rmusser01 · rmusser01 · Jul 1, 2026 · Jul 1, 2026 · Jul 1, 2026 · Jul 2, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -17,6 +17,43 @@ and this project adheres to Some kind of Versioning
 ### Removed
 
 
+## [0.1.34] - 2026-07-02
+
+> Rollup coverage: this entry covers current `dev` work that landed after the
+> `0.1.33` release-prep metadata through PR #2568, including the post-PR #2567
+> review follow-ups and current-main CodeQL alert cleanup.
+
+### Added
+
+- **PR 2568 Follow-Up Coverage** — Added Backlog records and focused
+  regression coverage for Jobs event-filter SQL helpers, public metrics-label
+  hashing, frontend auth persistence, and the `mcp-unified` PEP 561
+  `py.typed` marker/package-data contract.
+
+### Changed
+
+- **Jobs, WebSearch, And Auth Persistence Cleanup** — Moved Jobs event-filter
+  SQL construction behind DB management helpers, replaced WebSearch diagnostic
+  `print()` calls with structured Loguru logging, clarified Google parser debug
+  formatting, and restored browser persistence for manually entered API keys
+  and bearer tokens while preserving environment-provided auth precedence.
+- **CodeQL Suppression Hygiene** — Updated validated path/auth/download/sync
+  suppressions from legacy LGTM comments to scoped CodeQL annotations with
+  local rationale on the reviewed paths.
+
+### Fixed
+
+- **PR 2567/2568 Review Follow-Ups** — Addressed review findings for DB-layer
+  ownership, missing helper/class docstrings, pytest unit markers, metrics tests
+  using public label normalization, WebSearch logging ambiguity, frontend auth
+  reload behavior, and the `mcp-unified` typed-marker package-data mismatch.
+
+### Removed
+
+- Removed stray WebSearch parser diagnostic `print()` calls from the current
+  release line.
+
+
 ## [0.1.33] - 2026-07-01
 
 > Rollup coverage: this entry covers work that landed after the `0.1.32`

diff --git a/Docs/mkdocs.yml b/Docs/mkdocs.yml
@@ -59,13 +59,13 @@ markdown_extensions:
 
 extra:
   generator: false
-  version: v0.1.33
+  version: v0.1.34
   social:
     - icon: fontawesome/brands/github
       link: https://github.com/rmusser01/tldw_server
       name: GitHub
 copyright: |
-  © 2024-2025 tldw_Server - v0.1.33 - <a href="https://github.com/rmusser01/tldw_server">GitHub</a>
+  © 2024-2025 tldw_Server - v0.1.34 - <a href="https://github.com/rmusser01/tldw_server">GitHub</a>
 
 nav:
   - Home: User_Guides/index.md

diff --git a/Helper_Scripts/release.py b/Helper_Scripts/release.py
@@ -290,16 +290,6 @@ def update_readme_release_references(readme_text: str, version: str) -> str:
             rf"\g<1>{version}\g<2>",
             "current release line",
         ),
-        (
-            rf"(?m)^(- The `dev` branch currently contains additional unreleased work beyond `){_SEMVER_PATTERN}(`; see \[CHANGELOG\.md\]\(CHANGELOG\.md\) for branch-level detail and \[Docs/Published/RELEASE_NOTES\.md\]\(Docs/Published/RELEASE_NOTES\.md\) for the published release entry point\.)$",
-            rf"\g<1>{version}\g<2>",
-            "beyond-release reference",
-        ),
-        (
-            rf"(?m)^(Currently landing on `dev` \(post-`){_SEMVER_PATTERN}(` branch work\):)$",
-            rf"\g<1>{version}\g<2>",
-            "post-release reference",
-        ),
     ]
 
     updated_text = readme_text
@@ -308,6 +298,28 @@ def update_readme_release_references(readme_text: str, version: str) -> str:
         if count == 0:
             raise ValueError(f"Missing README anchor for {anchor_name}")
 
