rootr-cli 0.32.0 → 0.34.0

package/README.ko.md

@@ -405,7 +405,7 @@ rootr memory forget <id>                         # 폐기(--hard면 행 삭제)
 
 ## MCP 서버로 사용하기
 
-`rootr mcp`는 stdio로 MCP(Model Context Protocol) 서버를 구동합니다. 제공 도구 214종:
+`rootr mcp`는 stdio로 MCP(Model Context Protocol) 서버를 구동합니다. 제공 도구 221종:
 
 노드를 가리키는 인자(`target`, `databaseId`, `spreadsheetId`, `formId`, `crmId`, `trackerId`,
 `recordingId`, `presentationId`, `whiteboardId`, `logId`, `parentId` 등)는 **노드 id와 경로를 모두**
@@ -487,6 +487,16 @@ rootr memory forget <id>                         # 폐기(--hard면 행 삭제)
 | `rootr_get_issue` | 이슈 상세 조회 |
 | `rootr_update_issue` | 이슈 갱신(닫기: state=CLOSED + stateReason) |
 | `rootr_comment_issue` | 이슈에 댓글 추가 |
+| `rootr_update_issue_tracker` | 트래커 설정 — **외부 참여**(`read` 보기만 · `login` 로그인한 사람만 작성 · `anyone` 누구나 작성), 라벨·유형 |
+| `rootr_submit_public_issue` | **웹게시한** 트래커에 밖에서 이슈 올리기(공개 주소로, `asGuest`+`guestName` 이면 손님으로, 페이지 블록은 `blockId`, `files:[{filename, contentBase64}]` 첨부) |
+| `rootr_comment_public_issue` | 웹게시한 트래커의 이슈에 댓글(`files` 첨부, `read:true` 면 공개 댓글 읽기) |
+| `rootr_search_public_issues` | 웹게시한 트래커를 밖에서 찾기 — `q`(제목·본문·#번호·쓴 사람), `labels`(모두 가진 것), `state`, `sort`(newest·oldest·comments) |
+
+CLI: `rootr issue tracker <트래커> --participation anyone` · `rootr issue list|create|comment …` ·
+`rootr issue list <공개 주소> --q "결제" --label 버그` · `rootr issue submit <공개 주소> --title "…" --name <이름> --file 화면.png --file 로그.txt` ·
+`rootr issue reply <공개 주소> <#번호> "<댓글>" [--file <경로>]`.
+첨부는 그림(png·jpg·gif·webp)·pdf·txt·csv·log·docx·xlsx·pptx·zip, 한 파일 10MB·글 하나에 10개까지입니다(확장자와 파일 첫 바이트가 맞아야 함).
+외부 참여는 **트래커 설정**이라 페이지(PAGE)에 `issues` 블록으로 끼운 트래커도 같은 규칙을 따릅니다.
 
 #### 웹훅 (webhooks:manage 스코프)
 
@@ -713,7 +723,7 @@ rootr db column <표> 특이사항 --wrap on --align center  # 긴 글 줄바꿈
 | 도구 | 설명 |
 |---|---|
 | `rootr_publish_node` | **아무 노드나** 공개 — 문서·표·폼·시트·화이트보드·덱·페이지, 하위까지. **페이지(PAGE)는 Team 플랜부터**(무료는 403 `PLAN_UPGRADE_REQUIRED`, 하위 포함 시 페이지는 건너뛰고 개수를 알려 줌) |
-| `rootr_set_node_public` | 이미 공개한 것의 설정 변경(하위 포함 여부·검색 노출·만료) |
+| `rootr_set_node_public` | 이미 공개한 것의 설정 변경(하위 포함 여부·검색 노출·만료·비밀번호, 이슈트래커는 `participation` 외부 참여) |
 | `rootr_node_public_status` | 지금 공개돼 있는지, 주소는 무엇인지 |
 | `rootr_publish_document` | 문서 전용 발행(구형 — 새로 짤 때는 `rootr_publish_node`) |
 | `rootr_set_document_public` | 문서 전용 공개 설정 변경 |

package/README.md

@@ -11,7 +11,7 @@ citations back to the exact paragraph.
 *(한국어 문서: [README.ko.md](https://github.com/gwmage/rootr-cli/blob/main/README.ko.md))*
 
 - `rootr` CLI — documents, databases, forms, signed documents, publishing, permissions, memory
-- `rootr mcp` — stdio MCP server, **217 tools** (see [MCP tools](#mcp-tools))
+- `rootr mcp` — stdio MCP server, **221 tools** (see [MCP tools](#mcp-tools))
 
 Plain Node.js ESM, no build step. Node 18+ (uses the built-in `fetch`).
 
@@ -296,8 +296,31 @@ rootr publish /handbook --status                # is it public, at what URL, chi
 rootr publish /projects/tasks --layout board --skin paper   # 9 layouts × 6 skins
 rootr publish /handbook/policy.md --comments --expires 2026-12-31T00:00:00Z
 rootr publish /handbook --off
+rootr publish /support/feedback --participation anyone   # issue tracker: visitors file issues & comment with just a name
+rootr publish /support/feedback --password s3cret       # lock the address (Team plan) — writing is locked too
 ```
 
+**Issue trackers take outside participation** (외부 참여): `read` (default, read-only), `login`
+(any signed-in Rootr account files issues and comments) or `anyone` (no account — just a name, shown as
+"name (guest)"). It is the tracker's own setting, so a tracker placed on a published page (`issues`
+block) follows the same rule.
+
+```bash
+rootr issue tracker /support/feedback --participation login      # change it (MANAGE)
+rootr issue list /support/feedback --state ALL
+rootr issue create /support/feedback --title "Export is slow" --body "…"
+rootr issue comment /support/feedback 12 "Fixed in 1.4"
+rootr issue submit https://rootr.io/ko/p/AbCd123 --title "Button does nothing" --name "Kim"   # from outside, as a guest
+rootr issue submit https://rootr.io/ko/p/AbCd123 --title "Crash" --file shot.png --file app.log --name "Kim"   # with files
+rootr issue reply https://rootr.io/ko/p/AbCd123 12 "Same here" --name "Lee"
+rootr issue list https://rootr.io/ko/p/AbCd123 --q "payment" --label bug --sort comments   # search a published tracker
+```
+
+Outside attachments: images (png·jpg·gif·webp), pdf, txt·csv·log, docx·xlsx·pptx, zip — 10MB per file, 10 per
+issue/comment; the extension and the file's first bytes must agree. MCP: `rootr_submit_public_issue` /
+`rootr_comment_public_issue` take `files: [{ filename, contentBase64 }]` (contents, never a path), and
+`rootr_search_public_issues` searches a published tracker the way a visitor does.
+
 Every node type publishes on the Free plan **except PAGE** (the block-built web page): publishing a
 page to the web needs the **Team plan**. On Free, `rootr publish <page>` fails with
 `PLAN_UPGRADE_REQUIRED` and nothing changes; `--children` skips pages underneath and says how many.
@@ -517,7 +540,7 @@ is refused and says when the grace was used.
 
 ## MCP tools
 
-`rootr mcp` speaks MCP over stdio. 217 tools:
+`rootr mcp` speaks MCP over stdio. 221 tools:
 
 | Group | Count | Tools |
 |---|---|---|
@@ -532,7 +555,7 @@ is refused and says when the grace was used.
