diff --git a/.github/workflows/prerelease-cua-cli.yml b/.github/workflows/prerelease-cua-cli.yml
new file mode 100644
index 0000000..4f95774
--- /dev/null
+++ b/.github/workflows/prerelease-cua-cli.yml
@@ -0,0 +1,117 @@
+name: Prerelease CUA CLI
+
+# Manually publish a prerelease of @onkernel/cua-cli from any branch under an
+# npm dist-tag (never `latest`). Unlike release-cua-cli.yml there is no
+# "tag is on main" gate — this exists to try unmerged work via
+# `npm install -g @onkernel/cua-cli@<dist-tag>`. The published version is
+# `<pkg-version>-<dist-tag>.<run-number>`, unique per run, and only reachable
+# through the chosen dist-tag, so normal installs are unaffected.
+
+on:
+  workflow_dispatch:
+    inputs:
+      dist_tag:
+        description: "npm dist-tag to publish under (never 'latest'); also used as the prerelease id"
+        required: true
+        default: "ext"
+        type: string
+
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: prerelease-cua-cli-${{ github.ref_name }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      - name: Ensure npm supports trusted publishing
+        run: npm install -g npm@^11.5.1
+
+      - name: Validate dist-tag
+        env:
+          DIST_TAG: ${{ inputs.dist_tag }}
+        run: |
+          if [[ ! "$DIST_TAG" =~ ^[a-z0-9][a-z0-9-]*$ ]]; then
+            echo "dist_tag must be lowercase alphanumeric/hyphen, e.g. ext, next, pr-41 (got '$DIST_TAG')" >&2
+            exit 1
+          fi
+          if [[ "$DIST_TAG" == "latest" ]]; then
+            echo "refusing to publish a prerelease to the 'latest' dist-tag" >&2
+            exit 1
+          fi
+
+      - run: npm ci
+
+      - name: Compute prerelease version
+        id: version
+        env:
+          DIST_TAG: ${{ inputs.dist_tag }}
+        run: |
+          BASE=$(node -p "require('./packages/cli/package.json').version")
+          VERSION="${BASE}-${DIST_TAG}.${GITHUB_RUN_NUMBER}"
+          npm pkg set version="$VERSION" --workspace @onkernel/cua-cli
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "cua-cli prerelease version: $VERSION"
+
+      - name: Verify runtime dependencies are published
+        run: |
+          node -p 'require("./packages/cli/package.json").dependencies["@onkernel/cua-ai"]' \
+            | xargs -I{} npm view @onkernel/cua-ai@{} version
+          node -p 'require("./packages/cli/package.json").dependencies["@onkernel/cua-agent"]' \
+            | xargs -I{} npm view @onkernel/cua-agent@{} version
+
+      - run: npm run build --workspace @onkernel/cua-ai
+      - run: npm run build --workspace @onkernel/cua-agent
+
+      - name: Build cua-cli
+        run: npm run build --workspace @onkernel/cua-cli
+
+      - name: Pack tarball
+        run: npm pack --workspace @onkernel/cua-cli --pack-destination "$RUNNER_TEMP"
+
+      - name: CLI bin smoke test
+        run: |
+          SMOKE_DIR=$(mktemp -d)
+          cd "$SMOKE_DIR"
+          npm init -y > /dev/null
+          npm install "$RUNNER_TEMP"/onkernel-cua-cli-*.tgz
+          OUTPUT=$(./node_modules/.bin/cua --help)
+          echo "$OUTPUT"
+          echo "$OUTPUT" | grep -q "Usage:"
+          echo "$OUTPUT" | grep -q "cua \[options\] \[prompt\.\.\.\]"
+
+      - name: Publish to npm
+        env:
+          DIST_TAG: ${{ inputs.dist_tag }}
+        run: npm publish --workspace @onkernel/cua-cli --access public --tag "$DIST_TAG"
+
+      - name: Job summary
+        env:
+          DIST_TAG: ${{ inputs.dist_tag }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          {
+            echo "### Prerelease published"
+            echo ""
+            echo "- version: \`$VERSION\`"
+            echo "- dist-tag: \`$DIST_TAG\`"
+            echo "- branch: \`$GITHUB_REF_NAME\` (\`$GITHUB_SHA\`)"
+            echo ""
+            echo "Install:"
+            echo ""
+            echo '```'
+            echo "npm install -g @onkernel/cua-cli@$DIST_TAG"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"