diff --git a/.gitea/workflows/ci-diag2.yml b/.gitea/workflows/ci-diag2.yml
new file mode 100644
index 0000000..6c882bd
--- /dev/null
+++ b/.gitea/workflows/ci-diag2.yml
@@ -0,0 +1,52 @@
+name: diag2
+# 临时诊断 v2：网络出口 / GITHUB_TOKEN / clone 可行性 / 工具链可安装性
+# 注意: act 以 bash -e -o pipefail 执行每步，故全程禁用会提前退出的管道
+on:
+  push:
+  workflow_dispatch:
+
+jobs:
+  diag2:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 网络与令牌自检
+        env:
+          GT: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set +e
+          echo "=== GITHUB_TOKEN(secrets 上下文) ==="
+          if [ -n "${GT}" ]; then echo "  已注入 len=${#GT}"; else echo "  未注入"; fi
+
+          echo "=== 外网出口 ==="
+          for u in https://pypi.org/simple/ https://go.dev/dl/ https://registry.npmjs.org/ https://goproxy.cn/ https://github.com/ http://192.168.50.223:3000/; do
+            c=$(curl -s -o /dev/null -m 8 -w '%{http_code}' "$u")
+            echo "  $u -> ${c:-ERR}"
+          done
+
+          echo "=== DNS ==="
+          getent hosts go.dev || echo "  go.dev 解析失败"
+          getent hosts goproxy.cn || echo "  goproxy.cn 解析失败"
+
+          echo "=== 基础镜像里有没有 ip/ss ==="
+          command -v ip || echo "  ip 缺失"
+          command -v ss || echo "  ss 缺失"
+
+          echo "=== docker.sock 是否挂进容器 ==="
+          ls -la /var/run/docker.sock 2>&1 || echo "  无 docker.sock"
+          docker ps 2>&1 | head -n 3 || true
+
+          echo "=== 尝试用 GITHUB_TOKEN 手动 clone ==="
+          mkdir -p /tmp/ck && cd /tmp/ck
+          if [ -n "${GT}" ]; then
+            git clone --quiet --depth 1 "http://x-access-token:${GT}@192.168.50.223:3000/${GITHUB_REPOSITORY}.git" repo 2>&1 || echo "  token clone 失败"
+          else
+            echo "  跳过(无 token)"
+          fi
+          echo "=== 匿名 clone（公开库）==="
+          git clone --quiet --depth 1 "http://192.168.50.223:3000/${GITHUB_REPOSITORY}.git" repo2 2>&1 || echo "  匿名 clone 失败"
+          ls -a repo repo2 2>&1 | head -n 20 || true
+
+          echo "=== 工具链可安装性 ==="
+          pip download --no-deps -q -d /tmp/pipck uv >/dev/null 2>&1 && echo "  pip 可取 uv: OK" || echo "  pip 取 uv: 失败"
+          curl -s -o /dev/null -m 20 -w '  go tarball http=%{http_code} size=%{size_download}\n' -r 0-1000 https://goproxy.cn/ || true
+          echo "=== 诊断 v2 结束 ==="
\ No newline at end of file