CedarCopilot/cedar-mail

Branch: staging

merging staging to main

merged#2650CedarCopilot

CedarCopilot wants to merge 1 commit into main from staging

Live on prod, no production signal yetTimeline and evidence

Opened
Sep 1, 2026, 11:05 PM
No findings
Sep 1, 2026, 11:15 PM
Live on prod
Sep 2, 2026, 12:22 AM
Observed 0 hours
Sep 2, 2026, 12:22 AM
Unobserved
Live on prod, no production signal yet
Sep 2, 2026, 12:22 AM
Pipelines steady after this deploy
Sep 2, 2026, 12:22 AM
Merged
Sep 2, 2026, 12:22 AM

Behaviors Libra is checking

The on-event drafting executor receives additive read-only live-mail access while retaining structured synced-mail search and without receiving Gmail sync, send, or subagent-spawning capabilities.Not checked

prod

On-event drafting executions can search the connected live Gmail mailbox for threads that are absent from Cedar's synced email store.Not checked

prod

On-event drafting executions can read a selected live Gmail thread, including threads that never synced into Cedar, using the thread ID returned by live-mail search.Not checked

prod

Failures attributed to this change

error @ GET /<redacted-token>/<id>.jsonIntroducedmedium confidence

unknown

prod, first seen Sep 2, 2026, 1:11 AM

error @ GET /<redacted-token>/<id>.jsonIntroducedmedium confidence

unknown

prod, first seen Sep 2, 2026, 6:22 AM

error @ GET /<redacted-token>/7527688.jsonIntroducedmedium confidence

unknown

prod, first seen Sep 3, 2026, 2:56 AM

Libra has verdicts on 0 of 3 tracked behaviors on prod; 3 are still being checked. Libra attributed 3 failures to this change at medium confidence and is still confirming them. Libra checks hourly for 3 days after each deploy.

Greptile Summary

This change lets autonomous drafting search live Gmail threads that were never synced into Cedar, adds recipient metadata to live-thread results, and updates related evaluation and operational guidance.

Two reproduced issues need correction before merge. The drafting executor invokes live-mail tools without its agent identity, so configured mailbox restrictions are bypassed. Live-thread reads also expose historical Bcc recipients as ordinary participants, allowing a hidden address to be added to a visible reply.

The reported customer-data exposure was dropped after an executed unauthenticated GitHub API and raw-file visibility check returned 404 for the repository and document. The document contains sensitive operational data, but the claimed public repository distribution was contradicted by that check.

Confidence Score: 1/5

Not safe to merge until live-mail scope enforcement and Bcc recipient handling are corrected.

Focused executable checks reproduced two independent security failures: restricted mailbox access falls back to inherited access, and hidden Bcc recipients can become visible reply recipients. The repository-rule evaluation issue is also present.

Files Needing Attention: apps/server/src/mastra/tools/subagent-tool-allowlists.ts, apps/server/src/mastra/tools/event-execution/orchestrator-dispatch-tools.ts, apps/server/src/mastra/tools/mail/readLiveThreadTool.ts, and apps/server/.claude/skills/playbook-instruction-eval/live-thread-search-eval.ts.

Security Review

Live-mail access can exceed an agent's configured mailbox scope because the executor omits agentId when calling the tool gate, causing the connection scope to fall back to inherited access. Historical Bcc recipients are also returned to the model and can flow through the normal recipient merger into a visible outgoing reply. Both issues were reproduced through the affected production paths.

T-Rex Logs

What T-Rex did

T-Rex produced a proof for a posted P1 finding.
T-Rex produced a second proof for a posted P1 finding with related repro artifacts.
A narrow Vitest repro was executed under the server test path and passed two tests, confirming the authorization bypass for newly granted aliases.
T-Rex produced another P1 finding proof.
A general-contract-validation proof verified that a live message with hidden Bcc was drafted correctly and that the same flow also passes against the pre-change tool, confirming draft recipient construction.

_{Ran code and verified through T-Rex}

Prompt To Fix All With AI

### Issue 1
apps/server/src/mastra/tools/subagent-tool-allowlists.ts:222-223
**Live-mail grants bypass agent scope**

The drafting executor grants `search-live-emails` and `read-live-email-thread`, but invokes the gated tools with a request context that does not include `agentId`. The scope resolver treats that context as inherited access rather than applying the drafting agent's configured mailbox restrictions. A restricted dra

Show production surfaces and changed-file mapping

Production surfaces

Libra has not measured any production surfaces for this change yet.

Changed files → surfaces

apps/server/.claude/skills/cedar-configuration/SKILL.mdno production surface mapped
apps/server/.claude/skills/cedar-configuration/cedar-system-knowledge.mdno production surface mapped
apps/server/.claude/skills/playbook-authoring/SKILL.mdno production surface mapped
apps/server/.claude/skills/playbook-instruction-eval/live-thread-search-eval.tsno production surface mapped
apps/server/.claude/skills/sherlock/SHERLOCK_SYSTEM_KNOWLEDGE.mdno production surface mapped
apps/server/src/mastra/tools/__tests__/drafting-executor-live-mail-grant.test.tsno production surface mapped
apps/server/src/mastra/tools/mail/__tests__/liveMailTools.test.tsno production surface mapped
apps/server/src/mastra/tools/mail/__tests__/mailTool.live-actions.test.tsno production surface mapped
apps/server/src/mastra/tools/mail/mailTool.tsno production surface mapped
apps/server/src/mastra/tools/mail/readLiveThreadTool.tsno production surface mapped
apps/server/src/mastra/tools/subagent-tool-allowlists.tsno production surface mapped
apps/server/src/services/drafting/drafting.tsno production surface mapped
apps/server/src/services/mail/lib/email-utils.tsno production surface mapped
docs/customer-feedback/2026-09-01-mihir-reactivation-draft-repair.mdno production surface mapped