v0.1.18

Same-day follow-up to 0.1.17: 12 commits (10 non-merge), no new external pull
requests. It ships the fixes made on main after 0.1.17 — `mcp>=1.30` so the
HTTP MCP transport reclaims sessions, connect-time checks for custom model
endpoints (including fake-IP proxy hosts), grounding of `run_dir/…` refs and
signed amounts, Beijing codes in correlation, the macOS timeout fix and the
sdist contents — together with a leaner agent runtime: tool schemas load on
demand through `load_tools`, oversized tool results stay readable in the run
directory, Swarm sizes its context by the model window, and usage accounting
covers compaction, cancelled responses and failed streams. On the 0.1.17
pre-release verification prompt (DeepSeek V4 Pro, a 20/60 SMA backtest on
AAPL.US) a run took 7 model calls instead of 12 and 152K input tokens instead
of 706K, and reported the same figures.

### Known issues

- A retried provider error (a connection reset or rate limit) can halt live
  model decisions until the next UTC day, and a research goal's final answer
  that crosses its token budget is discarded. Both are fixed on main (see
  Unreleased) and ship with the next release.

### Changed

- Reduce agent request overhead with on-demand tool schemas while keeping the
  complete tool catalog and existing execution permissions. Ordinary backtests
  no longer request extra attribution automatically. Automatic summary titles
  remain available after the first chat exchange.
- Preserve oversized tool results in readable run artifacts and stop Swarm from
  clearing new observations before the model sees them. Context pressure uses
  the model window and includes tool schemas.
- **README credits cover every cycle again**: contributor lines for the
  0.1.13, 0.1.15, 0.1.16 and 0.1.17 cycles in all seven READMEs, each PR
  attribution checked against GitHub. The data-tools list counts the 29
  read-only data tools the MCP server serves (it said 22). The 0.1.13 notes
  below credit ModelScope (#1011) to @yrk111222 and #676 to the session
  lifecycle entry it fixed.

### Fixed

- Keep the custom-endpoint guard lazy-loaded for minimal installations and align
  the Windows desktop MCP lock with the updated package requirement.
- Include compaction, cancelled responses and failed streams in usage accounting;
  stop further work when a research goal exhausts its token budget. Forward the
  configured output cap to both DeepSeek adapters.
- Redact credentials before tool results reach model context or replay caches,
  and reject incomplete compatible-provider streams instead of releasing a
  truncated answer or tool call.
- **`vibe-trading-mcp --transport http` reclaims its sessions**
  (CVE-2026-59951 / GHSA-84m7-p3x7-pcfv). `mcp` is now `>=1.30.0` instead of
  capped below 1.30: an idle session closes after 30 minutes, at most 10,000
  exist and an ended session is dropped, so a client can no longer grow
  server memory without bound. 0.1.15–0.1.17 held the cap because 1.30's
  RFC 8414 issuer check refused IBKR's OAuth metadata; IBKR's
  protected-resource document now names the same issuer as its metadata
  (checked 2026-10-21) and Robinhood's already did. The Docker lock pins
  `mcp` 1.30.0.
- **Custom model endpoints are checked again on every connection**. Saving a
  profile resolved its host once; a name that later re-resolved to a private
  address (DNS rebinding), or a redirect to one, was not checked again. The
  provider test and the running model now resolve each direct connection
  once, refuse it unless every address is public and connect to the address
  they checked (TLS still verifies the host name). When an environment proxy
  carries the request the proxy resolves the name, so this check does not
  apply there.
- **Custom providers can be saved behind fake-IP proxies**. Clash, Surge and
  sing-box in TUN mode answer every lookup from 198.18.0.0/15, which 0.1.17
  refused, so no custom provider could be saved on such a host. A looked-up
  198.18.x address is accepted now (the proxy resolves the real name); the
  same address written into the URL is still refused.
- **Grounding reads the run's own files under the names models use**. A
  figures-block ref naming the active run as `run_dir/…` or by its directory
  name (`20261021_…/artifacts/metrics.csv`) resolves to that run's
  engine-written file, and a sign written before a currency mark
  (`−$1,847.78`, `(−$5.00)`, `PnL: -$3.20`) is the number's sign in both prose
  and declarations. A live DeepSeek backtest report had its final value,
  trade count and losing trade's PnL cut for these two reasons. Model-written
  files and paths outside the run still never resolve, and a hyphen joining
  two figures (`$10-$20`) or a spaced one (`$10 - $20`) is not a sign.
- **Correlation analysis puts bare Beijing, Shanghai-fund and B-share codes on
  their exchange**. `920xxx` resolved to `.SZ`, as did Shanghai `5xxxxx`
  funds and `9xxxxx` B shares; the rule now matches the Tushare fallback's
  (4/8/920 → `.BJ`, 5/6/9 → `.SH`, otherwise `.SZ`).
- **A timed-out background command is reported as a timeout on macOS**.
  macOS answers EPERM rather than ESRCH when a process group holds only
  exited, unreaped processes, so the final kill of a timed-out tree raised
  and the task was marked `error` on a loaded host.
- **Paper accounts say when nothing can be settled yet**. Advancing an
  account before its first session closed reported a date range that ran
  backwards ("between 2026-10-21 and 2026-10-20"); it now names the first
  execution date and the settlement time in the market's time zone.
- **The sdist carries what its tests need**: the test packages'
  `__init__.py` files and CSV / JSON fixtures, and no untracked
  `test_e2e_*.py` harness.