@useconductor/conductor 1.0.0

package/src/plugins/builtin/notion.ts

@@ -0,0 +1,348 @@
+/**
+ * Notion Plugin
+ *
+ * Search, read, and create pages and databases in Notion.
+ * Requires a Notion Integration API key.
+ *
+ * Setup:
+ *   1. Go to https://www.notion.so/my-integrations and create an integration
+ *   2. Copy the "Internal Integration Token" (starts with ntn_)
+ *   3. Share each workspace page/db you want to access with your integration
+ *   4. Run: conductor plugins config notion token <YOUR_TOKEN>
+ *      OR set it during install when prompted
+ *
+ * Stored in keychain as: notion / api_key
+ */
+
+import { Plugin, PluginTool } from '../manager.js';
+import { Conductor } from '../../core/conductor.js';
+import { Keychain } from '../../security/keychain.js';
+
+const NOTION_BASE = 'https://api.notion.com/v1';
+const NOTION_VERSION = '2022-06-28';
+
+export class NotionPlugin implements Plugin {
+  name = 'notion';
+  description = 'Read, search, and create Notion pages and databases — requires Notion API key';
+  version = '1.0.0';
+
+  configSchema = {
+    fields: [
+      {
+        key: 'api_key',
+        label: 'Internal Integration Token',
+        type: 'password' as const,
+        required: true,
+        secret: true,
+        service: 'notion',
+        description: 'Copy your token (starts with ntn_) from Notion Developer portal.',
+      },
+    ],
+    setupInstructions:
+      '1. Visit Notion Settings > My integrations. 2. Create a new "Internal Integration". 3. Copy the token. 4. Ensure you "Connect" the integration to the pages you want Conductor to access.',
+  };
+
+  private keychain!: Keychain;
+
+  async initialize(conductor: Conductor): Promise<void> {
+    this.keychain = new Keychain(conductor.getConfig().getConfigDir());
+  }
+
+  isConfigured(): boolean {
+    return true;
+  }
+
+  private async getToken(): Promise<string> {
+    const token = await this.keychain.get('notion', 'api_key');
+    if (!token) {
+      throw new Error(
+        'Notion not configured. Get your integration token from https://www.notion.so/my-integrations\n' +
+          'Then run: conductor plugins config notion token <YOUR_TOKEN>',
+      );
+    }
+    return token;
+  }
+
+  private async notionFetch(
+    path: string,
+    options: {
+      method?: string;
+      body?: any;
+    } = {},
+  ): Promise<any> {
+    const token = await this.getToken();
+    const res = await fetch(`${NOTION_BASE}${path}`, {
+      method: options.method ?? 'GET',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json',
+        'Notion-Version': NOTION_VERSION,
+      },
+      body: options.body ? JSON.stringify(options.body) : undefined,
+    });
+    if (!res.ok) {
+      const err = (await res.json().catch(() => ({ message: res.statusText }))) as any;
+      throw new Error(`Notion API ${res.status}: ${err.message ?? res.statusText}`);
+    }
+    return res.json();
+  }
+
+  /** Extract plain text from Notion rich_text blocks */
+  private richText(blocks: any[]): string {
+    return (blocks ?? []).map((b: any) => b.plain_text ?? '').join('');
+  }
+
+  /** Extract plain text from a block's content */
+  private blockText(block: any): string {
+    const type = block.type;
+    const content = block[type];
+    if (!content) return '';
+    if (content.rich_text) return this.richText(content.rich_text);
+    return '';
+  }
+
+  /** Format a page for clean output */
+  private formatPage(page: any) {
+    const props = page.properties ?? {};
+    const titleProp: any = props.title ?? props.Name ?? Object.values(props).find((p: any) => p.type === 'title') ?? {};
+    const title = this.richText(titleProp.title ?? []);
+    return {
+      id: page.id,
+      title: title || '(Untitled)',
+      url: page.url ?? '',
+      createdTime: page.created_time ?? '',
+      lastEditedTime: page.last_edited_time ?? '',
+      archived: page.archived ?? false,
+      parent:
+        page.parent?.type === 'database_id'
+          ? { type: 'database', id: page.parent.database_id }
+          : page.parent?.type === 'page_id'
+            ? { type: 'page', id: page.parent.page_id }
+            : { type: 'workspace' },
+    };
+  }
+
+  getTools(): PluginTool[] {
+    return [
+      // ── notion_search ───────────────────────────────────────────────────────
+      {
+        name: 'notion_search',
+        description: 'Search Notion pages and databases by title',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            query: { type: 'string', description: 'Search term' },
+            filter: {
+              type: 'string',
+              enum: ['page', 'database'],
+              description: 'Filter to only pages or only databases',