+    branch_line_pattern = rf"(?m)^- The `dev` branch .*beyond `{_SEMVER_PATTERN}`.*$"
+
+    def _replace_branch_line(match: re.Match[str]) -> str:
+        return re.sub(_SEMVER_PATTERN, version, match.group(0))
+
+    updated_text, count = re.subn(
+        branch_line_pattern,
+        _replace_branch_line,
+        updated_text,
+        count=1,
+    )
+    if count == 0:
+        raise ValueError("Missing README anchor for beyond-release reference")
+
+    updated_text, post_count = re.subn(
+        rf"(?m)^(Currently landing on `dev` \(post-`){_SEMVER_PATTERN}(` branch work\):)$",
+        rf"\g<1>{version}\g<2>",
+        updated_text,
+    )
+    if post_count == 0 and f"post-`{version}` branch work" not in updated_text:
+        raise ValueError("Missing README anchor for post-release reference")
+
     return updated_text
 
 

diff --git a/README.md b/README.md
@@ -108,10 +108,10 @@ Optional add-ons (apply AFTER your base profile is healthy):
 ## Current Status
 
 Current release line:
-- `0.1.33` Beta status. Expect rough edges and please report issues.
+- `0.1.34` Beta status. Expect rough edges and please report issues.
 - Primary client surfaces are the Next.js WebUI, Admin UI, and browser extension.
 - Package metadata is prepared under the canonical PyPI name `tldw-server`; use a repository checkout until publishing is complete.
-- The `dev` branch carries work beyond `0.1.33`, including post-`0.1.33` branch work, and is prepared for the `0.1.33` release merge to `main`; see [CHANGELOG.md](CHANGELOG.md) for the PR rollup and [Docs/Published/RELEASE_NOTES.md](Docs/Published/RELEASE_NOTES.md) for the published release entry point.
+- The `dev` branch carries work beyond `0.1.34`, including post-`0.1.34` branch work, and is prepared for the `0.1.34` release merge to `main`; see [CHANGELOG.md](CHANGELOG.md) for the PR rollup and [Docs/Published/RELEASE_NOTES.md](Docs/Published/RELEASE_NOTES.md) for the published release entry point.
 
 <details>
 <summary>Current focus and migration notes from the old Gradio version</summary>
@@ -146,18 +146,17 @@ Current release line:
 ## What's New (in the last few releases)
 
 <details>
-<summary>0.1.33 release-prep rollup</summary>
+<summary>0.1.34 release-prep rollup</summary>
 
-Included in the `0.1.33` release-prep rollup:
-- Post-`0.1.32` dev/main stabilization for PR #1982 and PR #2557, including full-suite shard coverage mapping, MkDocs deploy verification, grouped CI fixes, and circuit-breaker flake cleanup.
-- Fish Audio S2 TTS support, including provider registration, native backend/adapter wiring, voice metadata resolution, managed reference imports, contract fixes, and setup documentation.
-- Explainer Workspace persistence, expansion jobs, grounding snapshots, chatbook export/import, UI surfaces, verification coverage, and follow-up hardening.
-- MCP, Skills, and package-gateway readiness work covering runtime metadata, recovery/readiness fields, risky-module opt-in handling, standalone profile discovery, and residual UX review fixes.
-- Chunking and moderation internals refactored around shared helpers and compiler abstractions while preserving existing parsing, dispatch, metrics, and service behavior.
-- Release documentation and packaging cleanup for README skimming, root implementation-plan cleanup, MCP package-path clarity, VCS/manual backend extras, and stale release-branch artifacts.
+Included in the `0.1.34` release-prep rollup:
+- Post-`0.1.33` dev follow-ups for PR #2568, covering review feedback from the dev-to-main PR #2567 path and current-main CodeQL alert cleanup.
+- Jobs event-filter SQL construction moved behind DB management helpers, with focused regression coverage for backend/column validation.
+- WebSearch diagnostic logging cleaned up by replacing `print()` calls with structured Loguru logging and clearer Google raw-result debug formatting.
+- Frontend auth persistence restored for manually entered API keys and bearer tokens while preserving environment-provided auth precedence.
+- `mcp-unified` typed-marker/package-data coverage restored, and related package-boundary tests kept aligned with release metadata.
 
