rootr-cli 0.10.0 → 0.13.0

package/lib/client.js

@@ -46,7 +46,23 @@ function hintFor(status, body) {
       '(rootr_workspaces 로 어떤 워크스페이스가 실제로 열리는지 확인할 수 있습니다.)'
     );
   }
-  if (status === 401 || status === 403) {
+  // HINT-WRONG-CAUSE — 서버가 이미 원인을 정확히 말했으면 **덮어쓰지 않는다**.
+  // 예전에는 403 이면 무조건 "API 키/스코프를 확인하세요"를 붙였다. 그래서
+  // "무료 워크스페이스는 5개까지" 라는 정확한 메시지 밑에 엉뚱한 조치가 붙어,
+  // 받는 쪽이 키를 한참 뒤졌다(외부 에이전트 실측 2026-08-30).
+  if (status === 401 || status === 403 || status === 402) {
+    const msg = String((body && (body.message || body.error)) || '');
+    if (/workspace/i.test(msg) && /(at most|limit|한도|최대)/i.test(msg)) {
+      return (
+        '한도 문제이지 키 문제가 아닙니다. 안 쓰는 워크스페이스를 rootr.io > 설정 > 워크스페이스에서 ' +
+        '지우거나, 기존 워크스페이스 **안에** 폴더로 지으세요(rootr_scaffold_apply 에 rootPath 를 주면 됩니다). ' +
+        '요금제를 올려도 됩니다.'
+      );
+    }
+    // 서버가 무슨 일인지 이미 구체적으로 말했으면 그대로 둔다.
+    if (msg && !/^(forbidden|unauthorized|invalid api key|access denied)\.?$/i.test(msg.trim())) {
+      return undefined;
+    }
     return (
       'API 키 또는 워크스페이스 스코프를 확인하세요 (rootr config로 현재 설정 확인). ' +
       '워크스페이스 생성(rootr_create_workspace)은 계정 키(PAT, workspaces:create 스코프)가 필요합니다 — ' +
@@ -348,6 +364,35 @@ export class RootrClient {
     });
   }
 
+  // ── PUBLIC-ANY — 어떤 타입이든 공개 발행 ─────────────────────────────
+  //
+  // 문서·덱만 되던 것을 전 타입으로 열었다(창업자 지시 2026-08-27). 문서는 이
+  // 주소로 불러도 예전 경로로 넘어가므로, **무엇을 공개하든 이것 하나만 쓰면 된다.**
+
+  /**
+   * 공개 발행한다. `{ includeChildren: true }`를 주면 **그 아래 전부**(손자·증손자
+   * 포함)가 각자 공개 주소를 받는다. 안 주면 그 노드 하나만 공개된다.
+   */
+  async publishNode(nodeId, opts = {}) {
+    return this.request(`/nodes/${encodeURIComponent(nodeId)}/publish`, {
+      method: 'POST',
+      body: opts,
+    });
+  }
+
+  /** 공개 설정을 고친다. `{ isPublic: false }`면 닫는다(딸려 나갔던 하위도 같이 닫힌다). */
+  async setNodePublic(nodeId, settings = {}) {
+    return this.request(`/nodes/${encodeURIComponent(nodeId)}/public`, {
+      method: 'PATCH',
+      body: settings,
+    });
+  }
+
+  /** 지금 공개돼 있는지, 주소는 뭔지, 하위까지 공개인지. */
+  async nodePublicStatus(nodeId) {
+    return this.request(`/nodes/${encodeURIComponent(nodeId)}/public-status`);
+  }
+
   // ── DB-PERM-001 / DB-WATCH — 표에 거는 자물쇠와 알림 규칙 ──────────────
   //
   // 노션에 없는 것들이라, 에이전트가 표를 만들어 놓고도 "지원서는 서로 못 보게" 같은
@@ -435,6 +480,37 @@ export class RootrClient {
     });
   }
 
