Rooms

Rooms publishes client-safe versions of Linear issues through revocable, accountless room and issue links.

This repository is public for transparency and review. It is source-available, not open source. See LICENSE.

Stack

• Next.js 16.2, React 19.2, strict TypeScript, Node.js 24, pnpm
• shadcn/ui base-nova, Base UI, Tailwind CSS v4, Lucide
• Convex for data, realtime subscriptions, webhooks, and scheduled reconciliation
• Clerk for authentication and organizations
• Polar for subscriptions and Merchant-of-Record billing
• Vercel for the Next.js application and public metadata

No Prisma and no SQL ORM are used. If Rooms later adds SQL, use Drizzle rather than Prisma.

Local development

cp .env.example .env.local
pnpm dev

The interface runs with safe demo data when credentials are absent. Add the service variables only when connecting real accounts.

Useful routes:

• /app/issues — shared issues
• /app/issues/export-demo — selected internal issue workspace
• /r/northwind-demo — accountless client room
• /i/export-demo — direct client issue
• /pricing — public pricing

Linear-native workflow

• Linear workflow states are mapped to editable public statuses in Rooms.
• Status changes update every published share that follows its Linear mapping.
• A newly created Linear comment is published only when it begins with @rooms or #rooms.
• Rooms removes the marker and publishes the remaining text to every active client share of that Linear issue. Untagged comments remain internal.
• Rooms adds ⏳ while processing, then replaces it with ✅ or ❌. A successful nested reply contains one client link per active room, anchored directly to the new timeline entry. Retries do not duplicate the client update.
• Configure the Linear OAuth application webhook for both Issue and Comment resource types and authorize the read, write, and admin scopes.

Security boundaries

• Linear descriptions, untagged comments, assignees, and attachments are never copied.
• Anonymous queries resolve a secret-token hash and return an allowlisted DTO.
• All tenant mutations must call the centralized Convex tenant identity guard.
• Linear webhooks verify the raw-body HMAC and replay timestamp before forwarding an allowlisted issue or explicitly marked comment event.
• Polar webhooks use the official signature-verifying Next.js adapter.
• Invalid room and issue tokens return the same non-enumerating message.

The same base64-encoded 32-byte INTEGRATION_ENCRYPTION_KEY and CONVEX_WEBHOOK_SECRET must be set in both Vercel and Convex. Convex also needs CLERK_JWT_ISSUER_DOMAIN, LINEAR_CLIENT_ID, and LINEAR_CLIENT_SECRET. Each Polar subscription product must use a 14-day trial so checkout collects a card and Polar emits the trialing subscription state.

Cost rollout

• Private beta: Vercel Hobby and Convex Free with usage alerts and hard limits.
• External beta: dedicated Vercel Pro team with a $5 metered-overage pause.
• First paying customer: Convex Professional for backups and observability.

Vercel and Convex spend controls are configured in their dashboards rather than in source code.