ci(tui): build and publish prebuilt TUI binaries on canary

`@codeworksh/cli` depends on `@codeworksh/tui`, which nothing
published, so canary could not release the CLI.

- `.github/workflows/tui.yml` (reusable) builds the TUI for macOS
  arm64/x64 and Linux arm64/x64, Linux as static musl binaries, and
  uploads one artifact per platform package.
- Four platform packages, `@codeworksh/tui-<os>-<arch>`, live under
  packages/tui/npm as workspace packages with `os`/`cpu` set; their
  build stages the downloaded binary. `@codeworksh/tui` depends on them
  as optional workspace dependencies, so publish pins them like any
  other workspace dependency.
- canary.yml runs the build first, then publishes in order
  aikit, plugin, harness, the platform packages, tui, cli.
- dev.yml runs `cargo check` on the TUI.
- `publish.mjs` knows the tui targets and carries `os`/`cpu`;
  `pnpm bump:tui` moves all five versions together.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: sanchitrk

.github/workflows/canary.yml

@@ -15,7 +15,11 @@ concurrency:
    cancel-in-progress: false
 
 jobs:
+   tui:
+      uses: ./.github/workflows/tui.yml
+
    publish:
+      needs: tui
       runs-on: ubuntu-latest
       steps:
          - uses: actions/checkout@v6
@@ -30,5 +34,10 @@ jobs:
          - run: vp run @codeworksh/aikit#build
          - run: vp check packages scripts .github
          - run: vp run --filter './packages/*' --concurrency-limit 2 typecheck
+         # One directory per platform package; each package's build stages its binary from here.
+         - uses: actions/download-artifact@v4
+           with:
+              pattern: tui-*
+              path: packages/tui/dist/bin
          - name: Publish all packages under canary
            run: node scripts/canary.mjs

.github/workflows/dev.yml

@@ -33,3 +33,16 @@ jobs:
          - run: vp check packages scripts .github
          - run: vp run --filter './packages/*' --concurrency-limit 2 typecheck
          - run: vp run --filter './packages/*' --concurrency-limit 2 build
+
+   tui:
+      runs-on: ubuntu-latest
+      defaults:
+         run:
+            working-directory: packages/tui
+      steps:
+         - uses: actions/checkout@v6
+         - uses: dtolnay/rust-toolchain@stable
+         - uses: Swatinem/rust-cache@v2
+           with:
+              workspaces: packages/tui
+         - run: cargo check --locked

.github/workflows/tui.yml

@@ -0,0 +1,59 @@
+name: TUI Binaries
+
+# Builds the Rust TUI for every published platform and uploads one artifact per
+# platform package, named after it (`tui-<os>-<arch>`). Publishing workflows call
+# this and stage the artifacts under packages/tui/dist/bin before `publish.mjs`.
+on:
+   workflow_call:
+   workflow_dispatch:
+
+permissions:
+   contents: read
+
+jobs:
+   build:
+      name: build (${{ matrix.package }})
+      runs-on: ${{ matrix.runner }}
+      strategy:
+         fail-fast: true
+         matrix:
+            include:
+               - package: tui-darwin-arm64
+                 runner: macos-14
+                 target: aarch64-apple-darwin
+               - package: tui-darwin-x64
+                 runner: macos-14
+                 target: x86_64-apple-darwin
+               # Linux binaries link musl statically, so one build runs on any distro.
+               - package: tui-linux-arm64
+                 runner: ubuntu-24.04-arm
+                 target: aarch64-unknown-linux-musl
+               - package: tui-linux-x64
+                 runner: ubuntu-24.04
+                 target: x86_64-unknown-linux-musl
+      defaults:
+         run:
+            working-directory: packages/tui
+      steps:
+         - uses: actions/checkout@v6
+         - if: runner.os == 'Linux'
+           run: sudo apt-get update && sudo apt-get install -y musl-tools
+         - uses: dtolnay/rust-toolchain@stable
+           with:
+              targets: ${{ matrix.target }}
+         - uses: Swatinem/rust-cache@v2
+           with:
+              workspaces: packages/tui
+              key: ${{ matrix.target }}
+         - run: cargo build --release --locked --target ${{ matrix.target }}
+         - name: Inspect binary
+           run: file target/${{ matrix.target }}/release/codework-tui
+         - if: runner.os == 'Linux'
+           name: Require a static binary
+           run: file target/${{ matrix.target }}/release/codework-tui | grep -E "static(-pie)? linked|statically linked"
+         - uses: actions/upload-artifact@v4
+           with:
+              name: ${{ matrix.package }}
+              path: packages/tui/target/${{ matrix.target }}/release/codework-tui
+              if-no-files-found: error
+              retention-days: 7

CLAUDE.md

@@ -87,4 +87,4 @@ Flow:
 3. `git push && git push --tag`.
 4. `pnpm release:aikit:dry` to preview the tarball, then `pnpm release:aikit` to publish. Use `pnpm release:aikit:dev` for a prerelease under the `dev` dist-tag.
 
