@open-everywhere/provider-notion 0.1.0

package/dist/agent/tools/notion_search.js

@@ -0,0 +1,100 @@
+// THE WORK-PLANE SEARCH (OPE-913) — Notion's own cross-container read, under a domain work grant.
+//
+// WHY IT IS WORK AND NOT CHAT (OPE-928's container line): a read INSIDE the wake container is chat —
+// the envelope already renders it. A read ACROSS containers is work: it reaches pages nobody in this
+// conversation named, which is an exfiltration surface, so it lives behind the domain's work grant
+// and runs on the work credential.
+//
+// MOUNT: the domain's work grant, and nothing else. No grant ⇒ the tool is ABSENT, not refusing.
+// That is the OPE-927 class closed structurally: a worker that never mounts this cannot tell a
+// member it "searched Notion and found nothing".
+//
+// 🔴 NO RESULT FILTER, EVER. Tommy ruled on 2026-08-21 that search's reach IS the credential's
+// reach: "OE never filters search results as a boundary (a post-hoc filter is not enforcement)."
+// Notion enforces the boundary for real — an internal integration sees only the page trees a human
+// shared with it — so an organisation narrows search by sharing a narrow integration, and OE ships
+// the legible seam rather than a filter that would look like one. If you are about to add a
+// domain-scoped filter here, read that ruling first.
+//
+// WHAT COMES BACK: ids and titles. No page body ever crosses this tool, so the model has to take the
+// second, FENCED step (read_notion_page, which admits only pages the caller's own domain owns) to
+// read anything. Search widens what the agent can FIND; it does not widen what it can READ.
+//
+// Output is wrapped untrusted: a page title is written by arbitrary workspace members, so the model
+// must treat it as DATA, not instructions.
+import { defineDynamic, defineTool } from "eve/tools";
+import { z } from "zod";
+import { resolveNotionCredential, searchNotion } from "../channels/notion-api.js";
+import { notionWorkGrant, notionWorkMount } from "../channels/notion-work.js";
+import { assertNotionActingIdentity } from "../channels/notion-acting-identity.js";
+import { ingestUntrustedModelOutput, getConfig, preRegisterDynamicEntry, } from "@open-everywhere/core/agent/adapter-api.js";
+const MAX_RESULTS = 25;
+// FACTORED (see read_notion_page.ts's REPLAY DOCTRINE note): a top-level defineTool const, never an
+// inline literal in the handler. Exported so the work-grant test can drive execute() and prove the
+// grant is actually WIRED here — a mount gate the handler forgets to honour is worth nothing.
+export const notionSearchEntry = defineTool({
+    description: "Search this domain's Notion workspace by title and text, and get back page ids + titles. " +
+        "Use it to FIND the page you need — a spec, a runbook, a notes page — then read it with " +
+        "read_notion_page. It returns no page content, so a result is a pointer, not an answer.",
+    inputSchema: z.object({
+        query: z.string().min(1).describe("Words to search for in page titles and text."),
+        limit: z.number().int().min(1).max(MAX_RESULTS).optional().describe(`How many results to return (default 10, max ${MAX_RESULTS}).`),
+        kind: z.enum(["page", "database"]).optional().describe("Restrict results to pages or to databases. Omit for both."),
+    }),
+    outputSchema: z.object({
+        query: z.string(),
+        hits: z.array(z.object({ id: z.string(), object: z.string(), title: z.string(), url: z.string().optional() })),
+    }),
+    // NO `approval:` — a dynamic-tool approval fn only registers at session.started resolve time, so a
+    // resumed session's replay lookup fails and eve kills the turn (the pin read_notion_page carries).
+    // Read-only, so absent approval === never() is correct.
+    async execute(input, ctx) {
+        const domains = getConfig().loadDomains();
+        // THE GRANT IS RE-CHECKED IN EXECUTE, not trusted from the mount. A session resolves its tools
+        // once at session.started and can then run for hours; the config it mounted under is a
+        // deployment away from changing. Re-reading it here costs one pure lookup and means a revoked
+        // grant stops working on the next call rather than on the next rotation.
