Frontend adjustments

src/app/api/workspace-defaults/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { getSessionUser } from "@/lib/session";
+import { getPackageDef } from "@/lib/packages";
 import {
   getDefaultSoulMd,
   getDefaultAgentsMd,
@@ -7,9 +8,12 @@ import {
 } from "@/lib/workspace-defaults";
 
 /**
- * GET /api/workspace-defaults?orgName=...&packages=telegram,web-search
+ * GET /api/workspace-defaults?packages=telegram,web-search
  * Returns default content for SOUL.md, AGENTS.md, and TOOLS.md.
  * Used by the onboarding wizard to pre-fill textareas.
+ *
+ * orgName is always resolved from the authenticated session — never
+ * accepted as a query parameter.
  */
 export async function GET(req: NextRequest) {
   const user = await getSessionUser();
@@ -17,10 +21,13 @@ export async function GET(req: NextRequest) {
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   }
 
-  const orgName =
-    req.nextUrl.searchParams.get("orgName") || user.orgName || "Your Company";
+  // Always use the session org name — not a client-supplied parameter
+  const orgName = user.orgName || "Your Company";
+
   const packagesParam = req.nextUrl.searchParams.get("packages") || "";
-  const packages = packagesParam ? packagesParam.split(",").filter(Boolean) : [];
+  const packages = packagesParam
+    ? packagesParam.split(",").filter((id) => id && getPackageDef(id))
+    : [];
 
   const [soulMd, agentsMd, toolsMd] = await Promise.all([
     getDefaultSoulMd(orgName),