 | Pages | 7 | HTML page nodes: create, read, update, append and patch blocks, live data, visit tracking (GA-style visits / scroll / conversions stored as a LOG, a daily table and a dashboard) |
 | Spreadsheets | 7 | create, read, update, per-sheet create/update/delete, patch cells & formulas |
 | Recordings | 7 | create, upload & download audio, transcribe, summarize, rename speakers |
-| Issue tracker | 6 | create tracker, list / create / get / update issue, comment |
+| Issue tracker | 9 | create tracker, change tracker settings (outside participation, labels, types), list / create / get / update issue, comment, file an issue / comment on a PUBLISHED tracker from outside |
 | Permissions & visibility | 10 | grant / revoke node permissions, read access, visibility, public status, read requirements |
 | LOG datastores | 5 | create store, update fields, add entries, query, stats |
 | Templates | 4 | list, apply, save as template, update |

package/bin/rootr.js

@@ -5,7 +5,16 @@ import { dirname, join, basename, extname } from 'node:path';
 
 import { loadConfig, saveConfig, keyForWorkspace, maskKey, upsertKey, CONFIG_PATH, DEFAULT_BASE_URL } from '../lib/config.js';
 import { candidateClients, rememberWorkspace, resolveWorkspaceSwitch, surveyWorkspaces } from '../lib/credentials.js';
-import { RootrClient, RootrApiError, imageMarkdown } from '../lib/client.js';
+import {
+  RootrClient,
+  RootrApiError,
+  imageMarkdown,
+  publicIssueMimeOf,
+  withPublicAttachments,
+  PUBLIC_ISSUE_FILE_EXTENSIONS,
+  PUBLIC_ISSUE_FILE_MAX_BYTES,
+  PUBLIC_ISSUE_FILES_PER_POST,
+} from '../lib/client.js';
 import { setGlobalDocMailSink } from '../lib/context.js';
 import { resolveTarget, requireResolved, resolveMoveDestination } from '../lib/resolve.js';
 import { t as tr, lang } from '../lib/i18n.js';
@@ -43,7 +52,7 @@ const USAGE_KO = `Rootr CLI v${pkg.version}
   rootr db button-run <path|id> <buttonId> [--rows id,id] [--input 글|--input-file f|--input -]  버튼 한 번 누르기 (행 만들기·값 채우기·AI 채우기 · 글 받는 버튼이면 --input)
   rootr db automations <path|id> [--file rules.json] [--clear] 자동 규칙 — "값이 이렇게 되면 이 일을 해라"·정해진 시각
   rootr db import-sheets <파일.xlsx> --ws <id> [--dry]         시트 수백 장짜리 엑셀을 표 하나로 접어 가져오기
-  rootr db view <path|id> [뷰이름] [--scale week|month|year] [--name 새이름] [--cards "칸,칸"]  뷰 목록·달력 주/달/해 단위·보드 카드에 보일 칸 ·[--density compact|normal] [--freeze 0~3] 촘촘하게·왼쪽 칸 고정
+  rootr db view <path|id> [뷰이름] [--scale week|month|year] [--name 새이름] [--cards "칸,칸"]  뷰 목록·달력 주/달/해 단위·보드 카드에 보일 칸 ·[--density compact|normal] [--freeze 0~3] [--lines rows|all|none] [--line-strength light|strong] 촘촘하게·왼쪽 칸 고정·칸 선
   rootr db view <path|id> <뷰이름> [--row-hidden on|off] [--quick "칸,칸"] [--entry-row on|off|top|bottom] [--personal-filters on|off] [--day-pager 날짜칸|off]  행 열면 감춘 칸 보이기·필터 맨 위 고정 칸·맨 아래 입력 줄·하루씩 보기
   rootr db column <path|id> <칸> [--align left|center|right] [--wrap on|off] [--overdue on|off] [--time on|off] [--range on|off]  칸 정렬·줄바꿈·지난 날짜 빨강·시간·기간
   rootr db row-add <path|id> --values '<json>' [--body <md>|--body-file <f>]  행 추가(상세 내용 포함)
@@ -75,6 +84,17 @@ const USAGE_KO = `Rootr CLI v${pkg.version}
   rootr publish <표> --layout board --skin paper   공개한 표를 무슨 꼴로 보일지 (배치 9종 × 분위기 6종)
   rootr publish <문서> --comments [false] [--expires <ISO>] [--skin <분위기>]  문서 전용 — 댓글(편집 제안)·만료일·스킨 16종
   rootr publish <path|id> --description "<글>" --cover <그림|id|none>  검색 설명문·링크 미리보기 대표 이미지 (검색엔진에 바로 알림)
+  rootr publish <path|id> --password <비번> | --no-password  공개 주소 잠그기(Team 부터)·풀기 — 이슈트래커는 쓰기도 같이 잠김
+  rootr publish <이슈트래커> --participation read|login|anyone  외부 참여 — 보기만·로그인한 사람만 작성·누구나 작성(이름만 적고)
+  rootr issue tracker <트래커> [--participation read|login|anyone] [--json]  트래커 설정 보기·외부 참여 바꾸기(MANAGE)
+  rootr issue list <트래커|공개 주소> [--state OPEN|CLOSED|ALL] [--q <검색어>] [--label <라벨>]… [--sort newest|oldest|comments] [--json]
+                                                   이슈 목록·검색(공개 주소면 밖에서 — 제목·본문·#번호·쓴 사람, 페이지 블록은 --block)
+  rootr issue create <트래커> --title "<제목>" [--body "<본문>"]  이슈 올리기(내 계정으로)
+  rootr issue comment <트래커> <#번호> "<댓글>"       이슈에 댓글
+  rootr issue submit <공개 주소> --title "<제목>" [--body …] [--file <경로>]… [--name <이름>] [--block <블록 id>] [--password <비번>]
+                                                   웹게시한 트래커에 밖에서 이슈 올리기(--name 이면 키 없이 손님으로, 페이지 블록은 --block)
+                                                   --file: 그림·pdf·txt·csv·log·docx·xlsx·pptx·zip, 한 파일 10MB·글 하나에 10개
+  rootr issue reply <공개 주소> <#번호> "<댓글>" [--file <경로>]… [--name <이름>] [--block <블록 id>] [--password <비번>]  웹게시한 트래커 이슈에 댓글
   rootr booking show <표>                           방문자 일정 등록(예약) 설정 보기
   rootr booking set <표> --on --days 1,2,3,4,5 --hours 10:00-18:00 --duration 30  예약 켜기·규칙
   rootr booking set <표> --ask "연락처:required" --approval manual  방문자에게 더 묻기 · 승인 후 확정
@@ -146,7 +166,7 @@ const USAGE_KO = `Rootr CLI v${pkg.version}
   rootr memory add "<내용>" [--kind 지시|사람|프로젝트|참고] [--source <경로|id>] [--related a,b]  기억 저장
   rootr memory edit <id> [--content "<내용>"] [--kind …] [--source …] [--related a,b]  기억 고치기(준 칸만)
   rootr memory forget <id> [--hard]                 기억 폐기(--hard면 행 삭제)
-  rootr mcp                                        MCP stdio 서버 구동 (도구 214종 — README 참고)
+  rootr mcp                                        MCP stdio 서버 구동 (도구 220종 — README 참고)
   rootr --help                                     도움말
   rootr --version                                  버전 출력
 
@@ -186,7 +206,7 @@ usage:
   rootr db button-run <path|id> <buttonId> [--rows id,id] [--input text|--input-file f|--input -]  press a button once (create rows, fill values, AI fill · --input for a button that asks for text)
   rootr db automations <path|id> [--file rules.json] [--clear] automatic rules — "when a value becomes X, do Y", or at a set time
   rootr db import-sheets <file.xlsx> --ws <id> [--dry]        fold a one-sheet-per-record workbook into ONE table
-  rootr db view <path|id> [view name] [--scale week|month|year] [--name <new name>]  list views; calendar week/month/year [--density compact|normal] [--freeze 0-3]  compact rows · frozen left columns
+  rootr db view <path|id> [view name] [--scale week|month|year] [--name <new name>]  list views; calendar week/month/year [--density compact|normal] [--freeze 0-3] [--lines rows|all|none] [--line-strength light|strong]  compact rows · frozen left columns · grid lines
   rootr db view <path|id> <view name> [--row-hidden on|off] [--quick "field,field"] [--entry-row on|off|top|bottom] [--personal-filters on|off] [--day-pager <date field>|off]  hidden fields shown in the row page · pinned filters · entry row · one day at a time
   rootr db column <path|id> <column> [--align left|center|right] [--wrap on|off] [--overdue on|off] [--time on|off] [--range on|off]  column alignment · wrapping · overdue red · time · end date
   rootr db row-add <path|id> --values '<json>' [--body <md>|--body-file <f>]  add a row (with its body)
@@ -220,6 +240,17 @@ usage:
   rootr publish <table> --layout board --skin paper   how a published table looks (9 layouts × 6 skins)
   rootr publish <doc> --comments [false] [--expires <ISO>] [--skin <skin>]  documents only — comments, expiry, 16 skins
   rootr publish <path|id> --description "<text>" --cover <image|id|none>  search description & link-preview cover image (search engines pinged)
+  rootr publish <path|id> --password <pw> | --no-password  lock (Team plan) / unlock the public address — on a tracker writing is locked too
+  rootr publish <issue tracker> --participation read|login|anyone  outside participation — read-only · signed-in users write · anyone writes (just a name)
+  rootr issue tracker <tracker> [--participation read|login|anyone] [--json]  show tracker settings / change outside participation (MANAGE)
+  rootr issue list <tracker|public URL> [--state OPEN|CLOSED|ALL] [--q <text>] [--label <name>]… [--sort newest|oldest|comments] [--json]
+                                                   list/search issues (a public URL searches a PUBLISHED tracker from outside — title, body, #number, author; --block for a page)
+  rootr issue create <tracker> --title "<title>" [--body "<body>"]  file an issue (as your account)
+  rootr issue comment <tracker> <#number> "<comment>"  comment on an issue
+  rootr issue submit <public URL> --title "<title>" [--body …] [--file <path>]… [--name <name>] [--block <block id>] [--password <pw>]
+                                                   file an issue on a PUBLISHED tracker from outside (--name = as a guest, no key; --block for a tracker on a page)
+                                                   --file: images·pdf·txt·csv·log·docx·xlsx·pptx·zip, 10MB per file, 10 per issue/comment
+  rootr issue reply <public URL> <#number> "<comment>" [--file <path>]… [--name <name>] [--block <block id>] [--password <pw>]  comment on an issue of a published tracker
   rootr booking show <table>                        show visitor booking settings
   rootr booking set <table> --on --days 1,2,3,4,5 --hours 10:00-18:00 --duration 30  turn on + rules
   rootr booking set <table> --ask "Phone:required" --approval manual  ask more · confirm after approval
@@ -287,7 +318,7 @@ usage:
   rootr memory add "<content>" [--kind instruction|person|project|reference] [--source <path|id>] [--related a,b]  save a memory
   rootr memory edit <id> [--content "<content>"] [--kind …] [--source …] [--related a,b]  edit a memory (only the fields you pass)
   rootr memory forget <id> [--hard]                 retire a memory (--hard deletes the row)
-  rootr mcp                                        run the MCP stdio server (214 tools — see the README)
+  rootr mcp                                        run the MCP stdio server (220 tools — see the README)
   rootr --help                                     this help
   rootr --version                                  print the version
 
@@ -306,7 +337,8 @@ function usage(syntax) {
 }
 
 function parseArgs(argv) {
-  const args = { _: [] };
+  // `__all[key]` — 같은 깃발을 여러 번 준 값 전부(`--file a --file b`). 나머지 명령은 예전처럼 마지막 값(args[key])을 쓴다.
+  const args = { _: [], __all: {} };
   for (let i = 0; i < argv.length; i++) {
     const tok = argv[i];
     if (tok.startsWith('--')) {
@@ -316,6 +348,7 @@ function parseArgs(argv) {
         args[key] = true;
       } else {
         args[key] = next;
+        (args.__all[key] = args.__all[key] || []).push(next);
         i++;
       }
     } else {
@@ -2161,6 +2194,188 @@ function flagToBool(v) {
   return v !== 'false' && v !== '0';
 }
 
+/** ISSUE-PUBLIC — 외부 참여(서버 issue-schema.ts PUBLIC_PARTICIPATION_MODES 와 같은 값). */
+const PARTICIPATION_MODES = ['read', 'login', 'anyone'];
+
+function participationLabel(mode) {
+  return {
+    read: tr('보기만', 'read only'),
+    login: tr('로그인한 사람만 작성', 'signed-in users write'),
+    anyone: tr('누구나 작성(이름만 적고)', 'anyone writes (just a name)'),
+  }[mode] ?? mode;
+}
+
+/** 공개 주소(rootr.io/…/p/{slug}) 또는 slug 그대로. */
+function publicSlugOf(target) {
+  const m = /\/p\/([^/?#\s]+)/.exec(String(target || ''));
+  return m ? decodeURIComponent(m[1]) : String(target || '').trim();
+}
+
+/** GET /issue-trackers/:id/issues 는 `{ issues: [...] }` 로 답한다(배열이 아니다 — 3100 실측에서 `find is not a function`). */
+function issuesOf(res) {
+  return Array.isArray(res) ? res : Array.isArray(res?.issues) ? res.issues : [];
+}
+
+function issueNumberOf(raw) {
+  const n = Number(String(raw ?? '').replace(/^#/, ''));
+  if (!Number.isSafeInteger(n) || n < 1) throw new Error(tr(`이슈 번호가 아닙니다: ${raw}`, `Not an issue number: ${raw}`));
+  return n;
+}
+
+/** `--file <경로>`(여러 번) → 올릴 파일들. 개수·크기·형식을 보내기 전에 거른다 — 서버 안전선(issue-public-attachments.ts)과 같은 값. */
+function publicIssueFilesOf(args) {
+  const paths = args.__all.file || (typeof args.file === 'string' ? [args.file] : []);
+  if (paths.length > PUBLIC_ISSUE_FILES_PER_POST) {
+    throw new Error(tr(`파일은 글 하나에 ${PUBLIC_ISSUE_FILES_PER_POST}개까지 붙일 수 있습니다.`, `At most ${PUBLIC_ISSUE_FILES_PER_POST} files per issue/comment.`));
+  }
+  return paths.map((p) => {
+    const filename = basename(p);
+    const mimeType = publicIssueMimeOf(filename);
+    if (!mimeType) {
+      throw new Error(
+        tr(`이 형식은 올릴 수 없습니다: ${filename} — ${PUBLIC_ISSUE_FILE_EXTENSIONS.join('·')} 만`, `File type not allowed: ${filename} — only ${PUBLIC_ISSUE_FILE_EXTENSIONS.join(', ')}`),
+      );
+    }
+    const data = readFileSync(p);
+    if (data.length > PUBLIC_ISSUE_FILE_MAX_BYTES) {
+      throw new Error(tr(`파일이 너무 큽니다: ${filename} — 한 파일에 10MB까지`, `File too large: ${filename} — 10MB per file`));
+    }
+    return { filename, mimeType, data };
+  });
+}
+
+/**
+ * ISSUE-PUBLIC — 이슈트래커 명령(창업자 지시 2026-11-02 "api cli mcp scaffold 에도 적용"). 예전엔 CLI 에 이슈 명령이 아예 없었다.
+ *  · 안에서: tracker(설정·외부 참여) · list · create · comment
+ *  · 밖에서(웹게시한 트래커): submit · reply — 키가 있으면 그 계정으로, --name 이면 키 없이 손님으로
+ */
+async function cmdIssue(args) {
+  const sub = args._[0];
+  const client = makeClient();
+  if (sub === 'tracker') {
+    const target = args._[1];
+    if (!target) throw new Error(usage('rootr issue tracker <path|id> [--participation read|login|anyone] [--json]'));
+    const id = await resolveNodeId(client, target);
+    let t;
+    if (args.participation !== undefined) {
+      if (!PARTICIPATION_MODES.includes(args.participation)) {
+        throw new Error(tr(`--participation 은 다음 중 하나여야 합니다: ${PARTICIPATION_MODES.join(', ')}`, `--participation must be one of: ${PARTICIPATION_MODES.join(', ')}`));
+      }
+      t = await client.updateIssueTracker(id, { publicParticipation: args.participation });
+    } else {
+      t = await client.getIssueTracker(id);
+    }
+    if (args.json) return console.log(JSON.stringify(t, null, 2));
+    const mode = (t.config && t.config.publicParticipation) || 'read';
+    console.log(`${t.name}  (${t.path})`);
+    console.log(tr(`  열림 ${t.openCount} · 닫힘 ${t.closedCount}`, `  open ${t.openCount} · closed ${t.closedCount}`));
+    console.log(tr(`  외부 참여: ${participationLabel(mode)}`, `  outside participation: ${participationLabel(mode)}`));
+    console.log(tr(`  라벨: ${(t.labels || []).map((l) => l.name).join(', ') || '없음'}`, `  labels: ${(t.labels || []).map((l) => l.name).join(', ') || 'none'}`));
+    if (mode !== 'read') {
+      const st = await client.nodePublicStatus(id);
+      if (!st.isPublic) {
+        console.log(tr('  ※ 아직 웹게시 전입니다 — `rootr publish <트래커>` 로 공개하거나 발행한 페이지에 issues 블록으로 넣어야 밖에서 씁니다.', '  Note: not published yet — `rootr publish <tracker>` or put it on a published page (issues block) so outsiders can write.'));
+      } else {
+        console.log(tr(`  공개 주소: /p/${st.slug}`, `  public address: /p/${st.slug}`));
+      }
+    }
+    return;
+  }
+  if (sub === 'list') {
+    const target = args._[1];
+    if (!target) throw new Error(usage('rootr issue list <path|id|공개 주소> [--state OPEN|CLOSED|ALL] [--q <text>] [--label <이름>]… [--sort newest|oldest|comments] [--json]'));
+    // ISSUE-PUBLIC-SEARCH — 공개 주소(…/p/{slug})나 --block 이면 웹게시한 트래커를 **밖에서** 찾는다(키 없이, 서버 검색).
+    if (/\/p\//.test(String(target)) || typeof args.block === 'string') {
+      const slug = publicSlugOf(target);
+      const pass = typeof args.password === 'string' ? await client.unlockPublicNode(slug, args.password) : undefined;
+      const res = await client.searchPublicIssues(slug, {
+        blockId: typeof args.block === 'string' ? args.block : undefined,
+        q: typeof args.q === 'string' ? args.q : undefined,
+        state: typeof args.state === 'string' ? args.state : undefined,
+        labels: args.__all.label || [],
+        sort: typeof args.sort === 'string' ? args.sort : undefined,
+        pass,
+      });
+      if (args.json) return console.log(JSON.stringify(res, null, 2));
+      const list = res?.issues || [];
+      if (!list.length) return console.log(tr('조건에 맞는 이슈가 없습니다.', 'No matching issues.'));
+      for (const i of list) {
+        const who = i.author ? (i.author.guest ? tr(`${i.author.name} (외부)`, `${i.author.name} (guest)`) : i.author.name) : '';
+        const labels = (i.labels || []).map((l) => l.name).join(',');
+        console.log(`#${i.number}\t${i.state}\t${i.title}${labels ? `\t[${labels}]` : ''}${who ? `\t${who}` : ''}${i.commentCount ? `\t💬${i.commentCount}` : ''}`);
+      }
+      if (res.truncated) console.log(tr(`… ${res.truncated.total}건 중 ${res.truncated.shown}건`, `… ${res.truncated.shown} of ${res.truncated.total}`));
+      return;
+    }
+    const id = await resolveNodeId(client, target);
+    const list = issuesOf(await client.listIssues(id, { state: args.state, q: typeof args.q === 'string' ? args.q : undefined }));
+    if (args.json) return console.log(JSON.stringify(list, null, 2));
+    if (!list.length) return console.log(tr('이슈가 없습니다.', 'No issues.'));
+    for (const i of list) {
+      const who = i.guestName ? tr(`${i.guestName} (외부)`, `${i.guestName} (guest)`) : i.author?.name ?? '';
+      console.log(`#${i.number}\t${i.state}\t${i.title}${who ? `\t${who}` : ''}${i.commentCount ? `\t💬${i.commentCount}` : ''}`);
+    }
+    return;
+  }
+  if (sub === 'create') {
+    const target = args._[1];
+    if (!target || typeof args.title !== 'string') throw new Error(usage('rootr issue create <path|id> --title "<title>" [--body "<body>"]'));
+    const id = await resolveNodeId(client, target);
+    const out = await client.createIssue(id, { title: args.title, body: typeof args.body === 'string' ? args.body : undefined });
+    console.log(tr(`올렸습니다: #${out.number} ${out.title}`, `Filed: #${out.number} ${out.title}`));
+    return;
+  }
+  if (sub === 'comment') {
+    const [, target, num, ...rest] = args._;
+    const text = rest.join(' ').trim();
+    if (!target || !num || !text) throw new Error(usage('rootr issue comment <path|id> <#number> "<comment>"'));
+    const id = await resolveNodeId(client, target);
+    const n = issueNumberOf(num);
+    const hit = issuesOf(await client.listIssues(id, { state: 'ALL', q: `#${n}` })).find((i) => i.number === n);
+    if (!hit) throw new Error(tr(`#${n} 이슈가 없습니다.`, `Issue #${n} not found.`));
+    await client.commentIssue(id, hit.id, text);
+    console.log(tr(`#${n} 에 댓글을 달았습니다.`, `Commented on #${n}.`));
+    return;
+  }
+  if (sub === 'submit' || sub === 'reply') {
+    const slug = publicSlugOf(args._[1]);
+    if (!slug) throw new Error(usage(`rootr issue ${sub} <public URL> …`));
+    const asGuest = typeof args.name === 'string';
+    const opts = {
+      blockId: typeof args.block === 'string' ? args.block : undefined,
+      guestName: asGuest ? args.name : undefined,
+      asGuest,
+      pass: typeof args.password === 'string' ? await client.unlockPublicNode(slug, args.password) : undefined,
+    };
+    // ISSUE-PUBLIC-ATTACH — `--file <경로>` 여러 번. 보내기 전에 크기·형식을 걸러(서버가 다시 판정) 올리고, 받은 줄을 본문 끝에 붙인다.
