diff --git a/README.md b/README.md
index 453634f..86b114f 100644
--- a/README.md
+++ b/README.md
@@ -181,7 +181,7 @@ dsh plugin --profile web add D:\path\to\dsh-telegram-channel
 
 | 现象 | 处理 |
 |---|---|
-| `allowBuilds` / `ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED` | 再跑一遍安装脚本，或手工在 `~\.dsh\profiles\web\pnpm-workspace.yaml` 加 `allowBuilds.dsh-telegram-channel: true` |
+| `ERR_PNPM_IGNORED_BUILDS` / allowBuilds | pnpm 11 起：**仅** `dsh-telegram-channel: true` 不够（git 包无效）。在 `~\.dsh\profiles\web\pnpm-workspace.yaml` 写入仓库级授权后重装：<br>`'dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git': true`<br>再跑菜单 **1**（新版安装脚本会自动写） |
 | `duplicate loader entry id: dsh-telegram-channel` | 用户 patch **不要 insert** 同名 id；用上面的 `- id:` 覆盖，或只用环境变量白名单 |
 | 手机完全没回复 / ConnectTimeout | 打开本地代理（如 7890），重启 `dsh web` |
 | `missing bot token` | 检查环境变量；**新开终端**再 `dsh web` |
diff --git a/package.json b/package.json
index 1695629..b75ca22 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "dsh-telegram-channel",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "DeepSeek Harness Telegram mobile remote: workspace→session picker (Web-aligned), /model switch, same trajectory — dsh-plugin",
   "keywords": [
     "telegram",
diff --git a/scripts/install.ps1 b/scripts/install.ps1
index 56619d7..5f19822 100644
--- a/scripts/install.ps1
+++ b/scripts/install.ps1
@@ -74,13 +74,20 @@ function Get-UserEnv([string] $Name) {
   return [Environment]::GetEnvironmentVariable($Name, 'Process')
 }
 
+# pnpm 10+/11: package-name alone does NOT approve git/tarball installs.
+# Need the stable repo key (works across commits). See: https://pnpm.io/settings/build
+function Get-AllowBuildsEntries {
+  return @(
+    '  dsh-telegram-channel: true'
+    "  'dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git': true"
+  )
+}
+
 function Ensure-AllowBuilds([string] $ProfileDir) {
   $path = Join-Path $ProfileDir 'pnpm-workspace.yaml'
-  $blockLines = @(
-    'allowBuilds:'
-    '  dsh-telegram-channel: true'
-  )
-  $block = $blockLines -join "`r`n"
+  $entries = Get-AllowBuildsEntries
+  $block = (@('allowBuilds:') + $entries) -join "`r`n"
+
   if (-not (Test-Path -LiteralPath $path)) {
     $content = @(
       'packages:'
@@ -97,18 +104,31 @@ function Ensure-AllowBuilds([string] $ProfileDir) {
   }
 
   $raw = Get-Content -LiteralPath $path -Raw
-  if ($raw -match '(?m)^\s*dsh-telegram-channel\s*:\s*true\s*$') {
-    Write-Host 'allowBuilds already present, skip'
+  # Drop pnpm auto-placeholders ("set this to true or false") for this package.
+  $raw = [regex]::Replace(
+    $raw,
+    '(?m)^\s*[''"]?dsh-telegram-channel@https://codeload\.github\.com/[^\r\n]+:\s*set this to true or false\s*\r?\n?',
+    ''
+  )
+
+  $repoKeyPresent = $raw -match 'dsh-telegram-channel@git\+https://github\.com/hi-wenw/dsh-telegram-channel\.git'
+  $nameKeyPresent = $raw -match '(?m)^\s*dsh-telegram-channel\s*:\s*true\s*$'
+  if ($repoKeyPresent -and $nameKeyPresent) {
+    Write-Host 'allowBuilds already present (git repo + package name), skip'
     return
   }
 
