multi-workspace-for-notion 0.1.0 → 0.1.1

package/README.ko.md

@@ -3,7 +3,7 @@
 <p align="center"><em>Claude Code 하나로 모든 Notion 워크스페이스를. 공식 도구는 그대로.</em></p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/version-0.1.0-111111?style=flat-square" alt="Version 0.1.0">
+  <img src="https://img.shields.io/badge/version-0.1.1-111111?style=flat-square" alt="Version 0.1.1">
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-111111?style=flat-square" alt="Claude Code plugin">
   <img src="https://img.shields.io/badge/platform-macOS-111111?style=flat-square" alt="macOS">
   <img src="https://img.shields.io/badge/license-MIT-111111?style=flat-square" alt="MIT license">
@@ -15,7 +15,7 @@
 
 Claude Code에서 여러 Notion 워크스페이스를 동시에 쓸 수 있게 해 줍니다. 공식 Notion MCP 서버의 도구를 하나도 빠짐없이 그대로 씁니다.
 
-> **상태: 개발 초기 (v0.1.0).** 워크스페이스 연결과 공식 도구 전달은 동작하며, 실제 워크스페이스 두 개를 Claude Code에 연결해 시험했습니다. 계획한 기능 중 아직 없는 것이 여럿 있습니다. [로드맵](#로드맵)과 [알려진 제약](#알려진-제약)을 참고하세요.
+> **상태: 개발 초기 (v0.1.1).** 워크스페이스 연결과 공식 도구 전달은 동작하며, 실제 워크스페이스 두 개를 Claude Code에 연결해 시험했습니다. 계획한 기능 중 아직 없는 것이 여럿 있습니다. [로드맵](#로드맵)과 [알려진 제약](#알려진-제약)을 참고하세요.
 >
 > 비공식 프로젝트입니다. Notion Labs, Inc.와 관계가 없고 Notion의 승인을 받지 않았습니다.
 
@@ -106,6 +106,8 @@ claude.ai Notion 커넥터도 켜져 있으면 Claude에게 Notion 도구가 두
 
 ## Claude Desktop 확장(`.mcpb`, 아직 시험 전)
 
+[최신 릴리스](https://github.com/heoeunseo08/multi-workspace-for-notion/releases/latest)에서 `multi-workspace-for-notion.mcpb`를 받거나, 직접 빌드합니다.
+
 ```bash
 npm install
 npm run pack:mcpb    # multi-workspace-for-notion.mcpb 생성
@@ -160,7 +162,7 @@ claude mcp add --scope user multi-workspace -- node /absolute/path/to/multi-work
 | 도구 목록과 안내문 캐시 | `~/.config/multi-workspace-for-notion/cache/` |
 | 토큰 저장용 잠금 파일 | `~/.config/multi-workspace-for-notion/locks/` |
 
-다른 폴더를 쓰려면 `MWN_CONFIG_DIR`을 설정하세요. 파일은 본인만 읽고 쓸 수 있는 권한으로 만들고, 토큰은 절대 들어가지 않습니다.
+다른 폴더를 쓰려면 `MWN_CONFIG_DIR`을 설정하세요. 본인만 접근할 수 있는 폴더로 지정하세요(기본값은 `0700`으로 만듭니다). 파일은 본인만 읽고 쓸 수 있는 권한으로 만들고, 토큰은 절대 들어가지 않습니다.
 
 ## 보안
 

package/README.md

@@ -3,7 +3,7 @@
 <p align="center"><em>One Claude Code, every Notion workspace. The official tools, untouched.</em></p>
 
 <p align="center">
-  <img src="https://img.shields.io/badge/version-0.1.0-111111?style=flat-square" alt="Version 0.1.0">
+  <img src="https://img.shields.io/badge/version-0.1.1-111111?style=flat-square" alt="Version 0.1.1">
   <img src="https://img.shields.io/badge/Claude%20Code-plugin-111111?style=flat-square" alt="Claude Code plugin">
   <img src="https://img.shields.io/badge/platform-macOS-111111?style=flat-square" alt="macOS">
   <img src="https://img.shields.io/badge/license-MIT-111111?style=flat-square" alt="MIT license">
@@ -15,7 +15,7 @@
 
 Use several Notion workspaces at the same time from Claude Code, with every tool the official Notion MCP server offers.
 
-> **Status: early development (v0.1.0).** Connecting workspaces and proxying the official tools work and have been tested with two real workspaces in Claude Code. Several planned pieces are still missing; see [Roadmap](#roadmap) and [Known limitations](#known-limitations).
+> **Status: early development (v0.1.1).** Connecting workspaces and proxying the official tools work and have been tested with two real workspaces in Claude Code. Several planned pieces are still missing; see [Roadmap](#roadmap) and [Known limitations](#known-limitations).
 >
 > This is an unofficial project. It is not affiliated with or endorsed by Notion Labs, Inc.
 
@@ -106,6 +106,8 @@ Each new session also starts with a one-line status, such as `Notion: personal(M
 
 ## Claude Desktop extension (`.mcpb`, not tested yet)
 
+Download `multi-workspace-for-notion.mcpb` from the [latest release](https://github.com/heoeunseo08/multi-workspace-for-notion/releases/latest), or build it yourself:
+
 ```bash
 npm install
 npm run pack:mcpb    # writes multi-workspace-for-notion.mcpb
@@ -162,7 +164,7 @@ CLI messages are currently in Korean.
 | Cached tool lists and instructions | `~/.config/multi-workspace-for-notion/cache/` |
 | Lock files for saving tokens | `~/.config/multi-workspace-for-notion/locks/` |
 