+    const files = publicIssueFilesOf(args);
+    const attach = async () => {
+      const lines = [];
+      for (const f of files) {
+        const out = await client.uploadPublicIssueFile(slug, { ...opts, filename: f.filename, mimeType: f.mimeType, data: f.data });
+        console.log(tr(`첨부: ${out.filename} (${out.size}B)`, `attached: ${out.filename} (${out.size}B)`));
+        lines.push(out.markdown);
+      }
+      return lines;
+    };
+    if (sub === 'submit') {
+      if (typeof args.title !== 'string') throw new Error(usage('rootr issue submit <public URL> --title "<title>" [--body …] [--file <경로>]… [--name <name>] [--block <id>]'));
+      const body = withPublicAttachments(typeof args.body === 'string' ? args.body : '', await attach());
+      const out = await client.submitPublicIssue(slug, { ...opts, title: args.title, body: body || undefined });
+      console.log(out?.number ? tr(`올렸습니다: #${out.number}`, `Filed: #${out.number}`) : tr('올렸습니다.', 'Filed.'));
+      return;
+    }
+    const [, , num, ...rest] = args._;
+    const text = rest.join(' ').trim();
+    if (!num || (!text && !files.length)) throw new Error(usage('rootr issue reply <public URL> <#number> "<comment>" [--file <경로>]… [--name <name>] [--block <id>]'));
+    const n = issueNumberOf(num);
+    await client.commentPublicIssue(slug, n, { ...opts, body: withPublicAttachments(text, await attach()) });
+    console.log(tr('댓글을 달았습니다.', 'Comment posted.'));
+    return;
+  }
+  throw new Error(usage('rootr issue tracker|list|create|comment|submit|reply …'));
+}
+
 async function cmdPublish(args) {
   const target = args._[0];
   if (!target) {
@@ -2219,6 +2434,7 @@ async function cmdPublish(args) {
       printSeo(st.publicConfig?.seo);
     } else {
       if (st.hasPassword) console.log(tr('  비밀번호 걸려 있음', `  password protected`));
+      if (st.participation) console.log(tr(`  외부 참여: ${participationLabel(st.participation)}`, `  outside participation: ${participationLabel(st.participation)}`));
       console.log(tr(`  하위 문서도 공개: ${st.includeChildren ? '예' : '아니오'}`, `  children published too: ${st.includeChildren ? 'yes' : 'no'}`));
       console.log(tr(`  복제 허용: ${st.allowClone === false ? '아니오' : '예'}`, `  cloning allowed: ${st.allowClone === false ? 'no' : 'yes'}`));
       if (st.design && (st.design.layout || st.design.skin)) {
@@ -2274,12 +2490,22 @@ async function cmdPublish(args) {
   if (design.skin && !DB_SKINS.includes(design.skin)) {
     throw new Error(tr(`--skin 은 다음 중 하나여야 합니다: ${DB_SKINS.join(', ')}`, `--skin must be one of: ${DB_SKINS.join(', ')}`));
   }
+  // ISSUE-PUBLIC — 이슈트래커의 외부 참여(트래커 설정에 저장 — 페이지에 끼운 블록도 같은 값을 따른다)
+  if (args.participation !== undefined && !PARTICIPATION_MODES.includes(args.participation)) {
+    throw new Error(tr(`--participation 은 다음 중 하나여야 합니다: ${PARTICIPATION_MODES.join(', ')}`, `--participation must be one of: ${PARTICIPATION_MODES.join(', ')}`));
+  }
   const res = await client.publishNode(id, {
     ...(args.children ? { includeChildren: true } : {}),
     ...(typeof args.view === 'string' ? { view: args.view } : {}),
     ...(Object.keys(design).length ? { design } : {}),
+    ...(typeof args.participation === 'string' ? { participation: args.participation } : {}),
   });
   console.log(tr(`공개했습니다: /p/${res.slug}`, `Published: /p/${res.slug}`));
+  if (res.participation) console.log(tr(`  외부 참여: ${participationLabel(res.participation)}`, `  outside participation: ${participationLabel(res.participation)}`));
+  if (typeof args.password === 'string' || args['no-password']) {
+    await client.setNodePublic(id, { password: typeof args.password === 'string' ? args.password : null });
+    console.log(typeof args.password === 'string' ? tr('  비밀번호를 걸었습니다(쓰기도 같이 잠김).', '  Locked with a password (writing too).') : tr('  비밀번호를 풀었습니다.', '  Password removed.'));
+  }
   if (args.children) console.log(tr('  이 문서 아래 전부(손자·증손자 포함)도 각자 주소로 공개됩니다.', `  Everything under this document (grandchildren included) gets its own public address.`));
   if (res.skippedPagesRequireTeam) {
     // PAGE-PUBLISH-TEAM — 무료 워크스페이스에서는 아래의 페이지(PAGE)는 따라 나가지 않는다.
@@ -2987,6 +3213,17 @@ async function cmdDbView(args) {
     if (!['compact', 'normal'].includes(density)) throw new Error(tr('--density 는 compact · normal 중 하나여야 합니다.', `--density must be compact or normal.`));
     patch.density = density;
   }
+  // VIEW-GRID-LINES — 칸 선(rows 가로선만 · all 칸마다 · none)·진하기(light · strong).
+  if (args.lines !== undefined) {
+    const lines = String(args.lines);
+    if (!['rows', 'all', 'none'].includes(lines)) throw new Error(tr('--lines 는 rows · all · none 중 하나여야 합니다.', `--lines must be rows, all or none.`));
+    patch.gridLines = lines;
+  }
+  if (args['line-strength'] !== undefined) {
+    const strength = String(args['line-strength']);
+    if (!['light', 'strong'].includes(strength)) throw new Error(tr('--line-strength 는 light · strong 중 하나여야 합니다.', `--line-strength must be light or strong.`));
+    patch.lineStrength = strength;
+  }
   if (args.freeze !== undefined) {
     const n = Number(args.freeze);
     if (!Number.isInteger(n) || n < 0 || n > 3) throw new Error(tr('--freeze 는 0~3 (왼쪽에 붙여 둘 칸 수)', `--freeze must be 0-3 (columns kept on the left)`));
@@ -3015,7 +3252,7 @@ async function cmdDbView(args) {
     patch.dayPager = !v || v === 'off' || v === 'false' ? null : { dateProp: v };
   }
   if (!Object.keys(patch).length) {
-    throw new Error(tr('바꿀 것을 주세요: --scale week|month|year, --name 새이름, --cards "칸,칸", --density compact|normal, --freeze 0~3, --row-hidden on|off, --quick "칸,칸", --entry-row on|off|top|bottom, --personal-filters on|off 또는 --day-pager 날짜칸|off', `Give something to change: --scale week|month|year, --name <new name>, --cards "field,field", --density compact|normal, --freeze 0-3, --row-hidden on|off, --quick "field,field", --entry-row on|off|top|bottom, --personal-filters on|off, or --day-pager <date field>|off`));
+    throw new Error(tr('바꿀 것을 주세요: --scale week|month|year, --name 새이름, --cards "칸,칸", --density compact|normal, --lines rows|all|none, --line-strength light|strong, --freeze 0~3, --row-hidden on|off, --quick "칸,칸", --entry-row on|off|top|bottom, --personal-filters on|off 또는 --day-pager 날짜칸|off', `Give something to change: --scale week|month|year, --name <new name>, --cards "field,field", --density compact|normal, --lines rows|all|none, --line-strength light|strong, --freeze 0-3, --row-hidden on|off, --quick "field,field", --entry-row on|off|top|bottom, --personal-filters on|off, or --day-pager <date field>|off`));
   }
 
   const view = await client.updateDatabaseView(id, viewRef, patch);
@@ -4152,6 +4389,9 @@ async function main() {
       return cmdForm(args);
     case 'publish':
       return cmdPublish(args);
+    case 'issue':
+    case 'issues':
+      return cmdIssue(args);
     case 'booking':
       return cmdBooking(args);
     case 'gcal':

package/lib/client.js

@@ -115,6 +115,43 @@ function hintFor(status, body) {
   return undefined;
 }
 
+/**
+ * ISSUE-PUBLIC-ATTACH — 공개 이슈트래커 첨부의 안전선(서버 issue-public-attachments.ts 와 같은 값). 서버가 다시 판정하지만, 보내기 전에
+ * 걸러 큰 파일을 헛되이 싣지 않게 한다.
+ */
+export const PUBLIC_ISSUE_FILE_MAX_BYTES = 10 * 1024 * 1024;
+export const PUBLIC_ISSUE_FILES_PER_POST = 10;
+const PUBLIC_ISSUE_MIME = {
+  png: 'image/png',
+  jpg: 'image/jpeg',
+  jpeg: 'image/jpeg',
+  gif: 'image/gif',
+  webp: 'image/webp',
+  pdf: 'application/pdf',
+  txt: 'text/plain',
+  log: 'text/plain',
+  csv: 'text/csv',
+  docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+  zip: 'application/zip',
+};
+export const PUBLIC_ISSUE_FILE_EXTENSIONS = Object.keys(PUBLIC_ISSUE_MIME);
+
+/** 파일 이름 → 보낼 mimeType(모르는 확장자면 null — 서버가 415 로 거절할 것을 미리 알린다). */
+export function publicIssueMimeOf(filename) {
+  const ext = String(filename || '').split('.').pop().toLowerCase();
+  return PUBLIC_ISSUE_MIME[ext] || null;
+}
+
+/** 본문 끝에 첨부 줄(서버가 준 `markdown`)을 붙인다 — 화면(PublicIssueBoard)과 같은 모양. */
+export function withPublicAttachments(body, markdowns) {
+  const lines = (markdowns || []).filter(Boolean);
+  if (!lines.length) return body || '';
+  const text = String(body || '').replace(/\s+$/, '');
+  return `${text}${text ? '\n\n' : ''}${lines.join('\n\n')}`;
+}
+
 export class RootrClient {
   constructor({ apiKey, workspace, baseUrl, publicBaseUrl, defaultHeaders }) {
     this.apiKey = apiKey;
@@ -165,11 +202,12 @@ export class RootrClient {
    * @param {boolean} [opts.returnResponse] - if true, return the raw Response (for header access)
    */
   async request(path, opts = {}) {
-    this._requireApiKey();
+    // ISSUE-PUBLIC — `noAuth` 는 공개 주소에 **손님으로** 부를 때(키를 보내면 그 키 주인의 계정으로 쓰인다).
