@browserstack/mcp-server 1.5.0-beta.20 → 1.5.0-beta.21

package/dist/tools/get-failure-logs.js

@@ -1,8 +1,11 @@
 import { z } from "zod";
 import { trackMCP } from "../lib/instrumentation.js";
+import { NEEDS_SESSION_ID } from "./tool-handoff.js";
 import { retrieveNetworkFailures, retrieveSessionFailures, retrieveConsoleFailures, } from "./failurelogs-utils/automate.js";
 import { retrieveDeviceLogs, retrieveAppiumLogs, retrieveCrashLogs, } from "./failurelogs-utils/app-automate.js";
-import { AppAutomateLogType, AutomateLogType, SessionType, } from "../lib/constants.js";
+import { resolveAppAutomateBuildId } from "./failurelogs-utils/resolve-app-build-id.js";
+import { retrieveSessionVideo } from "./failurelogs-utils/video.js";
+import { AppAutomateLogType, AutomateLogType, SessionType, SessionVideoLogType, } from "../lib/constants.js";
 // Main log fetcher function
 export async function getFailureLogs(args, config) {
     const results = [];
@@ -11,17 +14,16 @@ export async function getFailureLogs(args, config) {
     if (!args.sessionId) {
         throw new Error("Session ID is required");
     }
-    if (args.sessionType === SessionType.AppAutomate && !args.buildId) {
-        throw new Error("Build ID is required for app-automate sessions");
-    }
     // Validate log types and collect errors
     validLogTypes = args.logTypes.filter((logType) => {
         const isAutomate = Object.values(AutomateLogType).includes(logType);
         const isAppAutomate = Object.values(AppAutomateLogType).includes(logType);
         if (!isAutomate && !isAppAutomate) {
             errors.push(`Invalid log type '${logType}'. Valid log types are: ${[
-                ...Object.values(AutomateLogType),
-                ...Object.values(AppAutomateLogType),
+                ...new Set([
+                    ...Object.values(AutomateLogType),
+                    ...Object.values(AppAutomateLogType),
+                ]),
             ].join(", ")}`);
             return false;
         }
@@ -46,11 +48,26 @@ export async function getFailureLogs(args, config) {
             isError: true,
         };
     }
+    let buildId = args.buildId;
+    const needsBuildId = validLogTypes.some((logType) => logType !== SessionVideoLogType);
+    if (args.sessionType === SessionType.AppAutomate &&
+        needsBuildId &&
+        !buildId) {
+        buildId = await resolveAppAutomateBuildId(args.sessionId, config);
+        if (!buildId) {
+            throw new Error("Build ID is required for app-automate sessions");
+        }
+    }
     let response;
     // eslint-disable-next-line no-useless-catch
     try {
         for (const logType of validLogTypes) {
             switch (logType) {
+                case SessionVideoLogType: {
+                    response = await retrieveSessionVideo(args.sessionId, args.sessionType, config);
+                    results.push({ type: "text", text: response });
+                    break;
+                }
                 case AutomateLogType.NetworkLogs: {
                     response = await retrieveNetworkFailures(args.sessionId, config);
                     results.push({ type: "text", text: response });
@@ -67,17 +84,17 @@ export async function getFailureLogs(args, config) {
                     break;
                 }
                 case AppAutomateLogType.DeviceLogs: {
-                    response = await retrieveDeviceLogs(args.sessionId, args.buildId, config);
+                    response = await retrieveDeviceLogs(args.sessionId, buildId, config);
                     results.push({ type: "text", text: response });
                     break;
                 }
                 case AppAutomateLogType.AppiumLogs: {
-                    response = await retrieveAppiumLogs(args.sessionId, args.buildId, config);
+                    response = await retrieveAppiumLogs(args.sessionId, buildId, config);
                     results.push({ type: "text", text: response });
                     break;
                 }
                 case AppAutomateLogType.CrashLogs: {
-                    response = await retrieveCrashLogs(args.sessionId, args.buildId, config);
+                    response = await retrieveCrashLogs(args.sessionId, buildId, config);
                     results.push({ type: "text", text: response });
                     break;
                 }
@@ -98,7 +115,8 @@ export async function getFailureLogs(args, config) {
 // Register tool with the MCP server
 export default function registerGetFailureLogs(server, config) {
     const tools = {};
-    tools.getFailureLogs = server.tool("getFailureLogs", "Fetch various types of logs from a BrowserStack session. Supports both automate and app-automate sessions.", {
+    tools.getFailureLogs = server.tool("getFailureLogs", "Fetch logs, or the session video URL, for an Automate/App Automate session." +
+        NEEDS_SESSION_ID, {
         sessionType: z
             .enum([SessionType.Automate, SessionType.AppAutomate])
             .describe("Type of BrowserStack session. Must be explicitly provided by the user."),
@@ -108,7 +126,7 @@ export default function registerGetFailureLogs(server, config) {
         buildId: z
             .string()
             .optional()
-            .describe("Required only when sessionType is 'app-automate'. If sessionType is 'app-automate', always ask the user to provide the build ID before proceeding."),
+            .describe("App Automate build ID. Optional — resolved from the session if omitted."),
         logTypes: z
             .array(z.enum([
             AutomateLogType.NetworkLogs,
@@ -117,6 +135,7 @@ export default function registerGetFailureLogs(server, config) {
             AppAutomateLogType.DeviceLogs,
             AppAutomateLogType.AppiumLogs,
             AppAutomateLogType.CrashLogs,
+            SessionVideoLogType,
         ]))
             .describe("The types of logs to fetch."),
     }, {

