bump version to 0.0.21

[tonychang04]

Release bump for the MCP onboarding work (#57): OAuth-first MCP registration in insta setup agent, new insta mcp install multi-agent command (--mcp-token headless fallback).

🤖 Generated with Claude Code

---

Summary by cubic

Bump insta CLI to 0.0.21 to ship MCP onboarding. Adds OAuth-first MCP registration in insta setup agent, plus a new insta mcp install for multi-agent installs with a --mcp-token headless fallback.

^{Written for commit cc98dcf. Summary will update on new commits.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[jwfing]

Review — #58 bump version to 0.0.21

Summary: A clean release-bump PR that moves insta from 0.0.20 → 0.0.21 to ship the MCP-onboarding work from #57; the change is correct and the release will be idempotency-safe.

Requirements context

No matching spec/plan found under /docs/superpowers/ or docs/specs/ (the repo has no docs/ tree at this head), so this is assessed against the PR description and the [version-release convention](this repo's release flow), which explicitly treats the package.json version bump as a separate, human-reviewed PR merged to main before the tag release. This PR fits that role exactly.

Findings

Critical — (none)

Suggestion — (none)

Information

• Software engineering — package.json:6: the description value is unchanged in meaning but re-serialized so the em-dash is now the escaped — instead of the literal —. Functionally identical; likely a tool re-wrote the JSON. Harmless, but it introduces a mixed escaping style in an otherwise literal-UTF-8 file — no action needed.
• Functionality — package-lock.json root is out of sync with package.json ("name": "insta-cli" / "version": "0.0.0" vs "name": "insta" / "0.0.21"). This is pre-existing (not touched by this PR) and empirically harmless: release.yml runs npm ci before npm publish, and the identical drift already existed at 0.0.20, which released successfully. Worth reconciling in a future housekeeping PR, but it does not block this release.

Dimension coverage

• Software engineering — Sequential patch bump, matching prior release-bump commits (e.g. 1d6c632 bump version to 0.0.20). No behavior change, so no new tests are warranted.
• Functionality — The feature this release advertises (#57: OAuth-first MCP registration in insta setup agent, insta mcp install, --mcp-token headless fallback) is present on the branch — commit 61ae3ab is the immediate parent and src/commands/mcp.ts, src/commands/setup.ts, and the --mcp-token options in src/index.ts are all in place. Tag v0.0.21 does not yet exist (only v0.0.20), so the tag-triggered npm publish in release.yml won't collide.
• Security — No security-relevant changes (version string only).
• Performance — No performance-relevant changes.

Verdict

approved (informational; zero Critical findings). Posting as a comment — a human still gives the explicit GitHub approval via the approve flow. The version bump is correct and safe to merge and release.

[jwfing]

Review — bump version to 0.0.21

Summary: A clean release-bump PR that advances package.json from 0.0.20 → 0.0.21 to cut the release containing the MCP onboarding work (#57); the only concern is one unrelated, cosmetic change bundled into the diff.

Requirements context: No docs/superpowers/ (or docs/specs/) spec/plan exists in this repo, so this was assessed against the PR description, the repo's developing-insta-cli skill, and the version-release skill. The release flow confirms a version bump should be a PR that changes only the package.json version field (main is protected; the tag is cut afterward and triggers the npm publish) — which is exactly what the core of this PR does.

I verified the release actually contains what it claims: base main (61ae3ab) already includes feat(setup): register the insta-cloud remote MCP server during insta setup agent (#57), and src/commands/mcp.ts / src/commands/setup.ts carry the insta mcp install + setup agent surfaces referenced in the body. So v0.0.21 is not an empty/misleading release.

---

Findings

Critical

(none)

Suggestion

• Software engineering / scope — package.json:5: Beyond the version bump, this PR also re-encodes the description em-dash from a literal — to the JSON unicode escape —:

  - "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
  + "description": "InstaCloud CLI — a thin client of the platform control-plane API.",

  This is JSON-semantically identical (both parse to the same em-dash, and npm renders them the same), so it's harmless. But it's unrelated to a version bump — the prior bump (0.0.20, commit 1d6c632) correctly touched only the version line and left the literal em-dash intact. Per the repo's scope-discipline convention ("one PR = one concern"), consider reverting line 5 so the release bump stays a pure one-line diff. Non-blocking.

Information

• Lockfile intentionally not bumped: package-lock.json's root packages[""].version is pinned at 0.0.0 and has never mirrored the app version, so leaving it untouched is correct and npm ci will not report drift. Noting it here only so it isn't mistaken for an omission.
• Post-merge reminder: per version-release, after merge the release is cut by pushing tag v0.0.21 from main (OIDC-trusted npm publish fires on the tag). Confirm no v0.0.21 tag already exists before tagging (idempotency check).

---

Verdict: approved (informational)

No Critical findings. The version increment is valid, the release genuinely contains the #57 work it references, and the lockfile handling is consistent with repo convention. The single Suggestion (drop the unrelated description re-encoding) is optional cleanup, not a merge blocker. Human approval is still required via the normal approve flow.

[jwfing]

LGTM - approved.

[jwfing]

LGTM - approved.

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}