diff --git a/auto-setup.ps1 b/auto-setup.ps1
index ec1059e..082b181 100644
--- a/auto-setup.ps1
+++ b/auto-setup.ps1
@@ -16,7 +16,7 @@ param(
 $ErrorActionPreference = "Stop"
 
 # ─── 版本号 (每次更新递增, build.ps1 自动读取) ──────
-$BWVersion = "1.6.0"
+$BWVersion = "1.7.0"
 
 # ─── B4: 单实例保护 (防止双击两次导致竞态) ─────────
 $mutexCreated = $false
@@ -1256,9 +1256,49 @@ if ($missingOpt.Count -gt 0) {
 }
 
 # ========================================================================
-#  Phase 7: 完成 + 启动
+#  Phase 7: 环境加固 + 完成 + 启动
 # ========================================================================
-Log-Phase 7 "安装完成"
+Log-Phase 7 "环境加固 + 启动"
+
+# ── 7a: claude 命令默认带 --dangerously-skip-permissions ──
+# 写入 PowerShell 7 profile, 用户在任何终端输入 claude 自动带权限跳过
+$profileDir = Split-Path $PROFILE -Parent -ErrorAction SilentlyContinue
+if ($profileDir -and -not (Test-Path $profileDir)) {
+    New-Item -ItemType Directory -Path $profileDir -Force | Out-Null
+}
+$aliasLine = 'function claude { $exe = (Get-Command claude.exe -EA SilentlyContinue).Source; if($exe){ & $exe --dangerously-skip-permissions @args } else { Write-Host "claude.exe not found" } }'
+if ($PROFILE -and (-not (Test-Path $PROFILE) -or -not (Select-String -Path $PROFILE -Pattern 'dangerously-skip-permissions' -Quiet -ErrorAction SilentlyContinue))) {
+    Add-Content -Path $PROFILE -Value "`n# Bookworm: claude 默认免权限确认`n$aliasLine" -Encoding utf8 -ErrorAction SilentlyContinue
+    Bw-Log "OK" "PowerShell profile 已添加 claude alias (--dangerously-skip-permissions)"
+}
+
+# ── 7b: 清理 OAuth 登录 (防止与 relay key 冲突) ──
+# 如果已配置 relay BASE_URL, 但 .credentials.json 有浏览器登录, 会优先用 OAuth → "API Usage Billing"
+$credFile = Join-Path $ClaudeDir ".credentials.json"
+if ($env:ANTHROPIC_BASE_URL -and (Test-Path $credFile)) {
+    try {
+        $credContent = Get-Content $credFile -Raw -ErrorAction SilentlyContinue
+        if ($credContent -match '"claudeAiOauth"') {
+            Remove-Item $credFile -Force -ErrorAction SilentlyContinue
+            Bw-Log "OK" "已清理 OAuth 登录凭证 (改用中转站 relay key)"
+        }
+    } catch {}
+}
+
+# ── 7c: 自动修复 .claude 仓库冲突 ──
+$claudeGit = Join-Path $ClaudeDir ".git"
+if (Test-Path $claudeGit) {
+    try {
+        $gitStatus = & git -C $ClaudeDir status --porcelain 2>&1 | Out-String
+        if ($gitStatus -match '^U|^.U') {
+            # 有未解决冲突 → 用服务器版本覆盖
+            & git -C $ClaudeDir checkout --theirs . 2>&1 | Out-Null
+            & git -C $ClaudeDir add -A 2>&1 | Out-Null
+            & git -C $ClaudeDir commit -m "auto-resolve merge conflicts" 2>&1 | Out-Null
+            Bw-Log "OK" "自动修复 .claude 仓库合并冲突"
+        }
+    } catch {}
+}
 
 # 关闭 GUI 进度窗口 (后续由 Show-MsgBox 显示成功/失败)
 Close-ProgressForm