Files

T

Alex Kutas 49f0a9e62f OPE-296: Add linear integration for starting sessions from issues (#3235 )

* feat(linear): start sessions from Linear issues
Authorize a Linear workspace on this OpenChamber server, map teams to
projects, attach an issue from chat, start a session or worktree from an
issue, and post started/completed/failed comments that open the session.
Hidden in VS Code.

* feat(linear): connect more than one Linear workspace

Store each OAuth grant on this OpenChamber server and keep one current, so Settings can add and switch workspaces without dropping the others. Project mapping is per workspace. Remove the Linear button next to New Chat; start-from-issue stays on New Worktree.

* feat(linear): add a right-hand issues panel

Browse and filter issues in the rail, open a card to change status or start a session, and collapse search plus most filters to icons on a narrow panel.

* feat(linear): open issues in the rail and filter by Linear status

The rail icon only shows after Linear is connected. Clicking a Linear row on work status opens the panel. Status options match the card, including Done, Canceled, and Duplicate. The Integrations experimental warning sits under Third-party integrations.

* fix(linear): use stable OAuth callback broker

* fix(chat): preview Linear issue attachments

The context switch missed linear-issue, so tsc treated the preview helpers as incomplete.

* fix(ui): restore Linear i18n parity and the #2903 sync harness

Turkish was missing the Linear dictionaries, and the subagent test still wrapped only SyncContext after reads moved to SyncRuntimeContext.

* fix(linear): drop changelog hunks and close review races

Keep changelogs out of this PR, restore CodeMirror ranges, ignore stale Linear list pages, and leave a persisted Linear tab open until auth has actually resolved.

* fix(linear): tint active issue filters and clear them in one click

* fix(markdown): read escaped brackets as text, not display math

`\[...\]` is display math in LaTeX and an escaped bracket pair in
CommonMark. The block tokenizer claimed every `\[`, so prose like
`[title \[Bug\] more](url)` was handed to KaTeX: "Bug" rendered as a
centered formula and the block token split the paragraph, tearing the
link into three pieces. Linear, GitHub and any other source that escapes
brackets the way CommonMark requires hit this.

Display math now has to own its line — `\[` starts one and `\]` ends
one. A formula on its own line still renders; `\[` mid-sentence stays an
escape, which is what CommonMark says it is and what prose almost always
means. Inline `\(...\)` keeps the same ambiguity, but inline math is
legitimately mid-sentence, so there is no position to judge it by.

Covered by regression tests, including the verbatim comment body that
surfaced this.

* feat(linear): make session status comments opt-in and public-only

A status comment lands in a Linear workspace the whole team reads, and
the link it carried pointed at whatever origin started the session —
usually loopback or a LAN address. Everyone but its author got a dead
link, and nobody had agreed to the comments in the first place.

Comments are now off until the user turns them on in Settings ->
Integrations -> Linear, and the check lives on the server: the event hub
posts completed and failure without going through the interface, so a
client-side gate would not hold. When the resolved origin is not
publicly reachable the server posts nothing at all rather than a link
only its author can open; `isPublicSessionOrigin` rejects loopback,
private LAN, carrier-grade NAT, link-local and single-label hosts. The
desktop deep-link origin is gone with it, since no one else can follow
one either.

The comment body also dropped the session title. It repeated the issue
the comment already sits on, and issue titles routinely carry brackets
("[Bug] ...") that broke the markdown link. The body is now one short
link, and `sessionTitle` is gone from the route, client and types.

Also caps the dedupe file at the newest 500 sessions; it grew forever.

* fix(linear): match the pull request panel and clear review findings

Comments in the Linear panel now render as the same avatar timeline the
pull request panel uses, with the shared time-format preference instead
of a raw locale string. Comment authors carry `avatarUrl`, which the
GraphQL selection was not requesting.

Review findings from the same pass:

- `status-runtime.js` hand-rolled `typeof` narrowing and failed the
vendored anti-slop lint; it now parses through `parse.js` like every
other file in the module.
- `useLinearAuthStore` turned any failed request into `connected: false`
with `hasChecked: true`. Since the rail icon, the composer entry and
the worktree option all gate on `connected === true`, one network blip
hid Linear for the rest of the session, and Settings only re-checked
when it had never checked. It now keeps the last known status and
leaves `hasChecked` false so the next caller retries.
- `LinearIssuesView` (1096 lines) was a static import in `ContextPanel`,
shipping in the main bundle although its rail icon stays hidden until
a workspace is connected. It is lazy now, like `GitView`.
- Dropped dead code: the unused port helpers left over from the loopback
callback, two re-exported default values nothing read, and a redundant
export in `linkedIssues`.
- Integrations is no longer badged beta.

2026-08-30 02:18:40 +03:00

3.0 KiB

Raw Permalink Blame History

Linear OAuth broker hand-off

Required Linear application change

https://api.openchamber.dev/v1/oauth/linear/callback

Linear compares the full redirect URI, including scheme, host, path, and port. Deploy the API broker and apply its D1 migration before testing this branch.

Why the original callback failed

The first implementation redirected Linear back to the OpenChamber server:

http://127.0.0.1:<listen-port>/linear/oauth/callback

That address is not stable across OpenChamber runtimes:

packaged desktop prefers its stored local port and can select another free port when needed;
local development and the CLI use different ports;
self-hosted servers may sit behind a reverse proxy or have no public inbound address at all.

Linear requires an exact pre-registered callback. Registering every possible desktop or self-hosted address is impossible, and forcing desktop onto one port would make startup fail whenever another process owns that port.

New flow

The built-in Linear client now uses the stable callback broker in openchamber-website/apps/api:

The OpenChamber server generates OAuth state, a PKCE verifier, and a separate claim secret.
The broker stores only hashes of state and the claim secret for ten minutes.
Linear sends its authorization code to the stable public callback.
The OpenChamber server polls the broker with state and the claim secret.
The OpenChamber server exchanges the code using the PKCE verifier and stores the Linear tokens locally.
After persistence succeeds, OpenChamber acknowledges the hand-off and the broker marks it consumed.

The broker never receives the PKCE verifier, access token, or refresh token. Private Relay is not involved; the local server only needs outbound HTTPS.

Compatibility and configuration

OPENCHAMBER_LINEAR_BROKER_URL or settings.json linearBrokerUrl selects a self-hosted broker. The default is https://api.openchamber.dev/v1/oauth/linear.
OPENCHAMBER_LINEAR_REDIRECT_URI or settings.json linearRedirectUri bypasses the broker and preserves the direct callback flow for a custom Linear OAuth application.

Owning files

OpenChamber:

auth.js: broker and redirect configuration.
oauth.js: PKCE, broker registration/poll/acknowledgement, token exchange.
routes.js: starts authorization and completes broker results during status polling.

Hosted API, in the openchamber-website repository:

apps/api/src/routes/linear-oauth.ts
apps/api/migrations/0010_linear_oauth_transactions.sql
apps/api/LINEAR-OAUTH.md

Validation

OpenChamber focused tests:

bunx vitest run \
  packages/web/server/lib/linear/oauth.test.js \
  packages/web/server/lib/linear/auth.test.js \
  packages/web/server/lib/linear/routes.test.js

Hosted API checks:

cd apps/api
bun test src/routes/linear-oauth.test.ts
bun run check
bun run build

3.0 KiB Raw Permalink Blame History