dsh-notion-oauth 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+## 1.0.0
+
+First stable release.
+
+- OAuth 2.0 authorization code flow with PKCE (S256) and a verified `state`,
+  against the official Notion MCP server — no integration token to copy.
+- GUI sign-in: a **Notion** page under Settings with Login / Logout and a live
+  connection status.
+- CLI fallback: `dsh notion login`, `dsh notion logout`, `dsh notion status`.
+- Silent token refresh five minutes before expiry, retrying every minute while a
+  refresh keeps failing.
+- Notion tools exposed as `mcp__notion__*` through the official MCP server.
+- Localized display metadata (`locale/en.json`, `locale/zh.json`) and a vector icon.
+- Hardened local control routes: loopback-only, method-pinned, cross-site
+  refused, and JSON-only for state changes. The token never reaches the browser
+  half, and it is never logged.

package/LICENSE

@@ -0,0 +1,28 @@
+MIT License
+
+Copyright (c) 2026 dsh-notion-oauth contributors
+
+This plugin reuses code and design patterns from:
+
+- dsh-notion-mcp (https://github.com/zengming21/dsh-notion-mcp) — MIT
+  Copyright (c) 2026 mingzeng
+- dsh-notion-connector (https://github.com/zhengjy01/dsh-notion-connector) — MIT
+  Copyright (c) 2026 zhengjunyao
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,82 @@
+# dsh-notion-oauth
+
+Notion integration for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) via the official Notion MCP server with OAuth 2.0 (authorization code + PKCE).
+
+## Features
+
+- **GUI login** — a "Notion" page under Settings with a one-click Login (no terminal, no Integration Token).
+- **CLI fallback** — `dsh notion login` for headless / CLI profiles.
+- **OAuth + PKCE** — dynamic client registration (RFC 7591), no `client_id`/secret to copy.
+- **Silent refresh** — access token refreshed automatically; refresh token rotated atomically.
+- **Tools as `mcp__notion__*`** — search, read/create pages, databases, comments via the official MCP server.
+
+## Install
+
+Via the DSH GUI: Settings → Plugins → Add plugin → `dsh-notion-oauth`.
+
+Or via CLI:
+
+```sh
+dsh plugin --profile <name> add dsh-notion-oauth
+```
+
+## Usage
+
+1. Open Settings → Notion → Login.
+2. Approve access in the browser.
+3. The token is stored in DSH credentials; the `mcp__notion__*` tools become available.
+
+## Config
+
+| Key | Default | Meaning |
+|---|---|---|
+| `mcpUrl` | `https://mcp.notion.com/mcp` | Notion MCP server URL |
+| `port` | `53007` | Local OAuth callback port (`127.0.0.1`) |
+| `refreshLeadMs` | `300000` (5 min) | Refresh the token this far before it expires |
+| `refreshRetryMs` | `60000` (1 min) | Retry interval when a refresh attempt fails |
+
+## Security
+
+- **Loopback-only control routes.** The Settings page talks to
+  `/api/dsh-notion-oauth/{status,login,logout}`. Each route is pinned to one HTTP
+  method (`GET /status`, `POST /login`, `POST /logout`) and accepts only requests
+  whose remote address and `Host` are loopback and that are not `Sec-Fetch-Site:
+  cross-site`. When an `Origin` is present it must be the app itself
+  (`dsh-app://app`) or the same host. The Desktop shell proxies renderer calls and
+  strips `Origin`/`Sec-Fetch-Site`, so an absent `Origin` is normal; the two POST
+  routes therefore additionally require `Content-Type: application/json` — not a
+  CORS-simple value, so a cross-site caller first needs a preflight that these
+  routes reject.
+- **OAuth hardening.** Authorization code + PKCE (S256), a per-flow `state` the
+  callback server verifies, and a 10-minute deadline on the callback. A malformed
+  or forged callback is answered with 400 and leaves the pending login running,
+  so a stray local request cannot kill a real authorization.
+- **Transport.** `mcpUrl` must be `https://` — the plugin refuses to load
+  otherwise. Discovery endpoints (authorization, token, registration) are read
+  from whatever the `mcpUrl` resource advertises, so keep it on a trusted origin.
+- **Token at rest.** The access/refresh token is stored as a single record in the
+  DSH credentials service (`NOTION_OAUTH`). That store is only as private as your
+  OS user account: tool processes run as the same user, so any plugin with
+  credentials access can read every stored secret (`NOTION_OAUTH`,
+  `DEEPSEEK_API_KEY`, …), not just its own. The token is never exposed to the
+  browser half, never returned by an HTTP route, and never written to logs.
+
+## Development
+
+```sh
+pnpm install      # installs dev dependencies and builds lib/ via the prepare hook
+pnpm run build    # rebuilds lib/index.js (host) and lib/client.js (browser half)
+```
+
+`lib/` is build output and is not committed; `pnpm install` and `pnpm pack`
+regenerate it through the `prepare` script.
+
+`pnpm run typecheck` checks the sources against the DSH host packages
+(`@deepseek-ai/*`). DeepSeek Harness provides those at runtime, and their npm
+publication is currently incomplete — some transitive packages are missing from
+the registry — so typechecking needs an environment that supplies them. The
+build itself has no such dependency.
+
+## License
+
+MIT. Reuses code/patterns from `dsh-notion-mcp` and `dsh-notion-connector` (both MIT).

