fix: derive --help URLs and banner version from package.json

`workforge --help` shipped in @juspay/workforge@1.0.0 advertising

  Documentation: https://github.com/yourusername/workforge
  Issues: https://github.com/yourusername/workforge/issues

alongside a hardcoded "WorkForge v3.0" banner on a package whose actual
version is 1.0.0. Both are user-facing strings in a published artifact,
and both were duplicates of metadata package.json already carries.

Read them from package.json instead, so they cannot drift again: the
homepage and bugs.url fields are already correct, and VERSION was
already being read there for --version. package.json's index signature
is deliberately loose, so the two fields are narrowed rather than cast.

Also drops the "v3.0" prose from CLAUDE.md, which referred to the third
internal rewrite rather than any released version, and refreshes the
test inventory and count.

Adds test/cli-help.test.ts, which asserts the help output against
package.json rather than a second copy of the same literals. Verified by
reverting the fix: 3 of its 4 assertions fail.

Author: murdore

CLAUDE.md

@@ -4,10 +4,17 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Project Overview
 
-WorkForge v3.0 is a TypeScript CLI tool for managing Git worktrees with intelligent environment variable synchronization, automatic backup management, and comprehensive audit logging. The tool provides five commands: `create`, `close`, `sync-env`, `list`, and `cleanup`.
+WorkForge is a TypeScript CLI tool for managing Git worktrees with intelligent environment variable synchronization, automatic backup management, and comprehensive audit logging. The tool provides five commands: `create`, `close`, `sync-env`, `list`, and `cleanup`.
 
 **Binary aliases**: `workforge` and `wf`
 
+**Versioning**: published as [`@juspay/workforge`](https://www.npmjs.com/package/@juspay/workforge),
+which started its public life at **1.0.0**. "v3.0" appears in older prose here
+and refers to the third internal rewrite — the modular architecture described
+below — not to a released version. Never write a version number into source or
+docs; read it from `package.json`, which is the only thing semantic-release
+updates.
+
 ## Development Commands
 
 ```bash
@@ -74,9 +81,9 @@ pnpm run release:dry-run
 
 ## Architecture
 
-### v3.0 - Modular Design
+### Modular Design
 
-WorkForge v3.0 uses a **modular architecture** with separation of concerns across commands, core components, UI components, and types.
+WorkForge uses a **modular architecture** with separation of concerns across commands, core components, UI components, and types.
 
 ### Directory Structure
 
@@ -116,17 +123,19 @@ src/
 
 test/
 ├── helpers/
-│   └── fixtures.ts    # Isolated bare remote + clone, CLI runner
-├── env-parser.test.ts # Parser fidelity and sync safety (unit)
-├── create.test.ts     # create command (drives the built CLI)
-└── close.test.ts      # close, BranchCleaner, BackupManager, ProjectIdentifier
+│   └── fixtures.ts        # Isolated bare remote + clone, CLI runner
+├── env-parser.test.ts     # Parser fidelity and sync safety (unit)
+├── create.test.ts         # create command (drives the built CLI)
+├── close.test.ts          # close, BranchCleaner, BackupManager, ProjectIdentifier
+├── worktree-audit.test.ts # WorktreeResolver/Remover, audit log durability
+└── cli-help.test.ts       # --help/--version strings, asserted against package.json
 ```
 
 ---
 
 ## Testing
 
-`pnpm test` builds, then runs Vitest. 41 tests, ~16s.
+`pnpm test` builds, then runs Vitest. 57 tests, ~23s.
 