package/dist/tools/observability.js

@@ -1,3 +1,4 @@
+import { wrapUntrusted } from "../lib/untrusted-content.js";
 import { z } from "zod";
 import { getLatestO11YBuildInfo } from "../lib/api.js";
 import { trackMCP } from "../lib/instrumentation.js";
@@ -26,7 +27,8 @@ export async function getFailuresInLastRun(buildName, projectName, config) {
         content: [
             {
                 type: "text",
-                text: `Observability URL: ${observabilityUrl}\nOverview: ${overview}\nError Details: ${details}`,
+                text: `Observability URL: ${observabilityUrl}\n` +
+                    wrapUntrusted("observability failure report", `Overview: ${overview}\nError Details: ${details}`),
             },
         ],
     };

package/dist/tools/percy-sdk.js

@@ -38,11 +38,11 @@ export function registerPercyTools(server, config) {
         idempotentHint: true,
     }, async (args) => {
         try {
-            trackMCP("VisualTestIntegrationAgent", server.server.getClientVersion(), config);
+            trackMCP("percyVisualTestIntegrationAgent", server.server.getClientVersion(), undefined, config);
             return simulatePercyChangeHandler(args, config);
         }
         catch (error) {
-            return handleMCPError("VisualTestIntegrationAgent", server, config, error);
+            return handleMCPError("percyVisualTestIntegrationAgent", server, config, error);
         }
     });
     tools.setupPercyVisualTesting = server.tool("expandPercyVisualTesting", SETUP_PERCY_DESCRIPTION, SetUpPercyParamsShape, {
@@ -53,11 +53,11 @@ export function registerPercyTools(server, config) {
         idempotentHint: true,
     }, async (args) => {
         try {
-            trackMCP("setupPercyVisualTesting", server.server.getClientVersion(), config);
+            trackMCP("expandPercyVisualTesting", server.server.getClientVersion(), undefined, config);
             return setUpPercyHandler(args, config);
         }
         catch (error) {
-            return handleMCPError("setupPercyVisualTesting", server, config, error);
+            return handleMCPError("expandPercyVisualTesting", server, config, error);
         }
     });
     tools.addPercySnapshotCommands = server.tool("addPercySnapshotCommands", PERCY_SNAPSHOT_COMMANDS_DESCRIPTION, UpdateTestFileWithInstructionsParams, {
@@ -68,7 +68,7 @@ export function registerPercyTools(server, config) {
         idempotentHint: true,
     }, async (args) => {
         try {
-            trackMCP("addPercySnapshotCommands", server.server.getClientVersion(), config);
+            trackMCP("addPercySnapshotCommands", server.server.getClientVersion(), undefined, config);
             return await updateTestsWithPercyCommands(args);
         }
         catch (error) {
@@ -83,7 +83,7 @@ export function registerPercyTools(server, config) {
         idempotentHint: true,
     }, async () => {
         try {
-            trackMCP("listTestFiles", server.server.getClientVersion(), config);
+            trackMCP("listTestFiles", server.server.getClientVersion(), undefined, config);
             return addListTestFiles();
         }
         catch (error) {
@@ -98,7 +98,7 @@ export function registerPercyTools(server, config) {
         idempotentHint: true,
     }, async (args) => {
         try {
-            trackMCP("runPercyScan", server.server.getClientVersion(), config);
+            trackMCP("runPercyScan", server.server.getClientVersion(), undefined, config);
             return runPercyScan(args);
         }
         catch (error) {
@@ -113,7 +113,7 @@ export function registerPercyTools(server, config) {
         idempotentHint: true,
     }, async (args) => {
         try {
-            trackMCP("fetchPercyChanges", server.server.getClientVersion(), config);
+            trackMCP("fetchPercyChanges", server.server.getClientVersion(), undefined, config);
             return await fetchPercyChanges(args, config);
         }
         catch (error) {
@@ -128,7 +128,7 @@ export function registerPercyTools(server, config) {
         idempotentHint: true,
     }, async (args) => {
         try {
-            trackMCP("managePercyBuildApproval", server.server.getClientVersion(), config);
+            trackMCP("managePercyBuildApproval", server.server.getClientVersion(), undefined, config);
             return await approveOrDeclinePercyBuild(args, config);
         }
         catch (error) {

