diff --git a/lib/sync.mjs b/lib/sync.mjs
index 9e7921d..39c54df 100644
--- a/lib/sync.mjs
+++ b/lib/sync.mjs
@@ -238,6 +238,12 @@ export function dshNodeModules() {
     path.resolve(path.dirname(real), '..', 'node_modules'),
     path.resolve(path.dirname(bin), '..', 'lib', 'node_modules', '@deepseek-ai', 'dsh', 'node_modules'),
   ]
+  // Hoisted layouts (npx, pnpm dlx, flat npm installs): the bin lives inside
+  // <root>/node_modules/@deepseek-ai/dsh/..., so walk up to the enclosing node_modules.
+  for (let d = path.dirname(real); d && d !== path.dirname(d); d = path.dirname(d)) {
+    if (path.basename(d) === 'node_modules') { cand.push(d); break }
+  }
+  for (const c of cand) if (fs.existsSync(path.join(c, '@deepseek-ai', 'cordis-plugin-include'))) return c
   for (const c of cand) if (fs.existsSync(path.join(c, '@deepseek-ai'))) return c
   return null
 }
diff --git a/package.json b/package.json
index ac9fb5c..4bffd6e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@local/dsh-remote",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Claude-Desktop-style remote control for DSH: master/slave link, every device's sessions on every device (/r/<device>/), plugin + config sync with opt-in secrets.",
   "private": true,
   "type": "module",