diff --git a/.github/workflows/cua-helper-package.yml b/.github/workflows/cua-helper-package.yml
index b57392c8c0..3ed909a35b 100644
--- a/.github/workflows/cua-helper-package.yml
+++ b/.github/workflows/cua-helper-package.yml
@@ -8,11 +8,6 @@ on:
         type: string
         default: master
         required: true
-      cua_run_id:
-        description: 'CUA helper run ID，留空复用源码逐字节一致的产物，无匹配则构建'
-        type: string
-        required: false
-        default: ''
       preset:
         description: '机器上的签名配置'
         type: choice
diff --git a/packages/experimental/cua-macos/native/README.i18n.yaml b/packages/experimental/cua-macos/native/README.i18n.yaml
index 8c3d14cf94..3bd7e46d45 100644
--- a/packages/experimental/cua-macos/native/README.i18n.yaml
+++ b/packages/experimental/cua-macos/native/README.i18n.yaml
@@ -15,8 +15,8 @@
   en: e8cbc43d38786c40
   zh: 52b3ba85d98011b9
 /dsh-cua-native-helper/build-and-service:
-  en: 660b210eff828ec2
-  zh: 37315043987817b2
+  en: 0957d00ac9d9f06e
+  zh: 96d5871ba1bfea1c
 /dsh-cua-native-helper/request-protocol:
   en: fc8043c425322cdd
   zh: cf1edb9a78fda301
diff --git a/packages/experimental/cua-macos/native/README.md b/packages/experimental/cua-macos/native/README.md
index 1c0092ad39..44577c9014 100644
--- a/packages/experimental/cua-macos/native/README.md
+++ b/packages/experimental/cua-macos/native/README.md
@@ -41,7 +41,7 @@ The manual **Package CUA helper · macOS** [workflow](../../../../.github/workfl
 
 The workflow retains `cua-helper.tgz` and `cua-helper.json`. The manifest records the original build's product version, commit and Team ID, both application digests, the source digest and the build key. [Release publish](../../../../.github/workflows/release-publish.yml) always calls this workflow, then downloads its selected run ID and artifact ID before packing the provider for npm. Staging verifies the current helper source digest and selected build key, both architectures, application generations, file bytes and executable permissions. npm publication rechecks the exact provider tarball before any registry write. Reuse preserves the original manifest and signed bytes across unrelated commits or product versions. Ordinary PR release rehearsals have no signing credentials.
 
-Both **Release publish (dsh)** and **Package CUA helper · macOS** accept an optional `cua_run_id`: enter the numeric run ID after `/actions/runs/` in the producer's GitHub URL, not its job ID. Leave it empty to search completed runs of these two workflows from the last 14 days for an unexpired matching artifact. Selection runs on the Mac before pnpm setup or dependency installation. A match skips installation, compilation, signing and notarization; an automatic miss rebuilds. An explicit run selects its latest attempt once and fails on unsuccessful helper packaging, missing or expired artifacts, or mismatched inputs. It never chooses an older attempt or another run. A later npm failure does not invalidate a successful helper job. GitHub API failures stop selection. The summary links the actual producer; a run that only reuses an artifact does not upload another copy, so use its linked producer run for manual selection. Artifacts are retained for 14 days.
+**Release publish (dsh)** accepts an optional `cua_run_id`: enter the numeric run ID after `/actions/runs/` in the producer's GitHub URL, not its job ID. It passes this selection through the helper's `workflow_call` input. Manual **Package CUA helper · macOS** runs only ask for `source_ref` and `preset`, and always discover artifacts automatically. Automatic discovery searches completed runs of these two workflows from the last 14 days for an unexpired matching artifact. Selection runs on the Mac before pnpm setup or dependency installation. A match skips installation, compilation, signing and notarization; an automatic miss rebuilds. An explicit run selects its latest attempt once and fails on unsuccessful helper packaging, missing or expired artifacts, or mismatched inputs. It never chooses an older attempt or another run. A later npm failure does not invalidate a successful helper job. GitHub API failures stop selection. The summary links the actual producer; a run that only reuses an artifact does not upload another copy, so use its linked producer run for manual selection. Artifacts are retained for 14 days.
 