-Set `MWN_CONFIG_DIR` to use a different directory. Files are written with owner-only permissions and never contain tokens.
+Set `MWN_CONFIG_DIR` to use a different directory; point it at a private, owner-only path (the default is created with `0700`). Files are written with owner-only permissions and never contain tokens.
 
 ## Security
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "multi-workspace-for-notion",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "scripts": {
     "dev": "tsx src/index.ts",
     "typecheck": "tsc --noEmit",

package/plugin/server.mjs

@@ -16635,6 +16635,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
 import { createServer } from "node:http";
 async function startCallbackServer() {
   let deliver;
+  let expectedState;
   const received = new Promise((resolve) => deliver = resolve);
   const handler = (req, res) => {
     const url2 = new URL(req.url ?? "/", "http://localhost");
@@ -16645,12 +16646,18 @@ async function startCallbackServer() {
     }
     const error2 = url2.searchParams.get("error");
     const code = url2.searchParams.get("code");
+    const state = url2.searchParams.get("state");
+    if (!error2 && !code || expectedState === void 0 || state !== expectedState) {
+      res.writeHead(400, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+      res.end(`<!doctype html><meta charset="utf-8"><p style="font-family:system-ui">\uC798\uBABB\uB41C \uCF5C\uBC31 \uC694\uCCAD\uC785\uB2C8\uB2E4.</p>`);
+      return;
+    }
     const ok = !error2 && code;
     res.writeHead(ok ? 200 : 400, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
     res.end(
       `<!doctype html><meta charset="utf-8"><title>Multi-Workspace for Notion</title><p style="font-family:system-ui;margin:20vh auto;max-width:420px">` + (ok ? "\uC778\uC99D\uC774 \uB05D\uB0AC\uC2B5\uB2C8\uB2E4. \uC774 \uCC3D\uC744 \uB2EB\uACE0 \uD130\uBBF8\uB110\uB85C \uB3CC\uC544\uAC00\uC138\uC694." : "\uC778\uC99D\uC774 \uCDE8\uC18C\uB418\uC5C8\uAC70\uB098 \uC2E4\uD328\uD588\uC2B5\uB2C8\uB2E4. \uD130\uBBF8\uB110\uC744 \uD655\uC778\uD558\uC138\uC694.") + `</p>`
     );
-    deliver?.(ok ? { code, state: url2.searchParams.get("state") } : { error: error2 ?? "code\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4" });
+    deliver?.(ok ? { code, state } : { error: error2 ?? "code\uAC00 \uC5C6\uC2B5\uB2C8\uB2E4" });
     deliver = void 0;
   };
   const servers = [createServer(handler)];
@@ -16660,7 +16667,8 @@ async function startCallbackServer() {
   if (await listen(ipv62, port, "::1").then(() => true, () => false)) servers.push(ipv62);
   return {
     redirectUrl: `http://localhost:${port}/callback`,
-    async waitForCode(expectedState, timeoutMs) {
+    async waitForCode(expected, timeoutMs) {
+      expectedState = expected;
       let timer;
       const timeout = new Promise((_, reject) => {
         timer = setTimeout(() => reject(new Error("\uC778\uC99D \uB300\uAE30 \uC2DC\uAC04\uC774 \uC9C0\uB0AC\uC2B5\uB2C8\uB2E4.")), timeoutMs);
@@ -16668,7 +16676,6 @@ async function startCallbackServer() {
       try {
         const result = await Promise.race([received, timeout]);
         if ("error" in result) throw new Error(`Notion \uC778\uC99D \uC2E4\uD328: ${result.error}`);
-        if (result.state !== expectedState) throw new Error("state\uAC00 \uC77C\uCE58\uD558\uC9C0 \uC54A\uC544 \uC778\uC99D \uC751\uB2F5\uC744 \uAC70\uBD80\uD588\uC2B5\uB2C8\uB2E4.");
         return result.code;
       } finally {
         clearTimeout(timer);
@@ -19238,7 +19245,7 @@ var StreamableHTTPClientTransport = class {
 
