diff --git a/.github/workflows/run.yml b/.github/workflows/run.yml
index d27d48c5..80f108a3 100644
--- a/.github/workflows/run.yml
+++ b/.github/workflows/run.yml
@@ -27,6 +27,8 @@ jobs:
       #      cd ../
       #   shell: bash
       - name: xiaosa tools
+        env:
+          CF_PROXY_URL: ${{ secrets.CF_PROXY_URL }}
         run: |
           pwd
           cd tools/
diff --git a/tools/build_local.py b/tools/build_local.py
index 22bf7f47..0fecf6a8 100644
--- a/tools/build_local.py
+++ b/tools/build_local.py
@@ -152,7 +152,30 @@ class TVBox本地构建器:
         except Exception as e:
             print(f"  ✗ requests下载失败: {e}")
 
-        # 方案2: 使用已有的 spider.jar（从上级目录查找）
+        # 方案2: 通过 CF Worker 代理下载
+        cf_proxy = os.environ.get('CF_PROXY_URL', '')
+        if cf_proxy:
+            try:
+                proxy_url = f"{cf_proxy}?q={url}"
+                print(f"  下载(cf-proxy): {proxy_url[:80]}...")
+                resp = self.session.get(proxy_url, timeout=60, allow_redirects=True)
+                resp.raise_for_status()
+                content = resp.content
+                # 检查是否为有效 jar 文件（PK 开头 = zip/jar）
+                if len(content) > 1000 and content[:2] == b'PK':
+                    with open(spider_path, 'wb') as f:
+                        f.write(content)
+                    md5 = self.计算MD5(spider_path)
+                    print(f"  ✓ cf-proxy保存到: {spider_path}")
+                    print(f"  MD5: {md5}")
+                    self.数据['spider'] = f"./spider.jar;md5;{md5}"
+                    return True
+                else:
+                    print(f"  ✗ cf-proxy返回内容非有效jar (大小: {len(content)})")
+            except Exception as e:
+                print(f"  ✗ cf-proxy下载失败: {e}")
+
+        # 方案3: 使用已有的 spider.jar（从上级目录查找）
         import shutil
         for candidate in [Path('../xiaosa/spider.jar'), Path('../jar/spider.jar'), Path('spider.jar')]:
             candidate = candidate.resolve() if not candidate.is_absolute() else candidate
diff --git a/tools/cf-proxy-worker.js b/tools/cf-proxy-worker.js
new file mode 100644
index 00000000..ebc1ff7d
--- /dev/null
+++ b/tools/cf-proxy-worker.js
@@ -0,0 +1,35 @@
+export default {
+  async fetch(request) {
+    const u = new URL(request.url);
+    let t = u.searchParams.get('q') || u.pathname.slice(1);
+    if (!t) return new Response('', { status: 404 });
+    if (!t.startsWith('http')) t = 'https://' + t;
+    try {
+      const target = new URL(t);
+      const r = await fetch(t, {
+        method: 'GET',
+        headers: {
+          'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+          'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
+          'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8',
+          'Accept-Encoding': 'gzip, deflate, br',
+          'Referer': target.origin + '/',
+          'Origin': target.origin,
+          'Connection': 'keep-alive',
+          'Upgrade-Insecure-Requests': '1',
+          'Sec-Fetch-Dest': 'document',
+          'Sec-Fetch-Mode': 'navigate',
+          'Sec-Fetch-Site': 'same-origin',
+          'Sec-Fetch-User': '?1',
+        },
+        redirect: 'follow',
+      });
+      const h = new Headers(r.headers);
+      h.set('Access-Control-Allow-Origin', '*');
+      h.delete('set-cookie');
+      return new Response(r.body, { status: r.status, headers: h });
+    } catch {
+      return new Response('', { status: 502 });
+    }
+  },
+};