@open-everywhere/provider-notion 0.1.0

package/agent/channels/notion-work-search.ts

@@ -0,0 +1,74 @@
+// Notion's WORK-SEARCH adapter (OPE-961) — wraps notion_search.ts's own `searchNotion` call behind
+// the federating `search` tool's registry (@open-everywhere/core `channels/work-search.ts`).
+//
+// 🔴 NO RESULT FILTER AS A BOUNDARY, unconditionally — the ratified rule this bundle's
+// `notion_search.ts` already states: Notion's own integration-share IS the reach, and OE never
+// narrows it as enforcement. That rule governs the UNSCOPED call.
+//
+// `insideDomain: true` IS a real narrowing here, and it is legitimate for the reason OPE-961 exists
+// at all: it is OPT-IN, documented as a convenience, and it can only ever DROP hits, never add one
+// the credential could not already reach. It keeps only the pages this domain names outright —
+// the EXACT `domain.reach` entries of the form `notion/<workspace>/<pageId>` (the same set
+// `read_notion_page`'s fence reads, via `notionPageDomain` — see notion-scope.ts). A shared Notion
+// integration used by several domains therefore lets each ask "just MY declared pages" without
+// touching what the credential itself can see.
+//
+// Registered GATED (`registerWorkSearchAdapter`), mirroring `registerReadAdapter` — Notion is a
+// provider bundle and participates in provider selection like every other bundle seam.
+
+import {
+  registerWorkSearchAdapter,
+  type WorkSearchAdapter,
+  type WorkSearchHit,
+  type BindableContext,
+  type Domain,
+} from "@open-everywhere/core/agent/adapter-api.js";
+import { resolveNotionCredential, searchNotion } from "./notion-api.js";
+import { notionWorkGrant } from "./notion-work.js";
+import { assertNotionActingIdentity } from "./notion-acting-identity.js";
+import { canonicalNotionId } from "./notion-scope.js";
+import { domainRoster } from "@open-everywhere/core/agent/adapter-api.js";
+
+/** The canonical page ids this domain names OUTRIGHT — the EXACT `reach` entries shaped
+ *  `notion/<workspace>/<pageId>`. Any workspace segment counts: an exact entry belongs to exactly
+ *  one domain (config-load exclusivity), so no workspace cross-check is needed here the way
+ *  `notionPageDomain`'s CALLER-vs-TARGET comparison needs one. */
+export function domainOwnPageIds(domain: Domain): ReadonlySet<string> {
+  const ids = new Set<string>();
+  for (const key of domainRoster(domain)) {
+    const parts = key.split("/");
+    if (parts.length === 3 && parts[0] === "notion" && parts[2].length > 0) ids.add(canonicalNotionId(parts[2]));
+  }
+  return ids;
+}
+
+export const notionWorkSearchAdapter: WorkSearchAdapter = {
+  connector: "notion",
+  async search(ctx: BindableContext, domain: Domain | undefined, query: string, opts: { limit: number; insideDomain: boolean }): Promise<readonly WorkSearchHit[]> {
+    // Notion's grant is a `Domain.credentials` declaration (never domain-free like GitHub's repo
+    // grant), so `domain` is undefined here only if the federator's grant-set derivation and this
+    // adapter ever disagreed about what grants Notion — a defensive backstop, not a reachable path.
+    if (!domain) throw new Error("this domain holds no Notion work grant.");
+    const grant = notionWorkGrant(ctx, [domain]);
+    if (!grant) throw new Error("this domain holds no Notion work grant.");
+    // 🔴 OPE-1525 — THE OWN-ACCOUNT GATE, on the line below's behalf. This is the federated `search`
+    // tool's Notion arm and it spends the same `install`-family work key `notion_search` does, so it
+    // takes the same gate. See channels/notion-acting-identity.ts.
