# Reported issues for Corresync Pod holds 20 of 36 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user. Back to [Corresync](/mcp/corresync). ## Most discussed ### feat(auth): support user-owned Google OAuth while managed OAuth stays dormant ## Decision update — 2026-08-18 The managed-first plan in the original issue is superseded. Corresync will first support a Google Desktop OAuth client owned by the signed-in human. The dormant Corresync-managed Google OAuth route stays in the tree for a possible future review or policy change, but it has no environment, configuration, CLI, MCP, discovery, or fallback switch and is not enabled in RC builds. This avoids making Gmail, Google Calendar, Meet event links, and Google Tasks depend on [Read the thread](https://github.com/nkiyohara/corresync/issues/63) · 2026-07-29 · open · 4 comments ### feat(site): add a privacy-preserving email provider compatibility checker ## Problem People usually know their email address or service name, not whether the account uses Microsoft 365, Google Workspace, JMAP, IMAP/SMTP, CalDAV, or another Corresync route. The site should let a visitor enter an address and receive useful pre-authentication guidance without sending, retaining, or logging the mailbox identity and without pretending that DNS evidence can guarantee a successful login. ## Desired experience 1. The visitor enters an email address on the public site. 2. [Read the thread](https://github.com/nkiyohara/corresync/issues/91) · 2026-08-11 · closed · 3 comments ### feat(teams): add parity-gated Graph and Teams Web messaging routes Parent: #142 Depends on: the communications-scope ADR and provider-neutral domain children of #142 ## Goal Implement Microsoft Teams messaging through both an explicitly selected Microsoft Graph route and an explicitly selected, interactive browser-owned Teams Web route. v0.9 must not expose a Teams capability on only one of the two routes. ## Target capability cohort Where both provider contracts can prove the behavior, cover chats, channels, meeting chats, message/thread history and search [Read the thread](https://github.com/nkiyohara/corresync/issues/146) · 2026-08-14 · open · 2 comments ### Roadmap: ship provider-neutral messaging in v0.9 ## Summary Prepare Corresync v0.9 to add provider-neutral messaging through the same typed application use cases in CLI, stable JSON, MCP, and the local daemon. This roadmap changes no accepted product scope by itself: #144 must first accept the bounded communications ADR and supersede the relevant exclusions in ADR 0005 and ADR 0008. ## Product boundary - Accounts, workspaces, routes, actors, conversations, cursors, caches, and audit context remain isolated. - Consequential operations use se [Read the thread](https://github.com/nkiyohara/corresync/issues/142) · 2026-08-14 · open · 2 comments ### feat(todoist): add a first-class Todoist task provider Parent: #105 Depends on: #106 Official API: https://developer.todoist.com/api/v1/ Todoist is the strongest independent first-wave provider: it has a supported REST API, a first-party `/sync` endpoint, OAuth, webhooks, and 2026 support for RFC 7591 Dynamic Client Registration and public clients with PKCE. ## Scope - OAuth authorization using a public-client-safe flow; evaluate client-ID metadata versus dynamic registration. - Projects, sections, tasks, subtasks, labels, assignees, priorities, [Read the thread](https://github.com/nkiyohara/corresync/issues/110) · 2026-08-13 · closed · 2 comments ### feat: expose monitoring and notifications through CLI and MCP Parent: #44 Make existing opt-in monitoring understandable and manageable through CLI and MCP without conflating detection, notification, queueing, agent execution, or egress. ## Scope - Account-local event records with pending, delivered, failed, and acknowledged states. - CLI-owned enablement and configuration for monitoring mode, filters, quiet hours, retention, debounce, rate limits, runners, and remote egress. - Typed CLI/JSON/MCP status, bounded event reads, acknowledgements, and recove [Read the thread](https://github.com/nkiyohara/corresync/issues/47) · 2026-07-29 · closed · 2 comments ### feat: add efficient refresh, saved queries, and an evidence-backed cache decision Parent: #44 Keep mail and calendar projections responsive without merging provider state or creating an accidental permanent mail archive. ## Scope - Incremental refresh where a provider exposes a safe cursor/history contract. - Account-local invalidation and deterministic merge into read-only