fix(cloud): render empty skills without sandbox grant

docs/multi-tenant/DATABASE_MIGRATION_GUIDE.md

@@ -1,166 +0,0 @@
-# LangBot 多租户数据库迁移指南
-
-## 概述
-
-LangBot 从单租户 OSS 架构迁移到多租户 SaaS 架构，需要执行 7 个数据库迁移（0009-0015）。
-
-## 迁移序列
-
-```
-0009_workspace_tenancy_kernel → 创建 Workspace、成员、邀请表
-0010_scope_tenant_resources → 所有业务表添加 workspace_uuid
-0011_postgres_tenant_rls → PostgreSQL 行级安全策略
-0012_plugin_installation_identity → 插件实例租户绑定
-0013_tenant_pgvector → RAG 向量存储隔离
-0014_cloud_directory_projection → Cloud 控制平面同步
-0015_cloud_core_collaboration → 协作和权限功能
-```
-
-## 执行步骤
-
-### 1. 备份（必须）
-
-```bash
-# SQLite
-cp ~/.langbot/data/langbot.db ~/.langbot/data/langbot.db.backup-$(date +%Y%m%d)
-
-# PostgreSQL  
-pg_dump -U langbot_user -d langbot_db -F c -f langbot_backup_$(date +%Y%m%d).dump
-```
-
-### 2. 执行迁移
-
-```bash
-# 停止服务
-sudo -S -p '' systemctl stop langbot
-
-# 执行迁移
-python -m langbot.pkg.persistence.migration upgrade head
-
-# 验证
-python -m langbot.pkg.persistence.migration current
-# 预期: 0015_cloud_core_collaboration
-
-# 启动服务
-sudo -S -p '' systemctl start langbot
-```
-
-### 3. OSS 单租户自动迁移
-
-迁移会自动：
-- 创建默认 Workspace（名称："Default Workspace"）
-- 第一个用户成为 Owner
-- 所有现有资源绑定到该 Workspace
-
-### 4. 验证检查
-
-```bash
-# 检查 Workspace
-python << EOF
-from langbot.pkg.persistence import manager
-import sqlalchemy as sa
-
-with manager.engine.connect() as conn:
-    ws = conn.execute(sa.text("SELECT uuid, name FROM workspaces LIMIT 1")).first()
-    print(f"Workspace: {ws[1]} ({ws[0]})")
-    
-    # 检查资源绑定
-    bot_count = conn.execute(sa.text(
-        f"SELECT COUNT(*) FROM bots WHERE workspace_uuid='{ws[0]}'"
-    )).scalar()
-    print(f"Bots: {bot_count}")
-EOF
-```
-
-## 回滚方案
-
-### 完全回滚（丢失多租户数据）
-
-```bash
-# 1. 停止服务
-sudo -S -p '' systemctl stop langbot
-
-# 2. 恢复备份
-cp ~/.langbot/data/langbot.db.backup-YYYYMMDD ~/.langbot/data/langbot.db
-
-# 3. 回退代码
-git checkout v4.10.x
-pip install -e .
-
-# 4. 启动
-sudo -S -p '' systemctl start langbot
-```
-
-### 降级迁移（保留数据但移除多租户）
-
-```bash
-# 警告：会移除 Workspace 表但保留资源
-python -m langbot.pkg.persistence.migration downgrade 0008_mcp_resource_prefs
-```
-
-## 常见问题
-
-### Q: 迁移后无法登录
-
-```bash
-# 检查用户 UUID
-python << EOF
-from langbot.pkg.persistence import manager
-import sqlalchemy as sa
-
-with manager.engine.connect() as conn:
-    users = conn.execute(sa.text("SELECT id, user, uuid, status FROM users")).all()
-    for u in users:
-        print(f"{u[1]}: UUID={u[2]}, Status={u[3]}")
-EOF
-```
-
-### Q: 资源看不见了
-
-检查 Workspace 上下文：
-```bash
-# 前端请求需要带 X-Workspace-ID header
-curl -H "Authorization: Bearer $TOKEN" \
-     -H "X-Workspace-ID: $WORKSPACE_UUID" \
-     http://localhost:5200/api/v1/platform/bots
-```
-
-### Q: 迁移速度慢
-
-```bash
-# SQLite 优化
-sqlite3 ~/.langbot/data/langbot.db << EOF
-PRAGMA journal_mode=WAL;
-PRAGMA synchronous=NORMAL;
-VACUUM;
-EOF
-```
-
-## 性能调优
-
-### PostgreSQL 索引
-
-```sql
--- 迁移后创建
-CREATE INDEX CONCURRENTLY idx_model_providers_workspace 
-    ON model_providers(workspace_uuid);
-
-CREATE INDEX CONCURRENTLY idx_bots_workspace 
-    ON bots(workspace_uuid);
-
-CREATE INDEX CONCURRENTLY idx_pipelines_workspace 
-    ON pipelines(workspace_uuid);
-```
-
-## 预估时间
-
-- SQLite < 100MB: 2-5 分钟
-- SQLite 100MB-1GB: 5-15 分钟  
-- PostgreSQL: < 5 分钟（取决于数据量）
-
-## 支持
-
-问题反馈：https://github.com/langbot-app/LangBot/issues
-
-**版本**: 1.0  
-**最后更新**: 2026-07-30

src/langbot/pkg/api/http/authz.py

@@ -74,11 +74,6 @@ class AuthorizationError(Exception):
     error_code = 'forbidden'
 
 
-class AuthenticationDeniedError(AuthorizationError):
-    status_code = 401
-    error_code = 'invalid_authentication'
-
-
 class WorkspaceRequiredError(AuthorizationError):
     status_code = 400
     error_code = 'workspace_required'

src/langbot/pkg/api/http/context.py

@@ -9,7 +9,6 @@ class PrincipalType(enum.StrEnum):
 
     ACCOUNT = 'account'
     API_KEY = 'api_key'
-    SUPPORT_ADMIN = 'support_admin'
     SYSTEM = 'system'
     PUBLIC_BOT = 'public_bot'
 
@@ -20,9 +19,7 @@ class PrincipalContext:
 
     principal_type: PrincipalType
     account_uuid: str | None = None
-    actor_account_uuid: str | None = None
     api_key_uuid: str | None = None
-    support_session_id: str | None = None
 
 
 @dataclasses.dataclass(frozen=True, slots=True)

src/langbot/pkg/api/http/controller/group.py

@@ -15,17 +15,8 @@ from ....workspace.collaboration import MembershipPermissionError, WorkspaceColl
 from ....workspace.errors import WorkspaceNotFoundError
 from ....cloud.entitlements import EntitlementUnavailableError
 from ....core.errors import TaskCapacityError
-from ..authz import (
-    AuthenticationDeniedError,
-    AuthorizationError,
-    Permission,
-    PermissionDeniedError,
-    WorkspaceRequiredError,
-    permissions_for_role,
-    require_permission,
-)
+from ..authz import AuthorizationError, Permission, permissions_for_role, require_permission
 from ..context import PrincipalContext, PrincipalType, RequestContext, WorkspaceContext
-from ....cloud.support_admin import SupportAdminSessionError
 
 if typing.TYPE_CHECKING:
     from ....core.app import Application
@@ -60,17 +51,6 @@ class AuthType(enum.Enum):
     USER_TOKEN_OR_API_KEY = 'user-token-or-api-key'
 
 
-_SUPPORT_ADMIN_DENIED_PERMISSIONS = frozenset(
-    {
-        Permission.OWNER_TRANSFER.value,
-        Permission.MEMBER_VIEW.value,
-        Permission.MEMBER_INVITE.value,
-        Permission.MEMBER_UPDATE_ROLE.value,
-        Permission.MEMBER_REMOVE.value,
-    }
-)
-
-
 class RouterGroup(abc.ABC):
     name: str
 
@@ -115,10 +95,6 @@ class RouterGroup(abc.ABC):
                         return self.http_status(401, -1, 'No valid user token provided')
 
                     try:
-                        if self._is_support_admin_token(token):
-                            raise AuthenticationDeniedError(
-                                'Support admin tokens cannot be refreshed or used on account endpoints'
-                            )
                         account, user_email = await self._authenticate_account(token)
                         # Account-token routes deliberately stop before Workspace
                         # selection. They may bootstrap a selector, but cannot
@@ -135,13 +111,8 @@ class RouterGroup(abc.ABC):
                         return self.http_status(401, -1, 'No valid user token provided')
 
                     try:
-                        request_context = await self._authenticate_support_admin(token, auth_type)
-                        if request_context is not None:
-                            self._require_support_admin_route_allowed(rule, f, permission)
-                            user_email = None
-                        else:
-                            account, user_email = await self._authenticate_account(token)
-                            request_context = await self._resolve_account_context(account, auth_type)
+                        account, user_email = await self._authenticate_account(token)
+                        request_context = await self._resolve_account_context(account, auth_type)
                         if permission is not None:
                             if request_context is None:
                                 raise AuthorizationError('Workspace authorization is unavailable')
@@ -170,20 +141,10 @@ class RouterGroup(abc.ABC):
                         return self._auth_error_response(e)
 
                 elif auth_type == AuthType.USER_TOKEN_OR_API_KEY:
-                    token = quart.request.headers.get('Authorization', '').replace('Bearer ', '')
-                    if token and self._is_support_admin_token(token):
-                        try:
-                            request_context = await self._authenticate_support_admin(token, auth_type)
-                            if request_context is None:
-                                raise AuthenticationDeniedError('Invalid support admin token')
-                            self._require_support_admin_route_allowed(rule, f, permission)
-                            if permission is not None:
-                                require_permission(request_context, permission)
-                            self._inject_handler_context(f, kwargs, None, request_context)
-                        except Exception as e:
-                            return self._auth_error_response(e)
                     # Try API key first (check X-API-Key header)
-                    elif api_key := quart.request.headers.get('X-API-Key', ''):
+                    api_key = quart.request.headers.get('X-API-Key', '')
+
+                    if api_key:
                         # API key authentication
                         try:
                             request_context = await self._authenticate_api_key(api_key, auth_type)
@@ -194,6 +155,8 @@ class RouterGroup(abc.ABC):
                             return self._auth_error_response(e)
                     else:
                         # Try user token authentication (Authorization header)
+                        token = quart.request.headers.get('Authorization', '').replace('Bearer ', '')
+
                         if not token:
                             return self.http_status(
                                 401, -1, 'No valid authentication provided (user token or API key required)'
@@ -305,83 +268,10 @@ class RouterGroup(abc.ABC):
             raise ValueError('User not found')
         return account, account.user
 
-    def _is_support_admin_token(self, token: str) -> bool:
-        service = getattr(self.ap, 'support_admin_session_service', None)
-        detector = getattr(service, 'is_support_admin_token', None)
-        return callable(detector) and detector(token) is True
-
-    async def _authenticate_support_admin(
-        self,
-        token: str,
-        auth_type: AuthType,
-        *,
-        workspace_uuid: str | None = None,
-        request_id: str | None = None,
-    ) -> RequestContext | None:
-        service = getattr(self.ap, 'support_admin_session_service', None)
-        detector = getattr(service, 'is_support_admin_token', None)
-        if service is None or not callable(detector) or detector(token) is not True:
-            return None
-
-        requested_workspace_uuid = (
-            workspace_uuid if workspace_uuid is not None else quart.request.headers.get('X-Workspace-Id')
-        )
-        if not requested_workspace_uuid:
-            raise WorkspaceRequiredError('Support admin token requires an explicit Workspace selector')
-        try:
-            identity = await service.authenticate_token(
-                token,
-                requested_workspace_uuid=requested_workspace_uuid,
-            )
-        except SupportAdminSessionError as exc:
-            raise AuthenticationDeniedError(str(exc)) from exc
-
-        entitlement_revision = await self._resolve_entitlement_revision(
-            identity.instance_uuid,
-            identity.workspace_uuid,
-        )
-        request_context = RequestContext(
-            instance_uuid=identity.instance_uuid,
-            placement_generation=identity.placement_generation,
-            request_id=request_id or self.request_id(),
-            auth_type=auth_type.value,
-            principal=PrincipalContext(
-                principal_type=PrincipalType.SUPPORT_ADMIN,
-                actor_account_uuid=identity.actor_account_uuid,
-                support_session_id=identity.grant_jti_hash,
-            ),
-            workspace=WorkspaceContext(
-                workspace_uuid=identity.workspace_uuid,
-                membership_uuid=None,
-                role='owner',
-                permissions=permissions_for_role('owner') - _SUPPORT_ADMIN_DENIED_PERMISSIONS,
-                membership_revision=0,
-            ),
-            entitlement_revision=entitlement_revision,
-        )
-        quart.g.request_context = request_context
-        quart.g.workspace_membership = None
-        return request_context
-
-    @staticmethod
-    def _require_support_admin_route_allowed(
-        rule: str,
-        handler: RouteCallable,
-        permission: Permission | str | None,
-    ) -> None:
-        parameters = inspect.signature(handler).parameters
-        if rule.startswith('/api/v1/user/') or 'account' in parameters or 'user_email' in parameters:
-            raise AuthenticationDeniedError('Support admin tokens are not permitted on account endpoints')
-        permission_value = permission.value if isinstance(permission, Permission) else permission
-        if permission_value in _SUPPORT_ADMIN_DENIED_PERMISSIONS:
-            raise PermissionDeniedError(permission_value)
-
     async def _resolve_account_context(
         self,
         account: typing.Any,
         auth_type: AuthType,
-        *,
-        token: str | None = None,
     ) -> RequestContext | None:
         collaboration_service = getattr(self.ap, 'workspace_collaboration_service', None)
         account_uuid = getattr(account, 'uuid', None)

src/langbot/pkg/api/http/controller/groups/files.py

@@ -23,13 +23,8 @@ def _storage_owner(context: RequestContext) -> str:
 @group.group_class('files', '/api/v1/files')
 class FilesRouterGroup(group.RouterGroup):
     async def initialize(self) -> None:
-        @self.route(
-            '/image/<path:image_key>',
-            methods=['GET'],
-            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
-            permission=Permission.RESOURCE_VIEW,
-        )
-        async def _(image_key: str, request_context: RequestContext) -> quart.Response:
+        @self.route('/image/<path:image_key>', methods=['GET'], auth_type=group.AuthType.NONE)
+        async def _(image_key: str) -> quart.Response:
             image_bytes = await self.ap.storage_mgr.resolve_public_object(
                 image_key,
                 expected_owner_type='upload_image',

src/langbot/pkg/api/http/controller/groups/pipelines/websocket_chat.py

@@ -97,16 +97,6 @@ class WebSocketChatRouterGroup(group.RouterGroup):
         if not token or not workspace_uuid:
             raise ValueError('Authentication is required')
 
-        support_context = await self._authenticate_support_admin(
-            token,
-            group.AuthType.USER_TOKEN,
-            workspace_uuid=workspace_uuid,
-            request_id=quart.websocket.headers.get('X-Request-Id') or str(uuid.uuid4()),
-        )
-        if support_context is not None:
-            require_permission(support_context, Permission.RUNTIME_OPERATE)
-            return support_context, token
-
         account, _ = await self._authenticate_account(token)
         account_uuid = getattr(account, 'uuid', None)
         collaboration_service = getattr(self.ap, 'workspace_collaboration_service', None)
@@ -138,26 +128,9 @@ class WebSocketChatRouterGroup(group.RouterGroup):
         self,
         request_context: RequestContext,
         token: str,
-    ) -> RequestContext:
+    ) -> None:
         """Recheck revocable account, membership, permission, and placement state."""
 
