Reported issues for Corresync

Pod holds 20 of 36 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to Corresync.

Most discussed

feat(auth): support user-owned Google OAuth while managed OAuth stays dormant

Decision update — 2026-08-18

The managed-first plan in the original issue is superseded. Corresync will first support a Google Desktop OAuth client owned by the signed-in human. The dormant Corresync-managed Google OAuth route stays in the tree for a possible future review or policy change, but it has no environment, configuration, CLI, MCP, discovery, or fallback switch and is not enabled in RC builds.

This avoids making Gmail, Google Calendar, Meet event links, and Google Tasks depend on

Read the thread · 2026-07-29 · open · 4 comments

feat(site): add a privacy-preserving email provider compatibility checker

Problem

People usually know their email address or service name, not whether the account uses Microsoft 365, Google Workspace, JMAP, IMAP/SMTP, CalDAV, or another Corresync route.

The site should let a visitor enter an address and receive useful pre-authentication guidance without sending, retaining, or logging the mailbox identity and without pretending that DNS evidence can guarantee a successful login.

Desired experience

The visitor enters an email address on the public site.

Read the thread · 2026-08-11 · closed · 3 comments

feat(teams): add parity-gated Graph and Teams Web messaging routes

Parent: #142 Depends on: the communications-scope ADR and provider-neutral domain children of #142

Goal

Implement Microsoft Teams messaging through both an explicitly selected Microsoft Graph route and an explicitly selected, interactive browser-owned Teams Web route. v0.9 must not expose a Teams capability on only one of the two routes.

Target capability cohort

Where both provider contracts can prove the behavior, cover chats, channels, meeting chats, message/thread history and search

Read the thread · 2026-08-14 · open · 2 comments

Roadmap: ship provider-neutral messaging in v0.9

Summary

Prepare Corresync v0.9 to add provider-neutral messaging through the same typed application use cases in CLI, stable JSON, MCP, and the local daemon. This roadmap changes no accepted product scope by itself: #144 must first accept the bounded communications ADR and supersede the relevant exclusions in ADR 0005 and ADR 0008.

Product boundary

Accounts, workspaces, routes, actors, conversations, cursors, caches, and audit context remain isolated.
Consequential operations use se

Read the thread · 2026-08-14 · open · 2 comments

feat(todoist): add a first-class Todoist task provider

Parent: #105 Depends on: #106

Official API: https://developer.todoist.com/api/v1/

Todoist is the strongest independent first-wave provider: it has a supported REST API, a first-party /sync endpoint, OAuth, webhooks, and 2026 support for RFC 7591 Dynamic Client Registration and public clients with PKCE.

Scope

OAuth authorization using a public-client-safe flow; evaluate client-ID metadata versus dynamic registration.
Projects, sections, tasks, subtasks, labels, assignees, priorities,

Read the thread · 2026-08-13 · closed · 2 comments

feat: expose monitoring and notifications through CLI and MCP

Parent: #44

Make existing opt-in monitoring understandable and manageable through CLI and MCP without conflating detection, notification, queueing, agent execution, or egress.

Scope

Account-local event records with pending, delivered, failed, and acknowledged states.
CLI-owned enablement and configuration for monitoring mode, filters, quiet hours, retention, debounce, rate limits, runners, and remote egress.
Typed CLI/JSON/MCP status, bounded event reads, acknowledgements, and recove

Read the thread · 2026-07-29 · closed · 2 comments

feat: add efficient refresh, saved queries, and an evidence-backed cache decision

Parent: #44

Keep mail and calendar projections responsive without merging provider state or creating an accidental permanent mail archive.

Scope

Incremental refresh where a provider exposes a safe cursor/history contract.
Account-local invalidation and deterministic merge into read-only projections.
Private saved query definitions for account, folder/calendar, query, output bounds, and display preferences.
Consistent access to those projections and saved queries through typed CLI/J

Read the thread · 2026-07-29 · closed · 2 comments

feat: streamline browser-owned reauthentication when the provider session is still valid

Related to #45.

Observation

On 2026-08-26, a configured Microsoft OWA account entered reauthentication_required with reason interaction_required relatively soon after earlier use.

Running:

corr auth login --account <alias>

completed successfully without any password, MFA, or other human input because the authentication session was still present in the browser. The local Corresync session had expired or become unusable while the browser-owned provider session remained vali

Read the thread · 2026-08-26 · closed · 1 comment

Most recent

bug(release): MCPB SBOM generation can fail when snapshot runs in a TTY

Summary

The reproducible Syft wrapper inherits a terminal for stdout/stderr but no stdin when invoked as a child of mcpbpack. Syft 1.48 can enter its terminal progress renderer, observe EOF, and exit successfully without writing the requested SBOM. The wrapper then fails while opening the absent output.

Reproduction

Run mise exec -- task release:snapshot from an allocated PTY. GoReleaser completes its archives, packages, and SBOMs; the MCPB SPDX step reports that the requested docum

Read the thread · 2026-08-26 · closed · 0 comments

bug(mcp): settings_update is unavailable with an empty account catalog

Summary

After removing the final account, MCP can add an account again, but settings_update fails before preview because it binds the global settings operation to the empty default account.

Reproduction

Start the daemon with one configured account.
Remove the final account through the reviewed MCP account removal flow.
Call the MCP settings update preview before adding another account.

