy) {
-    const rest = legacy[1] ?? "";
-    return rest === "" ? "/admin" : `/admin${rest}`;
-  }
-  return path;
+  return raw;
 }
 
 function trimTrailingSlash(url: string): string {

hub/src/agent/configuration.ts

@@ -18,7 +18,6 @@ export interface AgentRoleRow {
   readonly createdAt: string;
   readonly updatedAt: string;
   readonly skillNames: readonly string[];
-  readonly folderId: string | null;
 }
 
 export interface AgentSkillRow {
@@ -31,17 +30,6 @@ export interface AgentSkillRow {
   readonly createdAt: string;
   readonly updatedAt: string;
   readonly boundRoleIds: readonly string[];
-  readonly folderId: string | null;
-}
-
-/**
- * ADR-0028 transparent folder node of the org's shared agent-config folder
- * tree. Grouping only: never part of skill/role identity or run resolution.
- */
-export interface AgentConfigFolderRow {
-  readonly id: string;
-  readonly name: string;
-  readonly parentId: string | null;
 }
 
 /**
@@ -92,213 +80,9 @@ export class OrganizationAgentConfiguration {
       createdAt: skill.createdAt.toISOString(),
       updatedAt: skill.updatedAt.toISOString(),
       boundRoleIds: skill.roleBindings.map((binding) => binding.role.roleId),
-      folderId: skill.folderId,
     }));
   }
 
