Code Review — insta-cli#49 release: v0.0.17

Summary: Pure version bump (0.0.16 → 0.0.17) in package.json to cut a release that ships the already-merged #48 (default cloud API host → api.instacloud.com); the diff is a single, correct line.

Requirements context

No matching spec/plan found — this repo has no docs/superpowers/ or docs/specs/ directory (no docs/ at all). Assessed against the PR description, the version-release skill, and git history. This PR is the "bump version in package.json, merged to main before the tag is cut" step that the release flow requires; the tag/npm-publish is a separate downstream action.

Findings

Critical

(none)

Suggestion

(none)

Information

• Software engineering — release convention followed. The one-line release: vX.Y.Z bump with no code/test changes matches the established pattern in this repo's history (caf94ee v0.0.16, 398c5e4 v0.0.15, 715fe33 v0.0.14 — each a standalone release: PR following its fix). No tests are expected or needed for a version-only bump.
• Functionality — claim verified. This PR's base (7f8cec7) is exactly the merge commit of #48, and src/config.ts:24 sets const DEFAULT_API = 'https://api.instacloud.com' (with src/config.ts:21-22 documenting the switch away from the legacy beta-api.insta.insforge.dev host). So v0.0.17 genuinely carries the change described. The 0.0.x patch bump is appropriate for a default-host change under the repo's 0.x-per-fix scheme.
• Release safety — no tag collision. Tags currently run v0.0.10…v0.0.16; v0.0.17 does not yet exist locally or on origin, so the downstream tag/npm-publish step has no idempotency conflict.
• Pre-existing lockfile drift (not introduced here, out of scope). package-lock.json carries root "version": "0.0.0" and "name": "insta-cli", while package.json is "version": "0.0.17" / "name": "insta". This mismatch is identical at the PR base — it predates this PR and every prior release — so it is not a regression from this change. It does not affect npm publish (reads package.json) or npm ci (validates dependency tree, not the root version field). Worth a separate cleanup PR to keep the lockfile in sync, but nothing to block on here.

Security

No security-relevant changes in this PR (version string only).

Performance

No performance-relevant changes in this PR.

Verdict

approved (informational) — zero Critical findings. The diff is minimal, correct, matches release conventions, and accurately ships #48. Left as a COMMENT; explicit GitHub green-checkmark approval remains a human action.

LGTM - approved.

Code Review — PR #49 release: v0.0.17

Summary: A clean, one-line release bump (package.json 0.0.16 → 0.0.17) that tags and ships the already-merged #48 (default cloud API host → api.instacloud.com); the shipped code is present and correct at this head.

Requirements context

No matching spec/plan found — this repo has no docs/superpowers/ (or any docs/) directory. Assessed against the PR description and the change it ships (#48). I verified the substance by inspecting the code the tag will release, not just the one-line diff:

• The base of this PR (7f8cec7) is already fix(config): default cloud API to api.instacloud.com (#48), so tagging v0.0.17 legitimately ships that change.
• src/config.ts:24 defines DEFAULT_API = 'https://api.instacloud.com', matching the PR/cubic summary.

Findings

Critical

(none)

Suggestion

• Software engineering — The config-resolution change this release advertises (#48, src/config.ts) has no direct test coverage: there is no test/config.test.ts, and no test references readGlobal / DEFAULT_API / apiUrl. The PR's headline guarantee ("existing configurations are unaffected") is exactly the kind of invariant a small regression test would lock down — e.g. assert readGlobal() returns api.instacloud.com on a fresh install, preserves a persisted parsed.apiUrl, and honors INSTA_API_URL. Non-blocking here (the change is already merged into main), but worth adding in a follow-up.

Information

• Functionality — I confirmed the "existing configurations are unaffected" claim is accurate. src/config.ts:32 resolves envApi ?? parsed.apiUrl ?? DEFAULT_API, so a persisted apiUrl from a prior login always wins over the new default; DEFAULT_API only applies to a fresh install (:34) or a config file missing apiUrl. INSTA_API_URL overrides both. Correct.
• Software engineering — Touching only package.json matches this repo's release convention (prior release caf94ee/v0.0.16 was likewise a single-line package.json bump). package-lock.json is intentionally decoupled (root version stays 0.0.0), so it needs no bump — no inconsistency.
• Security — No security-relevant changes. No user input, secrets, tokens, auth logic, or dependencies are touched; the diff is a version-string bump.
• Performance — No performance-relevant changes. No new queries, loops, allocations, or I/O.

Verdict

approved (informational — zero Critical findings). Posted as a COMMENT; explicit GitHub approval remains a separate human action. The one Suggestion (add a regression test for the config-host default) is non-blocking and better addressed as a follow-up than gated on a release tag.

LGTM - approved.