diff --git a/.component-builds/auth_service_account/pnpm-workspace.yaml b/.component-builds/auth_service_account/pnpm-workspace.yaml
new file mode 100644
index 0000000..d4d28e2
--- /dev/null
+++ b/.component-builds/auth_service_account/pnpm-workspace.yaml
@@ -0,0 +1,8 @@
+allowBuilds:
+  esbuild: true
+  sharp: true
+  workerd: true
+onlyBuiltDependencies:
+  - esbuild
+  - sharp
+  - workerd
diff --git a/.component-builds/cron/pnpm-workspace.yaml b/.component-builds/cron/pnpm-workspace.yaml
new file mode 100644
index 0000000..d4d28e2
--- /dev/null
+++ b/.component-builds/cron/pnpm-workspace.yaml
@@ -0,0 +1,8 @@
+allowBuilds:
+  esbuild: true
+  sharp: true
+  workerd: true
+onlyBuiltDependencies:
+  - esbuild
+  - sharp
+  - workerd
diff --git a/.component-builds/http_request/pnpm-workspace.yaml b/.component-builds/http_request/pnpm-workspace.yaml
new file mode 100644
index 0000000..d4d28e2
--- /dev/null
+++ b/.component-builds/http_request/pnpm-workspace.yaml
@@ -0,0 +1,8 @@
+allowBuilds:
+  esbuild: true
+  sharp: true
+  workerd: true
+onlyBuiltDependencies:
+  - esbuild
+  - sharp
+  - workerd
diff --git a/.component-builds/kbdb_upsert_block/pnpm-workspace.yaml b/.component-builds/kbdb_upsert_block/pnpm-workspace.yaml
new file mode 100644
index 0000000..d4d28e2
--- /dev/null
+++ b/.component-builds/kbdb_upsert_block/pnpm-workspace.yaml
@@ -0,0 +1,8 @@
+allowBuilds:
+  esbuild: true
+  sharp: true
+  workerd: true
+onlyBuiltDependencies:
+  - esbuild
+  - sharp
+  - workerd
diff --git a/.component-builds/km_writer/pnpm-workspace.yaml b/.component-builds/km_writer/pnpm-workspace.yaml
new file mode 100644
index 0000000..d4d28e2
--- /dev/null
+++ b/.component-builds/km_writer/pnpm-workspace.yaml
@@ -0,0 +1,8 @@
+allowBuilds:
+  esbuild: true
+  sharp: true
+  workerd: true
+onlyBuiltDependencies:
+  - esbuild
+  - sharp
+  - workerd
diff --git a/.component-builds/platform_crypto/pnpm-workspace.yaml b/.component-builds/platform_crypto/pnpm-workspace.yaml
new file mode 100644
index 0000000..d4d28e2
--- /dev/null
+++ b/.component-builds/platform_crypto/pnpm-workspace.yaml
@@ -0,0 +1,8 @@
+allowBuilds:
+  esbuild: true
+  sharp: true
+  workerd: true
+onlyBuiltDependencies:
+  - esbuild
+  - sharp
+  - workerd
diff --git a/builtins/pnpm-workspace.yaml b/builtins/pnpm-workspace.yaml
new file mode 100644
index 0000000..d4d28e2
--- /dev/null
+++ b/builtins/pnpm-workspace.yaml
@@ -0,0 +1,8 @@
+allowBuilds:
+  esbuild: true
+  sharp: true
+  workerd: true
+onlyBuiltDependencies:
+  - esbuild
+  - sharp
+  - workerd
diff --git a/cli/src/lib/deploy.ts b/cli/src/lib/deploy.ts
index 1577d0f..909760c 100644
--- a/cli/src/lib/deploy.ts
+++ b/cli/src/lib/deploy.ts
@@ -336,15 +336,24 @@ function runWranglerDeploy(dir: string, ctx: DeployContext): void {
     const installer = existsSync(join(dir, 'pnpm-lock.yaml'))
       ? ['pnpm', 'install', '--frozen-lockfile']
       : ['npm', 'install', '--no-audit', '--no-fund'];
-    execFileSync(installer[0], installer.slice(1), { cwd: dir, stdio: 'ignore' });
+    runStep(installer[0], installer.slice(1), dir, process.env);
   }
-  execFileSync('wrangler', ['deploy'], {
-    cwd: dir,
-    stdio: 'ignore',
-    env: {
-      ...process.env,
-      CLOUDFLARE_API_TOKEN: ctx.apiToken,
-      CLOUDFLARE_ACCOUNT_ID: ctx.accountId,
-    },
+  runStep('wrangler', ['deploy'], dir, {
+    ...process.env,
+    CLOUDFLARE_API_TOKEN: ctx.apiToken,
+    CLOUDFLARE_ACCOUNT_ID: ctx.accountId,
   });
 }
+
+/** 跑一個部署步驟，失敗時把 stderr 尾段帶進錯誤訊息——stdio ignore 會吞掉真因，
+ *  用戶只看到「Command failed: pnpm install」無從診斷（壓測 2026-06-12：
+ *  ERR_PNPM_IGNORED_BUILDS 被吞，10/23 失敗查不到原因）。*/
+function runStep(cmd: string, args: string[], dir: string, env: NodeJS.ProcessEnv): void {
+  try {
+    execFileSync(cmd, args, { cwd: dir, stdio: ['ignore', 'ignore', 'pipe'], env });
+  } catch (e) {
+    const stderr = (e as { stderr?: Buffer }).stderr?.toString().trim() ?? '';
+    const tail = stderr.split('\n').slice(-3).join(' | ').slice(0, 300);
+    throw new Error(`${cmd} ${args.join(' ')} 失敗${tail ? `：${tail}` : ''}`);
+  }
+}
diff --git a/kbdb/pnpm-workspace.yaml b/kbdb/pnpm-workspace.yaml
new file mode 100644
index 0000000..d4d28e2
--- /dev/null
+++ b/kbdb/pnpm-workspace.yaml
@@ -0,0 +1,8 @@
+allowBuilds:
+  esbuild: true
+  sharp: true
+  workerd: true
+onlyBuiltDependencies:
+  - esbuild
+  - sharp
+  - workerd
diff --git a/mcp/pnpm-workspace.yaml b/mcp/pnpm-workspace.yaml
new file mode 100644
index 0000000..d4d28e2
--- /dev/null
+++ b/mcp/pnpm-workspace.yaml
@@ -0,0 +1,8 @@
+allowBuilds:
+  esbuild: true
+  sharp: true
+  workerd: true
+onlyBuiltDependencies:
+  - esbuild
+  - sharp
+  - workerd
diff --git a/registry/pnpm-workspace.yaml b/registry/pnpm-workspace.yaml
new file mode 100644
index 0000000..d4d28e2
--- /dev/null
+++ b/registry/pnpm-workspace.yaml
@@ -0,0 +1,8 @@
+allowBuilds:
+  esbuild: true
+  sharp: true
+  workerd: true
+onlyBuiltDependencies:
+  - esbuild
+  - sharp
+  - workerd