diff --git a/pipeline_service/agent_loop.py b/pipeline_service/agent_loop.py
index a20381b..42d6caf 100644
--- a/pipeline_service/agent_loop.py
+++ b/pipeline_service/agent_loop.py
@@ -129,20 +129,24 @@ def _get_db():
 
 
 def _resolve_workspace(workspace_dir):
-    """解析工作目录，如果不可写则回退到 /tmp。确保目录存在。"""
+    """解析工作目录，如果不可写则回退到 pipeline 用户可写的 /tmp/pipeline_ws。确保目录存在。"""
     if not workspace_dir:
-        workspace_dir = '/tmp/pipeline_workspaces/default'
+        workspace_dir = '/tmp/pipeline_ws/default'
     # 检测是否可写
     try:
         parent = os.path.dirname(workspace_dir)
         if parent and not os.access(parent, os.W_OK):
-            # 回退到 /tmp
+            # 回退到 pipeline 用户可写的目录
             proj_name = os.path.basename(workspace_dir)
-            workspace_dir = f'/tmp/pipeline_workspaces/{proj_name}'
+            workspace_dir = f'/tmp/pipeline_ws/{proj_name}'
     except Exception:
-        workspace_dir = f'/tmp/pipeline_workspaces/{os.path.basename(workspace_dir) or "default"}'
-    # 确保目录存在
+        workspace_dir = f'/tmp/pipeline_ws/{os.path.basename(workspace_dir) or "default"}'
+    # 确保目录存在，设宽松权限
     os.makedirs(workspace_dir, exist_ok=True)
+    try:
+        os.chmod(workspace_dir, 0o777)
+    except Exception:
+        pass
     return workspace_dir