diff --git a/cli/package.json b/cli/package.json
index 86d59c64..9cb4418c 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -23,29 +23,28 @@
   "files": [
     "dist"
   ],
-  "engines": {
-    "node": ">=20"
+  "scripts": {
+    "dev": "tsx src/index.ts",
+    "build": "tsc",
+    "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.888.0",
     "@clack/prompts": "^0.10.0",
-    "better-auth": "^1.3.8",
-    "commander": "^13.1.0",
-    "detect-port": "^2.1.0",
-    "dotenv": "^17.0.1",
+    "@paperclipai/adapter-claude-local": "workspace:*",
+    "@paperclipai/adapter-codex-local": "workspace:*",
+    "@paperclipai/adapter-openclaw": "workspace:*",
+    "@paperclipai/adapter-utils": "workspace:*",
+    "@paperclipai/db": "workspace:*",
+    "@paperclipai/server": "workspace:*",
+    "@paperclipai/shared": "workspace:*",
     "drizzle-orm": "0.38.4",
-    "express": "^5.1.0",
-    "multer": "^2.0.2",
-    "open": "^11.0.0",
-    "picocolors": "^1.1.1",
-    "pino": "^9.6.0",
-    "pino-http": "^10.4.0",
-    "pino-pretty": "^13.1.3",
-    "postgres": "^3.4.5",
-    "ws": "^8.19.0",
-    "zod": "^3.24.2"
+    "dotenv": "^17.0.1",
+    "commander": "^13.1.0",
+    "picocolors": "^1.1.1"
   },
-  "optionalDependencies": {
-    "embedded-postgres": "^18.1.0-beta.16"
+  "devDependencies": {
+    "@types/node": "^22.12.0",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.3"
   }
 }
diff --git a/doc/PUBLISHING.md b/doc/PUBLISHING.md
index d32ec7eb..29ac7291 100644
--- a/doc/PUBLISHING.md
+++ b/doc/PUBLISHING.md
@@ -9,7 +9,29 @@ This document covers how to build and publish the `paperclipai` CLI package to n
 - An npm account with publish access to the `paperclipai` package
 - Logged in to npm: `npm login`
 
-## Quick Reference
+## One-Command Publish
+
+The fastest way to publish — bumps version, builds, publishes, restores, commits, and tags in one shot:
+
+```bash
+./scripts/bump-and-publish.sh patch          # 0.1.1 → 0.1.2
+./scripts/bump-and-publish.sh minor          # 0.1.1 → 0.2.0
+./scripts/bump-and-publish.sh major          # 0.1.1 → 1.0.0
+./scripts/bump-and-publish.sh 2.0.0          # set explicit version
+./scripts/bump-and-publish.sh patch --dry-run # everything except npm publish
+```
+
+The script runs all 6 steps below in order. It requires a clean working tree and an active `npm login` session (unless `--dry-run`). After it finishes, push:
+
+```bash
+git push && git push origin v<version>
+```
+
+## Manual Step-by-Step
+
+If you prefer to run each step individually:
+
+### Quick Reference
 
 ```bash
 # Bump version
@@ -168,6 +190,7 @@ pnpm check:tokens
 
 | Script | Command | Description |
 |---|---|---|
+| `bump-and-publish` | `pnpm bump-and-publish <type>` | One-command bump + build + publish + commit + tag |
 | `build:npm` | `pnpm build:npm` | Full build (check + typecheck + bundle + package.json) |
 | `version:bump` | `pnpm version:bump <type>` | Bump CLI version |
 | `check:tokens` | `pnpm check:tokens` | Run forbidden token check only |
diff --git a/package.json b/package.json
index 5dd6037b..17f67273 100644
--- a/package.json
+++ b/package.json
@@ -17,6 +17,7 @@
     "db:backup": "./scripts/backup-db.sh",
     "paperclipai": "node cli/node_modules/tsx/dist/cli.mjs cli/src/index.ts",
     "build:npm": "./scripts/build-npm.sh",
+    "bump-and-publish": "./scripts/bump-and-publish.sh",
     "version:bump": "./scripts/version-bump.sh",
     "check:tokens": "node scripts/check-forbidden-tokens.mjs",
     "docs:dev": "cd docs && npx mintlify dev"
diff --git a/scripts/bump-and-publish.sh b/scripts/bump-and-publish.sh
new file mode 100755
index 00000000..a0a9b870
--- /dev/null
+++ b/scripts/bump-and-publish.sh
@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# bump-and-publish.sh — One-command version bump, build, publish, and cleanup.