+    if (!opts.noAuth) this._requireApiKey();
 
     const url = opts.url || `${this.baseUrl}${path}`;
     const headers = {
-      'x-api-key': this.apiKey,
+      ...(opts.noAuth ? {} : { 'x-api-key': this.apiKey }),
       ...this.defaultHeaders,
       ...(opts.headers || {}),
     };
@@ -936,10 +974,10 @@ export class RootrClient {
 
   // ---- Issues ---------------------------------------------------------------
 
-  async createIssueTracker(workspace, name) {
+  async createIssueTracker(workspace, name, extra = {}) {
     return this.request(`/workspaces/${encodeURIComponent(workspace)}/issue-trackers`, {
       method: 'POST',
-      body: { name },
+      body: { name, ...extra },
     });
   }
 
@@ -947,6 +985,93 @@ export class RootrClient {
     return this.request(`/issue-trackers/${encodeURIComponent(trackerId)}`);
   }
 
+  /**
+   * 트래커 설정을 고친다 — `{ publicParticipation }`(외부 참여: read·login·anyone)만 보내면 그 값만 바뀐다.
+   * `labels`·`types` 는 통째로 바꾼다. 외부 참여를 **바꾸는 것**은 MANAGE(웹게시와 같은 주인 몫)다.
+   */
+  async updateIssueTracker(trackerId, patch = {}) {
+    return this.request(`/issue-trackers/${encodeURIComponent(trackerId)}`, {
+      method: 'PATCH',
+      body: patch,
+    });
+  }
+
+  // ── ISSUE-PUBLIC — 남의(또는 내) **웹게시한** 이슈트래커에 밖에서 쓰기 ──────────────
+  // 공개 주소(rootr.io/p/{slug}) 위의 길이다. 키를 보내면 그 키 주인(계정)으로 쓰이고, `asGuest` 면 키 없이 손님 이름으로.
+  // 페이지에 끼운 트래커는 페이지 주소 + `blockId` 로 닿는다.
+
+  /** 잠긴 공개 주소의 비밀번호 → 통과증(`?pass=`). */
+  async unlockPublicNode(slug, password) {
+    const out = await this.request(`/public/nodes/${encodeURIComponent(slug)}/unlock`, {
+      method: 'POST',
+      body: { password },
+      noAuth: true,
+    });
+    return out?.token;
+  }
+
+  _publicIssuesBase(slug, blockId) {
+    const s = encodeURIComponent(slug);
+    return blockId ? `/public/nodes/${s}/issue-blocks/${encodeURIComponent(blockId)}/issues` : `/public/nodes/${s}/issues`;
+  }
+
+  async submitPublicIssue(slug, { blockId, title, body, guestName, pass, asGuest } = {}) {
+    const qs = pass ? `?pass=${encodeURIComponent(pass)}` : '';
+    return this.request(`${this._publicIssuesBase(slug, blockId)}${qs}`, {
+      method: 'POST',
+      body: { title, body, ...(guestName ? { guestName } : {}) },
+      noAuth: Boolean(asGuest) || !this.apiKey,
+    });
+  }
+
+  async commentPublicIssue(slug, number, { blockId, body, guestName, pass, asGuest } = {}) {
+    const qs = pass ? `?pass=${encodeURIComponent(pass)}` : '';
+    return this.request(`${this._publicIssuesBase(slug, blockId)}/${encodeURIComponent(String(number))}/comments${qs}`, {
+      method: 'POST',
+      body: { body, ...(guestName ? { guestName } : {}) },
+      noAuth: Boolean(asGuest) || !this.apiKey,
+    });
+  }
+
+  /**
+   * ISSUE-PUBLIC-SEARCH — 공개 트래커(또는 페이지 블록)의 목록을 서버에서 찾는다. `q` 는 제목·본문·번호(#12)·(이름을 싣는 모드면) 쓴 사람,
+   * `labels` 는 이름(모두 가진 것), `state` OPEN|CLOSED, `sort` newest|oldest|comments. 키 없이 부른다(공개 읽기).
+   */
+  async searchPublicIssues(slug, { blockId, q, state, labels, sort, pass } = {}) {
+    const qs = new URLSearchParams();
+    if (q) qs.set('q', q);
+    if (state && String(state).toUpperCase() !== 'ALL') qs.set('state', String(state).toUpperCase());
+    for (const l of [].concat(labels || [])) if (l) qs.append('label', l);
+    if (sort) qs.set('sort', sort);
+    if (pass) qs.set('pass', pass);
+    const tail = qs.toString();
+    return this.request(`${this._publicIssuesBase(slug, blockId)}${tail ? `?${tail}` : ''}`, { noAuth: true });
+  }
+
+  /**
+   * ISSUE-PUBLIC-ATTACH — 공개 트래커(또는 페이지 블록)에 새 이슈·댓글용 파일을 올린다(본문 = 바이트). 10MB·허용 형식은 서버가 판정한다.
+   * 돌려받은 `markdown` 을 이슈·댓글 본문 끝에 붙여 보낸다(`withPublicAttachments`).
+   */
+  async uploadPublicIssueFile(slug, { blockId, filename, mimeType, data, guestName, pass, asGuest } = {}) {
+    const s = encodeURIComponent(slug);
+    const base = blockId ? `/public/nodes/${s}/issue-blocks/${encodeURIComponent(blockId)}/attachments` : `/public/nodes/${s}/issues/attachments`;
+    const qs = new URLSearchParams({ filename, mimeType: mimeType || publicIssueMimeOf(filename) || 'application/octet-stream' });
+    if (guestName) qs.set('guestName', guestName);
+    if (pass) qs.set('pass', pass);
+    return this.request(`${base}?${qs.toString()}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/octet-stream' },
+      body: data,
+      noAuth: Boolean(asGuest) || !this.apiKey,
+    });
+  }
+
+  /** 공개 트래커(또는 페이지 블록)의 이슈 하나 — 댓글까지. */
+  async readPublicIssue(slug, number, { blockId, pass } = {}) {
+    const qs = pass ? `?pass=${encodeURIComponent(pass)}` : '';
+    return this.request(`${this._publicIssuesBase(slug, blockId)}/${encodeURIComponent(String(number))}${qs}`, { noAuth: true });
+  }
+
   async listIssues(trackerId, { state, label, type, assigneeId, q } = {}) {
     const params = new URLSearchParams();
     if (state) params.set('state', state);
@@ -1133,11 +1258,11 @@ export class RootrClient {
    */
   async createDatabaseView(
     databaseId,
-    { name, type, groupBy, dateProp, endDateProp, filters, sort, colWidths, calendarScale, density, frozenColumns, rowPaneShowHidden, quickFilters, entryRow, filtersPersonalOnly, dayPager } = {},
+    { name, type, groupBy, dateProp, endDateProp, filters, sort, colWidths, calendarScale, density, gridLines, lineStrength, frozenColumns, rowPaneShowHidden, quickFilters, entryRow, filtersPersonalOnly, dayPager } = {},
   ) {
     return this.request(`/databases/${encodeURIComponent(databaseId)}/views`, {
       method: 'POST',
-      body: { name, type, groupBy, dateProp, endDateProp, filters, sort, colWidths, calendarScale, density, frozenColumns, rowPaneShowHidden, quickFilters, entryRow, filtersPersonalOnly, dayPager },
+      body: { name, type, groupBy, dateProp, endDateProp, filters, sort, colWidths, calendarScale, density, gridLines, lineStrength, frozenColumns, rowPaneShowHidden, quickFilters, entryRow, filtersPersonalOnly, dayPager },
     });
   }
 
@@ -1454,10 +1579,10 @@ export class RootrClient {
     });
   }
 
-  async queryVectors(databaseId, column, { vector, topK, minScore } = {}) {
+  async queryVectors(databaseId, column, { vector, topK, minScore, filters } = {}) {
     return this.request(`/databases/${encodeURIComponent(databaseId)}/vectors/${encodeURIComponent(column)}/query`, {
       method: 'POST',
-      body: { vector, topK, minScore },
+      body: { vector, topK, minScore, ...(filters?.length ? { filters } : {}) },
     });
   }
 
@@ -2126,10 +2251,10 @@ export class RootrClient {
   }
 
   /** 연구노트 프리셋: 기재자(나) → 점검자 두 단계. */
-  async applyResearchNotePreset(nodeId, { reviewerUserId, noteMeta } = {}) {
+  async applyResearchNotePreset(nodeId, { reviewerUserId, noteMeta, authorUserId } = {}) {
     return this.request(`/signed-docs/${encodeURIComponent(nodeId)}/research-note-preset`, {
       method: 'POST',
-      body: { reviewerUserId, noteMeta },
+      body: { reviewerUserId, noteMeta, authorUserId },
     });
   }
 

package/lib/mcp-tools/databases.js

@@ -74,12 +74,16 @@ const FILTER_DESC =
   'still show them. A new row added while a filter is on is seeded with the filtered values so it does not ' +
   'vanish the moment it is created.';
 
-const SORT_SHAPE = z.object({
+const SORT_ONE = z.object({
   propId: z.string().describe('Column NAME or id to sort by'),
   dir: z.enum(['asc', 'desc']).describe('asc = 오름차순, desc = 내림차순'),
 });
+const SORT_SHAPE = z.union([SORT_ONE, z.array(SORT_ONE).min(1).max(3)]);
 
-const SORT_DESC = 'Row order in this view.';
+const SORT_DESC =
+  'Row order in this view — one { propId, dir } or a list of up to 3 (the next one breaks ties of the previous, e.g. ' +
+  '[{ "propId": "지원일", "dir": "desc" }, { "propId": "등록일시", "dir": "desc" }]). Rows still tied are ordered by creation ' +
+  'time in the direction of the first criterion (descending → the newest row first).';
 
 /**
  * VIEW-ROW-SHOW-HIDDEN · VIEW-QUICK-FILTER · VIEW-ENTRY-ROW · VIEW-DAY-PAGER — 표 보기 설정 넷. 만들기(rootr_create_view)와
@@ -178,7 +182,8 @@ export function registerDatabaseTools(server) {
       title: 'Create a Rootr database (table / board / kanban)',
       description:
         'Create a DATABASE node — a typed table with columns, views and rows — in ONE call, optionally seeded with ' +
-        'its first rows. **Use this whenever you need a table**: moving a Notion database over, building a kanban ' +
+        'its first rows. Column names must be unique in the table (trimmed, case-insensitive) — duplicates are ' +
+        'rejected with a 400 so rows can be addressed by column name unambiguously. **Use this whenever you need a table**: moving a Notion database over, building a kanban ' +
         'board, a task/requirement/risk tracker, anything with trackable rows. Do NOT fake a table with a markdown ' +
         'document, and do NOT create an empty database and then add columns one by one — `properties` order IS the ' +
         'column order, so one call keeps the columns in exactly the order you list them. ' +
