Track

Track organizes realtime conversation, tasks, references, and permission-aware AI assistance under Companies and Projects. A Company is the umbrella: each Project has one owning Company and can include collaborating Companies in the same workspace. An internal Project does not require a partner relationship; collaboration can be added later without duplicating conversations or tasks.

Company relationships, explicitly joined Channels, immutable Company exit archives, and guided transitions preserve access boundaries. Older Projects remain accessible through their existing memberships until ownership is explicitly assigned; ownership is never inferred from the selected Company. Ownership confirmation for an existing multi-Company Project requires approval from every current participating Company. Later transfers are initiated by the owning Company and use the same approval boundary; an owning Company must transfer ownership before exiting a Project that retains other participants. Channel threads add named focused conversations, follow and unread state, manual lifecycle controls, scoped search, and web and mobile flows.

Task management adds scoped Project and Channel boards, configurable workflows, task details and lists, conversation evidence, human-reviewed AI suggestions, search, notifications, and essential native workflows. Boards, lists, details, conversations, and threads are views of the same Project work. Task management also preserves compatibility with older Projects and does not require Channel threads or Company collaboration to be enabled.

Company collaboration, task management, and Channel threads are enabled by default through independent server-authoritative controls. An exact false environment override disables any one capability without changing the others. Clients keep gated surfaces hidden until that server projection is available.

Requirements

• Node.js 24 or newer.
• pnpm 12.8.1 through Corepack.
• A Convex project.
• OAuth credentials for enabled providers.
• An OpenRouter API key for AI features.

Cloudflare and Expo accounts are needed only for their deployment paths.

Local web setup

git clone https://github.com/hhushhas/track.git
cd track
corepack enable
pnpm install --frozen-lockfile
pnpm convex:dev

Keep pnpm convex:dev running. In another terminal:

pnpm exec convex env set SITE_URL http://localhost:3000 --deployment dev
pnpm exec convex env set BETTER_AUTH_URL http://localhost:3000 --deployment dev
pnpm exec convex env set DEV_AUTH_BYPASS 1 --deployment dev

These variables are for the development deployment only. The first two keep email sign-in redirects on the local web app, and the last enables the local development auth helpers. If the demo sign-in button is enabled, its VITE_DEV_AUTH_BYPASS values belong in .env.local and should use a development-only password.

Then start the web app:

pnpm --filter @track/web dev

Open http://localhost:3000. Convex creates the development deployment values in .env.local. Add the remaining auth, AI, and optional integration values documented in .env.example; do not copy the placeholder Convex deployment values over the generated values.

Company collaboration is enabled when TRACK_COMPANY_MODEL_ENABLED is absent or set to true. Set it to false on the Convex deployment to disable Company surfaces. The flag is server-authoritative and independent from TRACK_THREADS_ENABLED and TRACK_TASKS_ENABLED. Archive, Company-exit, redaction, account-deletion, and cleanup enforcement remains server-side while Company creation surfaces are disabled.

Task routes, controls, and new-message detection are enabled when TRACK_TASKS_ENABLED is absent or set to true. Set it to false to disable them. The flag is independent from Company and thread flags; existing conversation remains usable when tasks are disabled.

Channel threads are enabled when TRACK_THREADS_ENABLED is absent or set to true. Set it to false to disable them. Threads remain fully usable when Company collaboration or task management is disabled. The server flag hides thread discovery, routes, creation, search, and ordinary delivery when off while retaining lifecycle and cleanup enforcement for persisted data.

Local mobile setup

Create the ignored operator configuration once:

cp apps/mobile/app.example.json apps/mobile/app.json
cp apps/mobile/eas.example.json apps/mobile/eas.json
pnpm --filter @track/mobile dev

Set the EXPO_PUBLIC_* values from .env.example for the development environment. Native OAuth, push, and store builds also require operator-owned provider configuration.

Verification

pnpm lint
pnpm typecheck
pnpm test
pnpm audit --prod
pnpm build
pnpm gate
pnpm e2e
pnpm perf:fixture
pnpm perf:build

CI runs the same repository gate after a frozen install, plus the isolated browser journeys and performance budgets. The mobile build script records that release builds are handled by EAS; web client, SSR, and Worker output is built locally.

Configuration and safety

• Copy wrangler.example.toml to ignored wrangler.toml for Cloudflare variables.
• Copy convex.prod.env.example to ignored convex.prod.env for the production deployment selector.
• Keep credentials in .env.local, .credentials/, EAS, Convex, Cloudflare, or another provider secret store.
• Never commit deployment identifiers, credentials, personal data, working logs, crash reports, or store-submission material.
• Report security vulnerabilities through GitHub private vulnerability reporting.

See CONTRIBUTING.md for contribution expectations. Track is licensed under the MIT License.