-  async listFolders(input: { readonly organizationId: string }): Promise<readonly AgentConfigFolderRow[]> {
-    await this.requireActiveOrganization(input.organizationId);
-    const folders = await this.prisma.organizationAgentConfigFolder.findMany({
-      where: { organizationId: input.organizationId },
-      orderBy: [{ name: "asc" }, { id: "asc" }],
-      select: { id: true, name: true, parentId: true },
-    });
-    return folders;
-  }
-
-  async createFolder(input: {
-    readonly organizationId: string;
-    readonly name: string;
-    readonly parentId?: string | undefined;
-  }): Promise<AgentConfigFolderRow> {
-    await this.requireActiveOrganization(input.organizationId);
-    const name = nonEmpty(input.name, "folder name");
-    return this.prisma.$transaction(async (tx) => {
-      if (input.parentId !== undefined) {
-        await requireFolder(tx, input.organizationId, input.parentId);
-      }
-      const folder = await tx.organizationAgentConfigFolder.create({
-        data: {
-          organizationId: input.organizationId,
-          name,
-          ...(input.parentId !== undefined ? { parentId: input.parentId } : {}),
-        },
-        select: { id: true, name: true, parentId: true },
-      });
-      await tx.auditEntry.create({
-        data: {
-          organizationId: input.organizationId,
-          action: "agent_config_folder.created",
-          metadata: { folderId: folder.id, name: folder.name, parentId: folder.parentId },
-        },
-      });
-      return folder;
-    });
-  }
-
-  /**
-   * Rename and/or move a folder inside the same Organization tree. Moving is
-   * rejected when the target parent is the folder itself or one of its
-   * descendants (would create a cycle).
-   */
-  async updateFolder(input: {
-    readonly organizationId: string;
-    readonly folderId: string;
-    readonly name?: string | undefined;
-    readonly parentId?: string | null | undefined;
-  }): Promise<AgentConfigFolderRow> {
-    await this.requireActiveOrganization(input.organizationId);
-    return this.prisma.$transaction(async (tx) => {
-      const folder = await requireFolder(tx, input.organizationId, input.folderId);
-      if (input.parentId !== undefined && input.parentId !== null) {
-        if (input.parentId === folder.id) {
-          throw new Error("folder cannot be its own parent");
-        }
-        await requireFolder(tx, input.organizationId, input.parentId);
-        const descendant = await tx.$queryRaw<Array<{ found: boolean }>>(Prisma.sql`
-          WITH RECURSIVE descendants AS (
-            SELECT "id" FROM "OrganizationAgentConfigFolder" WHERE "parentId" = ${folder.id}
-            UNION ALL
-            SELECT child."id" FROM "OrganizationAgentConfigFolder" child
-            JOIN descendants parent ON child."parentId" = parent."id"
-          )
-          SELECT EXISTS(SELECT 1 FROM descendants WHERE "id" = ${input.parentId}) AS found
-        `);
-        if (descendant[0]?.found === true) throw new Error("folder cannot be moved below its descendant");
-      }
-      const name = input.name !== undefined ? nonEmpty(input.name, "folder name") : undefined;
-      const updated = await tx.organizationAgentConfigFolder.update({
-        where: { id: folder.id },
-        data: {
-          ...(name !== undefined ? { name } : {}),
-          ...(input.parentId !== undefined ? { parentId: input.parentId } : {}),
-        },
-        select: { id: true, name: true, parentId: true },
-      });
-      await tx.auditEntry.create({
-        data: {
-          organizationId: input.organizationId,
-          action: "agent_config_folder.updated",
-          metadata: {
-            folderId: folder.id,
-            ...(name !== undefined ? { name } : {}),
-            ...(input.parentId !== undefined ? { parentId: input.parentId } : {}),
-          },
-        },
-      });
-      return updated;
-    });
-  }
-
-  /**
-   * Delete a folder. Refused while the folder still has child folders, roles
-   * or skills (ADR-0028: items are relocated explicitly, so no orphan-placement
-   * rule is needed).
-   */
-  async deleteFolder(input: {
-    readonly organizationId: string;
-    readonly folderId: string;
-  }): Promise<void> {
-    await this.requireActiveOrganization(input.organizationId);
-    await this.prisma.$transaction(async (tx) => {
-      const folder = await requireFolder(tx, input.organizationId, input.folderId);
-      const childFolders = await tx.organizationAgentConfigFolder.count({
-        where: { parentId: folder.id },
-      });
-      if (childFolders > 0) {
-        throw new Error(`cannot delete folder: still has ${childFolders} child folder(s)`);
-      }
-      const skills = await tx.organizationAgentSkill.count({
-        where: { organizationId: input.organizationId, folderId: folder.id },
-      });
-      const roles = await tx.organizationAgentRole.count({
-        where: { organizationId: input.organizationId, folderId: folder.id },
-      });
-      if (skills > 0 || roles > 0) {
-        throw new Error(`cannot delete folder: still has ${roles} role(s) and ${skills} skill(s)`);
-      }
-      await tx.organizationAgentConfigFolder.delete({ where: { id: folder.id } });
-      await tx.auditEntry.create({
-        data: {
-          organizationId: input.organizationId,
-          action: "agent_config_folder.deleted",
-          metadata: { folderId: folder.id, name: folder.name },
-        },
-      });
-    });
-  }
-
-  /**
-   * Assign a skill to a folder (or unfile it with `folderId: null`). This is
-   * a label-class change in the ADR-0017 sense — the execution surface is
-   * untouched, so no session archival (ADR-0028).
-   */
-  async setSkillFolder(input: {
-    readonly organizationId: string;
-    readonly name: string;
-    readonly folderId: string | null;
-  }): Promise<void> {
-    await this.requireActiveOrganization(input.organizationId);
-    await this.prisma.$transaction(async (tx) => {
-      const skill = await tx.organizationAgentSkill.findUnique({
-        where: { organizationId_name: { organizationId: input.organizationId, name: input.name } },
-        select: { id: true, disabledAt: true },
-      });
-      if (skill === null || skill.disabledAt !== null) {
-        throw new Error(`active skill not found in organization: ${input.name}`);
-      }
-      if (input.folderId !== null) {
-        await requireFolder(tx, input.organizationId, input.folderId);
-      }
-      await tx.organizationAgentSkill.update({
-        where: { id: skill.id },
-        data: { folderId: input.folderId },
-      });
-      await tx.auditEntry.create({
-        data: {
-          organizationId: input.organizationId,
-          action: "agent_skill.folder_set",
-          metadata: { name: input.name, folderId: input.folderId },
-        },
-      });
-    });
-  }
-
-  /**
-   * Assign a role to a folder (or unfile it with `folderId: null`). Same
-   * label-class semantics as `setSkillFolder`: no session archival (ADR-0028).
-   */
-  async setRoleFolder(input: {
-    readonly organizationId: string;
-    readonly roleId: string;
-    readonly folderId: string | null;
-  }): Promise<void> {
-    await this.requireActiveOrganization(input.organizationId);
-    await this.prisma.$transaction(async (tx) => {
-      const role = await tx.organizationAgentRole.findUnique({
-        where: { organizationId_roleId: { organizationId: input.organizationId, roleId: input.roleId } },
-        select: { id: true, disabledAt: true },
-      });
-      if (role === null || role.disabledAt !== null) {
-        throw new Error(`active role not found in organization: ${input.roleId}`);
-      }
-      if (input.folderId !== null) {
-        await requireFolder(tx, input.organizationId, input.folderId);
-      }
-      await tx.organizationAgentRole.update({
-        where: { id: role.id },
-        data: { folderId: input.folderId },
-      });
-      await tx.auditEntry.create({
-        data: {
-          organizationId: input.organizationId,
-          action: "agent_role.folder_set",
-          metadata: { roleId: input.roleId, folderId: input.folderId },
-        },
-      });
-    });
-  }
-
   async installSkill(input: {
     readonly organizationId: string;
     readonly sourceDir: string;
@@ -688,19 +472,6 @@ export class OrganizationAgentConfiguration {
   }
 }
 