package/README.zh.md

@@ -0,0 +1,47 @@
+# dsh-notion-oauth
+
+通过官方 Notion MCP 服务器，用 OAuth 2.0（授权码 + PKCE）把 [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) 连接到 [Notion](https://www.notion.com)。
+
+## 特性
+
+- **GUI 一键登录** —— 设置页中的「Notion」页面提供一键 Login，无需终端、无需 Integration Token。
+- **CLI 备选** —— `dsh notion login` 适用于 headless / CLI 配置。
+- **OAuth + PKCE** —— 动态客户端注册（RFC 7591），无需复制 `client_id` 或密钥。
+- **静默刷新** —— access token 自动刷新，refresh token 原子轮换。
+- **工具以 `mcp__notion__*` 挂载** —— 通过官方 MCP 服务器搜索、读取/创建页面、数据库与评论。
+
+## 安装
+
+通过 DSH GUI：设置 → 插件 → 添加插件 → `dsh-notion-oauth`。
+
+或通过 CLI：
+
+```sh
+dsh plugin --profile <name> add dsh-notion-oauth
+```
+
+## 使用
+
+1. 打开 设置 → Notion → Login。
+2. 在浏览器中批准访问。
+3. Token 存入 DSH 凭据层，`mcp__notion__*` 工具随即可用。
+
+## 配置
+
+| 键 | 默认值 | 说明 |
+|---|---|---|
+| `mcpUrl` | `https://mcp.notion.com/mcp` | Notion MCP 服务器 URL |
+| `port` | `53007` | 本地 OAuth 回调端口（`127.0.0.1`） |
+| `refreshLeadMs` | `300000`（5 分钟） | 在令牌到期前提前这么久刷新 |
+| `refreshRetryMs` | `60000`（1 分钟） | 刷新失败时的重试间隔 |
+
+## 安全
+
+- **仅限回环的控制路由。** 设置页通过 `/api/dsh-notion-oauth/{status,login,logout}` 通信。每个路由固定一种 HTTP 方法（`GET /status`、`POST /login`、`POST /logout`），并且只接受远端地址与 `Host` 均为回环、且非 `Sec-Fetch-Site: cross-site` 的请求。当请求携带 `Origin` 时，它必须是应用自身（`dsh-app://app`）或同源主机。Desktop 外壳会代理渲染进程的请求并**剥离** `Origin` 与 `Sec-Fetch-Site`，因此 `Origin` 缺失属于正常情况；两个 POST 路由因此额外要求 `Content-Type: application/json` —— 它不属于 CORS 简单值，跨站调用方必须先通过被本路由拒绝的预检请求。
+- **OAuth 加固。** 授权码 + PKCE（S256）、每次流程独立的 `state`（由回调服务器校验），以及 10 分钟的回调截止时间。格式错误或伪造的回调返回 400，**不会**中断正在等待的登录。
+- **传输。** `mcpUrl` 必须是 `https://`，否则插件拒绝加载。发现端点（授权、令牌、注册）取自 `mcpUrl` 资源所声明的地址，因此请保持其来源可信。
+- **静态令牌。** access/refresh token 以单条记录存放在 DSH 凭据层（`NOTION_OAUTH`）。该存储的私密性仅等同于你的操作系统用户账户：工具进程以同一用户运行，因此任何拥有凭据访问权的插件都能读取**所有**已存密钥（`NOTION_OAUTH`、`DEEPSEEK_API_KEY` 等），而不只是自己的。令牌不会暴露给浏览器端、不会由任何 HTTP 路由返回，也不会写入日志。
+
+## 许可证
+
+MIT。复用了 `dsh-notion-mcp` 与 `dsh-notion-connector`（均为 MIT）的代码与设计模式。

package/cordis.patch.yml

@@ -0,0 +1,9 @@
+# dsh-notion-oauth bundle patch: inserts the dual-face plugin row into the
+# profile roster. Applied as a profile bundle layer (the `dsh.bundle.patch`
+# manifest field). Install with:
+#   dsh plugin --profile <name> add <package>
+# The node half (exports ".") runs in the host process (OAuth, /api/dsh-notion-oauth
+# routes, MCP mount); the browser half (exports "./client") renders the settings page.
+- insert:
+    - id: notion
+      name: 'dsh-notion-oauth'

package/icon.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32" width="32" height="32" role="img" aria-label="Notion">
+  <title>Notion</title>
+  <path d="M6.08 22.98 L6.08 7.23 L10.06 7.23 L15.74 18.46 L15.74 7.23 L19.73 7.23 L19.73 22.98 L15.74 22.98 L10.06 11.74 L10.06 22.98 Z M6.08 22.98 L6.08 7.23 L7.98 7.93 L7.98 23.68 Z M6.08 7.23 L10.06 7.23 L11.96 7.93 L7.98 7.93 Z M11.96 7.93 L17.64 19.16 L15.74 18.46 L10.06 7.23 Z M15.74 18.46 L15.74 7.23 L17.64 7.93 L17.64 19.16 Z M15.74 7.23 L19.73 7.23 L21.62 7.93 L17.64 7.93 Z M21.62 7.93 L21.62 23.68 L19.73 22.98 L19.73 7.23 Z M21.62 23.68 L17.64 23.68 L15.74 22.98 L19.73 22.98 Z M15.74 22.98 L10.06 11.74 L11.96 12.44 L17.64 23.68 Z M11.96 12.44 L11.96 23.68 L10.06 22.98 L10.06 11.74 Z M11.96 23.68 L7.98 23.68 L6.08 22.98 L10.06 22.98 Z" fill="#D0D4DA"/>
+  <path d="M7.98 23.68 L7.98 7.93 L11.96 7.93 L17.64 19.16 L17.64 7.93 L21.62 7.93 L21.62 23.68 L17.64 23.68 L11.96 12.44 L11.96 23.68 Z" fill="#111111"/>
+  <circle cx="24.9" cy="24.9" r="4.4" fill="#16A34A" stroke="#FFFFFF" stroke-width="1.5"/>
+</svg>

