rootr-cli 0.33.0 → 0.34.0

package/README.ko.md

@@ -405,7 +405,7 @@ rootr memory forget <id>                         # 폐기(--hard면 행 삭제)
 
 ## MCP 서버로 사용하기
 
-`rootr mcp`는 stdio로 MCP(Model Context Protocol) 서버를 구동합니다. 제공 도구 220종:
+`rootr mcp`는 stdio로 MCP(Model Context Protocol) 서버를 구동합니다. 제공 도구 221종:
 
 노드를 가리키는 인자(`target`, `databaseId`, `spreadsheetId`, `formId`, `crmId`, `trackerId`,
 `recordingId`, `presentationId`, `whiteboardId`, `logId`, `parentId` 등)는 **노드 id와 경로를 모두**
@@ -488,11 +488,14 @@ rootr memory forget <id>                         # 폐기(--hard면 행 삭제)
 | `rootr_update_issue` | 이슈 갱신(닫기: state=CLOSED + stateReason) |
 | `rootr_comment_issue` | 이슈에 댓글 추가 |
 | `rootr_update_issue_tracker` | 트래커 설정 — **외부 참여**(`read` 보기만 · `login` 로그인한 사람만 작성 · `anyone` 누구나 작성), 라벨·유형 |
-| `rootr_submit_public_issue` | **웹게시한** 트래커에 밖에서 이슈 올리기(공개 주소로, `asGuest`+`guestName` 이면 손님으로, 페이지 블록은 `blockId`) |
-| `rootr_comment_public_issue` | 웹게시한 트래커의 이슈에 댓글(`read:true` 면 공개 댓글 읽기) |
+| `rootr_submit_public_issue` | **웹게시한** 트래커에 밖에서 이슈 올리기(공개 주소로, `asGuest`+`guestName` 이면 손님으로, 페이지 블록은 `blockId`, `files:[{filename, contentBase64}]` 첨부) |
+| `rootr_comment_public_issue` | 웹게시한 트래커의 이슈에 댓글(`files` 첨부, `read:true` 면 공개 댓글 읽기) |
+| `rootr_search_public_issues` | 웹게시한 트래커를 밖에서 찾기 — `q`(제목·본문·#번호·쓴 사람), `labels`(모두 가진 것), `state`, `sort`(newest·oldest·comments) |
 
 CLI: `rootr issue tracker <트래커> --participation anyone` · `rootr issue list|create|comment …` ·
-`rootr issue submit <공개 주소> --title "…" --name <이름>` · `rootr issue reply <공개 주소> <#번호> "<댓글>"`.
+`rootr issue list <공개 주소> --q "결제" --label 버그` · `rootr issue submit <공개 주소> --title "…" --name <이름> --file 화면.png --file 로그.txt` ·
+`rootr issue reply <공개 주소> <#번호> "<댓글>" [--file <경로>]`.
+첨부는 그림(png·jpg·gif·webp)·pdf·txt·csv·log·docx·xlsx·pptx·zip, 한 파일 10MB·글 하나에 10개까지입니다(확장자와 파일 첫 바이트가 맞아야 함).
 외부 참여는 **트래커 설정**이라 페이지(PAGE)에 `issues` 블록으로 끼운 트래커도 같은 규칙을 따릅니다.
 
 #### 웹훅 (webhooks:manage 스코프)

package/README.md

@@ -11,7 +11,7 @@ citations back to the exact paragraph.
 *(한국어 문서: [README.ko.md](https://github.com/gwmage/rootr-cli/blob/main/README.ko.md))*
 
 - `rootr` CLI — documents, databases, forms, signed documents, publishing, permissions, memory
-- `rootr mcp` — stdio MCP server, **220 tools** (see [MCP tools](#mcp-tools))
+- `rootr mcp` — stdio MCP server, **221 tools** (see [MCP tools](#mcp-tools))
 
 Plain Node.js ESM, no build step. Node 18+ (uses the built-in `fetch`).
 
@@ -311,9 +311,16 @@ rootr issue list /support/feedback --state ALL
 rootr issue create /support/feedback --title "Export is slow" --body "…"
 rootr issue comment /support/feedback 12 "Fixed in 1.4"
 rootr issue submit https://rootr.io/ko/p/AbCd123 --title "Button does nothing" --name "Kim"   # from outside, as a guest
+rootr issue submit https://rootr.io/ko/p/AbCd123 --title "Crash" --file shot.png --file app.log --name "Kim"   # with files
 rootr issue reply https://rootr.io/ko/p/AbCd123 12 "Same here" --name "Lee"
+rootr issue list https://rootr.io/ko/p/AbCd123 --q "payment" --label bug --sort comments   # search a published tracker
 ```
 
+Outside attachments: images (png·jpg·gif·webp), pdf, txt·csv·log, docx·xlsx·pptx, zip — 10MB per file, 10 per
+issue/comment; the extension and the file's first bytes must agree. MCP: `rootr_submit_public_issue` /
+`rootr_comment_public_issue` take `files: [{ filename, contentBase64 }]` (contents, never a path), and
+`rootr_search_public_issues` searches a published tracker the way a visitor does.
