fix: add repository.url to package.json (required for npm provenance)

[bergetbjork]

OIDC trusted publishing got as far as signing the provenance statement, then E422: package.json: repository.url is "", expected to match https://github.com/berget-ai/cli. Adds the missing field.

[berget-ai]

🟠 warning — Identical repository block already merged to main in eff27de (PR #87) — this PR is now a redundant no-op and should be closed.

[berget-ai]

✅ good — URL matches the actual origin remote (github.com/berget-ai/cli), which is what npm provenance validation requires.

[berget-ai]

Review

Summary

Adds a repository field to package.json (git+https://github.com/berget-ai/cli.git) to satisfy npm OIDC trusted publishing / provenance validation.

Risk

LOW — the change itself is correct and harmless, but the PR is fully redundant: the byte-identical repository block already landed on main in commit eff27de (PR #87, "add repository.url to package.json — required for npm provenance"), leaving this PR a no-op on top of a stale base.

Issues

• warning package.json:85 — this exact repository block, including the identical URL, is already present on main via commit eff27de (PR fix: add repository.url to package.json (required for npm provenance) #87); git diff origin/main HEAD -- package.json shows zero remaining delta for this change, so merging this PR produces nothing new — close it as superseded/duplicated by fix: add repository.url to package.json (required for npm provenance) #87.
• nit package.json:3 — branch is stale (merge-base 414da05; main has advanced to eff27de + release 2.2.23, PR head still shows 2.2.22); verified there is no semantic conflict — both branches made identical lint-staged-adjacent additions, so git resolves cleanly and the version field will not be regressed by a merge since this PR's commit doesn't touch it.

Suggestions

• package.json — close this PR instead of merging; eff27de on main already contains the identical fix, and a merge would only add a duplicate commit to history.

Architecture

No structural change — 4 lines of npm package metadata.

CodeSense score: 9/10 — the change is minimal, correct, and verified against the real origin remote (https://github.com/berget-ai/cli), which is exactly what npm provenance E422 validation requires; the only flaw is that it duplicates an already-merged change.

Inline findings

---

_{Berget AI (berget/zai-org/GLM-5.3-Flash) | PR #87}