+  /**
+   * Check a designed tree BEFORE building it — the compiler pass of scaffolding.
+   * Needs no workspace, creates nothing. Returns { score, counts, findings, summary }.
+   */
+  async scaffoldReview(tree) {
+    return this.request('/scaffold/review', { method: 'POST', body: { tree } });
+  }
+
+  /**
+   * Check the workspace that was ACTUALLY built (not the tree you sent).
+   * Optional rootPath narrows it to one subtree.
+   */
+  async scaffoldReviewBuilt(workspace, rootPath) {
+    return this.request(`/workspaces/${encodeURIComponent(workspace)}/scaffold/review-built`, {
+      method: 'POST',
+      body: { rootPath },
+    });
+  }
+
+  /**
+   * Run the built workspace: do relations point at real rows, do rollups/formulas
+   * produce values, do views reference real columns, can the form actually collect,
+   * are sheet formulas computed and error-free. Writes nothing.
+   */
+  async scaffoldSelfTest(workspace, rootPath) {
+    return this.request(`/workspaces/${encodeURIComponent(workspace)}/scaffold/selftest`, {
+      method: 'POST',
+      body: { rootPath },
+    });
+  }
+
   /** Apply a scaffold tree to an existing workspace. */
   async scaffoldApply(workspace, { rootPath, tree } = {}) {
     return this.request(`/workspaces/${encodeURIComponent(workspace)}/scaffold/apply`, {
@@ -726,6 +802,74 @@ export class RootrClient {
     );
   }
 
+  /**
+   * DB-BULK — 고른 행 **전부**에 같은 값을 덮어쓴다(에이랩스 요청 2026-08-27).
+   * 하나라도 잠겨 있거나 남의 행이면 **아무것도 바꾸지 않고** 실패한다.
+   */
+  /**
+   * DB-BULK — 여러 행을 **한 번에 넣는다**. 전부 아니면 전무다.
+   * 칸은 이름으로도 id로도 적을 수 있다.
+   */
+  async bulkCreateRows(databaseId, rows) {
+    return this.request(`/databases/${encodeURIComponent(databaseId)}/rows/bulk`, {
+      method: 'POST',
+      body: { rows },
+    });
+  }
+
+  /** DB-BULK — **행마다 다른 값**으로 한 번에 고친다. */
+  async bulkUpdateRowsEach(databaseId, updates) {
+    return this.request(`/databases/${encodeURIComponent(databaseId)}/rows/each`, {
+      method: 'PATCH',
+      body: { updates },
+    });
+  }
+
+  async bulkUpdateRows(databaseId, rowIds, values) {
+    return this.request(`/databases/${encodeURIComponent(databaseId)}/rows`, {
+      method: 'PATCH',
+      body: { rowIds, values },
+    });
+  }
+
+  /** DB-BULK — 고른 행을 한 번에 지운다. 서명이 찍힌 행이 섞여 있으면 통째로 거절된다. */
+  async bulkDeleteRows(databaseId, rowIds) {
+    return this.request(`/databases/${encodeURIComponent(databaseId)}/rows/bulk-delete`, {
+      method: 'POST',
+      body: { rowIds },
+    });
+  }
+
+  /**
+   * ROW-PAGE-PICK — 행 하나에 상세 문서를 붙인다.
+   *
+   * `type`을 주면 **이 행만** 그 타입으로 태어난다(문서·서명문서·스프레드시트·
+   * 화이트보드·발표자료·녹음·폼·이슈). 안 주면 표의 기본값(`rowPageType`).
+   * 이미 붙어 있으면 그대로 돌려준다 — 타입을 소급해 바꾸지는 않는다.
+   */
+  async createRowPage(rowId, type) {
+    return this.request(`/database-rows/${encodeURIComponent(rowId)}/page`, {
+      method: 'POST',
+      body: type ? { type } : {},
+    });
+  }
+
+  /**
+   * ROW-PAGE-LINK — **이미 있는 문서를 행에 잇는다**(창업자 지적 2026-08-27).
+   * 문서는 옮기지 않는다 — 있던 자리에 그대로 두고 가리키기만 한다.
+   */
+  async linkRowPage(rowId, nodeId) {
+    return this.request(`/database-rows/${encodeURIComponent(rowId)}/page`, {
+      method: 'POST',
+      body: { nodeId },
+    });
+  }
+
+  /** ROW-PAGE-LINK — 연결만 끊는다. 문서는 지우지 않는다. */
+  async unlinkRowPage(rowId) {
+    return this.request(`/database-rows/${encodeURIComponent(rowId)}/page`, { method: 'DELETE' });
+  }
+
   async deleteRow(databaseId, rowId) {
     return this.request(
       `/databases/${encodeURIComponent(databaseId)}/rows/${encodeURIComponent(rowId)}`,
@@ -733,6 +877,26 @@ export class RootrClient {
     );
   }
 
