feat(security): require MCP_UPLOAD_BASE_DIR for the upload-PRD tool

[SavioBS629]

Summary

Makes the uploadProductRequirementFile tool opt-in: it works only when the operator has set the MCP_UPLOAD_BASE_DIR environment variable to an allowed directory, and uploads are confined to that directory. Without it, the tool refuses instead of accepting an arbitrary local file path.

This closes the residual gap in the upload path: validateUploadPath already blocks traversal / hidden-dir / bad-extension / oversized files, and supports a base-directory jail — but that jail was previously optional. This change makes it required for the document/attachment upload tool, so a caller (or a prompt-injected agent) can't have the tool read files from anywhere on disk.

Changes

• testmanagement-utils/upload-file.ts: refuse with clear guidance when MCP_UPLOAD_BASE_DIR is unset ("set it and restart; uploads are restricted to that directory"). When set, the existing validateUploadPath containment applies.
• file_path schema description now documents the base-dir requirement.
• Tests: refuses when unset; passes the gate when set.

Scope

Applies to the document/attachment upload tool (uploadProductRequirementFile). App-binary uploads (App Live / App Automate) keep their current behaviour (traversal/hidden-dir/extension/size guards remain in force via validateUploadPath).

Testing

tsc --noEmit clean; eslint clean; tests/tools/uploadFile.test.ts passes (2).

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 22b69454-4a8e-4140-b612-3ac0ee694163

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}