rootr-cli 0.24.0 → 0.26.0

package/lib/mcp-tools/doc-mail.js

@@ -3,40 +3,44 @@ import { z } from 'zod';
 import { jsonResult, errorResult, makeClient, resolveNodeId, NODE_TARGET_HINT } from './shared.js';
 
 /**
- * DOC-MAIL — 문서 송수신(창업자 지시 2026-10-20).
+ * DOC-MAIL — 문서 송수신(창업자 지시 2026-10-20, 같은 날 정정 "문서자체를 보내란 뜻임").
  *
- * 어떤 타입이든(문서·표·시트·화이트보드·덱·폼·이슈·로그·CRM·녹음·페이지·서명문서) 노드 하나를
- * **보낼 때의 복사본**으로 특정 이메일에게 보낸다. 받은 문서는 받는 사람의 **이메일 주소**에 붙는다 —
- * 계정이 없어도 메일 링크로 열리고, 나중에 그 이메일로 가입하면 받은 문서함에 그대로 있다.
- * 보낸 뒤 원본을 고치거나 지워도 받은 문서는 그대로다(살아 있는 공유가 필요하면 권한/공개를 쓴다).
+ * 어떤 타입이든(문서·폴더·표·시트·화이트보드·덱·폼·이슈·로그·CRM·녹음·페이지·서명문서) 노드 하나를 특정 이메일에게
+ * **보낸다 = 원본 그 자체를 그 이메일에 열어 준다**(보기·댓글·편집). 복사본이 아니라서 보낸 사람이 고치면 받는 사람에게
+ * 바로 보이고, 편집을 받았으면 받는 사람이 고친 것이 원본에 남는다. 받은 문서는 받는 사람의 **이메일 주소**에 붙는다 —
+ * 계정이 없어도 메일 링크(받은 이메일을 넣어야 열림, 읽기 전용)로 열리고, 그 이메일로 가입하면 문서함에서 원본이 열린다.
  */
 export function registerDocMailTools(server) {
   server.registerTool(
     'rootr_send_document',
     {
-      title: 'Send a Rootr node to email addresses',
+      title: 'Send a Rootr node to email addresses (give them access to the original)',
       description:
-        'Send a SNAPSHOT of any Rootr node (document, table, spreadsheet, whiteboard, deck, form, issues, log, CRM, ' +
-        'recording, page, signed document — anything but a folder) to 1–20 email addresses. Each recipient gets an ' +
-        'email with a link that opens the copy WITHOUT a Rootr account; if they have (or later create) a Rootr account ' +
-        'with that email, it also sits in their inbox (rootr_list_doc_mail). The copy is frozen at send time — later ' +
-        'edits or deletion of the original do not change it; use permissions/publishing for a live share instead. ' +
-        'Needs WRITE on the node (the same bar as sharing). What never goes out: the same things a public page hides ' +
-        '(person/attachment/relation columns, row documents, form responses, signer emails). ' +
-        'The result lists each recipient with `emailed` (false = the notification email failed; the copy still exists). ' +
-        'Only send to addresses the user asked for — this emails real people.',
+        'Send any Rootr node (document, folder, table, spreadsheet, whiteboard, deck, form, issues, log, CRM, recording, ' +
+        'page, signed document) to 1–20 email addresses. This is NOT a copy: each address gets access to the ORIGINAL ' +
+        'node (and everything under it, if it is a folder) at `access` = read (view, default) | comment | write (edit). ' +
+        'They always see the latest version; with write their edits land in the original. People with a Rootr account ' +
+        'on that (verified) email open it from their inbox (rootr_list_doc_mail) with that access, even if they are not ' +
+        'members of your workspace — they never see your workspace tree, members or search. People without an account ' +
+        'get an email link where they must type their email address to read it (read-only). ' +
+        'Needs WRITE on the node as a workspace member (the same bar as sharing); you can give at most your own level, ' +
+        'never manage. Re-sending to the same address updates access/message instead of adding a second grant. ' +
+        'Withdraw with rootr_revoke_doc_mail; change access with rootr_set_doc_mail_access. ' +
+        'The result lists each recipient with `emailed` (false = the email failed; the access still stands). ' +
+        'Only send to addresses the user asked for — this emails real people and opens the document to them.',
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
       inputSchema: {
         node: z.string().describe(`보낼 노드 id${NODE_TARGET_HINT}`),
         to: z.array(z.string()).min(1).max(20).describe('받는 사람 이메일 주소들(1~20개). 대소문자만 다른 주소는 같은 사람'),
         message: z.string().max(2000).optional().describe('보내며 함께 적을 말(메일과 문서함에 보인다, 2000자까지)'),
+        access: z.enum(['read', 'comment', 'write']).optional().describe('받는 사람이 원본에서 할 수 있는 것: read=보기(기본) · comment=댓글 · write=편집. 내 권한까지만'),
         workspace: z.string().optional().describe('경로로 줄 때 찾을 워크스페이스 id (생략하면 설정값)'),
       },
     },
-    async ({ node, to, message, workspace }) => {
+    async ({ node, to, message, access, workspace }) => {
       try {
         const client = makeClient(workspace);
-        return jsonResult(await client.sendNode(await resolveNodeId(client, node), { to, message }));
+        return jsonResult(await client.sendNode(await resolveNodeId(client, node), { to, message, access }));
       } catch (err) {
         return errorResult(err);
       }
@@ -51,7 +55,9 @@ export function registerDocMailTools(server) {
         "List the caller's document mailbox: box=inbox (documents sent TO the caller's account email — default) or " +
         'box=sent (documents the caller sent). Summaries only (title, type, sender, recipient, message, sentAt, ' +
         'readAt, revoked); open one with rootr_read_doc_mail. `unread` is the number of unread received documents. ' +
-        'Page with `cursor` = the previous `nextCursor`. Belongs to the person (their email), not to a workspace.',
+        'Page with `cursor` = the previous `nextCursor`. Belongs to the person (their email), not to a workspace. ' +
+        'Each item has `access` (READ/COMMENT/WRITE), `original` (live | trashed | deleted) and, for live received ones, ' +
+        '`nodeId`/`workspaceId` of the original.',
       annotations: { readOnlyHint: true },
       inputSchema: {
         box: z.enum(['inbox', 'sent']).optional().describe('inbox=받은 문서(기본), sent=보낸 문서'),
@@ -74,18 +80,21 @@ export function registerDocMailTools(server) {
     {
       title: 'Read a received or sent Rootr document',
       description:
-        'Open one document from the mailbox (id from rootr_list_doc_mail). Returns the summary plus `payload` — the ' +
-        'snapshot taken at send time, in the same shape a public page uses: `kind` says what it is (doc → `content` ' +
-        'markdown; database → `properties` + `rows`; spreadsheet → `data`; …). Opening a received one marks it read. ' +
-        'If the sender withdrew it, `revoked` is true and `payload` is null.',
+        'Open one document from the mailbox (id from rootr_list_doc_mail). Returns the summary plus the CURRENT content ' +
+        'of the original, read-only, in the same shape a public page uses: `contentMd` for documents, `payload.kind` for ' +
+        'the rest (database → `properties` + `rows`; spreadsheet → `data`; …), `children` (items inside — pass one as ' +
+        '`node` to read it), `access` (what the recipient may do), `openUrl` (the original in the Rootr editor). ' +
+        'Opening a received one marks it read. Withdrawn → `revoked` true and no content; original deleted → ' +
+        '`originalDeleted` true. This works with any of the recipient\'s keys, even one bound to another workspace.',
       annotations: { readOnlyHint: false },
       inputSchema: {
         id: z.string().describe('문서함 항목 id (rootr_list_doc_mail 의 items[].id)'),
+        node: z.string().optional().describe('폴더(부모)를 받았을 때 그 아래 노드 id (앞 응답의 children[].id)'),
       },
     },
-    async ({ id }) => {
+    async ({ id, node }) => {
       try {
-        return jsonResult(await makeClient().getDocMail(id));
+        return jsonResult(await makeClient().getDocMail(id, { node }));
       } catch (err) {
         return errorResult(err);
       }