 Still active on `dev`:
-- Final CI for PR #2557 must clear before the prepared `0.1.33` release metadata is merged.
+- Final CI for the prepared `0.1.34` release metadata must clear before this release is merged toward `main`.
 - Treat [CHANGELOG.md](CHANGELOG.md) as the authoritative branch-level history for what has entered the release train.
 
 See [CHANGELOG.md](CHANGELOG.md) for the full running history and [Docs/Published/RELEASE_NOTES.md](Docs/Published/RELEASE_NOTES.md) for published release notes.

diff --git a/apps/mcp-unified/src/mcp_unified/py.typed b/apps/mcp-unified/src/mcp_unified/py.typed
@@ -0,0 +1 @@
+
diff --git a/apps/tldw-frontend/e2e/smoke/chat-openui-dynamic-ui.spec.ts b/apps/tldw-frontend/e2e/smoke/chat-openui-dynamic-ui.spec.ts
@@ -26,8 +26,8 @@
     window.localStorage.setItem("assistant_setup_dismissed", "true")
     window.localStorage.setItem("__tldw_first_run_complete", "true")
     window.localStorage.setItem("__tldw_test_bypass", "true")
-    window.localStorage.setItem("tldwConfig", JSON.stringify(authConfig)) // lgtm[js/clear-text-storage-of-sensitive-data] synthetic E2E auth seed only
-    window.localStorage.setItem("apiKey", authConfig.apiKey) // lgtm[js/clear-text-storage-of-sensitive-data] test-only legacy auth compatibility key
+    window.localStorage.setItem("tldwConfig", JSON.stringify(authConfig)) // codeql[js/clear-text-storage-of-sensitive-data] synthetic E2E auth seed only
+    window.localStorage.setItem("apiKey", authConfig.apiKey) // codeql[js/clear-text-storage-of-sensitive-data] test-only legacy auth compatibility key
     window.localStorage.setItem("authMode", authConfig.authMode)
   })
 }

diff --git a/apps/tldw-frontend/e2e/smoke/chat-sticky-composer.spec.ts b/apps/tldw-frontend/e2e/smoke/chat-sticky-composer.spec.ts
@@ -26,8 +26,8 @@
     window.localStorage.setItem('assistant_setup_dismissed', 'true');
     window.localStorage.setItem('__tldw_first_run_complete', 'true');
     window.localStorage.setItem('__tldw_test_bypass', 'true');
-    window.localStorage.setItem('tldwConfig', JSON.stringify(authConfig)); // lgtm[js/clear-text-storage-of-sensitive-data] synthetic E2E auth seed only
-    window.localStorage.setItem('apiKey', authConfig.apiKey); // lgtm[js/clear-text-storage-of-sensitive-data] test-only legacy auth compatibility key
+    window.localStorage.setItem('tldwConfig', JSON.stringify(authConfig)); // codeql[js/clear-text-storage-of-sensitive-data] synthetic E2E auth seed only
+    window.localStorage.setItem('apiKey', authConfig.apiKey); // codeql[js/clear-text-storage-of-sensitive-data] test-only legacy auth compatibility key
     window.localStorage.setItem('authMode', authConfig.authMode);
     window.localStorage.setItem('stickyChatInput', 'true');
     window.localStorage.setItem('playgroundComposerOptionsExpanded', 'false');

diff --git a/apps/tldw-frontend/e2e/smoke/smoke.setup.ts b/apps/tldw-frontend/e2e/smoke/smoke.setup.ts
@@ -411,14 +411,14 @@
         accessToken: cfg.accessToken
       }
 
