@@ -3,6 +3,8 @@ name: Publish
 # One workflow publishes every channel, since npm trusted publishing names a single workflow file.
 # - canary / dev: every push to that branch
 # - latest: run by hand on `main`; publishes each package whose version is not on npm yet
+# dev and latest also build the standalone binary and attach it to a GitHub Release: `devel`, one
+# prerelease replaced on every dev push, or `cli-v<version>`, marked latest. canary stays npm-only.
 on:
    push:
       branches: [canary, dev]
@@ -26,9 +28,20 @@ env:
 jobs:
    guard:
       runs-on: ubuntu-latest
+      # The run's release id, computed once so every job publishes under the same version.
+      outputs:
+         id: ${{ steps.release.outputs.id }}
       steps:
          - if: github.event_name == 'workflow_dispatch' && github.ref_name != 'main'
            run: echo "::error::latest is published from main only" && exit 1
+         - uses: actions/checkout@v6
+         - uses: voidzero-dev/setup-vp@v1.21.1
+           with:
+              node-version: 24
+              run-install: false
+              cache: false
+         - id: release
+           run: echo "id=$(node scripts/version.mjs "$CHANNEL")" >> "$GITHUB_OUTPUT"
 
    tui:
       needs: guard
@@ -75,8 +88,10 @@ jobs:
               retention-days: 1
 
    publish:
-      needs: tui
+      needs: [guard, tui]
       runs-on: ubuntu-latest
+      env:
+         CODEWORK_RELEASE_ID: ${{ needs.guard.outputs.id }}
       steps:
          - uses: actions/checkout@v6
          - uses: voidzero-dev/setup-vp@v1.21.1
@@ -95,3 +110,93 @@ jobs:
               pattern: tui-*
               path: packages/tui/dist/bin
          - run: vp run release "$CHANNEL"
+
+   binary:
+      needs: [guard, tui]
+      if: github.ref_name != 'canary'
+      name: binary (${{ matrix.binary }})
+      runs-on: ${{ matrix.runner }}
+      strategy:
+         fail-fast: true
+         matrix:
+            # Each on its own platform: --build-sea runs that platform's Node, and macOS signs.
+            include:
+               - binary: cli-darwin-arm64
+                 tui: tui-darwin-arm64
+                 runner: macos-14
+               - binary: cli-linux-arm64
+                 tui: tui-linux-arm64
+                 runner: ubuntu-24.04-arm
+               - binary: cli-linux-x64
+                 tui: tui-linux-x64
+                 runner: ubuntu-24.04
+      env:
+         CODEWORK_RELEASE_ID: ${{ needs.guard.outputs.id }}
+      steps:
+         - uses: actions/checkout@v6
+         # node-liblzma builds against the system liblzma at install. The bundle rebuilds it with xz
+         # linked statically, which needs cmake; the runners ship it.
+         - if: runner.os == 'Linux'
+           run: sudo apt-get update && sudo apt-get install -y liblzma-dev
+         - uses: voidzero-dev/setup-vp@v1.21.1
+           with:
+              node-version: 24
+              run-install: false
+              cache: false
+         - run: vp install --frozen-lockfile --filter '!@codeworksh/www'
+         - uses: actions/download-artifact@v8
+           with:
+              name: ${{ matrix.tui }}
+              path: tui
+         - run: |
+              chmod +x tui/codework-tui
+              echo "CODEWORK_TUI_BIN=$GITHUB_WORKSPACE/tui/codework-tui" >> "$GITHUB_ENV"
+              echo "CODEWORK_VERSION=$(node scripts/version.mjs "$CHANNEL" packages/codework)" >> "$GITHUB_ENV"
+         - working-directory: packages/codework
+           run: vp run bundle && vp run sea
+         # Without API keys only the offline case runs: the binary with no Node on PATH unpacks its
+         # assets and runs a plugin through its own effect.
+         - working-directory: packages/codework
+           run: vp test test/sea.test.ts
+         - run: tar -czf ${{ matrix.binary }}.tar.gz -C packages/codework/dist/sea codework
+         - uses: actions/upload-artifact@v7
+           with:
+              name: ${{ matrix.binary }}
+              path: ${{ matrix.binary }}.tar.gz
+              if-no-files-found: error
+              retention-days: 1
+
+   # After npm, so a release never names a version npm does not have.
+   release:
+      needs: [guard, publish, binary]
+      if: github.ref_name != 'canary'
+      runs-on: ubuntu-latest
+      permissions:
+         contents: write
+      env:
+         CODEWORK_RELEASE_ID: ${{ needs.guard.outputs.id }}
+         GH_TOKEN: ${{ github.token }}
+      steps:
+         - uses: actions/checkout@v6
+         - uses: voidzero-dev/setup-vp@v1.21.1
+           with:
+              node-version: 24
+              run-install: false
+              cache: false
+         - uses: actions/download-artifact@v8
+           with:
+              pattern: cli-*
+              path: release
+              merge-multiple: true
+         - run: |
+              version="$(node scripts/version.mjs "$CHANNEL" packages/codework)"
+              if [ "$CHANNEL" = dev ]; then
+                 gh release delete devel --cleanup-tag --yes || true
+                 gh release create devel release/*.tar.gz --prerelease --target "$GITHUB_SHA" \
+                    --title "CLI $version" --notes "Development build $version, from $GITHUB_SHA."
+              elif gh release view "cli-v$version" > /dev/null 2>&1; then
+                 echo "cli-v$version is already released"
+              else
+                 gh release create "cli-v$version" release/*.tar.gz --latest --target "$GITHUB_SHA" \
+                    --title "CLI $version" --generate-notes
+              fi
@@ -6,7 +6,9 @@
 //                    files from beside their own modules (WASM, workers, native addons)
 //
 // Run under `--conditions=development` (see `scripts/shared.mjs`). The TUI comes from
-// `CODEWORK_TUI_BIN`, else the local release build. Rebuilding xz statically needs cmake.
+// `CODEWORK_TUI_BIN`, else the local release build. `CODEWORK_VERSION` replaces the version the CLI
+// reports, which a canary or dev release computes (scripts/version.mjs). Rebuilding xz statically
+// needs cmake.
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import {
@@ -155,6 +157,14 @@ for (const file of files.map((entry) => join(entry.parentPath, entry.name)).sort
 await bundle(join(root, "src/sea.ts"), out, "codework.mjs", {
 	define: { CODEWORK_ASSETS: JSON.stringify(hash.digest("hex").slice(0, 16)) },
 	plugins: [
+		{
+			name: "codework:version",
+			enforce: "pre",
+			load: (id) =>
+				id === join(root, "package.json") && process.env["CODEWORK_VERSION"] !== undefined
+					? JSON.stringify({ ...JSON.parse(readFileSync(id, "utf8")), version: process.env["CODEWORK_VERSION"] })
+					: undefined,
+		},
 		{
 			name: "codework:shared",
 			resolveId: (id) => (id === "virtual:codework-shared" ? "\0virtual:codework-shared" : undefined),
 