+
 Every node type publishes on the Free plan **except PAGE** (the block-built web page): publishing a
 page to the web needs the **Team plan**. On Free, `rootr publish <page>` fails with
 `PLAN_UPGRADE_REQUIRED` and nothing changes; `--children` skips pages underneath and says how many.
@@ -533,7 +540,7 @@ is refused and says when the grace was used.
 
 ## MCP tools
 
-`rootr mcp` speaks MCP over stdio. 220 tools:
+`rootr mcp` speaks MCP over stdio. 221 tools:
 
 | Group | Count | Tools |
 |---|---|---|

package/bin/rootr.js

@@ -5,7 +5,16 @@ import { dirname, join, basename, extname } from 'node:path';
 
 import { loadConfig, saveConfig, keyForWorkspace, maskKey, upsertKey, CONFIG_PATH, DEFAULT_BASE_URL } from '../lib/config.js';
 import { candidateClients, rememberWorkspace, resolveWorkspaceSwitch, surveyWorkspaces } from '../lib/credentials.js';
-import { RootrClient, RootrApiError, imageMarkdown } from '../lib/client.js';
+import {
+  RootrClient,
+  RootrApiError,
+  imageMarkdown,
+  publicIssueMimeOf,
+  withPublicAttachments,
+  PUBLIC_ISSUE_FILE_EXTENSIONS,
+  PUBLIC_ISSUE_FILE_MAX_BYTES,
+  PUBLIC_ISSUE_FILES_PER_POST,
+} from '../lib/client.js';
 import { setGlobalDocMailSink } from '../lib/context.js';
 import { resolveTarget, requireResolved, resolveMoveDestination } from '../lib/resolve.js';
 import { t as tr, lang } from '../lib/i18n.js';
@@ -78,12 +87,14 @@ const USAGE_KO = `Rootr CLI v${pkg.version}
   rootr publish <path|id> --password <비번> | --no-password  공개 주소 잠그기(Team 부터)·풀기 — 이슈트래커는 쓰기도 같이 잠김
   rootr publish <이슈트래커> --participation read|login|anyone  외부 참여 — 보기만·로그인한 사람만 작성·누구나 작성(이름만 적고)
   rootr issue tracker <트래커> [--participation read|login|anyone] [--json]  트래커 설정 보기·외부 참여 바꾸기(MANAGE)
-  rootr issue list <트래커> [--state OPEN|CLOSED|ALL] [--q <검색어>] [--json]  이슈 목록
+  rootr issue list <트래커|공개 주소> [--state OPEN|CLOSED|ALL] [--q <검색어>] [--label <라벨>]… [--sort newest|oldest|comments] [--json]
+                                                   이슈 목록·검색(공개 주소면 밖에서 — 제목·본문·#번호·쓴 사람, 페이지 블록은 --block)
   rootr issue create <트래커> --title "<제목>" [--body "<본문>"]  이슈 올리기(내 계정으로)
   rootr issue comment <트래커> <#번호> "<댓글>"       이슈에 댓글
-  rootr issue submit <공개 주소> --title "<제목>" [--body …] [--name <이름>] [--block <블록 id>] [--password <비번>]
+  rootr issue submit <공개 주소> --title "<제목>" [--body …] [--file <경로>]… [--name <이름>] [--block <블록 id>] [--password <비번>]
                                                    웹게시한 트래커에 밖에서 이슈 올리기(--name 이면 키 없이 손님으로, 페이지 블록은 --block)
-  rootr issue reply <공개 주소> <#번호> "<댓글>" [--name <이름>] [--block <블록 id>] [--password <비번>]  웹게시한 트래커 이슈에 댓글
+                                                   --file: 그림·pdf·txt·csv·log·docx·xlsx·pptx·zip, 한 파일 10MB·글 하나에 10개
+  rootr issue reply <공개 주소> <#번호> "<댓글>" [--file <경로>]… [--name <이름>] [--block <블록 id>] [--password <비번>]  웹게시한 트래커 이슈에 댓글
   rootr booking show <표>                           방문자 일정 등록(예약) 설정 보기
   rootr booking set <표> --on --days 1,2,3,4,5 --hours 10:00-18:00 --duration 30  예약 켜기·규칙
   rootr booking set <표> --ask "연락처:required" --approval manual  방문자에게 더 묻기 · 승인 후 확정
@@ -232,12 +243,14 @@ usage:
   rootr publish <path|id> --password <pw> | --no-password  lock (Team plan) / unlock the public address — on a tracker writing is locked too
   rootr publish <issue tracker> --participation read|login|anyone  outside participation — read-only · signed-in users write · anyone writes (just a name)
   rootr issue tracker <tracker> [--participation read|login|anyone] [--json]  show tracker settings / change outside participation (MANAGE)
