[artickc]

Summary

• Live cookie-auth model discovery for notion-web via Notion's internal POST /api/v3/getAvailableModels (same endpoint the browser AI surface uses), so operators see real GPT/Claude/Gemini/Grok/… codenames instead of a single stub notion-ai id.
• Resolves spaceId from the pasted cookie (space_id=…) or falls back to POST /api/v3/getSpaces.
• Seeds an offline fallback catalog from the live picker list; discovery failure still returns the seed (intentional local catalog).
• Executor injects a config transcript entry with value.model for non-default model ids so selected models are actually requested on runInferenceTranscript.

Test plan

• node --import tsx --test tests/unit/executor-notion-web.test.ts tests/unit/notion-web-models-discovery.test.ts — 30/30 pass
• node scripts/check/check-file-size.mjs — OK (route 2089 ≤ frozen 2593; new service 286 ≤ cap 800)
• Manual: paste token_v2 + space_id cookie → Providers → sync models / GET /api/providers/{id}/models?refresh=true returns live list
• Manual: chat with e.g. orange-mousse / ambrosia-tart-high through notion-web

Notes

Follow-up to #7600 / #6758. Undocumented endpoints remain experimental (same risk class as other web-cookie providers).

[gemini-code-assist]

Code Review

This pull request introduces live model discovery for the Notion AI Web provider via the getAvailableModels endpoint, including fallback offline models, cookie parsing helpers, and updated executor transcript formatting. The review feedback suggests wrapping decodeURIComponent in a try-catch block to handle malformed cookies safely, using extractSpaceIdFromNotionCookie instead of a case-sensitive substring check to prevent duplicate space IDs, and refactoring redundant string trimming in buildNotionTranscript.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Pasted cookie values from users can sometimes contain malformed percent-encodings (e.g., a raw % character). Calling decodeURIComponent on such values will throw a URIError, which could crash the discovery process. Wrapping it in a try-catch block and falling back to the raw trimmed value is much safer.

  const m = cookie.match(re);
  if (!m) return "";
  try {
    return decodeURIComponent(m[1].trim());
  } catch {
    return m[1].trim();
  }

[gemini-code-assist]

The check cookie.includes("space_id=") is case-sensitive and only checks for the exact string "space_id=". However, extractSpaceIdFromNotionCookie supports both space_id and spaceId case-insensitively. If the cookie contains spaceId=..., cookie.includes("space_id=") will evaluate to false, causing a duplicate space_id to be appended to the cookie string.

Using extractSpaceIdFromNotionCookie(cookie) as the condition is more robust and consistent with how the space ID is extracted.

Suggested change

	const headers = buildNotionModelsDiscoveryHeaders(
	cookie.includes("space_id=") ? cookie : `${cookie}; space_id=${spaceId}`
	);
	const headers = buildNotionModelsDiscoveryHeaders(
	extractSpaceIdFromNotionCookie(cookie) ? cookie : cookie + "; space_id=" + spaceId
	);

[gemini-code-assist]

The notionModel string is trimmed multiple times redundantly. We can trim it once and reuse the result, which is cleaner and more efficient.

Suggested change

	const model =
	typeof notionModel === "string" &&
	notionModel.trim() &&
	notionModel.trim() !== "notion-ai"
	? notionModel.trim()
	: "";
	const trimmedModel = typeof notionModel === "string" ? notionModel.trim() : "";
	const model = trimmedModel && trimmedModel !== "notion-ai" ? trimmedModel : "";

[diegosouzapw]

Reviewed and validated in an isolated probe worktree off release/v3.8.49: node --import tsx/esm --test tests/unit/executor-notion-web.test.ts tests/unit/notion-web-models-discovery.test.ts -> 30/30 pass, npm run typecheck:core clean, ESLint clean on all touched files. The safeOutboundFetch + cached/local-catalog fallback pattern matches the rest of the route, and errors are only logged (never leaked into the response body), so this is consistent with the error-sanitization hard rule. Confirmed no conflict with the already-merged #7600 base provider. Nice touch keeping a documented offline fallback catalog for when the endpoint changes shape again. Good to merge as-is.

[diegosouzapw]

Thanks @artickc! Great feature — notion-web live model discovery via getAvailableModels. I extracted a few helpers from parseNotionAvailableModels/pickFirstSpaceId to keep them under the complexity cap (behavior unchanged, 30/30 tests green), then merged. Validated in local merge-train on devbox @ 516c20438 (FAST gates green: static + changed tests + vitest). The +2 complexity from the new discovery helpers was resolved in-place by extracting helper functions (parseNotionModelEntry, pickSpaceIdFrom*); complexity back to 2058. Stale per-PR CI reds were the shared base-red DRIFT on the release tip.