-      localStorage.setItem("tldwConfig", JSON.stringify(authConfig)) // lgtm[js/clear-text-storage-of-sensitive-data] synthetic E2E auth seed only
+      localStorage.setItem("tldwConfig", JSON.stringify(authConfig)) // codeql[js/clear-text-storage-of-sensitive-data] synthetic E2E auth seed only
       localStorage.setItem("isMigrated", "true")
       // Backward-compat for routes still reading legacy top-level keys.
       localStorage.setItem("serverUrl", cfg.serverUrl)
       localStorage.setItem("tldwServerUrl", cfg.serverUrl)
       localStorage.setItem("authMode", cfg.authMode)
-      localStorage.setItem("apiKey", cfg.apiKey) // lgtm[js/clear-text-storage-of-sensitive-data] test-only legacy auth compatibility key
-      localStorage.setItem("accessToken", cfg.accessToken) // lgtm[js/clear-text-storage-of-sensitive-data] synthetic E2E auth seed only
+      localStorage.setItem("apiKey", cfg.apiKey) // codeql[js/clear-text-storage-of-sensitive-data] test-only legacy auth compatibility key
+      localStorage.setItem("accessToken", cfg.accessToken) // codeql[js/clear-text-storage-of-sensitive-data] synthetic E2E auth seed only
       localStorage.setItem("__tldw_first_run_complete", "true")
       localStorage.setItem("assistant_setup_dismissed", "true")
       localStorage.setItem("__tldw_test_bypass", "true")

diff --git a/apps/tldw-frontend/e2e/ux-audit/knowledge-readiness-recovery.spec.ts b/apps/tldw-frontend/e2e/ux-audit/knowledge-readiness-recovery.spec.ts
@@ -11,15 +11,15 @@
     }
 
     try {
-      localStorage.setItem("tldwConfig", JSON.stringify(authConfig)) // lgtm[js/clear-text-storage-of-sensitive-data] synthetic E2E auth seed only
+      localStorage.setItem("tldwConfig", JSON.stringify(authConfig)) // codeql[js/clear-text-storage-of-sensitive-data] synthetic E2E auth seed only
       localStorage.setItem("isMigrated", "true")
       localStorage.setItem("__tldw_first_run_complete", "true")
       localStorage.setItem("assistant_setup_dismissed", "true")
       localStorage.setItem("serverUrl", cfg.serverUrl)
       localStorage.setItem("tldwServerUrl", cfg.serverUrl)
       localStorage.setItem("tldw-api-host", cfg.serverUrl)
       localStorage.setItem("authMode", "single-user")
-      localStorage.setItem("apiKey", cfg.apiKey) // lgtm[js/clear-text-storage-of-sensitive-data] test-only legacy auth compatibility key
+      localStorage.setItem("apiKey", cfg.apiKey) // codeql[js/clear-text-storage-of-sensitive-data] test-only legacy auth compatibility key
       localStorage.removeItem("__tldw_allow_offline")
       localStorage.removeItem("__tldw_test_bypass")
     } catch {

diff --git a/apps/tldw-frontend/e2e/workflows/chat-cockpit.real-server.spec.ts b/apps/tldw-frontend/e2e/workflows/chat-cockpit.real-server.spec.ts
@@ -364,12 +364,12 @@
         localStorage.setItem(key, JSON.stringify(value));
       };
 
