chore(release): 0.0.34

[Fermionic-Lyu]

Version bump for the release shipping insta feedback (#95 + review follow-ups #96, #98).

After merge: tag v0.0.34 → release workflow builds binaries + publishes npm via OIDC.

🤖 Generated with Claude Code

---

Summary by cubic

Releases insta v0.0.34 to ship the new feedback flow. v0.0.33 shipped without feedback; v0.0.34 enables it with no other behavior changes.

• Tag v0.0.34 after merge; the release workflow builds binaries and publishes to npm via OIDC.
• No migration required for users.

^{Written for commit 8c37c08. Summary will update on new commits.}

[jwfing]

Review — chore(release): 0.0.34

Summary: A clean, self-consistent patch version bump (0.0.33 → 0.0.34) across package.json and package-lock.json, releasing the already-merged insta feedback work; no functional code changes.

Requirements context: No matching spec/plan found — insta-cli keeps specs under docs/specs/ and this is a release chore with no spec. Assessed against the PR description and the repo's release workflow (.github/workflows/release.yml).

Verification performed

• Version consistency: Both package.json:3 and package-lock.json (root version and the packages[""] entry) move 0.0.33 → 0.0.34. Keeping the lockfile in lockstep matters here — the publish-npm job runs npm ci, which fails on a package/lock version mismatch. ✅
• Correct next version: Prior release was 0.0.33 (merge #94, 9d4b3c9); 0.0.34 is the correct next patch. ✅
• Shipped work is actually present: The three PRs cited in the body are all merged into the base (a9055ea): #95 (feat: insta feedback), #96 (review follow-ups), #98 (--file regular-files-only). ✅
• No other version references to update — no CHANGELOG, and grep finds no other hardcoded 0.0.33/0.0.34 strings in the tree. ✅
• Release path matches the body: pushing tag v0.0.34 triggers release.yml → Bun builds binaries → publish-npm publishes insta to npm. Tag has no hyphen, so it correctly takes the latest dist-tag / GitHub "Latest" release (production channel). ✅

Findings

Critical: (none)

Suggestion: (none)

Information

• Software engineering — No tests accompany this change, which is correct: a version-string bump has no behavior to test, and CI's npm ci implicitly validates package/lock consistency.
• Process note (out of scope, pre-existing) — The PR body says npm is published "via OIDC", which the publish-npm job indeed does (id-token: write, --provenance, trusted publishing, no token). However, the release.yml comment block still describes a "GRANULAR AUTOMATION token (repo secret NPM_TOKEN)" for the npm half. That comment is stale relative to the OIDC flow directly below it and could confuse a release operator — worth a cleanup in a separate PR, but nothing to change here.

Dimension coverage

• Software engineering: No conventions violated; no tests warranted for a version bump.
• Functionality: Bump is correct, complete, and keeps npm ci green.
• Security: No security-relevant changes — no new dependencies, no code, no secrets.
• Performance: No performance-relevant changes.

Verdict

approved — no Critical findings. Textbook clean release bump; safe to tag v0.0.34 after merge. (Informational only; the green-checkmark approval remains a separate human action.)

[jwfing]

LGTM - approved.