+        const grant = notionWorkGrant(ctx, domains);
+        if (!grant) {
+            throw new Error("This domain holds no Notion work grant, so Notion search is unavailable here. " +
+                "An operator grants it by declaring the domain's Notion work credential in agent/memory/config/domains.ts.");
+        }
+        // 🔴 OPE-1525 — THE OWN-ACCOUNT GATE, on the line below's behalf. `grant.credential` is a TEAM
+        // key by construction (channels/notion-work.ts NOTION_WORK_CREDENTIAL), so a member who asked to
+        // act with THEIR OWN Notion account has no answer here. The gate refuses that turn and writes the
+        // `connector.acting_identity` row either way — see channels/notion-acting-identity.ts.
+        await assertNotionActingIdentity(ctx, "notion_search");
+        const cred = await resolveNotionCredential(grant.credential);
+        if (!cred)
+            throw new Error(`no value stored for this domain's Notion work credential "${grant.credential}" — cannot search.`);
+        const hits = await searchNotion(input.query, {
+            ...cred,
+            pageSize: input.limit ?? 10,
+            ...(input.kind ? { filter: input.kind } : {}),
+        });
+        return { query: input.query, hits: hits.slice(0, input.limit ?? 10).map((h) => ({ ...h })) };
+    },
+    toModelOutput(output) {
+        const body = output.hits.length === 0
+            ? `Notion search for "${output.query}" matched nothing the work integration can see.`
+            : `Notion search for "${output.query}" — ${output.hits.length} result(s):\n` +
+                output.hits.map((h) => `- ${h.object} ${h.id}: ${h.title || "(untitled)"}`).join("\n");
+        return ingestUntrustedModelOutput(body, {
+            source: "notion search",
+            ingestion: { kind: "notion", label: "notion_search" },
+        });
+    },
+});
+preRegisterDynamicEntry("notion_search", "_single", notionSearchEntry);
+export default defineDynamic({
+    events: {
+        // session.started ONLY: a session's domain cannot change mid-session, so resolving the grant
+        // once is correct and cheaper (the same reasoning read_notion_page's resolver carries).
+        "session.started": (_event, ctx) => {
+            if (!notionWorkMount(ctx, () => getConfig().loadDomains()))
+                return null; // no work grant ⇒ absent
+            return notionSearchEntry;
+        },
+    },
+});
+//# sourceMappingURL=notion_search.js.map

package/dist/agent/tools/notion_search.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notion_search.js","sourceRoot":"","sources":["../../../agent/tools/notion_search.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,mGAAmG;AACnG,mCAAmC;AACnC,EAAE;AACF,iGAAiG;AACjG,+FAA+F;AAC/F,iDAAiD;AACjD,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,mGAAmG;AACnG,mGAAmG;AACnG,4FAA4F;AAC5F,qDAAqD;AACrD,EAAE;AACF,qGAAqG;AACrG,kGAAkG;AAClG,4FAA4F;AAC5F,EAAE;AACF,oGAAoG;AACpG,2CAA2C;AAE3C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EACL,0BAA0B,EAC1B,SAAS,EACT,uBAAuB,GAExB,MAAM,4CAA4C,CAAC;AAEpD,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,oGAAoG;AACpG,mGAAmG;AACnG,8FAA8F;AAC9F,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;IAC1C,WAAW,EACT,2FAA2F;QAC3F,yFAAyF;QACzF,wFAAwF;IAC1F,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,8CAA8C,CAAC;QACjF,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+CAA+C,WAAW,IAAI,CAAC;QACnI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2DAA2D,CAAC;KACpH,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;QACjB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;KAC/G,CAAC;IACF,mGAAmG;IACnG,mGAAmG;IACnG,wDAAwD;IACxD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG;QACtB,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,+FAA+F;QAC/F,uFAAuF;QACvF,8FAA8F;QAC9F,yEAAyE;QACzE,MAAM,KAAK,GAAG,eAAe,CAAC,GAAsB,EAAE,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,gFAAgF;gBAC9E,2GAA2G,CAC9G,CAAC;QACJ,CAAC;QACD,+FAA+F;QAC/F,iGAAiG;QACjG,kGAAkG;QAClG,uFAAuF;QACvF,MAAM,0BAA0B,CAAC,GAAsB,EAAE,eAAe,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,KAAK,CAAC,UAAU,oBAAoB,CAAC,CAAC;QAC9H,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE;YAC3C,GAAG,IAAI;YACP,QAAQ,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;YAC3B,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;IACD,aAAa,CAAC,MAAM;QAClB,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YACtB,CAAC,CAAC,sBAAsB,MAAM,CAAC,KAAK,iDAAiD;YACrF,CAAC,CAAC,sBAAsB,MAAM,CAAC,KAAK,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,eAAe;gBAC1E,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7F,OAAO,0BAA0B,CAAC,IAAI,EAAE;YACtC,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE;SACtD,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AACH,uBAAuB,CAAC,eAAe,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAEvE,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,6FAA6F;QAC7F,wFAAwF;QACxF,iBAAiB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;YACjC,IAAI,CAAC,eAAe,CAAC,GAAsB,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,yBAAyB;YACrH,OAAO,iBAAiB,CAAC;QAC3B,CAAC;KACF;CACF,CAAC,CAAC"}