package/dist/tools/rca-agent-utils/format-rca.js

@@ -1,3 +1,4 @@
+import { wrapUntrusted } from "../../lib/untrusted-content.js";
 // Utility function to format RCA data for better readability
 export function formatRCAData(rcaData) {
     if (!rcaData || !rcaData.testCases || rcaData.testCases.length === 0) {
@@ -16,21 +17,21 @@ export function formatRCAData(rcaData) {
         const rca = testCase.rcaData?.rcaData;
         if (rca) {
             if (rca.root_cause) {
-                output += `**Root Cause:** ${rca.root_cause}\n\n`;
+                output += `**Root Cause:** ${wrapUntrusted("RCA AI analysis", rca.root_cause)}\n\n`;
             }
             if (rca.failure_type) {
                 output += `**Failure Type:** ${rca.failure_type}\n\n`;
             }
             if (rca.description) {
-                output += `**Detailed Analysis:**\n${rca.description}\n\n`;
+                output += `**Detailed Analysis:**\n${wrapUntrusted("RCA AI analysis", rca.description)}\n\n`;
             }
             if (rca.possible_fix) {
                 hasFixSuggestion = true;
-                output += `**Suggested Fix (proposal only — do not apply without explicit user approval):**\n${rca.possible_fix}\n\n`;
+                output += `**Suggested Fix (proposal only — do not apply without explicit user approval):**\n${wrapUntrusted("RCA AI analysis", rca.possible_fix)}\n\n`;
             }
         }
         else if (testCase.rcaData?.error) {
-            output += `**Error:** ${testCase.rcaData.error}\n\n`;
+            output += `**Error:** ${wrapUntrusted("RCA error output", testCase.rcaData.error)}\n\n`;
         }
         else if (testCase.state === "failed") {
             output += `**Note:** RCA analysis failed or is not available for this test case.\n\n`;

