Libra CodeHub

CedarCopilot/cedar-mail

Branch: staging

merging staging to main

merged#2760CedarCopilot

CedarCopilot wants to merge 2 commits into main from staging

Not deployedTimeline and evidence
  1. Opened
    Sep 11, 2026, 10:01 AM
  2. Merged
    Sep 11, 2026, 10:53 AM
  3. No findings
    Sep 11, 2026, 11:12 AM
  4. Live on staging, live on prod, observed
    Pending
  5. Not deployed

    Not deployed

    Pending

Libra has no production signal for this change yet because it has not deployed. Libra checks hourly for 3 days after each deploy.

Greptile Summary

This change adds a customer-specific Simcare account-setup record, expands MCP OAuth resource-path matching, and configures Sol automations to disable OpenAI reasoning. The account-setup document exposes customer operational data, and the MCP change accepts an ancestor resource identifier that is then sent through authorization and token exchange. The added TypeScript assertion also violates a repository requirement.

Confidence Score: 1/5

Not safe to merge: customer operational data is committed to the repository, the OAuth flow can request a token for a broader resource than the MCP endpoint, and the repository’s no-cast requirement must be satisfied.

Two independently reproduced security-impacting failures affect the customer setup document and MCP OAuth flow. The repository requirement violation is also present.

Files Needing Attention: docs/account-setup/simcare-ai-2026-09-10.md, apps/server/src/services/integrations/mcp/server-url.ts, and apps/server/src/services/aop/automations.ts

Security Review

The Simcare setup record exposes customer-specific identifiers, internal Slack identifiers, live operational configuration, and account activation state to repository readers. Separately, MCP OAuth discovery now accepts an ancestor resource path and forwards that broader resource to authorization and token exchange.

T-Rex T-Rex Logs

What T-Rex did

  • T-Rex produced a proof for a posted P1 finding and included the Sensitive-data evidence collector script and parent/current revision captures.
  • T-Rex produced a proof for a posted P1 finding and included the OAuth ancestor-resource probe with before-change and after-change results.
  • T-Rex posted a second P1 finding proof.
  • T-Rex validated the MCP resource ancestor contract by examining the MCP resource ancestor probe source and comparing outputs before/after the change.
  • T-Rex validated the SIMCare sensitive-data capture contract, showing before/after captures and the evidence script used to reproduce results.

View all artifacts

T-Rex Ran code and verified through T-Rex

Comments Outside Diff (1)

  1. General comment

    P1 Customer operational data is committed in the Simcare account-setup document

    • Bug
      • docs/account-setup/simcare-ai-2026-09-10.md commits a named user's personal email and internal user/org identifiers; internal Slack channel and user identifiers; live-database-derived account, playbook, sales-process, and customer operational details; and records that agent execution and Gmail draft pushing are enabled. It also states that customer account-password strings were found in source email examples, even though the copied examples were reportedly redacted. The executed evidence collector established that this document is tracked in commit d4eaacbf91315c1051e593ff61774130e978575b on the configured GitHub remote, s
Show production surfaces and changed-file mapping

Production surfaces

Libra has not measured any production surfaces for this change yet.

Changed files → surfaces

  • apps/mail/modules/administeredUser/contract.tsno production surface mapped
  • apps/mail/modules/agents/components/AgentActionMenu.tsxno production surface mapped
  • apps/mail/modules/agents/components/AgentAddConnectionDialog.tsxno production surface mapped
  • apps/mail/modules/agents/components/AgentConnectionsPanel.tsxno production surface mapped
  • apps/mail/modules/agents/components/AgentDocumentView.tsxno production surface mapped
  • apps/mail/modules/agents/components/AgentHeader.tsxno production surface mapped
  • apps/mail/modules/agents/components/AgentInstructionsSection.tsxno production surface mapped
  • apps/mail/modules/agents/components/AgentMemoryTab.tsxno production surface mapped
  • apps/mail/modules/agents/components/AgentOutputTab.tsxno production surface mapped
  • apps/mail/modules/agents/components/AgentSettingsSection.tsxno production surface mapped
  • apps/mail/modules/agents/components/AgentSourcesPanel.tsxno production surface mapped
  • apps/mail/modules/agents/components/AgentView.tsxno production surface mapped
  • apps/mail/modules/agents/components/AgentsGrid.tsxno production surface mapped
  • apps/mail/modules/agents/hooks/use-rename-agent.tsno production surface mapped
  • apps/mail/modules/agents/hooks/use-set-agent-default-file.tsno production surface mapped
  • apps/mail/modules/agents/queries.tsno production surface mapped
  • apps/mail/modules/agents/utils/agent-paths.tsno production surface mapped
  • apps/mail/modules/brain/brain-routes.tsxno production surface mapped
  • apps/mail/modules/brain/components/BrainHero.tsxno production surface mapped
  • apps/mail/modules/brain/components/PlaybookAopSection.tsxno production surface mapped
  • apps/mail/modules/company/components/CompanyExplorer.tsxno production surface mapped
  • apps/mail/tests/modules/brain/brainHero.test.tsxno production surface mapped
  • apps/server/src/http/app.tsno production surface mapped
  • apps/server/src/mastra/routeHandlers/chat/handleChat.tsno production surface mapped
  • apps/server/src/mastra/workflows/chat/chat-workflow.tsno production surface mapped
  • apps/server/src/services/agent-workspace/agent-read.tsno production surface mapped
  • apps/server/src/services/aop/automations.tsno production surface mapped
  • apps/server/src/services/integrations/mcp/__tests__/oauth-discovery.test.tsno production surface mapped
  • apps/server/src/services/integrations/mcp/oauth-discovery.tsno production surface mapped
  • apps/server/src/services/integrations/mcp/server-url.tsno production surface mapped
  • apps/server/src/trpc/routes/__tests__/agent-router-org-admin.test.tsno production surface mapped
  • apps/server/src/trpc/routes/agent.tsno production surface mapped
  • docs/account-setup/simcare-ai-2026-09-10.mdno production surface mapped
  • docs/account-setup/simcare-ai-proposal.mdno production surface mapped
  • docs/changelogs/2026-W37.mdno production surface mapped