diff --git a/.forgejo/workflows/debug-secrets.yaml b/.forgejo/workflows/debug-secrets.yaml
new file mode 100644
index 0000000..591d992
--- /dev/null
+++ b/.forgejo/workflows/debug-secrets.yaml
@@ -0,0 +1,48 @@
+# 光湖 · Secrets诊断
+name: Secrets诊断
+
+on:
+  push:
+    paths:
+      - '.gitea/workflows/debug-secrets.yaml'
+
+jobs:
+  debug:
+    runs-on: ubuntu
+    steps:
+      - name: 环境变量诊断
+        env:
+          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
+          QIANWEN_API_KEY: ${{ secrets.QIANWEN_API_KEY }}
+          ZY_REPO_TOKEN: ${{ secrets.ZY_REPO_TOKEN }}
+          COS_SECRET_ID: ${{ secrets.COS_SECRET_ID }}
+          COS_SECRET_KEY: ${{ secrets.COS_SECRET_KEY }}
+          SG_BRAIN_HOST: ${{ secrets.SG_BRAIN_HOST }}
+          SG_BRAIN_USER: ${{ secrets.SG_BRAIN_USER }}
+          SG_BRAIN_KEY: ${{ secrets.SG_BRAIN_KEY }}
+        run: |
+          echo "═══ Secrets 注入诊断 ═══"
+          echo ""
+          echo "--- 1. 逐个检查secrets是否有值 ---"
+          for key in DEEPSEEK_API_KEY QIANWEN_API_KEY ZY_REPO_TOKEN COS_SECRET_ID COS_SECRET_KEY SG_BRAIN_HOST SG_BRAIN_USER SG_BRAIN_KEY; do
+            eval val=\$$key
+            if [ -z "$val" ]; then
+              echo "  ❌ $key = (空)"
+            else
+              echo "  ✅ $key = ${val:0:4}**** (长度: ${#val})"
+            fi
+          done
+          echo ""
+          echo "--- 2. 所有环境变量中含SECRET/KEY/TOKEN的 ---"
+          env | grep -iE 'SECRET|KEY|TOKEN|COS|BRAIN|DEEPSEEK|QIANWEN' | while read line; do
+            key=$(echo "$line" | cut -d= -f1)
+            val=$(echo "$line" | cut -d= -f2-)
+            echo "  $key = ${val:0:4}**** (长度: ${#val})"
+          done
+          echo ""
+          echo "--- 3. Gitea Actions 特殊变量 ---"
+          echo "  GITHUB_REPOSITORY: ${GITHUB_REPOSITORY:-未设置}"
+          echo "  GITHUB_SHA: ${GITHUB_SHA:-未设置}"
+          echo "  GITHUB_EVENT_NAME: ${GITHUB_EVENT_NAME:-未设置}"
+          echo "  RUNNER_NAME: ${RUNNER_NAME:-未设置}"
+          echo "  GITEA_TOKEN: ${GITEA_TOKEN:-未设置}"
diff --git a/.gitea/workflows/debug-secrets.yaml b/.gitea/workflows/debug-secrets.yaml
new file mode 100644
index 0000000..591d992
--- /dev/null
+++ b/.gitea/workflows/debug-secrets.yaml
@@ -0,0 +1,48 @@
+# 光湖 · Secrets诊断
+name: Secrets诊断
+
+on:
+  push:
+    paths:
+      - '.gitea/workflows/debug-secrets.yaml'
+
+jobs:
+  debug:
+    runs-on: ubuntu
+    steps:
+      - name: 环境变量诊断
+        env:
+          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
+          QIANWEN_API_KEY: ${{ secrets.QIANWEN_API_KEY }}
+          ZY_REPO_TOKEN: ${{ secrets.ZY_REPO_TOKEN }}
+          COS_SECRET_ID: ${{ secrets.COS_SECRET_ID }}
+          COS_SECRET_KEY: ${{ secrets.COS_SECRET_KEY }}
+          SG_BRAIN_HOST: ${{ secrets.SG_BRAIN_HOST }}
+          SG_BRAIN_USER: ${{ secrets.SG_BRAIN_USER }}
+          SG_BRAIN_KEY: ${{ secrets.SG_BRAIN_KEY }}
+        run: |
+          echo "═══ Secrets 注入诊断 ═══"
+          echo ""
+          echo "--- 1. 逐个检查secrets是否有值 ---"
+          for key in DEEPSEEK_API_KEY QIANWEN_API_KEY ZY_REPO_TOKEN COS_SECRET_ID COS_SECRET_KEY SG_BRAIN_HOST SG_BRAIN_USER SG_BRAIN_KEY; do
+            eval val=\$$key
+            if [ -z "$val" ]; then
+              echo "  ❌ $key = (空)"
+            else
+              echo "  ✅ $key = ${val:0:4}**** (长度: ${#val})"
+            fi
+          done
+          echo ""
+          echo "--- 2. 所有环境变量中含SECRET/KEY/TOKEN的 ---"
+          env | grep -iE 'SECRET|KEY|TOKEN|COS|BRAIN|DEEPSEEK|QIANWEN' | while read line; do
+            key=$(echo "$line" | cut -d= -f1)
+            val=$(echo "$line" | cut -d= -f2-)
+            echo "  $key = ${val:0:4}**** (长度: ${#val})"
+          done
+          echo ""
+          echo "--- 3. Gitea Actions 特殊变量 ---"
+          echo "  GITHUB_REPOSITORY: ${GITHUB_REPOSITORY:-未设置}"
+          echo "  GITHUB_SHA: ${GITHUB_SHA:-未设置}"
+          echo "  GITHUB_EVENT_NAME: ${GITHUB_EVENT_NAME:-未设置}"
+          echo "  RUNNER_NAME: ${RUNNER_NAME:-未设置}"
+          echo "  GITEA_TOKEN: ${GITEA_TOKEN:-未设置}"