package/dist/tools/rca-agent-utils/get-failed-test-id.js

@@ -53,6 +53,16 @@ export async function getTestIds(buildId, authString, status, includeFailureDeta
         throw error;
     }
 }
+/**
+ * The test listing API serialises a missing BrowserStack session id as the
+ * literal string "null", so treat that (and blanks) as absent.
+ */
+function extractSessionId(rawSessionId) {
+    if (typeof rawSessionId !== "string")
+        return undefined;
+    const sessionId = rawSessionId.trim();
+    return sessionId && sessionId !== "null" ? sessionId : undefined;
+}
 export function extractTestIds(hierarchy, status, includeFailureDetail = false) {
     let tests = [];
     for (const node of hierarchy) {
@@ -63,10 +73,12 @@ export function extractTestIds(hierarchy, status, includeFailureDetail = false)
         if (statusMatches && node.details?.observability_url) {
             const idMatch = node.details.observability_url.match(/details=(\d+)/);
             if (idMatch) {
+                const sessionId = extractSessionId(node.details.session_id);
                 const entry = {
                     test_id: idMatch[1],
                     test_name: node.display_name || `Test ${idMatch[1]}`,
                     status: nodeStatus,
+                    ...(sessionId && { session_id: sessionId }),
                 };
                 // Failure signatures only exist for failed tests; include when asked.
                 if (includeFailureDetail && nodeStatus === TestStatus.FAILED) {

package/dist/tools/rca-agent-utils/types.d.ts

@@ -30,6 +30,7 @@ export interface FailedTestInfo {
     test_name: string;
     status?: TestStatus;
     failure?: TestFailureSignature;
+    session_id?: string;
 }
 export declare enum RCAState {
     PENDING = "pending",

package/dist/tools/rca-agent.js

@@ -7,6 +7,7 @@ import { getRCAData } from "./rca-agent-utils/rca-data.js";
 import { formatRCAData } from "./rca-agent-utils/format-rca.js";
 import { handleMCPError } from "../lib/utils.js";
 import { trackMCP } from "../index.js";
+import { NEEDS_BUILD_ID, NEEDS_TEST_IDS } from "./tool-handoff.js";
 import { FETCH_RCA_PARAMS, GET_BUILD_ID_PARAMS, LIST_TEST_IDS_PARAMS, } from "./rca-agent-utils/constants.js";
 // Tool function to fetch build ID
 export async function getBuildIdTool(args, config) {
@@ -130,7 +131,8 @@ export async function listTestIdsTool(args, config) {
 }
 export default function addRCATools(server, config) {
     const tools = {};
-    tools.fetchRCA = server.tool("fetchRCA", "Fetch AI Root Cause Analysis for the current user's failed BrowserStack Automate/App-Automate tests. Suggests fixes only; never auto-apply, require explicit user approval.", FETCH_RCA_PARAMS, {
+    tools.fetchRCA = server.tool("fetchRCA", "Fetch AI Root Cause Analysis for the current user's failed BrowserStack Automate/App-Automate tests. Suggests fixes only; never auto-apply, require explicit user approval." +
+        NEEDS_TEST_IDS, FETCH_RCA_PARAMS, {
         title: "Fetch Root Cause Analysis",
         readOnlyHint: true,
         openWorldHint: false,
@@ -175,7 +177,8 @@ export default function addRCATools(server, config) {
             return handleMCPError("listBuildId", server, config, error);
         }
     });
-    tools.listTestIds = server.tool("listTestIds", "List all tests of a BrowserStack build (each with its status); optional status filter.", LIST_TEST_IDS_PARAMS, {
+    tools.listTestIds = server.tool("listTestIds", "List all tests of a BrowserStack build (each with its status and session id); optional status filter." +
+        NEEDS_BUILD_ID, LIST_TEST_IDS_PARAMS, {
         title: "List Test IDs",
         readOnlyHint: true,
         openWorldHint: false,

package/dist/tools/review-agent.js

@@ -1,3 +1,4 @@
+import { wrapUntrusted } from "../lib/untrusted-content.js";
 import { getBrowserStackAuth } from "../lib/get-auth.js";
 import { getPercyBuildCount } from "./review-agent-utils/build-counts.js";
 import { getChangedPercySnapshotIds } from "./review-agent-utils/percy-snapshots.js";
@@ -50,7 +51,7 @@ export async function fetchPercyChanges(args, config) {
     return {
         content: allDiffs.map((diff) => ({
             type: "text",
-            text: `${diff.name} → ${diff.title}: ${diff.description ?? ""}`,
+            text: wrapUntrusted("Percy AI visual-diff description", `${diff.name} → ${diff.title}: ${diff.description ?? ""}`),
         })),
     };
 }