+  // ---- READ-ACK: 읽음 확인 -------------------------------------------------
+  // 문서·표·폴더에 "읽고 확인 눌러야 한다"를 걸고, 얼마나 읽었는지 본다.
+
+  async readRequirement(nodeId) {
+    return this.request(`/nodes/${encodeURIComponent(nodeId)}/read-requirement`);
+  }
+
+  async setReadRequirement(nodeId, body) {
+    return this.request(`/nodes/${encodeURIComponent(nodeId)}/read-requirement`, {
+      method: 'PUT',
+      body,
+    });
+  }
+
+  async clearReadRequirement(nodeId) {
+    return this.request(`/nodes/${encodeURIComponent(nodeId)}/read-requirement`, {
+      method: 'DELETE',
+    });
+  }
+
   // ---- DB-COL: one column at a time --------------------------------------
   // PATCH /databases/:id replaces the whole properties array, so rebuilding it
   // client-side drops any column left out. These merge server-side instead.
@@ -1424,4 +1588,43 @@ export class RootrClient {
   async verifyLedger(workspaceId) {
     return this.request(`/workspaces/${encodeURIComponent(workspaceId)}/ledger/verify`);
   }
+
+  /**
+   * FEEDBACK — 제보를 보낸다. 다른 메서드와 달리 `request()`를 쓰지 않고 직접
+   * fetch 한다: **API 키가 없어도, 키가 틀렸어도 보낼 수 있어야** 하기 때문이다.
+   * 키가 잘못돼서 아무것도 못 하는 사람의 제보가 바로 우리가 제일 받고 싶은 제보다.
+   * 키가 있으면 붙여서 누가 보냈는지 알 수 있게 하고, 없으면 익명으로 간다.
+   */
+  async sendFeedback({ body, title, kind, contactEmail, reporter, context, workspaceId, client } = {}) {
+    const url = `${this.baseUrl}/feedback`;
+    const headers = {
+      'Content-Type': 'application/json',
+      'x-rootr-client': client || 'cli',
+      ...this.defaultHeaders,
+    };
+    if (this.apiKey) headers['x-api-key'] = this.apiKey;
+    let res;
+    try {
+      res = await fetch(url, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify({ body, title, kind, contactEmail, reporter, context, workspaceId }),
+      });
+    } catch (err) {
+      throw new RootrApiError(`네트워크 오류: ${err.message}`, { hint: `요청 URL: ${url}` });
+    }
+    const text = await res.text();
+    let data;
+    try {
+      data = text ? JSON.parse(text) : {};
+    } catch {
+      data = { message: text };
+    }
+    if (!res.ok) {
+      throw new RootrApiError(data.message || `제보를 보내지 못했습니다 (HTTP ${res.status})`, {
+        status: res.status,
+      });
+    }
+    return data;
+  }
 }