package/dist/agent/tools/read_notion_comments.d.ts

@@ -0,0 +1,57 @@
+import { type SurfaceTrust } from "@open-everywhere/core/agent/adapter-api.js";
+export declare const readNotionCommentsEntry: import("eve/tools").ToolDefinition<{
+    page?: string | undefined;
+    block?: string | undefined;
+}, {
+    page: string;
+    discussions: number;
+    comments: number;
+    blocksScanned: number;
+    truncated: boolean;
+    text: string;
+    readAt?: string | undefined;
+    workspaceTrust?: "internal" | "public" | undefined;
+}> & {
+    execute(input: {
+        page?: string | undefined;
+        block?: string | undefined;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        page: string;
+        discussions: number;
+        comments: number;
+        blocksScanned: number;
+        truncated: boolean;
+        text: string;
+        readAt: string;
+        workspaceTrust?: SurfaceTrust | undefined;
+    }>;
+};
+declare const _default: import("eve/tools").DynamicSentinel<(import("eve/tools").ToolDefinition<{
+    page?: string | undefined;
+    block?: string | undefined;
+}, {
+    page: string;
+    discussions: number;
+    comments: number;
+    blocksScanned: number;
+    truncated: boolean;
+    text: string;
+    readAt?: string | undefined;
+    workspaceTrust?: "internal" | "public" | undefined;
+}> & {
+    execute(input: {
+        page?: string | undefined;
+        block?: string | undefined;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        page: string;
+        discussions: number;
+        comments: number;
+        blocksScanned: number;
+        truncated: boolean;
+        text: string;
+        readAt: string;
+        workspaceTrust?: SurfaceTrust | undefined;
+    }>;
+}) | null>;
+export default _default;
+//# sourceMappingURL=read_notion_comments.d.ts.map

package/dist/agent/tools/read_notion_comments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read_notion_comments.d.ts","sourceRoot":"","sources":["../../../agent/tools/read_notion_comments.ts"],"names":[],"mappings":"AA8CA,OAAO,EAYL,KAAK,YAAY,EAElB,MAAM,4CAA4C,CAAC;AA2CpD,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;CAmIlC,CAAC"}

package/dist/agent/tools/read_notion_comments.js

@@ -0,0 +1,236 @@
+// The comments/inline-discussion read tool for the ambient Notion surface — the SIBLING of
+// read_notion_page (which returns the page BODY). The comment thread you were WOKEN on is already in
+// context; this pulls the OTHER discussions on the page (a second commenter on another block, an
+// older resolved argument the reply needs to reconcile) BY REFERENCE — fetched on demand, never
+// inlined into the wake, so a heavily-annotated page can't blow the backscroll budget.
+//
+// SURFACE GATE + REPLAY DOCTRINE + UNTRUSTED WRAP: identical to read_notion_page.ts — a per-session
+// dynamic resolver gated on `notion ∈ sources` (workerChatArmMount) with a per-turn origin fence
+// (assertTurnSurface), a top-level factored defineTool (never an inline literal — the bundler's
+// build-time transform hoists one under a build-order-counter name that shifts across deploys; eve
+// derives a session-scoped step id for a factored, unstamped entry and self-heals it on cold resume,
+// OPE-867), and NO `approval:` (read-only).
+//
+// DOMAIN FENCE (channels/notion-scope.ts, OPE-236): BOTH caller-supplied ids are gated — `page`, and
+// `block`, which addresses a block directly and never touches `page` at all. Fail closed on either,
+// and audit the refusal; the one deployment-wide credential fences the workspace, never the domain.
+//
+// Comment bodies are EXTERNAL, UNTRUSTED content (commenters include workspace guests / externals),
+// so the whole rendered listing is wrapped through ingestUntrusted (toModelOutput) — the model must
+// treat comment text as DATA, not instructions. Author ids are surfaced as DATA too, never as a
+// trust signal.
+//
+// 🔴 THIS TOOL IS THE DELEGATED WORKER'S ONLY (OPE-1014). It has ONE mount arm — the chat arm — and
+// that arm now mounts on the `task` grain alone (access/source-scoped-mount.ts `workerChatArmMount`).
+// A conversational Notion seat reads the same comment layer through `read_channel` (channels/
+// notion-read.ts), which sweeps every discussion on the page headed by its anchor block, a SUPERSET
+// of what this tool returns, and `read_thread`, which reads the one discussion the turn is in. Since
+// OPE-1039 the generic pair carries the OPE-1026 dated-read framing too — the `readAt` stamp, the
+// per-line age and the HISTORY marker that stops the model reading a stale comment's claim as the
+// page's present state — so the seat loses no safety framing by taking the generic route.
+//
+// The worker kept it because it had no substitute: access/worker-seat.ts withholds `read_channel` /
+// `read_thread` from every delegated worker. That is no longer the whole story (OPE-1064): `WORK_ROLES`
+// now gives Notion a CONTAINER row too, so a work-granted domain's delegated worker also holds the
+// generic `read_work_channel` / `read_work_thread` pair, which the paragraph above already says
+// SUPERSEDES this tool's own read (a superset via `read_channel`'s discussion sweep). This tool has
+// no work arm of its own to fall back on, so the `task` grain is still its whole mount — it stays
+// live for now because retiring a shipped tool is its own reviewed change (filed on OPE-1064), not
+// a side effect of adding the neutral path beside it.
+import { defineDynamic, defineTool } from "eve/tools";
+import { z } from "zod";
+import { readNotionComments, resolveBlockOwningPage, resolveNotionCredential } from "../channels/notion-api.js";
+import { notionCallerCredential } from "../channels/notion-credentials.js";
+import { assertNotionActingIdentity } from "../channels/notion-acting-identity.js";
+import { assertNotionBlockAllowed, assertNotionPageAllowed } from "../channels/notion-scope.js";
+import { ingestUntrustedModelOutput, assertTurnSurface, TurnOriginFenceError, auditOriginFenceRefusal, bindFrom, workerChatArmMount, getConfig, preRegisterDynamicEntry, resolvePartition, declaredWorkspaceTrust, ageAtRead, } from "@open-everywhere/core/agent/adapter-api.js";
+const MAX_COMMENTS = 100;
+const MAX_BLOCK_SCANS = 80;
+/** Render the flattened comments into a human-readable, per-discussion listing. The WHOLE string is
+ *  wrapped untrusted by toModelOutput, so bodies + author ids inside it are DATA.
+ *
+ *  OPE-1026 — each line carries its age at the moment of the read (see {@link ageAtRead}), the same
+ *  fact `read_linear_issue.ts` renders for Linear comments: the discriminator between "an old comment
+ *  said X" and "X is true now". `readAt` is optional so a stored output from before this field
+ *  existed still renders — with no invented age. */
+function renderComments(comments, readAt) {
+    if (comments.length === 0)
+        return "";
+    // Group by anchor (block/page) → each anchor is a distinct inline discussion.
+    const byAnchor = new Map();
+    for (const c of comments) {
+        const key = c.anchorId ?? "(unknown)";
+        let list = byAnchor.get(key);
+        if (!list) {
+            list = [];
+            byAnchor.set(key, list);
+        }
+        list.push(c);
+    }
+    const sections = [];
+    for (const [anchor, list] of byAnchor) {
+        const disc = list.find((c) => c.discussionId)?.discussionId;
+        const head = `discussion on block ${anchor}${disc ? ` (discussion_id ${disc})` : ""}:`;
+        const lines = list.map((c) => {
+            const who = c.authorId ? `${c.authorKind ?? "user"} ${c.authorId}` : "unknown author";
+            const when = c.createdTime ? ` at ${c.createdTime}` : "";
+            const age = ageAtRead(c.createdTime, readAt);
+            const old = age ? ` (${age} before this read)` : "";
+            return `  - ${who}${when}${old}: ${c.text}`;
+        });
+        sections.push([head, ...lines].join("\n"));
+    }
+    return sections.join("\n\n");
+}
+// FACTORED + PRE-REGISTERED (see read_notion_page.ts / access/window-gated.ts REPLAY DOCTRINE).