@@ -386,6 +391,16 @@ export function registerDatabaseTools(server) {
           .nullable()
           .optional()
           .describe('table view: "compact" = lower rows and smaller text so more rows fit on one screen. null/"normal" = default.'),
+        gridLines: z
+          .enum(['rows', 'all', 'none'])
+          .nullable()
+          .optional()
+          .describe('table view lines: "rows" = lines between rows only (default), "all" = a border around every cell (spreadsheet-like), "none" = no lines. null = default.'),
+        lineStrength: z
+          .enum(['light', 'strong'])
+          .nullable()
+          .optional()
+          .describe('table view: "strong" = darker grid lines so rows are easier to tell apart. null/"light" = default.'),
         frozenColumns: z
           .number()
           .int()
@@ -400,7 +415,7 @@ export function registerDatabaseTools(server) {
         ...VIEW_EXTRA_SHAPE,
       },
     },
-    async ({ databaseId, name, type, groupBy, dateProp, endDateProp, filters, sort, colWidths, calendarScale, density, frozenColumns, rowPaneShowHidden, quickFilters, entryRow, filtersPersonalOnly, dayPager }) => {
+    async ({ databaseId, name, type, groupBy, dateProp, endDateProp, filters, sort, colWidths, calendarScale, density, gridLines, lineStrength, frozenColumns, rowPaneShowHidden, quickFilters, entryRow, filtersPersonalOnly, dayPager }) => {
       try {
         const client = makeClient();
         const id = await resolveNodeId(client, databaseId);
@@ -415,6 +430,8 @@ export function registerDatabaseTools(server) {
           colWidths,
           calendarScale,
           density,
+          gridLines,
+          lineStrength,
           frozenColumns,
           rowPaneShowHidden,
           quickFilters,
@@ -525,6 +542,16 @@ export function registerDatabaseTools(server) {
           .nullable()
           .optional()
           .describe('table view: "compact" = lower rows and smaller text so more rows fit on one screen. null/"normal" = default.'),
+        gridLines: z
+          .enum(['rows', 'all', 'none'])
+          .nullable()
+          .optional()
+          .describe('table view lines: "rows" = lines between rows only (default), "all" = a border around every cell (spreadsheet-like), "none" = no lines. null = default.'),
+        lineStrength: z
+          .enum(['light', 'strong'])
+          .nullable()
+          .optional()
+          .describe('table view: "strong" = darker grid lines so rows are easier to tell apart. null/"light" = default.'),
         frozenColumns: z
           .number()
           .int()
@@ -554,6 +581,8 @@ export function registerDatabaseTools(server) {
       cardProps,
       rowColors,
       density,
+      gridLines,
+      lineStrength,
       frozenColumns,
       rowPaneShowHidden,
       quickFilters,
@@ -577,6 +606,8 @@ export function registerDatabaseTools(server) {
           cardProps,
           rowColors,
           density,
+          gridLines,
+          lineStrength,
           frozenColumns,
           rowPaneShowHidden,
           quickFilters,
@@ -1989,7 +2020,10 @@ export function registerDatabaseTools(server) {
         'Remove ONE column from a Rootr (루터) DATABASE. The values stored under it are NOT erased from the rows, ' +
         'so re-adding a column is not enough to bring them back in the UI — confirm with the user before calling this. ' +
         'Exception: values of a vector column are erased (see below). ' +
-        'The title column cannot be deleted. Views grouped/dated by the column are cleared automatically. ' +
+        'The title column cannot be deleted. Views grouped/dated by the column are cleared automatically, and so are the ' +
+        'value lines that point at it in buttons/automations of THIS and OTHER tables (an add_row into this table, an update_rows ' +
+        'of its rows, an ai_fill of that column); automations whose condition watches it stop. The result lists them under ' +
+        '`deleteCascade` — show it to the user. ' +
         'For a vector column the stored vectors are deleted with it (not kept for re-adding — re-add the column and ' +
         'store the vectors again with rootr_set_row_vectors).',
       annotations: { readOnlyHint: false, destructiveHint: true },
@@ -2418,7 +2452,10 @@ export function registerDatabaseTools(server) {
         'query with the same model you used for rootr_set_row_vectors. `minScore` drops weak matches. Rows the caller ' +
         'cannot see (own-rows-only tables) are never returned. Rows without a stored vector are skipped. ' +
         'The column can hold at most 50,000 vectors — a bigger column is refused, not searched partially — and the scan has ' +
-        'no index, so latency grows with the number of rows in the column.',
+        'no index, so latency grows with the number of rows compared (1536 dims: ~0.7s at 2,000 rows, ~3s at 10,000). ' +
+        'Pass `filters` (same shape as rootr_create_view filters, columns by NAME or id) to compare only the rows that match — ' +
+        'e.g. [{"propId":"상태","op":"is","values":["진행"]}]. When more than 5,000 vectors were compared without filters the ' +
+        'answer carries a `hint` saying so; `scanned` is how many vectors were compared.',
       annotations: { readOnlyHint: true, openWorldHint: false },
       inputSchema: {
         databaseId: z.string().describe(DATABASE_TARGET_DESC),
@@ -2426,13 +2463,21 @@ export function registerDatabaseTools(server) {
         vector: z.array(z.number()).describe('Query vector — same length as the column\'s dimensions'),
         topK: z.number().int().min(1).max(100).optional().default(10).describe('How many rows (default 10, max 100)'),
         minScore: z.number().min(-1).max(1).optional().describe('Only rows with cosine ≥ this'),
+        filters: z
+          .array(z.object({ propId: z.string(), op: z.string(), values: z.array(z.string()).optional() }))
+          .optional()
+          .describe(
+            'Compare only rows matching EVERY condition (AND), checked before any vector is compared — the way to keep a big ' +
+              'column fast. Same conditions as a view filter: propId = column NAME or id, op = is / is_not / contains / ' +
+              'is_empty / is_not_empty / before / after / on / between / eq / gt / lt / checked / unchecked / today / this_week …',
+          ),
       },
     },
-    async ({ databaseId, column, vector, topK, minScore }) => {
+    async ({ databaseId, column, vector, topK, minScore, filters }) => {
       try {
         const client = makeClient();
         const id = await resolveNodeId(client, databaseId);
-        return jsonResult(await client.queryVectors(id, column, { vector, topK, minScore }));
+        return jsonResult(await client.queryVectors(id, column, { vector, topK, minScore, filters }));
       } catch (err) {
         return errorResult(err);
       }

package/lib/mcp-tools/documents.js

@@ -693,7 +693,10 @@ export function registerDocumentTools(server) {
       title: 'Duplicate a Rootr node (deep copy)',
       description:
         'Deep-copy a Rootr (루터) node — a document or a whole folder tree — next to the original, or into ' +
-        'another workspace the user can access (targetWorkspaceId). Returns the new root node.',
+        'another workspace the user can access (targetWorkspaceId). Returns the new root node. If an older table ' +
+        '(or one inside the copied folder) has two columns with the same name, the COPY gets the later one renamed ' +
+        'to "Name (2)" (values and views follow — columns are kept by id; the original is not changed) and the ' +
+        'result lists it in `renamedColumns`.',
       annotations: { readOnlyHint: false, destructiveHint: false },
       inputSchema: {
         target: z.string().describe('Node path (starting with "/") or node id to copy'),

package/lib/mcp-tools/feedback.js

@@ -60,7 +60,10 @@ export function registerFeedbackTools(server) {
           .string()
           .email()
           .optional()
-          .describe('Only if the user asked for a reply and gave you their address'),
+          .describe(
+            'Only if the user asked for a reply and gave you their address. Without it, the "fixed" notice goes to the ' +
+              'signed-in user, or — for a workspace API key — to the person who created that key.',
+          ),
         reporter: z
           .string()
           .max(120)

package/lib/mcp-tools/issues.js

@@ -1,6 +1,35 @@
 import { z } from 'zod';
 
 import { textResult, jsonResult, errorResult, makeClient, requireWorkspace, resolveNodeId, NODE_TARGET_HINT, NODE_URL_HINT } from './shared.js';
+import {
+  RootrApiError,
+  publicIssueMimeOf,
+  withPublicAttachments,
+  PUBLIC_ISSUE_FILE_EXTENSIONS,
+  PUBLIC_ISSUE_FILE_MAX_BYTES,
+  PUBLIC_ISSUE_FILES_PER_POST,
+} from '../client.js';
+
+/**
+ * ISSUE-PUBLIC — 외부 참여(웹게시한 트래커·페이지에 끼운 트래커에 밖의 사람이 무엇을 할 수 있나). 서버 값과 같아야 한다
+ * (issues/issue-schema.ts PUBLIC_PARTICIPATION_MODES).