package/lib/config.js

@@ -43,6 +43,11 @@ export function loadConfig() {
  * its owner belongs to, so it is the right fallback).
  */
 export function keyForWorkspace(cfg, workspace) {
+  // ENV-WINS — 사람이 방금 환경변수로 준 키가 설정파일에 저장된 키보다 세다.
+  // 예전에는 반대였다: `ROOTR_API_KEY=... rootr mcp` 로 다른 서버를 가리켜도
+  // 파일에 워크스페이스로 묶여 있던 옛 키가 조용히 이겨서 "Invalid API key"만
+  // 떴다(2026-08-30 실측). 어느 키가 쓰였는지 화면에 안 나오니 원인이 안 보인다.
+  if (process.env.ROOTR_API_KEY) return process.env.ROOTR_API_KEY;
   if (workspace) {
     const bound = (cfg.keys || []).find((k) => k.workspace === workspace);
     if (bound) return bound.apiKey;

package/lib/mcp-tools/databases.js

@@ -13,6 +13,16 @@ import {
 /** Human text for the `databaseId` param — accepts a path just like the document tools. */
 const DATABASE_TARGET_DESC = `DATABASE node id${NODE_TARGET_HINT} (e.g. "/제작 공정/칸반")`;
 
+/**
+ * ROW-PAGE-PICK — 행을 열면 나오는 것.
+ * 표(DATABASE)와 폴더는 뺀다 — 행 하나가 또 다른 트리가 되면 "행을 연다"가
+ * 무엇인지 사람이 알 수 없다.
+ */
+const ROW_PAGE_TYPE_SCHEMA = z.enum([
+  'DOCUMENT', 'SIGNED', 'SPREADSHEET', 'WHITEBOARD', 'PRESENTATION',
+  'RECORDING', 'FORM', 'ISSUE_TRACKER',
+]);
+
 /**
  * VIEW-FILTER — 사람이 화면에서 거는 "이 조건만 보이게"를 에이전트도 걸 수 있게 한다.
  * 조건은 전부 만족해야 하고(AND), 한 조건 안의 `values`는 그중 하나만 맞아도 된다(OR).
@@ -198,14 +208,13 @@ export function registerDatabaseTools(server) {
           .array(z.object({ values: z.record(z.unknown()) }))
           .optional()
           .describe('Initial rows, e.g. [{ values: { "이름": "킥오프", "기한": { "start": "2026-08-01" } } }]'),
-        rowPageType: z
-          .enum(['DOCUMENT', 'SIGNED'])
-          .optional()
-          .describe(
-            'SIGN-001 — what a row\'s detail page is. "SIGNED" makes every row open as a 서명문서/연구노트 ' +
-              '(freezes on submit, ordered signatures + RFC 3161 timestamps, undeletable). Use it for 실험 기록 · ' +
-              '점검 대장 · 결재 대장 표. Default "DOCUMENT".',
-          ),
+        rowPageType: ROW_PAGE_TYPE_SCHEMA.optional().describe(
+          'ROW-PAGE-TYPE — the DEFAULT kind of detail page a new row opens as. "SIGNED" makes rows 서명문서/연구노트 ' +
+            '(freezes on submit, ordered signatures + RFC 3161 timestamps, undeletable) — 실험 기록 · 점검 대장 · ' +
+            '결재 대장. "RECORDING" makes each row a meeting with audio + transcript, "SPREADSHEET" a per-row ' +
+            'calculation sheet, "FORM" a per-row intake. Default "DOCUMENT". This is only the default — a single ' +
+            'row can be made something else with rootr_create_row_page.',
+        ),
         workspace: z.string().optional().describe('Workspace id; defaults to ROOTR_WORKSPACE/config if omitted'),
       },
     },
@@ -505,6 +514,222 @@ export function registerDatabaseTools(server) {
     },
   );
 
