diff --git a/scripts/gitea.mjs b/scripts/gitea.mjs
new file mode 100644
index 0000000..e79afe8
--- /dev/null
+++ b/scripts/gitea.mjs
@@ -0,0 +1,18 @@
+/*** 作用：Gitea 认证 git 包装器，从 .gitea-token 读取令牌注入 Authorization 头，避免令牌出现在命令行 ***/
+import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+
+// 令牌文件路径（不入库）
+const tokenFile = new URL('../.gitea-token', import.meta.url);
+// git 子命令参数（如 push origin main）
+const args = process.argv.slice(2);
+// 卫语句：无参数直接退出
+if (args.length === 0) { console.error('用法: node scripts/gitea.mjs <git参数...>'); process.exit(2); }
+
+let token = '';
+try { token = readFileSync(tokenFile, 'utf8').trim(); } catch { console.error('缺少 .gitea-token 文件'); process.exit(2); }
+if (!token) { console.error('.gitea-token 为空'); process.exit(2); }
+
+// 注入认证头执行 git
+const result = spawnSync('git', ['-c', `http.extraheader=Authorization: token ${token}`, ...args], { stdio: 'inherit' });
+process.exit(result.status ?? 1);