fix: derive --help URLs and banner version from package.json

[murdore]

The defect

@juspay/workforge@1.0.0 is on the registry, and its --help tells users to file issues at a placeholder:

Documentation: https://github.com/yourusername/workforge
Issues: https://github.com/yourusername/workforge/issues

It also prints WorkForge v3.0 on a package whose version is 1.0.0.

Found by installing the published tarball and running it, rather than by reading source:

$ npm pack @juspay/workforge@1.0.0 && npm install ./juspay-workforge-1.0.0.tgz
$ ./node_modules/.bin/workforge --help | tail -3
Documentation: https://github.com/yourusername/workforge
Issues: https://github.com/yourusername/workforge/issues

The fix

Both strings were duplicates of metadata package.json already carries correctly (homepage, bugs.url), and VERSION was already read from there for --version. They now come from the same source, so they cannot drift apart again.

PackageJson's index signature is intentionally loose (ConfigValue), so the two fields are narrowed through small helpers rather than cast — no any.

After

Documentation: https://github.com/juspay/workforge#readme
Issues: https://github.com/juspay/workforge/issues
WorkForge v1.0.0 - Advanced Git Worktree Manager

Test

test/cli-help.test.ts asserts the rendered help against package.json rather than against a second copy of the same literals — a test holding its own copy of the URL would have passed against the placeholder.

Mutation-checked per this repo's rule that a guard must fail when its fix is reverted:

❯ test/cli-help.test.ts (4 tests | 3 failed)
  × contains no placeholder URLs
  × reports the real package version rather than a hardcoded one
  × points at the repository recorded in package.json

Restored: 57 passed (57), lint 0 errors, npm pack --dry-run clean.

Docs

Drops v3.0 from CLAUDE.md prose — it referred to the third internal rewrite, not a released version, and reads as a version claim next to a 1.0.0 package. Test inventory and count refreshed (41 → 57, and the two newer files were missing).

Release note

Typed fix: deliberately. This is the first release to go through npm trusted publishing — the OIDC connection for juspay/workforge → release.yml with npm publish permission was configured today, and both prerequisites are confirmed live in CI on the previous run (npm 11.19.0, @semantic-release/npm 13.1.5). Expect 1.0.1 with a provenance attestation and no NPM_TOKEN involved.

[murdore]

CodeQL flagged js/regex/missing-regexp-anchor (high) on the new test: /example\.com/i is an unanchored regex evaluated against URL-bearing text.

It's a fair catch rather than noise — the assertions were literals that never needed regexes. Rewritten as substring checks over a PLACEHOLDERS list, which also widened the guard to your-org and TODO.

Re-verified after the change:

× contains no placeholder URLs
× points at the repository recorded in package.json

with the fix reverted, and 57 passed (57) restored. Amended rather than stacked, per the one-commit-per-PR policy.

[github-actions]

🎉 This PR is included in version 1.0.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