-async function requireFolder(
-  tx: Prisma.TransactionClient,
-  organizationId: string,
-  folderId: string,
-): Promise<{ readonly id: string; readonly name: string; readonly parentId: string | null }> {
-  const folder = await tx.organizationAgentConfigFolder.findFirst({
-    where: { id: folderId, organizationId },
-    select: { id: true, name: true, parentId: true },
-  });
-  if (folder === null) throw new Error(`folder not found in organization: ${folderId}`);
-  return folder;
-}
-
 async function archiveRoleSessions(
   tx: Prisma.TransactionClient,
   organizationId: string,
@@ -759,7 +530,6 @@ function toRoleRow(role: {
   readonly disabledAt: Date | null;
   readonly createdAt: Date;
   readonly updatedAt: Date;
-  readonly folderId: string | null;
   readonly skillBindings: ReadonlyArray<{
     readonly skill: { readonly name: string; readonly disabledAt: Date | null };
   }>;
@@ -779,6 +549,5 @@ function toRoleRow(role: {
     skillNames: role.skillBindings
       .filter((binding) => binding.skill.disabledAt === null)
       .map((binding) => binding.skill.name),
-    folderId: role.folderId,
   };
 }

hub/test/integration/admin-auth.test.ts

@@ -170,7 +170,7 @@ describe("admin auth + org API guards", () => {
     try {
       const res = await app.inject({
         method: "GET",
-        url: "/auth/feishu?returnTo=/admin",
+        url: "/auth/feishu?returnTo=/admin/org/test-default",
       });
       expect(res.statusCode).toBe(302);
       const location = res.headers.location;
@@ -233,7 +233,7 @@ describe("admin auth + org API guards", () => {
     try {
       const nonce = "nonce-test-1";
       const state = signOAuthState(
-        { nonce, returnTo: "/admin" },
+        { nonce, returnTo: "/admin/org/test-default" },
         SESSION_SECRET,
       );
       const res = await app.inject({
@@ -242,7 +242,7 @@ describe("admin auth + org API guards", () => {
         headers: { cookie: `${OAUTH_STATE_COOKIE_NAME}=${nonce}` },
       });
       expect(res.statusCode).toBe(302);
-      expect(res.headers.location).toBe("/admin");
+      expect(res.headers.location).toBe("/admin/org/test-default");
       expect(JSON.stringify(res.headers["set-cookie"])).toContain("cph_session=");
 
