diff --git a/.github/workflows/publish-knowledge.yml b/.github/workflows/publish-knowledge.yml
deleted file mode 100644
index 8f6d644..0000000
--- a/.github/workflows/publish-knowledge.yml
+++ /dev/null
@@ -1,86 +0,0 @@
-name: Publish Knowledge
-
-on:
-  workflow_dispatch:
-    inputs:
-      mode:
-        description: "Publish mode"
-        required: true
-        type: choice
-        options:
-          - channel
-          - stable
-      channel:
-        description: "dist-tag (channel mode only, e.g. mcp/plugin/advisor)"
-        required: false
-        type: string
-
-concurrency:
-  group: publish-knowledge-${{ inputs.mode }}-${{ inputs.channel }}
-  cancel-in-progress: false
-
-jobs:
-  publish-stable:
-    if: inputs.mode == 'stable'
-    name: publish stable (with knowledge) to npm + tag
-    runs-on: ubuntu-latest
-    environment: production # Required Reviewers gate
-    permissions:
-      contents: write # push lightweight tag to origin
-      id-token: write # OIDC for npm Trusted Publishing + provenance
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: pnpm/action-setup@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: "24"
-          cache: pnpm
-          registry-url: "https://registry.npmjs.org/"
-
-      - name: Install gitleaks
-        run: |
-          set -euo pipefail
-          GITLEAKS_VERSION=8.21.2
-          curl -sSfL \
-            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
-            | sudo tar -xz -C /usr/local/bin gitleaks
-          gitleaks version
-
-      - run: pnpm install --frozen-lockfile
-
-      - name: publish-stable (with knowledge)
-        run: node tools/release/publish-stable.mjs --knowledge
-
-  publish-channel:
-    if: inputs.mode == 'channel'
-    name: publish beta (with knowledge) to npm
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read # no tag, no Release; just publish
-      id-token: write # OIDC for npm Trusted Publishing + provenance
-    steps:
-      - uses: actions/checkout@v6
-
-      - uses: pnpm/action-setup@v6
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: "24"
-          cache: pnpm
-          registry-url: "https://registry.npmjs.org/"
-
-      - name: Install gitleaks
-        run: |
-          set -euo pipefail
-          GITLEAKS_VERSION=8.21.2
-          curl -sSfL \
-            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
-            | sudo tar -xz -C /usr/local/bin gitleaks
-          gitleaks version
-
-      - run: pnpm install --frozen-lockfile
-
-      - name: publish-channel (with knowledge)
-        run: node tools/release/publish-channel.mjs --knowledge --channel "${{ inputs.channel }}"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index bd91e89..c45f8b4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,6 +3,13 @@ name: Publish
 on:
   workflow_dispatch:
     inputs:
+      package:
+        description: "Which package set to publish"
+        required: true
+        type: choice
+        options:
+          - bailian-cli
+          - knowledge-studio-cli
       mode:
         description: "Publish mode"
         required: true
@@ -16,13 +23,13 @@ on:
         type: string
 
 concurrency:
-  group: publish-${{ inputs.mode }}-${{ inputs.channel }}
+  group: publish-${{ inputs.package }}-${{ inputs.mode }}-${{ inputs.channel }}
   cancel-in-progress: false
 
 jobs:
   publish-stable:
     if: inputs.mode == 'stable'
-    name: publish stable to npm + tag
+    name: publish stable (${{ inputs.package }}) to npm + tag
     runs-on: ubuntu-latest
     environment: production # Required Reviewers gate
     permissions:
@@ -51,11 +58,11 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - name: publish-stable
-        run: node tools/release/publish-stable.mjs
+        run: node tools/release/publish-stable.mjs ${{ inputs.package == 'knowledge-studio-cli' && '--knowledge' || '' }}
 
   publish-channel:
     if: inputs.mode == 'channel'
-    name: publish beta to npm
+    name: publish channel (${{ inputs.package }}) to npm
     runs-on: ubuntu-latest
     permissions:
       contents: read # no tag, no Release; just publish
@@ -83,4 +90,4 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - name: publish-channel
-        run: node tools/release/publish-channel.mjs --channel "${{ inputs.channel }}"
+        run: node tools/release/publish-channel.mjs ${{ inputs.package == 'knowledge-studio-cli' && '--knowledge' || '' }} --channel "${{ inputs.channel }}"
diff --git a/tools/release/lib/packages.mjs b/tools/release/lib/packages.mjs
index 285f6be..d7118f5 100644
--- a/tools/release/lib/packages.mjs
+++ b/tools/release/lib/packages.mjs
@@ -10,7 +10,7 @@ export const PACKAGES = [
 ];
 
 // knowledge-studio-cli shares the same library deps as bailian-cli.
-// Published via a separate workflow (publish-knowledge.yml) with --knowledge flag.
+// Published via publish.yml with package=knowledge-studio-cli (passes --knowledge flag).
 export const KSCLI_PACKAGE = { key: "kscli", dir: "packages/kscli", name: "knowledge-studio-cli" };
 export const ALL_PACKAGES = [...PACKAGES, KSCLI_PACKAGE];