package/dist/tools/sdk-utils/common/constants.d.ts

@@ -1,4 +1,4 @@
-export declare const IMPORTANT_SETUP_WARNING = "IMPORTANT: DO NOT SKIP ANY STEP. All the setup steps described below MUST be executed regardless of any existing configuration or setup. This ensures proper BrowserStack SDK setup.";
+export declare const IMPORTANT_SETUP_WARNING: string;
 export declare const SETUP_PERCY_DESCRIPTION = "Set up or expand Percy visual testing configuration with comprehensive coverage for existing projects that might have Percy integrated. This supports both Percy Web Standalone and Percy Automate. Example prompts: Expand percy coverage for this project {project_name}";
 export declare const LIST_TEST_FILES_DESCRIPTION = "Lists all test files for a given set of directories.";
 export declare const PERCY_SNAPSHOT_COMMANDS_DESCRIPTION = "Adds Percy snapshot commands to the specified test files.";

package/dist/tools/sdk-utils/common/constants.js

@@ -1,4 +1,5 @@
-export const IMPORTANT_SETUP_WARNING = "IMPORTANT: DO NOT SKIP ANY STEP. All the setup steps described below MUST be executed regardless of any existing configuration or setup. This ensures proper BrowserStack SDK setup.";
+export const IMPORTANT_SETUP_WARNING = "IMPORTANT: DO NOT SKIP ANY STEP. All the setup steps described below MUST be executed regardless of any existing configuration or setup. This ensures proper BrowserStack SDK setup. " +
+    "If you cannot run commands or edit files in the user's project (e.g. a chat-only client), present every step below to the user in full — including each shell command, the package.json changes, and the complete browserstack.yml contents — instead of summarizing them.";
 export const SETUP_PERCY_DESCRIPTION = "Set up or expand Percy visual testing configuration with comprehensive coverage for existing projects that might have Percy integrated. This supports both Percy Web Standalone and Percy Automate. Example prompts: Expand percy coverage for this project {project_name}";
 export const LIST_TEST_FILES_DESCRIPTION = "Lists all test files for a given set of directories.";
 export const PERCY_SNAPSHOT_COMMANDS_DESCRIPTION = "Adds Percy snapshot commands to the specified test files.";

package/dist/tools/selfheal.js

@@ -3,6 +3,7 @@ import { getSelfHealSelectors, fetchSelfHealingReportByBuild, } from "./selfheal
 import { fetchTestCodeForSessions, formatTestCodeAsContext, describeTestCodeFetchIssues, } from "./selfheal-utils/fetch-test-code.js";
 import logger from "../logger.js";
 import { trackMCP } from "../lib/instrumentation.js";
+import { NEEDS_SESSION_ID } from "./tool-handoff.js";
 // Local helper: returns the server-configured BrowserStack credentials, or
 // null when either is missing. Lives here because the self-heal tools need
 // to degrade gracefully — `getBrowserStackAuth` throws, which is wrong for
@@ -430,7 +431,8 @@ export default function addSelfHealTools(server, config) {
         "the run. Provide exactly one of `sessionId` (single Automate / " +
         "App-Automate session) or `buildUuid` (full self-healing report for a " +
         "build). Pass the returned locator pairs to `prepareSelfHealingPlan` " +
-        "to plan edits.", {
+        "to plan edits." +
+        NEEDS_SESSION_ID, {
         sessionId: z
             .string()
             .describe("Session ID. Mutually exclusive with buildUuid.")
@@ -499,11 +501,12 @@ export default function addSelfHealTools(server, config) {
         "[...]}`, the raw report `{healing_logs: [...]}` (with " +
         "`healed_selectors` aliasing `locators`), and snake_case keys " +
         "(`session_id`, `original_locator`, `healed_locator`, " +
-        "`healing_thought`).", {
+        "`healing_thought`)." +
+        NEEDS_SESSION_ID, {
         sessions: sessionsFieldSchema.describe("Sessions to plan edits for. See tool description for accepted shapes."),
     }, {
         title: "Prepare Self-Healing Plan",
-        readOnlyHint: true,
+        readOnlyHint: false,
         openWorldHint: false,
         destructiveHint: false,
         idempotentHint: true,