-A workspace dependency is published at its manifest version, which must already be on the registry. A dependency with only dev builds (e.g. plugin, when releasing harness) is pinned explicitly, as a version or a dist-tag resolved at publish time — there is no implicit fallback: `pnpm release:harness:dev --dep @codeworksh/plugin@dev`. Release in dependency order: aikit → plugin → harness → cli.
+A workspace dependency is published at its manifest version, which must already be on the registry. A dependency with only dev builds (e.g. plugin, when releasing harness) is pinned explicitly, as a version or a dist-tag resolved at publish time — there is no implicit fallback: `pnpm release:harness:dev --dep @codeworksh/plugin@dev`. Release in dependency order: aikit → plugin → harness → tui platform packages (`tui-<os>-<arch>`) → tui → cli. The TUI's platform packages carry prebuilt binaries built by `.github/workflows/tui.yml` (macOS arm64/x64, Linux arm64/x64 static musl; Unix only) and ship in lockstep with `@codeworksh/tui`; `pnpm bump:tui` moves all five versions. Canary (push to `canary`) builds and publishes the whole chain.

package.json

@@ -18,6 +18,7 @@
 		"bump:cli": "pnpm --filter @codeworksh/cli run bump",
 		"bump:harness": "pnpm --filter @codeworksh/harness run bump",
 		"bump:plugin": "pnpm --filter @codeworksh/plugin run bump",
+		"bump:tui": "pnpm --filter @codeworksh/tui run bump",
 		"check": "vp check",
 		"check:packages": "vp run -r check",
 		"dev:desktop": "pnpm --filter @codeworksh/desktop dev",
@@ -36,6 +37,9 @@
 		"release:plugin": "pnpm --filter @codeworksh/plugin run release",
 		"release:plugin:dev": "pnpm --filter @codeworksh/plugin run release:dev",
 		"release:plugin:dry": "pnpm --filter @codeworksh/plugin run release:dry",
+		"release:tui": "pnpm --filter @codeworksh/tui run release",
+		"release:tui:dev": "pnpm --filter @codeworksh/tui run release:dev",
+		"release:tui:dry": "pnpm --filter @codeworksh/tui run release:dry",
 		"test": "vp test",
 		"test:packages": "vp run -r test",
 		"typecheck": "vp run -r --concurrency-limit 2 typecheck"

packages/tui/bump.config.ts

@@ -0,0 +1,10 @@
+import { defineConfig } from "bumpp";
+
+// Release config for @codeworksh/tui, loaded automatically by `bumpp`. The platform
+// packages ship in lockstep with the launcher, so all five versions move together.
+export default defineConfig({
+	files: ["package.json", "npm/*/package.json"],
+	tag: "@codeworksh/tui@%s",
+	commit: "release: @codeworksh/tui@%s",
+	push: false,
+});

packages/tui/npm/darwin-arm64/README.md

@@ -0,0 +1,3 @@
+# @codeworksh/tui-darwin-arm64
+
+The prebuilt CodeWork terminal UI for macOS on Apple silicon. Installed automatically with `@codeworksh/cli`; run it with `codework tui`.

packages/tui/npm/darwin-arm64/package.json

@@ -0,0 +1,24 @@
+{
+	"name": "@codeworksh/tui-darwin-arm64",
+	"version": "0.0.1",
+	"description": "The CodeWork terminal UI binary for macOS on Apple silicon",
+	"homepage": "https://www.codework.sh",
+	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/codeworksh/codework.git",
+		"directory": "packages/tui/npm/darwin-arm64"
+	},
+	"os": [
+		"darwin"
+	],
+	"cpu": [
+		"arm64"
+	],
+	"publishConfig": {
+		"access": "public"
+	},
+	"scripts": {
+		"build": "node ../../scripts/stage.mjs"
+	}
+}

packages/tui/npm/darwin-x64/README.md

@@ -0,0 +1,3 @@
+# @codeworksh/tui-darwin-x64
+
+The prebuilt CodeWork terminal UI for macOS on Intel. Installed automatically with `@codeworksh/cli`; run it with `codework tui`.

packages/tui/npm/darwin-x64/package.json

@@ -0,0 +1,24 @@
+{
+	"name": "@codeworksh/tui-darwin-x64",
+	"version": "0.0.1",
+	"description": "The CodeWork terminal UI binary for macOS on Intel",
+	"homepage": "https://www.codework.sh",
+	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/codeworksh/codework.git",
+		"directory": "packages/tui/npm/darwin-x64"
+	},
+	"os": [
+		"darwin"
+	],
+	"cpu": [
+		"x64"
+	],
+	"publishConfig": {
+		"access": "public"
+	},
+	"scripts": {
+		"build": "node ../../scripts/stage.mjs"
+	}
+}