-  rootr issue list <tracker> [--state OPEN|CLOSED|ALL] [--q <text>] [--json]  list issues
+  rootr issue list <tracker|public URL> [--state OPEN|CLOSED|ALL] [--q <text>] [--label <name>]… [--sort newest|oldest|comments] [--json]
+                                                   list/search issues (a public URL searches a PUBLISHED tracker from outside — title, body, #number, author; --block for a page)
   rootr issue create <tracker> --title "<title>" [--body "<body>"]  file an issue (as your account)
   rootr issue comment <tracker> <#number> "<comment>"  comment on an issue
-  rootr issue submit <public URL> --title "<title>" [--body …] [--name <name>] [--block <block id>] [--password <pw>]
+  rootr issue submit <public URL> --title "<title>" [--body …] [--file <path>]… [--name <name>] [--block <block id>] [--password <pw>]
                                                    file an issue on a PUBLISHED tracker from outside (--name = as a guest, no key; --block for a tracker on a page)
-  rootr issue reply <public URL> <#number> "<comment>" [--name <name>] [--block <block id>] [--password <pw>]  comment on an issue of a published tracker
+                                                   --file: images·pdf·txt·csv·log·docx·xlsx·pptx·zip, 10MB per file, 10 per issue/comment
+  rootr issue reply <public URL> <#number> "<comment>" [--file <path>]… [--name <name>] [--block <block id>] [--password <pw>]  comment on an issue of a published tracker
   rootr booking show <table>                        show visitor booking settings
   rootr booking set <table> --on --days 1,2,3,4,5 --hours 10:00-18:00 --duration 30  turn on + rules
   rootr booking set <table> --ask "Phone:required" --approval manual  ask more · confirm after approval
@@ -324,7 +337,8 @@ function usage(syntax) {
 }
 
 function parseArgs(argv) {
-  const args = { _: [] };
+  // `__all[key]` — 같은 깃발을 여러 번 준 값 전부(`--file a --file b`). 나머지 명령은 예전처럼 마지막 값(args[key])을 쓴다.
+  const args = { _: [], __all: {} };
   for (let i = 0; i < argv.length; i++) {
     const tok = argv[i];
     if (tok.startsWith('--')) {
@@ -334,6 +348,7 @@ function parseArgs(argv) {
         args[key] = true;
       } else {
         args[key] = next;
+        (args.__all[key] = args.__all[key] || []).push(next);
         i++;
       }
     } else {
@@ -2207,6 +2222,28 @@ function issueNumberOf(raw) {
   return n;
 }
 
+/** `--file <경로>`(여러 번) → 올릴 파일들. 개수·크기·형식을 보내기 전에 거른다 — 서버 안전선(issue-public-attachments.ts)과 같은 값. */
+function publicIssueFilesOf(args) {
+  const paths = args.__all.file || (typeof args.file === 'string' ? [args.file] : []);
+  if (paths.length > PUBLIC_ISSUE_FILES_PER_POST) {
+    throw new Error(tr(`파일은 글 하나에 ${PUBLIC_ISSUE_FILES_PER_POST}개까지 붙일 수 있습니다.`, `At most ${PUBLIC_ISSUE_FILES_PER_POST} files per issue/comment.`));
+  }
+  return paths.map((p) => {
+    const filename = basename(p);
+    const mimeType = publicIssueMimeOf(filename);
+    if (!mimeType) {
+      throw new Error(
+        tr(`이 형식은 올릴 수 없습니다: ${filename} — ${PUBLIC_ISSUE_FILE_EXTENSIONS.join('·')} 만`, `File type not allowed: ${filename} — only ${PUBLIC_ISSUE_FILE_EXTENSIONS.join(', ')}`),
+      );
+    }
+    const data = readFileSync(p);
+    if (data.length > PUBLIC_ISSUE_FILE_MAX_BYTES) {
+      throw new Error(tr(`파일이 너무 큽니다: ${filename} — 한 파일에 10MB까지`, `File too large: ${filename} — 10MB per file`));
+    }
+    return { filename, mimeType, data };
+  });
+}
+
 /**
  * ISSUE-PUBLIC — 이슈트래커 명령(창업자 지시 2026-11-02 "api cli mcp scaffold 에도 적용"). 예전엔 CLI 에 이슈 명령이 아예 없었다.