package/lib/client.js

@@ -0,0 +1,185 @@
+window.__ModuleLoader__.load({
+	id: "dsh-notion-oauth",
+	factory: (require) => {
+		var module = { exports: {} };
+		var exports = module.exports;
+		Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+  "use strict";
+  var __defProp = Object.defineProperty;
+  var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+  var __getOwnPropNames = Object.getOwnPropertyNames;
+  var __hasOwnProp = Object.prototype.hasOwnProperty;
+  var __export = (target, all) => {
+    for (var name in all)
+      __defProp(target, name, { get: all[name], enumerable: true });
+  };
+  var __copyProps = (to, from, except, desc) => {
+    if (from && typeof from === "object" || typeof from === "function") {
+      for (let key of __getOwnPropNames(from))
+        if (!__hasOwnProp.call(to, key) && key !== except)
+          __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+    }
+    return to;
+  };
+  var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+  // src/client/index.ts
+  var index_exports = {};
+  __export(index_exports, {
+    apply: () => apply,
+    inject: () => inject
+  });
+  module.exports = __toCommonJS(index_exports);
+  var import_react2 = require("react");
+
+  // src/client/NotionSettings.tsx
+  var import_react = require("react");
+  var import_jsx_runtime = require("react/jsx-runtime");
+  var API = "/api/dsh-notion-oauth";
+  var POLL_MS = 4e3;
+  async function api(path, body) {
+    const response = await fetch(API + path, {
+      method: body === void 0 ? "GET" : "POST",
+      headers: body === void 0 ? void 0 : { "Content-Type": "application/json" },
+      body: body === void 0 ? void 0 : JSON.stringify(body),
+      signal: AbortSignal.timeout(15e3)
+    });
+    if (!response.ok) {
+      let detail = "";
+      try {
+        const j = await response.json();
+        if (typeof j?.error === "string") detail = j.error;
+      } catch {
+      }
+      throw new Error(detail ? `${detail} (HTTP ${response.status})` : `HTTP ${response.status}`);
+    }
+    return await response.json();
+  }
+  var styles = {
+    page: { display: "flex", flexDirection: "column", gap: 12, fontSize: 13, lineHeight: 1.5, padding: "4px 2px" },
+    title: { margin: 0, fontSize: 15 },
+    status: { display: "flex", alignItems: "center", gap: 9, padding: "9px 12px", borderRadius: 8, border: "1px solid transparent", fontWeight: 500 },
+    statusPending: { background: "rgba(127,127,127,.10)", borderColor: "rgba(127,127,127,.20)", opacity: 0.72 },
+    statusOn: { background: "rgba(34,197,94,.10)", borderColor: "rgba(34,197,94,.34)", color: "#16a34a" },
+    statusOff: { background: "rgba(229,72,77,.09)", borderColor: "rgba(229,72,77,.26)", color: "#e5484d" },
+    glyph: { width: 20, height: 20, borderRadius: "50%", display: "grid", placeItems: "center", fontSize: 12, lineHeight: 1, fontWeight: 700, flex: "0 0 auto" },
+    glyphPending: { background: "rgba(127,127,127,.18)" },
+    glyphOn: { background: "rgba(34,197,94,.18)", color: "#16a34a" },
+    glyphOff: { background: "rgba(229,72,77,.14)", color: "#e5484d" },
+    row: { display: "flex", alignItems: "center", gap: 8, flexWrap: "wrap" },
+    button: { padding: "5px 12px", borderRadius: 6, border: "1px solid rgba(127,127,127,.35)", background: "transparent", color: "inherit", font: "inherit", cursor: "pointer" },
+    buttonPrimary: { padding: "5px 12px", borderRadius: 6, border: "1px solid #2563eb", background: "#2563eb", color: "#fff", font: "inherit", cursor: "pointer" },
+    buttonDisabled: { opacity: 0.5, cursor: "default" },
+    ok: { color: "#22c55e" },
+    err: { color: "#ef4444" },
+    info: { opacity: 0.72 },
+    hint: { opacity: 0.75, fontSize: 12 },
+    hintP: { margin: "4px 0" }
+  };
+  function NotionSettings() {
+    const [status, setStatus] = (0, import_react.useState)(null);
+    const [busy, setBusy] = (0, import_react.useState)(false);
+    const [note, setNote] = (0, import_react.useState)(null);
+    const pendingSeenRef = (0, import_react.useRef)(false);
+    const connected = status?.connected ?? false;
+    const refresh = (0, import_react.useCallback)(async () => {
+      try {
+        setStatus(await api("/status"));
+      } catch {
+      }
+    }, []);
+    (0, import_react.useEffect)(() => {
+      refresh();
+      const poll = window.setInterval(refresh, POLL_MS);
+      return () => window.clearInterval(poll);
+    }, [refresh]);
+    (0, import_react.useEffect)(() => {
+      if (status?.loginPending) pendingSeenRef.current = true;
+    }, [status?.loginPending]);
+    const waiting = busy && note?.kind === "info";
+    (0, import_react.useEffect)(() => {
+      if (!waiting || status === null) return;
+      if (status.connected) {
+        setBusy(false);
+        setNote(null);
+      } else if (pendingSeenRef.current && !status.loginPending) {
+        setBusy(false);
+        setNote({ kind: "err", text: "Authorization was not completed \u2014 please try again." });
+      }
+    }, [waiting, status]);
+    const login = (0, import_react.useCallback)(async () => {
+      setBusy(true);
+      setNote(null);
+      try {
+        const r = await api("/login", {});
+        if (!r.ok || !r.url) throw new Error(r.error ?? "login failed");
+        window.open(r.url, "_blank", "noopener");
+        setNote({ kind: "info", text: "Waiting for confirmation in the browser\u2026" });
+      } catch (e) {
+        setBusy(false);
+        setNote({ kind: "err", text: e instanceof Error ? e.message : String(e) });
+      }
+    }, []);
+    const logout = (0, import_react.useCallback)(async () => {
+      setBusy(true);
+      setNote(null);
+      try {
+        await api("/logout", {});
+        await refresh();
+      } catch (e) {
+        setNote({ kind: "err", text: e instanceof Error ? e.message : String(e) });
+      } finally {
+        setBusy(false);
+      }
+    }, [refresh]);
+    const view = status === null ? { label: "Checking\u2026", mark: "\u22EF", box: styles.statusPending, markStyle: styles.glyphPending } : connected ? { label: "Connected", mark: "\u2713", box: styles.statusOn, markStyle: styles.glyphOn } : { label: "Not connected", mark: "\u2715", box: styles.statusOff, markStyle: styles.glyphOff };
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: styles.page, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)("h2", { style: styles.title, children: "Notion (OAuth)" }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: { ...styles.status, ...view.box }, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { style: { ...styles.glyph, ...view.markStyle }, children: view.mark }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("span", { children: view.label })
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: styles.row, children: [
+        !connected && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          "button",
+          {
+            style: busy ? { ...styles.buttonPrimary, ...styles.buttonDisabled } : styles.buttonPrimary,
+            disabled: busy,
+            onClick: login,
+            children: "Login"
+          }
+        ),
+        connected && /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+          "button",
+          {
+            style: busy ? { ...styles.button, ...styles.buttonDisabled } : styles.button,
+            disabled: busy,
+            onClick: logout,
+            children: "Logout"
+          }
+        )
+      ] }),
+      note !== null && /* @__PURE__ */ (0, import_jsx_runtime.jsx)("div", { style: note.kind === "info" ? styles.info : styles.err, children: note.text }),
+      /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("div", { style: styles.hint, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: styles.hintP, children: "Authorizes through the official Notion MCP (OAuth) \u2014 no integration tokens. Permissions come from your Notion account." }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: styles.hintP, children: "After signing in, the mcp__notion__* tools become available (search, read and create pages, databases)." }),
+        /* @__PURE__ */ (0, import_jsx_runtime.jsx)("p", { style: styles.hintP, children: "The token renews in the background, so you only sign in once." })
+      ] })
+    ] });
+  }
+
+  // src/client/index.ts
+  var inject = ["slots"];
+  function apply(ctx) {
+    ctx.slots.inject(
+      "settings.section",
+      () => ctx.slots.register(
+        { name: "settings.section", id: "notion", order: 30, label: "Notion" },
+        () => (0, import_react2.createElement)(NotionSettings)
+      )
+    );
+  }
+
+		return module.exports;
+	}
+});