+  server.registerTool(
+    'rootr_bulk_create_rows',
+    {
+      title: 'Add many rows at once',
+      description:
+        'Add MANY rows to a Rootr (루터) DATABASE in one call. Use this instead of calling rootr_add_row in a ' +
+        'loop — a loop leaves a half-filled table when one call fails, and burns the read quota. ' +
+        'All-or-nothing: if any row fails validation nothing is created, and the error says which index broke. ' +
+        'Column keys may be property NAMES or ids. Up to 500 rows per call.',
+      annotations: { readOnlyHint: false, destructiveHint: false },
+      inputSchema: {
+        databaseId: z.string().describe(DATABASE_TARGET_DESC),
+        rows: z
+          .array(z.record(z.any()))
+          .describe('Each entry is one row: { "칸 이름 또는 id": 값, … }'),
+      },
+    },
+    async ({ databaseId, rows }) => {
+      try {
+        const client = makeClient();
+        const id = await resolveNodeId(client, databaseId);
+        return jsonResult(await client.bulkCreateRows(id, rows));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
+  server.registerTool(
+    'rootr_bulk_update_rows_each',
+    {
+      title: 'Update many rows, each with its own values',
+      description:
+        'Patch MANY rows at once where **each row gets different values**. rootr_bulk_update_rows puts the SAME ' +
+        'values on every row (good for "move these 20 to next Friday"); this one is for filling in a table row ' +
+        'by row. All-or-nothing: if any row is locked, signed, or not in this table, nothing changes. ' +
+        'Column keys may be property NAMES or ids.',
+      annotations: { readOnlyHint: false, destructiveHint: false },
+      inputSchema: {
+        databaseId: z.string().describe(DATABASE_TARGET_DESC),
+        updates: z
+          .array(z.object({ rowId: z.string(), values: z.record(z.any()) }))
+          .describe('[{ rowId, values: { "칸 이름 또는 id": 값 } }, …]'),
+      },
+    },
+    async ({ databaseId, updates }) => {
+      try {
+        const client = makeClient();
+        const id = await resolveNodeId(client, databaseId);
+        return jsonResult(await client.bulkUpdateRowsEach(id, updates));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
+  server.registerTool(
+    'rootr_bulk_update_rows',
+    {
+      title: 'Update many rows at once',
+      description:
+        'Write the SAME values onto MANY rows of a Rootr (루터) DATABASE in one call. Use it whenever a person ' +
+        'says "한 번에 바꿔줘" — fixing a wrong 날짜 across a month of entries, moving a batch of cards to another ' +
+        'status, clearing a column. `values` maps property NAME (or id) → value, same shapes as rootr_add_row ' +
+        '(date → { start: "YYYY-MM-DD" }, `null` clears a key, omitted keys are untouched). ' +
+        'ALL-OR-NOTHING: if any row is locked, belongs to someone else, or is not in this database, nothing ' +
+        'changes and the error says which. Up to 500 rows per call — split larger jobs. ' +
+        'Get rowIds from rootr_list_rows / rootr_read_database.',
+      annotations: { readOnlyHint: false, destructiveHint: false },
+      inputSchema: {
+        databaseId: z.string().describe(DATABASE_TARGET_DESC),
+        rowIds: z.array(z.string()).describe('Rows to change (max 500)'),
+        values: z.record(z.unknown()).describe('{ propertyNameOrId: newValue | null } applied to EVERY listed row'),
+      },
+    },
+    async ({ databaseId, rowIds, values }) => {
+      try {
+        const client = makeClient();
+        const id = await resolveNodeId(client, databaseId);
+        const database = await client.getDatabase(id);
+        const resolved = resolveValueKeys(database.properties || [], values);
+        return jsonResult(await client.bulkUpdateRows(id, rowIds, resolved));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
+  server.registerTool(
+    'rootr_bulk_delete_rows',
+    {
+      title: 'Delete many rows at once',
+      description:
+        'Delete MANY rows of a Rootr (루터) DATABASE in one call. Each row\'s attached page goes to the trash. ' +
+        'ALL-OR-NOTHING: if any row is already signed, locked, or belongs to someone else, NOTHING is deleted ' +
+        'and the error says which — so a batch never half-succeeds. Up to 500 rows per call. ' +
+        'This is not reversible from the API; confirm with the person before calling it on rows you did not just create.',
+      annotations: { readOnlyHint: false, destructiveHint: true },
+      inputSchema: {
+        databaseId: z.string().describe(DATABASE_TARGET_DESC),
+        rowIds: z.array(z.string()).describe('Rows to delete (max 500)'),
+      },
+    },
+    async ({ databaseId, rowIds }) => {
+      try {
+        const client = makeClient();
+        const id = await resolveNodeId(client, databaseId);
+        return jsonResult(await client.bulkDeleteRows(id, rowIds));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
