From 4059fe01dd7a9bd0c078e45b96f462ea35831383 Mon Sep 17 00:00:00 2001
From: Lior Kanfi <lior@tikalk.com>
Date: Sun, 27 Sep 2026 22:58:37 +0300
Subject: [PATCH] =?UTF-8?q?fix:=20derive=20version=20from=20package.json?=
 =?UTF-8?q?=20=E2=80=94=20hard-coded=202.0.0=20shipped=20in=20v2.1.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

adlc-cli version printed the stale hard-coded constant instead of the real
package version. Read package.json via createRequire (src/ → ../package.json,
works in-repo and installed) and pin the contract with a drift-regression
test that spawns the bin and asserts against package.json.
---
 src/dispatch.mjs    | 6 +++++-
 tests/bins.test.mjs | 7 +++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/dispatch.mjs b/src/dispatch.mjs
index 1da66c6..11aae3d 100644
--- a/src/dispatch.mjs
+++ b/src/dispatch.mjs
@@ -1,5 +1,6 @@
 // Command dispatch: parse args, route to skill/agent/version/help trees.
 
+import { createRequire } from "node:module";
 import { AGENTS } from "./registry.mjs";
 import { cmdAdd, cmdUpdate, cmdRemove, cmdStatus } from "./commands/skills.mjs";
 import { cmdTeamSetup, cmdTeamUpdate, cmdTeamRepair } from "./commands/team.mjs";
@@ -16,7 +17,10 @@ import {
   printHelp,
 } from "./help.mjs";
 
-const VERSION = "2.0.0";
+// Single source of truth: package.json (drifts when hard-coded — v2.1.0
+// shipped printing "2.0.0"). dispatch.mjs lives in src/, so ../package.json
+// resolves the repo root both in-repo and when installed.
+const { version: VERSION } = createRequire(import.meta.url)("../package.json");
 
 export async function dispatch(argv, mode = "legacy") {
   const parsed = parseArgs(argv);
diff --git a/tests/bins.test.mjs b/tests/bins.test.mjs
index 7fe0370..ccfb990 100644
--- a/tests/bins.test.mjs
+++ b/tests/bins.test.mjs
@@ -4,6 +4,7 @@ import { test } from "node:test";
 import assert from "node:assert/strict";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { readFileSync } from "node:fs";
 
 const exec = promisify(execFile);
 
@@ -20,3 +21,9 @@ test("legacy bin still dispatches the add command surface", async () => {
   const { stdout } = await exec(process.execPath, ["bin/adlc-skills-cli.mjs", "agents"]);
   assert.match(stdout, /OpenCode/);
 });
+
+test("version output matches package.json (no drift)", async () => {
+  const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf-8"));
+  const { stdout } = await exec(process.execPath, ["bin/adlc-cli.mjs", "version"]);
+  assert.equal(stdout.trim(), `adlc-cli ${pkg.version}`);
+});