@@ -97,9 +106,9 @@ export function registerDocMailTools(server) {
     {
       title: 'Withdraw a sent Rootr document',
       description:
-        'Withdraw a document the caller sent (id from rootr_list_doc_mail box=sent). From then on the recipient sees ' +
-        'only the title and "withdrawn" — no content — and the email link answers 410. Only the sender can do this; ' +
-        'it cannot be undone (send it again instead). Copies the recipient already saved elsewhere are out of reach.',
+        'Withdraw a document the caller sent (id from rootr_list_doc_mail box=sent). The recipient loses access to the ' +
+        'original immediately (open editors are disconnected), sees only the title and "withdrawn", and the email link ' +
+        'answers 410. Only the sender can do this; it cannot be undone (send it again instead).',
       annotations: { readOnlyHint: false, destructiveHint: true },
       inputSchema: {
         id: z.string().describe('보낸 문서함 항목 id'),
@@ -113,4 +122,117 @@ export function registerDocMailTools(server) {
       }
     },
   );
+
+  server.registerTool(
+    'rootr_set_doc_mail_access',
+    {
+      title: 'Change what the recipient of a sent Rootr document can do',
+      description:
+        'Change the access of one recipient of a document the caller sent (id from rootr_list_doc_mail box=sent): ' +
+        'read (view) | comment | write (edit). Only the sender; at most the sender\'s own level on the node. Lowering it ' +
+        'takes effect immediately. No email is sent.',
+      annotations: { readOnlyHint: false, destructiveHint: false },
+      inputSchema: {
+        id: z.string().describe('보낸 문서함 항목 id'),
+        access: z.enum(['read', 'comment', 'write']).describe('read=보기 · comment=댓글 · write=편집'),
+      },
+    },
+    async ({ id, access }) => {
+      try {
+        return jsonResult(await makeClient().setDocMailAccess(id, access));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
+  // ── DOC-MAIL-HOOK — 사람 단위 웹훅 ──────────────────────────────────────
+  server.registerTool(
+    'rootr_add_doc_mail_webhook',
+    {
+      title: 'Get a webhook when documents arrive for me',
+      description:
+        "Register a webhook on the caller's own account (not a workspace) for their document mailbox. Rootr POSTs JSON to " +
+        '`url` on doc_mail.received (a document was sent to the account\'s verified email), doc_mail.revoked (a received one ' +
+        'was withdrawn) and doc_mail.read (a recipient opened one the caller sent). The body has id, title, nodeType, sender, ' +
+        'message, access, apiUrl (GET it with your key for the content) and appUrl — never the document content. Each request ' +
+        'is signed: X-Rootr-Signature: sha256=HMAC_SHA256(secret, raw body). The `secret` is returned ONCE, here — store it. ' +
+        'Only public http(s) URLs (private/loopback addresses are refused). Max 5 per account.',
+      annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+      inputSchema: {
+        url: z.string().describe('받을 주소(공인 http/https)'),
+        events: z.array(z.enum(['doc_mail.received', 'doc_mail.revoked', 'doc_mail.read'])).optional().describe('받을 사건(안 주면 셋 다)'),
+        name: z.string().max(100).optional().describe('알아보기 쉬운 이름'),
+      },
+    },
+    async ({ url, events, name }) => {
+      try {
+        return jsonResult(await makeClient().addDocMailWebhook({ url, events, name }));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
+  server.registerTool(
+    'rootr_list_doc_mail_webhooks',
+    {
+      title: "List my document webhooks",
+      description: "List the caller's document-mailbox webhooks (url, events, active, last delivery status). Secrets are not shown.",
+      annotations: { readOnlyHint: true },
+      inputSchema: {},
+    },
+    async () => {
+      try {
+        return jsonResult(await makeClient().listDocMailWebhooks());
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
+  server.registerTool(
+    'rootr_remove_doc_mail_webhook',
+    {
+      title: 'Remove one of my document webhooks',
+      description: 'Delete a document-mailbox webhook of the caller (id from rootr_list_doc_mail_webhooks). Its delivery log goes with it.',
+      annotations: { readOnlyHint: false, destructiveHint: true },
+      inputSchema: { id: z.string().describe('웹훅 id') },
+    },
+    async ({ id }) => {
+      try {
+        return jsonResult(await makeClient().removeDocMailWebhook(id));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
+  server.registerTool(
+    'rootr_test_doc_mail_webhook',
+    {
+      title: 'Send a test event to one of my document webhooks',
+      description:
+        'Queue a signed doc_mail.test delivery to the webhook (re-enables it if it was turned off), then report the latest ' +
+        'deliveries a few seconds later (status, HTTP code, error).',
+      annotations: { readOnlyHint: false, openWorldHint: true },
+      inputSchema: { id: z.string().describe('웹훅 id') },
+    },
+    async ({ id }) => {
+      try {
+        const client = makeClient();
+        const queued = await client.testDocMailWebhook(id);
+        let deliveries = null;
+        for (let i = 0; i < 8; i++) {
+          await new Promise((r) => setTimeout(r, 750));
+          deliveries = await client.docMailWebhookDeliveries(id);
+          const d = deliveries?.items?.find((x) => x.id === queued.deliveryId);
+          if (d && d.status !== 'PENDING') break;
+        }
+        return jsonResult({ ...queued, deliveries: deliveries?.items?.slice(0, 5) ?? [] });
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
 }

package/lib/mcp-tools/pages.js

@@ -26,7 +26,11 @@ import {
 const BLOCK_GUIDE =
   'A page is `blocks[]` (ordered, max 200) + `config`. Each block is {id?, type, props}. ' +
   'You assemble a page from these block types:\n' +
-  '· hero {title, subtitle?, align?:"left"|"center", size?:"normal"|"screen", background?:{kind:"color",color}|{kind:"image",attachmentId}, button?:{label,target}} — the opening banner. ' +
+  '· hero {title, subtitle?, align?:"left"|"center", size?:"normal"|"screen", background?:{kind:"color",color}|{kind:"image",attachmentId}|{kind:"video",attachmentId,posterAttachmentId?,portraitAttachmentId?,portraitPosterAttachmentId?}, button?:{label,target}} — the opening banner. ' +
+  'background kind:"video" = a looping MOTION-GRAPHIC background (autoplay, muted, loop, inline, no controls; same dark shade and white text as an image; ' +
+  'covers the full-screen hero too). posterAttachmentId (an image) is shown while loading and INSTEAD of the video for visitors who ask for reduced motion or whose browser blocks autoplay — ' +
+  'make the poster the video\'s first frame. portraitAttachmentId (+ portraitPosterAttachmentId) is an optional PHONE/PORTRAIT cut (e.g. 1080×1920): ' +
+  'a portrait screen plays it and a landscape screen plays the default one — only ONE file is downloaded. Without it, phones crop the middle strip of a 16:9 video. ' +
   'size:"screen" makes it a FULL-SCREEN landing hero: edge to edge and one viewport tall (minus the top name bar, capped at 1200px), big headline, content centred vertically ' +
   '(default "normal" = a compact banner inside the text column)\n' +
   '· text {body (markdown), title?} — prose section; markdown is sanitized when rendered\n' +
@@ -57,6 +61,14 @@ const BLOCK_GUIDE =
   'needs on a short phone and nothing is clipped. Inside, take the frame height with `height:100%` (html and body already are 100%) ' +
   'and centre the content with flexbox. bleed:true + minHeight:"screen" = a full-screen section; stack several for a ' +
   'section-per-screen landing page.\n' +
+  '· video {attachmentId, posterAttachmentId?, caption?, aspect?:"16:9"|"9:16"|"1:1"|"4:5" (default "16:9"), bleed?:boolean} — a MOTION-GRAPHIC clip ' +
+  '(always autoplay, muted, loop, playsinline, no controls — it is a moving picture, not a talk with sound). bleed:true spans the full page width. ' +
+  'Same poster / reduced-motion rule as the hero video background.\n' +
+  'VIDEOS (hero video background, video block): upload the file first — POST /v1/attachments/upload?workspaceId=<ws>&nodeId=<page>&filename=a.mp4&mimeType=video/mp4 ' +
+  'with the raw bytes as the body and Content-Type application/octet-stream (H.264 MP4 with +faststart plays everywhere incl. iPhone). ' +
+  'The attachment must belong to the page\'s workspace (else 400 PAGE_MEDIA_INVALID; a poster must be an image). Videos on pages need the TEAM plan ' +
+  '(Free → 403 PLAN_UPGRADE_REQUIRED, same as slide videos). Read responses carry a short-lived `vt` playback signature on each video spot; ' +
+  'the bare /raw address of a video answers 403 (hotlink protection) — never store `vt`, it is dropped on save.\n' +
   'LAYOUT: any block takes `width:"full"|"twoThirds"|"half"|"third"` — neighbouring blocks sit side by side (phones stack them). ' +
   'That is how a page becomes a DASHBOARD: a row of `chart:"kpi"` blocks at width "third", then charts at width "half". ' +
   'A hero with size:"screen" and a custom block with bleed:true always take the whole row — `width` is ignored (not stored) on them.\n' +
@@ -90,10 +102,15 @@ const BLOCK_GUIDE =
   'saved; it is never stored as a silently empty block. `column`/`labelColumn`/' +
   '`valueColumn`/`orderBy.column` are the column NAMES as shown in the table (not column ids). A table or form that ' +
   'sits in a PRIVATE subtree is silently skipped on the published page — that is deliberate, never a bug to work around.\n' +
-  'LINKS: every `target` is {kind:"url", href} (absolute http(s)://, mailto: or tel: only) or {kind:"node", nodeId} ' +
-  'for a document in the same workspace. Internal path strings are rejected. A node link renders as the in-app ' +
+  'LINKS: every `target` is {kind:"url", href} (absolute http(s)://, mailto: or tel: only), {kind:"node", nodeId} ' +
+  'for a document in the same workspace, or {kind:"block", blockId} to JUMP TO ANOTHER BLOCK ON THIS SAME PAGE ' +
+  '(e.g. a hero button "Book a free consult" → the booking block further down: smooth scroll in the same tab, no new tab — ' +
+  'use this for landing pages opened in Instagram/Facebook in-app browsers). blockId must be the id of a block on this page ' +
+  '(else 400) — when you create the page, give the target block an explicit `id` (e.g. "booking") so you can point at it. ' +
+  'Internal path strings are rejected. A url link opens in a new tab; a node link renders as the in-app ' +
   'document for members, as the public address on the published page, and is hidden entirely if that document is ' +
-  'not published — so link to nodes rather than pasting addresses.\n' +
+  'not published — so link to nodes rather than pasting addresses. Inside a text block\'s markdown, `[label](#<blockId>)` ' +
+  'is a same-page link to that block.\n' +
   'CONFIG: {theme, accentColor?, navEnabled?, metaPixelId?}. theme is one of classic | minimal | warm | pastel | editorial | mono | ' +
   'dark | midnight. accentColor is a hex like "#1A4A7A"; leave it out and the theme picks a matching accent.' +