package/lib/index.js

@@ -0,0 +1,628 @@
+// src/index.ts
+import z from "@deepseek-ai/schemastery";
+import { Command } from "commander";
+import { parseCmdline } from "@deepseek-ai/dsh-cmdline";
+import * as mcpClient from "@deepseek-ai/dsh-mcp-client";
+
+// src/notion-oauth.ts
+import { createHash, randomBytes } from "node:crypto";
+var UA = `dsh-notion-oauth/${"1.0.0"}`;
+function withUA(init = {}) {
+  const headers = new Headers(init.headers);
+  if (!headers.has("User-Agent")) headers.set("User-Agent", UA);
+  return { ...init, headers };
+}
+function withTimeout(ms, init = {}) {
+  const signal = init.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(ms)]) : AbortSignal.timeout(ms);
+  return { ...init, signal };
+}
+function base64url(buf) {
+  return buf.toString("base64url");
+}
+function generateVerifier() {
+  return base64url(randomBytes(32));
+}
+function computeChallenge(verifier) {
+  return base64url(createHash("sha256").update(verifier).digest());
+}
+function generateState() {
+  return base64url(randomBytes(16));
+}
+async function fetchJson(url, init = {}, timeoutMs = 3e4) {
+  const res = await fetch(url, withUA(withTimeout(timeoutMs, init)));
+  if (!res.ok) throw new Error(`HTTP ${res.status} for ${url}`);
+  return res.json();
+}
+async function discoverOAuth(resourceBaseUrl) {
+  const origin = new URL(resourceBaseUrl).origin;
+  const doc = await fetchJson(`${origin}/.well-known/oauth-protected-resource`);
+  const authServer = doc.authorization_servers?.[0];
+  if (!authServer) throw new Error("OAuth discovery: no authorization_servers advertised");
+  if (!/^https:\/\//i.test(authServer)) {
+    throw new Error("OAuth discovery: authorization server must be https");
+  }
+  const meta = await fetchJson(`${authServer}/.well-known/oauth-authorization-server`);
+  const endpoints = {
+    authorizationEndpoint: meta.authorization_endpoint,
+    tokenEndpoint: meta.token_endpoint,
+    registrationEndpoint: meta.registration_endpoint
+  };
+  for (const [key, value] of Object.entries(endpoints)) {
+    if (typeof value !== "string" || !/^https:\/\//i.test(value)) {
+      throw new Error(`OAuth discovery: ${key} must be https`);
+    }
+  }
+  return endpoints;
+}
+async function registerClient(registrationEndpoint, redirectUris) {
+  const res = await fetch(registrationEndpoint, withUA(withTimeout(3e4, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      client_name: "dsh-notion-oauth",
+      redirect_uris: redirectUris,
+      token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"]
+    })
+  })));
+  if (!res.ok) throw new Error(`DCR failed: HTTP ${res.status}`);
+  const json = await res.json();
+  return json.client_id;
+}
+function buildAuthorizeUrl(authorizationEndpoint, opts) {
+  const url = new URL(authorizationEndpoint);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", opts.clientId);
+  url.searchParams.set("redirect_uri", opts.redirectUri);
+  url.searchParams.set("state", opts.state);
+  url.searchParams.set("code_challenge", opts.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url.toString();
+}
+function parseTokenBody(body) {
+  const accessToken = body.access_token;
+  const expiresIn = body.expires_in;
+  if (typeof accessToken !== "string" || accessToken.length === 0) {
+    throw new Error("token response missing access_token");
+  }
+  if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw new Error("token response missing or invalid expires_in");
+  }
+  return { accessToken, refreshToken: body.refresh_token, expiresIn };
+}
+async function exchangeCode(tokenEndpoint, opts) {
+  const res = await fetch(tokenEndpoint, withUA(withTimeout(6e4, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: opts.clientId,
+      code: opts.code,
+      redirect_uri: opts.redirectUri,
+      code_verifier: opts.codeVerifier
+    })
+  })));
+  if (!res.ok) throw new Error(`token exchange failed: HTTP ${res.status}`);
+  return parseTokenBody(await res.json());
+}
+var InvalidGrantError = class extends Error {
+  constructor() {
+    super("invalid_grant: refresh token expired or rotated away \u2014 re-authorize required");
+  }
+};
+async function refreshAccessToken(tokenEndpoint, opts) {
+  const res = await fetch(tokenEndpoint, withUA(withTimeout(6e4, {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      client_id: opts.clientId,
+      refresh_token: opts.refreshToken
+    })
+  })));
+  const body = await res.json().catch(() => ({}));
+  if (body.error === "invalid_grant") throw new InvalidGrantError();
+  if (!res.ok) throw new Error(`refresh failed: HTTP ${res.status}`);
+  return parseTokenBody(body);
+}
+
+// src/token-store.ts
+import { credentialRef } from "@deepseek-ai/dsh-credentials";
+var REF = credentialRef("NOTION_OAUTH");
+function isStoredTokens(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  return typeof v.accessToken === "string" && v.accessToken.length > 0 && typeof v.refreshToken === "string" && v.refreshToken.length > 0 && typeof v.clientId === "string" && v.clientId.length > 0 && typeof v.expiresAt === "number" && Number.isFinite(v.expiresAt);
+}
+var NotionTokenStore = class {
+  credentials;
+  constructor(credentials) {
+    this.credentials = credentials;
+  }
+  async load() {