-        if request_context.principal.principal_type == PrincipalType.SUPPORT_ADMIN:
-            current_context = await self._authenticate_support_admin(
-                token,
-                group.AuthType.USER_TOKEN,
-                workspace_uuid=request_context.workspace_uuid,
-                request_id=request_context.request_id,
-            )
-            if current_context is None or current_context.principal != request_context.principal:
-                raise ValueError('WebSocket support admin session changed')
-            if (
-                current_context.instance_uuid != request_context.instance_uuid
-                or current_context.placement_generation != request_context.placement_generation
-            ):
-                raise ValueError('WebSocket authorization changed')
-            require_permission(current_context, Permission.RUNTIME_OPERATE)
-            return current_context
-
         account, _ = await self._authenticate_account(token)
         account_uuid = getattr(account, 'uuid', None)
         if account_uuid != request_context.account_uuid:
@@ -195,7 +168,6 @@ class WebSocketChatRouterGroup(group.RouterGroup):
             entitlement_revision=request_context.entitlement_revision,
         )
         require_permission(current_context, Permission.RUNTIME_OPERATE)
-        return current_context
 
     async def _get_scoped_adapter(self, request_context: RequestContext, pipeline_uuid: str):
         pipeline = await run_in_workspace_uow(
@@ -238,7 +210,6 @@ class WebSocketChatRouterGroup(group.RouterGroup):
                     scope=WebSocketScope.from_context(request_context),
                     pipeline_uuid=pipeline_uuid,
                     session_type=session_type,
-                    trigger_principal=request_context.principal,
                     metadata={'user_agent': quart.websocket.headers.get('User-Agent', '')},
                     send_queue_size=(
                         self.ap.instance_config.data.get('system', {})
@@ -419,7 +390,7 @@ class WebSocketChatRouterGroup(group.RouterGroup):
                         )
                     elif message_type == 'message':
                         try:
-                            request_context = await self._revalidate_websocket_authorization(request_context, token)
+                            await self._revalidate_websocket_authorization(request_context, token)
                         except Exception:
                             await connection.send_queue.put({'type': 'error', 'message': 'Unauthorized'})
                             break

src/langbot/pkg/api/http/controller/groups/platform/adapters.py

@@ -22,7 +22,6 @@ class _AdapterSessionScope:
     principal_type: str
     account_uuid: str | None
     api_key_uuid: str | None
-    support_session_id: str | None
 
     @classmethod
     def from_request_context(cls, request_context: RequestContext) -> '_AdapterSessionScope':
@@ -34,7 +33,6 @@ class _AdapterSessionScope:
             principal_type=principal.principal_type.value,
             account_uuid=principal.account_uuid,
             api_key_uuid=principal.api_key_uuid,
-            support_session_id=principal.support_session_id,
         )
 
     def matches(self, request_context: RequestContext) -> bool:

src/langbot/pkg/api/http/controller/groups/skills.py

@@ -2,7 +2,6 @@ from __future__ import annotations
 
 import quart
 
-from langbot.pkg.cloud.entitlements import EntitlementFeatureUnavailableError
 from langbot_plugin.box.errors import BoxError
 
 from ...authz import Permission
@@ -24,11 +23,6 @@ class SkillsRouterGroup(group.RouterGroup):
         async def list_skills(request_context: RequestContext) -> quart.Response:
             try:
                 skills = await self.ap.skill_service.list_skills(request_context)
-            except EntitlementFeatureUnavailableError:
-                # Plans without managed sandbox support have no runnable skills.
-                # Treat that capability absence as an empty collection so the
-                # shared UI can render normally instead of surfacing a 500.
-                return self.success(data={'skills': []})
             except (ValueError, BoxError) as exc:
                 return self.http_status(400, -1, str(exc))
             return self.success(data={'skills': skills})

src/langbot/pkg/api/http/controller/groups/user.py

@@ -396,19 +396,6 @@ class UserRouterGroup(group.RouterGroup):
                 launch_assertion,
                 expected_workspace_uuid=workspace_uuid,
             )
-            if launch.get('launch_mode') == 'support_admin':
-                token = launch.get('support_admin_token')
-                if not token:
-                    raise SpaceLaunchError('Support admin launch session was not issued')
-                return self.success(
-                    data={
-                        'token': token,
-                        'workspace_uuid': launch['workspace_uuid'],
-                        'principal_type': 'support_admin',
-                        'actor_account_uuid': launch['actor_account_uuid'],
-                    }
-                )
-
             account = await self.ap.user_service.get_user_by_uuid(launch['account_uuid'])
             if account is None:
                 raise SpaceLaunchError('Launch Account is not projected into Core')

src/langbot/pkg/api/http/controller/groups/workspaces.py

@@ -5,7 +5,7 @@ import typing
 import quart
 
 from ...authz import Permission, permissions_for_role
-from ...context import PrincipalType, RequestContext
+from ...context import RequestContext
 from ...service.user import AccountExistsLoginRequiredError, ControlPlaneDirectoryRequiredError
 from .....entity.persistence.workspace import Workspace, WorkspaceInvitation, WorkspaceMembership
 from .....entity.persistence.workspace import WorkspaceSource
@@ -120,6 +120,9 @@ class WorkspacesRouterGroup(group.RouterGroup):
         @self.route('/current', methods=['GET'], permission=Permission.WORKSPACE_VIEW)
         async def _(request_context: RequestContext) -> typing.Any:
             membership = quart.g.workspace_membership
+            account = await self.ap.user_service.get_user_by_uuid(request_context.account_uuid)
+            if account is None:
+                return self.http_status(401, 'invalid_authentication', 'Account not found')
             workspace = await self.ap.workspace_service.get_workspace(request_context.workspace_uuid)
             plan_name: str | None = None
             resolver = getattr(self.ap, 'entitlement_resolver', None)
@@ -129,28 +132,6 @@ class WorkspacesRouterGroup(group.RouterGroup):
                     minimum_revision=request_context.entitlement_revision,
                 )
                 plan_name = entitlement.plan_name
-            if request_context.principal.principal_type == PrincipalType.SUPPORT_ADMIN:
-                return self.success(
-                    data={
-                        'workspace': _workspace_payload(workspace),
-                        'membership': {
-                            'uuid': None,
-                            'workspace_uuid': request_context.workspace_uuid,
-                            'account_uuid': None,
-                            'email': None,
-                            'role': 'owner',
-                            'status': 'active',
-                            'joined_at': None,
-                            'created_at': None,
-                        },
-                        'permissions': sorted(request_context.workspace.permissions),
-                        'placement_generation': request_context.placement_generation,
-                        'plan_name': plan_name,
-                    }
-                )
-            account = await self.ap.user_service.get_user_by_uuid(request_context.account_uuid)
-            if account is None:
-                return self.http_status(401, 'invalid_authentication', 'Account not found')
             return self.success(
                 data={
                     'workspace': _workspace_payload(workspace),

src/langbot/pkg/api/http/service/knowledge.py

@@ -56,14 +56,6 @@ class KnowledgeService:
         require_workspace_uuid(context)
         # In new architecture, we delegate entirely to RAGManager which uses plugins.
         # Legacy internal KB creation is removed.
-        limitation = (
-            getattr(getattr(self.ap, 'instance_config', None), 'data', {}).get('system', {}).get('limitation', {})
-        )
-        max_knowledge_bases = limitation.get('max_knowledge_bases', -1)
-        if max_knowledge_bases >= 0:
-            knowledge_bases = await self.ap.rag_mgr.get_all_knowledge_base_details(context)
-            if len(knowledge_bases) >= max_knowledge_bases:
-                raise ValueError(f'Maximum number of knowledge bases ({max_knowledge_bases}) reached')
 
         knowledge_engine_plugin_id = kb_data.get('knowledge_engine_plugin_id')
         if not knowledge_engine_plugin_id:

src/langbot/pkg/api/http/service/provider.py

@@ -331,15 +331,8 @@ class ModelProviderService:
         embedding_models = await self.ap.embedding_models_service.get_embedding_models_by_provider(
             context, provider_uuid
         )
-        rerank_service = getattr(self.ap, 'rerank_models_service', None)
-        rerank_models = (
-            await rerank_service.get_rerank_models_by_provider(context, provider_uuid)
-            if rerank_service is not None
-            else []
-        )
         existing_llm_names = {model['name'] for model in llm_models}
         existing_embedding_names = {model['name'] for model in embedding_models}
-        existing_rerank_names = {model['name'] for model in rerank_models}
 
         filtered_models = []
         for model in scanned_models:
@@ -366,8 +359,6 @@ class ModelProviderService:
                     'already_added': (
                         model_name in existing_embedding_names
                         if scanned_type == 'embedding'
-                        else model_name in existing_rerank_names
-                        if scanned_type == 'rerank'
                         else model_name in existing_llm_names
                     ),
                 }

src/langbot/pkg/api/http/service/skill.py

@@ -12,6 +12,7 @@ from urllib.parse import quote, unquote, urlparse
 
 import httpx
 
+from ....cloud.entitlements import EntitlementFeatureUnavailableError
 from ....core import app
 from ....skill.utils import parse_frontmatter
 from ....utils import httpclient
@@ -119,7 +120,13 @@ class SkillService:
         box_service = self._box_service()
         if box_service is None:
             return []
-        return [self._serialize_skill(skill) for skill in await box_service.list_skills(execution_context)]
+        try:
+            skills = await box_service.list_skills(execution_context)
+        except EntitlementFeatureUnavailableError as error:
+            if error.feature == 'managed_sandbox':
+                return []
+            raise
+        return [self._serialize_skill(skill) for skill in skills]
 
     async def get_skill(self, context: TenantContext, skill_name: str) -> Optional[dict]:
         execution_context = await self._execution_context(context)

src/langbot/pkg/api/http/service/user.py

@@ -400,10 +400,7 @@ class UserService:
 
         return await self.generate_jwt_token(user_obj)
 
-    async def generate_jwt_token(
-        self,
-        account: user.User | str,
-    ) -> str:
+    async def generate_jwt_token(self, account: user.User | str) -> str:
         jwt_secret = self.ap.instance_config.data['system']['jwt']['secret']
         jwt_expire = self.ap.instance_config.data['system']['jwt']['expire']
 
@@ -416,7 +413,7 @@ class UserService:
                 # Lightweight unit-test and bootstrap callers may not have persistence wired.
                 account_obj = None
 
-        payload: dict[str, typing.Any] = {
+        payload = {
             'user': user_email,
             'iss': self._jwt_identity()[0],
             'aud': self._jwt_identity()[1],

src/langbot/pkg/cloud/entitlements.py

@@ -18,19 +18,11 @@ class EntitlementUnavailableError(RuntimeError):
 
 
 class EntitlementFeatureUnavailableError(EntitlementUnavailableError):
-    """Raised only when an active entitlement does not grant one feature."""
+    """Raised when an active entitlement explicitly omits a capability."""
 