+ */
+const PARTICIPATION = z
+  .enum(['read', 'login', 'anyone'])
+  .optional()
+  .describe(
+    'Outside participation (외부 참여) on the tracker\'s PUBLIC page and on any published PAGE that shows it (`issues` block): ' +
+      '"read" 보기만 (default) · "login" 로그인한 사람만 작성 (any Rootr account may file issues and comment) · ' +
+      '"anyone" 누구나 작성 (no account — visitors type a name, shown as "이름 (외부)"). Takes effect once the tracker ' +
+      '(or the page holding it) is published — rootr_publish_node.',
+  );
+
+/** 공개 주소 글자(slug · rootr.io/…/p/{slug} 주소)에서 slug 만. */
+function slugOf(target) {
+  const t = String(target || '').trim();
+  const m = /\/p\/([^/?#\s]+)/.exec(t);
+  return m ? decodeURIComponent(m[1]) : t;
+}
 
 /** Issue tracker tools: create tracker, list/create/get/update issues, comment. */
 export function registerIssueTools(server) {
@@ -19,13 +48,14 @@ export function registerIssueTools(server) {
           .string()
           .optional()
           .describe('Workspace id; defaults to ROOTR_WORKSPACE/config if omitted'),
+        publicParticipation: PARTICIPATION,
       },
     },
-    async ({ name, workspace }) => {
+    async ({ name, workspace, publicParticipation }) => {
       try {
         const ws = requireWorkspace(workspace);
         const client = makeClient(ws);
-        const result = await client.createIssueTracker(ws, name);
+        const result = await client.createIssueTracker(ws, name, publicParticipation ? { publicParticipation } : {});
         return jsonResult(result);
       } catch (err) {
         return errorResult(err);
@@ -170,4 +200,205 @@ export function registerIssueTools(server) {
       }
     },
   );
+
+  server.registerTool(
+    'rootr_update_issue_tracker',
+    {
+      title: 'Change an issue tracker\'s settings (outside participation, labels, types)',
+      description:
+        'Change settings of a Rootr (루터) issue tracker. `publicParticipation` decides what people OUTSIDE the workspace may ' +
+        'do on its public page (rootr.io/p/…) and on published PAGEs that show it: "read" 보기만 · "login" 로그인한 사람만 ' +
+        '작성 · "anyone" 누구나 작성 (just a name). Only the keys you send change; `labels`/`types` REPLACE the whole list ' +
+        '([{ id?, name, color? }] — read the current ones with rootr_list_issues / the tracker first). Changing ' +
+        'publicParticipation is an owner-level action (MANAGE, same as publishing) — use an account key (PAT). ' +
+        'To also publish in one step use rootr_publish_node with `participation`.',
+      annotations: { readOnlyHint: false, destructiveHint: false },
+      inputSchema: {
+        trackerId: z.string().describe(`Issue tracker node id${NODE_TARGET_HINT}`),
+        publicParticipation: PARTICIPATION,
+        labels: z
+          .array(z.object({ id: z.string().optional(), name: z.string(), color: z.string().optional() }))
+          .optional()
+          .describe('Full label list (replaces the current one)'),
+        types: z
+          .array(z.object({ id: z.string().optional(), name: z.string(), color: z.string().optional() }))
+          .optional()
+          .describe('Full issue type list (replaces the current one)'),
+      },
+    },
+    async ({ trackerId, ...patch }) => {
+      try {
+        const client = makeClient();
+        trackerId = await resolveNodeId(client, trackerId);
+        const body = Object.fromEntries(Object.entries(patch).filter(([, v]) => v !== undefined));
+        return jsonResult(await client.updateIssueTracker(trackerId, body));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
+  const PUBLIC_TARGET = {
+    url: z
+      .string()
+      .describe(
+        'The PUBLIC address of the tracker — "https://rootr.io/ko/p/<slug>" or just the slug. For a tracker shown on a ' +
+          'published PAGE, the page\'s address plus `blockId`.',
+      ),
+    blockId: z.string().optional().describe('Only when the tracker sits on a published PAGE: that `issues` block\'s id'),
+    guestName: z
+      .string()
+      .max(40)
+      .optional()
+      .describe('Name to show when writing as a guest (누구나 작성 mode with asGuest). Ignored when writing as your account.'),
+    asGuest: z
+      .boolean()
+      .optional()
+      .describe(
+        'Write WITHOUT your API key, as a guest with `guestName` (only works when participation is "anyone"). ' +
+          'Default false: the key\'s owner account is the author (works for "login" and "anyone").',
+      ),
+    password: z.string().optional().describe('If the public page is password-locked'),
+  };
+
+  /**
+   * ISSUE-PUBLIC-ATTACH — 공개 이슈·댓글에 붙일 파일. **내용(base64)만** 받는다 — 파일 경로는 받지 않는다: 원격 커넥터는 이 도구를 API 서버
+   * 안에서 돌리므로 경로를 읽으면 서버 파일을 남의 공개 트래커로 내보내는 구멍이 된다(rootr-remote-mcp-runs-in-api-process). 로컬에서도
+   * 같은 모양이라 원격/로컬을 가를 필요가 없다. 크기 상한은 서버와 같은 10MB(base64 로 약 13.4MB), 글 하나에 10개.
+   */
+  const PUBLIC_FILES = z
+    .array(
+      z.object({
+        filename: z.string().min(1).max(255).describe('File name with extension, e.g. "screenshot.png"'),
+        contentBase64: z
+          .string()
+          .max(Math.ceil(PUBLIC_ISSUE_FILE_MAX_BYTES / 3) * 4 + 4)
+          .describe('The file bytes, base64-encoded (≤10MB decoded)'),
+        mimeType: z.string().max(120).optional().describe('Optional — guessed from the extension'),
+      }),
+    )
+    .max(PUBLIC_ISSUE_FILES_PER_POST)
+    .optional()
+    .describe(
+      `Files to attach (≤${PUBLIC_ISSUE_FILES_PER_POST}, ≤10MB each): ${PUBLIC_ISSUE_FILE_EXTENSIONS.join(', ')}. ` +
+        'Images show inside the text, other files as a download link. svg/html/executables/video are refused, and the file\'s ' +
+        'first bytes must match its extension. Content only — no file paths.',
+    );
+
+  /** 파일들을 그 트래커에 올리고, 본문 끝에 붙일 줄들을 돌려준다. 보내기 전에 크기·형식을 거른다(서버가 다시 판정). */
+  async function uploadPublicFiles(client, slug, files, opts) {
+    const lines = [];
+    for (const f of files || []) {
+      const data = Buffer.from(f.contentBase64, 'base64');
+      if (!data.length) throw new RootrApiError(`빈 파일입니다: ${f.filename}`);
+      if (data.length > PUBLIC_ISSUE_FILE_MAX_BYTES) throw new RootrApiError(`파일이 너무 큽니다: ${f.filename} — 한 파일에 10MB까지`);
+      const mimeType = f.mimeType || publicIssueMimeOf(f.filename);
+      if (!mimeType) {
+        throw new RootrApiError(`이 형식은 올릴 수 없습니다: ${f.filename}`, { hint: `허용: ${PUBLIC_ISSUE_FILE_EXTENSIONS.join(', ')}` });
+      }
+      const out = await client.uploadPublicIssueFile(slug, { ...opts, filename: f.filename, mimeType, data });
+      lines.push(out.markdown);
+    }
+    return lines;
+  }
+
+  server.registerTool(
+    'rootr_search_public_issues',
+    {
+      title: 'Search the issues of a PUBLISHED tracker (outside view)',
+      description:
+        'Search/filter the issues of someone\'s (or your own) PUBLISHED Rootr (루터) issue tracker through its public address — ' +
+        'what an outside visitor sees. `q` matches title, body, number ("#12" or "12") and, when the tracker shows authors ' +
+        '(participation login/anyone), the author name; `labels` = label names (issues having all of them); `state` OPEN|CLOSED; ' +
+        '`sort` newest (default) | oldest | comments. Returns { participation, issues:[{number,title,state,body,labels,createdAt,' +
+        'closedAt,commentCount,author}], truncated? } (≤500 per call). No key needed. For a tracker in YOUR workspace prefer ' +
+        'rootr_list_issues (internal fields).',
+      annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: true },
+      inputSchema: {
+        url: PUBLIC_TARGET.url,
+        blockId: PUBLIC_TARGET.blockId,
+        password: PUBLIC_TARGET.password,
+        q: z.string().max(200).optional().describe('Search text'),
+        state: z.enum(['OPEN', 'CLOSED', 'ALL']).optional().describe('Default ALL'),
+        labels: z.array(z.string().max(100)).max(20).optional().describe('Label names — issues having all of them'),
+        sort: z.enum(['newest', 'oldest', 'comments']).optional(),
+      },
+    },
+    async ({ url, blockId, password, q, state, labels, sort }) => {
+      try {
+        const client = makeClient();
+        const slug = slugOf(url);
+        const pass = password ? await client.unlockPublicNode(slug, password) : undefined;
+        return jsonResult(await client.searchPublicIssues(slug, { blockId, q, state, labels, sort, pass }));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
+  server.registerTool(
+    'rootr_submit_public_issue',
+    {
+      title: 'File an issue on a PUBLISHED tracker (outside participation)',
+      description:
+        'File an issue on someone\'s (or your own) PUBLISHED Rootr (루터) issue tracker through its public address — the ' +
+        'way an outside person or an external agent reports a bug/request. Works only when the tracker\'s participation ' +
+        'allows it: "login" (your account key counts as signed in) or "anyone". Errors: 403 PUBLIC_READ_ONLY (보기만), ' +
+        '401 LOGIN_REQUIRED, 400 GUEST_NAME_REQUIRED, 401 PUBLIC_DOC_PASSWORD (pass `password`). Text and `files` only — labels, ' +
+        'assignee and state cannot be set from outside, and @mentions are stripped. `files` are uploaded to that tracker first ' +
+        'and appended to the body (415 ATTACHMENT_TYPE_NOT_ALLOWED / ATTACHMENT_CONTENT_MISMATCH, 413 ATTACHMENT_TOO_LARGE, ' +
+        '403 TRACKER_STORAGE_FULL). Returns { ok, number }. For a tracker in YOUR workspace prefer rootr_create_issue (full fields).',
+      annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+      inputSchema: {
+        ...PUBLIC_TARGET,
+        title: z.string().max(200).describe('Issue title (≤200)'),
+        body: z.string().max(20000).optional().describe('Issue body, markdown (≤20,000)'),
+        files: PUBLIC_FILES,
+      },
+    },
+    async ({ url, blockId, guestName, asGuest, password, title, body, files }) => {
+      try {
+        const client = makeClient();
+        const slug = slugOf(url);
+        const pass = password ? await client.unlockPublicNode(slug, password) : undefined;
+        const lines = await uploadPublicFiles(client, slug, files, { blockId, guestName, pass, asGuest });