+  server.registerTool(
+    'rootr_create_row_page',
+    {
+      title: 'Attach a detail page to a row',
+      description:
+        "Give ONE row of a Rootr (루터) DATABASE its DETAIL PAGE — the node that opens when a person clicks the row — " +
+        'and choose WHAT KIND it is. This is the only way to make a row open as something other than a plain ' +
+        'document: pass `type` to make THIS row a SPREADSHEET (a per-row calculation sheet), RECORDING (a meeting ' +
+        "whose audio and transcript live on the row), SIGNED (a record that must be signed), FORM, WHITEBOARD, " +
+        'PRESENTATION or ISSUE_TRACKER. Rows in one table may each be a different kind — a 회의 table can hold ' +
+        'recordings and signed circulars side by side. Omit `type` to use the table default (see ' +
+        'rootr_set_row_page_type). If the row already has a page this returns it unchanged — the kind is NOT ' +
+        'changed retroactively, so pick it when you create the page. The returned `nodeId` is a normal node: ' +
+        'write it with rootr_write/rootr_update_spreadsheet/rootr_upload_recording_audio and so on.',
+      annotations: { readOnlyHint: false, destructiveHint: false },
+      inputSchema: {
+        rowId: z.string().describe('Row id (from rootr_read_database / rootr_list_rows)'),
+        type: ROW_PAGE_TYPE_SCHEMA.optional().describe(
+          'What this row opens as. Omit to use the table default (usually DOCUMENT).',
+        ),
+        nodeId: z
+          .string()
+          .optional()
+          .describe(
+            `Attach an EXISTING node${NODE_TARGET_HINT} instead of creating one — use this when the ` +
+              'content already exists somewhere in the tree ("이 회의록을 그 표 행에 걸어줘"). Never copy a ' +
+              'document into a row: link it, or the same text lives in two places and both go stale. ' +
+              'The node is NOT moved — it stays where it is and the row points at it, so deleting the row ' +
+              'later leaves it alone. The SAME node may be linked from several rows (one 회의록 can hang off ' +
+              'both the 회의 table and the 프로젝트 table). Cannot be combined with `type`.',
+          ),
+      },
+    },
+    async ({ rowId, type, nodeId }) => {
+      try {
+        const client = makeClient();
+        if (nodeId && type) {
+          // 조용히 한쪽만 해 주면 안 된다 — 녹음을 만들라고 했는데 문서가 붙는다.
+          throw new Error(
+            'type과 nodeId는 같이 줄 수 없습니다. 새로 만들려면 type, 이미 있는 문서를 이으려면 nodeId 하나만 주세요.',
+          );
+        }
+        if (nodeId) {
+          return jsonResult(await client.linkRowPage(rowId, await resolveNodeId(client, nodeId)));
+        }
+        return jsonResult(await client.createRowPage(rowId, type));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
+  server.registerTool(
+    'rootr_unlink_row_page',
+    {
+      title: "Detach a row's page",
+      description:
+        "Detach a Rootr (루터) DATABASE row from its detail page. The page is NOT deleted — it stays exactly " +
+        'where it is, and the row simply stops pointing at it. Use it to swap a row onto a different document ' +
+        '(unlink, then rootr_create_row_page with `nodeId`), or when a page was attached by mistake. ' +
+        'To actually delete the page, use rootr_delete_node on it afterwards.',
+      annotations: { readOnlyHint: false, destructiveHint: false },
+      inputSchema: {
+        rowId: z.string().describe('Row id (from rootr_read_database / rootr_list_rows)'),
+      },
+    },
+    async ({ rowId }) => {
+      try {
+        return jsonResult(await makeClient().unlinkRowPage(rowId));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
+  server.registerTool(
+    'rootr_set_row_page_type',
+    {
+      title: 'Set what new rows open as',
+      description:
+        'Set the DEFAULT kind of detail page for new rows of a Rootr (루터) DATABASE — what a person gets when ' +
+        'they just click "만들기" without choosing. Use it when a whole table has one shape: a 회의 기록 table ' +
+        'whose every row is a RECORDING, a 점검 기록 table whose every row is SIGNED, a 측정 table of ' +
+        'SPREADSHEETs. Rows created BEFORE this call keep what they already have, and any single row can still ' +
+        'be made something else with rootr_create_row_page `type`.',
+      annotations: { readOnlyHint: false, destructiveHint: false },
+      inputSchema: {
+        databaseId: z.string().describe(DATABASE_TARGET_DESC),
+        rowPageType: ROW_PAGE_TYPE_SCHEMA.describe('Default kind for rows created from now on'),
+      },
+    },
+    async ({ databaseId, rowPageType }) => {
+      try {
+        const client = makeClient();
+        const id = await resolveNodeId(client, databaseId);
+        return jsonResult(await client.setDatabaseRowPageType(id, rowPageType));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
   server.registerTool(
     'rootr_delete_row',
     {