  *  · 안에서: tracker(설정·외부 참여) · list · create · comment
@@ -2246,7 +2283,30 @@ async function cmdIssue(args) {
   }
   if (sub === 'list') {
     const target = args._[1];
-    if (!target) throw new Error(usage('rootr issue list <path|id> [--state OPEN|CLOSED|ALL] [--q <text>] [--json]'));
+    if (!target) throw new Error(usage('rootr issue list <path|id|공개 주소> [--state OPEN|CLOSED|ALL] [--q <text>] [--label <이름>]… [--sort newest|oldest|comments] [--json]'));
+    // ISSUE-PUBLIC-SEARCH — 공개 주소(…/p/{slug})나 --block 이면 웹게시한 트래커를 **밖에서** 찾는다(키 없이, 서버 검색).
+    if (/\/p\//.test(String(target)) || typeof args.block === 'string') {
+      const slug = publicSlugOf(target);
+      const pass = typeof args.password === 'string' ? await client.unlockPublicNode(slug, args.password) : undefined;
+      const res = await client.searchPublicIssues(slug, {
+        blockId: typeof args.block === 'string' ? args.block : undefined,
+        q: typeof args.q === 'string' ? args.q : undefined,
+        state: typeof args.state === 'string' ? args.state : undefined,
+        labels: args.__all.label || [],
+        sort: typeof args.sort === 'string' ? args.sort : undefined,
+        pass,
+      });
+      if (args.json) return console.log(JSON.stringify(res, null, 2));
+      const list = res?.issues || [];
+      if (!list.length) return console.log(tr('조건에 맞는 이슈가 없습니다.', 'No matching issues.'));
+      for (const i of list) {
+        const who = i.author ? (i.author.guest ? tr(`${i.author.name} (외부)`, `${i.author.name} (guest)`) : i.author.name) : '';
+        const labels = (i.labels || []).map((l) => l.name).join(',');
+        console.log(`#${i.number}\t${i.state}\t${i.title}${labels ? `\t[${labels}]` : ''}${who ? `\t${who}` : ''}${i.commentCount ? `\t💬${i.commentCount}` : ''}`);
+      }
+      if (res.truncated) console.log(tr(`… ${res.truncated.total}건 중 ${res.truncated.shown}건`, `… ${res.truncated.shown} of ${res.truncated.total}`));
+      return;
+    }
     const id = await resolveNodeId(client, target);
     const list = issuesOf(await client.listIssues(id, { state: args.state, q: typeof args.q === 'string' ? args.q : undefined }));
     if (args.json) return console.log(JSON.stringify(list, null, 2));
@@ -2287,16 +2347,29 @@ async function cmdIssue(args) {
       asGuest,
       pass: typeof args.password === 'string' ? await client.unlockPublicNode(slug, args.password) : undefined,
     };
+    // ISSUE-PUBLIC-ATTACH — `--file <경로>` 여러 번. 보내기 전에 크기·형식을 걸러(서버가 다시 판정) 올리고, 받은 줄을 본문 끝에 붙인다.
+    const files = publicIssueFilesOf(args);
+    const attach = async () => {
+      const lines = [];
+      for (const f of files) {
+        const out = await client.uploadPublicIssueFile(slug, { ...opts, filename: f.filename, mimeType: f.mimeType, data: f.data });
+        console.log(tr(`첨부: ${out.filename} (${out.size}B)`, `attached: ${out.filename} (${out.size}B)`));
+        lines.push(out.markdown);
+      }
+      return lines;
+    };
     if (sub === 'submit') {
-      if (typeof args.title !== 'string') throw new Error(usage('rootr issue submit <public URL> --title "<title>" [--body …] [--name <name>] [--block <id>]'));
-      const out = await client.submitPublicIssue(slug, { ...opts, title: args.title, body: typeof args.body === 'string' ? args.body : undefined });
+      if (typeof args.title !== 'string') throw new Error(usage('rootr issue submit <public URL> --title "<title>" [--body …] [--file <경로>]… [--name <name>] [--block <id>]'));
+      const body = withPublicAttachments(typeof args.body === 'string' ? args.body : '', await attach());
+      const out = await client.submitPublicIssue(slug, { ...opts, title: args.title, body: body || undefined });
       console.log(out?.number ? tr(`올렸습니다: #${out.number}`, `Filed: #${out.number}`) : tr('올렸습니다.', 'Filed.'));
       return;
     }
     const [, , num, ...rest] = args._;
     const text = rest.join(' ').trim();
-    if (!num || !text) throw new Error(usage('rootr issue reply <public URL> <#number> "<comment>" [--name <name>] [--block <id>]'));
-    await client.commentPublicIssue(slug, issueNumberOf(num), { ...opts, body: text });
+    if (!num || (!text && !files.length)) throw new Error(usage('rootr issue reply <public URL> <#number> "<comment>" [--file <경로>]… [--name <name>] [--block <id>]'));
+    const n = issueNumberOf(num);
+    await client.commentPublicIssue(slug, n, { ...opts, body: withPublicAttachments(text, await attach()) });
     console.log(tr('댓글을 달았습니다.', 'Comment posted.'));
     return;
   }

package/lib/client.js

@@ -115,6 +115,43 @@ function hintFor(status, body) {
   return undefined;
 }
 
+/**
+ * ISSUE-PUBLIC-ATTACH — 공개 이슈트래커 첨부의 안전선(서버 issue-public-attachments.ts 와 같은 값). 서버가 다시 판정하지만, 보내기 전에
+ * 걸러 큰 파일을 헛되이 싣지 않게 한다.
