Prepare TypeWhisper 1.7.0-rc1 and fix MCP timeout ordering

[SeoFood]

Publish TypeWhisper 1.7.0-rc1 after successful user everyday testing of Daily 20260910, including an additional AirPods Max retest, and the explicitly requested Vercel AI Gateway integration from #1295.

Add curated RC release notes and allow manual Swift CodeQL analysis before publication. Also fix a genuine MCP timeout race exposed by the initial release attempt: cleanup could cancel the pending request before the timer published its timeout result, so callers sometimes received CancellationError. The timer now returns a timeout outcome; the parent selects it before cancellation, awaits cleanup, then reports the timeout. A deterministic regression fails the cleanup-order assertion against the original implementation and passes with the fix.

Closes #1296. RC1 is published as a GitHub prerelease in the Release Candidate update channel. Stable and Homebrew remain on 1.6.0.

Validation

• Final source 84f8b117874972bf17d86326edc41c4a0fe97cfd, build 1220: signed release workflow passed 1,762 app tests, 788 SDK/plugin tests (3 expected opt-in live-provider skips), Release build, warning checks, iCloud bridge/profile checks, notarization, isolated app spawn, and canonical appcast verification. Duplicate standalone Build DMG runs were cancelled in favor of this complete release workflow, not counted as passes.
• Swift CodeQL passed the post-init Metal check and traced app build at 82fffe163e149e5fa00e87647f1a3acdd83e29f4; Swift, Python, and Actions analyses reported zero results/errors/warnings. The subsequent change touches only the optional MCP plugin and its tests, which the app CodeQL scheme does not build. App/host-SDK sources, Xcode project, dependency manifests and locks are unchanged, so the analyzed app inputs are unchanged. Final-head SDK tests include the corrected MCP implementation.
• actionlint -shellcheck= .github/workflows/codeql.yml
• /opt/homebrew/bin/python3 -m unittest discover -s scripts -p 'test_*.py' — 47 tests pass.
• DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer swift test --package-path TypeWhisperPluginSDK --force-resolved-versions --filter MCPClientPluginTests — 38 tests pass.
• DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer swift test --package-path TypeWhisperPluginSDK --force-resolved-versions — 788 tests, 3 expected skips, no failures.
• bash scripts/check_release_signing.sh --require-notarization /private/tmp/typewhisper-rc1-mounted/TypeWhisper.app and bash scripts/check_release_binary_instrumentation.sh /private/tmp/typewhisper-rc1-mounted/TypeWhisper.app/Contents/MacOS/typewhisper-cli pass against the downloaded artifact.
• Downloaded DMG/ZIP SHA-256 digests and sizes match GitHub. ZIP integrity and app/CLI/bridge contents match the verified DMG. App and SDK are universal, iCloud is enabled, and release metadata identifies RC1/build 1220.
• Vercel AI Gateway 1.0.0: signed universal bundle; all 32 SDK imports exist in the published host on each architecture. Immediate dynamic loading and principal-class lookup pass natively and under Rosetta. This does not claim a live provider call or physical Intel test.
• RC appcast entry is build 1220; stable and Daily entry contents are unchanged.

Published release: https://github.com/TypeWhisper/typewhisper-mac/releases/tag/v1.7.0-rc1

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-10T14:36:55.667958Z	84f8b11	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: bf8e1e9e-588e-4ce3-bf1f-c9666b1e96e7

📥 Commits

Reviewing files that changed from the base of the PR and between 82fffe1 and 84f8b11.

📒 Files selected for processing (2)

• TypeWhisperPluginSDK/Plugins/MCPClientPlugin/MCPClientSession.swift
• TypeWhisperPluginSDK/Plugins/MCPClientPlugin/Tests/MCPClientPluginTests.swift

Included review availability: 2 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

---

📝 Walkthrough

Walkthrough

The PR enables manual Swift CodeQL analysis, adds TypeWhisper 1.7.0 RC1 release notes, and updates MCP timeout handling so asynchronous cleanup completes before a timeout error is returned.

Changes

Release and reliability updates

Layer / File(s)	Summary
MCP timeout cleanup TypeWhisperPluginSDK/Plugins/MCPClientPlugin/MCPClientSession.swift, TypeWhisperPluginSDK/Plugins/MCPClientPlugin/Tests/MCPClientPluginTests.swift	withTimeout distinguishes operation completion from timeout, awaits cancellation cleanup, and preserves the .timedOut error. Tests verify the cleanup ordering.
Release preparation .github/workflows/codeql.yml, docs/release-notes/1.7.0-rc1.md	The CodeQL workflow supports manual dispatches. RC1 notes document features, compatibility, plugin requirements, distribution channels, and regression reporting.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant MCPClientSession
  participant Operation
  Caller->>MCPClientSession: Start withTimeout
  MCPClientSession->>Operation: Run operation and timeout task
  MCPClientSession->>Operation: Cancel operation after timeout
  Operation-->>MCPClientSession: Complete asynchronous cleanup
  MCPClientSession-->>Caller: Throw .timedOut

Loading

Merge Risk: ⚪ Minimal · up to 84f8b

The change ensures timeout cleanup completes before returning an error and prepares the RC1 release workflow and notes. Validation passed, with no concrete merge-blocking risk remaining.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes satisfy the coding objectives in issue #1296. The workflow supports manual Swift CodeQL validation, the release notes document the RC1 scope and channel policy, and the MCP timeout fix add…
Out of Scope Changes check	✅ Passed	The workflow change, RC1 release notes, MCP timeout fix, and regression test all support the release preparation and validation objectives in issue #1296. No unrelated changes are present.
Title check	✅ Passed	The title clearly identifies both main changes: preparing TypeWhisper 1.7.0-rc1 and fixing MCP timeout ordering.
Description check	✅ Passed	The description provides a detailed summary, release context, linked issue, and extensive validation results. It uses a Validation section instead of the template's Summary and Test Plan headings, but…

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch seofood/release-1.7.0-rc1

---

_{A rabbit checked the timeout gate
Cleanup finished before it was late
CodeQL woke when called by hand
RC1 notes spread across the land
Swift hops safely, neat and bright}

_{Comment @coderabbitai help to get the list of available commands.}