Libra CodeHub

CedarCopilot/cedar-mail

Branch: staging

[2026-09-09] merging staging to main

merged#2745CedarCopilot

CedarCopilot wants to merge 1 commit into main from staging

Not deployedTimeline and evidence
  1. Opened
    Sep 9, 2026, 7:26 PM
  2. No findings
    Sep 9, 2026, 7:39 PM
  3. Merged
    Sep 9, 2026, 7:43 PM
  4. Live on staging, live on prod, observed
    Pending
  5. Not deployed

    Not deployed

    Pending

Libra has no production signal for this change yet because it has not deployed. Libra checks hourly for 3 days after each deploy.

Greptile Summary

Summary

  • The transcript endpoint can return a same-organization teammate's transcript without confirming access to the associated meeting conversation.
  • Manual transcripts for users without organization context are no longer recoverable, and the admin meeting viewer rejects a valid direct transcript key when the event owner has no connections.
  • The updated regression test uses prohibited casts that must be replaced before merging.

Confidence Score: 2/5

Not safe to merge: transcript access can disclose inaccessible meeting content, valid solo-user transcripts become unreadable, and the repository-required test typing cleanup remains outstanding.

Two reproduced functional failures include one confirmed unauthorized transcript disclosure. The remaining findings do not further change the confidence result.

Files Needing Attention: apps/server/src/trpc/routes/crm.ts, apps/server/src/services/crm/events.ts, apps/server/src/trpc/routes/admin.ts, and apps/server/src/services/crm/tests/conversations.get-conversation-meeting-transcript-key.test.ts

Security Review

The browser-facing transcript route accepts a client-provided transcript key based only on organization ownership. A same-organization user without access to the meeting conversation can retrieve the keyed transcript and supply an unrelated meeting ID.

T-Rex T-Rex Logs

What T-Rex did

  • T-Rex produced proofs for posted findings P1 and P2, attaching TypeScript artifacts and logs.
  • T-Rex performed a general-contract-validation-proof focused on transcript authorization in crm.ts, noting the exact location and that the transcript was returned without key-binding or access enforcement.
  • T-Rex documented pre-baseline validations, including manual-user transcript handling and absence of connections, with the command outputs captured.
  • T-Rex executed the focused test pr2745-empty-connection-direct-key-01-before.test.ts, observed a 404 for no connections and a 200 for the direct-key resolver, and the test passed.

View all artifacts

T-Rex Ran code and verified through T-Rex

Comments Outside Diff (3)

  1. apps/server/src/trpc/routes/admin.ts, line 3300-3305 (link)

    P2 Allow direct key resolution

    The admin meeting viewer rejects an event owner with no connections before attempting the stored direct transcript key. A valid same-organization key can point to a teammate's connection and does not require fallback connection IDs, so this guard makes otherwise resolvable meeting transcripts unavailable to administrators. The practical cost is a failed admin visualization for those meetings.

    <img alt="T-Rex" src="https://greptile-static-assets.s3.ama

Show production surfaces and changed-file mapping

Production surfaces

Libra has not measured any production surfaces for this change yet.

Changed files → surfaces

  • apps/server/scripts/dump-followup-emails.tsno production surface mapped
  • apps/server/src/mastra/routeHandlers/event-execution/handleReexecuteEvent.tsno production surface mapped
  • apps/server/src/mastra/workflows/event-execution/pre-execution-setup.tsno production surface mapped
  • apps/server/src/services/agent-action-queue/replay-execution.tsno production surface mapped
  • apps/server/src/services/context-search/documents.tsno production surface mapped
  • apps/server/src/services/crm/__tests__/conversations.get-conversation-meeting-transcript-key.test.tsno production surface mapped
  • apps/server/src/services/crm/__tests__/meeting-s3-cross-user-resolution.test.tsno production surface mapped
  • apps/server/src/services/crm/__tests__/transcript-key-cross-org-auth.test.tsno production surface mapped
  • apps/server/src/services/crm/conversations.tsno production surface mapped
  • apps/server/src/services/crm/events.tsno production surface mapped
  • apps/server/src/services/crm/taxonomy-extraction-step.tsno production surface mapped
  • apps/server/src/services/integrations/meetings/types.tsno production surface mapped
  • apps/server/src/services/mail/initial-sync/handlers.tsno production surface mapped
  • apps/server/src/services/playbook/agent-defaults/meeting-prep.tsno production surface mapped
  • apps/server/src/services/turbopuffer/meeting-timestamps.tsno production surface mapped
  • apps/server/src/services/users/user-settings.tsno production surface mapped
  • apps/server/src/trpc/routes/__tests__/admin-notifications-update-settings.test.tsno production surface mapped
  • apps/server/src/trpc/routes/admin-notifications.tsno production surface mapped
  • apps/server/src/trpc/routes/admin.tsno production surface mapped
  • apps/server/src/trpc/routes/crm.tsno production surface mapped
  • docs/changelogs/2026-W37.mdno production surface mapped