feat(cli): --version flag and --help anywhere in argv

--help/-h now prints usage from any position (so 'reconcile --help' works),
and --version/-v prints the version inlined from package.json at build time.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RErsihpfppjyZ37vQuRwKb

Author: lex00

CLI.md

@@ -10,7 +10,9 @@ with live GitHub state.
 | `audit` | Run chant's posture-audit engine over every repo declared in the config. | Never. |
 | `report` | Run cycles in dry-run, optionally add audit and identity passes, print a compliance snapshot, optionally write a JSON artifact. | Never. |
 
-Run `github-warden` with no arguments (or `--help`) for the built-in usage text.
+Run `github-warden` with no arguments (or `--help`, anywhere in the argument
+list) for the built-in usage text; `github-warden --version` prints the version
+(inlined from package.json at build time).
 
 ## Config file parsing
 

action/index.mjs

@@ -232794,6 +232794,53 @@ var init_discover3 = __esm({
 import { readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
 import { pathToFileURL } from "node:url";
 
+// package.json
+var package_default = {
+  name: "@intentius/github-warden",
+  version: "0.3.1",
+  type: "module",
+  description: "Keep your GitHub org and repos in declared state \u2014 reconcile, guardrails, drift correction",
+  license: "Apache-2.0",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/INTENTIUS/github-warden.git"
+  },
+  homepage: "https://github.com/INTENTIUS/github-warden#readme",
+  bugs: {
+    url: "https://github.com/INTENTIUS/github-warden/issues"
+  },
+  publishConfig: {
+    access: "public"
+  },
+  bin: {
+    "github-warden": "bin/github-warden.js"
+  },
+  files: [
+    "bin",
+    "dist"
+  ],
+  scripts: {
+    tsc: "tsc --noEmit",
+    test: "vitest run",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
+    build: "esbuild src/cli.ts --bundle --platform=node --format=esm --outfile=dist/cli.js && chmod +x dist/cli.js",
+    "build:action": `esbuild src/action.ts --bundle --platform=node --format=esm --define:process.env.GITHUB_WARDEN_IS_ACTION='"1"' --outfile=action/index.mjs`,
+    prepublishOnly: "npm run build"
+  },
+  dependencies: {
+    "@intentius/chant": "^0.44.1",
+    "@intentius/chant-lexicon-github": "^0.44.1"
+  },
+  devDependencies: {
+    "@types/libsodium-wrappers": "^0.7.14",
+    "@types/node": "^22.0.0",
+    esbuild: "^0.28.0",
+    "libsodium-wrappers": "^0.8.4",
+    typescript: "^5.9.3",
+    vitest: "^4.1.9"
+  }
+};
+
 // src/config/load.ts
 var GovernanceConfigError = class extends Error {
   field;
@@ -237573,10 +237620,15 @@ function buildClient(args) {
 }
 async function main(argv = process.argv.slice(2)) {
   const subcommand = argv[0];
-  if (!subcommand || subcommand === "--help" || subcommand === "-h") {
+  if (!subcommand || argv.includes("--help") || argv.includes("-h")) {
     printUsage();
     process.exit(0);
   }
+  if (subcommand === "--version" || subcommand === "-v") {
+    process.stdout.write(`${package_default.version}
+`);
+    process.exit(0);
+  }
   if (subcommand === "audit") {
     await runAudit(argv.slice(1));
     return;

src/cli.ts

@@ -37,6 +37,7 @@
 
 import { readFileSync, writeFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
+import pkg from "../package.json" with { type: "json" };
 import { loadGovernanceConfig } from "./config/load.js";
 import { createAppClient } from "./auth/app-client.js";
 import { runReconcile } from "./reconcile/runner.js";
@@ -517,11 +518,17 @@ async function main(argv: string[] = process.argv.slice(2)) {
 
   // Top-level subcommand dispatch.
   const subcommand = argv[0];
-  if (!subcommand || subcommand === "--help" || subcommand === "-h") {
+  if (!subcommand || argv.includes("--help") || argv.includes("-h")) {
     printUsage();
     process.exit(0);
   }
 
+  if (subcommand === "--version" || subcommand === "-v") {
+    // Inlined from package.json at build time — always matches the published version.
+    process.stdout.write(`${pkg.version}\n`);
+    process.exit(0);
+  }
+
   if (subcommand === "audit") {
     await runAudit(argv.slice(1));
     return;