+ */
+export const PUBLIC_ISSUE_FILE_MAX_BYTES = 10 * 1024 * 1024;
+export const PUBLIC_ISSUE_FILES_PER_POST = 10;
+const PUBLIC_ISSUE_MIME = {
+  png: 'image/png',
+  jpg: 'image/jpeg',
+  jpeg: 'image/jpeg',
+  gif: 'image/gif',
+  webp: 'image/webp',
+  pdf: 'application/pdf',
+  txt: 'text/plain',
+  log: 'text/plain',
+  csv: 'text/csv',
+  docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+  zip: 'application/zip',
+};
+export const PUBLIC_ISSUE_FILE_EXTENSIONS = Object.keys(PUBLIC_ISSUE_MIME);
+
+/** 파일 이름 → 보낼 mimeType(모르는 확장자면 null — 서버가 415 로 거절할 것을 미리 알린다). */
+export function publicIssueMimeOf(filename) {
+  const ext = String(filename || '').split('.').pop().toLowerCase();
+  return PUBLIC_ISSUE_MIME[ext] || null;
+}
+
+/** 본문 끝에 첨부 줄(서버가 준 `markdown`)을 붙인다 — 화면(PublicIssueBoard)과 같은 모양. */
+export function withPublicAttachments(body, markdowns) {
+  const lines = (markdowns || []).filter(Boolean);
+  if (!lines.length) return body || '';
+  const text = String(body || '').replace(/\s+$/, '');
+  return `${text}${text ? '\n\n' : ''}${lines.join('\n\n')}`;
+}
+
 export class RootrClient {
   constructor({ apiKey, workspace, baseUrl, publicBaseUrl, defaultHeaders }) {
     this.apiKey = apiKey;
@@ -996,6 +1033,39 @@ export class RootrClient {
     });
   }
 
+  /**
+   * ISSUE-PUBLIC-SEARCH — 공개 트래커(또는 페이지 블록)의 목록을 서버에서 찾는다. `q` 는 제목·본문·번호(#12)·(이름을 싣는 모드면) 쓴 사람,
+   * `labels` 는 이름(모두 가진 것), `state` OPEN|CLOSED, `sort` newest|oldest|comments. 키 없이 부른다(공개 읽기).
+   */
+  async searchPublicIssues(slug, { blockId, q, state, labels, sort, pass } = {}) {
+    const qs = new URLSearchParams();
+    if (q) qs.set('q', q);
+    if (state && String(state).toUpperCase() !== 'ALL') qs.set('state', String(state).toUpperCase());
+    for (const l of [].concat(labels || [])) if (l) qs.append('label', l);
+    if (sort) qs.set('sort', sort);
+    if (pass) qs.set('pass', pass);
+    const tail = qs.toString();
+    return this.request(`${this._publicIssuesBase(slug, blockId)}${tail ? `?${tail}` : ''}`, { noAuth: true });
+  }
+
+  /**
+   * ISSUE-PUBLIC-ATTACH — 공개 트래커(또는 페이지 블록)에 새 이슈·댓글용 파일을 올린다(본문 = 바이트). 10MB·허용 형식은 서버가 판정한다.
+   * 돌려받은 `markdown` 을 이슈·댓글 본문 끝에 붙여 보낸다(`withPublicAttachments`).