-    def __init__(
-        self,
-        feature: str,
-        *,
-        entitlement_revision: int | None = None,
-    ) -> None:
+    def __init__(self, message: str, *, feature: str, entitlement_revision: int | None = None) -> None:
+        super().__init__(message, entitlement_revision=entitlement_revision)
         self.feature = feature
-        super().__init__(
-            f'Workspace entitlement does not grant {feature}',
-            entitlement_revision=entitlement_revision,
-        )
 
 
 class EntitlementSnapshot(pydantic.BaseModel):
@@ -99,7 +91,8 @@ class EntitlementSnapshot(pydantic.BaseModel):
     def require_feature(self, feature: str) -> None:
         if self.features.get(feature) is not True:
             raise EntitlementFeatureUnavailableError(
-                feature,
+                f'Workspace entitlement does not grant {feature}',
+                feature=feature,
                 entitlement_revision=self.entitlement_revision,
             )
 

src/langbot/pkg/cloud/launch.py

@@ -15,15 +15,12 @@ from cryptography.exceptions import InvalidSignature
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
 
-from .support_admin import SupportAdminReplayError, SupportAdminSessionError, hash_grant_jti
-
 if typing.TYPE_CHECKING:
     from ..core.app import Application
 
 
 CONTROL_PLANE_TYP = 'langbot-control-plane+jwt'
 LAUNCH_KIND = 'workspace.launch'
-SUPPORT_ADMIN_LAUNCH_KIND = 'workspace.support_admin_launch'
 EXPECTED_ISSUER = 'langbot-space'
 EXPECTED_AUDIENCE = 'langbot-cloud-runtime'
 _CONSUMED_JTI_MAX_ENTRIES = 4096
@@ -126,60 +123,15 @@ class SpaceLaunchService:
         payload = claims.get('payload')
         if not isinstance(payload, dict):
             raise SpaceLaunchError('Launch assertion payload must be a JSON object')
-        kind = _required_string(claims, 'kind')
+        account_uuid = _required_string(payload, 'account_uuid')
         workspace_uuid = _required_string(payload, 'workspace_uuid')
         if expected_workspace_uuid is not None and workspace_uuid != expected_workspace_uuid:
             raise SpaceLaunchError('Launch assertion targets another Workspace')
-        if kind == SUPPORT_ADMIN_LAUNCH_KIND:
-            if 'account_uuid' in payload:
-                raise SpaceLaunchError('Admin launch assertion must not identify a customer Account')
-            if payload.get('launch_mode') != 'support_admin' or payload.get('principal_type') != 'support_admin':
-                raise SpaceLaunchError('Admin launch principal must be support_admin')
-            actor_account_uuid = _required_string(payload, 'actor_account_uuid')
-            if _required_string(payload, 'effective_role') != 'owner':
-                raise SpaceLaunchError('Admin launch effective role must be owner')
-            issued_at = _required_int(claims, 'iat')
-            expires_at = _required_int(claims, 'exp', minimum=1)
-            if expires_at - issued_at > 90:
-                raise SpaceLaunchError('Admin launch assertion lifetime exceeds 90 seconds')
-            grant_jti_hash = hash_grant_jti(_required_string(claims, 'jti'))
-            result = {
-                'workspace_uuid': workspace_uuid,
-                'launch_mode': 'support_admin',
-                'actor_account_uuid': actor_account_uuid,
-                'effective_role': 'owner',
-                'grant_jti_hash': grant_jti_hash,
-            }
-            support_service = getattr(self.ap, 'support_admin_session_service', None)
-            if support_service is None or not callable(getattr(support_service, 'consume_launch_grant', None)):
-                raise SpaceLaunchError('Durable support admin session service is unavailable')
-            try:
-                support_session = await support_service.consume_launch_grant(
-                    grant_jti_hash=grant_jti_hash,
-                    workspace_uuid=workspace_uuid,
-                    actor_account_uuid=actor_account_uuid,
-                )
-            except SupportAdminReplayError as exc:
-                raise SpaceLaunchError('Launch assertion has already been consumed') from exc
-            except SupportAdminSessionError as exc:
-                raise SpaceLaunchError(str(exc)) from exc
-            result['support_admin_token'] = support_session.token
-            self.ap.logger.info(
-                'cloud_support_admin_launch_consumed actor_account_uuid=%s workspace_uuid=%s',
-                result['actor_account_uuid'],
-                workspace_uuid,
-            )
-            return result
-
-        if payload.get('launch_mode') is not None:
-            raise SpaceLaunchError('Launch assertion mode is unsupported')
-        account_uuid = _required_string(payload, 'account_uuid')
-        result = {
+        await self._consume_jti(_required_string(claims, 'jti'), _required_int(claims, 'exp', minimum=1))
+        return {
             'account_uuid': account_uuid,
             'workspace_uuid': workspace_uuid,
         }
-        await self._consume_jti(_required_string(claims, 'jti'), _required_int(claims, 'exp', minimum=1))
-        return result
 
     def _verify_assertion(self, token: str) -> dict[str, typing.Any]:
         if not getattr(getattr(self.ap, 'deployment', None), 'multi_workspace_enabled', False):
@@ -217,9 +169,8 @@ class SpaceLaunchService:
             raise SpaceLaunchError('Launch assertion subject targets another instance')
         if _required_string(claims, 'instance_uuid') != instance_uuid:
             raise SpaceLaunchError('Launch assertion instance UUID does not match this Core')
-        kind = _required_string(claims, 'kind')
-        if kind not in {LAUNCH_KIND, SUPPORT_ADMIN_LAUNCH_KIND}:
-            raise SpaceLaunchError('Launch assertion kind is not supported')
+        if _required_string(claims, 'kind') != LAUNCH_KIND:
+            raise SpaceLaunchError('Launch assertion kind is not workspace.launch')
 
         issued_at = _required_int(claims, 'iat')
         not_before = _required_int(claims, 'nbf')

src/langbot/pkg/cloud/support_admin.py

@@ -1,248 +0,0 @@
-from __future__ import annotations
-
-import dataclasses
-import datetime
-import hashlib
-import re
-import time
-import typing
-
-import jwt
-from sqlalchemy.exc import IntegrityError
-
-from ..entity.persistence.support_admin import SupportAdminTemporarySession
-from ..workspace.errors import WorkspaceError
-
-if typing.TYPE_CHECKING:
-    from ..core.app import Application
-
-
-SUPPORT_ADMIN_TOKEN_TYP = 'langbot-support-admin+jwt'
-SUPPORT_ADMIN_TOKEN_KIND = 'support_admin.session'
-SUPPORT_ADMIN_EFFECTIVE_ROLE = 'owner'
-SUPPORT_ADMIN_MAX_TOKEN_SECONDS = 300
-_SHA256_HEX = re.compile(r'^[0-9a-f]{64}$')
-
-
-class SupportAdminSessionError(ValueError):
-    """Raised when a support-admin session or token is not admissible."""
-
-
-class SupportAdminReplayError(SupportAdminSessionError):
-    """Raised when a launch grant JTI has already been consumed."""
-
-
-@dataclasses.dataclass(frozen=True, slots=True)
-class IssuedSupportAdminSession:
-    token: str
-    grant_jti_hash: str
-    workspace_uuid: str
-    actor_account_uuid: str
-    issued_at: datetime.datetime
-    expires_at: datetime.datetime
-
-
-@dataclasses.dataclass(frozen=True, slots=True)
-class SupportAdminSessionIdentity:
-    grant_jti_hash: str
-    workspace_uuid: str
-    actor_account_uuid: str
-    instance_uuid: str
-    placement_generation: int
-
-
-def hash_grant_jti(jti: str) -> str:
-    return hashlib.sha256(jti.encode('utf-8')).hexdigest()
-
-
-class SupportAdminSessionService:
-    """Issue and validate temporary Workspace-scoped support-admin sessions."""
-
-    def __init__(
-        self,
-        ap: Application,
-        *,
-        wall_time: typing.Callable[[], float] = time.time,
-    ) -> None:
-        self.ap = ap
-        self._wall_time = wall_time
-
-    async def consume_launch_grant(
-        self,
-        *,
-        grant_jti_hash: str,
-        workspace_uuid: str,
-        actor_account_uuid: str,
-    ) -> IssuedSupportAdminSession:
-        self._validate_grant_hash(grant_jti_hash)
-        if not workspace_uuid or not actor_account_uuid:
-            raise SupportAdminSessionError('Support admin session requires an actor and Workspace')
-
-        issued_at = self._utcnow()
-        expires_at = issued_at + datetime.timedelta(seconds=SUPPORT_ADMIN_MAX_TOKEN_SECONDS)
-        tenant_uow = getattr(self.ap.persistence_mgr, 'tenant_uow', None)
-        if not callable(tenant_uow):
-            raise SupportAdminSessionError('Support admin sessions require tenant persistence')
-
-        try:
-            async with tenant_uow(workspace_uuid) as uow:
-                await self.ap.workspace_service.get_execution_binding(workspace_uuid, session=uow.session)
-                uow.session.add(
-                    SupportAdminTemporarySession(
-                        grant_jti_hash=grant_jti_hash,
-                        workspace_uuid=workspace_uuid,
-                        actor_account_uuid=actor_account_uuid,
-                        issued_at=issued_at,
-                        expires_at=expires_at,
-                    )
-                )
-                await uow.session.flush()
-        except IntegrityError as exc:
-            raise SupportAdminReplayError('Launch assertion has already been consumed') from exc
-        except WorkspaceError as exc:
-            raise SupportAdminSessionError('Workspace is unavailable for support access') from exc
-
-        return IssuedSupportAdminSession(
-            token=self._encode_token(
-                grant_jti_hash=grant_jti_hash,
-                workspace_uuid=workspace_uuid,
-                actor_account_uuid=actor_account_uuid,
-                issued_at=issued_at,
-                expires_at=expires_at,
-            ),
-            grant_jti_hash=grant_jti_hash,
-            workspace_uuid=workspace_uuid,
-            actor_account_uuid=actor_account_uuid,
-            issued_at=issued_at,
-            expires_at=expires_at,
-        )
-
-    def is_support_admin_token(self, token: str) -> bool:
-        """Return True only for compact JWTs marked as support-admin tokens."""
-
-        if not isinstance(token, str) or token.count('.') != 2:
-            return False
-        try:
-            header = jwt.get_unverified_header(token)
-        except jwt.PyJWTError:
-            return False
-        if header.get('typ') == SUPPORT_ADMIN_TOKEN_TYP:
-            return True
-        try:
-            payload = jwt.decode(token, options={'verify_signature': False})
-        except jwt.PyJWTError:
-            return False
-        return payload.get('kind') == SUPPORT_ADMIN_TOKEN_KIND
-
-    async def authenticate_token(
-        self,
-        token: str,
-        *,
-        requested_workspace_uuid: str | None,
-    ) -> SupportAdminSessionIdentity:
-        if not self.is_support_admin_token(token):
-            raise SupportAdminSessionError('Not a support admin token')
-        workspace_uuid = (requested_workspace_uuid or '').strip()
-        if not workspace_uuid:
-            raise SupportAdminSessionError('Support admin token requires an explicit Workspace selector')
-
-        jwt_secret = self.ap.instance_config.data['system']['jwt']['secret']
-        try:
-            payload = jwt.decode(
-                token,
-                jwt_secret,
-                algorithms=['HS256'],
-                issuer='langbot-core',
-                audience=self._audience(workspace_uuid),
-                options={'require': ['exp', 'iat', 'nbf', 'iss', 'aud']},
-            )
-        except jwt.PyJWTError as exc:
-            raise SupportAdminSessionError('Invalid support admin token') from exc
-        self._validate_payload(payload, workspace_uuid)
-        grant_jti_hash = payload['grant_jti_hash']
-        actor_account_uuid = payload['actor_account_uuid']
-
-        tenant_uow = getattr(self.ap.persistence_mgr, 'tenant_uow', None)
-        if not callable(tenant_uow):
-            raise SupportAdminSessionError('Support admin sessions require tenant persistence')
-
-        now = self._utcnow()
-        async with tenant_uow(workspace_uuid) as uow:
-            session = await uow.session.get(SupportAdminTemporarySession, grant_jti_hash)
-            if (
-                session is None
-                or session.workspace_uuid != workspace_uuid
-                or session.actor_account_uuid != actor_account_uuid
-                or session.revoked_at is not None
-                or session.expires_at <= now
-            ):
-                raise SupportAdminSessionError('Support admin session is inactive')
-            binding = await self.ap.workspace_service.get_execution_binding(workspace_uuid, session=uow.session)
-            session.last_used_at = now
-            await uow.session.flush()
-
-        return SupportAdminSessionIdentity(
-            grant_jti_hash=grant_jti_hash,
-            workspace_uuid=workspace_uuid,
-            actor_account_uuid=actor_account_uuid,
-            instance_uuid=binding.instance_uuid,
-            placement_generation=binding.placement_generation,
-        )
-
-    async def revoke_session(self, grant_jti_hash: str, workspace_uuid: str) -> None:
-        self._validate_grant_hash(grant_jti_hash)
-        now = self._utcnow()
-        async with self.ap.persistence_mgr.tenant_uow(workspace_uuid) as uow:
-            row = await uow.session.get(SupportAdminTemporarySession, grant_jti_hash)
-            if row is not None and row.revoked_at is None:
-                row.revoked_at = now
-
-    def _encode_token(
-        self,
-        *,
-        grant_jti_hash: str,
-        workspace_uuid: str,
-        actor_account_uuid: str,
-        issued_at: datetime.datetime,
-        expires_at: datetime.datetime,
-    ) -> str:
-        jwt_secret = self.ap.instance_config.data['system']['jwt']['secret']
-        payload: dict[str, typing.Any] = {
-            'kind': SUPPORT_ADMIN_TOKEN_KIND,
-            'iss': 'langbot-core',
-            'aud': self._audience(workspace_uuid),
-            'sub': f'support-admin:{actor_account_uuid}',
-            'iat': issued_at,
-            'nbf': issued_at,
-            'exp': expires_at,
-            'actor_account_uuid': actor_account_uuid,
-            'workspace_uuid': workspace_uuid,
-            'effective_role': SUPPORT_ADMIN_EFFECTIVE_ROLE,
-            'grant_jti_hash': grant_jti_hash,
-        }
-        return jwt.encode(payload, jwt_secret, algorithm='HS256', headers={'typ': SUPPORT_ADMIN_TOKEN_TYP})
-
-    def _validate_payload(self, payload: dict[str, typing.Any], workspace_uuid: str) -> None:
-        if payload.get('kind') != SUPPORT_ADMIN_TOKEN_KIND:
-            raise SupportAdminSessionError('Invalid support admin token kind')
-        if payload.get('workspace_uuid') != workspace_uuid:
-            raise SupportAdminSessionError('Support admin session is scoped to another Workspace')
-        if payload.get('effective_role') != SUPPORT_ADMIN_EFFECTIVE_ROLE:
-            raise SupportAdminSessionError('Invalid support admin token role')
-        actor_account_uuid = payload.get('actor_account_uuid')
-        if not isinstance(actor_account_uuid, str) or not actor_account_uuid.strip():
-            raise SupportAdminSessionError('Invalid support admin actor')
-        grant_jti_hash = payload.get('grant_jti_hash')
-        if not isinstance(grant_jti_hash, str) or not _SHA256_HEX.match(grant_jti_hash):
-            raise SupportAdminSessionError('Invalid support admin grant')
-
-    def _audience(self, workspace_uuid: str) -> str:
-        return f'langbot-support-admin:{self.ap.workspace_service.instance_uuid}:{workspace_uuid}'
-
-    @staticmethod
-    def _validate_grant_hash(grant_jti_hash: str) -> None:
-        if not _SHA256_HEX.match(grant_jti_hash):
-            raise SupportAdminSessionError('Invalid support admin grant')
-
-    def _utcnow(self) -> datetime.datetime:
-        return datetime.datetime.fromtimestamp(self._wall_time(), datetime.UTC).replace(tzinfo=None)