+// Exported for the unit test (its toModelOutput = the untrusted-wrap assertion).
+export const readNotionCommentsEntry = defineTool({
+    description: "Read the comments / inline discussions on a Notion page (this doc, or another page shared with " +
+        "the integration). Use it when a reply needs OTHER discussions on the page — a comment on a " +
+        "different block, or an older thread — beyond the one you were woken on (already in context). " +
+        "Pass `block` to read just one block's inline discussion. Bounded; truncates a heavily-commented page.",
+    inputSchema: z.object({
+        page: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("The Notion page id whose comments to read. Defaults to THIS doc — the page the comment you're on lives in."),
+        block: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("Read ONLY this block's inline discussion (a block/page id), instead of sweeping the whole page."),
+    }),
+    outputSchema: z.object({
+        page: z.string(),
+        discussions: z.number(),
+        comments: z.number(),
+        blocksScanned: z.number(),
+        truncated: z.boolean(),
+        text: z.string(),
+        // OPE-1026 — the moment the comments below were fetched, stamped by `execute` and carried to
+        // `toModelOutput`. Optional because `toModelOutput` also runs over outputs stored before this
+        // field existed; the render drops the read-time line rather than inventing one (see
+        // read_linear_issue.ts's `readAt`, the pattern this copies).
+        readAt: z.string().optional(),
+        // OPE-331 — the bound workspace's declared tier, carried execute → toModelOutput. Same shape and
+        // same reasoning as read_notion_page's field; model-invisible behind the authored projection.
+        workspaceTrust: z.enum(["internal", "public"]).optional(),
+    }),
+    // NO `approval:` — read-only; a dynamic-tool approval fn fails a resumed session's replay lookup
+    // (same pin read_notion_page / access/window-gated.ts document). Absent approval === never() is correct.
+    async execute(input, ctx2) {
+        // Per-turn surface fence (finding 1b): a non-Notion-origin turn on a unified window must not read
+        // Notion comments even though the tool is armed for the session.
+        // OPE-732: the fence's refusal is audited here (see read_notion_page.ts's note).
+        try {
+            assertTurnSurface(ctx2, "notion");
+        }
+        catch (err) {
+            if (err instanceof TurnOriginFenceError)
+                await auditOriginFenceRefusal(ctx2, "notion");
+            throw err;
+        }
+        // Default to THIS session's page (bindFrom(ctx).surface = the page id for Notion).
+        const page = input.page ?? bindFrom(ctx2).surface;
+        if (!page)
+            throw new Error("No Notion page id available for this session — pass `page` explicitly.");
+        // DOMAIN FENCE (OPE-236) — see read_notion_page.ts and channels/notion-scope.ts. The one
+        // deployment-wide integration key bounds the WORKSPACE, not the domain, so the domain allowlist
+        // is ours to enforce: fail closed on an unresolvable page, audit every refusal.
+        const domains = getConfig().loadDomains();
+        await assertNotionPageAllowed(ctx2, page, domains);
+        // OPE-467 / OPE-499 — the carried delivery credential decides, when one is present; the CALLING
+        // domain's own binding is the fallback (see read_notion_page.ts / notion-credentials.ts).
+        // OPE-505: `cred` is the key AND its endpoint rules; spreading it carries the fence into every
+        // REST call below (notion-api.ts funnels them all through one guarded fetch).
+        // 🔴 OPE-1525 — THE OWN-ACCOUNT GATE, on the line below's behalf. `notionCallerCredential`
+        // resolves an `install`-family key, so a member who asked to act with THEIR OWN Notion account
+        // has no answer here. This tool is the DELEGATED WORKER's own arm — the grain the live
+        // substitution ran in — so leaving it ungated while `read_notion_page` is gated would move the
+        // defect one verb along. The gate refuses that turn and writes the `connector.acting_identity`
+        // row either way; see channels/notion-acting-identity.ts.
+        await assertNotionActingIdentity(ctx2, "read_notion_comments");
+        const cred = await resolveNotionCredential(notionCallerCredential(ctx2, domains));
+        if (!cred)
+            throw new Error("no value stored under db:notion:channel-key — cannot read the comments.");
+        // `block` NEEDS ITS OWN GATE: the drill-in addresses the block directly and never touches `page`
+        // (notion-api.ts readNotionComments returns early on it), so fencing `page` alone would leave the
+        // whole fence bypassable in one argument. Costs one `GET /v1/blocks/{id}` only when the block
+        // isn't already in scope by id — the common case (a top-level block of this very page) still
+        // pays it, which is the honest price of not trusting a caller-supplied id.
