fix: derive version from package.json (hard-coded 2.0.0 shipped in v2.1.0)

src/dispatch.mjs

@@ -1,5 +1,6 @@
 // Command dispatch: parse args, route to skill/agent/version/help trees.
 
+import { createRequire } from "node:module";
 import { AGENTS } from "./registry.mjs";
 import { cmdAdd, cmdUpdate, cmdRemove, cmdStatus } from "./commands/skills.mjs";
 import { cmdTeamSetup, cmdTeamUpdate, cmdTeamRepair } from "./commands/team.mjs";
@@ -16,7 +17,10 @@ import {
   printHelp,
 } from "./help.mjs";
 
-const VERSION = "2.0.0";
+// Single source of truth: package.json (drifts when hard-coded — v2.1.0
+// shipped printing "2.0.0"). dispatch.mjs lives in src/, so ../package.json
+// resolves the repo root both in-repo and when installed.
+const { version: VERSION } = createRequire(import.meta.url)("../package.json");
 
 export async function dispatch(argv, mode = "legacy") {
   const parsed = parseArgs(argv);

tests/bins.test.mjs

@@ -4,6 +4,7 @@ import { test } from "node:test";
 import assert from "node:assert/strict";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
+import { readFileSync } from "node:fs";
 
 const exec = promisify(execFile);
 
@@ -20,3 +21,9 @@ test("legacy bin still dispatches the add command surface", async () => {
   const { stdout } = await exec(process.execPath, ["bin/adlc-skills-cli.mjs", "agents"]);
   assert.match(stdout, /OpenCode/);
 });
+
+test("version output matches package.json (no drift)", async () => {
+  const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf-8"));
+  const { stdout } = await exec(process.execPath, ["bin/adlc-cli.mjs", "version"]);
+  assert.equal(stdout.trim(), `adlc-cli ${pkg.version}`);
+});