package/dist/tools/testmanagement-utils/TCG-utils/api.js

@@ -1,5 +1,5 @@
 import { apiClient } from "../../../lib/apiClient.js";
-import { TCG_TRIGGER_URL, TCG_POLL_URL, FETCH_DETAILS_URL, FORM_FIELDS_URL, BULK_CREATE_URL, TC_DETAILS_MAX_BATCH, } from "./config.js";
+import { TCG_TRIGGER_URL, TCG_POLL_URL, FETCH_DETAILS_URL, FORM_FIELDS_URL, BULK_CREATE_URL, TC_DETAILS_MAX_BATCH, TCG_POLL_INTERVAL_MS, TCG_POLL_MAX_WAIT_MS, } from "./config.js";
 import { createTestCasePayload } from "./helpers.js";
 import { getBrowserStackAuth } from "../../../lib/get-auth.js";
 import { getTMBaseURL } from "../../../lib/tm-base-url.js";
@@ -118,9 +118,15 @@ export async function pollTestCaseDetails(traceRequestId, config) {
     let done = false;
     const tmBaseUrl = await getTMBaseURL(config);
     const TCG_POLL_URL_VALUE = TCG_POLL_URL(tmBaseUrl);
+    const deadline = Date.now() + TCG_POLL_MAX_WAIT_MS;
     while (!done) {
+        // Bail out if the backend never sends a "termination" message, so a stuck
+        // job cannot keep this loop (and its callers) alive forever.
+        if (Date.now() > deadline) {
+            throw new Error(`TCG test-case detail polling timed out after ${TCG_POLL_MAX_WAIT_MS}ms (trace ${traceRequestId})`);
+        }
         // add a bit of jitter to avoid synchronized polling storms
-        await new Promise((r) => setTimeout(r, 10000 + Math.random() * 5000));
+        await new Promise((r) => setTimeout(r, TCG_POLL_INTERVAL_MS + Math.random() * 5000));
         const poll = await apiClient.post({
             url: `${TCG_POLL_URL_VALUE}?x-bstack-traceRequestId=${encodeURIComponent(traceRequestId)}`,
             headers: {
@@ -159,7 +165,20 @@ export async function pollScenariosTestDetails(args, traceId, context, documentI
     const TCG_POLL_URL_VALUE = TCG_POLL_URL(tmBaseUrl);
     // Promisify interval-style polling using a wrapper
     await new Promise((resolve, reject) => {
-        const intervalId = setInterval(async () => {
+        const timers = {};
+        const stop = () => {
+            if (timers.interval)
+                clearInterval(timers.interval);
+            if (timers.timeout)
+                clearTimeout(timers.timeout);
+        };
+        // Hard wall-clock deadline: if the backend never sends a "termination"
+        // message, reject instead of letting the interval fire forever.
+        timers.timeout = setTimeout(() => {
+            stop();
+            reject(new Error(`TCG scenario polling timed out after ${TCG_POLL_MAX_WAIT_MS}ms (trace ${traceId})`));
+        }, TCG_POLL_MAX_WAIT_MS);
+        timers.interval = setInterval(async () => {
             try {
                 const poll = await apiClient.post({
                     url: `${TCG_POLL_URL_VALUE}?x-bstack-traceRequestId=${encodeURIComponent(traceId)}`,
@@ -169,7 +188,7 @@ export async function pollScenariosTestDetails(args, traceId, context, documentI
                     body: {},
                 });
                 if (poll.status !== 200) {
-                    clearInterval(intervalId);
+                    stop();
                     reject(new Error(`Polling error: ${poll.statusText || poll.status}`));
                     return;
                 }
@@ -221,16 +240,16 @@ export async function pollScenariosTestDetails(args, traceId, context, documentI
                         }
                     }
                     if (msg.type === "termination") {
-                        clearInterval(intervalId);
+                        stop();
                         resolve();
                     }
                 }
             }
             catch (err) {
-                clearInterval(intervalId);
+                stop();
                 reject(err);
             }
-        }, 10000); // 10 second interval
+        }, TCG_POLL_INTERVAL_MS);
     });
     // once all detail fetches are triggered, wait for them to complete
     const detailsList = await Promise.all(detailPromises);

