[M3gA-Mind]

Summary

Bumps the workspace version from 0.18.5 to 0.18.6 for a release. The release carries:

• Move the pure tool-UI rules into tinymcp-bus #105, which moves the pure tool-UI rules into tinymcp-bus (contract 1.25).
• Bound the cooldown tests' wall clock by a budget, not by 100ms #107, the cooldown-test timing fix.

The change matches the 0.18.5 release (bcbb2fb): [workspace.package] version in Cargo.toml, and the tinymcp and tinymcp-bus entries in Cargo.lock. Nothing else changes.

After this merges, a maintainer tags v0.18.6 at the merge commit and dispatches Release. This PR does not push a tag.

Related issue

Part of tinyhumansai/openhuman#7868. openhuman's host switch (tinyhumansai/openhuman#7876) needs a published tinymcp release that contains #105 before it can repin. The issue stays open until that repin lands.

API or behavior changes

None in this PR (version only). The release itself ships #105's public API addition, tinymcp_bus::ui rules re-exported as tinymcp::ui, and its fail-closed behaviour change: http(s) links with userinfo, IDN/punycode or %-encoded hosts, IPv6, non-canonical IPv4, bad ports or dot segments are now Blocked, where they were previously Web.

Validation

• cargo metadata --locked --offline: exit 0, so the edited lockfile resolves
• cargo fmt --all -- --check (no Rust source changed; CI)
• cargo clippy --all-targets --all-features -- -D warnings (CI)
• cargo build --all-targets --all-features (CI)
• cargo test --all-features (CI)

These were not run locally: by our fleet's policy, CI is the gate.

Tests

None: version only.

Documentation

None needed. The contract 1.25 notes landed with #105.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints
• No secrets, tokens, or .env contents in the diff or the description

[tinysweeper]

Tiny Sweeper review

Tiny Sweeper completed its review; deterministic results follow.

State: Incomplete
Priority: none
Reviewed head: d8d809d5ac99
Updated: 2026-10-15T20:59:43Z

Review snapshot

Change surface	Files	Review signal	Count
Production	0	Active findings	0
Tests	0	Noted findings	0
Documentation	0	Resolved findings	0
Configuration	1	Pending checks/questions	1

Completeness: Incomplete
Test assessment: No supported feature-to-test mapping was available; this does not mean tests are absent or passed.

Features

None identified with supported citations.

Tests

No supported feature-to-test mapping was produced. Test execution is not inferred.

Findings

No active actionable findings.

Could not review: tinysweeper/description

Before merge

• Complete the description review for tinysweeper/description.

Agent review details

critique

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: This is a routine version bump of the workspace package version from `0.18.5` to `0.18.6`, the single place the release workflow writes it (per the comment above the change). It changes no code, no dependency, and no behavior, and matches the repository's documented release process (bump versions via reviewed PR, then tag). There is nothing here that a lookup could settle further and no defect to report; the change looks sound. Note I am reviewing only `Cargo.toml` — the lockfile bump and any release-flow consequence live in other files and are not mine to raise here. _The code index is behind this pull request (indexed at `d5de9e52aa66`), so retrieved context may be out of date._

security

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Lane summary: The diff is a single routine workspace version bump from 0.18.5 to 0.18.6 in `[workspace.package]`. The repository's own guidance (AGENTS.md, CONTRIBUTING.md) explicitly anticipates version bumps through a reviewed PR, and the release workflow bumps this shared version; nothing in the change touches dependencies, permissions, code paths, or secrets. No security-relevant defect is visible and no lookups are needed to settle anything about this one-line change. _The code index is behind this pull request (indexed at `d5de9e52aa66`), so retrieved context may be out of date._

tests

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: No behavioural change: nothing outside documentation, configuration and tests.

commits

• Conclusion: Neutral
• Scope reviewed: all assigned evidence
• Lane summary: Nothing sensitive found in what this pull request commits.

description

• Conclusion: Neutral
• Scope reviewed: incomplete; unanswered: tinysweeper/description
• Lane summary: No reviewer produced a usable response.

Evidence and run details

• Models: ladder/vectors-oai3, glm-5.3-flash
• Spend: $0.000379
• Tokens: 32670 input · 2657 output · 0 cached · 29 embedding

Head	State	Pass summary
ac180a81c036	ready for maintainer review	0 active finding(s), 0 resolved finding(s) (at 2026-10-15T20:58:49Z)
d8d809d5ac99	incomplete	0 active finding(s), 0 resolved finding(s) (at 2026-10-15T20:59:43Z)

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 80fab852-327a-4577-9c4b-9e17280727ab

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[tinysweeper]

tinysweeper found nothing blocking. Approving.

$0.0000 · 0 in / 0 out · 14 embedded · ladder/vectors-oai3

tinysweeper could not review the latest push, so its earlier approval no longer speaks for this pull request.

[tinysweeper]

tinysweeper found nothing blocking, but could not review everything, so this is not an approval: tinysweeper/description.

             $0.0004 · 32,670 in / 2,657 out · 0 cached (0%) · ladder/vectors-oai3, glm-5.3-flash · 29 embedded
critique:    $0.0001 · 13,189 in / 141 out   · 0 cached (0%) · glm-5.3-flash
security:    $0.0001 · 12,945 in / 108 out   · 0 cached (0%) · glm-5.3-flash
description: $0.0001 · 5,070 in  / 690 out   · 0 cached (0%) · glm-5.3-flash