Ship the CLI on npm, and prune the lock so --locked passes

[las7]

What

@reachpad/cli plus four platform packages (-darwin-arm64, -darwin-x64, -linux-x64, -linux-arm64), published from the same cli-v* tag as the GitHub release and carrying the same binaries.

The launcher (npm/cli/bin/reachpad.js) resolves the one platform package npm installed for the machine and execs it. There is no second implementation of any verb, so parity is by construction — same binary, same flags, same exit codes.

Why npm

Our release binaries are ad-hoc signed by the linker, not Developer ID signed and notarized. I checked the shipped 0.3.0 Mach-O: one CodeDirectory slot, identifier reachpad-c5850a1ca39ad196, no CMS blob. Ad-hoc is enough to execute on Apple silicon, which is why brew and the curl installer work. It is not enough for anything that stamps com.apple.quarantine — a browser download from the releases page, or the Homebrew cask we shipped until 2026-08-13. npm never sets that attribute.

Also: npx @reachpad/cli needs no install, and Node is already on every machine that runs coding agents.

The lock

assemble-cli-repo.sh copies the private monorepo's Cargo.lock verbatim onto a generated three-member Cargo.toml. The lock therefore describes a different workspace than the manifest, and cargo has to rewrite it. Consequences, both live on main today:

• cargo test --workspace --locked — this repo's own greentree test check — fails on pristine main.
• The committed lock is not the lock a release builds from: release.yml runs without --locked and re-resolves on the runner.

Pruned here: 532 to 265 packages. Every surviving (name, version) was already in the lock; nothing added, no version changed (the apparent digest/sha2 changes are duplicate majors losing the copy no public crate references). The companion fix in reachpad-infra prunes it in the sync script, and produces a byte-identical lock to this one.

Release workflow

• New target x86_64-apple-darwin, cross-compiled on the same arm64 runner. Intel Macs previously had no binary at all — install.sh refused them and the formula rejected them on an arch requirement.
• Developer ID sign + notarize step, which warns loudly and skips while the six secrets are absent, so a release can never quietly claim to be signed. See the comment in release.yml for the exact secrets.
• npm publish job, OIDC Trusted Publishing with no token in the repo, same shape as Reachpad/reachpad-mcp. Idempotent (skips a version already on npm), platform packages first.

Tests

npm/test/packages.test.mjs, 16 tests, no network and no build. Two kinds:

• The four lists are one list. release.yml's build matrix (parsed, not restated), npm/prepare.mjs's staging table, the launcher's lookup, and @reachpad/cli's optionalDependencies. A target added to the matrix and nowhere else publishes tarballs npm install can never reach.
• The three things a launcher can silently break, each against a real child process: exit codes (reachpad run returns the guest's status), signals (a SIGTERMed guest must make the launcher die of SIGTERM, not exit 1), and stdio inheritance (a pipe would hand reachpad attach a non-tty).

Wired into both ci.yml and greentree.yaml.

Verified by hand

Staged the real 0.3.0 linux tarball, packed both tarballs, npm install -g into a prefix, and ran against the live control plane:

$ reachpad --version
reachpad 0.3.0
$ reachpad list
ws-429  scratch-3   paused   saved snap-610 (disk+mem)
0 running, 1 paused, 4 archived

npx reachpad and npm install --ignore-scripts both work — the reason the binary is an optional dependency rather than a postinstall download.

Not in this PR

The first publish of each of the five packages must be manual: npm Trusted Publishing can only be configured on a package that already exists. npm/README.md has the exact commands and the per-package settings.