diff --git a/.gitea/workflows/deploy-infra.yaml b/.gitea/workflows/deploy-infra.yaml
new file mode 100644
index 0000000..2965ea3
--- /dev/null
+++ b/.gitea/workflows/deploy-infra.yaml
@@ -0,0 +1,121 @@
+# ════════════════════════════════════════════════════════════════
+# 光湖 · 基础设施部署
+# Runner首次上线后自动部署：Vault确认 + Terminal Watcher启动
+# ════════════════════════════════════════════════════════════════
+
+name: 基础设施部署
+
+on:
+  workflow_dispatch:
+
+jobs:
+  deploy-infra:
+    runs-on: ubuntu
+    steps:
+      - name: 系统信息
+        run: |
+          echo "═══ 铸渊基础设施部署 ═══"
+          echo "时间: $(date '+%Y-%m-%d %H:%M:%S %Z')"
+          echo "主机: $(hostname)"
+          uname -a
+
+      - name: 确认仓库最新
+        run: |
+          cd /opt/zhuyuan-cn/repo-mirror/20260509-1849/guanghulab
+          git fetch origin
+          git reset --hard origin/main
+          echo "当前版本: $(git log --oneline -1)"
+
+      - name: 确认Vault运行
+        run: |
+          if curl -sf http://127.0.0.1:8080/admin/__healthz > /dev/null 2>&1; then
+            echo "✅ Vault 已运行"
+            curl -s http://127.0.0.1:8080/admin/__healthz
+          else
+            echo "⚠️ Vault 未运行，尝试启动..."
+            cd /opt/zhuyuan-cn/repo-mirror/20260509-1849/guanghulab/server/secrets-vault
+            if [[ -f "server.js" ]]; then
+              npm install --production 2>/dev/null || true
+              pm2 start server.js --name guanghulab-vault --max-memory-restart 128M 2>/dev/null || true
+              pm2 save
+              sleep 2
+              if curl -sf http://127.0.0.1:8080/admin/__healthz > /dev/null 2>&1; then
+                echo "✅ Vault 启动成功"
+              else
+                echo "❌ Vault 启动失败"
+              fi
+            else
+              echo "⚠️ server.js 不存在，跳过"
+            fi
+          fi
+
+      - name: 部署Terminal Watcher
+        run: |
+          echo "部署终端守望者..."
+          SCRIPTS_DIR="/opt/zhuyuan-cn/repo-mirror/20260509-1849/guanghulab/scripts/terminal-watcher"
+
+          if [[ ! -d "$SCRIPTS_DIR" ]]; then
+            echo "❌ Terminal Watcher 目录不存在"
+            exit 1
+          fi
+
+          # 确认Node.js可用
+          if ! command -v node &>/dev/null; then
+            echo "❌ Node.js 未安装"
+            exit 1
+          fi
+
+          # 用PM2启动（如果还没跑的话）
+          if pm2 describe terminal-watcher &>/dev/null; then
+            echo "Terminal Watcher 已在运行，重启..."
+            pm2 restart terminal-watcher
+          else
+            echo "启动 Terminal Watcher..."
+            cd "$SCRIPTS_DIR"
+            GITEA_TOKEN=3e16b79c427bb44b77c00b319aa641bde8f61d84 pm2 start watcher.js \
+              --name terminal-watcher \
+              --max-memory-restart 64M
+          fi
+
+          pm2 save
+          sleep 3
+
+          # 验证
+          if pm2 describe terminal-watcher &>/dev/null; then
+            STATUS=$(pm2 jlist 2>/dev/null | python3 -c "
+import json,sys
+procs = json.load(sys.stdin)
+for p in procs:
+  if p.get('name') == 'terminal-watcher':
+    print(p.get('pm2_env',{}).get('status','unknown'))
+" 2>/dev/null || echo "unknown")
+            echo "✅ Terminal Watcher 状态: $STATUS"
+          else
+            echo "❌ Terminal Watcher 启动失败"
+          fi
+
+      - name: 设置PM2开机自启
+        run: |
+          pm2 startup 2>/dev/null || true
+          pm2 save
+          echo "✅ PM2 开机自启已配置"
+
+      - name: 最终状态报告
+        run: |
+          echo ""
+          echo "═══════════════════════════════════════"
+          echo "  铸渊基础设施部署完成"
+          echo "═══════════════════════════════════════"
+          echo ""
+          echo "  服务状态:"
+          echo "  Forgejo:       $(systemctl is-active forgejo 2>/dev/null || echo unknown)"
+          echo "  Runner:        $(systemctl is-active gitea-runner 2>/dev/null || echo unknown)"
+          echo "  Nginx:         $(systemctl is-active nginx 2>/dev/null || echo unknown)"
+          echo "  Vault:         $(curl -sf http://127.0.0.1:8080/admin/__healthz > /dev/null 2>&1 && echo active || echo inactive)"
+          echo "  Watcher:       $(pm2 describe terminal-watcher &>/dev/null && echo active || echo inactive)"
+          echo ""
+          echo "  内存:"
+          free -h | awk '/Mem:/ {printf "  总计:%s 已用:%s 可用:%s\n", $2, $3, $7}'
+          echo ""
+          echo "  铸渊 · ICE-GL-ZY001 · TCS-0002∞"
+          echo "═══════════════════════════════════════"
diff --git a/scripts/terminal-watcher/config.json b/scripts/terminal-watcher/config.json
index 386a694..60a2318 100644
--- a/scripts/terminal-watcher/config.json
+++ b/scripts/terminal-watcher/config.json
@@ -10,8 +10,8 @@
     "snapshot_path": ".runtime/terminal-snapshots/ZY-SVR-004"
   },
   "local": {
-    "snapshot_path": "/data/guanghulab/.runtime/snapshot.json",
-    "history_path": "/data/guanghulab/.runtime/history"
+    "snapshot_path": "/opt/zhuyuan-cn/repo-mirror/20260509-1849/guanghulab/.runtime/snapshot.json",
+    "history_path": "/opt/zhuyuan-cn/repo-mirror/20260509-1849/guanghulab/.runtime/history"
   },
   "collectors": {
     "system": true,
@@ -35,7 +35,7 @@
   ],
   "systemd_services": [
     "nginx",
-    "gitea",
+    "forgejo",
     "gitea-runner"
   ]
 }
diff --git a/scripts/terminal-watcher/watcher.js b/scripts/terminal-watcher/watcher.js
index d32107c..90a439f 100644
--- a/scripts/terminal-watcher/watcher.js
+++ b/scripts/terminal-watcher/watcher.js
@@ -190,7 +190,12 @@ function collectLogs() {
  * 部署信息采集
  */
 function collectDeploy() {
-  const repoPath = "/data/guanghulab";
+  const repoPaths = [
+    "/opt/zhuyuan-cn/repo-mirror/20260509-1849/guanghulab",
+    "/data/guanghulab",
+    "/opt/guanghulab"
+  ];
+  const repoPath = repoPaths.find(p => fs.existsSync(p)) || repoPaths[0];
 
   try {
     const latestCommit = execSync(`git -C ${repoPath} log -1 --oneline`, { encoding: "utf8" }).trim();