+#
+# Usage:
+#   ./scripts/bump-and-publish.sh patch          # 0.1.1 → 0.1.2
+#   ./scripts/bump-and-publish.sh minor          # 0.1.1 → 0.2.0
+#   ./scripts/bump-and-publish.sh major          # 0.1.1 → 1.0.0
+#   ./scripts/bump-and-publish.sh 2.0.0          # set explicit version
+#   ./scripts/bump-and-publish.sh patch --dry-run # everything except npm publish
+#
+# Steps:
+#   1. Bump version (cli/package.json + cli/src/index.ts)
+#   2. Build for npm (token check, typecheck, esbuild, publishable package.json)
+#   3. Preview (npm pack --dry-run)
+#   4. Publish to npm (unless --dry-run)
+#   5. Restore dev package.json
+#   6. Commit and tag
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+CLI_DIR="$REPO_ROOT/cli"
+
+# ── Parse args ────────────────────────────────────────────────────────────────
+
+dry_run=false
+bump_type=""
+
+for arg in "$@"; do
+  case "$arg" in
+    --dry-run) dry_run=true ;;
+    *) bump_type="$arg" ;;
+  esac
+done
+
+if [ -z "$bump_type" ]; then
+  echo "Usage: $0 <patch|minor|major|X.Y.Z> [--dry-run]"
+  exit 1
+fi
+
+# ── Preflight checks ─────────────────────────────────────────────────────────
+
+if [ "$dry_run" = false ]; then
+  if ! npm whoami &>/dev/null; then
+    echo "Error: Not logged in to npm. Run 'npm login' first."
+    exit 1
+  fi
+fi
+
+# Check for uncommitted changes (version bump and build will create changes)
+if ! git -C "$REPO_ROOT" diff --quiet || ! git -C "$REPO_ROOT" diff --cached --quiet; then
+  echo "Error: Working tree has uncommitted changes. Commit or stash them first."
+  exit 1
+fi
+
+# ── Step 1: Version bump ─────────────────────────────────────────────────────
+
+echo ""
+echo "==> Step 1/6: Bumping version..."
+"$REPO_ROOT/scripts/version-bump.sh" "$bump_type"
+
+# Read the new version
+NEW_VERSION=$(node -e "console.log(require('$CLI_DIR/package.json').version)")
+
+# ── Step 2: Build ─────────────────────────────────────────────────────────────
+
+echo ""
+echo "==> Step 2/6: Building for npm..."
+"$REPO_ROOT/scripts/build-npm.sh"
+
+# ── Step 3: Preview ───────────────────────────────────────────────────────────
+
+echo ""
+echo "==> Step 3/6: Preview..."
+cd "$CLI_DIR"
+npm pack --dry-run
+cd "$REPO_ROOT"
+
+# ── Step 4: Publish ───────────────────────────────────────────────────────────
+
+if [ "$dry_run" = true ]; then
+  echo ""
+  echo "==> Step 4/6: Skipping publish (--dry-run)"
+else
+  echo ""
+  echo "==> Step 4/6: Publishing to npm..."
+  cd "$CLI_DIR"
+  npm publish --access public
+  cd "$REPO_ROOT"
+  echo "  ✓ Published paperclipai@$NEW_VERSION"
+fi
+
+# ── Step 5: Restore dev package.json ──────────────────────────────────────────
+
+echo ""
+echo "==> Step 5/6: Restoring dev package.json..."
+mv "$CLI_DIR/package.dev.json" "$CLI_DIR/package.json"
+echo "  ✓ Restored workspace:* dependencies"
+
+# ── Step 6: Commit and tag ────────────────────────────────────────────────────
+
+echo ""
+echo "==> Step 6/6: Committing and tagging..."
+cd "$REPO_ROOT"
+git add cli/package.json cli/src/index.ts
+git commit -m "chore: bump version to $NEW_VERSION"
+git tag "v$NEW_VERSION"
+echo "  ✓ Committed and tagged v$NEW_VERSION"
+
+# ── Done ──────────────────────────────────────────────────────────────────────
+
+echo ""
+if [ "$dry_run" = true ]; then
+  echo "Dry run complete for v$NEW_VERSION."
+  echo "  - Version bumped, built, and previewed"
+  echo "  - Dev package.json restored"
+  echo "  - Commit and tag created (locally)"
+  echo ""
+  echo "To actually publish, run:"
+  echo "  cd cli && npm publish --access public"
+else
+  echo "Published paperclipai@$NEW_VERSION"
+  echo ""
+  echo "To push:"
+  echo "  git push && git push origin v$NEW_VERSION"
+fi