Frontend adjustments

src/app/[locale]/dashboard/page.tsx

@@ -169,7 +169,6 @@ export default async function DashboardPage() {
   }
 
   const tenantName = myTenant.metadata.name;
-  const teamId = myTenant.status?.litellmTeamId || tenantName;
 
   return (
     <div>
@@ -209,12 +208,12 @@ export default async function DashboardPage() {
         </Card>
       </div>
 
-      {/* Usage */}
+      {/* Usage — no teamId passed, backend resolves from session */}
       <div className="mb-6 animate-in animate-in-delay-2">
         <h2 className="text-xs font-semibold uppercase tracking-wider text-text-muted mb-3">
           {t("usage")}
         </h2>
-        <UsageDisplay teamId={myTenant.status?.litellmTeamId || teamId} />
+        <UsageDisplay />
       </div>
 
       {/* Link to tenant detail */}

src/app/[locale]/tenants/[name]/page.tsx

@@ -39,6 +39,12 @@ export default async function TenantDetailPage({
   );
   const channelUsers = tenant.spec.channelUsers || {};
 
+  // Admins inspecting another tenant's usage: pass teamId explicitly.
+  // Customers viewing their own: no teamId, backend resolves from session.
+  const usageTeamId = user.isPlatform
+    ? tenant.status?.litellmTeamId || undefined
+    : undefined;
+
   return (
     <div>
       {/* Header */}
@@ -61,7 +67,7 @@ export default async function TenantDetailPage({
         <h2 className="text-xs font-semibold uppercase tracking-wider text-text-muted mb-3">
           {t("usage")}
         </h2>
-        <UsageDisplay teamId={tenant.status?.litellmTeamId || name} />
+        <UsageDisplay teamId={usageTeamId} />
       </section>
 
       {/* Packages */}
@@ -96,4 +102,4 @@ export default async function TenantDetailPage({
       </section>
     </div>
   );
-}
+}

src/app/api/workspace-defaults/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { getSessionUser } from "@/lib/session";
+import { getPackageDef } from "@/lib/packages";
 import {
   getDefaultSoulMd,
   getDefaultAgentsMd,
@@ -7,9 +8,12 @@ import {
 } from "@/lib/workspace-defaults";
 
 /**
- * GET /api/workspace-defaults?orgName=...&packages=telegram,web-search
+ * GET /api/workspace-defaults?packages=telegram,web-search
  * Returns default content for SOUL.md, AGENTS.md, and TOOLS.md.
  * Used by the onboarding wizard to pre-fill textareas.
+ *
+ * orgName is always resolved from the authenticated session — never
+ * accepted as a query parameter.
  */
 export async function GET(req: NextRequest) {
   const user = await getSessionUser();
@@ -17,10 +21,13 @@ export async function GET(req: NextRequest) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
-  const orgName =
-    req.nextUrl.searchParams.get("orgName") || user.orgName || "Your Company";
+  // Always use the session org name — not a client-supplied parameter
+  const orgName = user.orgName || "Your Company";
+
   const packagesParam = req.nextUrl.searchParams.get("packages") || "";
-  const packages = packagesParam ? packagesParam.split(",").filter(Boolean) : [];
+  const packages = packagesParam
+    ? packagesParam.split(",").filter((id) => id && getPackageDef(id))
+    : [];
 
   const [soulMd, agentsMd, toolsMd] = await Promise.all([
     getDefaultSoulMd(orgName),