src/langbot/pkg/core/app.py

@@ -51,7 +51,6 @@ from ..workspace import collaboration as workspace_collaboration_module
 from ..workspace import invitation_delivery as invitation_delivery_module
 from ..cloud import bootstrap as cloud_bootstrap_module
 from ..cloud import launch as cloud_launch_module
-from ..cloud import support_admin as cloud_support_admin_module
 from ..cloud import directory_projection as cloud_directory_projection_module
 from ..cloud import entitlements as cloud_entitlements_module
 from ..api.http.context import ExecutionContext, PrincipalContext, PrincipalType
@@ -137,8 +136,6 @@ class Application:
 
     space_launch_service: cloud_launch_module.SpaceLaunchService = None
 
-    support_admin_session_service: cloud_support_admin_module.SupportAdminSessionService = None
-
     deployment: cloud_bootstrap_module.OpenSourceDeployment | cloud_bootstrap_module.VerifiedCloudDeployment = None
 
     deployment_admission: cloud_bootstrap_module.DeploymentAdmissionGuard = None

src/langbot/pkg/core/stages/build_app.py

@@ -42,7 +42,6 @@ from ...workspace import collaboration as workspace_collaboration_module
 from ...workspace import invitation_delivery as invitation_delivery_module
 from ...cloud import bootstrap as cloud_bootstrap
 from ...cloud import launch as cloud_launch_module
-from ...cloud import support_admin as cloud_support_admin_module
 from ...cloud.directory import directory_projection_limits_from_config
 from ...cloud.directory_projection import DirectoryProjectionService
 from ...cloud.entitlements import EntitlementResolver
@@ -181,7 +180,6 @@ class BuildAppStage(stage.BootingStage):
             workspace_service_inst,
         )
         ap.invitation_delivery_service = invitation_delivery_module.InvitationDeliveryService(ap)
-        ap.support_admin_session_service = cloud_support_admin_module.SupportAdminSessionService(ap)
         ap.space_launch_service = cloud_launch_module.SpaceLaunchService(ap)
 
         user_service_inst = user_service.UserService(ap)

src/langbot/pkg/entity/persistence/support_admin.py

@@ -1,35 +0,0 @@
-from __future__ import annotations
-
-import sqlalchemy
-
-from .base import Base
-
-
-class SupportAdminTemporarySession(Base):
-    """Temporary support-admin Workspace access session."""
-
-    __tablename__ = 'support_admin_temporary_sessions'
-
-    grant_jti_hash = sqlalchemy.Column(sqlalchemy.String(64), primary_key=True)
-    workspace_uuid = sqlalchemy.Column(
-        sqlalchemy.String(36),
-        sqlalchemy.ForeignKey('workspaces.uuid', ondelete='CASCADE'),
-        nullable=False,
-    )
-    actor_account_uuid = sqlalchemy.Column(sqlalchemy.String(36), nullable=False)
-    issued_at = sqlalchemy.Column(sqlalchemy.DateTime, nullable=False)
-    expires_at = sqlalchemy.Column(sqlalchemy.DateTime, nullable=False)
-    revoked_at = sqlalchemy.Column(sqlalchemy.DateTime, nullable=True)
-    last_used_at = sqlalchemy.Column(sqlalchemy.DateTime, nullable=True)
-
-    __table_args__ = (
-        sqlalchemy.Index(
-            'ix_support_admin_sessions_workspace_expiry',
-            'workspace_uuid',
-            'expires_at',
-        ),
-        sqlalchemy.CheckConstraint(
-            'length(grant_jti_hash) = 64',
-            name='ck_support_admin_sessions_grant_jti_hash',
-        ),
-    )

src/langbot/pkg/persistence/alembic/versions/0016_support_admin_sessions.py

@@ -1,88 +0,0 @@
-"""add temporary support-admin sessions
-
-Revision ID: 0016_support_admin_sessions
-Revises: 0015_cloud_core_collab
-Create Date: 2026-07-31
-"""
-
-from __future__ import annotations
-
-import sqlalchemy as sa
-from alembic import op
-
-
-revision = '0016_support_admin_sessions'
-down_revision = '0015_cloud_core_collab'
-branch_labels = None
-depends_on = None
-
-
-_TABLE_NAME = 'support_admin_temporary_sessions'
-_POLICY_NAME = 'langbot_workspace_isolation'
-_TENANT_SETTING = 'langbot.workspace_uuid'
-
-
-def _setting(name: str) -> str:
-    return f"NULLIF(current_setting('{name}', true), '')"
-
-
-def _quote(conn: sa.Connection, identifier: str) -> str:
-    return conn.dialect.identifier_preparer.quote(identifier)
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-    existing_tables = set(sa.inspect(conn).get_table_names())
-    if _TABLE_NAME not in existing_tables:
-        op.create_table(
-            _TABLE_NAME,
-            sa.Column('grant_jti_hash', sa.String(64), nullable=False),
-            sa.Column(
-                'workspace_uuid',
-                sa.String(36),
-                sa.ForeignKey('workspaces.uuid', ondelete='CASCADE'),
-                nullable=False,
-            ),
-            sa.Column('actor_account_uuid', sa.String(36), nullable=False),
-            sa.Column('issued_at', sa.DateTime(), nullable=False),
-            sa.Column('expires_at', sa.DateTime(), nullable=False),
-            sa.Column('revoked_at', sa.DateTime(), nullable=True),
-            sa.Column('last_used_at', sa.DateTime(), nullable=True),
-            sa.CheckConstraint(
-                'length(grant_jti_hash) = 64',
-                name='ck_support_admin_sessions_grant_jti_hash',
-            ),
-            sa.PrimaryKeyConstraint('grant_jti_hash'),
-        )
-        op.create_index(
-            'ix_support_admin_sessions_workspace_expiry',
-            _TABLE_NAME,
-            ['workspace_uuid', 'expires_at'],
-            unique=False,
-        )
-
-    if conn.dialect.name != 'postgresql':
-        return
-
-    table = _quote(conn, _TABLE_NAME)
-    policy = _quote(conn, _POLICY_NAME)
-    expression = f'workspace_uuid::text = {_setting(_TENANT_SETTING)}'
-    op.execute(sa.text(f'ALTER TABLE {table} ENABLE ROW LEVEL SECURITY'))
-    op.execute(sa.text(f'ALTER TABLE {table} FORCE ROW LEVEL SECURITY'))
-    op.execute(sa.text(f'DROP POLICY IF EXISTS {policy} ON {table}'))
-    op.execute(
-        sa.text(
-            f'CREATE POLICY {policy} ON {table} AS PERMISSIVE FOR ALL TO PUBLIC '
-            f'USING ({expression}) WITH CHECK ({expression})'
-        )
-    )
-
-
-def downgrade() -> None:
-    conn = op.get_bind()
-    if conn.dialect.name == 'postgresql':
-        table = _quote(conn, _TABLE_NAME)
-        policy = _quote(conn, _POLICY_NAME)
-        op.execute(sa.text(f'DROP POLICY IF EXISTS {policy} ON {table}'))
-    op.drop_index('ix_support_admin_sessions_workspace_expiry', table_name=_TABLE_NAME)
-    op.drop_table(_TABLE_NAME)

src/langbot/pkg/persistence/mgr.py

@@ -54,7 +54,6 @@ _ALEMBIC_TENANT_TABLES = {
     'workspace_memberships',
     'workspace_invitations',
     'workspace_execution_states',
-    'support_admin_temporary_sessions',
     'workspace_metadata',
     'api_keys',
     'bots',

src/langbot/pkg/persistence/tenant_uow.py

@@ -43,7 +43,6 @@ TENANT_TABLE_COLUMNS: dict[str, str] = {
     'workspace_memberships': 'workspace_uuid',
     'workspace_invitations': 'workspace_uuid',
     'workspace_execution_states': 'workspace_uuid',
-    'support_admin_temporary_sessions': 'workspace_uuid',
     'workspace_metadata': 'workspace_uuid',
     'api_keys': 'workspace_uuid',
     'bots': 'workspace_uuid',

src/langbot/pkg/pipeline/process/handlers/command.py

@@ -1,12 +1,10 @@
 from __future__ import annotations
 import typing
 
-import sqlalchemy
 
 from .. import handler
 from ... import entities
 from ... import plugin_diagnostics
-from ....entity.persistence.bot import BotAdmin
 import langbot_plugin.api.entities.builtin.provider.message as provider_message
 import langbot_plugin.api.entities.builtin.provider.session as provider_session
 import langbot_plugin.api.entities.builtin.pipeline.query as pipeline_query
@@ -26,14 +24,7 @@ class CommandHandler(handler.MessageHandler):
 
         privilege = 1
 
-        admins = await self.ap.persistence_mgr.execute_async(
-            sqlalchemy.select(BotAdmin).where(
-                BotAdmin.bot_uuid == (query.bot_uuid or ''),
-                BotAdmin.launcher_type == query.launcher_type.value,
-                BotAdmin.launcher_id == str(query.launcher_id),
-            )
-        )
-        if admins.first() is not None:
+        if f'{query.launcher_type.value}_{query.launcher_id}' in self.ap.instance_config.data['admins']:
             privilege = 2
 
         spt = command_text.split(' ')

src/langbot/pkg/platform/sources/aiocqhttp.py

@@ -241,11 +241,7 @@ class AiocqhttpMessageConverter(abstract_platform_adapter.AbstractMessageConvert
         async def process_message_data(msg_data, reply_list):
             if msg_data['type'] == 'image':
                 image_base64, image_format = await image.qq_image_url_to_base64(msg_data['data']['url'])
-                reply_list.append(
-                    platform_message.Image(
-                        url=msg_data['data']['url'], base64=f'data:image/{image_format};base64,{image_base64}'
-                    )
-                )
+                reply_list.append(platform_message.Image(base64=f'data:image/{image_format};base64,{image_base64}'))
 
             elif msg_data['type'] == 'text':
                 reply_list.append(platform_message.Plain(text=msg_data['data']['text']))
@@ -290,9 +286,7 @@ class AiocqhttpMessageConverter(abstract_platform_adapter.AbstractMessageConvert
                     image_msg = platform_message.Face(face_id=face_id, face_name=face_name)
                 else:
                     image_base64, image_format = await image.qq_image_url_to_base64(msg.data['url'])
-                    image_msg = platform_message.Image(
-                        url=msg.data['url'], base64=f'data:image/{image_format};base64,{image_base64}'
-                    )
+                    image_msg = platform_message.Image(base64=f'data:image/{image_format};base64,{image_base64}')
                 yiri_msg_list.append(image_msg)
             elif msg.type == 'forward':
                 # 暂时不太合理

src/langbot/pkg/platform/sources/discord.py

@@ -764,9 +764,7 @@ class DiscordMessageConverter(abstract_platform_adapter.AbstractMessageConverter
                 )
                 image_base64 = (await asyncio.to_thread(base64.b64encode, image_data)).decode('utf-8')
                 image_format = response.headers['Content-Type']
-                element_list.append(
-                    platform_message.Image(url=attachment.url, base64=f'data:{image_format};base64,{image_base64}')
-                )
+                element_list.append(platform_message.Image(base64=f'data:{image_format};base64,{image_base64}'))
 
         return platform_message.MessageChain(element_list)
 

src/langbot/pkg/platform/sources/qqofficial.py

@@ -102,7 +102,7 @@ class QQOfficialMessageConverter(abstract_platform_adapter.AbstractMessageConver
         yiri_msg_list.append(platform_message.Source(id=message_id, time=datetime.datetime.now()))
         if pic_url is not None:
             base64_url = await image.get_qq_official_image_base64(pic_url=pic_url, content_type=content_type)
-            yiri_msg_list.append(platform_message.Image(url=pic_url, base64=base64_url))
+            yiri_msg_list.append(platform_message.Image(base64=base64_url))
 
         yiri_msg_list.append(platform_message.Plain(text=message))
         chain = platform_message.MessageChain(yiri_msg_list)

src/langbot/pkg/platform/sources/slack.py

@@ -47,7 +47,7 @@ class SlackMessageConverter(abstract_platform_adapter.AbstractMessageConverter):
         yiri_msg_list.append(platform_message.Source(id=message_id, time=datetime.datetime.now()))
         if pic_url is not None:
             base64_url = await image.get_slack_image_to_base64(pic_url=pic_url, bot_token=bot.bot_token)
-            yiri_msg_list.append(platform_message.Image(url=pic_url, base64=base64_url))
+            yiri_msg_list.append(platform_message.Image(base64=base64_url))
 
         yiri_msg_list.append(platform_message.Plain(text=message))
         chain = platform_message.MessageChain(yiri_msg_list)

src/langbot/pkg/platform/sources/telegram.py

@@ -181,10 +181,7 @@ class TelegramMessageConverter(abstract_platform_adapter.AbstractMessageConverte
 
             encoded = await asyncio.to_thread(base64.b64encode, file_bytes)
             message_components.append(
-                platform_message.Image(
-                    url=file.file_path,
-                    base64=f'data:{file_format};base64,{encoded.decode("utf-8")}',
-                )
+                platform_message.Image(base64=f'data:{file_format};base64,{encoded.decode("utf-8")}')
             )
 
         if message.voice:

src/langbot/pkg/platform/sources/websocket_manager.py

@@ -9,7 +9,7 @@ from datetime import datetime
 
 import pydantic
 
-from ...api.http.context import ExecutionContext, PrincipalContext
+from ...api.http.context import ExecutionContext
 
 logger = logging.getLogger(__name__)
 _SESSION_FILTER_UNSET = object()
@@ -95,9 +95,6 @@ class WebSocketConnection(pydantic.BaseModel):
     metadata: dict = pydantic.Field(default_factory=dict)
     """连接元数据（可存储额外信息）"""
 