Actual behavior

PreviewSettingsUpdate calls NewOperation with backend.DefaultAccount. In

Read the thread · 2026-08-21 · closed · 0 comments

bug(mcp): validate service inputs before checking authenticated session state

Summary

Malformed mail, calendar, or task inputs can produce an authentication-required error through MCP before their input contract is validated, while corresponding CLI commands validate locally first.

Reproduction

Use a configured but signed-out account.
Call an MCP mail, calendar, or task tool with a structurally invalid input.
Compare the result with the corresponding corr CLI command.

Actual behavior

The MCP daemon forwarding path reaches authenticated session resol

Read the thread · 2026-08-21 · closed · 0 comments

bug: agenda projection returns an internal consistency error for a reauthentication-required account

Corresync version

v0.9.0-rc.1, commit 856f07baa4974b57aaa26c0ab720472034b74153, standalone install on macOS arm64.

Observed behavior

With one configured microsoft-owa calendar account in reauthentication_required state:

A direct calendar-folder read returns the expected stable reauthentication_required action with reason interaction_required.
The equivalent bounded all-account agenda projection exits with the free-text internal error:

validate daemon agenda projection: project

Read the thread · 2026-08-20 · closed · 0 comments

feat(mattermost): add REST and WebSocket messaging routes

Parent: #142 Depends on: the communications-scope ADR and provider-neutral domain children of #142

Goal

Add Mattermost through its supported REST API and WebSocket event contract for an exact user-authorized server and account.

Scope

Teams, channels, direct and group messages, posts/threads, bounded search, send/reply, edit/delete, reactions, mentions, files, channel creation, and membership operations where the server reports support.
REST snapshots plus WebSocket invalidation/eve

Read the thread · 2026-08-14 · open · 1 comment

feat(slack): add an official API messaging route

Parent: #142 Depends on: the communications-scope ADR and provider-neutral domain children of #142

Goal

Add Slack messaging through supported Slack APIs and provider-supported installation authorization. Do not automate app.slack.com, reuse browser sessions, use private APIs, or operate as a prohibited self-bot.

Scope

Explicit workspace installation and actor mode, with the visible bot/app or delegated-user attribution preserved.
Conversations, channel and DM history, threads, boun

Read the thread · 2026-08-14 · open · 1 comment

feat(messages): define the provider-neutral domain and CLI/MCP contracts

Parent: #142 Depends on: the communications-scope ADR child of #142

Goal

Add the provider-neutral domain and application ports shared by every v0.9 messaging adapter. Transports and providers translate these contracts and hold no product policy.

Scope

Stable account, workspace, route, and actor provenance.
Conversation kinds, membership snapshots, message/thread identity, versions, authors, timestamps, bounded rich text, links, mentions, reactions, and attachments.
Typed list/get

Read the thread · 2026-08-14 · open · 1 comment

docs(messages): accept a bounded communications scope for v0.9

Parent: #142

Goal

Write and accept the architectural decision that permits Corresync to add a provider-neutral communications domain without weakening its local-first CLI/MCP trust model.

No messaging implementation may become reachable before this ADR is accepted. The ADR must explicitly supersede only the communications exclusions in ADR 0005 and ADR 0008; mail, calendar, tasks, hosted-relay, administrator, credential, and authentication boundaries remain unchanged.

v0.9 release coho

Read the thread · 2026-08-14 · open · 1 comment

feat(trello): add a board/card work-item provider

Parent: #105 Depends on: #106

Official references:

Trello cards are work items, not generic personal tasks. Board/list/card placement and membership must remain visible.

Scope

Supported Trello authorization for installed/local Corresync clients.
Board and list discovery; card read/search/create/update/move/archive.
Members, labels, due/start/

Read the thread · 2026-08-13 · closed · 1 comment

feat(notion): add a schema-mapped work-item connector

Parent: #105 Depends on: #106

Official API references:

Notion does not have one universal task resource. Tasks are user-defined pages in databases/data sources, so this is a work-item connector with explicit schema mapping rather than a personal To Do adapter.

Scope

OAuth and page/data-source selection.
Guided mapping for title, status, due date, assignee, pr

Read the thread · 2026-08-13 · closed · 1 comment

feat(anydo): integrate the official remote MCP provider

Parent: #105 Depends on: #106

Any.do launched an official remote MCP server in beta on 2026-06-15:

https://support.any.do/en/articles/15505097-any-do-mcp
Endpoint documented by Any.do: https://mcp.any.do/sse

It supports personal tasks, reminders/recurrence, workspaces, calendars, and grocery lists through OAuth 2.0.

Architecture questions to resolve

Corresync normally exposes MCP to downstream agents; this provider makes Corresync an MCP client upstream. Define an explicit remote-p

Read the thread · 2026-08-13 · open · 1 comment

feat(microsoft-web): add an explicit Outlook Web / Exchange Tasks fallback

Parent: #105 Depends on: #106

Motivation

Some users can operate tasks in Outlook on the web but cannot authorize Corresync's Microsoft Graph application because of tenant consent policy, app-registration constraints, sovereign-cloud setup, or an on-premises Exchange deployment.

Microsoft documents task operation in Outlook on the web and classic Outlook Web App:

https://support.microsoft.com/en-us/office/use-microsoft-to-do-for-tasks-and-reminders-in-outlook-on-the-web-dadc98aa-d854-4ec

Read the thread · 2026-08-13 · open · 1 comment

The remaining reports are on the project's issue tracker.