Conversation
Notion workspace assistant that lets users connect their own integration key via UI and interact with pages, databases, and blocks through chat. Key implementation details: - Uses runtime: "claude-code" with bash/node calls to Notion API directly - Injects NOTION_API_KEY via envs option in sandboxes.create() — not files, because the platform overwrites /home/user/.env with relay config - Wraps all async bash in IIFE to avoid ERR_AMBIGUOUS_MODULE_SYNTAX on Node 24 - Saves Notion key + sessions to localStorage for returning users Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d1c656f494
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -0,0 +1,6 @@ | |||
| # 21st SDK credentials (https://21st.dev/agents/api-keys) | |||
| API_KEY_21ST=an_sk_3d11e249701bd71aeb4ec039f8062520af1a4f11099fd69283476d6881690263 | |||
There was a problem hiding this comment.
The example env file checks in a concrete an_sk_... credential instead of a placeholder, which exposes that account to unauthorized use and makes it easy for anyone cloning the repo to accidentally run sandboxes against someone else’s billing quota. Replace it with a non-secret placeholder (for example an_sk_your_key_here) and rotate the leaked key.
Useful? React with 👍 / 👎.
| const sandbox = await client.sandboxes.create({ | ||
| agent: NOTION_AGENT_NAME, |
There was a problem hiding this comment.
This endpoint performs sandboxes.create directly with the server API key but does not enforce any authentication/authorization first, so a public deployment can be abused by arbitrary callers to create unbounded sandboxes and burn account quota/cost. Add a user/session check (and ideally rate limiting) before this call.
Useful? React with 👍 / 👎.
1 participant
Notion workspace assistant that lets users connect their own integration key via UI and interact with pages, databases, and blocks through chat.
Key implementation details: