diff --git a/wwwroot/api/kb_diag3.dspy b/wwwroot/api/kb_diag3.dspy
new file mode 100644
index 0000000..7898085
--- /dev/null
+++ b/wwwroot/api/kb_diag3.dspy
@@ -0,0 +1,36 @@
+# kb_diag3.dspy - 抓应用内自调用 401 的请求细节：对比外部成功调用的差异
+import json as _j
+
+uid = await get_user()
+if not uid:
+    return _j.dumps({"ok": False, "error": "未登录"}, ensure_ascii=False)
+
+out = {}
+try:
+    from pipeline_service.rag_client import resolve_project_owner, get_owner_apikey
+    pid = "d9jE6l8vx-yHO6-_pIWnY"
+    owner, _e = await resolve_project_owner(pid)
+    key, err = await get_owner_apikey(owner)
+    out["key_repr"] = repr(key)
+
+    # 完全复刻 _rag_call 的请求，打印实际发送的 URL/headers/响应
+    import aiohttp
+    base = "http://127.0.0.1:9090/rag/api"
+    url = base + "/kb_list.dspy"
+    headers = {"Authorization": "***" + key, "Content-Type": "application/json"}
+    out["send_headers"] = {k: (v if k != "Authorization" else v[:12] + "...len=" + str(len(v))) for k, v in headers.items()}
+    async with aiohttp.ClientSession(timeout=aiohttp.ClientTimeout(total=30, connect=10)) as session:
+        async with session.post(url, headers=headers, json={}) as resp:
+            body = await resp.read()
+            out["status"] = resp.status
+            out["resp_headers_ct"] = resp.headers.get("Content-Type", "")
+            out["body_head"] = body[:120].decode("utf-8", "replace")
+
+    # 对照组：同一进程内用 requests 风格的简单 GET（不带 body）
+    async with aiohttp.ClientSession(timeout=aiohttp.ClientTimeout(total=30)) as session:
+        async with session.get("http://127.0.0.1:9090/") as resp:
+            out["root_status"] = resp.status
+except Exception as e:
+    import traceback
+    out["traceback"] = traceback.format_exc()[-700:]
+return _j.dumps(out, ensure_ascii=False, default=str)