diff --git a/internal/agent/tools/grep_chunks.go b/internal/agent/tools/grep_chunks.go
index c830d97f..32a23811 100644
--- a/internal/agent/tools/grep_chunks.go
+++ b/internal/agent/tools/grep_chunks.go
@@ -56,7 +56,7 @@ grep_chunks scans enabled chunks across the specified knowledge bases and return
 	schema: json.RawMessage(`{
   "type": "object",
   "properties": {
-    "pattern": {
+    "patterns": {
       "type": "array",
       "description": "REQUIRED: Text patterns to search for. Can be a single pattern or multiple patterns. Treated as literal text (fixed string matching). Results match any of the patterns (OR logic).",
       "items": {
@@ -79,13 +79,13 @@ grep_chunks scans enabled chunks across the specified knowledge bases and return
       "maximum": 200
     }
   },
-  "required": ["pattern"]
+  "required": ["patterns"]
 }`),
 }
 
 // GrepChunksInput defines the input parameters for grep chunks tool
 type GrepChunksInput struct {
-	Pattern          []string `json:"pattern" `
+	Patterns         []string `json:"patterns" `
 	KnowledgeBaseIDs []string `json:"knowledge_base_ids,omitempty"`
 	MaxResults       int      `json:"max_results,omitempty"`
 }
@@ -122,11 +122,11 @@ func (t *GrepChunksTool) Execute(ctx context.Context, args json.RawMessage) (*ty
 	}
 
 	// Parse pattern parameter (required) - support multiple patterns
-	patterns := input.Pattern
+	patterns := input.Patterns
 
 	// Validate patterns
 	if len(patterns) == 0 {
-		logger.Errorf(ctx, "[Tool][GrepChunks] Missing or invalid pattern parameter")
+		logger.Errorf(ctx, "[Tool][GrepChunks] Missing or invalid patterns parameter")
 		return &types.ToolResult{
 			Success: false,
 			Error:   "pattern parameter is required and must contain at least one non-empty pattern",
diff --git a/internal/middleware/auth.go b/internal/middleware/auth.go
index 9f26de64..7c0e3d8d 100644
--- a/internal/middleware/auth.go
+++ b/internal/middleware/auth.go
@@ -3,6 +3,7 @@ package middleware
 import (
 	"context"
 	"errors"
+	"fmt"
 	"log"
 	"net/http"
 	"slices"
@@ -190,16 +191,25 @@ func Auth(
 				types.TenantInfoContextKey, t,
 			)
 
-			// 通过 TenantID 关联查询用户
+			// 通过 TenantID 关联查询用户；找不到时构造系统虚拟用户，
+			// 确保所有依赖 UserContextKey 的下游 handler 正常工作。
 			user, err := userService.GetUserByTenantID(c.Request.Context(), tenantID)
-			if err == nil && user != nil {
-				c.Set(types.UserContextKey.String(), user)
-				c.Set(types.UserIDContextKey.String(), user.ID)
-				ctx = context.WithValue(
-					context.WithValue(ctx, types.UserContextKey, user),
-					types.UserIDContextKey, user.ID,
-				)
+			if err != nil || user == nil {
+				user = &types.User{
+					ID:       fmt.Sprintf("system-%d", tenantID),
+					Username: fmt.Sprintf("system-%d", tenantID),
+					Email:    fmt.Sprintf("system-%d@api-key.local", tenantID),
+					TenantID: tenantID,
+					IsActive: true,
+				}
+				log.Printf("No user found for tenant %d via API key, using synthetic system user %s", tenantID, user.ID)
 			}
+			c.Set(types.UserContextKey.String(), user)
+			c.Set(types.UserIDContextKey.String(), user.ID)
+			ctx = context.WithValue(
+				context.WithValue(ctx, types.UserContextKey, user),
+				types.UserIDContextKey, user.ID,
+			)
 
 			c.Request = c.Request.WithContext(ctx)
 			c.Next()