+  $toInsert = @()
+  if (-not $nameKeyPresent) { $toInsert += '  dsh-telegram-channel: true' }
+  if (-not $repoKeyPresent) {
+    $toInsert += "  'dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git': true"
+  }
+  $insertText = ($toInsert -join "`r`n")
+
   if ($raw -match '(?m)^allowBuilds\s*:') {
-    if ($raw -notmatch '(?m)^allowBuilds\s*:[\s\S]*?dsh-telegram-channel\s*:') {
-      $raw = $raw -replace '(?m)^(allowBuilds\s*:)', ('$1' + "`r`n  dsh-telegram-channel: true")
-      $out = ($raw.TrimEnd() + "`r`n")
-      Set-Content -LiteralPath $path -Value $out -Encoding utf8
-      Write-Host ("Wrote allowBuilds.dsh-telegram-channel -> " + $path)
-    }
+    $raw = $raw -replace '(?m)^(allowBuilds\s*:)', ('$1' + "`r`n" + $insertText)
+    Set-Content -LiteralPath $path -Value ($raw.TrimEnd() + "`r`n") -Encoding utf8
+    Write-Host ("Updated allowBuilds (git repo approval) -> " + $path)
     return
   }
 
diff --git a/scripts/install.sh b/scripts/install.sh
index e311932..5c4b7bb 100644
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -58,6 +58,7 @@ persist_env() {
   done
 }
 
+# pnpm 10+/11: package-name alone does NOT approve git/tarball installs.
 ensure_allow_builds() {
   local ws="$1/pnpm-workspace.yaml"
   if [[ ! -f "$ws" ]]; then
@@ -70,13 +71,54 @@ autoInstallPeers: false
 
 allowBuilds:
   dsh-telegram-channel: true
+  'dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git': true
 EOF
-  elif ! grep -q 'dsh-telegram-channel:' "$ws"; then
-    if grep -q '^allowBuilds:' "$ws"; then
-      awk 'BEGIN{done=0} /^allowBuilds:/{print; print "  dsh-telegram-channel: true"; done=1; next} {print} END{if(!done){print ""; print "allowBuilds:"; print "  dsh-telegram-channel: true"}}' "$ws" >"$ws.tmp" && mv "$ws.tmp" "$ws"
-    else
-      printf '\nallowBuilds:\n  dsh-telegram-channel: true\n' >>"$ws"
-    fi
+    echo "Created $ws (allowBuilds)"
+    return
+  fi
+
+  # Drop pnpm auto-placeholders for this package.
+  if grep -q 'dsh-telegram-channel@https://codeload.github.com' "$ws" 2>/dev/null; then
+    tmp="$(mktemp)"
+    grep -v 'dsh-telegram-channel@https://codeload.github.com.*set this to true or false' "$ws" >"$tmp" || true
+    mv "$tmp" "$ws"
+  fi
+
+  local need_name=0 need_repo=0
+  grep -qE '^[[:space:]]*dsh-telegram-channel:[[:space:]]*true[[:space:]]*$' "$ws" || need_name=1
+  grep -q 'dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git' "$ws" || need_repo=1
+  if [[ "$need_name" -eq 0 && "$need_repo" -eq 0 ]]; then
+    echo "allowBuilds already present (git repo + package name), skip"
+    return
+  fi
+
+  local insert=""
+  [[ "$need_name" -eq 1 ]] && insert+=$'  dsh-telegram-channel: true\n'
+  [[ "$need_repo" -eq 1 ]] && insert+=$'  '\''dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git'\'': true\n'
+
+  if grep -q '^allowBuilds:' "$ws"; then
+    tmp="$(mktemp)"
+    awk -v insert="$insert" '
+      BEGIN { done=0 }
+      /^allowBuilds:/ {
+        print
+        printf "%s", insert
+        done=1
+        next
+      }
+      { print }
+      END {
+        if (!done) {
+          print ""
+          print "allowBuilds:"
+          printf "%s", insert
+        }
+      }
+    ' "$ws" >"$tmp" && mv "$tmp" "$ws"
+    echo "Updated allowBuilds (git repo approval) -> $ws"
+  else
+    printf '\nallowBuilds:\n%s' "$insert" >>"$ws"
+    echo "Appended allowBuilds -> $ws"
   fi
 }
 