 // src/meta.ts
 var SERVER_NAME = "multi-workspace-for-notion";
-var SERVER_VERSION = "0.1.0";
+var SERVER_VERSION = "0.1.1";
 
 // src/notion.ts
 var NOTION_MCP_URL = new URL("https://mcp.notion.com/mcp");
@@ -19268,7 +19275,7 @@ var NotionSession = class _NotionSession {
   async callTool(name, args2) {
     return await this.client.callTool({ name, arguments: args2 });
   }
-  /** notion-get-self로 이 토큰이 실제로 어느 워크스페이스에 붙었는지 확인한다. */
+  /** Asks notion-get-self which workspace this token actually belongs to. */
   async getSelf() {
     const result = await this.client.callTool({ name: "notion-get-self", arguments: {} });
     const text2 = result.content.filter((part) => part.type === "text").map((part) => part.text ?? "").join("\n");
@@ -19351,13 +19358,13 @@ var WorkspaceAuthProvider = class _WorkspaceAuthProvider {
   onRedirect;
   verifier;
   expectedState;
-  /** 키체인에 값이 있는 것을 확인했거나 저장한 적이 있다. 그 뒤에 값이 사라졌다면 연결 해제나 별칭 변경 때문이다. */
+  /** The keychain value was seen or saved. If it disappears later, the workspace was disconnected or renamed. */
   persisted = false;
-  /** 새로 연결할 때. redirectUrl은 콜백 서버의 주소다. */
+  /** For a new connection. redirectUrl is the callback server's address. */
   static forNewConnection(alias, redirectUrl, onRedirect) {
     return new _WorkspaceAuthProvider(credentialAccount(alias), { redirectUrl }, onRedirect);
   }
-  /** 이미 연결된 워크스페이스를 쓸 때. 저장된 토큰이 없으면 undefined. */
+  /** For a connected workspace. Undefined when nothing is stored. */
   static async forExisting(alias) {
     const raw = await keychain.get(credentialAccount(alias));
     if (raw === void 0) return void 0;
@@ -19381,7 +19388,7 @@ var WorkspaceAuthProvider = class _WorkspaceAuthProvider {
     this.expectedState = randomBytes2(24).toString("base64url");
     return this.expectedState;
   }
-  /** 콜백 서버가 비교할 state. redirectToAuthorization() 이후에만 값이 있다. */
+  /** The state the callback must echo back. Set once auth() has started an authorization. */
   get pendingState() {
     return this.expectedState;
   }
@@ -19392,8 +19399,8 @@ var WorkspaceAuthProvider = class _WorkspaceAuthProvider {
     await this.update((s) => s.clientInformation = clientInformation);
   }
   /**
-   * Claude 세션마다 서버 프로세스가 따로 뜨므로, 다른 프로세스가 갱신한 토큰을 바로 쓰도록 매번 키체인에서 다시 읽는다.
-   * 메모리의 옛 리프레시 토큰을 쓰면, 한 번만 쓸 수 있는 토큰이라 invalid_grant가 난다.
+   * Each Claude session runs its own server process, so re-read the keychain every time to pick up tokens another
+   * process refreshed. Refresh tokens are single-use: a stale one from memory fails with invalid_grant.
    */
   async tokens() {
     await this.reload();
@@ -19411,7 +19418,7 @@ var WorkspaceAuthProvider = class _WorkspaceAuthProvider {
     }
     await this.onRedirect(authorizationUrl);
   }
-  // PKCE verifier는 한 번의 인증 동안만 필요하므로 메모리에만 둔다.
+  // The PKCE verifier lives only for one authorization, so it stays in memory.
   saveCodeVerifier(codeVerifier) {
     this.verifier = codeVerifier;
   }
@@ -19446,9 +19453,10 @@ var WorkspaceAuthProvider = class _WorkspaceAuthProvider {
     if (raw !== void 0) this.stored = JSON.parse(raw);
   }
   /**
-   * 메모리에 든 값을 통째로 쓰면 그사이 다른 프로세스가 저장한 새 토큰을 옛 토큰으로 덮어쓴다.
-   * 그래서 잠금을 잡고 키체인을 다시 읽은 뒤, 바꾸려는 항목만 고쳐서 쓴다.
-   * 다른 프로세스가 연결을 해제했거나 별칭을 바꿔 값이 사라졌으면, 지운 토큰을 되살리지 않도록 쓰지 않는다.
+   * Writing the in-memory copy wholesale would overwrite newer tokens another process saved meanwhile.
+   * So take the lock, re-read the keychain and change only the given fields.
+   * If the value vanished because another process disconnected or renamed the workspace, write nothing,
+   * so deleted tokens stay deleted.
    */
   async update(change) {
     await withFileLock(this.account, async () => {
@@ -19500,20 +19508,18 @@ var UpstreamPool = class {
   open;
   sessions = /* @__PURE__ */ new Map();
   session(alias) {
-    let pending = this.sessions.get(alias);
-    if (!pending) {
-      pending = this.open(alias);
-      const opened = pending;
-      opened.catch(() => {
-        if (this.sessions.get(alias) === opened) this.sessions.delete(alias);
-      });
-      this.sessions.set(alias, pending);
-    }
-    return pending;
+    const existing = this.sessions.get(alias);
+    if (existing) return existing;
+    const opened = this.open(alias);
+    opened.catch(() => {
+      if (this.sessions.get(alias) === opened) this.sessions.delete(alias);
+    });
+    this.sessions.set(alias, opened);
+    return opened;
   }
   /**
-   * 업스트림 MCP 세션이 만료되면 서버가 404를 돌려준다. 그 경우 요청이 처리되지 않았으므로
-   * 세션을 새로 열어 한 번 더 보낸다. 다른 오류는 이미 처리됐을 수 있어 다시 보내지 않는다.
+   * An expired upstream MCP session gets a 404 and the request was not processed, so reopen and send it once more.
+   * Other errors may come after the request was processed, so those are never resent.
    */
   async callTool(alias, name, args2) {
     try {
@@ -19559,7 +19565,6 @@ async function fetchLive(alias, pool) {
     alias,
     tools: await session.listTools(),
     instructions: session.instructions,
-    source: "live",
     fetchedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
@@ -19572,8 +19577,7 @@ async function writeCache(catalog) {
 }
 async function readCache(alias) {
   try {
-    const cached2 = JSON.parse(await readFile2(cachePath(alias), "utf8"));
-    return { ...cached2, source: "cache" };
+    return JSON.parse(await readFile2(cachePath(alias), "utf8"));
   } catch {
     return void 0;
   }
@@ -19641,6 +19645,7 @@ async function openWorkspace(alias) {
   return NotionSession.open(provider);
 }
 async function disconnectWorkspace(alias) {
+  assertAlias(alias);
   const workspaces = await loadWorkspaces();
   const raw = await withFileLock(credentialAccount(alias), async () => {
     const found = await keychain.get(credentialAccount(alias));
@@ -20349,8 +20354,7 @@ async function callProxiedTool(catalog, name, args2, call) {
   }
   const others = available.filter((alias) => alias !== workspace);
   if (!isNotFound(result) || others.length === 0) return result;
-  const readOnly = catalog.tools.find((t) => t.name === name)?.annotations?.readOnlyHint === true;
-  if (!readOnly) {
+  if (!FAN_OUT_ON_NOT_FOUND.has(name)) {
     return withNote(
       result,
       `[${workspace} \uC6CC\uD06C\uC2A4\uD398\uC774\uC2A4\uC5D0\uC11C \uCC3E\uC9C0 \uBABB\uD588\uB2E4. \uB2E4\uB978 \uC6CC\uD06C\uC2A4\uD398\uC774\uC2A4(${others.join(", ")})\uC758 ID\uC77C \uC218 \uC788\uB2E4. notion-fetch\uB85C \uADF8 ID\uAC00 \uC788\uB294 \uC6CC\uD06C\uC2A4\uD398\uC774\uC2A4\uB97C \uD655\uC778\uD55C \uB4A4, \uC0AC\uC6A9\uC790\uC5D0\uAC8C \uD655\uC778\uC744 \uBC1B\uACE0 \uADF8 workspace\uB85C \uB2E4\uC2DC \uD638\uCD9C\uD55C\uB2E4.]`
@@ -20364,6 +20368,7 @@ async function callProxiedTool(catalog, name, args2, call) {
     `[${workspace} \uC6CC\uD06C\uC2A4\uD398\uC774\uC2A4\uC5D0\uB294 \uC5C6\uC5B4\uC11C ${others[found]} \uC6CC\uD06C\uC2A4\uD398\uC774\uC2A4\uC5D0\uC11C \uCC3E\uC740 \uACB0\uACFC\uB2E4. \uC774 \uB300\uC0C1\uC744 \uB2E4\uB8E8\uB294 \uB2E4\uC74C \uD638\uCD9C\uC740 workspace=${others[found]}\uB85C \uBCF4\uB0B8\uB2E4.]`
   );
 }
+var FAN_OUT_ON_NOT_FOUND = /* @__PURE__ */ new Set(["notion-fetch"]);
 var isNotFound = (result) => result.isError === true && result.content.some((c) => c.type === "text" && c.text.includes("object_not_found"));
 var withNote = (result, note) => ({
   ...result,