-    trigger_principal: PrincipalContext | None = None
-    """Authenticated principal that opened this dashboard connection."""
-
     @property
     def scope(self) -> WebSocketScope:
         return WebSocketScope(
@@ -115,7 +112,6 @@ class WebSocketConnection(pydantic.BaseModel):
             workspace_uuid=self.workspace_uuid,
             placement_generation=self.placement_generation,
             pipeline_uuid=self.pipeline_uuid,
-            trigger_principal=self.trigger_principal,
         )
 
 
@@ -142,7 +138,6 @@ class WebSocketConnectionManager:
         pipeline_uuid: str,
         session_type: str,
         metadata: dict | None = None,
-        trigger_principal: PrincipalContext | None = None,
         session_id: str | None = None,
         send_queue_size: int = _DEFAULT_SEND_QUEUE_SIZE,
         max_connections: int = 1024,
@@ -179,7 +174,6 @@ class WebSocketConnectionManager:
                 session_id=session_id,
                 websocket=websocket,
                 metadata=metadata or {},
-                trigger_principal=trigger_principal,
                 send_queue=asyncio.Queue(maxsize=send_queue_size),
             )
 

src/langbot/pkg/platform/sources/wecom.py

@@ -133,9 +133,7 @@ class WecomMessageConverter(abstract_platform_adapter.AbstractMessageConverter):
         yiri_msg_list = []
         yiri_msg_list.append(platform_message.Source(id=message_id, time=datetime.datetime.now()))
         image_base64, image_format = await image.get_wecom_image_base64(pic_url=picurl)
-        yiri_msg_list.append(
-            platform_message.Image(url=picurl, base64=f'data:image/{image_format};base64,{image_base64}')
-        )
+        yiri_msg_list.append(platform_message.Image(base64=f'data:image/{image_format};base64,{image_base64}'))
         chain = platform_message.MessageChain(yiri_msg_list)
 
         return chain

src/langbot/pkg/provider/modelmgr/modelmgr.py

@@ -529,7 +529,6 @@ class ModelManager:
             model['uuid']: model
             for model in await self.ap.embedding_models_service.get_embedding_models(context, include_secret=True)
         }
-        existing_rerank_models = {m['uuid']: m for m in await self.ap.rerank_models_service.get_rerank_models(context)}
 
         created = 0
         updated = 0
@@ -598,36 +597,6 @@ class ModelManager:
                         )
                         updated += 1
 
-            elif space_model.category == 'rerank':
-                existing = existing_rerank_models.get(space_model.uuid)
-                if existing is None:
-                    await self.ap.rerank_models_service.create_rerank_model(
-                        context,
-                        {
-                            'uuid': space_model.uuid,
-                            'name': space_model.model_id,
-                            'provider_uuid': space_model_provider.uuid,
-                            'extra_args': {},
-                            'prefered_ranking': space_model.featured_order,
-                        },
-                        preserve_uuid=True,
-                    )
-                    created += 1
-                elif existing.get('provider_uuid') == space_model_provider.uuid:
-                    desired = {
-                        'name': space_model.model_id,
-                        'provider_uuid': space_model_provider.uuid,
-                        'prefered_ranking': space_model.featured_order,
-                    }
-                    if (
-                        existing.get('name') != desired['name']
-                        or existing.get('prefered_ranking') != desired['prefered_ranking']
-                    ):
-                        await self.ap.rerank_models_service.update_rerank_model(
-                            context, space_model.uuid, dict(desired)
-                        )
-                        updated += 1
-
         if created or updated:
             self.ap.logger.info(f'Synced models from LangBot Space: {created} added, {updated} updated.')
 

src/langbot/pkg/provider/modelmgr/requesters/litellmchat.py

@@ -944,21 +944,16 @@ class LiteLLMRequester(requester.ProviderAPIRequester):
         if api_key:
             headers['Authorization'] = f'Bearer {api_key}'
 
-        request_args = dict(extra_args)
-        rerank_url = request_args.pop('rerank_url', None)
-        rerank_path = request_args.pop('rerank_path', 'rerank')
-
         payload: dict[str, typing.Any] = {
             'model': model_name,
             'query': query,
             'documents': documents,
             'top_n': top_n,
         }
-        if request_args:
-            payload.update(request_args)
+        if extra_args:
+            payload.update(extra_args)
 
-        if not rerank_url:
-            rerank_url = f'{base_url}/{str(rerank_path).strip("/")}'
+        rerank_url = f'{base_url}/rerank'
 
         try:
             async with httpx.AsyncClient(

src/langbot/pkg/workspace/collaboration.py

@@ -499,14 +499,14 @@ class WorkspaceCollaborationService:
             return await self._run(operation, session=session)
 
     @asynccontextmanager
-    async def _invitation_lock(self, lock_key: str):
-        """Serialize one token within workspace scope while retaining only active lock entries."""
+    async def _invitation_lock(self, token_digest: str):
+        """Serialize one token while retaining only active lock entries."""
 
         async with self._invitation_locks_guard:
-            entry = self._invitation_locks.get(lock_key)
+            entry = self._invitation_locks.get(token_digest)
             if entry is None:
                 entry = _InvitationLockEntry(lock=asyncio.Lock())
-                self._invitation_locks[lock_key] = entry
+                self._invitation_locks[token_digest] = entry
             entry.users += 1
 
         await entry.lock.acquire()
@@ -517,7 +517,7 @@ class WorkspaceCollaborationService:
             async with self._invitation_locks_guard:
                 entry.users -= 1
                 if entry.users == 0:
-                    self._invitation_locks.pop(lock_key, None)
+                    self._invitation_locks.pop(token_digest, None)
 
     async def revoke_invitation(
         self,

src/langbot/templates/config.yaml

@@ -105,7 +105,6 @@ system:
         max_bots: -1
         max_pipelines: -1
         max_extensions: -1
-        max_knowledge_bases: -1
         # When set to a non-empty string, every pipeline is forced to use this
         # Box sandbox-scope template regardless of its own configuration, and
         # the per-pipeline "Sandbox Scope" selector is locked in the web UI.

tests/integration/api/test_skills_entitlements.py

@@ -1,79 +0,0 @@
-"""Skills API behavior when a workspace plan has no managed sandbox."""
-
-from __future__ import annotations
-
-from types import SimpleNamespace
-from unittest.mock import AsyncMock, Mock
-
-import pytest
-import quart
-
-from langbot.pkg.api.http.controller.groups.skills import SkillsRouterGroup
-from langbot.pkg.cloud.entitlements import (
-    EntitlementFeatureUnavailableError,
-    EntitlementUnavailableError,
-)
-
-pytestmark = pytest.mark.integration
-WORKSPACE_UUID = '11111111-1111-4111-8111-111111111111'
-
-
-@pytest.fixture
-async def skills_api():
-    account = SimpleNamespace(uuid='owner-account', user='owner@example.com')
-    access = SimpleNamespace(
-        workspace=SimpleNamespace(uuid=WORKSPACE_UUID),
-        membership=SimpleNamespace(uuid='member-owner', role='owner', projection_revision=1),
-        execution=SimpleNamespace(instance_uuid='instance-a', placement_generation=1),
-    )
-    application = Mock()
-    application.deployment = SimpleNamespace(multi_workspace_enabled=False)
-    application.persistence_mgr = SimpleNamespace(tenant_uow=None)
-    application.user_service.get_authenticated_account = AsyncMock(return_value=account)
-    application.workspace_collaboration_service.resolve_account_workspace = AsyncMock(return_value=access)
-    application.skill_service.list_skills = AsyncMock(
-        side_effect=EntitlementFeatureUnavailableError(
-            'managed_sandbox',
-            entitlement_revision=1,
-        )
-    )
-
-    quart_app = quart.Quart(__name__)
-    router = SkillsRouterGroup(application, quart_app)
-    await router.initialize()
-    return application, quart_app.test_client()
-
-
-@pytest.mark.asyncio
-async def test_list_skills_is_empty_when_plan_has_no_managed_sandbox(skills_api):
-    application, client = skills_api
-    response = await client.get(
-        '/api/v1/skills',
-        headers={
-            'Authorization': 'Bearer owner-token',
-            'X-Workspace-Id': WORKSPACE_UUID,
-        },
-    )
-
-    assert response.status_code == 200
-    payload = await response.get_json()
-    assert payload['data'] == {'skills': []}
-    application.skill_service.list_skills.assert_awaited_once()
-
-
-@pytest.mark.asyncio
-async def test_list_skills_does_not_hide_other_entitlement_failures(skills_api):
-    application, client = skills_api
-    application.skill_service.list_skills.side_effect = EntitlementUnavailableError(
-        'Workspace entitlement revision rolled back'
-    )
-
-    response = await client.get(
-        '/api/v1/skills',
-        headers={
-            'Authorization': 'Bearer owner-token',
-            'X-Workspace-Id': WORKSPACE_UUID,
-        },
-    )
-
-    assert response.status_code == 500