@@ -1,6 +1,4 @@
 {
-	"version": "codework v0.2.0",
-	"cache": "<hash>-darwin-arm64",
 	"assets": [
 		"codework-tui",
 		"node_modules",
 
@@ -95,7 +95,8 @@ describe.skipIf(!existsSync(binary))("the standalone binary", () => {
 
 		const version = spawn(binary, ["--version"]);
 		expect(version.status, version.stderr).toBe(0);
-		expect(version.stdout.trim()).toBe(`codework v${pkg.version}`);
+		// A canary or dev release builds in the version it publishes under (scripts/version.mjs).
+		expect(version.stdout.trim()).toBe(`codework v${process.env["CODEWORK_VERSION"] ?? pkg.version}`);
 
 		expect(added.status, added.stderr).toBe(0);
 		const listed = spawn(binary, ["plugin", "list"]);
@@ -109,18 +110,16 @@ describe.skipIf(!existsSync(binary))("the standalone binary", () => {
 		const assets = join(cache, unpacked!);
 		expect(statSync(join(assets, "codework-tui")).mode & 0o111).not.toBe(0);
 
+		expect(unpacked).toMatch(new RegExp(`^[0-9a-f]{16}-${process.platform}-${process.arch}$`));
+
+		// One artifact for every platform: what is unpacked does not depend on it.
 		await expect(
 			`${JSON.stringify(
-				{
-					version: version.stdout.trim(),
-					cache: unpacked!.replace(/^[0-9a-f]{16}-/, "<hash>-"),
-					assets: readdirSync(assets).sort(),
-					packages: readdirSync(join(assets, "node_modules")).sort(),
-				},
+				{ assets: readdirSync(assets).sort(), packages: readdirSync(join(assets, "node_modules")).sort() },
 				null,
 				"\t",
 			)}\n`,
-		).toMatchFileSnapshot(`./__artifacts__/sea.${process.platform}-${process.arch}.json`);
+		).toMatchFileSnapshot("./__artifacts__/sea.json");
 	});
 
 	describe.each(LIVE)("against live $name", (live) => {
 
@@ -1,14 +1,15 @@
 // Publishes the package chain for one channel: `canary`, `dev` or `latest`. CI runs it (see
 // .github/workflows/publish.yml) after the TUI binaries are staged under packages/tui/dist/bin.
 //
-// canary/dev publish every package as a prerelease of its version (see previewId).
+// canary/dev publish every package as a prerelease of its version (see scripts/version.mjs).
 // latest publishes each package whose manifest version is not on npm yet, so a release is a
 // local `vp run bump` followed by a run on main.
 import { spawnSync } from "node:child_process";
 import { resolve } from "node:path";
 import { setTimeout } from "node:timers/promises";
 
 import { distTags, isPublished } from "./registry.mjs";
+import { releaseId, releaseVersion } from "./version.mjs";
 import { publishablePackages, repoRoot as root, workspaceDependencies } from "./workspace.mjs";
 
 const [channel, ...forwardArgs] = process.argv.slice(2);
@@ -18,24 +19,11 @@ if (!["canary", "dev", "latest"].includes(channel)) {
 }
 const dryRun = forwardArgs.includes("--dry-run");
 