   ' metaPixelId is the numeric Meta (Facebook/Instagram) Pixel ID: when set, the PUBLISHED page reports PageView and, when a visitor books through a booking block, Schedule to that pixel (never in the editor); send "" to turn it off. ' +
@@ -109,7 +126,8 @@ export function registerPageTools(server) {
       title: 'Create a Rootr page (block-assembled web page)',
       description:
         'Create a new PAGE node in a Rootr (루터) workspace — a web page assembled from safe typed blocks, which ' +
-        'can then be published to the web at a public address (see rootr_publish_node). Use this when someone asks ' +
+        'can then be published to the web at a public address (see rootr_publish_node — web publishing of pages needs ' +
+        'the Team plan; on Free the page still works inside the workspace). Use this when someone asks ' +
         'for a DASHBOARD / report / KPI board over their tables, spreadsheets or logs (46 live chart kinds, numbers stay ' +
         'current), or for a landing page, an announcement page, an event page, a product/pricing page or a signup page. ' +
         'Omit `blocks` to start from a hero/text/footer skeleton. ' +

package/lib/mcp-tools/public.js

@@ -29,9 +29,13 @@ export function registerPublicTools(server) {
       description:
         'Publish ANY Rootr (루터) node at a public read-only URL (rootr.io/p/{slug}) — a DATABASE (visitors get a ' +
         'searchable table and can clone it into their own workspace), SPREADSHEET, WHITEBOARD, FORM (questions only), ' +
-        'ISSUE_TRACKER, LOG, CRM, RECORDING (transcript only), SIGNED or DOCUMENT. Use this instead of ' +
+        'ISSUE_TRACKER, LOG, CRM, RECORDING (transcript only), SIGNED, DOCUMENT or PAGE. Use this instead of ' +
         'rootr_publish_document unless you specifically want the document-only extras (skins, edit proposals). ' +
         'FOLDER cannot be published. ' +
+        'PAGE (the block-assembled web page) can be published only on the Team plan and up — a Free workspace gets ' +
+        '403 PLAN_UPGRADE_REQUIRED (nothing is changed; tell the user to upgrade the workspace to Team). Every other type ' +
+        'publishes on Free as before. With `includeChildren` on Free, PAGE nodes underneath are skipped and the response ' +
+        'says how many (`skippedPagesRequireTeam`). ' +
         'Set `includeChildren: true` to publish everything underneath as well — the WHOLE subtree, grandchildren ' +
         'included, each getting its own URL and listed on the parent page. Leave it off and only this one node goes ' +
         'out (its sub-page names do not even appear). Turning it back off, closing the parent, moving a child out, ' +
@@ -90,6 +94,7 @@ export function registerPublicTools(server) {
         'PLAN_UPGRADE_REQUIRED; a password-locked page is always hidden and cannot be re-exposed until unlocked); ' +
         '`{"design": {"layout": "board", "skin": "paper"}}` changes how a published TABLE looks — it does not ' +
         'have to be a table (cards, gallery, list, board, timeline, calendar, chart, ranking). ' +
+        '`{"isPublic": true}` on a PAGE needs the Team plan (Free → 403 PLAN_UPGRADE_REQUIRED); closing it works on any plan. ' +
         'For DOCUMENT nodes use rootr_set_document_public instead — documents keep their own settings (skins, ' +
         'edit proposals) on the older path. Owner-level action (MANAGE): use an account key (PAT).',
       annotations: { readOnlyHint: false, destructiveHint: false },
@@ -132,6 +137,8 @@ export function registerPublicTools(server) {
         '`publishable: false` means this type cannot be published at all (FOLDER). ' +
         '`closed: "PUBLIC_OWN_ROW_PAGE"` (with `isPublic: false` and a `closedReason`) means publishing is switched on but the ' +