+            },
+            maxResults: { type: 'number', description: 'Max results (default: 10)' },
+          },
+          required: ['query'],
+        },
+        handler: async ({ query, filter, maxResults = 10 }: any) => {
+          const body: any = { query, page_size: Math.min(maxResults, 100) };
+          if (filter) body.filter = { value: filter, property: 'object' };
+
+          const res = await this.notionFetch('/search', { method: 'POST', body });
+          return {
+            count: res.results?.length ?? 0,
+            results: (res.results ?? []).map((r: any) => ({
+              ...this.formatPage(r),
+              type: r.object,
+            })),
+          };
+        },
+      },
+
+      // ── notion_get_page ─────────────────────────────────────────────────────
+      {
+        name: 'notion_get_page',
+        description: 'Get metadata and properties of a Notion page',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            pageId: {
+              type: 'string',
+              description: 'Notion page ID or URL',
+            },
+          },
+          required: ['pageId'],
+        },
+        handler: async ({ pageId }: any) => {
+          // Accept full URLs — extract ID from them
+          const id = pageId.includes('notion.so')
+            ? (pageId.split('/').pop()?.split('?')[0]?.replace(/-/g, '').slice(-32) ?? pageId)
+            : pageId;
+          const page = await this.notionFetch(`/pages/${id}`);
+          return this.formatPage(page);
+        },
+      },
+
+      // ── notion_read_page ────────────────────────────────────────────────────
+      {
+        name: 'notion_read_page',
+        description: 'Read the full text content of a Notion page (blocks)',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            pageId: { type: 'string', description: 'Notion page ID or URL' },
+            maxChars: { type: 'number', description: 'Max characters (default: 8000)' },
+          },
+          required: ['pageId'],
+        },
+        handler: async ({ pageId, maxChars = 8000 }: any) => {
+          const id = pageId.includes('notion.so')
+            ? (pageId.split('/').pop()?.split('?')[0]?.replace(/-/g, '').slice(-32) ?? pageId)
+            : pageId;
+
+          const [page, blocks] = await Promise.all([
+            this.notionFetch(`/pages/${id}`),
+            this.notionFetch(`/blocks/${id}/children?page_size=100`),
+          ]);
+
+          const lines = (blocks.results ?? [])
+            .map((b: any) => {
+              const text = this.blockText(b);
+              const type = b.type;
+              if (type === 'heading_1') return `# ${text}`;
+              if (type === 'heading_2') return `## ${text}`;
+              if (type === 'heading_3') return `### ${text}`;
+              if (type === 'bulleted_list_item') return `• ${text}`;
+              if (type === 'numbered_list_item') return `1. ${text}`;
+              if (type === 'to_do') return `[${b.to_do?.checked ? 'x' : ' '}] ${text}`;
+              if (type === 'divider') return '---';
+              if (type === 'code')
+                return `\`\`\`${b.code?.language ?? ''}\n${this.richText(b.code?.rich_text ?? [])}\n\`\`\``;
+              return text;
+            })
+            .filter(Boolean)
+            .join('\n');
+
+          return {
+            ...this.formatPage(page),
+            content: lines.slice(0, maxChars),
+            truncated: lines.length > maxChars,
+            blockCount: blocks.results?.length ?? 0,
+          };
+        },
+      },
+
+      // ── notion_create_page ──────────────────────────────────────────────────
+      {
+        name: 'notion_create_page',
+        description: 'Create a new Notion page',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            title: { type: 'string', description: 'Page title' },
+            content: { type: 'string', description: 'Plain text content for the page body' },
+            parentPageId: {
+              type: 'string',
+              description: 'Parent page ID — page will be created as a child',
+            },
+            parentDatabaseId: {
+              type: 'string',
+              description: 'Parent database ID — page will be created as a database entry',
+            },
+          },
+          required: ['title'],
+        },
+        handler: async ({ title, content, parentPageId, parentDatabaseId }: any) => {
+          if (!parentPageId && !parentDatabaseId) {
+            throw new Error('Provide either parentPageId or parentDatabaseId.');
+          }
+
+          const parent = parentDatabaseId ? { database_id: parentDatabaseId } : { page_id: parentPageId };