+    await assertNotionActingIdentity(ctx, "notion_work_search");
+    const cred = await resolveNotionCredential(grant.credential);
+    if (!cred) throw new Error(`no value stored for this domain's Notion work credential "${grant.credential}".`);
+    const hits = await searchNotion(query, { ...cred, pageSize: Math.min(Math.max(opts.limit, 1), 100) });
+    const ownIds = opts.insideDomain ? domainOwnPageIds(domain) : undefined;
+    const scoped = ownIds ? hits.filter((h) => ownIds.has(canonicalNotionId(h.id))) : hits;
+    return scoped.slice(0, opts.limit).map((h) => ({
+      connector: "notion",
+      id: h.id,
+      title: h.title || "(untitled)",
+      ...(h.url ? { url: h.url } : {}),
+    }));
+  },
+};
+
+export function registerNotionWorkSearch(): void {
+  registerWorkSearchAdapter(notionWorkSearchAdapter);
+}

package/agent/channels/notion-work.ts

@@ -0,0 +1,144 @@
+// NOTION AS A WORK SURFACE (OPE-913) — the domain-granted half of the provider chat/work split.
+//
+// THE FINDING THIS EXISTS FOR. A soak run asked the agent to open a PR whose content came from a
+// spec page on Notion. The seat delegated; the delegated worker reported that it had no authorized
+// Notion connection and — correctly — refused to invent the spec. The seat had read that same page
+// an hour earlier, from a NOTION wake. Nothing about the page had changed; the WAKE SURFACE had.
+// Every Notion tool in this bundle is fenced to a Notion-origin turn (`assertTurnSurface`) and
+// mounted on `notion ∈ sources`, so a Slack-woken worker in the same domain, holding the same
+// credential, could not read it.
+//
+// THE RULE, Tommy 2026-08-21 (OPE-926 comment, generalized here): **capability derives from the
+// DOMAIN's connectors, not from the wake surface.** A domain that binds a Notion work credential
+// may read Notion from any of its surfaces; a domain that binds none may not, from any of them —
+// including from Notion itself, where the CHAT plane still serves the wake container.
+//
+// THE TWO PLANES, and which credential each runs on:
+//
+//   • CHAT plane — `read_notion_page` / `read_notion_comments` on a NOTION-origin turn, plus the
+//     reply arm. Credential: `channel-key` (notion-credentials.ts). Bounded to the wake container
+//     and its domain; unchanged by this module.
+//   • WORK plane — the same two reads from ANY surface in a work-granted domain, plus
+//     `notion_search`, the cross-container read. Credential: the domain's declared WORK credential
+//     ({@link notionWorkCredential}). Mounted only where {@link notionWorkGrant} resolves.
+//
+// 🔴 THE GRANT IS THE DECLARATION, AND ABSENCE IS A REFUSAL. `hasWorkGrant` (core
+// access/work-grant.ts) reads `Domain.credentials` by the OPPOSITE rule to `domainCredentialId`:
+// no entry for the work role ⇒ no grant ⇒ the work tools do not mount. Do not "fall back to the
+// org default" anywhere in this file; that is the hole the split closes.
+
+import {
+  callerWorkDomain,
+  hasWorkGrant,
+  resolveDomainForChannel,
+  workGrantCredential,
+  type BindableContext,
+  type Domain,
+} from "@open-everywhere/core/agent/adapter-api.js";
+import { NOTION_PROVIDER } from "./notion-credentials.js";
+import { notionPageDomain } from "./notion-scope.js";
+
+/**
+ * The ORG-DEFAULT credential id that plays Notion's WORK role — the role a domain's
+ * `Domain.credentials` entry names to hold the work grant.
+ *
+ * It is `team-key` because that is what the credential catalogue already calls it, in those words:
+ * "This is the WORK-SURFACE credential ONLY … The COMMUNICATION-CHANNEL plumbing … is a DISTINCT
+ * credential — `channel-key`". The role split predates this module; what was missing was any path
+ * that read it as a GRANT.
+ */
+export const NOTION_WORK_CREDENTIAL = "team-key";
+
+/** A resolved Notion work grant: the domain that holds it and the credential id it runs under. */
+export interface NotionWorkGrant {
+  readonly domain: Domain;
+  /** The `ConnectorCredential.id` this domain's Notion work calls run under. */
+  readonly credential: string;
+}
+
+/**
+ * The domain a CALLING SESSION belongs to, whatever surface it was woken on.
+ *
+ * Two resolvers, because a Notion page id is not compared the way every other surface key is:
+ * `notionPageDomain` canonicalises the UUID (dashes are cosmetic in Notion ids) and is
+ * workspace-blind on its roster leg, while `resolveDomainForChannel` compares whole keys verbatim.
+ * Sending a `notion/…` key through the verbatim comparison would miss a roster entry written with
+ * the other dash convention — a silent "no domain", i.e. a silent loss of the grant.
