Enforce Go best practices (task 344)

- Magefile.go: add Default() target so bare `mage` builds the binary;
  fix Install()/Uninstall() to use $GOPATH/bin (default ~/go/bin) instead
  of the previous hardcoded ~/.local/bin path; use cp -v for visibility;
  fix 0755 -> 0o755 octal literal in createBinDir; extract binaryName const
- cmd/geheim/main.go: add -version flag (prints version.Version and exits);
  pass flag.Args() instead of os.Args[1:] so flags are parsed cleanly
- internal/cli/cli.go: remove dead fatal() and prompt() helpers that were
  never called anywhere in the codebase

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

3 files changed, 55 insertions, 27 deletions

diff --git a/Magefile.go b/Magefile.go
index 4ec244d..91631f0 100644
--- a/Magefile.go
+++ b/Magefile.go
@@ -1,23 +1,29 @@
 //go:build mage
 
 // Magefile provides build targets for the geheim project.
-// Targets: Build, Test, Vet, Install, Uninstall, Clean
+// Targets: Default (Build), Build, Test, Vet, Install, Uninstall, Clean
+// Follows the same style as other projects (e.g. hexai).
 package main
 
 import (
 	"errors"
 	"fmt"
 	"os"
+	"path/filepath"
 
 	"github.com/magefile/mage/mg"
 	"github.com/magefile/mage/sh"
 )
 
 const (
-	binary  = "./bin/geheim"
-	mainPkg = "./cmd/geheim"
+	binary     = "./bin/geheim"
+	binaryName = "geheim"
+	mainPkg    = "./cmd/geheim"
 )
 
+// Default builds the binary so that a bare `mage` invocation is equivalent to `mage build`.
+func Default() { mg.Deps(Build) }
+
 // Build compiles the binary to ./bin/geheim.
 func Build() error {
 	mg.Deps(createBinDir)
@@ -37,29 +43,43 @@ func Vet() error {
 	return sh.RunV("go", "vet", "./...")
 }
 
-// Install builds the binary, copies it to ~/.local/bin/geheim, and sets executable permissions.
+// Install builds the binary and copies it to $GOPATH/bin (default ~/go/bin).
 func Install() error {
 	mg.Deps(Build)
-	home, err := os.UserHomeDir()
-	if err != nil {
-		return fmt.Errorf("cannot determine home directory: %w", err)
+
+	// Resolve GOPATH; fall back to ~/go when the environment variable is unset.
+	gopath := os.Getenv("GOPATH")
+	if gopath == "" {
+		home, err := os.UserHomeDir()
+		if err != nil {
+			return fmt.Errorf("resolving home directory: %w", err)
+		}
+		gopath = filepath.Join(home, "go")
 	}
-	dest := home + "/.local/bin/geheim"
-	fmt.Println("Installing to", dest)
-	if err := sh.Copy(dest, binary); err != nil {
-		return err
+
+	binDir := filepath.Join(gopath, "bin")
+	if err := os.MkdirAll(binDir, 0o755); err != nil {
+		return fmt.Errorf("creating %s: %w", binDir, err)
 	}
-	return os.Chmod(dest, 0755)
+
+	dest := filepath.Join(binDir, binaryName)
+	return sh.RunV("cp", "-v", binary, dest)
 }
 
-// Uninstall removes the installed binary from ~/.local/bin/geheim.
+// Uninstall removes the binary from $GOPATH/bin (default ~/go/bin).
 // It is idempotent: if the binary is not installed, it succeeds silently.
 func Uninstall() error {
-	home, err := os.UserHomeDir()
-	if err != nil {
-		return fmt.Errorf("cannot determine home directory: %w", err)
+	// Mirror Install()'s GOPATH resolution so the paths always match.
+	gopath := os.Getenv("GOPATH")
+	if gopath == "" {
+		home, err := os.UserHomeDir()
+		if err != nil {
+			return fmt.Errorf("resolving home directory: %w", err)
+		}
+		gopath = filepath.Join(home, "go")
 	}
-	dest := home + "/.local/bin/geheim"
+
+	dest := filepath.Join(gopath, "bin", binaryName)
 	fmt.Println("Uninstalling", dest)
 	if err := os.Remove(dest); err != nil && !errors.Is(err, os.ErrNotExist) {
 		return err
@@ -75,5 +95,5 @@ func Clean() error {
 
 // createBinDir ensures ./bin exists before the build step writes the binary.
 func createBinDir() error {
-	return os.MkdirAll("./bin", 0755)
+	return os.MkdirAll("./bin", 0o755)
 }
diff --git a/cmd/geheim/main.go b/cmd/geheim/main.go
index 4c432e8..1d5f6e6 100644
--- a/cmd/geheim/main.go
+++ b/cmd/geheim/main.go
@@ -1,19 +1,30 @@
 // main is the thin entry point for the geheim binary.
-// It sets up a signal-cancellable context, initialises the CLI, and exits
-// with the code returned by Run.  All command logic lives in internal/cli.
+// It handles the -version flag, sets up a signal-cancellable context,
+// initialises the CLI, and exits with the code returned by Run.
+// All command logic lives in internal/cli.
 package main
 
 import (
 	"context"
+	"flag"
 	"fmt"
 	"os"
 	"os/signal"
 	"syscall"
 
 	"codeberg.org/snonux/geheim/internal/cli"
+	"codeberg.org/snonux/geheim/internal/version"
 )
 
 func main() {
+	// -version prints the build version and exits immediately.
+	versionFlag := flag.Bool("version", false, "print version and exit")
+	flag.Parse()
+	if *versionFlag {
+		fmt.Println(version.Version)
+		os.Exit(0)
+	}
+
 	// Cancel the context on SIGINT or SIGTERM so that long-running operations
 	// (fzf, external editors) terminate gracefully rather than being killed hard.
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
@@ -25,5 +36,8 @@ func main() {
 		os.Exit(3)
 	}
 
-	os.Exit(c.Run(ctx, os.Args[1:]))
+	// flag.Args() returns arguments after flags, so flag-aware invocations
+	// like `geheim -version` work while plain `geheim cat foo` still passes
+	// all args through unchanged.
+	os.Exit(c.Run(ctx, flag.Args()))
 }
diff --git a/internal/cli/cli.go b/internal/cli/cli.go
index 7d59b94..0ae4dde 100644
--- a/internal/cli/cli.go
+++ b/internal/cli/cli.go
@@ -679,9 +679,3 @@ func logMsg(msg string) { fmt.Printf("> %s\n", msg) }
 
 // warn prints a "WARN " prefixed message to stderr.
 func warn(msg string) { fmt.Fprintf(os.Stderr, "WARN %s\n", msg) }
-
-// fatal prints a "FATAL " prefixed message to stderr and exits with code 3.
-func fatal(msg string) { fmt.Fprintf(os.Stderr, "FATAL %s\n", msg); os.Exit(3) }
-
-// prompt prints a prompt string without a trailing newline.
-func prompt(msg string) { fmt.Printf("< %s", msg) }