diff --git a/skills/plan/downstream-gen/scripts/derive-gitlab.sh b/skills/plan/downstream-gen/scripts/derive-gitlab.sh
index 085ea14..a764d7d 100644
--- a/skills/plan/downstream-gen/scripts/derive-gitlab.sh
+++ b/skills/plan/downstream-gen/scripts/derive-gitlab.sh
@@ -52,15 +52,53 @@ update_field() {
     return
   fi
   local current=${line#${key}=}
-  if [ -z "$current" ] || [ "$current" = "TBD(A5 自动补)" ]; then
+  # 剥外层单/双引号再比较，模板里 TBD(A5 自动补) 因含空格/括号必须加引号才能被 source
+  local stripped=$current
+  case "$stripped" in
+    \'*\') stripped=${stripped#\'}; stripped=${stripped%\'} ;;
+    \"*\") stripped=${stripped#\"}; stripped=${stripped%\"} ;;
+  esac
+  if [ -z "$stripped" ] || [ "$stripped" = "TBD(A5 自动补)" ]; then
     sed -i.bak -E "s|^${key}=.*$|${key}=${newval}|" "$ENV_FILE" && rm -f "${ENV_FILE}.bak"
-    echo "  ${key} = ${newval}"
+    echo "  ${key} = ${newval}  [已派生填入]"
+  elif [ "$stripped" = "$newval" ]; then
+    echo "  ${key} = ${newval}  [已是派生值，无需更新]"
   else
-    echo "  ${key} = (保留用户手填: ${current})"
+    echo "  ${key} = ${stripped}  [保留用户手填，未覆盖派生值 ${newval}]"
   fi
 }
 
+report_token() {
+  local key=GITLAB_TOKEN
+  local line
+  line=$(grep -E "^${key}=" "$ENV_FILE" | head -1)
+  if [ -z "$line" ]; then
+    echo "  ${key} = (.env.local 中无此行，跳过)" >&2
+    return
+  fi
+  local current=${line#${key}=}
+  local stripped=$current
+  case "$stripped" in
+    \'*\') stripped=${stripped#\'}; stripped=${stripped%\'} ;;
+    \"*\") stripped=${stripped#\"}; stripped=${stripped%\"} ;;
+  esac
+  case "$stripped" in
+    ""|"【人工填写："*|"TBD"*)
+      echo "  ${key} = ${stripped}  [待人工填写：GitLab Profile → Account → Private token]"
+      ;;
+    *)
+      local masked
+      if [ ${#stripped} -le 8 ]; then
+        masked=$(printf '%*s' ${#stripped} '' | tr ' ' '*')
+      else
+        masked="${stripped:0:4}$(printf '%*s' $((${#stripped}-8)) '' | tr ' ' '*')${stripped: -4}"
+      fi
+      echo "  ${key} = ${masked}  [已填入，长度 ${#stripped}]"
+      ;;
+  esac
+}
+
 echo "derive-gitlab.sh: 从 origin ($URL) 派生 GitLab 凭据："
 update_field GITLAB_PROJECT_ID "$PROJECT_ID"
 update_field GITLAB_API_URL "$API_URL"
-echo "  GITLAB_TOKEN = (保持占位，请去 GitLab Profile → Account → Private token 手填)"
+report_token
diff --git a/skills/plan/skeleton-gen/templates/env-local-template b/skills/plan/skeleton-gen/templates/env-local-template
index 7e2505f..3d884ef 100644
--- a/skills/plan/skeleton-gen/templates/env-local-template
+++ b/skills/plan/skeleton-gen/templates/env-local-template
@@ -31,6 +31,6 @@ TEST_DB_ALLOWED_HOSTS=
 #   `PRIVATE-TOKEN` 头。v3 token 是全权限、无细粒度 scope）。**无法派生，必须人工填**
 # - GITLAB_PROJECT_ID：A5 从 origin 远程路径自动派生为 URL-encoded 形式（如 `zhuzc/test` → `zhuzc%2Ftest`）；
 #   也可手动改成项目数字 ID（GitLab 项目设置页可见）
-GITLAB_API_URL=TBD(A5 自动补)
+GITLAB_API_URL='TBD(A5 自动补)'
 GITLAB_TOKEN=【人工填写：GitLab Private Token（Profile → Account → Private token）】
-GITLAB_PROJECT_ID=TBD(A5 自动补)
+GITLAB_PROJECT_ID='TBD(A5 自动补)'