+ *
+ * Pure: `domains` is injected, like every other decision in this bundle.
+ */
+export function notionCallerDomain(surfaceKey: string, domains: readonly Domain[]): Domain | undefined {
+  const parts = surfaceKey.split("/");
+  if (parts[0] === "notion" && parts.length === 3 && parts[2]) {
+    return notionPageDomain(parts[1] || undefined, parts[2], domains).domain;
+  }
+  return resolveDomainForChannel(surfaceKey, domains).domain;
+}
+
+/**
+ * This session's Notion WORK grant, or `undefined` when its domain holds none.
+ *
+ * FAIL-SOFT ON AN UNRESOLVABLE CONTEXT, and that is the fail-CLOSED direction here: a synthetic or
+ * identity-less ctx has no partition, so it resolves no domain, so it holds no grant, so no work
+ * tool mounts. There is no arm in which an unreadable context widens the surface. Core's
+ * {@link callerWorkDomain} owns that chain and that fail direction for every provider (OPE-951);
+ * Notion passes {@link notionCallerDomain} as the resolver because of the UUID rule above. The guard
+ * now covers the RESOLVER too, not only the partition read: a throw out of the roster comparison
+ * also resolves to no grant, which is the same direction.
+ */
+export function notionWorkGrant(ctx: BindableContext, domains: readonly Domain[]): NotionWorkGrant | undefined {
+  const domain = callerWorkDomain(ctx, () => domains, notionCallerDomain);
+  return domain ? notionWorkGrantForDomain(domain) : undefined;
+}
+
+/**
+ * The MOUNT predicate for a Notion work tool — {@link notionWorkGrant} as a boolean, with `domains`
+ * as a LAZY thunk and every failure absorbed.
+ *
+ * Both properties matter at a `session.started` resolver. The thunk is the same dependency-injection
+ * shape `sourceScopedMount` uses, so a resolver that runs before the app registers its config does
+ * not throw on `getConfig()`. And an absorbed failure resolves FALSE: an unreadable config hides the
+ * work tools rather than mounting them, which is the fail-closed direction.
+ */
+export function notionWorkMount(ctx: BindableContext, domains: () => readonly Domain[]): boolean {
+  try {
+    return notionWorkGrant(ctx, domains()) !== undefined;
+  } catch {
+    return false;
+  }
+}
+
+/** {@link notionWorkGrant} for a domain already in hand — the form {@link notionWorkGrant} and
+ *  {@link notionWorkCredential} share, and the one place the (connector, role) pair is named. */
+function notionWorkGrantForDomain(domain: Domain): NotionWorkGrant | undefined {
+  if (!hasWorkGrant(domain, NOTION_PROVIDER, NOTION_WORK_CREDENTIAL)) return undefined;
+  const credential = workGrantCredential(domain, NOTION_PROVIDER, NOTION_WORK_CREDENTIAL);
+  return credential ? { domain, credential } : undefined;
+}
+
+/** The credential id a work-granted domain's Notion calls run under, or undefined when it holds no
+ *  grant. Never falls back to the org default — see the header. */
+export function notionWorkCredential(domain: Domain | undefined): string | undefined {
+  return domain ? notionWorkGrantForDomain(domain)?.credential : undefined;
+}
+
+/**
+ * The Notion WORKSPACE ids a domain names for itself — every `notion/<workspace>/…` entry in its
+ * roster and its claims, de-duplicated.
+ *
+ * WHY A WORK READ NEEDS THIS. `notionPageDomain`'s CLAIM leg needs a workspace to build the key it
+ * matches; its roster leg does not. A Notion-woken caller supplies its own workspace from its
+ * surface key, but a Slack-woken worker has none — so without this, a work-granted domain that
+ * expresses its Notion membership as a CONTAINER would resolve nothing cross-surface, and the
+ * grant would silently work for pages the config names outright ONLY. Reading the candidates off the CALLER's
+ * OWN domain keeps that strictly inside what the domain already declares: it can never introduce a
+ * workspace nobody wrote down.
+ */
+export function notionWorkspacesOf(domain: Domain): readonly string[] {
+  const out = new Set<string>();
+  for (const key of domain.reach ?? []) {
+    const parts = key.split("/");
+    if (parts[0] === "notion" && parts.length >= 2 && parts[1]) out.add(parts[1]);
+  }
+  return [...out];
+}