fix(security): wrap the structured JSON block of TM plan tools (complete injection wrap)

[SavioBS629]

What & why

Follow-up to the TM prompt-injection hardening (GHSA-9w6g-vr6g-7jqx).

The earlier change wrapped the description in the human-readable header of
getTestPlan / getSubTestPlan. But each of those tools returns a second
content block — a raw JSON.stringify(...) dump of the full plan object —
where the description (and other free-text like name) was still emitted
unwrapped. Since the model reads every content block, an injection payload
placed in a shared plan description still reached it verbatim, so the vector
was not fully closed.

Verified by running the real tools with a payload description: the header was
wrapped, but the JSON block returned the raw payload.

Change

• Wrap the JSON dump with wrapUntrusted(...) in both get-testplan.ts and
  get-sub-testplan.ts, so untrusted backend content is framed as data in
  every content block.
• Add tests/tools/tm-desc-wrap.test.ts — exercises the real functions
  (existing suite mocks them) and asserts the payload never appears outside an
  UNTRUSTED wrapper in any block.

Test

• tsc, eslint: clean
• tests/tools/tm-desc-wrap.test.ts: 2 passing
• tests/tools/testmanagement.test.ts: 75 passing (unchanged)

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited), Workspace UI (inherited)

Review profile: ASSERTIVE

Plan: Enterprise

Run ID: 3eb8a6e8-1b95-4e6d-b39b-dc50b7f831da

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}