tests/integration/api/test_support_admin_launch.py

@@ -1,453 +0,0 @@
-from __future__ import annotations
-
-import base64
-import datetime
-import json
-import logging
-import time
-import uuid
-from types import SimpleNamespace
-from unittest.mock import AsyncMock
-
-import pytest
-import sqlalchemy
-from cryptography.hazmat.primitives import serialization
-from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
-from quart import Quart
-from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
-
-from langbot.pkg.api.http.authz import Permission
-from langbot.pkg.api.http.context import PrincipalType, RequestContext
-from langbot.pkg.api.http.controller import group
-from langbot.pkg.api.http.controller.groups.pipelines.websocket_chat import WebSocketChatRouterGroup
-from langbot.pkg.api.http.controller.groups.user import UserRouterGroup
-from langbot.pkg.cloud.launch import SpaceLaunchError, SpaceLaunchService
-from langbot.pkg.cloud.support_admin import SupportAdminSessionService
-from langbot.pkg.entity.persistence.base import Base
-from langbot.pkg.entity.persistence.support_admin import SupportAdminTemporarySession
-from langbot.pkg.entity.persistence.user import User
-from langbot.pkg.entity.persistence.workspace import (
-    Workspace,
-    WorkspaceExecutionState,
-    WorkspaceMembership,
-)
-from langbot.pkg.workspace.service import WorkspaceService
-
-
-pytestmark = [pytest.mark.integration, pytest.mark.asyncio]
-
-
-INSTANCE_UUID = 'instance-support-admin'
-WORKSPACE_UUID = '10000000-0000-4000-8000-000000000001'
-OTHER_WORKSPACE_UUID = '10000000-0000-4000-8000-000000000002'
-ACTOR_ACCOUNT_UUID = '20000000-0000-4000-8000-000000000001'
-KEY_ID = 'support-admin-key-1'
-
-
-def _base64url(raw: bytes) -> str:
-    return base64.urlsafe_b64encode(raw).rstrip(b'=').decode('ascii')
-
-
-def _sign(private_key: Ed25519PrivateKey, claims: dict, *, key_id: str = KEY_ID) -> str:
-    header = {'alg': 'EdDSA', 'kid': key_id, 'typ': 'langbot-control-plane+jwt'}
-    encoded_header = _base64url(json.dumps(header, separators=(',', ':')).encode('utf-8'))
-    encoded_claims = _base64url(json.dumps(claims, separators=(',', ':')).encode('utf-8'))
-    signing_input = f'{encoded_header}.{encoded_claims}'
-    return f'{signing_input}.{_base64url(private_key.sign(signing_input.encode("ascii")))}'
-
-
-def _admin_claims(*, now: int, jti: str | None = None, workspace_uuid: str = WORKSPACE_UUID) -> dict:
-    return {
-        'iss': 'langbot-space',
-        'aud': 'langbot-cloud-runtime',
-        'sub': f'langbot-instance:{INSTANCE_UUID}',
-        'jti': jti or str(uuid.uuid4()),
-        'iat': now,
-        'nbf': now - 5,
-        'exp': now + 90,
-        'instance_uuid': INSTANCE_UUID,
-        'kind': 'workspace.support_admin_launch',
-        'payload': {
-            'workspace_uuid': workspace_uuid,
-            'launch_mode': 'support_admin',
-            'principal_type': 'support_admin',
-            'actor_account_uuid': ACTOR_ACCOUNT_UUID,
-            'effective_role': 'owner',
-        },
-    }
-
-
-@group.group_class('support_admin_probe', '/api/v1/support-admin-probe')
-class SupportAdminProbeGroup(group.RouterGroup):
-    async def initialize(self) -> None:
-        @self.route('/user-token', auth_type=group.AuthType.USER_TOKEN, permission=Permission.WORKSPACE_VIEW)
-        async def _(request_context: RequestContext) -> str:
-            return self.success(data=_context_payload(request_context))
-
-        @self.route(
-            '/member-operation',
-            auth_type=group.AuthType.USER_TOKEN,
-            permission=Permission.MEMBER_VIEW,
-        )
-        async def member_operation(request_context: RequestContext) -> str:
-            return self.success(data=_context_payload(request_context))
-
-        @self.route(
-            '/user-token-or-api-key',
-            auth_type=group.AuthType.USER_TOKEN_OR_API_KEY,
-            permission=Permission.WORKSPACE_VIEW,
-        )
-        async def _(request_context: RequestContext) -> str:
-            return self.success(data=_context_payload(request_context))
-
-
-def _context_payload(request_context: RequestContext) -> dict:
-    return {
-        'principal_type': request_context.principal.principal_type.value,
-        'actor_account_uuid': request_context.principal.actor_account_uuid,
-        'account_uuid': request_context.principal.account_uuid,
-        'role': request_context.workspace.role,
-        'membership_uuid': request_context.workspace.membership_uuid,
-        'permissions': sorted(request_context.workspace.permissions),
-    }
-
-
-class _TenantUow:
-    def __init__(self, engine):
-        self._engine = engine
-        self.session = None
-        self._transaction = None
-
-    async def __aenter__(self):
-        session_factory = async_sessionmaker(self._engine, expire_on_commit=False)
-        self.session = session_factory()
-        self._transaction = await self.session.begin()
-        return self
-
-    async def __aexit__(self, exc_type, exc, traceback):
-        try:
-            if exc_type is None:
-                await self._transaction.commit()
-            else:
-                await self._transaction.rollback()
-        finally:
-            await self.session.close()
-
-
-class _TenantScope:
-    async def __aenter__(self):
-        return self
-
-    async def __aexit__(self, exc_type, exc, traceback):
-        return False
-
-
-class _PersistenceManager:
-    def __init__(self, engine):
-        self._engine = engine
-        self.mode = SimpleNamespace(value='oss_compat')
-
-    def get_db_engine(self):
-        return self._engine
-
-    def tenant_uow(self, workspace_uuid: str):
-        del workspace_uuid
-        return _TenantUow(self._engine)
-
-    def tenant_scope(self, workspace_uuid: str):
-        del workspace_uuid
-        return _TenantScope()
-
-
-@pytest.fixture
-async def support_admin_api(tmp_path):
-    private_key = Ed25519PrivateKey.generate()
-    public_key = private_key.public_key().public_bytes(
-        encoding=serialization.Encoding.Raw,
-        format=serialization.PublicFormat.Raw,
-    )
-    engine = create_async_engine(f'sqlite+aiosqlite:///{tmp_path / "support-admin.db"}')
-    async with engine.begin() as connection:
-        await connection.run_sync(
-            Base.metadata.create_all,
-            tables=[
-                User.__table__,
-                Workspace.__table__,
-                WorkspaceExecutionState.__table__,
-                WorkspaceMembership.__table__,
-                SupportAdminTemporarySession.__table__,
-            ],
-        )
-        for workspace_uuid, slug in (
-            (WORKSPACE_UUID, 'support-admin-a'),
-            (OTHER_WORKSPACE_UUID, 'support-admin-b'),
-        ):
-            await connection.execute(
-                sqlalchemy.insert(Workspace).values(
-                    uuid=workspace_uuid,
-                    instance_uuid=INSTANCE_UUID,
-                    name=slug,
-                    slug=slug,
-                    type='team',
-                    status='active',
-                    source='cloud_projection',
-                    projection_revision=1,
-                )
-            )
-            await connection.execute(
-                sqlalchemy.insert(WorkspaceExecutionState).values(
-                    workspace_uuid=workspace_uuid,
-                    instance_uuid=INSTANCE_UUID,
-                    active_generation=1,
-                    state='active',
-                    write_fenced=False,
-                    source='cloud',
-                    desired_state_revision=1,
-                )
-            )
-
-    app = SimpleNamespace()
-    app.persistence_mgr = _PersistenceManager(engine)
-    app.instance_config = SimpleNamespace(
-        data={
-            'system': {
-                'jwt': {'secret': 'support-admin-secret', 'expire': 3600},
-                'websocket_retention': {},
-            },
-            'space': {
-                'launch': {
-                    'control_plane_public_key': _base64url(public_key),
-                }
-            },
-            'api': {'global_api_key': ''},
-        }
-    )
-    app.logger = logging.getLogger('support-admin-test')
-    app.deployment = SimpleNamespace(mode='cloud', multi_workspace_enabled=True, verification_key_id=KEY_ID)
-    app.directory_projection_service = SimpleNamespace(require_ready=lambda: None)
-    app.workspace_service = WorkspaceService(app, instance_uuid=INSTANCE_UUID)
-    app.entitlement_resolver = SimpleNamespace(
-        instance_uuid=INSTANCE_UUID,
-        resolve=AsyncMock(return_value=SimpleNamespace(entitlement_revision=7)),
-    )
-    app.support_admin_session_service = SupportAdminSessionService(app)
-    app.space_launch_service = SpaceLaunchService(app)
-    app.user_service = SimpleNamespace()
-    app.user_service.get_authenticated_account = AsyncMock(side_effect=AssertionError('normal account auth used'))
-    app.user_service.verify_jwt_token = AsyncMock(side_effect=AssertionError('normal token verification used'))
-    app.user_service.get_user_by_email = AsyncMock(side_effect=AssertionError('user lookup used'))
-    app.apikey_service = SimpleNamespace()
-    app.apikey_service.authenticate_api_key = AsyncMock(
-        return_value=SimpleNamespace(
-            instance_uuid=INSTANCE_UUID,
-            workspace_uuid=OTHER_WORKSPACE_UUID,
-            placement_generation=1,
-            api_key_uuid='api-key',
-            permissions=frozenset(permission.value for permission in Permission),
-        )
-    )
-
-    quart_app = Quart(__name__)
-    await UserRouterGroup(app, quart_app).initialize()
-    await SupportAdminProbeGroup(app, quart_app).initialize()
-
-    yield app, quart_app.test_client(), engine, private_key
-    await engine.dispose()
-
-
-async def _issue_support_token(app, private_key: Ed25519PrivateKey, *, jti: str | None = None) -> dict[str, str]:
-    launch = await app.space_launch_service.consume_assertion(
-        _sign(private_key, _admin_claims(now=int(time.time()), jti=jti)),
-        expected_workspace_uuid=WORKSPACE_UUID,
-    )
-    return launch
-
-
-def _auth(token: str, workspace_uuid: str = WORKSPACE_UUID) -> dict[str, str]:
-    return {'Authorization': f'Bearer {token}', 'X-Workspace-Id': workspace_uuid}
-
-
-async def test_support_admin_membership_only_routes_are_denied(support_admin_api):
-    app, client, _engine, private_key = support_admin_api
-    launch = await _issue_support_token(app, private_key)
-
-    response = await client.get(
-        '/api/v1/support-admin-probe/member-operation',
-        headers=_auth(launch['support_admin_token']),
-    )
-
-    assert response.status_code == 403
-    assert (await response.get_json())['code'] == 'permission_denied'
-
-
-async def test_support_admin_check_token_is_rejected(support_admin_api):
-    app, client, _engine, private_key = support_admin_api
-    launch = await _issue_support_token(app, private_key)
-
-    response = await client.get('/api/v1/user/check-token', headers=_auth(launch['support_admin_token']))
-
-    assert response.status_code == 401
-    assert (await response.get_json())['code'] == 'invalid_authentication'
-
-
-async def test_support_admin_cross_workspace_denied_for_user_token_and_or_api_key(support_admin_api):
-    app, client, _engine, private_key = support_admin_api
-    launch = await _issue_support_token(app, private_key)
-
-    missing_selector = await client.get(
-        '/api/v1/support-admin-probe/user-token',
-        headers={'Authorization': f'Bearer {launch["support_admin_token"]}'},
-    )
-    user_response = await client.get(
-        '/api/v1/support-admin-probe/user-token',
-        headers=_auth(launch['support_admin_token'], OTHER_WORKSPACE_UUID),
-    )
-    either_response = await client.get(
-        '/api/v1/support-admin-probe/user-token-or-api-key',
-        headers={
-            **_auth(launch['support_admin_token'], OTHER_WORKSPACE_UUID),
-            'X-API-Key': 'valid-api-key',
-        },
-    )
-
-    assert missing_selector.status_code == 400
-    assert user_response.status_code == 401
-    assert either_response.status_code == 401
-    app.apikey_service.authenticate_api_key.assert_not_awaited()
-
-
-async def test_support_admin_request_context_has_actor_owner_and_no_membership(support_admin_api):
-    app, client, engine, private_key = support_admin_api
-    before_count = await _membership_count(engine)
-    launch = await _issue_support_token(app, private_key)
-
-    response = await client.get(
-        '/api/v1/support-admin-probe/user-token',
-        headers=_auth(launch['support_admin_token']),
-    )
-
-    assert response.status_code == 200
-    data = (await response.get_json())['data']
-    permissions = set(data.pop('permissions'))
-    assert Permission.WORKSPACE_VIEW.value in permissions
-    assert Permission.RESOURCE_MANAGE.value in permissions
-    assert not permissions.intersection(
-        {
-            Permission.OWNER_TRANSFER.value,
-            Permission.MEMBER_VIEW.value,
-            Permission.MEMBER_INVITE.value,
-            Permission.MEMBER_UPDATE_ROLE.value,
-            Permission.MEMBER_REMOVE.value,
-        }
-    )
-    assert data == {
-        'principal_type': PrincipalType.SUPPORT_ADMIN.value,
-        'actor_account_uuid': ACTOR_ACCOUNT_UUID,
-        'account_uuid': None,
-        'role': 'owner',
-        'membership_uuid': None,
-    }
-    assert await _membership_count(engine) == before_count
-
-
-async def test_support_admin_missing_workspace_is_controlled_launch_failure(support_admin_api):
-    app, _client, engine, private_key = support_admin_api
-    async with engine.begin() as connection:
-        await connection.execute(
-            sqlalchemy.delete(WorkspaceExecutionState).where(WorkspaceExecutionState.workspace_uuid == WORKSPACE_UUID)
-        )
-
-    with pytest.raises(SpaceLaunchError, match='unavailable'):
-        await _issue_support_token(app, private_key)
-
-
-async def test_support_admin_launch_replay_is_durable_across_service_instances(support_admin_api):
-    app, _client, _engine, private_key = support_admin_api
-    jti = str(uuid.uuid4())
-
-    await _issue_support_token(app, private_key, jti=jti)
-    second_service = SpaceLaunchService(app)
-
-    with pytest.raises(SpaceLaunchError, match='already been consumed'):
-        await second_service.consume_assertion(
-            _sign(private_key, _admin_claims(now=int(time.time()), jti=jti)),
-            expected_workspace_uuid=WORKSPACE_UUID,
-        )
-
-
-async def test_support_admin_persisted_expiry_and_revocation_are_enforced(support_admin_api):
-    app, client, engine, private_key = support_admin_api
-    launch = await _issue_support_token(app, private_key)
-    token = launch['support_admin_token']
-
-    async with engine.begin() as connection:
-        await connection.execute(
-            sqlalchemy.update(SupportAdminTemporarySession)
-            .where(SupportAdminTemporarySession.grant_jti_hash == launch['grant_jti_hash'])
-            .values(expires_at=datetime.datetime.now(datetime.UTC).replace(tzinfo=None) - datetime.timedelta(minutes=1))
-        )
-    expired = await client.get('/api/v1/support-admin-probe/user-token', headers=_auth(token))
-    assert expired.status_code == 401
-
-    second = await _issue_support_token(app, private_key)
-    async with engine.begin() as connection:
-        await connection.execute(
-            sqlalchemy.update(SupportAdminTemporarySession)
-            .where(SupportAdminTemporarySession.grant_jti_hash == second['grant_jti_hash'])
-            .values(revoked_at=datetime.datetime.now(datetime.UTC).replace(tzinfo=None))
-        )
-    revoked = await client.get('/api/v1/support-admin-probe/user-token', headers=_auth(second['support_admin_token']))
-    assert revoked.status_code == 401
-
-
-async def test_support_admin_websocket_preserves_actor_and_revalidates(support_admin_api):
-    app, _client, _engine, private_key = support_admin_api
-    launch = await _issue_support_token(app, private_key)
-    captured_contexts = []
-
-    class Adapter:
-        async def handle_websocket_message(self, connection, data):
-            del data
-            captured_contexts.append(connection.execution_context)
-            await connection.send_queue.put({'type': 'handled'})
-            connection.is_active = False
-
-    app.pipeline_service = SimpleNamespace(get_pipeline=AsyncMock(return_value=SimpleNamespace(uuid='pipeline-1')))
-    app.platform_mgr = SimpleNamespace(
-        get_websocket_proxy_bot=AsyncMock(return_value=SimpleNamespace(adapter=Adapter()))
-    )
-
-    quart_app = Quart(__name__)
-    await WebSocketChatRouterGroup(app, quart_app).initialize()
-
-    async with quart_app.test_client().websocket('/api/v1/pipelines/pipeline-1/ws/connect') as websocket:
-        await websocket.send(
-            json.dumps(
-                {
-                    'type': 'authenticate',
-                    'token': launch['support_admin_token'],
-                    'workspace_uuid': WORKSPACE_UUID,
-                }
-            )
-        )
-        connected = json.loads(await websocket.receive())
-        assert connected['type'] == 'connected'
-        await websocket.send(json.dumps({'type': 'message', 'message': [{'type': 'text', 'text': 'hi'}]}))
-        handled = json.loads(await websocket.receive())
-        assert handled['type'] == 'handled'
-
-    assert captured_contexts
-    principal = captured_contexts[0].trigger_principal
-    assert principal is not None
-    assert principal.principal_type == PrincipalType.SUPPORT_ADMIN
-    assert principal.actor_account_uuid == ACTOR_ACCOUNT_UUID
-
-
-async def _membership_count(engine) -> int:
-    async with engine.connect() as connection:
-        return int(
-            await connection.scalar(
-                sqlalchemy.select(sqlalchemy.func.count()).select_from(WorkspaceMembership),
-            )
-            or 0
-        )

tests/integration/api/test_user_space_oauth.py

@@ -270,7 +270,7 @@ async def test_space_credits_are_resolved_from_workspace_owner(space_oauth_api):
 
     response = await client.get(
         '/api/v1/user/space-credits',
-        headers={'Authorization': 'Bearer account-token', 'X-Workspace-Id': WORKSPACE_UUID},
+        headers={'Authorization': 'Bearer account-token', 'X-Workspace-UUID': WORKSPACE_UUID},
     )
 
     assert response.status_code == 200

tests/unit_tests/api/service/test_knowledge_service.py

@@ -34,7 +34,6 @@ class _Rows:
 def _app():
     return SimpleNamespace(
         logger=Mock(),
-        instance_config=SimpleNamespace(data={}),
         rag_mgr=SimpleNamespace(
             get_all_knowledge_base_details=AsyncMock(return_value=[]),
             get_knowledge_base_details=AsyncMock(return_value=None),
@@ -120,21 +119,6 @@ async def test_create_validates_schema_and_binds_context():
     )
 