-// dev: `<YYYYMMDDHHMMSS>` (UTC). canary: `<run>.<attempt>.g<sha>`.
-function previewId() {
-	const { GITHUB_RUN_NUMBER: run = "0", GITHUB_RUN_ATTEMPT: attempt = "0" } = process.env;
-	if (!process.env.GITHUB_RUN_NUMBER && !dryRun) {
-		throw new Error(`A ${channel} release runs in CI; locally only --dry-run is supported`);
-	}
-	if (channel === "dev") return new Date().toISOString().slice(0, 19).replace(/\D/g, "");
-	const sha = spawnSync("git", ["rev-parse", "--short=8", "HEAD"], { cwd: root }).stdout.toString().trim();
-	return `${run}.${attempt}.g${sha}`;
-}
-
-const id = channel === "latest" ? undefined : previewId();
+const id = releaseId(channel, { dryRun });
 const packages = [];
 for (const { manifest } of publishablePackages()) {
-	const base = /^\d+\.\d+\.\d+/.exec(manifest.version)?.[0];
-	if (!base) throw new Error(`Invalid package version: ${manifest.version}`);
 	if (id) {
-		packages.push({ manifest, version: `${base}-${channel}.${id}` });
+		packages.push({ manifest, version: releaseVersion(manifest.version, channel, id) });
 	} else if (await isPublished(manifest.name, manifest.version)) {
 		console.error(`Skipping ${manifest.name}@${manifest.version}: already published`);
 	} else {
 
@@ -0,0 +1,47 @@
+// The versions one publish run gives its packages. canary and dev publish each package as a
+// prerelease of its manifest version; latest publishes the manifest version as is.
+//
+//   node scripts/version.mjs <channel>             the run's release id (empty for latest)
+//   node scripts/version.mjs <channel> <package>   that package's version, e.g. packages/codework
+//
+// The first job of .github/workflows/publish.yml computes the id once and hands it to the later
+// jobs as CODEWORK_RELEASE_ID, so the npm packages and the standalone binary carry one version.
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+import { repoRoot as root } from "./workspace.mjs";
+
+/** dev: `<YYYYMMDDHHMMSS>` (UTC). canary: `<run>.<attempt>.g<sha>`. latest: none. */
+export function releaseId(channel, { dryRun = false } = {}) {
+	if (channel === "latest") return undefined;
+	if (process.env.CODEWORK_RELEASE_ID) return process.env.CODEWORK_RELEASE_ID;
+	const { GITHUB_RUN_NUMBER: run = "0", GITHUB_RUN_ATTEMPT: attempt = "0" } = process.env;
+	if (!process.env.GITHUB_RUN_NUMBER && !dryRun) {
+		throw new Error(`A ${channel} release runs in CI; locally only --dry-run is supported`);
+	}
+	if (channel === "dev") return new Date().toISOString().slice(0, 19).replace(/\D/g, "");
+	const sha = spawnSync("git", ["rev-parse", "--short=8", "HEAD"], { cwd: root }).stdout.toString().trim();
+	return `${run}.${attempt}.g${sha}`;
+}
+
+/** `version` as `channel` publishes it under the run's `id`. */
+export function releaseVersion(version, channel, id) {
+	const base = /^\d+\.\d+\.\d+/.exec(version)?.[0];
+	if (!base) throw new Error(`Invalid package version: ${version}`);
+	return id ? `${base}-${channel}.${id}` : version;
+}
+
+if (import.meta.main) {
+	const [channel, pkg] = process.argv.slice(2);
+	if (!["canary", "dev", "latest"].includes(channel)) {
+		console.error("Usage: node scripts/version.mjs <canary|dev|latest> [package directory]");
+		process.exit(1);
+	}
+	const id = releaseId(channel);
+	if (pkg === undefined) console.log(id ?? "");
+	else {
+		const { version } = JSON.parse(readFileSync(resolve(root, pkg, "package.json"), "utf8"));
+		console.log(releaseVersion(version, channel, id));
+	}
+}
Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,4 @@`
`1`	`1`	`{`
`2`		`- "version": "codework v0.2.0",`
`3`		`- "cache": "<hash>-darwin-arm64",`
`4`	`2`	`"assets": [`
`5`	`3`	`"codework-tui",`
`6`	`4`	`"node_modules",`