+    const resolved = await this.credentials.resolve(REF);
+    if (!resolved) return void 0;
+    try {
+      const parsed = JSON.parse(resolved.value);
+      return isStoredTokens(parsed) ? parsed : void 0;
+    } catch {
+      return void 0;
+    }
+  }
+  async save(tokens) {
+    await this.credentials.set(REF, JSON.stringify(tokens));
+  }
+  async clear() {
+    await this.credentials.unset(REF);
+  }
+};
+
+// src/login-server.ts
+import { createServer } from "node:http";
+var DEFAULT_TIMEOUT_MS = 10 * 60 * 1e3;
+function page(options) {
+  const accent = options.ok ? "#16a34a" : "#dc2626";
+  const wash = options.ok ? "rgba(22,163,74,.12)" : "rgba(220,38,38,.12)";
+  const glyph = options.ok ? "&#10003;" : "&#10007;";
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Notion \xB7 DeepSeek Harness</title>
+<style>
+  :root { color-scheme: light dark; }
+  * { box-sizing: border-box; }
+  body {
+    margin: 0; min-height: 100vh; display: grid; place-items: center; padding: 24px;
+    font: 15px/1.55 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+    background: #f5f6f8; color: #1f2328;
+  }
+  @media (prefers-color-scheme: dark) { body { background: #15171c; color: #e7e9ec; } }
+  .card {
+    width: min(430px, 100%); padding: 30px 28px 24px; text-align: center;
+    background: #fff; border: 1px solid rgba(127,127,127,.2); border-radius: 16px;
+    box-shadow: 0 10px 30px rgba(0,0,0,.07);
+  }
+  @media (prefers-color-scheme: dark) { .card { background: #1d2026; border-color: rgba(255,255,255,.08); } }
+  .badge {
+    width: 54px; height: 54px; margin: 0 auto 18px; border-radius: 50%;
+    display: grid; place-items: center; font-size: 27px; font-weight: 700;
+    color: ${accent}; background: ${wash};
+  }
+  h1 { margin: 0 0 8px; font-size: 19px; font-weight: 650; letter-spacing: -.01em; }
+  p.detail { margin: 0; font-size: 14px; opacity: .72; }
+  .brand {
+    margin-top: 22px; padding-top: 14px; border-top: 1px solid rgba(127,127,127,.18);
+    font-size: 11.5px; letter-spacing: .04em; text-transform: uppercase; opacity: .45;
+  }
+</style>
+</head>
+<body>
+  <main class="card">
+    <div class="badge">${glyph}</div>
+    <h1>${options.title}</h1>
+    <p class="detail">${options.detail}</p>
+    <div class="brand">DeepSeek Harness \xB7 Notion</div>
+  </main>
+  <script>${options.ok ? "setTimeout(function(){ window.close(); }, 900);" : ""}</script>
+</body>
+</html>
+`;
+}
+function startLoginServer(expectedState, port, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  return new Promise((resolveListen, rejectListen) => {
+    let settled = false;
+    let resolveWait;
+    let rejectWait;
+    const wait = new Promise((resolve, reject) => {
+      resolveWait = resolve;
+      rejectWait = reject;
+    });
+    wait.catch(() => {
+    });
+    let timer;
+    const finish = (settle) => {
+      if (settled) return;
+      settled = true;
+      if (timer !== void 0) clearTimeout(timer);
+      server.close();
+      settle();
+    };
+    const server = createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      const reply = (body, status = 200) => {
+        res.writeHead(status, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(body);
+      };
+      if (url.pathname !== "/callback") {
+        res.writeHead(404).end();
+        return;
+      }
+      const error = url.searchParams.get("error");
+      if (error) {
+        reply(page({
+          ok: false,
+          title: "Access denied",
+          detail: "Notion declined the authorization. Return to settings and try again."
+        }));
+        finish(() => rejectWait(new Error(`OAuth error: ${error}`)));
+        return;
+      }
+      const code = url.searchParams.get("code");
+      const state = url.searchParams.get("state");
+      if (!code || !state) {
+        reply(page({
+          ok: false,
+          title: "Invalid response",
+          detail: "The callback is missing the authorization code. Please try again."
+        }), 400);
+        return;
+      }
+      if (state !== expectedState) {
+        reply(page({
+          ok: false,
+          title: "Verification failed",
+          detail: "This request does not match the authorization that was started."
+        }), 400);
+        return;
+      }
+      reply(page({
+        ok: true,
+        title: "Authorization received",
+        detail: "Close this tab \u2014 the connection is finishing in DeepSeek Harness."
+      }));
+      finish(() => resolveWait({ code, state }));
+    });
+    server.on("error", (e) => {
+      if (settled) return;
+      settled = true;
+      if (timer !== void 0) clearTimeout(timer);
+      rejectListen(e);
+    });
+    timer = setTimeout(() => {
+      finish(() => rejectWait(new Error(`login timed out after ${Math.round(timeoutMs / 1e3)}s`)));
+    }, timeoutMs);
+    timer.unref?.();
+    server.listen(port, "127.0.0.1", () => {
+      const actual = server.address().port;
+      resolveListen({
+        redirectUri: `http://127.0.0.1:${actual}/callback`,
+        wait,
+        close: () => finish(() => rejectWait(new Error("login cancelled")))
+      });
+    });
+  });
+}
+
+// src/index.ts
+var name = "notion";
+var inject = ["credentials", "cmdlineArgs"];
+var Config = z.object({
