diff --git a/.github/workflows/ci-workbench-cli.yml b/.github/workflows/ci-workbench-cli.yml
new file mode 100644
index 0000000..7f42ac6
--- /dev/null
+++ b/.github/workflows/ci-workbench-cli.yml
@@ -0,0 +1,33 @@
+name: CI — workbench-cli
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'packages/workbench-cli/**'
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: bun install
+        working-directory: packages/workbench-cli
+
+      - name: Type check
+        run: bun tsc --noEmit
+        working-directory: packages/workbench-cli
+
+      - name: Build
+        run: bun run build
+        working-directory: packages/workbench-cli
+
+      - name: Smoke test
+        run: ./dist/index.js --help || true
+        working-directory: packages/workbench-cli
\ No newline at end of file
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..1e911f1
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,42 @@
+name: Publish
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write  # required for JSR OIDC auth
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: oven-sh/setup-bun@v2
+
+      - name: Install dependencies
+        run: bun install
+        working-directory: packages/workbench-cli
+
+      - name: Build
+        run: bun run build
+        working-directory: packages/workbench-cli
+
+      # Setup node for npm publish
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Publish to npm
+        run: npm publish --access public
+        working-directory: packages/workbench-cli
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish to JSR
+        run: bunx jsr publish --allow-slow-types
+        working-directory: packages/workbench-cli
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 9177892..091dd18 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,4 +3,5 @@
 package-lock.json
 .ck/*
 thoughts/
-node_modules
\ No newline at end of file
+node_modules
+dist/
\ No newline at end of file
diff --git a/packages/workbench-cli/README.md b/packages/workbench-cli/README.md
new file mode 100644
index 0000000..3a85218
--- /dev/null
+++ b/packages/workbench-cli/README.md
@@ -0,0 +1,39 @@
+# Workbench
+
+The `workbench` CLI provides a terminal UI for initializing the workbench repository.
+
+## Prerequisites
+
+- [Bun](https://bun.sh) installed
+- [gh CLI](https://cli.github.com) installed and authenticated (`gh auth login`)
+
+## Installation
+
+To install dependencies and link the CLI locally:
+
+```bash
+bun install
+bun link
+```
+
+After linking, the `workbench` command will be available globally on your system.
+
+## Run (without installing)
+
+You can run the CLI directly from the source without linking:
+
+```bash
+bun run src/index.ts
+```
+
+## Usage
+
+Run the `workbench` command from the workbench repository root. Select `init` to walk through the interactive setup:
+
+1. Select a GitHub organization or personal account.
+2. Select code repositories (added as submodules under the `projects/` directory).
+3. Select resource repositories (added as submodules under the `resources/` directory).
+4. Configure the target branch per repository.
+5. Optionally index with `ck`.
+
+After initialization, the selected configuration is written to `.workbench/config.yaml`.
diff --git a/packages/workbench-cli/jsr.json b/packages/workbench-cli/jsr.json
new file mode 100644
index 0000000..6a0f4a7
--- /dev/null
+++ b/packages/workbench-cli/jsr.json
@@ -0,0 +1,6 @@
+{
+  "name": "@pap/workbench",
+  "version": "0.1.3",
+  "license": "MIT",
+  "exports": "./src/index.ts"
+}
diff --git a/packages/workbench-cli/package.json b/packages/workbench-cli/package.json
index 9a7914e..0374aa4 100644
--- a/packages/workbench-cli/package.json
+++ b/packages/workbench-cli/package.json
@@ -1,8 +1,21 @@
 {
-  "name": "workbench-cli",
-  "version": "0.1.0",
+  "name": "@pap.dev/workbench",
+  "version": "0.1.3",
+  "type": "module",
   "bin": {
-    "workbench": "./src/index.ts"
+    "workbench": "dist/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "version": "node -e \"const j=require('./jsr.json');j.version=require('./package.json').version;require('fs').writeFileSync('./jsr.json',JSON.stringify(j,null,2)+'\\n')\" && git add jsr.json",
+    "postversion": "git add -A && git commit -m \"chore: bump version to $(node -e \"console.log(require('./package.json').version)\")\" && git tag v$(node -e \"console.log(require('./package.json').version)\")",
+    "build": "bun build ./src/index.ts --outdir ./dist --target bun --banner '#!/usr/bin/env bun'",
+    "prepublishOnly": "bun run build",
+    "release:patch": "npm version patch --message 'chore: bump version to %s'",
+    "release:minor": "npm version minor --message 'chore: bump version to %s'",
+    "release:major": "npm version major --message 'chore: bump version to %s'"
   },
   "dependencies": {
     "@opentui/core": "^0.1.90",
@@ -12,5 +25,6 @@
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^24.0.0",
     "typescript": "^5.0.0"
-  }
+  },
+  "license": "MIT"
 }
diff --git a/packages/workbench-cli/scripts/release.sh b/packages/workbench-cli/scripts/release.sh
new file mode 100755
index 0000000..f9647a8
--- /dev/null
+++ b/packages/workbench-cli/scripts/release.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+RELEASE_TYPE="${1:-patch}"
+
+if [[ "$RELEASE_TYPE" != "major" && "$RELEASE_TYPE" != "minor" && "$RELEASE_TYPE" != "patch" ]]; then
+  echo "Error: release type must be major, minor, or patch (got: '$RELEASE_TYPE')"
+  exit 1
+fi
+
+echo "This will:"
+echo "  1. Bump the $RELEASE_TYPE version number"
+echo "  2. Push main with the newly created tag to origin"
+echo "  3. Trigger a release action"
+echo ""
+read -r -p "Do you want to continue? [y/N] " confirm
+
+if [[ "$confirm" != "y" && "$confirm" != "Y" ]]; then
+  echo "Aborted."
+  exit 0
+fi
+
+bun run "release:$RELEASE_TYPE"
+git push origin main --tags