projections. - Private saved query definitions for account, folder/calendar, query, output bounds, and display preferences. - Consistent access to those projections and saved queries through typed CLI/J [Read the thread](https://github.com/nkiyohara/corresync/issues/46) · 2026-07-29 · closed · 2 comments ### feat: streamline browser-owned reauthentication when the provider session is still valid Related to #45. ## Observation On 2026-08-26, a configured Microsoft OWA account entered `reauthentication_required` with reason `interaction_required` relatively soon after earlier use. Running: ```text corr auth login --account ``` completed successfully without any password, MFA, or other human input because the authentication session was still present in the browser. The local Corresync session had expired or become unusable while the browser-owned provider session remained vali [Read the thread](https://github.com/nkiyohara/corresync/issues/171) · 2026-08-26 · closed · 1 comment ## Most recent ### bug(release): MCPB SBOM generation can fail when snapshot runs in a TTY ## Summary The reproducible Syft wrapper inherits a terminal for stdout/stderr but no stdin when invoked as a child of `mcpbpack`. Syft 1.48 can enter its terminal progress renderer, observe EOF, and exit successfully without writing the requested SBOM. The wrapper then fails while opening the absent output. ## Reproduction Run `mise exec -- task release:snapshot` from an allocated PTY. GoReleaser completes its archives, packages, and SBOMs; the MCPB SPDX step reports that the requested docum [Read the thread](https://github.com/nkiyohara/corresync/issues/173) · 2026-08-26 · closed · 0 comments ### bug(mcp): settings_update is unavailable with an empty account catalog ## Summary After removing the final account, MCP can add an account again, but settings_update fails before preview because it binds the global settings operation to the empty default account. ## Reproduction 1. Start the daemon with one configured account. 2. Remove the final account through the reviewed MCP account removal flow. 3. Call the MCP settings update preview before adding another account. ## Actual behavior PreviewSettingsUpdate calls NewOperation with backend.DefaultAccount. In [Read the thread](https://github.com/nkiyohara/corresync/issues/167) · 2026-08-21 · closed · 0 comments ### bug(mcp): validate service inputs before checking authenticated session state ## Summary Malformed mail, calendar, or task inputs can produce an authentication-required error through MCP before their input contract is validated, while corresponding CLI commands validate locally first. ## Reproduction 1. Use a configured but signed-out account. 2. Call an MCP mail, calendar, or task tool with a structurally invalid input. 3. Compare the result with the corresponding corr CLI command. ## Actual behavior The MCP daemon forwarding path reaches authenticated session resol [Read the thread](https://github.com/nkiyohara/corresync/issues/165) · 2026-08-21 · closed · 0 comments ### bug: agenda projection returns an internal consistency error for a reauthentication-required account ## Corresync version v0.9.0-rc.1, commit 856f07baa4974b57aaa26c0ab720472034b74153, standalone install on macOS arm64. ## Observed behavior With one configured microsoft-owa calendar account in reauthentication_required state: - A direct calendar-folder read returns the expected stable reauthentication_required action with reason interaction_required. - The equivalent bounded all-account agenda projection exits with the free-text internal error: validate daemon agenda projection: project [Read the thread](https://github.com/nkiyohara/corresync/issues/158) · 2026-08-20 · closed · 0 comments ### feat(mattermost): add REST and WebSocket messaging routes Parent: #142 Depends on: the communications-scope ADR and provider-neutral domain children of #142 ## Goal Add Mattermost through its supported REST API and WebSocket event contract for an exact user-authorized server and account. ## Scope - Teams, channels, direct and group messages, posts/threads, bounded search, send/reply, edit/delete, reactions, mentions, files, channel creation, and membership operations where the server reports support. - REST snapshots plus WebSocket invalidation/eve [Read the thread](https://github.com/nkiyohara/corresync/issues/148) · 2026-08-14 · open · 1 comment ### feat(slack): add an official API messaging route Parent: #142 Depends on: the communications-scope ADR and provider-neutral domain children of #142 ## Goal Add Slack messaging