diff --git a/scripts/manage.ps1 b/scripts/manage.ps1
index 3e97852..662df52 100644
--- a/scripts/manage.ps1
+++ b/scripts/manage.ps1
@@ -71,13 +71,19 @@ function Get-UserEnv([string] $Name) {
   return [Environment]::GetEnvironmentVariable($Name, 'Process')
 }
 
+# pnpm 10+/11: package-name alone does NOT approve git/tarball installs.
+function Get-AllowBuildsEntries {
+  return @(
+    '  dsh-telegram-channel: true'
+    "  'dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git': true"
+  )
+}
+
 function Ensure-AllowBuilds([string] $ProfileDir) {
   $path = Join-Path $ProfileDir 'pnpm-workspace.yaml'
-  $blockLines = @(
-    'allowBuilds:'
-    '  dsh-telegram-channel: true'
-  )
-  $block = $blockLines -join "`r`n"
+  $entries = Get-AllowBuildsEntries
+  $block = (@('allowBuilds:') + $entries) -join "`r`n"
+
   if (-not (Test-Path -LiteralPath $path)) {
     $content = @(
       'packages:'
@@ -94,18 +100,30 @@ function Ensure-AllowBuilds([string] $ProfileDir) {
   }
 
   $raw = Get-Content -LiteralPath $path -Raw
-  if ($raw -match '(?m)^\s*dsh-telegram-channel\s*:\s*true\s*$') {
-    Write-Host 'allowBuilds already present, skip'
+  $raw = [regex]::Replace(
+    $raw,
+    '(?m)^\s*[''"]?dsh-telegram-channel@https://codeload\.github\.com/[^\r\n]+:\s*set this to true or false\s*\r?\n?',
+    ''
+  )
+
+  $repoKeyPresent = $raw -match 'dsh-telegram-channel@git\+https://github\.com/hi-wenw/dsh-telegram-channel\.git'
+  $nameKeyPresent = $raw -match '(?m)^\s*dsh-telegram-channel\s*:\s*true\s*$'
+  if ($repoKeyPresent -and $nameKeyPresent) {
+    Write-Host 'allowBuilds already present (git repo + package name), skip'
     return
   }
 
+  $toInsert = @()
+  if (-not $nameKeyPresent) { $toInsert += '  dsh-telegram-channel: true' }
+  if (-not $repoKeyPresent) {
+    $toInsert += "  'dsh-telegram-channel@git+https://github.com/hi-wenw/dsh-telegram-channel.git': true"
+  }
+  $insertText = ($toInsert -join "`r`n")
+
   if ($raw -match '(?m)^allowBuilds\s*:') {
-    if ($raw -notmatch '(?m)^allowBuilds\s*:[\s\S]*?dsh-telegram-channel\s*:') {
-      $raw = $raw -replace '(?m)^(allowBuilds\s*:)', ('$1' + "`r`n  dsh-telegram-channel: true")
-      $out = ($raw.TrimEnd() + "`r`n")
-      Set-Content -LiteralPath $path -Value $out -Encoding utf8
-      Write-Host ("Wrote allowBuilds.dsh-telegram-channel -> " + $path)
-    }
+    $raw = $raw -replace '(?m)^(allowBuilds\s*:)', ('$1' + "`r`n" + $insertText)
+    Set-Content -LiteralPath $path -Value ($raw.TrimEnd() + "`r`n") -Encoding utf8
+    Write-Host ("Updated allowBuilds (git repo approval) -> " + $path)
     return
   }