+
+          const titleProp = parentDatabaseId
+            ? { Name: { title: [{ text: { content: title } }] } }
+            : { title: { title: [{ text: { content: title } }] } };
+
+          const children = content
+            ? content
+                .split('\n')
+                .filter(Boolean)
+                .map((line: string) => ({
+                  object: 'block',
+                  type: 'paragraph',
+                  paragraph: { rich_text: [{ text: { content: line } }] },
+                }))
+            : [];
+
+          const page = await this.notionFetch('/pages', {
+            method: 'POST',
+            body: { parent, properties: titleProp, children },
+          });
+
+          return { created: true, ...this.formatPage(page) };
+        },
+      },
+
+      // ── notion_append_to_page ───────────────────────────────────────────────
+      {
+        name: 'notion_append_to_page',
+        description: 'Append text content to the end of an existing Notion page',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            pageId: { type: 'string', description: 'Page ID to append to' },
+            content: { type: 'string', description: 'Text to append' },
+          },
+          required: ['pageId', 'content'],
+        },
+        handler: async ({ pageId, content }: any) => {
+          const children = content
+            .split('\n')
+            .filter(Boolean)
+            .map((line: string) => ({
+              object: 'block',
+              type: 'paragraph',
+              paragraph: { rich_text: [{ text: { content: line } }] },
+            }));
+
+          await this.notionFetch(`/blocks/${pageId}/children`, {
+            method: 'PATCH',
+            body: { children },
+          });
+
+          return { appended: true, pageId, linesAdded: children.length };
+        },
+      },
+
+      // ── notion_query_database ───────────────────────────────────────────────
+      {
+        name: 'notion_query_database',
+        description: 'Query a Notion database and return its entries',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            databaseId: { type: 'string', description: 'Database ID' },
+            maxResults: { type: 'number', description: 'Max entries to return (default: 20)' },
+            filter: {
+              type: 'object',
+              description: 'Notion filter object (optional)',
+            },
+          },
+          required: ['databaseId'],
+        },
+        handler: async ({ databaseId, maxResults = 20, filter }: any) => {
+          const body: any = { page_size: Math.min(maxResults, 100) };
+          if (filter) body.filter = filter;
+
+          const res = await this.notionFetch(`/databases/${databaseId}/query`, {
+            method: 'POST',
+            body,
+          });
+
+          return {
+            count: res.results?.length ?? 0,
+            hasMore: res.has_more ?? false,
+            entries: (res.results ?? []).map(this.formatPage.bind(this)),
+          };
+        },
+      },
+    ];
+  }
+}

package/src/plugins/builtin/shell.ts

@@ -0,0 +1,334 @@
+import { Plugin, PluginTool } from '../manager.js';
+import { Conductor } from '../../core/conductor.js';
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+import * as fs from 'fs/promises';
+import * as path from 'path';
+
+const execFileAsync = promisify(execFile);
+
+// Whitelist of safe commands — no shell interpretation
+const SAFE_COMMANDS = new Set([
+  'ls',
+  'cat',
+  'head',
+  'tail',
+  'wc',
+  'grep',
+  'find',
+  'stat',
+  'file',
+  'pwd',
+  'whoami',
+  'date',
+  'uptime',
+  'df',
+  'du',
+  'free',
+  'top',
+  'git',
+  'node',
+  'npm',
+  'pnpm',
+  'yarn',
+  'python',
+  'python3',
+  'pip',
+  'pip3',
+  'make',
+  'cmake',
+  'cargo',
+  'go',
+  'rustc',
+  'gcc',
+  'clang',
+  'curl',
+  'wget',
+  'ssh',
+  'scp',
+  'rsync',
+  'docker',
+  'docker-compose',
+  'kubectl',
+  'helm',
+  'terraform',
+  'ansible',
+  'vault',
+  'psql',
+  'mysql',
+  'mongosh',
+  'redis-cli',
+  'jq',
+  'yq',
+  'sed',
+  'awk',
+  'cut',
+  'sort',
+  'uniq',
+  'tr',
+  'xargs',
+  'zip',
+  'unzip',
+  'tar',
+  'gzip',
+  'chmod',
+  'chown',
+  'mkdir',
+  'rmdir',
+  'cp',
+  'mv',
+  'rm',
+  'touch',
+  'ln',
+  'diff',
+  'patch',
+  'md5sum',
+  'sha256sum',
+  'sha1sum',
+]);
+
+// Dangerous patterns that are never allowed even with approval
+const DANGEROUS_PATTERNS = [
+  /\brm\s+-rf\s+\/\b/,
+  /\bmkfs\b/,
+  /\bdd\s+if\b/,
+  /\bchmod\s+[0-7]*777\s+\/\b/,
+  /\bchown\s+-R\s+\S+\s+\/\b/,
+  /\b:\(\)\{\s*:\|:\s*&\s*\}\s*;:\b/, // fork bomb
+  /\/dev\/(zero|null|random|urandom)/,