+   */
+  async uploadPublicIssueFile(slug, { blockId, filename, mimeType, data, guestName, pass, asGuest } = {}) {
+    const s = encodeURIComponent(slug);
+    const base = blockId ? `/public/nodes/${s}/issue-blocks/${encodeURIComponent(blockId)}/attachments` : `/public/nodes/${s}/issues/attachments`;
+    const qs = new URLSearchParams({ filename, mimeType: mimeType || publicIssueMimeOf(filename) || 'application/octet-stream' });
+    if (guestName) qs.set('guestName', guestName);
+    if (pass) qs.set('pass', pass);
+    return this.request(`${base}?${qs.toString()}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/octet-stream' },
+      body: data,
+      noAuth: Boolean(asGuest) || !this.apiKey,
+    });
+  }
+
   /** 공개 트래커(또는 페이지 블록)의 이슈 하나 — 댓글까지. */
   async readPublicIssue(slug, number, { blockId, pass } = {}) {
     const qs = pass ? `?pass=${encodeURIComponent(pass)}` : '';
@@ -1509,10 +1579,10 @@ export class RootrClient {
     });
   }
 
-  async queryVectors(databaseId, column, { vector, topK, minScore } = {}) {
+  async queryVectors(databaseId, column, { vector, topK, minScore, filters } = {}) {
     return this.request(`/databases/${encodeURIComponent(databaseId)}/vectors/${encodeURIComponent(column)}/query`, {
       method: 'POST',
-      body: { vector, topK, minScore },
+      body: { vector, topK, minScore, ...(filters?.length ? { filters } : {}) },
     });
   }
 

package/lib/mcp-tools/databases.js

@@ -2452,7 +2452,10 @@ export function registerDatabaseTools(server) {
         'query with the same model you used for rootr_set_row_vectors. `minScore` drops weak matches. Rows the caller ' +
         'cannot see (own-rows-only tables) are never returned. Rows without a stored vector are skipped. ' +
         'The column can hold at most 50,000 vectors — a bigger column is refused, not searched partially — and the scan has ' +
-        'no index, so latency grows with the number of rows in the column.',
+        'no index, so latency grows with the number of rows compared (1536 dims: ~0.7s at 2,000 rows, ~3s at 10,000). ' +
+        'Pass `filters` (same shape as rootr_create_view filters, columns by NAME or id) to compare only the rows that match — ' +
+        'e.g. [{"propId":"상태","op":"is","values":["진행"]}]. When more than 5,000 vectors were compared without filters the ' +
+        'answer carries a `hint` saying so; `scanned` is how many vectors were compared.',
       annotations: { readOnlyHint: true, openWorldHint: false },
       inputSchema: {
         databaseId: z.string().describe(DATABASE_TARGET_DESC),
@@ -2460,13 +2463,21 @@ export function registerDatabaseTools(server) {
         vector: z.array(z.number()).describe('Query vector — same length as the column\'s dimensions'),
         topK: z.number().int().min(1).max(100).optional().default(10).describe('How many rows (default 10, max 100)'),
         minScore: z.number().min(-1).max(1).optional().describe('Only rows with cosine ≥ this'),
+        filters: z
+          .array(z.object({ propId: z.string(), op: z.string(), values: z.array(z.string()).optional() }))
+          .optional()
+          .describe(
+            'Compare only rows matching EVERY condition (AND), checked before any vector is compared — the way to keep a big ' +
+              'column fast. Same conditions as a view filter: propId = column NAME or id, op = is / is_not / contains / ' +
+              'is_empty / is_not_empty / before / after / on / between / eq / gt / lt / checked / unchecked / today / this_week …',
+          ),
       },
     },
-    async ({ databaseId, column, vector, topK, minScore }) => {
+    async ({ databaseId, column, vector, topK, minScore, filters }) => {
       try {
         const client = makeClient();
         const id = await resolveNodeId(client, databaseId);
-        return jsonResult(await client.queryVectors(id, column, { vector, topK, minScore }));
+        return jsonResult(await client.queryVectors(id, column, { vector, topK, minScore, filters }));
       } catch (err) {
         return errorResult(err);
       }

package/lib/mcp-tools/documents.js

@@ -693,7 +693,10 @@ export function registerDocumentTools(server) {
       title: 'Duplicate a Rootr node (deep copy)',
       description:
         'Deep-copy a Rootr (루터) node — a document or a whole folder tree — next to the original, or into ' +
-        'another workspace the user can access (targetWorkspaceId). Returns the new root node.',
+        'another workspace the user can access (targetWorkspaceId). Returns the new root node. If an older table ' +
+        '(or one inside the copied folder) has two columns with the same name, the COPY gets the later one renamed ' +
+        'to "Name (2)" (values and views follow — columns are kept by id; the original is not changed) and the ' +
+        'result lists it in `renamedColumns`.',
       annotations: { readOnlyHint: false, destructiveHint: false },
       inputSchema: {
         target: z.string().describe('Node path (starting with "/") or node id to copy'),

package/lib/mcp-tools/issues.js

@@ -1,6 +1,14 @@
 import { z } from 'zod';
 
 import { textResult, jsonResult, errorResult, makeClient, requireWorkspace, resolveNodeId, NODE_TARGET_HINT, NODE_URL_HINT } from './shared.js';
+import {
+  RootrApiError,
+  publicIssueMimeOf,
+  withPublicAttachments,
+  PUBLIC_ISSUE_FILE_EXTENSIONS,
+  PUBLIC_ISSUE_FILE_MAX_BYTES,
+  PUBLIC_ISSUE_FILES_PER_POST,
+} from '../client.js';
 
 /**
  * ISSUE-PUBLIC — 외부 참여(웹게시한 트래커·페이지에 끼운 트래커에 밖의 사람이 무엇을 할 수 있나). 서버 값과 같아야 한다
@@ -253,6 +261,81 @@ export function registerIssueTools(server) {
     password: z.string().optional().describe('If the public page is password-locked'),
   };
 
+  /**
+   * ISSUE-PUBLIC-ATTACH — 공개 이슈·댓글에 붙일 파일. **내용(base64)만** 받는다 — 파일 경로는 받지 않는다: 원격 커넥터는 이 도구를 API 서버
+   * 안에서 돌리므로 경로를 읽으면 서버 파일을 남의 공개 트래커로 내보내는 구멍이 된다(rootr-remote-mcp-runs-in-api-process). 로컬에서도
+   * 같은 모양이라 원격/로컬을 가를 필요가 없다. 크기 상한은 서버와 같은 10MB(base64 로 약 13.4MB), 글 하나에 10개.
