diff --git a/mcp/Nexus_server.py b/mcp/Nexus_server.py
index 99a97514..399e2ae4 100644
--- a/mcp/Nexus_server.py
+++ b/mcp/Nexus_server.py
@@ -131,7 +131,18 @@ async def git_log(count: int = 10):
 @server.tool()
 async def deploy():
     """同步最新代码到运行目录并重启服务（需通过 pre-deploy 门控检查）"""
-    # ── Gate Check ──
+    # ── Pull latest code first ──
+    try:
+        pull = subprocess.run(
+            f"cd {DEPLOY_DIR} && git fetch --all 2>&1 && git reset --hard origin/main 2>&1",
+            shell=True, capture_output=True, text=True, timeout=30,
+        )
+        if pull.returncode != 0:
+            return f"🚫 Git pull failed:\n\n{pull.stdout}\n{pull.stderr}"
+    except Exception as e:
+        return f"🚫 Git pull error: {e}"
+
+    # ── Gate Check (after pull so files are up to date) ──
     gate_script = os.path.join(DEPLOY_DIR, "deploy", "pre_deploy_check.sh")
     if os.path.exists(gate_script):
         try:
@@ -148,17 +159,10 @@ async def deploy():
         # Gate script not on server yet — warn but allow (bootstrap scenario)
         pass
 
-    # ── Deploy ──
+    # ── Restart service ──
     try:
-        cmds = [
-            f"cd {DEPLOY_DIR} && git fetch --all 2>&1 && git reset --hard origin/master 2>&1",
-            "supervisorctl restart nexus 2>&1",
-        ]
-        result = []
-        for cmd in cmds:
-            p = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=30)
-            result.append(p.stdout or p.stderr or "OK")
-        return "\n---\n".join(result)
+        p = subprocess.run("supervisorctl restart nexus 2>&1", shell=True, capture_output=True, text=True, timeout=30)
+        return f"Pull:\n{pull.stdout}\n---\nRestart:\n{p.stdout or p.stderr or 'OK'}"
     except Exception as e:
         return str(e)