-      localStorage.setItem('tldwConfig', JSON.stringify(config)); // lgtm[js/clear-text-storage-of-sensitive-data] test-only browser auth seed for real-server E2E
+      localStorage.setItem('tldwConfig', JSON.stringify(config)); // codeql[js/clear-text-storage-of-sensitive-data] test-only browser auth seed for real-server E2E
       localStorage.setItem('serverUrl', configuredServerUrl);
       localStorage.setItem('tldwServerUrl', configuredServerUrl);
       localStorage.setItem('tldw-api-host', configuredServerUrl);
       localStorage.setItem('authMode', 'single-user');
-      localStorage.setItem('apiKey', configuredApiKey); // lgtm[js/clear-text-storage-of-sensitive-data] test-only legacy auth compatibility key
+      localStorage.setItem('apiKey', configuredApiKey); // codeql[js/clear-text-storage-of-sensitive-data] test-only legacy auth compatibility key
       localStorage.setItem('isMigrated', 'true');
       localStorage.setItem('__tldw_first_run_complete', 'true');
       localStorage.setItem('assistant_setup_dismissed', 'true');
@@ -398,7 +398,7 @@
         }
       }
       if (configuredPersistedServerChatId) {
-        localStorage.setItem( // lgtm[js/clear-text-storage-of-sensitive-data] synthetic E2E persisted chat fixture
+        localStorage.setItem( // codeql[js/clear-text-storage-of-sensitive-data] synthetic E2E persisted chat fixture
           'tldw-playground-session',
           JSON.stringify({
             state: {

diff --git a/apps/tldw-frontend/e2e/workflows/media-review.spec.ts b/apps/tldw-frontend/e2e/workflows/media-review.spec.ts
@@ -86,7 +86,7 @@ const seedAppAuthWithApiKey = async (page: import("@playwright/test").Page) => {
         "tldwConfig",
         JSON.stringify({
           serverUrl: cfg.serverUrl,
-          // lgtm[js/clear-text-storage-of-sensitive-data] synthetic CI key only
+          // codeql[js/clear-text-storage-of-sensitive-data] synthetic CI key only
           apiKey: cfg.apiKey,
           authMode: "single-user"
         })

diff --git a/apps/tldw-frontend/e2e/workflows/onboarding-ingestion-first.spec.ts b/apps/tldw-frontend/e2e/workflows/onboarding-ingestion-first.spec.ts
@@ -303,7 +303,7 @@ test.describe("Onboarding First-Source Journey", () => {
     await installCompletedFirstRunApi(authedPage)
     await authedPage.addInitScript((cfg) => {
       try {
-        localStorage.setItem( // lgtm[js/clear-text-storage-of-sensitive-data] synthetic E2E auth seed only
+        localStorage.setItem( // codeql[js/clear-text-storage-of-sensitive-data] synthetic E2E auth seed only
           "tldwConfig",
           JSON.stringify({
             serverUrl: cfg.serverUrl,

diff --git a/apps/tldw-frontend/extension/shims/runtime-bootstrap.ts b/apps/tldw-frontend/extension/shims/runtime-bootstrap.ts
@@ -477,6 +477,7 @@
 
   if (initialServerUrl && explicitWebHost !== initialServerUrl) {
     try {
+      // codeql[js/clear-text-storage-of-sensitive-data]: tldw-api-host stores non-secret server metadata only.
       window.localStorage.setItem("tldw-api-host", initialServerUrl)
     } catch {
       // Best-effort only; ignore storage failures in web contexts.
@@ -501,7 +502,8 @@
    if (!serverUrl && !apiKey && !apiBearer) return
 
     if (serverUrl && initialServerUrl !== serverUrl) {
       try {
+        // codeql[js/clear-text-storage-of-sensitive-data]: tldw-api-host stores non-secret server metadata only.
         window.localStorage.setItem("tldw-api-host", serverUrl)
       } catch {
         // Best-effort only; ignore storage failures in web contexts.

diff --git a/apps/tldw-frontend/hooks/__tests__/useConfig.networking.test.tsx b/apps/tldw-frontend/hooks/__tests__/useConfig.networking.test.tsx
@@ -8,6 +8,10 @@ const authStorageMocks = vi.hoisted(() => ({
 
 vi.mock('@web/lib/authStorage', () => authStorageMocks);
 
+function readStoredTldwConfig(): Record<string, unknown> {
+  return JSON.parse(localStorage.getItem('tldwConfig') ?? '{}') as Record<string, unknown>;
+}
+
 describe('useConfig networking', () => {
   beforeEach(() => {
     vi.resetModules();
@@ -150,7 +154,7 @@ describe('useConfig networking', () => {
     });
   });
 