 The [source digest](../../../../scripts/cua-helper/build-inputs.ts) includes tracked file paths, raw bytes and executable bits under `native/`, `scripts/cua-helper/` and `apps/desktop/scripts/`, plus the helper workflow, lockfile, workspace configuration, root TypeScript configurations and package-manager version. Product version and unrelated package sources are excluded. The build key additionally includes the preset, Node/Swift/Clang/Python versions, macOS SDK build, signing identity, Team ID and certificate-container digest; passwords are excluded. Missing inputs or unreadable configuration fail. Artifacts without these records require a new build. Source comparison still requires a Mac runner and checkout; matching inputs establish reuse eligibility, while the consuming pack job validates the downloaded application bytes.
 
diff --git a/packages/experimental/cua-macos/native/README.zh.md b/packages/experimental/cua-macos/native/README.zh.md
index 8b10bd80eb..8a5c9de58b 100644
--- a/packages/experimental/cua-macos/native/README.zh.md
+++ b/packages/experimental/cua-macos/native/README.zh.md
@@ -41,7 +41,7 @@ kind: "package-reference"
 
 工作流保留 `cua-helper.tgz` 和 `cua-helper.json`。清单记录原始构建的产品版本、commit、Team ID、两份应用摘要、源码摘要和构建摘要。[Release publish](../../../../.github/workflows/release-publish.yml)始终调用该工作流，再按返回的 run ID 和 artifact ID 下载所选产物，生成 provider 的 npm 包。准备步骤校验当前 helper 的源码摘要、选定的构建摘要、两种架构、应用目录、文件字节和执行权限。npm 发布在写入注册表前重新检查实际 provider tarball。无关 commit 或产品版本变化时，复用保留原始清单和已签名字节。普通 PR 发布检查不使用签名凭据。
 
-**Release publish (dsh)** 和 **Package CUA helper · macOS** 都接受可选的 `cua_run_id`：填写构建运行页面 URL 中 `/actions/runs/` 后的数字，不填 job ID。留空时查询这两个工作流最近 14 天内已结束的运行，查找未过期的匹配产物。选择在 Mac 上执行，早于 pnpm 准备和依赖安装。命中时跳过安装、编译、签名和公证，自动查找未命中时重新构建。手动指定 run ID 时选定最新 attempt；helper 打包未成功、产物缺失或过期、输入不匹配时直接失败，不选择更早的 attempt 或其他运行。后续 npm 失败不影响成功的 helper job。GitHub API 读取失败会停止选择。运行摘要链接实际构建者；只复用产物的运行不重新上传副本，手动选择时填写摘要所链接的构建 run ID。产物保留 14 天。
+**Release publish (dsh)** 接受可选的 `cua_run_id`：填写构建运行页面 URL 中 `/actions/runs/` 后的数字，不填 job ID。发布工作流通过 helper 的 `workflow_call` 参数传入这个选择。手动启动 **Package CUA helper · macOS** 只填写 `source_ref` 和 `preset`，始终自动查找产物。自动查找会查询这两个工作流最近 14 天内已结束的运行，选择未过期的匹配产物。选择在 Mac 上执行，早于 pnpm 准备和依赖安装。命中时跳过安装、编译、签名和公证，自动查找未命中时重新构建。手动指定 run ID 时选定最新 attempt；helper 打包未成功、产物缺失或过期、输入不匹配时直接失败，不选择更早的 attempt 或其他运行。后续 npm 失败不影响成功的 helper job。GitHub API 读取失败会停止选择。运行摘要链接实际构建者；只复用产物的运行不重新上传副本，手动选择时填写摘要所链接的构建 run ID。产物保留 14 天。
 
 [源码摘要](../../../../scripts/cua-helper/build-inputs.ts)覆盖 `native/`、`scripts/cua-helper/`、`apps/desktop/scripts/` 下受 Git 跟踪文件的路径、原始字节和执行权限，以及 helper 工作流、锁文件、workspace 配置、根目录 TypeScript 配置和包管理器版本。产品版本及无关包的源码不参与比较。构建摘要还包含 preset、Node/Swift/Clang/Python 版本、macOS SDK build、签名身份、Team ID 和证书容器摘要，不包含密码。输入缺失或配置无法读取时失败。没有这些记录的旧产物需要重新构建。源码比较仍需等待 Mac runner 并检出代码；输入匹配确定可复用性，消费产物的 pack job 再校验下载的应用字节。