+        if (input.block) {
+            await assertNotionBlockAllowed(ctx2, input.block, domains, (id) => resolveBlockOwningPage(id, { ...cred }));
+        }
+        const res = await readNotionComments(page, {
+            ...cred,
+            block: input.block,
+            maxComments: MAX_COMMENTS,
+            maxBlockScans: MAX_BLOCK_SCANS,
+        });
+        // OPE-1026 — the moment the fetch above returned. Stamped AFTER the fetch, so it never claims a
+        // read is fresher than it is (see read_linear_issue.ts's `readAt`).
+        const readAt = new Date().toISOString();
+        // OPE-331 — resolve the workspace tier where a ctx exists; fail-soft to absent (the table's
+        // pre-existing fail-closed answer).
+        let workspaceTrust;
+        try {
+            workspaceTrust = declaredWorkspaceTrust(resolvePartition(ctx2).workspaceKey);
+        }
+        catch {
+            workspaceTrust = undefined;
+        }
+        return {
+            page,
+            discussions: res.discussionCount,
+            comments: res.comments.length,
+            blocksScanned: res.blocksScanned,
+            truncated: res.truncated,
+            text: renderComments(res.comments, readAt),
+            readAt,
+            ...(workspaceTrust !== undefined ? { workspaceTrust } : {}),
+        };
+    },
+    toModelOutput(output) {
+        const header = output.comments === 0
+            ? `Notion page ${output.page} has no readable comments.`
+            : `Notion page ${output.page} — ${output.comments} comment(s) across ${output.discussions} discussion(s):`;
+        const suffix = output.truncated ? "\n\n[truncated — the page has more comments/blocks than shown]" : "";
+        // OPE-1026 — THE PROVENANCE LINE, only when there is comment text to date (Linear's pattern,
+        // §OPE-1012): the comments above are dated against THIS read, and a comment's claim about status
+        // or approval is HISTORY, not the page's current state. `read_notion_page` is the tool that reads
+        // the page's current content — this one never claims to.
+        const asOf = output.comments > 0 && output.readAt
+            ? `\n\nRead live at ${output.readAt}: the comments above are HISTORY, each dated against this read. A comment's claim about status, approval or progress is not the page's current state — read the page itself (read_notion_page) for that.`
+            : "";
+        const body = output.comments === 0 ? header : `${header}\n${output.text}${suffix}${asOf}`;
+        // OPE-324 — `workspaceTrust` (plumbed OPE-331) is the DECISION here, same route and same meaning
+        // as read_notion_page's (see its note): a vouched-internal workspace fences without tainting, an
+        // unvouched one falls closed and taints, and the `assumed` flag says the operator never vouched
+        // it rather than that OE could not look.
+        return ingestUntrustedModelOutput(body, {
+            source: `notion comments ${output.page}`,
+            ingestion: {
+                kind: "notion",
+                label: "read_notion_comments",
+                ...(output.workspaceTrust !== undefined ? { workspaceTrust: output.workspaceTrust } : {}),
+            },
+        });
+    },
+});
+preRegisterDynamicEntry("read_notion_comments", "_single", readNotionCommentsEntry);
+export default defineDynamic({
+    events: {
+        // session.started ONLY: a session runs on exactly one surface (see read_notion_page.ts).
+        "session.started": (_event, ctx) => {
+            // THE CHAT ARM (§A5), narrowed to the DELEGATED-WORKER grain by OPE-1014: mount iff `notion ∈`
+            // this window's sources AND the grain is `task`. This tool has NO work arm, so `task` is its whole
+            // mount: a conversational Notion seat reads the same comment layer through the generic
+            // `read_channel` / `read_thread`, which sweep a superset of what this tool returns.