+   */
+  const PUBLIC_FILES = z
+    .array(
+      z.object({
+        filename: z.string().min(1).max(255).describe('File name with extension, e.g. "screenshot.png"'),
+        contentBase64: z
+          .string()
+          .max(Math.ceil(PUBLIC_ISSUE_FILE_MAX_BYTES / 3) * 4 + 4)
+          .describe('The file bytes, base64-encoded (≤10MB decoded)'),
+        mimeType: z.string().max(120).optional().describe('Optional — guessed from the extension'),
+      }),
+    )
+    .max(PUBLIC_ISSUE_FILES_PER_POST)
+    .optional()
+    .describe(
+      `Files to attach (≤${PUBLIC_ISSUE_FILES_PER_POST}, ≤10MB each): ${PUBLIC_ISSUE_FILE_EXTENSIONS.join(', ')}. ` +
+        'Images show inside the text, other files as a download link. svg/html/executables/video are refused, and the file\'s ' +
+        'first bytes must match its extension. Content only — no file paths.',
+    );
+
+  /** 파일들을 그 트래커에 올리고, 본문 끝에 붙일 줄들을 돌려준다. 보내기 전에 크기·형식을 거른다(서버가 다시 판정). */
+  async function uploadPublicFiles(client, slug, files, opts) {
+    const lines = [];
+    for (const f of files || []) {
+      const data = Buffer.from(f.contentBase64, 'base64');
+      if (!data.length) throw new RootrApiError(`빈 파일입니다: ${f.filename}`);
+      if (data.length > PUBLIC_ISSUE_FILE_MAX_BYTES) throw new RootrApiError(`파일이 너무 큽니다: ${f.filename} — 한 파일에 10MB까지`);
+      const mimeType = f.mimeType || publicIssueMimeOf(f.filename);
+      if (!mimeType) {
+        throw new RootrApiError(`이 형식은 올릴 수 없습니다: ${f.filename}`, { hint: `허용: ${PUBLIC_ISSUE_FILE_EXTENSIONS.join(', ')}` });
+      }
+      const out = await client.uploadPublicIssueFile(slug, { ...opts, filename: f.filename, mimeType, data });
+      lines.push(out.markdown);
+    }
+    return lines;
+  }
+
+  server.registerTool(
+    'rootr_search_public_issues',
+    {
+      title: 'Search the issues of a PUBLISHED tracker (outside view)',
+      description:
+        'Search/filter the issues of someone\'s (or your own) PUBLISHED Rootr (루터) issue tracker through its public address — ' +
+        'what an outside visitor sees. `q` matches title, body, number ("#12" or "12") and, when the tracker shows authors ' +
+        '(participation login/anyone), the author name; `labels` = label names (issues having all of them); `state` OPEN|CLOSED; ' +
+        '`sort` newest (default) | oldest | comments. Returns { participation, issues:[{number,title,state,body,labels,createdAt,' +
+        'closedAt,commentCount,author}], truncated? } (≤500 per call). No key needed. For a tracker in YOUR workspace prefer ' +
+        'rootr_list_issues (internal fields).',
+      annotations: { readOnlyHint: true, destructiveHint: false, openWorldHint: true },
+      inputSchema: {
+        url: PUBLIC_TARGET.url,
+        blockId: PUBLIC_TARGET.blockId,
+        password: PUBLIC_TARGET.password,
+        q: z.string().max(200).optional().describe('Search text'),
+        state: z.enum(['OPEN', 'CLOSED', 'ALL']).optional().describe('Default ALL'),
+        labels: z.array(z.string().max(100)).max(20).optional().describe('Label names — issues having all of them'),
+        sort: z.enum(['newest', 'oldest', 'comments']).optional(),
+      },
+    },
+    async ({ url, blockId, password, q, state, labels, sort }) => {
+      try {
+        const client = makeClient();
+        const slug = slugOf(url);
+        const pass = password ? await client.unlockPublicNode(slug, password) : undefined;
+        return jsonResult(await client.searchPublicIssues(slug, { blockId, q, state, labels, sort, pass }));
+      } catch (err) {
+        return errorResult(err);
+      }
+    },
+  );
+
   server.registerTool(
     'rootr_submit_public_issue',
     {
@@ -261,22 +344,26 @@ export function registerIssueTools(server) {
         'File an issue on someone\'s (or your own) PUBLISHED Rootr (루터) issue tracker through its public address — the ' +
         'way an outside person or an external agent reports a bug/request. Works only when the tracker\'s participation ' +
         'allows it: "login" (your account key counts as signed in) or "anyone". Errors: 403 PUBLIC_READ_ONLY (보기만), ' +
-        '401 LOGIN_REQUIRED, 400 GUEST_NAME_REQUIRED, 401 PUBLIC_DOC_PASSWORD (pass `password`). Text only — labels, ' +
-        'assignee and state cannot be set from outside, and @mentions are stripped. Returns { ok, number }. ' +