       const user = await prisma.user.findUnique({ where: { feishuOpenId: "ou_new" } });
@@ -293,7 +293,7 @@ describe("admin auth + org API guards", () => {
     try {
       const start = await app.inject({
         method: "GET",
-        url: "/auth/feishu/test-default?returnTo=/admin/settings",
+        url: "/auth/feishu/test-default?returnTo=/admin/org/test-default/settings",
       });
       expect(start.statusCode).toBe(302);
       const authorize = new URL(String(start.headers.location));
@@ -308,7 +308,7 @@ describe("admin auth + org API guards", () => {
         headers: { cookie: nonceCookie },
       });
       expect(callback.statusCode).toBe(302);
-      expect(callback.headers.location).toBe("/admin/settings");
+      expect(callback.headers.location).toBe("/admin/org/test-default/settings");
       const sessionCookie = cookiePair(callback.headers["set-cookie"], "cph_session");
       const me = await app.inject({ method: "GET", url: "/api/me", headers: { cookie: sessionCookie } });
       expect(me.statusCode).toBe(200);
@@ -346,7 +346,7 @@ describe("admin auth + org API guards", () => {
         headers: { cookie: cookiePair(defaultStart.headers["set-cookie"], OAUTH_STATE_COOKIE_NAME) },
       });
       expect(defaultCallback.statusCode).toBe(302);
-      expect(defaultCallback.headers.location).toBe("/admin");
+      expect(defaultCallback.headers.location).toBe("/admin/org/test-default");
 
       await connections.disable({ organizationId: DEFAULT_ORG_ID, actorUserId: "scoped-owner" });
       const revoked = await app.inject({ method: "GET", url: "/api/me", headers: { cookie: sessionCookie } });

hub/test/integration/agent-configuration.test.ts

@@ -118,105 +118,6 @@ describe("Organization Agent configuration management", () => {
     })).rejects.toThrow("must have exactly one active default Agent role");
   });
 
