security: restrict upload_attachment file access to upload root

[paradoxbound]

Summary

• upload_attachment previously accepted any filesystem path with no restriction, allowing arbitrary file reads when write mode was enabled
• Now validates paths against a configurable upload root directory (BOOKSTACK_UPLOAD_ROOT env var, defaults to cwd)
• Blocks path traversal via .. segments using path.resolve()

Security

• Finding: CSO audit identified that a prompt injection attack in BookStack page content could instruct the LLM to exfiltrate local files (SSH keys, AWS creds, .env) via upload_attachment
• Severity: HIGH (9/10 confidence, independently verified)
• Fix: Path traversal protection with configurable BOOKSTACK_UPLOAD_ROOT
• Tests: 2 new tests verify protection (path outside root + traversal attack)

Changes

• packages/core/src/types.ts — add uploadRoot to BookStackConfig
• packages/core/src/bookstack-client.ts — validate file path against upload root before reading
• packages/stdio/src/index.ts — read BOOKSTACK_UPLOAD_ROOT env var, log it at startup
• packages/core/tests/api-methods.test.ts — 2 new tests for path restriction + traversal

Test plan

• npm run build — compiles without errors
• npm test — 111 tests pass (2 new security tests)
• npm audit — 0 vulnerabilities

🤖 Generated with Claude Code

[paradoxbound]

Closing — recreating on a dedicated branch.