diff --git a/.gitea/workflows/diag.yml b/.gitea/workflows/diag.yml
new file mode 100644
index 000000000..23b84d676
--- /dev/null
+++ b/.gitea/workflows/diag.yml
@@ -0,0 +1,41 @@
+name: Runner Diagnose
+on:
+  push:
+    branches:
+      - ci/runner-fix
+
+jobs:
+  diag:
+    runs-on: saas
+    steps:
+      - name: 诊断
+        run: |
+          echo "=== 身份 ==="
+          whoami
+          id
+          echo ""
+          echo "=== act_runner 路径 ==="
+          which act_runner || echo "not in PATH"
+          ls -la /var/lib/xiaoxia-ci/act_runner 2>/dev/null || echo "not found"
+          echo ""
+          echo "=== systemctl 权限 ==="
+          systemctl list-units --type=service | grep act_runner || echo "cannot list"
+          echo ""
+          echo "=== CI_DIR 内容 ==="
+          ls -la /var/lib/xiaoxia-ci/
+          echo ""
+          echo "=== runner-2 目录 ==="
+          ls -la /var/lib/xiaoxia-ci/runner-2/ 2>/dev/null || echo "not found"
+          echo ""
+          echo "=== runner-3 目录 ==="
+          ls -la /var/lib/xiaoxia-ci/runner-3/ 2>/dev/null || echo "not found"
+          echo ""
+          echo "=== 测试注册token获取 ==="
+          TOK=$(curl -sk -X POST \
+            -H "Authorization: token 1f8058d097e3942a9ed31c44382baf7f08311272" \
+            "https://git.xiaoxiajianji.com/api/v1/repos/xiaoxia/xiaoxia-saas/actions/runners/registration-token" \
+            | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('token','NO_TOKEN'))")
+          echo "Token: ${TOK:0:10}..."
+          echo ""
+          echo "=== 测试 act_runner register --help ==="
+          /var/lib/xiaoxia-ci/act_runner register --help 2>&1 | head -20