-  it("groups roles and skills in the shared folder tree (ADR-0028)", async () => {
-    const teaching = await configuration.createFolder({ organizationId: DEFAULT_ORG_ID, name: "教学" });
-    const lessonPrep = await configuration.createFolder({
-      organizationId: DEFAULT_ORG_ID,
-      name: "备课",
-      parentId: teaching.id,
-    });
-    expect(lessonPrep.parentId).toBe(teaching.id);
-    const listed = await configuration.listFolders({ organizationId: DEFAULT_ORG_ID });
-    expect(listed.map((folder) => folder.id).sort()).toEqual([teaching.id, lessonPrep.id].sort());
-
-    const typst = await makeSkill(root, "typst");
-    await configuration.installSkill({ organizationId: DEFAULT_ORG_ID, sourceDir: typst, version: "1" });
-    await configuration.setSkillFolder({ organizationId: DEFAULT_ORG_ID, name: "typst", folderId: lessonPrep.id });
-    await configuration.setRoleFolder({ organizationId: DEFAULT_ORG_ID, roleId: "draft", folderId: teaching.id });
-
-    const skills = await configuration.listSkills({ organizationId: DEFAULT_ORG_ID });
-    expect(skills.find((skill) => skill.name === "typst")?.folderId).toBe(lessonPrep.id);
-    const roles = await configuration.listRoles({ organizationId: DEFAULT_ORG_ID });
-    expect(roles.find((role) => role.roleId === "draft")?.folderId).toBe(teaching.id);
-
-    const renamed = await configuration.updateFolder({
-      organizationId: DEFAULT_ORG_ID,
-      folderId: teaching.id,
-      name: "教研",
-    });
-    expect(renamed.name).toBe("教研");
-  });
-
-  it("moves folders within the tree and rejects moves below a descendant", async () => {
-    const a = await configuration.createFolder({ organizationId: DEFAULT_ORG_ID, name: "a" });
-    const b = await configuration.createFolder({ organizationId: DEFAULT_ORG_ID, name: "b", parentId: a.id });
-    const c = await configuration.createFolder({ organizationId: DEFAULT_ORG_ID, name: "c" });
-    const moved = await configuration.updateFolder({ organizationId: DEFAULT_ORG_ID, folderId: c.id, parentId: b.id });
-    expect(moved.parentId).toBe(b.id);
-    await expect(configuration.updateFolder({ organizationId: DEFAULT_ORG_ID, folderId: a.id, parentId: c.id }))
-      .rejects.toThrow("folder cannot be moved below its descendant");
-    await expect(configuration.updateFolder({ organizationId: DEFAULT_ORG_ID, folderId: a.id, parentId: a.id }))
-      .rejects.toThrow("folder cannot be its own parent");
-  });
-
-  it("deletes only empty folders", async () => {
-    const folder = await configuration.createFolder({ organizationId: DEFAULT_ORG_ID, name: "非空" });
-    const typst = await makeSkill(root, "typst");
-    await configuration.installSkill({ organizationId: DEFAULT_ORG_ID, sourceDir: typst, version: "1" });
-    await configuration.setSkillFolder({ organizationId: DEFAULT_ORG_ID, name: "typst", folderId: folder.id });
-    await expect(configuration.deleteFolder({ organizationId: DEFAULT_ORG_ID, folderId: folder.id }))
-      .rejects.toThrow("still has");
-
-    const parent = await configuration.createFolder({ organizationId: DEFAULT_ORG_ID, name: "父" });
-    await configuration.createFolder({ organizationId: DEFAULT_ORG_ID, name: "子", parentId: parent.id });
-    await expect(configuration.deleteFolder({ organizationId: DEFAULT_ORG_ID, folderId: parent.id }))
-      .rejects.toThrow("child folder");
-
-    await configuration.setSkillFolder({ organizationId: DEFAULT_ORG_ID, name: "typst", folderId: null });
-    await configuration.deleteFolder({ organizationId: DEFAULT_ORG_ID, folderId: folder.id });
-    const remaining = await configuration.listFolders({ organizationId: DEFAULT_ORG_ID });
-    expect(remaining.map((f) => f.id)).not.toContain(folder.id);
-    const skill = (await configuration.listSkills({ organizationId: DEFAULT_ORG_ID })).find((s) => s.name === "typst");
-    expect(skill?.folderId).toBeNull();
-  });
-
-  it("rejects cross-Organization folder assignment", async () => {
-    await seedTestOrganization("org_other", "other");
-    const otherFolder = await configuration.createFolder({ organizationId: "org_other", name: "外部" });
-    const typst = await makeSkill(root, "typst");
-    await configuration.installSkill({ organizationId: DEFAULT_ORG_ID, sourceDir: typst, version: "1" });
-    await expect(configuration.setSkillFolder({
-      organizationId: DEFAULT_ORG_ID,
-      name: "typst",
-      folderId: otherFolder.id,
-    })).rejects.toThrow("folder not found in organization");
-    await expect(configuration.setRoleFolder({
-      organizationId: DEFAULT_ORG_ID,
-      roleId: "draft",
-      folderId: otherFolder.id,
-    })).rejects.toThrow("folder not found in organization");
-  });
-
-  it("treats folder assignment as a label-class change (no session archival)", async () => {
-    await prisma.project.create({
-      data: { id: "project-a", organizationId: DEFAULT_ORG_ID, name: "A", workspaceDir: "/tmp/a" },
-    });
-    await prisma.agentSession.create({
-      data: {
-        id: "session-folder-assignment",
-        projectId: "project-a",
-        provider: "openrouter",
-        roleId: "draft",
-        model: "anthropic/claude-sonnet-5",
-        metadata: {},
-      },
-    });
-    const folder = await configuration.createFolder({ organizationId: DEFAULT_ORG_ID, name: "分组" });
-    await configuration.setRoleFolder({ organizationId: DEFAULT_ORG_ID, roleId: "draft", folderId: folder.id });
-    await expect(prisma.agentSession.findUniqueOrThrow({ where: { id: "session-folder-assignment" } }))
-      .resolves.toMatchObject({ archivedAt: null });
-  });
-
   async function makeSkill(parent: string, name: string): Promise<string> {
     const source = join(parent, "sources", name);
     await mkdir(source, { recursive: true });