         'address is closed right now — do NOT hand that URL out; tell the user why and how to reopen it. ' +
+        '`closed: "PAGE_PUBLISH_REQUIRES_TEAM"` means a PAGE was published but its workspace is on the Free plan, so ' +
+        'visitors see a "not published" screen — upgrading to Team reopens the same URL without publishing again. ' +
         'Call this before publishing so you do not tell the user a page is new when it already had a URL.',
       annotations: { readOnlyHint: true, destructiveHint: false },
       inputSchema: {

package/lib/mcp-tools/workspaces.js

@@ -42,10 +42,18 @@ const ACCESS_HINT =
   '`searchExcluded: true` (values stay out of the search index behind ask / AI explore / similar rows — not a read permission) and a `type: "vector"` ' +
   'property needs `dimensions` (an embedding column agents fill with rootr_set_row_vectors). ' +
   'A phone/email/name property may carry `dedupe: true` (warn when the same person is entered again) with ' +
-  '`dedupeShow: ["진행상태","특이사항","콜 이력"]` (fields of the existing row the warning shows — a relation shows its latest 5 rows); ' +
+  '`dedupeShow: ["상태","메모","통화 기록"]` (fields of the existing row the warning shows — a relation shows its latest 5 rows) and ' +
+  '`dedupeCarry: { label: "재등록", auto: true, exclude: ["접수일"], mark: { "재등록 여부": true, "구분": { map: { "A": "A(재등록)" }, else: "재등록" } } }` ' +
+  '(same entry came back: copy the earlier row into the new one — see rootr_update_column); any property may carry ' +
+  '`validate: { kind: "pattern"|"range"|"date"|"birthdate", pattern?, flags?, negate?, min?, max?, message? }` (flags a wrong value on every new write, never blocks); ' +
   'a relation property may carry `relationFilter: [{ propId, op: "is"|"is_not_empty", values? }]` (which linked rows may be picked). ' +
+  'The title property may carry `identifyProps: [{ propId: "연락처", mask: "last4" }, { propId: "지원일" }]` (shown next to the name ' +
+  'wherever another table picks these rows, so same-name people can be told apart). ' +
   'A board view config may carry `cardProps: ["면접예정일","연락처"]` (fields on each card, rollups too) and any view `rowColors` ' +
   '(`[{ propId, op: "is"|"is_not_empty", values?, color }]`). ' +
+  'Any property may carry `align: "left"|"center"|"right"` and `wrap: true`; a date property `highlightOverdue: true` ' +
+  '(past dates red — off by default), `allowTime: false` (no time) and `allowRange: false` (no end date). A table view ' +
+  'config may carry `density: "compact"` and `frozenColumns: 1` (first N visible columns fixed while scrolling sideways). ' +
   'A DOCUMENT\'s `content` may embed a live ' +
   'table/sheet/deck with a line `[[embed:<name of a node in this same tree>]]` or `[[embed:/absolute/path]]` — it is ' +
   'linked to the real node after the whole tree is built (an unknown name rolls the whole tree back).';

package/lib/mcp.js

@@ -25,7 +25,7 @@ import { registerSignedDocTools } from './mcp-tools/signed.js';
 import { registerFeedbackTools } from './mcp-tools/feedback.js';
 import { registerMemoryTools } from './mcp-tools/memory.js';
 import { registerDocMailTools } from './mcp-tools/doc-mail.js';
-import { withRateLimitSink } from './context.js';
+import { withDocMailSink, withRateLimitSink } from './context.js';
 import { makeClient } from './mcp-tools/shared.js';
 import { t as tr } from './i18n.js';
 
@@ -77,6 +77,39 @@ function withQuotaWarnings(server) {
 }
 
 
+/**
+ * DOC-MAIL-NOTIFY — 어떤 루터 도구를 부르든, 아직 알리지 않은 **새 받은 문서**가 있으면 응답 끝에 한 줄을 붙인다(창업자 지시
+ * 2026-10-20 — 클라이언트와 상관없이 루터를 쓰는 순간 알게). 도구가 부른 API 응답의 머리줄(`X-Rootr-Doc-Mail-New-Items`)을
+ * 그릇에 모아 쓴다 — 따로 묻는 호출이 없다. 서버가 키마다·채널(mcp)마다 한 번만 알려 준다(같은 문서를 두 번 알리지 않는다).
+ * 문서함 도구 자신(`*doc_mail*`)의 응답에는 붙이지 않는다 — 이미 문서함을 보고 있다.