-  it('keeps manually entered single-user api keys in runtime memory only', async () => {
+  it('persists manually entered single-user api keys for reloads', async () => {
     process.env.NEXT_PUBLIC_API_URL = 'http://127.0.0.1:8000';
     localStorage.setItem('apiBearer', 'legacy-bearer');
     localStorage.setItem('refreshToken', 'legacy-refresh');
@@ -167,12 +171,41 @@ describe('useConfig networking', () => {
     await waitFor(() => {
       expect(authStorageMocks.setRuntimeApiKey).toHaveBeenLastCalledWith('saved-api-key');
     });
-    expect(localStorage.getItem('apiKey')).toBeNull();
+    expect(localStorage.getItem('apiKey')).toBe('saved-api-key');
     expect(localStorage.getItem('apiBearer')).toBeNull();
-    expect(localStorage.getItem('tldwConfig')).not.toContain('saved-api-key');
+    expect(readStoredTldwConfig()).toMatchObject({
+      authMode: 'single-user',
+      apiKey: 'saved-api-key',
+    });
+    expect(readStoredTldwConfig()).not.toHaveProperty('accessToken');
     expect(localStorage.getItem('refreshToken')).toBeNull();
   });
 
+  it('persists manually entered multi-user bearer tokens for reloads', async () => {
+    process.env.NEXT_PUBLIC_API_URL = 'http://127.0.0.1:8000';
+    localStorage.setItem('apiKey', 'legacy-api-key');
+    const { ConfigProvider, useConfig } = await import('@web/hooks/useConfig');
+
+    const { result } = renderHook(() => useConfig(), {
+      wrapper: ({ children }) => <ConfigProvider>{children}</ConfigProvider>,
+    });
+
+    act(() => {
+      result.current.setApiBearer('Bearer saved-bearer-token');
+    });
+
+    await waitFor(() => {
+      expect(authStorageMocks.setRuntimeApiBearer).toHaveBeenLastCalledWith('Bearer saved-bearer-token');
+    });
+    expect(localStorage.getItem('accessToken')).toBe('saved-bearer-token');
+    expect(localStorage.getItem('apiKey')).toBeNull();
+    expect(readStoredTldwConfig()).toMatchObject({
+      authMode: 'multi-user',
+      accessToken: 'saved-bearer-token',
+    });
+    expect(readStoredTldwConfig()).not.toHaveProperty('apiKey');
+  });
+
   it('refreshes live config after settings writes canonical tldw config', async () => {
     process.env.NEXT_PUBLIC_API_URL = 'http://127.0.0.1:8000';
     const { ConfigProvider, useConfig } = await import('@web/hooks/useConfig');
@@ -198,8 +231,12 @@ describe('useConfig networking', () => {
       expect(result.current.config.apiBaseHost).toBe('http://127.0.0.1:8222');
       expect(authStorageMocks.setRuntimeApiKey).toHaveBeenLastCalledWith('event-api-key');
     });
-    expect(localStorage.getItem('apiKey')).toBeNull();
-    expect(localStorage.getItem('tldwConfig')).not.toContain('event-api-key');
+    expect(localStorage.getItem('apiKey')).toBe('event-api-key');
+    expect(readStoredTldwConfig()).toMatchObject({
+      authMode: 'single-user',
+      apiKey: 'event-api-key',
+    });
+    expect(readStoredTldwConfig()).not.toHaveProperty('accessToken');
   });
 
   it('keeps environment api keys ahead of stale browser config', async () => {
@@ -224,5 +261,8 @@ describe('useConfig networking', () => {
     await waitFor(() => {
       expect(authStorageMocks.setRuntimeApiKey).toHaveBeenLastCalledWith('env-api-key');
     });
+    expect(localStorage.getItem('apiKey')).toBeNull();
+    expect(readStoredTldwConfig()).not.toHaveProperty('apiKey');
+    expect(readStoredTldwConfig()).not.toHaveProperty('accessToken');
   });
 });