hub/test/unit/session.test.ts

@@ -68,14 +68,14 @@ describe("session cookie signing", () => {
 describe("oauth state signing", () => {
   it("round-trips state with returnTo", () => {
     const token = signOAuthState(
-      { nonce: "abc", returnTo: "/admin" },
+      { nonce: "abc", returnTo: "/admin/org/acme" },
       SECRET,
       600,
       1_700_000_000,
     );
     expect(verifyOAuthState(token, SECRET, 1_700_000_100)).toEqual({
       nonce: "abc",
-      returnTo: "/admin",
+      returnTo: "/admin/org/acme",
       exp: 1_700_000_600,
     });
   });
@@ -83,13 +83,13 @@ describe("oauth state signing", () => {
   it("binds state to an Organization and connection as one inseparable scope", () => {
     const token = signOAuthState({
       nonce: "scoped",
-      returnTo: "/admin",
+      returnTo: "/admin/org/acme",
       organizationId: "org-acme",
       connectionId: "connection-acme",
     }, SECRET, 600, 1_700_000_000);
     expect(verifyOAuthState(token, SECRET, 1_700_000_100)).toEqual({
       nonce: "scoped",
-      returnTo: "/admin",
+      returnTo: "/admin/org/acme",
       organizationId: "org-acme",
       connectionId: "connection-acme",
       exp: 1_700_000_600,
@@ -98,11 +98,8 @@ describe("oauth state signing", () => {
 });
 
 describe("sanitizeReturnTo", () => {
-  it("allows admin paths and rewrites legacy org slug prefixes", () => {
-    expect(sanitizeReturnTo("/admin")).toBe("/admin");
-    expect(sanitizeReturnTo("/admin/usage")).toBe("/admin/usage");
-    expect(sanitizeReturnTo("/admin/org/acme")).toBe("/admin");
-    expect(sanitizeReturnTo("/admin/org/acme/usage")).toBe("/admin/usage");
+  it("allows admin paths", () => {
+    expect(sanitizeReturnTo("/admin/org/acme")).toBe("/admin/org/acme");
   });
 
   it("blocks open redirects", () => {

hub/test/unit/silo-rate-limit.test.ts

@@ -23,7 +23,6 @@ describe("isSiloHttpRateLimitExempt", () => {
     expect(isSiloHttpRateLimitExempt("/favicon.svg")).toBe(true);
     expect(isSiloHttpRateLimitExempt("/robots.txt")).toBe(true);
     expect(isSiloHttpRateLimitExempt("/admin")).toBe(true);
-    expect(isSiloHttpRateLimitExempt("/admin/members")).toBe(true);
     expect(isSiloHttpRateLimitExempt("/admin/org/para-26071100/members")).toBe(true);
   });
 

spec/Spec/Prelude.lean

@@ -29,9 +29,6 @@ structure Identifiers where
   TeamId : Type
   /-- Project explorer folder 标识(`OPEN` 表示;ADR-0021 透明组织节点,非权限资源)。 -/
   FolderId : Type
-  /-- Agent 配置 folder 标识(`OPEN` 表示;ADR-0028 透明组织节点,skill/role 共用一棵树;
-      与 project explorer 的 `FolderId` 是不同实体,两棵树互不引用)。 -/
-  AgentConfigFolderId : Type
   /-- 一次 agent 任务的标识(`OPEN` 表示;锁的 owner、审计主体,`AgentRun`。provider 无关,
   ADR-0017;`@bot` 仅为触发品牌,不承诺 provider)。 -/
   RunId : Type