+  /\bnc\s+-[el]/, // netcat listener
+  /\bpython.*-c.*import.*socket/,
+  /\bbash\s+-i/,
+  /\beval\b/,
+  /\bcurl.*\|\s*(ba)?sh\b/,
+  /\bwget.*-O-.*\|\s*(ba)?sh\b/,
+];
+
+function isDangerous(cmd: string): { safe: boolean; reason?: string } {
+  for (const pattern of DANGEROUS_PATTERNS) {
+    if (pattern.test(cmd)) {
+      return { safe: false, reason: `Command matches dangerous pattern: ${pattern.source}` };
+    }
+  }
+  return { safe: true };
+}
+
+function validatePathArg(arg: string): string {
+  const resolved = path.resolve(arg);
+  if (resolved.includes('..') && !resolved.startsWith(process.cwd())) {
+    throw new Error(
+      `COND-FS-001: Path traversal detected: ${arg}. Paths must be within the current working directory.`,
+    );
+  }
+  return resolved;
+}
+
+export class ShellPlugin implements Plugin {
+  name = 'shell';
+  description = 'Safe shell command execution with approval workflow and path validation';
+  version = '1.0.0';
+
+  async initialize(_conductor: Conductor): Promise<void> {}
+  isConfigured(): boolean {
+    return true;
+  }
+
+  private async runCommand(
+    cmd: string,
+    args: string[],
+    cwd?: string,
+  ): Promise<{ stdout: string; stderr: string; exitCode: number }> {
+    const workingDir = cwd ? validatePathArg(cwd) : process.cwd();
+    try {
+      const { stdout, stderr } = await execFileAsync(cmd, args, {
+        timeout: 120000,
+        maxBuffer: 10 * 1024 * 1024, // 10MB
+        cwd: workingDir,
+      });
+      return { stdout: stdout.trim(), stderr: stderr.trim(), exitCode: 0 };
+    } catch (err: unknown) {
+      if (err && typeof err === 'object' && 'code' in err) {
+        const e = err as { code?: number; stdout?: string; stderr?: string };
+        return {
+          stdout: (e.stdout ?? '').trim(),
+          stderr: (e.stderr ?? '').trim(),
+          exitCode: e.code ?? 1,
+        };
+      }
+      throw err;
+    }
+  }
+
+  getTools(): PluginTool[] {
+    return [
+      {
+        name: 'shell_run',
+        description:
+          'Run a shell command. Commands are validated against a safety whitelist. Dangerous commands are blocked entirely.',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            command: { type: 'string', description: 'Command to run (e.g. "ls -la")' },
+            cwd: { type: 'string', description: 'Working directory (must be within current project)' },
+          },
+          required: ['command'],
+        },
+        handler: async (input: { command: string; cwd?: string }) => {
+          const parts = input.command.trim().split(/\s+/);
+          const cmd = parts[0];
+
+          if (!cmd) throw new Error('COND-SYS-001: Empty command provided to shell executor.');
+          if (!SAFE_COMMANDS.has(cmd)) {
+            throw new Error(
+              `COND-SEC-001: Command "${cmd}" is not in the safe command whitelist. Allowed commands: ${Array.from(SAFE_COMMANDS).sort().join(', ')}. Review the whitelist in shell.ts for approved commands.`,
+            );
+          }
+
+          const safety = isDangerous(input.command);
+          if (!safety.safe)
+            throw new Error(
+              `COND-SEC-002: ${safety.reason ?? 'Command blocked by safety check'}. Review DANGEROUS_PATTERNS in shell.ts for blocked patterns.`,
+            );
+
+          const result = await this.runCommand(cmd, parts.slice(1), input.cwd);
+          return {
+            command: input.command,
+            cwd: input.cwd ?? process.cwd(),
+            exit_code: result.exitCode,
+            stdout: result.stdout,
+            stderr: result.stderr,
+          };
+        },
+        requiresApproval: true,
+      },
+      {
+        name: 'shell_read_file',
+        description: 'Read the contents of a file',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            path: { type: 'string', description: 'File path to read' },
+            limit: { type: 'number', description: 'Maximum bytes to read', default: 100000 },
+          },
+          required: ['path'],
+        },
+        handler: async (input: { path: string; limit?: number }) => {
+          const filePath = validatePathArg(input.path);
+          const stat = await fs.stat(filePath);
+          if (!stat.isFile())
+            throw new Error(`COND-FS-002: Not a file: ${input.path}. Verify the path exists and is a regular file.`);
+          const limit = input.limit ?? 100000;
+          if (stat.size > limit)
+            throw new Error(
+              `COND-FS-003: File too large (${stat.size} bytes). Limit: ${limit} bytes. Use shell_run with head command for large files, or increase the limit parameter.`,
+            );
