fix: raise and configure per-user gateway session capacity

test/dingtalk.test.ts

@@ -70,6 +70,24 @@ test("loadConfig rejects the removed local DWS architecture", () => {
   }), /禁止配置本地 DWS/);
 });
 
+test("gateway session capacity defaults to 32 and validates operator overrides", () => {
+  const env = {
+    APP_MODE: "gateway", DINGTALK_CLIENT_ID: "mock-key", DINGTALK_CLIENT_SECRET: "mock-secret",
+    DINGTALK_CORP_ID: "mock-corp", MCP_PUBLIC_BASE_URL: "https://approval.example.test",
+    MCP_REMOTE_AUTH_ENABLED: "true", MCP_SESSION_SECRET: "mock-session-secret-with-at-least-32-bytes",
+    MCP_APPROVAL_REF_SECRET: "mock-reference-secret-with-at-least-32-bytes",
+    XFT_OPEN_API_ENABLED: "true", XFT_OPEN_API_APP_ID: "mock-app",
+    XFT_OPEN_API_AUTHORITY_SECRET: "1".repeat(64), XFT_OPEN_API_ENTERPRISE_ID: "mock-enterprise",
+  };
+  assert.equal(loadConfig(env).mcpSessionMaxPerUser, 32);
+  for (const value of ["1", "64", "1000"]) {
+    assert.equal(loadConfig({ ...env, MCP_SESSION_MAX_PER_USER: value }).mcpSessionMaxPerUser, Number(value));
+  }
+  for (const value of ["0", "-1", "1.5", "invalid", "1001"]) {
+    assert.throws(() => loadConfig({ ...env, MCP_SESSION_MAX_PER_USER: value }), /MCP_SESSION_MAX_PER_USER/);
+  }
+});
+
 test("loadConfig reads AuthoritySecret from the second line of an XFT portal credential file", () => {
   const directory = mkdtempSync(join(tmpdir(), "ding-mcp-xft-openapi-config-"));
   const secretPath = join(directory, "xft.key");