+  mcpUrl: z.string().default("https://mcp.notion.com/mcp"),
+  port: z.number().default(53007),
+  refreshLeadMs: z.number().default(5 * 60 * 1e3),
+  refreshRetryMs: z.number().default(60 * 1e3)
+});
+var API_PREFIX = "/api/dsh-notion-oauth";
+function apply(ctx, config) {
+  const store = new NotionTokenStore(ctx.credentials);
+  if (!/^https:\/\//i.test(config.mcpUrl)) {
+    throw new Error(`dsh-notion-oauth: mcpUrl must be an https:// URL (got "${config.mcpUrl}")`);
+  }
+  const slot = {};
+  let pending;
+  let activeLoginClose;
+  let mounted = false;
+  let refreshTimer;
+  let loginStarting = false;
+  let tokenLock = Promise.resolve();
+  function unmount() {
+    if (refreshTimer !== void 0) {
+      clearTimeout(refreshTimer);
+      refreshTimer = void 0;
+    }
+    if (slot.child) {
+      slot.child.dispose();
+      slot.child = void 0;
+    }
+    mounted = false;
+  }
+  function mount(accessToken) {
+    unmount();
+    slot.child = ctx.plugin(mcpClient, {
+      transport: "streamable-http",
+      serverName: "notion",
+      url: config.mcpUrl,
+      headers: { Authorization: `Bearer ${accessToken}` },
+      toolCallTimeoutMs: 6e4,
+      failOnStartupError: false
+    });
+    mounted = true;
+  }
+  function armRefresh(delayMs) {
+    if (refreshTimer !== void 0) clearTimeout(refreshTimer);
+    refreshTimer = setTimeout(() => {
+      void runRefresh();
+    }, delayMs);
+    refreshTimer.unref?.();
+  }
+  async function runRefresh() {
+    try {
+      await refreshAndMount();
+    } catch (e) {
+      console.error("[dsh-notion-oauth] refresh failed:", e);
+      if (await store.load()) armRefresh(config.refreshRetryMs);
+    }
+  }
+  function mountAndSchedule(accessToken, expiresAt) {
+    mount(accessToken);
+    armRefresh(Math.max(3e4, expiresAt - Date.now() - config.refreshLeadMs));
+  }
+  function withTokenLock(fn) {
+    const run = tokenLock.then(fn, fn);
+    tokenLock = run.then(() => void 0, () => void 0);
+    return run;
+  }
+  function refreshAndMount() {
+    return withTokenLock(async () => {
+      const tokens = await store.load();
+      if (!tokens) return;
+      const disc = await discoverOAuth(config.mcpUrl);
+      let next;
+      try {
+        next = await refreshAccessToken(disc.tokenEndpoint, {
+          clientId: tokens.clientId,
+          refreshToken: tokens.refreshToken
+        });
+      } catch (e) {
+        if (e instanceof InvalidGrantError) {
+          await store.clear();
+          unmount();
+          return;
+        }
+        throw e;
+      }
+      const refreshed = {
+        accessToken: next.accessToken,
+        refreshToken: next.refreshToken ?? tokens.refreshToken,
+        expiresAt: Date.now() + next.expiresIn * 1e3,
+        clientId: tokens.clientId
+      };
+      await store.save(refreshed);
+      mountAndSchedule(refreshed.accessToken, refreshed.expiresAt);
+    });
+  }
+  function completePending(code) {
+    return withTokenLock(async () => {
+      if (!pending) throw new Error("no pending login");
+      const { endpoints, clientId, verifier, redirectUri } = pending;
+      const tokens = await exchangeCode(endpoints.tokenEndpoint, {
+        clientId,
+        code,
+        redirectUri,
+        codeVerifier: verifier
+      });
+      if (!tokens.refreshToken) throw new Error("authorization response missing refresh_token");
+      const stored = {
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+        expiresAt: Date.now() + tokens.expiresIn * 1e3,
+        clientId
+      };
+      await store.save(stored);
+      mountAndSchedule(stored.accessToken, stored.expiresAt);
+    });
+  }
+  async function beginLogin() {
+    if (loginStarting) throw new Error("login already in progress");
+    loginStarting = true;
+    try {
+      if (activeLoginClose) {
+        activeLoginClose();
+        activeLoginClose = void 0;
+        pending = void 0;
+      }
+      const endpoints = await discoverOAuth(config.mcpUrl);
+      const verifier = generateVerifier();
+      const state = generateState();
+      const { redirectUri, wait, close } = await startLoginServer(state, config.port);
+      activeLoginClose = close;
+      try {
+        const clientId = await registerClient(endpoints.registrationEndpoint, [redirectUri]);
+        const myPending = { endpoints, clientId, verifier, redirectUri };
+        pending = myPending;
+        const url = buildAuthorizeUrl(endpoints.authorizationEndpoint, {
+          clientId,
+          redirectUri,
+          state,
+          codeChallenge: computeChallenge(verifier)
+        });
+        const done = wait.then(({ code }) => completePending(code)).finally(() => {
+          if (activeLoginClose === close) activeLoginClose = void 0;
+          if (pending === myPending) pending = void 0;
+        });
+        done.catch((e) => console.error("[dsh-notion-oauth] login failed:", e));
+        return { url, done };
+      } catch (e) {
+        close();
+        if (activeLoginClose === close) activeLoginClose = void 0;
+        throw e;
+      }
+    } finally {
+      loginStarting = false;
+    }
+  }
+  function isTrustedRequest(req, method) {
+    if (req.method !== method) return false;
+    const addr = req.socket.remoteAddress;