spec/Spec/System/Agent/AgentRole.lean

@@ -12,10 +12,6 @@ Role 的执行面(model/prompt/tools/skill 内容)变更时,该 role 的 active
 
 Run 时只读加载 role 选中的 skill 不可变版本到 run-scoped 目录,
 run 结束后删除(ADR-0018)。Skill 管理是 org-scoped;存储机制 `OPEN`。
-
-管理面分组:skill 与 role 共用一棵 org 内可嵌套 folder 树(ADR-0028)。folder 是透明
-组织节点——只做后台导航/分组,不进入身份、解析与授权;name/roleId 唯一性、role→skill
-绑定、run 加载与 slash 命令均与 folder 无关。
 -/
 
 namespace Spec.System
@@ -34,9 +30,6 @@ structure AgentRole where
   tools : List String
   /-- 默认 model(`PINNED`;model ID 表示 `OPEN`)。 -/
   defaultModel : String
-  /-- 管理面分组 folder(`PINNED`, ADR-0028;`none` 表示未分类)。透明节点,见
-  `AgentConfigFolder`——不进入 role 的身份与解析,roleId 仍 org 内唯一。 -/
-  folder : Option I.AgentConfigFolderId
 
 /-- Agent 技能(`PINNED`, org-scoped, ADR-0017/0018)。 -/
 structure AgentSkill where
@@ -50,9 +43,6 @@ structure AgentSkill where
   contentDigest : String
   /-- 描述(`OPEN`)。 -/
   description : String
-  /-- 管理面分组 folder(`PINNED`, ADR-0028;`none` 表示未分类)。透明节点,见
-  `AgentConfigFolder`——不进入 skill 的身份与解析,name 仍 org 内唯一。 -/
-  folder : Option I.AgentConfigFolderId
 
 /-- Role-Skill 绑定(`PINNED`, ADR-0017)。一个 role 可绑定零或多个 skill。 -/
 structure AgentRoleSkillBinding where
@@ -67,28 +57,4 @@ structure AgentRoleSkillBinding where
   /-- 排序(`PINNED`)。 -/
   sortOrder : Nat
 
-/-- Agent 配置 folder(`PINNED`, org-scoped, ADR-0028):skill 与 role **共用**的一棵
-可嵌套 folder 树的节点,仅承担管理面的导航与分组。它是透明组织节点(与 ADR-0021
-project Folder 同例):不是权限资源、不持有 grants;不进入 skill name / roleId 的身份
-与解析——name/roleId 仍在 org 内唯一、与 folder 无关;role→skill 绑定、run 的 skill
-快照加载与飞书 slash 命令均不引用 folder。folder 归属变更是 label 类变更
-(ADR-0017),不归档会话。folder 仅在为空(无子 folder、无挂载的 skill/role)时可删
-(`PINNED`)——挂载物的级动归置规则未定,故先禁止。 -/
-structure AgentConfigFolder where
-  /-- 所属组织(`PINNED`)。 -/
-  organization : I.OrganizationId
-  /-- folder 标识(`OPEN` 表示)。 -/
-  id : I.AgentConfigFolderId
-  /-- 父 folder;`none` 为根层(`PINNED`,可嵌套)。 -/
-  parent : Option I.AgentConfigFolderId
-
-/-- Skill/role 的 folder 归属良构性(`PINNED`, ADR-0028):每个 skill/role 至多归属于
-一个 folder,且只能归属于与其**同 org** 的 folder;`none`(未分类)总是良构。
-移动 skill/role 进出 folder 不改变其自身授权与解析。 -/
-def AgentConfigFolderPlacement.WellScoped
-    (organization : I.OrganizationId)
-    (placement : Option I.AgentConfigFolderId)
-    (folderOrg : I.AgentConfigFolderId → Option I.OrganizationId) : Prop :=
-  ∀ folderId, placement = some folderId → folderOrg folderId = some organization
-
 end Spec.System