ci(release): publish CLI package from release workflow

.github/workflows/release.yml

@@ -62,6 +62,26 @@ jobs:
           echo "node-linker=hoisted" >> .npmrc
           pnpm install
 
+      - name: Inject version into app package.json
+        shell: bash
+        run: |
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+            VERSION="${{ inputs.version }}"
+          else
+            VERSION="${{ github.ref_name }}"
+            VERSION="${VERSION#v}"
+          fi
+          echo "Injecting version: $VERSION"
+          node -e "
+            const fs = require('fs');
+            for (const p of ['apps/desktop/package.json', 'apps/cli/package.json']) {
+              const pkg = JSON.parse(fs.readFileSync(p, 'utf-8'));
+              pkg.version = '${VERSION}';
+              fs.writeFileSync(p, JSON.stringify(pkg, null, 2) + '\n');
+              console.log(p + ' → ' + '${VERSION}');
+            }
+          "
+
       - name: Cache Electron and electron-builder binaries
         uses: actions/cache@v5
         with:
@@ -139,6 +159,26 @@ jobs:
           echo "node-linker=hoisted" >> .npmrc
           pnpm install
 
+      - name: Inject version into app package.json
+        shell: bash
+        run: |
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+            VERSION="${{ inputs.version }}"
+          else
+            VERSION="${{ github.ref_name }}"
+            VERSION="${VERSION#v}"
+          fi
+          echo "Injecting version: $VERSION"
+          node -e "
+            const fs = require('fs');
+            for (const p of ['apps/desktop/package.json', 'apps/cli/package.json']) {
+              const pkg = JSON.parse(fs.readFileSync(p, 'utf-8'));
+              pkg.version = '${VERSION}';
+              fs.writeFileSync(p, JSON.stringify(pkg, null, 2) + '\n');
+              console.log(p + ' → ' + '${VERSION}');
+            }
+          "
+
       - name: Cache Electron and electron-builder binaries
         uses: actions/cache@v5
         with:
@@ -332,3 +372,70 @@ jobs:
           r2-bucket: ${{ secrets.R2_BUCKET_NAME }}
           source-dir: dist-yml
           destination-dir: releases/download
+
+  publish-cli:
+    needs: [release]
+    runs-on: ubuntu-latest
+
+    # 必须显式声明 id-token 写入权限，用于 OIDC 与 npm 握手交换临时 Token
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: '24'
+          package-manager-cache: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Install dependencies
+        run: |
+          echo "node-linker=hoisted" >> .npmrc
+          pnpm install
+
+      - name: Determine version and npm tag
+        id: npm_meta
+        shell: bash
+        run: |
+          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
+            VERSION="${{ inputs.version }}"
+          else
+            VERSION="${{ github.ref_name }}"
+            VERSION="${VERSION#v}"
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+          if [[ "$VERSION" =~ -beta\. ]]; then
+            echo "tag=beta" >> $GITHUB_OUTPUT
+          elif [[ "$VERSION" =~ -alpha\. ]]; then
+            echo "tag=alpha" >> $GITHUB_OUTPUT
+          elif [[ "$VERSION" =~ -rc\. ]]; then
+            echo "tag=rc" >> $GITHUB_OUTPUT
+          else
+            echo "tag=latest" >> $GITHUB_OUTPUT
+          fi
+
+          echo "Publishing chatlab-cli@$VERSION with tag $(grep tag <<< "$(cat $GITHUB_OUTPUT)" | tail -1 | cut -d= -f2)"
+
+      - name: Inject version
+        run: |
+          node -e "
+            const fs = require('fs');
+            const pkg = JSON.parse(fs.readFileSync('apps/cli/package.json', 'utf-8'));
+            pkg.version = '${{ steps.npm_meta.outputs.version }}';
+            fs.writeFileSync('apps/cli/package.json', JSON.stringify(pkg, null, 2) + '\n');
+          "
+
+      - name: Build CLI (with Web UI)
+        run: pnpm --filter chatlab-cli run build:full
+
+      - name: Publish to npm
+        working-directory: apps/cli
+        run: npm publish --tag ${{ steps.npm_meta.outputs.tag }} --provenance