 
-@pytest.mark.asyncio
-async def test_create_enforces_workspace_knowledge_base_limit():
-    app = _app()
-    app.instance_config.data = {'system': {'limitation': {'max_knowledge_bases': 2}}}
-    app.rag_mgr.get_all_knowledge_base_details.return_value = [{'uuid': 'kb-a'}, {'uuid': 'kb-b'}]
-    service = KnowledgeService(app)
-
-    with pytest.raises(ValueError, match=r'Maximum number of knowledge bases \(2\) reached'):
-        await service.create_knowledge_base(
-            CONTEXT,
-            {'knowledge_engine_plugin_id': 'author/engine'},
-        )
-    app.rag_mgr.create_knowledge_base.assert_not_awaited()
-
-
 @pytest.mark.asyncio
 async def test_update_rejects_guessed_uuid_and_scopes_reload():
     app = _app()

tests/unit_tests/api/service/test_provider_service.py

@@ -833,44 +833,6 @@ class TestModelProviderServiceScanProviderModels:
         assert len(result['models']) == 1
         assert result['models'][0]['type'] == 'llm'
 
-    async def test_scan_provider_marks_existing_rerank_model(self):
-        """Rerank scan results use the rerank service when computing already_added."""
-        ap = SimpleNamespace()
-        ap.persistence_mgr = SimpleNamespace()
-        ap.model_mgr = SimpleNamespace()
-        ap.llm_model_service = SimpleNamespace()
-        ap.embedding_models_service = SimpleNamespace()
-        ap.rerank_models_service = SimpleNamespace()
-
-        provider = _create_mock_provider(provider_uuid='rerank-scan-uuid')
-        ap.persistence_mgr.execute_async = AsyncMock(return_value=_create_mock_result([], first_item=provider))
-        ap.persistence_mgr.serialize_model = Mock(
-            return_value={
-                'uuid': 'rerank-scan-uuid',
-                'name': 'New API',
-                'requester': 'new-api-chat-completions',
-                'base_url': 'https://new-api.example.com/v1',
-                'api_keys': ['key'],
-            }
-        )
-
-        runtime_provider = Mock()
-        runtime_provider.token_mgr.get_token.return_value = 'token'
-        runtime_provider.requester.scan_models = AsyncMock(
-            return_value={'models': [{'id': 'Qwen3-Reranker-8B', 'type': 'rerank'}]}
-        )
-        ap.model_mgr.load_provider = AsyncMock(return_value=runtime_provider)
-        ap.llm_model_service.get_llm_models_by_provider = AsyncMock(return_value=[])
-        ap.embedding_models_service.get_embedding_models_by_provider = AsyncMock(return_value=[])
-        ap.rerank_models_service.get_rerank_models_by_provider = AsyncMock(return_value=[{'name': 'Qwen3-Reranker-8B'}])
-
-        result = await ModelProviderService(ap).scan_provider_models(
-            WORKSPACE_UUID, 'rerank-scan-uuid', model_type='rerank'
-        )
-
-        assert result['models'][0]['type'] == 'rerank'
-        assert result['models'][0]['already_added'] is True
-
     async def test_scan_provider_not_implemented_raises_error(self):
         """Raises ValueError when scan not implemented."""
         # Setup

tests/unit_tests/api/service/test_space_service.py

@@ -756,7 +756,7 @@ class TestSpaceServiceGetModels:
                             'uuid': 'uuid-2',
                             'model_id': 'model-2',
                             'provider': 'provider-2',
-                            'category': 'rerank',
+                            'category': 'chat',
                             'status': 'active',
                         },
                     ]
@@ -778,7 +778,6 @@ class TestSpaceServiceGetModels:
 
         # Verify
         assert len(result) == 2
-        assert result[1].category == 'rerank'
 
     async def test_get_models_api_error(self):
         """Raises ValueError on API error."""

tests/unit_tests/api/service/test_user_service.py

@@ -418,7 +418,6 @@ class TestUserServiceGenerateJwtToken:
         assert token is not None
 
 
-
 class TestUserServiceVerifyJwtToken:
     """Tests for verify_jwt_token method."""
 

tests/unit_tests/api/test_adapter_session_scoping.py

@@ -149,36 +149,6 @@ async def test_session_scope_matches_exact_tenant_placement_and_principal():
     assert sessions == {}
 
 
-async def test_support_admin_sessions_are_scoped_to_the_persisted_grant():
-    def support_context(grant_jti_hash: str) -> RequestContext:
-        return RequestContext(
-            instance_uuid='instance-test',
-            placement_generation=1,
-            request_id='request-test',
-            auth_type='support-admin',
-            principal=PrincipalContext(
-                principal_type=PrincipalType.SUPPORT_ADMIN,
-                actor_account_uuid='support-actor',
-                support_session_id=grant_jti_hash,
-            ),
-            workspace=WorkspaceContext(
-                workspace_uuid='workspace-a',
-                membership_uuid=None,
-                role='owner',
-                permissions=frozenset({'resource.manage'}),
-            ),
-        )
-
-    first_context = support_context('a' * 64)
-    second_context = support_context('b' * 64)
-    sessions: dict[str, dict] = {'session-test': {'status': 'waiting'}}
-    _bind_session_scope(sessions['session-test'], first_context)
-
-    assert _get_owned_session(sessions, 'session-test', second_context) is None
-    assert _pop_owned_session(sessions, 'session-test', second_context) is None
-    assert _get_owned_session(sessions, 'session-test', first_context) is sessions['session-test']
-
-
 async def test_session_capacity_evicts_oldest_session_in_same_workspace():
     owner_context = _request_context()
     sessions: dict[str, dict] = {}

tests/unit_tests/cloud/test_space_launch.py

@@ -11,7 +11,6 @@ from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 
 from langbot.pkg.cloud.launch import SpaceLaunchError, SpaceLaunchService
-from langbot.pkg.cloud.support_admin import SupportAdminReplayError
 
 
 pytestmark = pytest.mark.asyncio
@@ -58,21 +57,9 @@ def _service(private_key: Ed25519PrivateKey, *, now: int) -> SpaceLaunchService:
         encoding=serialization.Encoding.Raw,
         format=serialization.PublicFormat.Raw,
     )
-    consumed: set[str] = set()
-
-    class DurableSupportAdminService:
-        async def consume_launch_grant(self, **kwargs):
-            grant_hash = kwargs['grant_jti_hash']
-            if grant_hash in consumed:
-                raise SupportAdminReplayError('already consumed')
-            consumed.add(grant_hash)
-            return SimpleNamespace(token='support-admin-token')
-
     app = SimpleNamespace(
         deployment=SimpleNamespace(multi_workspace_enabled=True, verification_key_id=KEY_ID),
         workspace_service=SimpleNamespace(instance_uuid=INSTANCE_UUID),
-        logger=SimpleNamespace(info=lambda *args, **kwargs: None),
-        support_admin_session_service=DurableSupportAdminService(),
         instance_config=SimpleNamespace(
             data={
                 'space': {
@@ -99,81 +86,6 @@ async def test_consumes_valid_workspace_launch_assertion_once():
         await service.consume_assertion(token, expected_workspace_uuid=WORKSPACE_UUID)
 
 
-
-
-async def test_consumes_admin_owner_launch_once_and_validates_claims():
-    private_key = Ed25519PrivateKey.generate()
-    now = int(time.time())
-    service = _service(private_key, now=now)
-    claims = _claims(now=now)
-    claims['kind'] = 'workspace.support_admin_launch'
-    claims['payload'].update(
-        {
-            'launch_mode': 'support_admin',
-            'principal_type': 'support_admin',
-            'actor_account_uuid': '33333333-3333-4333-8333-333333333333',
-            'effective_role': 'owner',
-        }
-    )
-    claims['payload'].pop('account_uuid')
-    token = _sign(private_key, claims)
-
-    launch = await service.consume_assertion(token, expected_workspace_uuid=WORKSPACE_UUID)
-
-    assert launch == {
-        'workspace_uuid': WORKSPACE_UUID,
-        'launch_mode': 'support_admin',
-        'actor_account_uuid': '33333333-3333-4333-8333-333333333333',
-        'effective_role': 'owner',
-        'grant_jti_hash': launch['grant_jti_hash'],
-        'support_admin_token': 'support-admin-token',
-    }
-    with pytest.raises(SpaceLaunchError, match='already been consumed'):
-        await service.consume_assertion(token, expected_workspace_uuid=WORKSPACE_UUID)
-
-    invalid = _claims(now=now)
-    invalid['kind'] = 'workspace.support_admin_launch'
-    invalid['payload'].update(
-        {
-            'launch_mode': 'support_admin',
-            'principal_type': 'support_admin',
-            'actor_account_uuid': '33333333-3333-4333-8333-333333333333',
-            'effective_role': 'member',
-        }
-    )
-    invalid['payload'].pop('account_uuid')
-    with pytest.raises(SpaceLaunchError, match='effective role'):
-        await service.consume_assertion(_sign(private_key, invalid), expected_workspace_uuid=WORKSPACE_UUID)
-
-    too_long = _claims(now=now)
-    too_long['kind'] = 'workspace.support_admin_launch'
-    too_long['exp'] = now + 91
-    too_long['payload'].update(
-        {
-            'launch_mode': 'support_admin',
-            'principal_type': 'support_admin',
-            'actor_account_uuid': '33333333-3333-4333-8333-333333333333',
-            'effective_role': 'owner',
-        }
-    )
-    too_long['payload'].pop('account_uuid')
-    with pytest.raises(SpaceLaunchError, match='lifetime exceeds 90 seconds'):
-        await service.consume_assertion(_sign(private_key, too_long), expected_workspace_uuid=WORKSPACE_UUID)
-
-    impersonating = _claims(now=now)
-    impersonating['kind'] = 'workspace.support_admin_launch'
-    impersonating['payload'].update(
-        {
-            'launch_mode': 'support_admin',
-            'principal_type': 'support_admin',
-            'actor_account_uuid': '33333333-3333-4333-8333-333333333333',
-            'effective_role': 'owner',
-        }
-    )
-    with pytest.raises(SpaceLaunchError, match='customer Account'):
-        await service.consume_assertion(_sign(private_key, impersonating), expected_workspace_uuid=WORKSPACE_UUID)
-
-
 async def test_replay_cache_does_not_scan_all_live_assertions(monkeypatch):
     private_key = Ed25519PrivateKey.generate()
     now = int(time.time())

tests/unit_tests/pipeline/test_command_handler.py

@@ -158,21 +158,17 @@ class TestCommandHandlerReal:
 
     @pytest.mark.asyncio
     async def test_admin_privilege_check(self, fake_app, mock_event_ctx, mock_execute_factory):
-        """A per-bot admin from the database is marked as admin in command events."""
+        """Admin users get privilege level 2."""
         from langbot_plugin.api.entities.builtin.provider.session import LauncherTypes
 
         command = get_command_handler()
 
-        admin_result = Mock()
-        admin_result.first.return_value = Mock()
-        fake_app.persistence_mgr.execute_async = AsyncMock(return_value=admin_result)
-        fake_app.instance_config.data = {}
+        fake_app.instance_config.data = {'admins': ['person_12345']}
         fake_app.plugin_connector.emit_event = AsyncMock(return_value=mock_event_ctx)
         fake_app.cmd_mgr.execute = mock_execute_factory()
 
         handler = command.CommandHandler(fake_app)
         query = command_query('status')
-        query.bot_uuid = 'bot-1'
         query.launcher_type = LauncherTypes.PERSON
         query.launcher_id = 12345
 
@@ -180,28 +176,23 @@ class TestCommandHandlerReal:
         async for result in handler.handle(query):
             results.append(result)
 
-        fake_app.persistence_mgr.execute_async.assert_awaited_once()
         call_args = fake_app.plugin_connector.emit_event.call_args
         event = call_args[0][0]
         assert event.is_admin is True
 
     @pytest.mark.asyncio
     async def test_non_admin_privilege_check(self, fake_app, mock_event_ctx, mock_execute_factory):
-        """A launcher absent from the per-bot admin table is not an admin."""
+        """Non-admin users get privilege level 1."""
         from langbot_plugin.api.entities.builtin.provider.session import LauncherTypes
 
         command = get_command_handler()
 