 **How the fixtures work.** `makeRepo()` builds a bare repository standing in for
 the remote, a `seed` checkout used to push "someone else's" commits, and the

src/index.ts

@@ -17,6 +17,7 @@ import {
   SyncEnvOptions,
   ListOptions,
   CleanupOptions,
+  ConfigValue,
   PackageJson
 } from './types/index.js';
 
@@ -26,8 +27,24 @@ const __dirname = dirname(__filename);
 const packageJson: PackageJson = JSON.parse(readFileSync(join(__dirname, '../package.json'), 'utf8'));
 const VERSION = packageJson.version;
 
+function readString(value: ConfigValue | undefined): string | undefined {
+  return typeof value === 'string' ? value : undefined;
+}
+
+function readProperty(value: ConfigValue | undefined, key: string): ConfigValue | undefined {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+    ? value[key]
+    : undefined;
+}
+
+// Derived from package.json rather than written out again: a duplicated URL
+// silently rotted into a `yourusername` placeholder and shipped in --help.
+const HOMEPAGE = readString(packageJson.homepage) ?? 'https://github.com/juspay/workforge';
+const ISSUES_URL =
+  readString(readProperty(packageJson.bugs, 'url')) ?? 'https://github.com/juspay/workforge/issues';
+
 /**
- * WorkForge v3.0 - Advanced Git Worktree Manager
+ * WorkForge - Advanced Git Worktree Manager
  *
  * Commands:
  * - create: Create a new worktree
@@ -312,7 +329,7 @@ async function main(): Promise<void> {
     .strict()
     .recommendCommands()
     .epilogue(`
-WorkForge v3.0 - Advanced Git Worktree Manager
+WorkForge v${VERSION} - Advanced Git Worktree Manager
 ------------------------------------------------
 Features:
   • Intelligent environment variable synchronization
@@ -322,8 +339,8 @@ Features:
   • Complete audit trail
   • Safety checks before worktree closure
 
-Documentation: https://github.com/yourusername/workforge
-Issues: https://github.com/yourusername/workforge/issues
+Documentation: ${HOMEPAGE}
+Issues: ${ISSUES_URL}
     `)
     .parseAsync();
 }

test/cli-help.test.ts

@@ -0,0 +1,58 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { readFileSync } from 'fs';
+import * as path from 'path';
+import { REPO_ROOT, runCli, makeTempDir, cleanupFixtures } from './helpers/fixtures.js';
+
+/**
+ * `--help` shipped `https://github.com/yourusername/workforge` in
+ * @juspay/workforge@1.0.0, and a hardcoded "v3.0" banner on a 1.0.0 package.
+ * Both are user-facing strings in a published artifact, so they are asserted
+ * against package.json rather than against a literal copy of the same text.
+ */
+
+let cwd: string;
+let pkg: { version: string; homepage: string; bugs: { url: string } };
+
+beforeAll(() => {
+  cwd = makeTempDir('wf-help-');
+  pkg = JSON.parse(readFileSync(path.join(REPO_ROOT, 'package.json'), 'utf8'));
+});
+
+afterAll(cleanupFixtures);
+
+describe('workforge --help', () => {
+  // Substring checks rather than regexes: an unanchored pattern over URL-ish
+  // text is what CodeQL's js/regex/missing-regexp-anchor exists to catch, and
+  // these are plain literals with nothing to match loosely.
+  const PLACEHOLDERS = ['yourusername', 'example.com', 'your-org', 'TODO'];
+
+  it('contains no placeholder URLs', () => {
+    const result = runCli(cwd, ['--help']);
+    const output = result.output.toLowerCase();
+
+    expect(result.status).toBe(0);
+    for (const placeholder of PLACEHOLDERS) {
+      expect(output).not.toContain(placeholder.toLowerCase());
+    }
+  });
+
+  it('reports the real package version rather than a hardcoded one', () => {
+    const result = runCli(cwd, ['--help']);
+
+    expect(result.output).toContain(`WorkForge v${pkg.version}`);
+  });
+
+  it('points at the repository recorded in package.json', () => {
+    const result = runCli(cwd, ['--help']);
+
+    expect(result.output).toContain(pkg.homepage);
+    expect(result.output).toContain(pkg.bugs.url);
+  });
+
+  it('agrees with --version', () => {
+    const result = runCli(cwd, ['--version']);
+
+    expect(result.status).toBe(0);
+    expect(result.stdout.trim()).toBe(pkg.version);
+  });
+});