through supported Slack APIs and provider-supported installation authorization. Do not automate app.slack.com, reuse browser sessions, use private APIs, or operate as a prohibited self-bot. ## Scope - Explicit workspace installation and actor mode, with the visible bot/app or delegated-user attribution preserved. - Conversations, channel and DM history, threads, boun [Read the thread](https://github.com/nkiyohara/corresync/issues/147) · 2026-08-14 · open · 1 comment ### feat(messages): define the provider-neutral domain and CLI/MCP contracts Parent: #142 Depends on: the communications-scope ADR child of #142 ## Goal Add the provider-neutral domain and application ports shared by every v0.9 messaging adapter. Transports and providers translate these contracts and hold no product policy. ## Scope - Stable account, workspace, route, and actor provenance. - Conversation kinds, membership snapshots, message/thread identity, versions, authors, timestamps, bounded rich text, links, mentions, reactions, and attachments. - Typed list/get [Read the thread](https://github.com/nkiyohara/corresync/issues/145) · 2026-08-14 · open · 1 comment ### docs(messages): accept a bounded communications scope for v0.9 Parent: #142 ## Goal Write and accept the architectural decision that permits Corresync to add a provider-neutral communications domain without weakening its local-first CLI/MCP trust model. No messaging implementation may become reachable before this ADR is accepted. The ADR must explicitly supersede only the communications exclusions in ADR 0005 and ADR 0008; mail, calendar, tasks, hosted-relay, administrator, credential, and authentication boundaries remain unchanged. ## v0.9 release coho [Read the thread](https://github.com/nkiyohara/corresync/issues/144) · 2026-08-14 · open · 1 comment ### feat(trello): add a board/card work-item provider Parent: #105 Depends on: #106 Official references: - https://developer.atlassian.com/cloud/trello/rest/api-group-cards/ - https://developer.atlassian.com/cloud/trello/guides/rest-api/webhooks/ Trello cards are work items, not generic personal tasks. Board/list/card placement and membership must remain visible. ## Scope - Supported Trello authorization for installed/local Corresync clients. - Board and list discovery; card read/search/create/update/move/archive. - Members, labels, due/start/ [Read the thread](https://github.com/nkiyohara/corresync/issues/120) · 2026-08-13 · closed · 1 comment ### feat(notion): add a schema-mapped work-item connector Parent: #105 Depends on: #106 Official API references: - https://developers.notion.com/guides/get-started/overview - https://developers.notion.com/reference/webhooks-events-delivery Notion does not have one universal task resource. Tasks are user-defined pages in databases/data sources, so this is a work-item connector with explicit schema mapping rather than a personal To Do adapter. ## Scope - OAuth and page/data-source selection. - Guided mapping for title, status, due date, assignee, pr [Read the thread](https://github.com/nkiyohara/corresync/issues/118) · 2026-08-13 · closed · 1 comment ### feat(anydo): integrate the official remote MCP provider Parent: #105 Depends on: #106 Any.do launched an official remote MCP server in beta on 2026-06-15: - https://support.any.do/en/articles/15505097-any-do-mcp - Endpoint documented by Any.do: `https://mcp.any.do/sse` It supports personal tasks, reminders/recurrence, workspaces, calendars, and grocery lists through OAuth 2.0. ## Architecture questions to resolve Corresync normally exposes MCP to downstream agents; this provider makes Corresync an MCP client upstream. Define an explicit remote-p [Read the thread](https://github.com/nkiyohara/corresync/issues/115) · 2026-08-13 · open · 1 comment ### feat(microsoft-web): add an explicit Outlook Web / Exchange Tasks fallback Parent: #105 Depends on: #106 ## Motivation Some users can operate tasks in Outlook on the web but cannot authorize Corresync's Microsoft Graph application because of tenant consent policy, app-registration constraints, sovereign-cloud setup, or an on-premises Exchange deployment. Microsoft documents task operation in Outlook on the web and classic Outlook Web App: - https://support.microsoft.com/en-us/office/use-microsoft-to-do-for-tasks-and-reminders-in-outlook-on-the-web-dadc98aa-d854-4ec [Read the thread](https://github.com/nkiyohara/corresync/issues/109) · 2026-08-13 · open · 1 comment The remaining reports are on [the project's issue tracker](https://github.com/nkiyohara/corresync/issues).