+          const content = await fs.readFile(filePath, 'utf-8');
+          return { path: input.path, size: stat.size, content };
+        },
+      },
+      {
+        name: 'shell_write_file',
+        description: 'Write content to a file. Creates parent directories if needed.',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            path: { type: 'string', description: 'File path to write' },
+            content: { type: 'string', description: 'Content to write' },
+          },
+          required: ['path', 'content'],
+        },
+        handler: async (input: { path: string; content: string }) => {
+          const filePath = validatePathArg(input.path);
+          await fs.mkdir(path.dirname(filePath), { recursive: true });
+          await fs.writeFile(filePath, input.content, 'utf-8');
+          return { path: input.path, bytes_written: Buffer.byteLength(input.content, 'utf-8') };
+        },
+        requiresApproval: true,
+      },
+      {
+        name: 'shell_list_dir',
+        description: 'List directory contents',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            path: { type: 'string', description: 'Directory path', default: '.' },
+            recursive: { type: 'boolean', description: 'List recursively', default: false },
+          },
+        },
+        handler: async (input: { path?: string; recursive?: boolean; pattern?: string }) => {
+          const dirPath = validatePathArg(input.path ?? '.');
+          const stat = await fs.stat(dirPath);
+          if (!stat.isDirectory())
+            throw new Error(`COND-FS-004: Not a directory: ${input.path}. Verify the path exists and is a directory.`);
+          if (input.recursive) {
+            const { glob } = await import('glob');
+            const matches = await glob(input.pattern ?? '**/*', { cwd: dirPath, nodir: false });
+            return {
+              path: input.path ?? '.',
+              pattern: input.pattern ?? '**/*',
+              entries: matches.slice(0, 500),
+              truncated: matches.length > 500,
+            };
+          }
+          const entries = await fs.readdir(dirPath, { withFileTypes: true });
+          return {
+            path: input.path ?? '.',
+            entries: entries.map((e) => ({
+              name: e.name,
+              type: e.isDirectory() ? 'directory' : e.isFile() ? 'file' : 'other',
+            })),
+          };
+        },
+      },
+      {
+        name: 'shell_search_files',
+        description: 'Search for files by name pattern',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            path: { type: 'string', description: 'Directory to search in', default: '.' },
+            pattern: { type: 'string', description: 'Glob pattern (e.g. "*.ts", "**/*.test.ts")' },
+          },
+          required: ['pattern'],
+        },
+        handler: async (input: { pattern: string; path?: string }) => {
+          const dirPath = validatePathArg(input.path ?? '.');
+          const { glob } = await import('glob');
+          const matches = await glob(input.pattern, { cwd: dirPath, nodir: false });
+          return {
+            path: input.path ?? '.',
+            pattern: input.pattern,
+            matches: matches.slice(0, 200),
+            truncated: matches.length > 200,
+          };
+        },
+      },
+      {
+        name: 'shell_search_content',
+        description: 'Search file contents using grep',
+        inputSchema: {
+          type: 'object',
+          properties: {
+            pattern: { type: 'string', description: 'Regex pattern to search for' },
+            path: { type: 'string', description: 'Directory to search in', default: '.' },
+            include: { type: 'string', description: 'File glob to include (e.g. "*.ts")' },
+          },
+          required: ['pattern'],
+        },
+        handler: async (input: { pattern: string; path?: string; include?: string }) => {
+          const dirPath = validatePathArg(input.path ?? '.');
+          const args = ['-rn', '--color=never', input.pattern, dirPath];
+          if (input.include) args.push('--include', input.include);
+          const result = await this.runCommand('grep', args);
+          if (result.exitCode === 1) return { pattern: input.pattern, matches: [] };
+          if (result.exitCode > 1)
+            throw new Error(
+              `COND-SYS-002: Grep command failed with exit code ${result.exitCode}. Error: ${result.stderr}`,
+            );
+          const lines = result.stdout.split('\n').slice(0, 100);
+          return { pattern: input.pattern, matches: lines, truncated: result.stdout.split('\n').length > 100 };
+        },
+      },
+    ];
+  }
+}