diff --git a/wwwroot/api/kb_diag.dspy b/wwwroot/api/kb_diag.dspy
deleted file mode 100644
index ff19f5f..0000000
--- a/wwwroot/api/kb_diag.dspy
+++ /dev/null
@@ -1,34 +0,0 @@
-# kb_diag.dspy - 临时诊断端点：真实请求上下文验证 rag_client 全链路
-# 用后即删（不留生产痕迹）。验证点：owner解析→dapi发key→HTTP检索
-import json as _j
-
-uid = await get_user()
-if not uid:
-    return _j.dumps({"ok": False, "error": "未登录"}, ensure_ascii=False)
-
-project_id = (params_kw or {}).get('project_id', '').strip()
-query = (params_kw or {}).get('query', '').strip() or '测试入库闭环'
-if not project_id:
-    return _j.dumps({"ok": False, "error": "缺少 project_id"}, ensure_ascii=False)
-
-out = {"steps": []}
-try:
-    from pipeline_service.rag_client import (resolve_project_owner, get_owner_apikey,
-                                             tool_rag_kb_list, tool_rag_search)
-    owner, err = await resolve_project_owner(project_id)
-    out["steps"].append({"step": "resolve_owner", "owner": owner, "err": err})
-    if err:
-        return _j.dumps({"ok": False, "out": out}, ensure_ascii=False, default=str)
-    key, err = await get_owner_apikey(owner)
-    out["steps"].append({"step": "get_key", "key_prefix": (key or "")[:8],
-                         "key_len": len(key or ""), "err": err})
-    if err:
-        return _j.dumps({"ok": False, "out": out}, ensure_ascii=False, default=str)
-    out["kb_list"] = await tool_rag_kb_list(project_id)
-    out["search"] = (await tool_rag_search(project_id, query))[:600]
-    out["ok"] = True
-except Exception as e:
-    import traceback
-    out["ok"] = False
-    out["traceback"] = traceback.format_exc()[-800:]
-return _j.dumps(out, ensure_ascii=False, default=str)
diff --git a/wwwroot/api/kb_diag2.dspy b/wwwroot/api/kb_diag2.dspy
deleted file mode 100644
index 8baed13..0000000
--- a/wwwroot/api/kb_diag2.dspy
+++ /dev/null
@@ -1,48 +0,0 @@
-# kb_diag2.dspy - 深挖 Bearer key 401：dapi 查询匹配 + 注册表 + rbac 认证链
-import json as _j
-
-uid = await get_user()
-if not uid:
-    return _j.dumps({"ok": False, "error": "未登录"}, ensure_ascii=False)
-
-out = {}
-try:
-    from pipeline_service.rag_client import resolve_project_owner, get_owner_apikey
-    pid = "d9jE6l8vx-yHO6-_pIWnY"
-    owner, _e = await resolve_project_owner(pid)
-    key, err = await get_owner_apikey(owner)
-    out["key_len"] = len(key or "")
-    out["key_prefix"] = (key or "")[:10]
-
-    dbname = get_module_dbname('pipeline-sdlc')
-    async with DBPools().sqlorContext(dbname) as sor:
-        # 1. 库里 downapikey 存储值
-        recs = await sor.sqlExe(
-            "SELECT id, dappid, apikey FROM downapikey WHERE userid=${u}$", {"u": owner})
-        await sor.sqlExe("COMMIT", {})
-        out["stored"] = [{"id": r.id, "dappid": r.dappid, "enc_len": len(r.apikey or ""),
-                          "enc_prefix": (r.apikey or "")[:10]} for r in (recs or [])]
-
-        # 2. password_encode 对称性：编码明文 key 是否 == 存储值
-        from ahserver.serverenv import get_serverenv
-        enc_fn = get_serverenv('password_encode')
-        encoded = enc_fn(key) if key else ""
-        stored_enc = (recs[0].apikey if recs else "") or ""
-        out["encode_symmetric"] = (encoded == stored_enc)
-        out["encoded_len"] = len(encoded)
-
-        # 3. dapi 的 get_apikey_user 能否查到（传入明文，内部会 encode 再查）
-        from dapi.dapi import get_apikey_user
-        u = await get_apikey_user(sor, key, "127.0.0.1")
-        out["get_apikey_user"] = str(getattr(u, 'id', None)) if u else "NONE"
-
-        # 4. register_auth_method 注册表
-        from rbac import check_perm
-        for an in ('AUTH_METHODS', 'auth_methods', '_auth_methods', 'AUTHS', '_AUTH_METHODS'):
-            if hasattr(check_perm, an):
-                v = getattr(check_perm, an)
-                out["auth_methods_" + an] = list(v.keys()) if isinstance(v, dict) else str(type(v))
-except Exception as e:
-    import traceback
-    out["traceback"] = traceback.format_exc()[-700:]
-return _j.dumps(out, ensure_ascii=False, default=str)
diff --git a/wwwroot/api/kb_diag3.dspy b/wwwroot/api/kb_diag3.dspy
deleted file mode 100644
index 7898085..0000000
--- a/wwwroot/api/kb_diag3.dspy
+++ /dev/null
@@ -1,36 +0,0 @@
-# kb_diag3.dspy - 抓应用内自调用 401 的请求细节：对比外部成功调用的差异
-import json as _j
-
-uid = await get_user()
-if not uid:
-    return _j.dumps({"ok": False, "error": "未登录"}, ensure_ascii=False)
-
-out = {}
-try:
-    from pipeline_service.rag_client import resolve_project_owner, get_owner_apikey
-    pid = "d9jE6l8vx-yHO6-_pIWnY"
-    owner, _e = await resolve_project_owner(pid)
-    key, err = await get_owner_apikey(owner)
-    out["key_repr"] = repr(key)
-
-    # 完全复刻 _rag_call 的请求，打印实际发送的 URL/headers/响应
-    import aiohttp
-    base = "http://127.0.0.1:9090/rag/api"
-    url = base + "/kb_list.dspy"
-    headers = {"Authorization": "***" + key, "Content-Type": "application/json"}
-    out["send_headers"] = {k: (v if k != "Authorization" else v[:12] + "...len=" + str(len(v))) for k, v in headers.items()}
-    async with aiohttp.ClientSession(timeout=aiohttp.ClientTimeout(total=30, connect=10)) as session:
-        async with session.post(url, headers=headers, json={}) as resp:
-            body = await resp.read()
-            out["status"] = resp.status
-            out["resp_headers_ct"] = resp.headers.get("Content-Type", "")
-            out["body_head"] = body[:120].decode("utf-8", "replace")
-
-    # 对照组：同一进程内用 requests 风格的简单 GET（不带 body）
-    async with aiohttp.ClientSession(timeout=aiohttp.ClientTimeout(total=30)) as session:
-        async with session.get("http://127.0.0.1:9090/") as resp:
-            out["root_status"] = resp.status
-except Exception as e:
-    import traceback
-    out["traceback"] = traceback.format_exc()[-700:]
-return _j.dumps(out, ensure_ascii=False, default=str)