mcp(fix[option_tools]): Reject target without scope instead of ignoring

why: When `target` was provided without `scope`, `_resolve_option_target`
silently ignored the target and returned the server object. This caused
`show_option(option="x", target="my_session")` to query the server
instead of the intended session — a fail-open behavior.
what:
- Raise ToolError when target is provided but scope is None
- Add test for target-without-scope error path

Author: tony

src/libtmux/mcp/tools/option_tools.py

@@ -43,6 +43,12 @@ def _resolve_option_target(
         msg = f"Invalid scope: {scope!r}. Valid: {valid}"
         raise ToolError(msg)
 
+    if target is not None and opt_scope is None:
+        from fastmcp.exceptions import ToolError
+
+        msg = "scope is required when target is specified"
+        raise ToolError(msg)
+
     if target is not None and opt_scope is not None:
         if opt_scope == OptionScope.Session:
             return _resolve_session(server, session_name=target), opt_scope

tests/mcp/test_option_tools.py

@@ -38,6 +38,18 @@ def test_show_option_invalid_scope(mcp_server: Server, mcp_session: Session) ->
         )
 
 
+def test_show_option_target_without_scope(
+    mcp_server: Server, mcp_session: Session
+) -> None:
+    """show_option raises ToolError when target is given without scope."""
+    with pytest.raises(ToolError, match="scope is required"):
+        show_option(
+            option="base-index",
+            target="some_session",
+            socket_name=mcp_server.socket_name,
+        )
+
+
 def test_set_option(mcp_server: Server, mcp_session: Session) -> None:
     """set_option sets a tmux option."""
     result = set_option(