mcp(fix[batch_tools]): Limit generic batch operation count

why: A batch with enough small row results can exceed the response cap even
after nested payload truncation, because row metadata alone still serializes
into the FastMCP response envelope.
what:
- Reject generic tool batches above a fixed operation-count cap
- Add a public FastMCP regression for row-only oversized batch responses

Author: tony

src/libtmux_mcp/tools/batch_tools.py

@@ -44,6 +44,8 @@
     }
 )
 
+MAX_BATCH_OPERATIONS = 1_000
+
 _BATCH_TRUNCATED_CONTENT: list[dict[str, t.Any]] = [
     {
         "type": "text",
@@ -246,6 +248,9 @@ async def _call_tools_batch(
     if not operations:
         msg = "operations must contain at least one tool call"
         raise ExpectedToolError(msg)
+    if len(operations) > MAX_BATCH_OPERATIONS:
+        msg = f"operations must contain at most {MAX_BATCH_OPERATIONS} tool calls"
+        raise ExpectedToolError(msg)
     if on_error not in {"stop", "continue"}:
         msg = "on_error must be 'stop' or 'continue'"
         raise ExpectedToolError(msg)

tests/test_batch_tools.py

@@ -36,6 +36,21 @@ class BatchResponseLimitFixture(t.NamedTuple):
 ]
 
 
+class BatchOperationLimitFixture(t.NamedTuple):
+    """Test fixture for operation-count batch limiting."""
+
+    test_id: str
+    operation_count: int
+
+
+BATCH_OPERATION_LIMIT_FIXTURES: list[BatchOperationLimitFixture] = [
+    BatchOperationLimitFixture(
+        test_id="many_missing_tools",
+        operation_count=6_000,
+    ),
+]
+
+
 class BatchAnnotationFixture(t.NamedTuple):
     """Test fixture for generic batch wrapper annotations."""
 
@@ -251,6 +266,52 @@ async def _call() -> t.Any:
     ]
 
 
+@pytest.mark.parametrize(
+    BatchOperationLimitFixture._fields,
+    BATCH_OPERATION_LIMIT_FIXTURES,
+    ids=[fixture.test_id for fixture in BATCH_OPERATION_LIMIT_FIXTURES],
+)
+def test_call_readonly_tools_batch_rejects_oversized_operation_count(
+    test_id: str,
+    operation_count: int,
+) -> None:
+    """The batch wrapper rejects requests whose rows alone can exceed the cap."""
+    from fastmcp import Client
+
+    from libtmux_mcp.middleware import DEFAULT_RESPONSE_LIMIT_BYTES
+
+    assert test_id
+
+    async def _call() -> t.Any:
+        async with Client(_batch_probe_server()) as client:
+            return await client.call_tool(
+                "call_readonly_tools_batch",
+                {
+                    "operations": [
+                        {
+                            "tool": "missing_probe",
+                            "arguments": {},
+                        }
+                        for _ in range(operation_count)
+                    ],
+                    "on_error": "continue",
+                },
+                raise_on_error=False,
+            )
+
+    result = asyncio.run(_call())
+    serialized = json.dumps(
+        _call_tool_result_wire(result),
+        separators=(",", ":"),
+        sort_keys=True,
+    )
+
+    assert len(serialized.encode("utf-8")) <= DEFAULT_RESPONSE_LIMIT_BYTES
+    assert result.is_error is True
+    assert result.structured_content is None
+    assert "operations must contain at most" in serialized
+
+
 def test_call_readonly_tools_batch_rejects_mutating_inner_tool() -> None:
     """Readonly batching does not tunnel a mutating tool call."""
     from fastmcp import Client