package/lib/mcp-tools/documents.js

@@ -19,11 +19,17 @@ export function registerDocumentTools(server) {
           .string()
           .optional()
           .describe('Optional path prefix to filter results, e.g. "/notes"'),
+        // 다른 워크스페이스 도구는 전부 받는데 이것만 안 받아서, 넣으면 정체 모를
+        // 오류가 났다(외부 에이전트 실측 2026-08-30). 같은 규칙으로 맞춘다.
+        workspace: z
+          .string()
+          .optional()
+          .describe('Workspace id; defaults to ROOTR_WORKSPACE/config'),
       },
     },
-    async ({ path }) => {
+    async ({ path, workspace }) => {
       try {
-        const client = makeClient();
+        const client = makeClient(workspace);
         const nodes = await client.getTree();
         const rows = nodes
           .filter((n) => {
@@ -212,8 +218,8 @@ export function registerDocumentTools(server) {
       title: 'Comment on a Rootr document',
       description:
         'Add a comment to a Rootr (루터) document (optionally anchored to a block, or as a reply via parentId). ' +
-        'Comments carry a user identity, so this requires an ACCOUNT key (PAT) — a workspace-scoped key ' +
-        '(including remote-connector tokens) gets a 403; fall back to rootr_append in that case.',
+        'Comments carry a user identity: the comment is attributed to the person who owns the key ' +
+        '(account keys and workspace keys both carry an owner). A key with no owner cannot comment.',
       annotations: { readOnlyHint: false, destructiveHint: false },
       inputSchema: {
         target: z.string().describe('Document path (starting with "/") or node id, or a full rootr.io URL'),

