Add Notion MCP module with enforced read-only mode

[tpetr]

Adds a reusable notion-mcp Coder module for the official hosted Notion MCP server. It installs a stdio launcher and uses the workspace owner's optional Coder external-auth connection, fetching current MCP-issued OAuth tokens at runtime rather than putting credentials in client config or Terraform.

Read-only is the default. A reviewed allowlist exposes content search/fetch, comments, data-source queries, and tool-access metadata. The adapter enforces the same policy on direct calls, blocks user lookups and the legacy identity-fetch alias, and denies editing, Custom Agent execution, user-directory, unknown, and other non-allowlisted tools. Read-write is available explicitly.

Unlinked or rejected credentials leave a healthy empty MCP connection with Coder linking guidance. Authentication checks and tool-list notifications support linking/unlinking without restarting compatible clients. The module includes the installer, frozen SDK dependencies, README/client examples, and CI. Existing modules are unchanged.

Read-only restricts this adapter's operations, not the underlying OAuth grant or page visibility. Notion content search can include connected sources; the README documents that distinction. Provider-enforced read-only/page scoping would need a separate Notion API connection and implementation.

Validation:

• 24 JavaScript tests (19 adapter and 5 installer) and 6 mocked Terraform tests pass; Terraform validate and formatting pass.
• Fresh and repeat installation pass, including the installed stdio launcher with Coder environment forwarding. Installer regressions cover pnpm 10/11 Node layouts, reuse on restart, and missing-runtime failures.
• Live discovery exposes six read-only tools; workspace search and page fetch succeed without logging content. A direct create-page call is blocked locally. No write or Custom Agent calls were sent upstream.
• Reviewed staged files for credentials and private account/workspace data; none are included.

Template integration will follow after this module merges.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T23:40:12.485442Z	712c442	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 712c4425f6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ajbt200128]

Bruh mjs tests and sh.tpl in the terraform repo???