+    if (addr !== "127.0.0.1" && addr !== "::1" && addr !== "::ffff:127.0.0.1") return false;
+    const host = req.headers.host;
+    if (typeof host !== "string") return false;
+    let hostUrl;
+    try {
+      hostUrl = new URL(`http://${host}`);
+    } catch {
+      return false;
+    }
+    const hn = hostUrl.hostname;
+    if (hn !== "127.0.0.1" && hn !== "localhost" && hn !== "[::1]") return false;
+    if (req.headers["sec-fetch-site"] === "cross-site") return false;
+    const origin = req.headers.origin;
+    if (origin !== void 0 && origin !== "dsh-app://app") {
+      try {
+        if (new URL(origin).host !== hostUrl.host) return false;
+      } catch {
+        return false;
+      }
+    }
+    if (method === "POST") {
+      const contentType = req.headers["content-type"];
+      if (typeof contentType !== "string" || !/^application\/json\b/i.test(contentType)) return false;
+    }
+    return true;
+  }
+  function writeJson(res, status, value) {
+    res.writeHead(status, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(value));
+  }
+  const routes = [
+    {
+      kind: "exact",
+      path: `${API_PREFIX}/status`,
+      handler: async (req, res) => {
+        if (!isTrustedRequest(req, "GET")) {
+          writeJson(res, 403, { error: "forbidden" });
+          return;
+        }
+        const tokens = await store.load();
+        const expiresAt = tokens?.expiresAt ?? null;
+        writeJson(res, 200, {
+          connected: mounted && expiresAt !== null && expiresAt > Date.now(),
+          mounted,
+          expiresAt,
+          loginPending: activeLoginClose !== void 0
+        });
+      }
+    },
+    {
+      kind: "exact",
+      path: `${API_PREFIX}/login`,
+      handler: async (req, res) => {
+        if (!isTrustedRequest(req, "POST")) {
+          writeJson(res, 403, { error: "forbidden" });
+          return;
+        }
+        try {
+          const { url } = await beginLogin();
+          writeJson(res, 200, { ok: true, url });
+        } catch (e) {
+          writeJson(res, 500, { ok: false, error: e instanceof Error ? e.message : String(e) });
+        }
+      }
+    },
+    {
+      kind: "exact",
+      path: `${API_PREFIX}/logout`,
+      handler: async (req, res) => {
+        if (!isTrustedRequest(req, "POST")) {
+          writeJson(res, 403, { error: "forbidden" });
+          return;
+        }
+        if (activeLoginClose) {
+          activeLoginClose();
+          activeLoginClose = void 0;
+          pending = void 0;
+        }
+        await store.clear();
+        unmount();
+        writeJson(res, 200, { ok: true });
+      }
+    }
+  ];
+  ctx.inject(["webServer"], (ctx2) => {
+    const disposers = routes.map((r) => ctx2.webServer.register(r));
+    return () => {
+      for (const d of disposers) d?.();
+    };
+  });
+  const isNotionCommand = (ctx.cmdlineArgs?.get?.() ?? [])[0] === "notion";
+  if (isNotionCommand) {
+    const program = new Command();
+    const notion = program.command("notion").description("Notion OAuth connection");
+    notion.command("login").description("Authorize Notion via the official MCP OAuth flow").action(async () => {
+      try {
+        const { url, done } = await beginLogin();
+        console.log(`[dsh-notion-oauth] open this URL to authorize Notion:
+${url}`);
+        await done;
+        console.log("[dsh-notion-oauth] connected");
+        ctx.appExit?.(0);
+      } catch (e) {
+        console.error(e);
+        ctx.appExit?.(1);
+      }
+    });
+    notion.command("logout").description("Disconnect Notion and forget the stored token").action(async () => {
+      try {
+        if (activeLoginClose) {
+          activeLoginClose();
+          activeLoginClose = void 0;
+          pending = void 0;
+        }
+        await store.clear();
+        unmount();
+        console.log("[dsh-notion-oauth] disconnected");
+        ctx.appExit?.(0);
+      } catch (e) {
+        console.error(e);
+        ctx.appExit?.(1);
+      }
+    });
+    notion.command("status").description("Show the stored Notion token state").action(async () => {
+      try {
+        const tokens = await store.load();
+        const valid = tokens !== void 0 && tokens.expiresAt > Date.now();
+        console.log(JSON.stringify({
+          token: tokens === void 0 ? "none" : valid ? "valid" : "expired",
+          expiresAt: tokens?.expiresAt ?? null
+        }, null, 2));
+        ctx.appExit?.(0);
+      } catch (e) {
+        console.error(e);
+        ctx.appExit?.(1);
+      }
+    });
+    parseCmdline(ctx, program);
+  }
+  if (!isNotionCommand) {
+    (async () => {
+      try {
+        const tokens = await store.load();
+        if (!tokens) return;
+        if (tokens.expiresAt > Date.now() + 6e4) {
+          mountAndSchedule(tokens.accessToken, tokens.expiresAt);
+        } else {
+          await refreshAndMount();
+        }
+      } catch (e) {
+        console.error("[dsh-notion-oauth] startup error:", e);
+        if (await store.load()) armRefresh(config.refreshRetryMs);
+      }
+    })();
+  }
+  ctx.effect(() => () => {
+    if (activeLoginClose) {
+      activeLoginClose();
+      activeLoginClose = void 0;
+      pending = void 0;
+    }
+    unmount();
+  });
+}
+export {
+  Config,
+  apply,
+  inject,
+  name
+};

package/locale/en.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Notion",
+    "description": "Connect Notion through the official Notion MCP with OAuth 2.0 + PKCE — sign in from the GUI."
+  }
+}

package/locale/zh.json

@@ -0,0 +1,6 @@
+{
+  "meta": {
+    "title": "Notion",
+    "description": "通过官方 Notion MCP 以 OAuth 2.0 + PKCE 连接 Notion —— 在图形界面中登录。"
+  }
+}

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "dsh-notion-oauth",
+  "version": "1.0.0",
+  "description": "Connect Notion through the official Notion MCP with OAuth 2.0 + PKCE — sign in from the GUI.",
+  "icon": "./icon.svg",
+  "type": "module",
+  "license": "MIT",
+  "author": "Merkurev Sergei <merkurevsn@gmail.com> (https://github.com/MerkurevSergei)",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MerkurevSergei/dsh-notion-oauth.git"
+  },
+  "homepage": "https://github.com/MerkurevSergei/dsh-notion-oauth#readme",
+  "bugs": { "url": "https://github.com/MerkurevSergei/dsh-notion-oauth/issues" },
+  "engines": { "node": ">=22.12.0", "dsh": ">=0.1.5-rc.3" },
+  "packageManager": "pnpm@11.7.0",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js",
+    "./locale/*.json": "./locale/*.json",
+    "./package.json": "./package.json"
+  },
+  "files": ["lib", "locale", "icon.svg", "cordis.patch.yml", "README.md", "README.zh.md", "CHANGELOG.md", "LICENSE"],
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "typecheck": "tsc --noEmit",
+    "prepare": "node scripts/build.mjs"
+  },
+  "dsh": {
+    "bundle": { "patch": "./cordis.patch.yml" },
+    "client": { "inject": ["@deepseek-ai/dsh-client-runtime"], "platform": "web" }
+  },
+  "dependencies": { "commander": "^15.0.0" },
+  "peerDependencies": {
+    "react": ">=18"
+  },
+  "peerDependenciesMeta": {
+    "react": { "optional": true }
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/react": "^18.3.0",
+    "esbuild": "^0.25.0",
+    "typescript": "^5.6.0"
+  },
+  "keywords": ["dsh", "dsh-plugin", "notion", "mcp", "oauth", "deepseek-harness"]
+}
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+