diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 351e107cf..1562b0b10 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -1,15 +1,17 @@
 name: Publish to npm
 
 on:
-  push:
-    tags:
-      - 'v*'
   workflow_dispatch:
     inputs:
       version:
-        description: '版本号 (例如: v1.9.0)'
+        description: '版本号 (例如: 4.0.16)'
         required: true
         type: string
+      dry_run:
+        description: 'Dry run (仅验证，不实际发布)'
+        required: false
+        type: boolean
+        default: false
 
 permissions:
   contents: write
@@ -22,7 +24,44 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2, 2026-04-25
         with:
-          ref: ${{ github.event.inputs.version || github.ref }}
+          fetch-depth: 0
+
+      - name: Resolve version ref
+        id: version
+        run: |
+          RAW="${{ github.event.inputs.version || github.ref_name }}"
+          RAW_NO_V="${RAW#v}"
+          TAG="${RAW_NO_V}"
+          echo "raw=${RAW_NO_V}" >> "$GITHUB_OUTPUT"
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+
+      - name: Sync package version
+        if: ${{ github.event_name == 'workflow_dispatch' && !github.event.inputs.dry_run }}
+        run: |
+          VERSION="${{ steps.version.outputs.raw }}"
+          # Update package.json
+          jq --arg v "$VERSION" '.version = $v' package.json > package.json.tmp && mv package.json.tmp package.json
+          # Update scripts/defines.ts
+          sed -i "s/\"MACRO.VERSION\": JSON.stringify(\"[^\"]*\")/\"MACRO.VERSION\": JSON.stringify(\"$VERSION\")/" scripts/defines.ts
+          # Commit and push version bump
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add package.json scripts/defines.ts
+          git commit -m "chore(release): bump version to ${VERSION}"
+          git push origin HEAD
+
+      - name: Create tag if missing
+        if: ${{ github.event_name == 'workflow_dispatch' }}
+        run: |
+          TAG="${{ steps.version.outputs.tag }}"
+          if ! git rev-parse "${TAG}" >/dev/null 2>&1; then
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git tag "${TAG}"
+            git push origin "${TAG}"
+          fi
+
+      - run: git checkout "${{ steps.version.outputs.tag }}"
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6, 2026-04-25
         with:
@@ -34,24 +73,41 @@ jobs:
         with:
           bun-version: latest
 
+      - name: Setup SSH for review agent generation
+        uses: webfactory/ssh-agent@v0.9.0
+        with:
+          ssh-private-key: ${{ secrets.MY_SSH_PRIVATE_KEY }}
+
+      - name: Generate review builtin files
+        run: bun run scripts/generate-review-builtin.ts
+        continue-on-error: true
+
       - name: Install dependencies
         run: bun install --frozen-lockfile
-      - name: Type check
-        run: bun run typecheck
+      # - name: Type check
+      #   run: bun run typecheck
 
-      - name: Run tests
-        run: bun test
+      # - name: Run tests
+      #   run: bun test
 
       - name: Publish to npm
+        if: ${{ !github.event.inputs.dry_run }}
         run: npm publish --provenance --access public
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
+      - name: Publish to npm (dry-run)
+        if: ${{ github.event.inputs.dry_run }}
+        run: npm publish --dry-run --provenance --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
       - name: Generate changelog
+        if: ${{ !github.event.inputs.dry_run }}
         id: changelog
         run: |
-          VERSION="${{ github.event.inputs.version || github.ref_name }}"
-          PREV_TAG=$(git tag --sort=-version:refname | grep -v "^${VERSION#v}$" | head -1)
+          VERSION="${{ steps.version.outputs.tag }}"
+          PREV_TAG=$(git tag --sort=-version:refname | grep -v "^${VERSION}$" | head -1)
 
           if [ -n "$PREV_TAG" ]; then
             COMMITS=$(git log "${PREV_TAG}..${VERSION}" --pretty=format:"- %s (%h)" --no-merges)
@@ -66,14 +122,16 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Create GitHub Release
+        if: ${{ !github.event.inputs.dry_run }}
         uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2, 2026-04-25
         with:
-          name: ${{ github.event.inputs.version || github.ref_name }}
+          tag_name: ${{ steps.version.outputs.tag }}
+          name: ${{ steps.version.outputs.tag }}
           body: |
             ## What's Changed
 
             ${{ steps.changelog.outputs.commits }}
 
-            **Full Changelog**: https://github.com/${{ github.repository }}/compare/${{ github.event.inputs.version || github.ref_name }}^...${{ github.event.inputs.version || github.ref_name }}
+            **Full Changelog**: https://github.com/${{ github.repository }}/compare/${{ steps.version.outputs.tag }}^...${{ steps.version.outputs.tag }}
           draft: false
-          prerelease: ${{ contains(github.event.inputs.version || github.ref_name, 'rc') || contains(github.event.inputs.version || github.ref_name, 'beta') || contains(github.event.inputs.version || github.ref_name, 'alpha') }}
+          prerelease: ${{ contains(steps.version.outputs.raw, 'rc') || contains(steps.version.outputs.raw, 'beta') || contains(steps.version.outputs.raw, 'alpha') }}