CedarCopilot wants to merge 1 commit into main from staging
Not deployed
Libra has no production signal for this change yet because it has not deployed. Libra checks hourly for 3 days after each deploy.
This change adds organization two-factor authentication, MCP and credential connections, expanded calendar and meeting features, and task lifecycle updates. Two reproduced failures need correction before merge: MCP OAuth discovery can send requests to an internal loopback destination through an IPv4-mapped IPv6 URL, and a shared draft ID can mark a task from another conversation as completed. The new relative imports also violate the repository import convention.
Not safe to merge until the internal-request bypass and cross-conversation task completion report are fixed.
Focused runtime checks reproduced both reported behaviors through their production paths: discovery contacted a controlled internal service, and the send handler emitted completion for a task in a different conversation.
Files Needing Attention: apps/server/src/services/integrations/mcp/server-url.ts needs complete public-address enforcement; apps/server/src/services/user-tasks/tasks.ts and its send-handler caller need conversation or thread scoping; apps/mail/app/(auth)/two-factor/page.tsx needs the required import form.
MCP server URL validation accepts IPv4-mapped IPv6 loopback addresses. The OAuth discovery flow then sends MCP and OAuth metadata requests to the accepted internal destination, allowing an authenticated user configuring an MCP connection to access services reachable from the server.
What T-Rex did
General comment
MCP SSRF guard accepts IPv4-mapped IPv6 loopback destinations
validateMcpServerUrl accepts http://[::ffff:127.0.0.1]:<port>/mcp. Via user-supplied MCP OAuth setup, initiateOAuth validates this URL and constructs a discovered driver; discoverMcpOAuth validates it again, then calls probeResourceMetadataUrl, whose withTimeout invokes fetch(serverUrl). Runtime execution reached a controlLibra has not measured any production surfaces for this change yet.