+ */
+function docMailNotice(items) {
+  if (!items?.length) return null;
+  const shown = items.slice(0, 5);
+  const list = shown.map((i) => tr(`「${i.title}」 — ${i.sender} (id: ${i.id})`, `"${i.title}" from ${i.sender} (id: ${i.id})`)).join(', ');
+  const more = items.length > shown.length ? tr(` 외 ${items.length - shown.length}건`, ` and ${items.length - shown.length} more`) : '';
+  return tr(
+    `\n\n📬 새로 받은 문서 (${items.length}): ${list}${more} — rootr_read_doc_mail {id} 로 읽으세요. 사용자에게 알려 주세요.`,
+    `\n\n📬 New documents received (${items.length}): ${list}${more} — read with rootr_read_doc_mail {id}. Tell the user.`,
+  );
+}
+
+function withDocMailNotices(server) {
+  const original = server.registerTool.bind(server);
+  server.registerTool = (name, spec, handler) =>
+    original(name, spec, async (...args) => {
+      const sink = { channel: 'mcp', items: [] };
+      const result = await withDocMailSink(sink, () => handler(...args));
+      if (/doc_mail/.test(name)) return result;
+      const notice = docMailNotice(sink.items);
+      if (!notice || !result || !Array.isArray(result.content)) return result;
+      const last = [...result.content].reverse().find((c) => c && c.type === 'text');
+      if (!last) return { ...result, content: [...result.content, { type: 'text', text: notice.trim() }] };
+      return { ...result, content: result.content.map((c) => (c === last ? { ...c, text: `${c.text}${notice}` } : c)) };
+    });
+  return server;
+}
+
 /**
  * MEM-001 — **기억을 눈앞에 놓는다. 이 기능의 성패가 여기 달렸다.**
  *
@@ -225,10 +258,14 @@ export function buildMcpServer({ name, version }) {
         'rootr_request_signing_code first and ASK THE HUMAN for the 6 digits that arrive in their mail — ' +
         'that code is the only evidence a person (not an agent) pressed sign; ' +
         'FOLDER = grouping; LOG store = typed event table whose relation fields auto-build a lineage graph (metrics, incidents, pipeline events — use the rootr_*_log_* tools).\n\n' +
-        'Sending a document to someone by email (문서 보내기 · 문서함): rootr_send_document mails a frozen COPY of any ' +
-        'node (not a folder) to 1-20 addresses — no Rootr account needed to open it, and it lands in their inbox if ' +
-        'that email has an account; rootr_list_doc_mail (box inbox|sent) / rootr_read_doc_mail / rootr_revoke_doc_mail ' +
-        'cover the mailbox. Only send to addresses the user gave you.\n\n' +
+        'Sending a document to someone by email (문서 보내기 · 문서함): rootr_send_document gives 1-20 email addresses ' +
+        'access to the ORIGINAL node (not a copy) at access read|comment|write — they see live edits, and with write ' +
+        'their edits land in the original; an account on that email opens it from its inbox, others read it via the ' +
+        'email link after typing their address; rootr_list_doc_mail (box inbox|sent) / rootr_read_doc_mail / ' +
+        'rootr_set_doc_mail_access / rootr_revoke_doc_mail cover the mailbox. Only send to addresses the user gave you. ' +
+        'When any tool result ends with "📬 New documents received", tell the user right away (title and sender) and offer to ' +
+        'open them with rootr_read_doc_mail. rootr_add_doc_mail_webhook makes Rootr POST doc_mail.received / revoked / read ' +
+        'to the user\'s own URL (for their automations).\n\n' +
         'Scaffolding discipline — treat "set up a workspace for X" exactly like "build me this app": you ask a ' +
         'few clarifying questions, write it, compile it, run the tests, leave a README, and report. The user ' +
         'should only have to type that one sentence; everything else finishes inside the conversation. Never ask ' +
@@ -268,6 +305,7 @@ export function buildMcpServer({ name, version }) {
   // 한도 경고가 그 뒤에 붙는다 — 경고는 언제나 맨 끝에 있어야 눈에 띈다.
   withMemoryRecall(server);
   withQuotaWarnings(server);
+  withDocMailNotices(server);
 
   registerDocumentTools(server);
   registerTemplateTools(server);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rootr-cli",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "Official Rootr CLI + MCP server — read, write, edit and search Rootr documents from the shell or from an AI agent.",
   "type": "module",
   "bin": {