Feat/output length guard rust migration

[prakhar-singh1928]

Closes #145 — Migrate output_length_guard to Rust

Ports the output_length_guard plugin from the pure-Python implementation in
mcp-context-forge to a Rust core with thin PyO3 bindings, following the
established pii_filter pattern. Published as cpex-output-length-guard.

Tracked on the gateway side: IBM/mcp-context-forge#5752

---

What was done

Core migration (a24a944)

• New Rust crate at plugins/rust/python-package/output_length_guard/
• All Python behaviour ported 1:1 — no silent feature changes
• Rust modules: config.rs, guards.rs, structured.rs, plugin.rs
• Thin Python shim at cpex_output_length_guard/output_length_guard.py delegates entirely to the Rust core via PyO3
• plugin-manifest.yaml — hook: tool_post_invoke
• Crate added to workspace Cargo.toml
• tests/test_plugin_catalog.py updated — plugin count 7→8, all expected plugin lists updated in 5 places
• 21 plugin-framework integration tests added in plugins/tests/output_length_guard/test_integration.py
• uv.lock committed for reproducible dev installs

Bug fixes applied during validation

11b4dae — enforce max_structure_size on MCP content lists

• process_mcp_items_result was not checking max_structure_size against the content list length; the check only existed inside process_structured_data (used for structuredContent). Added the guard at the top of process_mcp_items_result, matching the existing behaviour in structured.rs.
• MIN_MAX_STRUCTURE_SIZE lowered from 10 → 1 so that small values (e.g. 2) can be set in config for testing. The unit test updated accordingly (reject 0, not 5).

6dff244 — emit observability metrics for MCP CallToolResult dicts

• handle_mcp_content_dict was modifying the payload but never calling push_metrics_kwargs, so result.metadata["output_length_guard"] was silently absent on every traced tool call whose result was a {"content": [...]} dict — the most common MCP result shape in production.
• process_mcp_items_result return type extended from (Vec, bool) to (Vec, bool, usize, usize) to surface total_chars_seen and items_modified_count without a second pass.
• The old handle_mcp_list tally was iterating out_items (already-truncated dicts) and calling .extract::<String>(), which always failed silently, leaving chars_seen = 0. Both callers now use the accurate counts from the single processing pass.

---

Feature parity

All config options and input shapes from the Python original are implemented.

Config options: min_chars, max_chars, min_tokens, max_tokens, chars_per_token, limit_mode, strategy, ellipsis, word_boundary, max_text_length, max_structure_size, max_recursion_depth

Supported input shapes: plain str, dict with text field, list[str], MCP content array, MCP CallToolResult dict with content list, structuredContent / structured_content recursive processing, type: "resource" item text field guarding

Violation codes: OUTPUT_LENGTH_VIOLATION, OUTPUT_TOKEN_VIOLATION, STRUCTURE_SIZE_VIOLATION, STRUCTURE_DEPTH_VIOLATION

Observability: result.metadata["output_length_guard"] emitted only when extensions.request.trace_id is present — counts and labels only, never raw content.

---

Validation

Check	Result
cargo clippy -p output_length_guard -- -D warnings	✅ PASS
cargo fmt -- --check	✅ PASS
cargo test -p output_length_guard	✅ 63/63 PASS
make test-integration	✅ 21/21 PASS
uv run python3 -m unittest tests.test_plugin_catalog tests.test_install_built_wheel	✅ 126/126 PASS (3 skipped, pre-existing)
uv run python3 tools/plugin_catalog.py validate .	✅ {"status": "ok"}

---

Files changed

Path	Description
plugins/rust/python-package/output_length_guard/	New plugin crate (Rust + Python shim)
plugins/tests/output_length_guard/test_integration.py	21 plugin-framework integration tests
Cargo.toml	Added new crate to workspace members
Cargo.lock	Updated automatically
tests/test_plugin_catalog.py	Plugin count 7→8, all plugin lists updated

---

Next steps (gateway side — IBM/mcp-context-forge#5752)

• Install cpex-output-length-guard>=0.1.0 and update pyproject.toml plugins extra
• Update plugins/config.yaml kind to cpex_output_length_guard.output_length_guard.OutputLengthGuardPlugin
• Add limit_mode, strategy to _SAFE_STRING_FIELD_NAMES and chars_seen, truncated_count to _SAFE_NUMERIC_FIELD_NAMES in mcpgateway/plugins/utils.py
• Remove plugins/output_length_guard/ (Python implementation)
• Tag output-length-guard-v0.1.0 on main to trigger PyPI publish