+        const full = withPublicAttachments(body || '', lines);
+        return jsonResult(await client.submitPublicIssue(slug, { blockId, title, body: full || undefined, guestName, pass, asGuest }));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
+  server.registerTool(
+    'rootr_comment_public_issue',
+    {
+      title: 'Comment on an issue of a PUBLISHED tracker (outside participation)',
+      description:
+        'Comment on issue #number of a PUBLISHED Rootr (루터) issue tracker through its public address (same rules as ' +
+        'rootr_submit_public_issue, `files` too). Pass `read: true` instead of `body` to just read that issue\'s public comments. ' +
+        'Returns { ok, id } (or { number, comments } when reading).',
+      annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
+      inputSchema: {
+        ...PUBLIC_TARGET,
+        number: z.number().int().positive().describe('Issue number (#N)'),
+        body: z.string().max(10000).optional().describe('Comment, markdown (≤10,000). Required unless read is true or files are given'),
+        files: PUBLIC_FILES,
+        read: z.boolean().optional().describe('Only read the public comments of this issue'),
+      },
+    },
+    async ({ url, blockId, guestName, asGuest, password, number, body, files, read }) => {
+      try {
+        const client = makeClient();
+        const slug = slugOf(url);
+        const pass = password ? await client.unlockPublicNode(slug, password) : undefined;
+        if (read) return jsonResult(await client.readPublicIssue(slug, number, { blockId, pass }));
+        if (!body && !(files && files.length)) throw new Error('body is required (or files, or read: true)');
+        const lines = await uploadPublicFiles(client, slug, files, { blockId, guestName, pass, asGuest });
+        return jsonResult(await client.commentPublicIssue(slug, number, { blockId, body: withPublicAttachments(body || '', lines), guestName, pass, asGuest }));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
 }

package/lib/mcp-tools/pages.js

@@ -49,6 +49,8 @@ const BLOCK_GUIDE =
   '· booking {bookingNodeId(DATABASE node id — a table that is published with visitor booking turned on, see rootr_set_booking), headline?, type?} — ' +
   'a visitor scheduling calendar right on the page; `type` shows only one of the table\'s booking types. ' +
   'bookingNodeId must be the node ID (names/paths are not resolved here); a table that is not published or has booking off renders as "not taking bookings"\n' +
+  '· issues {trackerNodeId(ISSUE_TRACKER id, unique name or "/path"), headline?} — an issue tracker on the page: visitors read issues and comments and, ' +
+  'when the tracker\'s publicParticipation (rootr_update_issue_tracker) is "login" or "anyone", file issues and comment right there — the tracker itself need not be published\n' +
   '· custom {html, height?(40-4000, default 260), minHeight?:"none"|"screen", bleed?:boolean} — free HTML/CSS, rendered inside a locked-down sandboxed iframe ' +
   '(no scripts, no same-origin, no network). Use it for a look the other blocks cannot make. Page theme colors are ' +
   'available inside as var(--pg-bg|text|muted|faint|card|line|accent|on-accent) and var(--pg-font). Scripts and ' +

package/lib/mcp-tools/public.js

@@ -14,6 +14,16 @@ const DB_DESIGN_SCHEMA = z.object({
   skin: z.enum(['clean', 'paper', 'dark', 'vivid', 'bento', 'brutal']).optional(),
 });
 
+const PARTICIPATION = z
+  .enum(['read', 'login', 'anyone'])
+  .optional()
+  .describe(
+    'ISSUE_TRACKER only — who OUTSIDE the workspace may write on the public page (외부 참여): ' +
+      '"read" 보기만 (default), "login" 로그인한 사람만 작성 (any Rootr account files issues and comments), ' +
+      '"anyone" 누구나 작성 (no account — visitors type a name, shown as "이름 (외부)"). Stored on the tracker itself, ' +
+      'so a tracker placed on a published PAGE (`issues` block) follows the same setting. A password lock locks writing too.',
+  );
+
 /**
  * PUBLIC-ANY — **어떤 타입이든 공개 발행한다**(창업자 지시 2026-08-27).
  *
@@ -45,7 +55,8 @@ export function registerPublicTools(server) {
         'its rows, form responses, recording audio, CRM contacts and deal amounts, and signer names on a signed ' +
         'document. Rows/entries are capped at 500 per page and the page says so when it truncates. ' +
         'Owner-level action (MANAGE): use an ACCOUNT key (PAT), not a workspace-scoped/connector token. ' +
-        'Safe to call again — the slug never changes, so links already shared stay valid.',
+        'Safe to call again — the slug never changes, so links already shared stay valid. ' +
+        'ISSUE_TRACKER: pass `participation` ("anyone" = outside feedback box) to let visitors file issues and comment.',
       annotations: { readOnlyHint: false, destructiveHint: false },
       inputSchema: {
         target: z.string().describe(`Node id${NODE_TARGET_HINT}`),
@@ -64,13 +75,14 @@ export function registerPublicTools(server) {
             'leaves the layout alone. Layouts that need a column (calendar/timeline need a date, board a ' +
             'select/status, ranking a number, chart either) fall back to the table and say why.',
         ),
+        participation: PARTICIPATION,
       },
     },
-    async ({ target, includeChildren, view, design }) => {
+    async ({ target, includeChildren, view, design, participation }) => {
       try {
         const client = makeClient();
         const id = await resolveNodeId(client, target);
-        return jsonResult(await client.publishNode(id, { includeChildren, view, design }));
+        return jsonResult(await client.publishNode(id, { includeChildren, view, design, participation }));
       } catch (err) {
         return errorResult(err);
       }
@@ -97,6 +109,8 @@ export function registerPublicTools(server) {
         '`{"seoDescription": "...", "seoImage": "<attachment id>"}` sets the search-result description and link-preview ' +
         'image (search engines are pinged right away). ' +
         '`{"isPublic": true}` on a PAGE needs the Team plan (Free → 403 PLAN_UPGRADE_REQUIRED); closing it works on any plan. ' +
+        '`{"participation": "anyone"}` (ISSUE_TRACKER only) opens the public page to outside issues/comments — ' +
+        '"read" | "login" | "anyone"; on a tracker a password lock also locks writing. ' +
         'For DOCUMENT nodes use rootr_set_document_public instead — documents keep their own settings (skins, ' +
         'edit proposals) on the older path. Owner-level action (MANAGE): use an account key (PAT).',
       annotations: { readOnlyHint: false, destructiveHint: false },
@@ -125,6 +139,7 @@ export function registerPublicTools(server) {
             'board, timeline, calendar, chart, ranking. `skin` — clean, paper, dark, vivid, bento, brutal. ' +
             'Only the keys you send change.',
         ),
+        participation: PARTICIPATION,
       },
     },
     async ({ target, ...settings }) => {
@@ -152,7 +167,8 @@ export function registerPublicTools(server) {
         'address is closed right now — do NOT hand that URL out; tell the user why and how to reopen it. ' +
         '`closed: "PAGE_PUBLISH_REQUIRES_TEAM"` means a PAGE was published but its workspace is on the Free plan, so ' +
         'visitors see a "not published" screen — upgrading to Team reopens the same URL without publishing again. ' +
-        'Call this before publishing so you do not tell the user a page is new when it already had a URL.',
+        'Call this before publishing so you do not tell the user a page is new when it already had a URL. ' +
+        'An ISSUE_TRACKER also returns `participation` (read 보기만 | login 로그인한 사람만 작성 | anyone 누구나 작성).',
       annotations: { readOnlyHint: true, destructiveHint: false },
       inputSchema: {
         target: z.string().describe(`Node id${NODE_TARGET_HINT}`),

package/lib/mcp-tools/signed.js

@@ -184,22 +184,33 @@ export function registerSignedDocTools(server) {
       title: 'Turn a signed document into a research note',
       description:
         'Switch a SIGNED document to RESEARCH_NOTE mode and build the two-step line the Korean national R&D ' +
-        'guideline requires: 기재자(the caller) → 점검자(the reviewer/연구책임자). Optionally stores the cover ' +
-        'metadata (과제번호·과제명·기관). Use this instead of hand-building the approval line for 연구노트.',
+        'guideline requires: 기재자 → 점검자(the reviewer/연구책임자). Optionally stores the cover ' +
+        'metadata (과제번호·과제명·기관). Use this instead of hand-building the approval line for 연구노트. ' +
+        'When calling with a session login, 기재자 defaults to the caller and authorUserId can be omitted. ' +
+        'When calling with a WORKSPACE API KEY (no logged-in user), authorUserId is REQUIRED — pass the ' +
+        '기재자의 userId explicitly (it may be the same person as reviewerUserId).',
       annotations: { readOnlyHint: false, destructiveHint: true },
       inputSchema: {
         nodeId: z.string().describe(`서명문서 노드 id${NODE_TARGET_HINT}`),
         reviewerUserId: z.string().describe('점검자(연구책임자)의 userId'),
+        authorUserId: z
+          .string()
+          .optional()
+          .describe(
+            '기재자의 userId. 세션 로그인이면 생략 시 호출자 본인이 들어간다. ' +
+              'API 키로 부를 때는 필수 — 점검자와 같은 사람이어도 된다.',
+          ),
         noteMeta: z.record(z.any()).optional().describe('표지 정보: 과제번호·과제명·연구책임자·기관 등'),
         workspace: z.string().optional().describe('워크스페이스 id (생략하면 설정값)'),
       },
     },
-    async ({ nodeId, reviewerUserId, noteMeta, workspace }) => {
+    async ({ nodeId, reviewerUserId, authorUserId, noteMeta, workspace }) => {
       try {
         const client = makeClient(workspace);
         return jsonResult(
           await client.applyResearchNotePreset(await resolveNodeId(client, nodeId), {
             reviewerUserId,
+            authorUserId,
             noteMeta,
           }),
         );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rootr-cli",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "Official Rootr CLI + MCP server — read, write, edit and search Rootr documents from the shell or from an AI agent.",
   "type": "module",
   "bin": {