-        admin_result = Mock()
-        admin_result.first.return_value = None
-        fake_app.persistence_mgr.execute_async = AsyncMock(return_value=admin_result)
-        fake_app.instance_config.data = {}
+        fake_app.instance_config.data = {'admins': ['person_12345']}
         fake_app.plugin_connector.emit_event = AsyncMock(return_value=mock_event_ctx)
         fake_app.cmd_mgr.execute = mock_execute_factory()
 
         handler = command.CommandHandler(fake_app)
         query = command_query('status')
-        query.bot_uuid = 'bot-1'
         query.launcher_type = LauncherTypes.PERSON
         query.launcher_id = 67890
 
@@ -209,7 +200,6 @@ class TestCommandHandlerReal:
         async for result in handler.handle(query):
             results.append(result)
 
-        fake_app.persistence_mgr.execute_async.assert_awaited_once()
         call_args = fake_app.plugin_connector.emit_event.call_args
         event = call_args[0][0]
         assert event.is_admin is False

tests/unit_tests/provider/test_litellmchat.py

@@ -1147,46 +1147,6 @@ class TestInvokeRerank:
         assert results[0]['relevance_score'] == 1.0
         assert results[1]['relevance_score'] == 0.0
 
-    @pytest.mark.asyncio
-    @pytest.mark.parametrize(
-        ('model_extra_args', 'expected_url'),
-        [
-            ({'rerank_path': 'reranks'}, 'https://gateway.example.com/v1/reranks'),
-            ({'rerank_url': 'https://rerank.example.com/api/rerank'}, 'https://rerank.example.com/api/rerank'),
-        ],
-    )
-    async def test_invoke_rerank_openai_compatible_endpoint_override(self, model_extra_args, expected_url):
-        """Endpoint configuration controls routing and is not sent in the Cohere body."""
-        requester = litellmchat.LiteLLMRequester(
-            ap=Mock(),
-            config={
-                'base_url': 'https://gateway.example.com/v1/',
-                'custom_llm_provider': 'openai',
-            },
-        )
-        model = MockRuntimeRerankModel('Qwen3-Reranker-8B', 'test-api-key')
-        model.model_entity.extra_args = model_extra_args
-
-        mock_resp = Mock()
-        mock_resp.raise_for_status = Mock()
-        mock_resp.json = Mock(return_value={'results': [{'index': 0, 'relevance_score': 0.8}]})
-        mock_client = AsyncMock()
-        mock_client.post = AsyncMock(return_value=mock_resp)
-        mock_client.__aenter__ = AsyncMock(return_value=mock_client)
-        mock_client.__aexit__ = AsyncMock(return_value=False)
-
-        with patch('httpx.AsyncClient', return_value=mock_client):
-            await requester.invoke_rerank(model=model, query='query', documents=['document'])
-
-        assert mock_client.post.call_args.args[0] == expected_url
-        payload = mock_client.post.call_args.kwargs['json']
-        assert payload == {
-            'model': 'Qwen3-Reranker-8B',
-            'query': 'query',
-            'documents': ['document'],
-            'top_n': 1,
-        }
-
 
 class TestConvertMessages:
     """Test _convert_messages method"""

tests/unit_tests/provider/test_model_manager.py

@@ -86,49 +86,6 @@ async def test_model_manager_skips_legacy_space_sync_in_cloud_runtime(mock_app_f
     app.workspace_service.get_local_execution_binding.assert_not_awaited()
 
 
-@pytest.mark.asyncio
-async def test_sync_new_models_from_space_creates_rerank_models(mock_app_for_modelmgr):
-    """Space rerank entries are discovered and persisted under the shared provider."""
-    app = mock_app_for_modelmgr
-    provider = persistence_model.ModelProvider(
-        uuid='space-provider',
-        name='LangBot Space',
-        requester='space-chat-completions',
-        base_url='https://api.langbot.cloud/v1',
-        api_keys=['space-key'],
-    )
-    app.persistence_mgr.execute_async = AsyncMock(return_value=_make_mock_result([provider], first_item=provider))
-    app.space_service.get_models = AsyncMock(
-        return_value=[
-            SimpleNamespace(
-                uuid='rerank-model-uuid',
-                model_id='Qwen3-Reranker-8B',
-                category='rerank',
-                featured_order=10,
-            )
-        ]
-    )
-    app.llm_model_service.get_llm_models = AsyncMock(return_value=[])
-    app.embedding_models_service.get_embedding_models = AsyncMock(return_value=[])
-    app.rerank_models_service = AsyncMock()
-    app.rerank_models_service.get_rerank_models = AsyncMock(return_value=[])
-
-    model_mgr = ModelManager(app)
-    await model_mgr.sync_new_models_from_space(TEST_EXECUTION_CONTEXT)
-
-    app.rerank_models_service.create_rerank_model.assert_awaited_once_with(
-        TEST_EXECUTION_CONTEXT,
-        {
-            'uuid': 'rerank-model-uuid',
-            'name': 'Qwen3-Reranker-8B',
-            'provider_uuid': 'space-provider',
-            'extra_args': {},
-            'prefered_ranking': 10,
-        },
-        preserve_uuid=True,
-    )
-
-
 # ============================================================================
 # Model Loading Tests
 # ============================================================================

tests/unit_tests/test_skill_service.py

@@ -8,6 +8,7 @@ import pytest
 
 from langbot.pkg.api.http.context import ExecutionContext
 from langbot.pkg.api.http.service.skill import SkillService
+from langbot.pkg.cloud.entitlements import EntitlementFeatureUnavailableError, EntitlementUnavailableError
 
 
 _CONTEXT = ExecutionContext(
@@ -113,6 +114,42 @@ class TestRequireBoxForWrite:
         service = SkillService(self._ap_with_disabled_box())
         assert await service.list_skills(_CONTEXT) == []
 
+    @pytest.mark.asyncio
+    async def test_list_skills_returns_empty_when_managed_sandbox_is_not_granted(self):
+        box_service = SimpleNamespace(
+            available=True,
+            list_skills=AsyncMock(
+                side_effect=EntitlementFeatureUnavailableError(
+                    'Workspace entitlement does not grant managed_sandbox',
+                    feature='managed_sandbox',
+                )
+            ),
+        )
+        service = SkillService(
+            SimpleNamespace(
+                workspace_service=_workspace_service(),
+                box_service=box_service,
+            )
+        )
+
+        assert await service.list_skills(_CONTEXT) == []
+
+    @pytest.mark.asyncio
+    async def test_list_skills_preserves_other_entitlement_failures(self):
+        box_service = SimpleNamespace(
+            available=True,
+            list_skills=AsyncMock(side_effect=EntitlementUnavailableError('control plane unavailable')),
+        )
+        service = SkillService(
+            SimpleNamespace(
+                workspace_service=_workspace_service(),
+                box_service=box_service,
+            )
+        )
+
+        with pytest.raises(EntitlementUnavailableError, match='control plane unavailable'):
+            await service.list_skills(_CONTEXT)
+
     @pytest.mark.asyncio
     async def test_read_skill_file_refused_when_box_unavailable(self):
         service = SkillService(self._ap_with_disabled_box())

web/src/app/auth/space/callback/page.tsx

@@ -3,7 +3,6 @@ import { useNavigate, useSearchParams } from 'react-router-dom';
 import { httpClient } from '@/app/infra/http/HttpClient';
 import {
   beginAuthenticatedSession,
-  beginSupportAdminSession,
   bootstrapWorkspaceSession,
   getPendingInvitationToken,
 } from '@/app/infra/http';
@@ -28,10 +27,8 @@ import langbotIcon from '@/app/assets/langbot-logo.webp';
 
 type SpaceOAuthLoginResult = {
   token: string;
-  user?: string;
+  user: string;
   workspace_uuid?: string;
-  principal_type?: 'account' | 'support_admin';
-  actor_account_uuid?: string;
 };
 
 const pendingSpaceOAuthLogins = new Map<
@@ -97,16 +94,6 @@ function SpaceOAuthCallbackContent() {
           return;
         }
 
-        if (response.principal_type === 'support_admin') {
-          if (!response.workspace_uuid) {
-            throw new Error('Support admin launch did not include a Workspace');
-          }
-          beginSupportAdminSession(response.token, response.workspace_uuid);
-          await bootstrapWorkspaceSession();
-          navigate('/home', { replace: true });
-          return;
-        }
-
         beginAuthenticatedSession(response.token, response.user);
         if (getPendingInvitationToken()) {
           navigate('/invitations/accept', { replace: true });

web/src/app/home/layout.tsx

@@ -17,7 +17,6 @@ import {
   bootstrapWorkspaceSession,
   systemInfo,
   initializeSystemInfo,
-  isSupportAdminSession,
   useCurrentWorkspace,
 } from '@/app/infra/http';
 import { useNavigate, useLocation } from 'react-router-dom';
@@ -157,7 +156,7 @@ export default function HomeLayout({
   // selected Workspace's wizard state.
   useEffect(() => {
     if (!identityReady) return;
-    if (systemInfo?.wizard_status === 'none' && !isSupportAdminSession()) {
+    if (systemInfo.wizard_status === 'none') {
       navigate('/wizard', { replace: true });
     }
   }, [identityReady, navigate]);

web/src/app/infra/http/BackendClient.ts

@@ -1327,10 +1327,8 @@ export class BackendClient extends BaseHttpClient {
     launchAssertion?: string,
   ): Promise<{
     token: string;
-    user?: string;
+    user: string;
     workspace_uuid?: string;
-    principal_type?: 'account' | 'support_admin';
-    actor_account_uuid?: string;
   }> {
     const response = await this.instance.post(
       '/api/v1/user/space/callback',

web/src/app/infra/http/index.ts

@@ -217,34 +217,10 @@ export function beginAuthenticatedSession(
   if (typeof window === 'undefined') return;
   localStorage.removeItem('token');
   localStorage.removeItem('userEmail');
-  localStorage.removeItem('authPrincipalType');
   localStorage.setItem('token', token);
   if (userEmail) localStorage.setItem('userEmail', userEmail);
 }
 
-export function beginSupportAdminSession(
-  token: string,
-  workspaceUuid: string,
-): void {
-  userInfo = null;
-  clearWorkspaceSelection();
-  clearWorkspaceBootstrapSnapshot();
-
-  if (typeof window === 'undefined') return;
-  localStorage.removeItem('token');
-  localStorage.removeItem('userEmail');
-  localStorage.setItem('token', token);
-  localStorage.setItem('authPrincipalType', 'support_admin');
-  setActiveWorkspaceUuid(workspaceUuid);
-}
-
-export function isSupportAdminSession(): boolean {
-  return (
-    typeof window !== 'undefined' &&
-    localStorage.getItem('authPrincipalType') === 'support_admin'
-  );
-}
-
 async function initializeSelectedWorkspace(
   workspaceUuid: string,
   workspaces: WorkspaceBootstrapEntry[],
@@ -276,27 +252,6 @@ async function initializeSelectedWorkspace(
 export async function bootstrapWorkspaceSession(
   options: WorkspaceBootstrapOptions = {},
 ): Promise<WorkspaceBootstrapResult> {
-  if (isSupportAdminSession()) {
-    const selectedWorkspaceUuid = getActiveWorkspaceUuid();
-    if (!selectedWorkspaceUuid) {
-      throw new Error('Support admin session is missing its Workspace scope');
-    }
-    if (
-      options.preferredWorkspaceUuid &&
-      options.preferredWorkspaceUuid !== selectedWorkspaceUuid
-    ) {
-      throw new Error('Support admin session cannot change Workspace scope');
-    }
-    await initializeWorkspaceInfo();
-    const workspace = getCurrentWorkspaceSnapshot();
-    if (!workspace || workspace.workspace.uuid !== selectedWorkspaceUuid) {
-      clearWorkspaceSelection();
-      throw new Error('Support admin Workspace scope could not be initialized');
-    }
-    clearWorkspaceBootstrapSnapshot();
-    return { status: 'ready', workspace, workspaces: [] };
-  }
-
   if (options.resetSelection) {
     clearWorkspaceSelection();
     clearWorkspaceBootstrapSnapshot();
@@ -384,9 +339,6 @@ export const clearUserInfo = (): void => {
   userInfo = null;
   clearWorkspaceSelection();
   clearWorkspaceBootstrapSnapshot();
-  if (typeof window !== 'undefined') {
-    localStorage.removeItem('authPrincipalType');
-  }
 };
 
 export {

web/tests/unit/support-admin-session.test.mjs

@@ -1,42 +0,0 @@
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import path from 'node:path';
-import test from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const root = path.resolve(
-  path.dirname(fileURLToPath(import.meta.url)),
-  '../..',
-);
-const read = (file) => fs.readFileSync(path.join(root, file), 'utf8');
-
-test('support-admin launch stores a scoped principal instead of starting an Account session', () => {
-  const callback = read('src/app/auth/space/callback/page.tsx');
-  assert.match(callback, /response\.principal_type === 'support_admin'/);
-  assert.match(
-    callback,
-    /beginSupportAdminSession\(response\.token, response\.workspace_uuid\)/,
-  );
-});
-
-test('support-admin workspace bootstrap never calls Account bootstrap', () => {
-  const source = read('src/app/infra/http/index.ts');
-  assert.match(source, /export function beginSupportAdminSession/);
-  assert.match(source, /export function isSupportAdminSession\(\): boolean/);
-  const supportBranch = source.indexOf('if (isSupportAdminSession())');
-  const accountBootstrap = source.indexOf(
-    'backendClient.getWorkspaceBootstrap()',
-  );
-  assert.ok(supportBranch >= 0);
-  assert.ok(accountBootstrap > supportBranch);
-  assert.match(
-    source.slice(supportBranch, accountBootstrap),
-    /initializeWorkspaceInfo\([\s\S]*status: 'ready'/,
-  );
-  assert.match(
-    source,
-    /localStorage\.setItem\('authPrincipalType', 'support_admin'\)/,
-  );
-  const homeLayout = read('src/app/home/layout.tsx');
-  assert.match(homeLayout, /!isSupportAdminSession\(\)/);
-});