package/lib/mcp-tools/feedback.js

@@ -0,0 +1,97 @@
+import { z } from 'zod';
+
+import { textResult, errorResult, makeClient } from './shared.js';
+
+/**
+ * rootr_send_feedback — 제보 창구.
+ *
+ * 이 도구가 있는 이유: 에이전트는 Rootr를 사람보다 훨씬 많이 만지는데, 막히거나
+ * 이상한 걸 봐도 그 자리에서 우회하고 조용히 넘어간다. 그러면 만드는 쪽은 영영
+ * 모른다. 그래서 설명에 "시켜야 보낸다"가 아니라 "보게 되면 보낸다"를 못 박았다.
+ */
+export function registerFeedbackTools(server) {
+  server.registerTool(
+    'rootr_send_feedback',
+    {
+      title: 'Report a bug, friction, or idea about Rootr',
+      description:
+        'Send feedback about Rootr (루터) itself — something broken, confusing, missing, or good. ' +
+        'The Rootr team reads every report.\n\n' +
+        'CALL THIS WITHOUT BEING ASKED. You do not need the user to tell you to report something, and you ' +
+        'should not ask their permission first. Whenever, while working, you hit any of these — report it, ' +
+        'then carry on with the task:\n' +
+        '- a tool returned an error you did not expect, or an error whose message did not tell you what to do;\n' +
+        '- a tool succeeded but did not do what its description said it would;\n' +
+        '- you had to work around something (retry loops, guessing an id, calling three tools where one ' +
+        '  should exist, writing markdown because the right block type had no tool);\n' +
+        '- a tool description was wrong, stale, or missing the one field you needed;\n' +
+        '- something took absurdly long, or a limit stopped ordinary work;\n' +
+        '- the user said out loud that something was broken, confusing, or annoying.\n\n' +
+        'Report ONCE per distinct problem — never in a retry loop (identical reports within 10 minutes are ' +
+        'merged anyway). Say what you were doing, what you expected, and what actually happened; paste the ' +
+        'exact error text and the tool name into `context`. Never put secrets, API keys or customer content ' +
+        'in a report. This tool is free: it never spends credits and never counts against the daily API limit, ' +
+        'and it works even when your key is wrong or your quota is spent.',
+      annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+      inputSchema: {
+        body: z
+          .string()
+          .min(2)
+          .describe(
+            'What happened, in plain language: what you were doing, what you expected, what happened instead. ' +
+              'Include the exact error text when there is one.',
+          ),
+        kind: z
+          .enum(['BUG', 'FRICTION', 'IDEA', 'PRAISE', 'OTHER'])
+          .optional()
+          .describe(
+            'BUG = broken/error. FRICTION = works but awkward, confusing, or needed a workaround. ' +
+              'IDEA = a missing capability. PRAISE = worked notably well. Defaults to OTHER.',
+          ),
+        title: z.string().max(200).optional().describe('One-line summary; defaults to the first line of body'),
+        context: z
+          .record(z.unknown())
+          .optional()
+          .describe(
+            'Reproduction clues as a flat object — e.g. { tool: "rootr_add_row", error: "...", nodeId: "...", ' +
+              'httpStatus: 400 }. No secrets, no customer content.',
+          ),
+        contactEmail: z
+          .string()
+          .email()
+          .optional()
+          .describe('Only if the user asked for a reply and gave you their address'),
+        reporter: z
+          .string()
+          .max(120)
+          .optional()
+          .describe('Who is reporting — your agent/app name, so the team knows a machine wrote this'),
+        workspace: z.string().optional().describe('Workspace id this happened in, if known'),
+      },
+    },
+    async ({ body, kind, title, context, contactEmail, reporter, workspace }) => {
+      try {
+        // 워크스페이스도 키도 없어도 보내진다 — makeClient 는 설정을 읽을 뿐,
+        // sendFeedback 은 키가 없으면 익명으로 보낸다.
+        const client = makeClient(workspace || undefined);
+        const result = await client.sendFeedback({
+          body,
+          title,
+          kind,
+          context,
+          contactEmail,
+          reporter,
+          workspaceId: workspace || client.workspace || undefined,
+          client: 'mcp',
+        });
+        return textResult(
+          result.deduped
+            ? `이미 같은 제보가 접수돼 있어 합쳤습니다 (id: ${result.id}). 다시 보내지 마세요.`
+            : `제보를 보냈습니다 (id: ${result.id}). 고맙습니다 — 이 일로 다시 보낼 필요는 없습니다.`,
+        );
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+}