-        'For a tracker in YOUR workspace prefer rootr_create_issue (full fields).',
+        '401 LOGIN_REQUIRED, 400 GUEST_NAME_REQUIRED, 401 PUBLIC_DOC_PASSWORD (pass `password`). Text and `files` only — labels, ' +
+        'assignee and state cannot be set from outside, and @mentions are stripped. `files` are uploaded to that tracker first ' +
+        'and appended to the body (415 ATTACHMENT_TYPE_NOT_ALLOWED / ATTACHMENT_CONTENT_MISMATCH, 413 ATTACHMENT_TOO_LARGE, ' +
+        '403 TRACKER_STORAGE_FULL). Returns { ok, number }. For a tracker in YOUR workspace prefer rootr_create_issue (full fields).',
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
       inputSchema: {
         ...PUBLIC_TARGET,
         title: z.string().max(200).describe('Issue title (≤200)'),
         body: z.string().max(20000).optional().describe('Issue body, markdown (≤20,000)'),
+        files: PUBLIC_FILES,
       },
     },
-    async ({ url, blockId, guestName, asGuest, password, title, body }) => {
+    async ({ url, blockId, guestName, asGuest, password, title, body, files }) => {
       try {
         const client = makeClient();
         const slug = slugOf(url);
         const pass = password ? await client.unlockPublicNode(slug, password) : undefined;
-        return jsonResult(await client.submitPublicIssue(slug, { blockId, title, body, guestName, pass, asGuest }));
+        const lines = await uploadPublicFiles(client, slug, files, { blockId, guestName, pass, asGuest });
+        const full = withPublicAttachments(body || '', lines);
+        return jsonResult(await client.submitPublicIssue(slug, { blockId, title, body: full || undefined, guestName, pass, asGuest }));
       } catch (err) {
         return errorResult(err);
       }
@@ -289,24 +376,26 @@ export function registerIssueTools(server) {
       title: 'Comment on an issue of a PUBLISHED tracker (outside participation)',
       description:
         'Comment on issue #number of a PUBLISHED Rootr (루터) issue tracker through its public address (same rules as ' +
-        'rootr_submit_public_issue). Pass `read: true` instead of `body` to just read that issue\'s public comments. ' +
+        'rootr_submit_public_issue, `files` too). Pass `read: true` instead of `body` to just read that issue\'s public comments. ' +
         'Returns { ok, id } (or { number, comments } when reading).',
       annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: true },
       inputSchema: {
         ...PUBLIC_TARGET,
         number: z.number().int().positive().describe('Issue number (#N)'),
-        body: z.string().max(10000).optional().describe('Comment, markdown (≤10,000). Required unless read is true'),
+        body: z.string().max(10000).optional().describe('Comment, markdown (≤10,000). Required unless read is true or files are given'),
+        files: PUBLIC_FILES,
         read: z.boolean().optional().describe('Only read the public comments of this issue'),
       },
     },
-    async ({ url, blockId, guestName, asGuest, password, number, body, read }) => {
+    async ({ url, blockId, guestName, asGuest, password, number, body, files, read }) => {
       try {
         const client = makeClient();
         const slug = slugOf(url);
         const pass = password ? await client.unlockPublicNode(slug, password) : undefined;
         if (read) return jsonResult(await client.readPublicIssue(slug, number, { blockId, pass }));
-        if (!body) throw new Error('body is required (or pass read: true)');
-        return jsonResult(await client.commentPublicIssue(slug, number, { blockId, body, guestName, pass, asGuest }));
+        if (!body && !(files && files.length)) throw new Error('body is required (or files, or read: true)');
+        const lines = await uploadPublicFiles(client, slug, files, { blockId, guestName, pass, asGuest });
+        return jsonResult(await client.commentPublicIssue(slug, number, { blockId, body: withPublicAttachments(body || '', lines), guestName, pass, asGuest }));
       } catch (err) {
         return errorResult(err);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rootr-cli",
-  "version": "0.33.0",
+  "version": "0.34.0",
   "description": "Official Rootr CLI + MCP server — read, write, edit and search Rootr documents from the shell or from an AI agent.",
   "type": "module",
   "bin": {