+            if (!workerChatArmMount(ctx, "notion", () => getConfig().loadDomains()))
+                return null;
+            return readNotionCommentsEntry;
+        },
+    },
+});
+//# sourceMappingURL=read_notion_comments.js.map

package/dist/agent/tools/read_notion_comments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read_notion_comments.js","sourceRoot":"","sources":["../../../agent/tools/read_notion_comments.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,qGAAqG;AACrG,iGAAiG;AACjG,gGAAgG;AAChG,uFAAuF;AACvF,EAAE;AACF,oGAAoG;AACpG,iGAAiG;AACjG,gGAAgG;AAChG,mGAAmG;AACnG,qGAAqG;AACrG,4CAA4C;AAC5C,EAAE;AACF,qGAAqG;AACrG,oGAAoG;AACpG,oGAAoG;AACpG,EAAE;AACF,oGAAoG;AACpG,oGAAoG;AACpG,gGAAgG;AAChG,gBAAgB;AAChB,EAAE;AACF,oGAAoG;AACpG,sGAAsG;AACtG,8FAA8F;AAC9F,oGAAoG;AACpG,qGAAqG;AACrG,kGAAkG;AAClG,kGAAkG;AAClG,0FAA0F;AAC1F,EAAE;AACF,oGAAoG;AACpG,wGAAwG;AACxG,mGAAmG;AACnG,gGAAgG;AAChG,oGAAoG;AACpG,kGAAkG;AAClG,mGAAmG;AACnG,sDAAsD;AAEtD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,uBAAuB,EAA6B,MAAM,2BAA2B,CAAC;AAC3I,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAChG,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,QAAQ,EACR,kBAAkB,EAClB,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,SAAS,GAGV,MAAM,4CAA4C,CAAC;AAEpD,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;;;oDAMoD;AACpD,SAAS,cAAc,CAAC,QAAyC,EAAE,MAAe;IAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,8EAA8E;IAC9E,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,WAAW,CAAC;QACtC,IAAI,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,EAAE,CAAC;YACV,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;QAC5D,MAAM,IAAI,GAAG,uBAAuB,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,IAAI,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC;YACtF,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,OAAO,OAAO,GAAG,GAAG,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,gGAAgG;AAChG,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,UAAU,CAAC;IAChD,WAAW,EACT,iGAAiG;QACjG,6FAA6F;QAC7F,+FAA+F;QAC/F,uGAAuG;IACzG,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,IAAI,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,4GAA4G,CAAC;QACzH,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,EAAE;aACV,QAAQ,CAAC,iGAAiG,CAAC;KAC/G,CAAC;IACF,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC;QACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;QACzB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,6FAA6F;QAC7F,8FAA8F;QAC9F,oFAAoF;QACpF,6DAA6D;QAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,iGAAiG;QACjG,8FAA8F;QAC9F,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC1D,CAAC;IACF,iGAAiG;IACjG,yGAAyG;IACzG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI;QACvB,kGAAkG;QAClG,iEAAiE;QACjE,iFAAiF;QACjF,IAAI,CAAC;YACH,iBAAiB,CAAC,IAAuB,EAAE,QAAQ,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,oBAAoB;gBAAE,MAAM,uBAAuB,CAAC,IAAuB,EAAE,QAAQ,CAAC,CAAC;YAC1G,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,mFAAmF;QACnF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAuB,CAAC,CAAC,OAAO,CAAC;QACrE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;QACrG,yFAAyF;QACzF,gGAAgG;QAChG,gFAAgF;QAChF,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,uBAAuB,CAAC,IAAuB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACtE,gGAAgG;QAChG,0FAA0F;QAC1F,+FAA+F;QAC/F,8EAA8E;QAC9E,2FAA2F;QAC3F,+FAA+F;QAC/F,uFAAuF;QACvF,+FAA+F;QAC/F,+FAA+F;QAC/F,0DAA0D;QAC1D,MAAM,0BAA0B,CAAC,IAAuB,EAAE,sBAAsB,CAAC,CAAC;QAClF,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,sBAAsB,CAAC,IAAuB,EAAE,OAAO,CAAC,CAAC,CAAC;QACrG,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QACtG,iGAAiG;QACjG,kGAAkG;QAClG,8FAA8F;QAC9F,6FAA6F;QAC7F,2EAA2E;QAC3E,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,wBAAwB,CAAC,IAAuB,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;QACjI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE;YACzC,GAAG,IAAI;YACP,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,YAAY;YACzB,aAAa,EAAE,eAAe;SAC/B,CAAC,CAAC;QACH,gGAAgG;QAChG,oEAAoE;QACpE,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,4FAA4F;QAC5F,oCAAoC;QACpC,IAAI,cAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,cAAc,GAAG,sBAAsB,CAAC,gBAAgB,CAAC,IAAuB,CAAC,CAAC,YAAY,CAAC,CAAC;QAClG,CAAC;QAAC,MAAM,CAAC;YACP,cAAc,GAAG,SAAS,CAAC;QAC7B,CAAC;QACD,OAAO;YACL,IAAI;YACJ,WAAW,EAAE,GAAG,CAAC,eAAe;YAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM;YAC7B,aAAa,EAAE,GAAG,CAAC,aAAa;YAChC,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC;YAC1C,MAAM;YACN,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D,CAAC;IACJ,CAAC;IACD,aAAa,CAAC,MAAM;QAClB,MAAM,MAAM,GACV,MAAM,CAAC,QAAQ,KAAK,CAAC;YACnB,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,4BAA4B;YACxD,CAAC,CAAC,eAAe,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,QAAQ,sBAAsB,MAAM,CAAC,WAAW,iBAAiB,CAAC;QAC/G,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,gEAAgE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxG,6FAA6F;QAC7F,iGAAiG;QACjG,kGAAkG;QAClG,yDAAyD;QACzD,MAAM,IAAI,GACR,MAAM,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM;YAClC,CAAC,CAAC,oBAAoB,MAAM,CAAC,MAAM,0MAA0M;YAC7O,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,MAAM,CAAC,IAAI,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;QAC1F,iGAAiG;QACjG,iGAAiG;QACjG,gGAAgG;QAChG,yCAAyC;QACzC,OAAO,0BAA0B,CAAC,IAAI,EAAE;YACtC,MAAM,EAAE,mBAAmB,MAAM,CAAC,IAAI,EAAE;YACxC,SAAS,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,sBAAsB;gBAC7B,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1F;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAC,CAAC;AACH,uBAAuB,CAAC,sBAAsB,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC;AAEpF,eAAe,aAAa,CAAC;IAC3B,MAAM,EAAE;QACN,yFAAyF;QACzF,iBAAiB,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;YACjC,+FAA+F;YAC/F,mGAAmG;YACnG,uFAAuF;YACvF,oFAAoF;YACpF,IAAI,CAAC,kBAAkB,CAAC,GAAsB,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxG,OAAO,uBAAuB,CAAC;QACjC,CAAC;KACF;CACF,CAAC,CAAC"}

package/dist/agent/tools/read_notion_page.d.ts

@@ -0,0 +1,53 @@
+import { type SurfaceTrust } from "@open-everywhere/core/agent/adapter-api.js";
+export declare const readNotionPageEntry: import("eve/tools").ToolDefinition<{
+    page?: string | undefined;
+}, {
+    page: string;
+    title?: string | undefined;
+    url?: string | undefined;
+    blocks: number;
+    truncated: boolean;
+    text: string;
+    readAt?: string | undefined;
+    workspaceTrust?: "internal" | "public" | undefined;
+}> & {
+    execute(input: {
+        page?: string | undefined;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        page: string;
+        title?: string | undefined;
+        url?: string | undefined;
+        blocks: number;
+        truncated: boolean;
+        text: string;
+        readAt: string;
+        workspaceTrust?: SurfaceTrust | undefined;
+    }>;
+};
+declare const _default: import("eve/tools").DynamicSentinel<(import("eve/tools").ToolDefinition<{
+    page?: string | undefined;
+}, {
+    page: string;
+    title?: string | undefined;
+    url?: string | undefined;
+    blocks: number;
+    truncated: boolean;
+    text: string;
+    readAt?: string | undefined;
+    workspaceTrust?: "internal" | "public" | undefined;
+}> & {
+    execute(input: {
+        page?: string | undefined;
+    }, ctx: import("eve/tools").ToolContext): Promise<{
+        page: string;
+        title?: string | undefined;
+        url?: string | undefined;
+        blocks: number;
+        truncated: boolean;
+        text: string;
+        readAt: string;
+        workspaceTrust?: SurfaceTrust | undefined;
+    }>;
+}) | null>;
+export default _default;
+//# sourceMappingURL=read_notion_page.d.ts.map

package/dist/agent/tools/read_notion_page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read_notion_page.d.ts","sourceRoot":"","sources":["../../../agent/tools/read_notion_page.ts"],"names":[],"mappings":"AAsDA,OAAO,EAYL,KAAK,YAAY,EAElB,MAAM,4CAA4C,CAAC;AAYpD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;CAqP9B,CAAC"}