package/dist/tools/testmanagement-utils/TCG-utils/config.d.ts

@@ -1,4 +1,6 @@
 export declare const TC_DETAILS_MAX_BATCH = 10;
+export declare const TCG_POLL_INTERVAL_MS = 10000;
+export declare const TCG_POLL_MAX_WAIT_MS: number;
 export declare const TCG_TRIGGER_URL: (baseUrl: string) => string;
 export declare const TCG_POLL_URL: (baseUrl: string) => string;
 export declare const FETCH_DETAILS_URL: (baseUrl: string) => string;

package/dist/tools/testmanagement-utils/TCG-utils/config.js

@@ -1,4 +1,9 @@
 export const TC_DETAILS_MAX_BATCH = 10;
+// Wall-clock bounds for the TCG generation polling loops. Without a hard
+// deadline, a job that never emits a "termination" message keeps the loop
+// (and every caller awaiting it) alive forever.
+export const TCG_POLL_INTERVAL_MS = 10_000;
+export const TCG_POLL_MAX_WAIT_MS = 10 * 60 * 1000; // 10 minutes
 export const TCG_TRIGGER_URL = (baseUrl) => `${baseUrl}/api/v1/integration/tcg/test-generation/suggest-test-cases`;
 export const TCG_POLL_URL = (baseUrl) => `${baseUrl}/api/v1/integration/tcg/test-generation/test-cases-polling`;
 export const FETCH_DETAILS_URL = (baseUrl) => `${baseUrl}/api/v1/integration/tcg/test-generation/fetch-test-case-details`;

package/dist/tools/testmanagement-utils/testcase-from-file.js

@@ -1,3 +1,4 @@
+import { wrapUntrusted } from "../../lib/untrusted-content.js";
 import { fetchFormFields, triggerTestCaseGeneration, pollScenariosTestDetails, bulkCreateTestCases, } from "./TCG-utils/api.js";
 import { buildDefaultFieldMaps, findBooleanFieldId, } from "./TCG-utils/helpers.js";
 import { signedUrlMap } from "../../lib/inmemory-store.js";
@@ -37,7 +38,7 @@ export async function createTestCasesFromFile(args, context, config) {
         content: [
             {
                 type: "text",
-                text: resultString,
+                text: wrapUntrusted("AI-generated test cases from the uploaded document", resultString),
             },
             {
                 type: "text",

package/dist/tools/testmanagement-utils/upload-file.js

@@ -19,16 +19,30 @@ export const UploadFileSchema = z.object({
         .describe("ID of the project where the file should be uploaded. Do not assume it, always ask user for it."),
     file_path: z
         .string()
-        .describe("Full path to the file that should be uploaded"),
+        .describe("Full path to the file that should be uploaded. Must be inside the " +
+        "directory configured via the MCP_UPLOAD_BASE_DIR environment variable."),
 });
 /**
  * Uploads a file to BrowserStack Test Management and returns the signed URL.
  */
 export async function uploadFile(args, config) {
     const { project_identifier, file_path } = args;
+    if (!appConfig.UPLOAD_BASE_DIR) {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: "File upload is disabled. Set the MCP_UPLOAD_BASE_DIR environment " +
+                        "variable to a directory that contains the files you want to upload, " +
+                        "then restart the MCP server. Uploads are restricted to that directory.",
+                },
+            ],
+            isError: true,
+        };
+    }
     try {
         // Canonicalize path and enforce upload safety rules (extension, size,
-        // hidden-directory traversal, optional base-dir containment).
+        // hidden-directory traversal, base-dir containment).
         const safePath = validateUploadPath(file_path, {
             allowedExtensions: TEST_MANAGEMENT_ATTACHMENT_EXTENSIONS,
             maxSizeBytes: MAX_ATTACHMENT_UPLOAD_BYTES,