diff --git a/cypher-executor/src/index.ts b/cypher-executor/src/index.ts
index cf6626a..6d7a6bb 100644
--- a/cypher-executor/src/index.ts
+++ b/cypher-executor/src/index.ts
@@ -39,10 +39,15 @@ const STATIC_ORIGINS = ['https://arcrun.dev', 'https://www.arcrun.dev'];
 
 app.use('*', cors({
   origin: (origin, c) => {
-    const extra = (c.env.UI_ORIGINS || '')
-      .split(',')
-      .map((s: string) => s.trim())
-      .filter(Boolean);
+    // ⚠️ 非瀏覽器請求（CLI／curl／MCP）沒有 Origin 標頭 → origin 是空字串/undefined。
+    //    此時必須原樣放行，不能回 null——回 null 會讓 Hono cors 中介層在後續處理拋錯，
+    //    表現為所有 CLI 部署一律 500（2026-07-21 實撞：acr push 全掛，對照組亦然）。
+    if (!origin) return origin;
+    let extra: string[] = [];
+    try {
+      extra = String((c.env as Record<string, unknown>).UI_ORIGINS || '')
+        .split(',').map((s: string) => s.trim()).filter(Boolean);
+    } catch { /* UI_ORIGINS 未設定＝只用靜態白名單 */ }
     return [...STATIC_ORIGINS, ...extra].includes(origin) ? origin : null;
   },
   allowMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],