tina4ruby 3.13.137 → 3.13.139

data/lib/tina4/cache.rb

@@ -1,3 +1,9 @@
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 module Tina4
   # In-memory TTL cache with tag-based invalidation.
   #

data/lib/tina4/cache_backends/base_backend.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   module CacheBackends
@@ -72,6 +78,14 @@ module Tina4
       def available?
         true
       end
+
+      # When available? is false because a required gem is not installed, the
+      # sentence that names the gem and the install command; nil otherwise.
+      #
+      # @return [String, nil]
+      def missing_driver_message
+        nil
+      end
     end
   end
 end

data/lib/tina4/cache_backends/database_backend.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "json"
 require_relative "base_backend"

data/lib/tina4/cache_backends/file_backend.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "json"
 require "fileutils"

data/lib/tina4/cache_backends/memcached_backend.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "json"
 require "socket"

data/lib/tina4/cache_backends/memory_backend.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require_relative "base_backend"
 

data/lib/tina4/cache_backends/mongo_backend.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "json"
 require "uri"
@@ -17,6 +23,7 @@ module Tina4
         @hits = 0
         @misses = 0
         @coll = nil
+        @driver_missing = false
         begin
           require "mongo"
           Mongo::Logger.logger.level = Logger::FATAL if defined?(Mongo::Logger)
@@ -33,7 +40,12 @@ module Tina4
           @coll = client[:tina4_cache]
           @coll.indexes.create_one({ expires_at: 1 }, expire_after: 0)
           client.database.command(ping: 1)
-        rescue LoadError, StandardError
+        rescue LoadError
+          # Recorded apart from a service failure so the factory's fallback
+          # warning names the gem only when the gem is really what is missing.
+          @driver_missing = true
+          @coll = nil
+        rescue StandardError
           @coll = nil
         end
       end
@@ -42,6 +54,15 @@ module Tina4
         !@coll.nil?
       end
 
+      # The install hint for the factory's fallback warning, or nil when the
+      # gem loaded and the service is what failed.
+      def missing_driver_message
+        return nil unless @driver_missing
+
+        "The 'mongo' gem is required for the mongodb cache backend. Install it with: " \
+          "bundle add mongo (or add gem \"mongo\" to your Gemfile)"
+      end
+
       def get(key)
         if @coll.nil?
           @misses += 1

data/lib/tina4/cache_backends/redis_backend.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "json"
 require "socket"

data/lib/tina4/cache_backends/valkey_backend.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require_relative "redis_backend"
 

data/lib/tina4/cache_backends.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require_relative "cache_backends/base_backend"
 require_relative "cache_backends/memory_backend"
@@ -86,9 +92,11 @@ module Tina4
 
       # Configured backend unusable — degrade to the file backend.
       begin
+        install_hint = be.missing_driver_message
         Tina4::Log.warning(
           "Cache backend '#{backend}' is unavailable " \
-          "(driver missing or service unreachable) — falling back to 'file'."
+          "(driver missing or service unreachable) — falling back to 'file'." \
+          "#{install_hint ? " #{install_hint}" : ""}"
         )
       rescue StandardError
         # Logging must never break cache construction.

data/lib/tina4/cli.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 require "optparse"
 require "fileutils"
@@ -8,6 +14,7 @@ require "tmpdir"    # Dir.mktmpdir — used by the ADR-0063 sandbox edit-hint sc
 require "stringio"  # StringIO — captures generator stdout during the sandbox run
 require "open3"     # Open3.capture2e — captures `ruby -c` output+status for `lint`
 require_relative "port_takeover"
+require_relative "env"       # Tina4::Env.is_truthy -- resolve_config runs before lib/tina4 loads
 
 module Tina4
   class CLI
@@ -676,7 +683,7 @@ module Tina4
         # invokes PHP. That mismatch is why Ruby could not be launched through
         # the shared launcher the other frameworks use.
         opts.on("--managed", "Running under the tina4 CLI supervisor") { options[:managed] = true }
-        opts.on("--production", "Use production server (Puma)") { options[:production] = true }
+        opts.on("--production", "Production mode: Puma if the app bundles it, else the built-in server") { options[:production] = true }
         opts.on("--no-browser", "Do not open browser on start") { options[:no_browser] = true }
         opts.on("--no-reload", "Disable file watcher / live-reload") { options[:no_reload] = true }
         opts.on("--no-kill", "Never take over the port from a stale dev server") { options[:no_kill] = true }
@@ -708,6 +715,11 @@ module Tina4
 
       require_relative "../tina4"
 
+      # --production turns debug off: the explicit flag beats .env and the
+      # environment (ADR-0041, ADR-0079 s3). Set before the env files load,
+      # which are first-wins. It used to only choose Puma.
+      ENV["TINA4_DEBUG"] = "false" if options[:production]
+
       root_dir = Dir.pwd
       Tina4.initialize!(root_dir)
 
@@ -727,9 +739,9 @@ module Tina4
 
       is_debug = Tina4::Env.is_truthy(ENV["TINA4_DEBUG"])
 
-      # Use Puma only when explicitly requested via --production flag
-      # WEBrick is used for development (supports dev toolbar/reload)
-      # Same production server, same shutdown contract as Tina4.run! - one
+      # Puma only with --production AND only when the app bundles it
+      # (ADR-0067); otherwise Tina4's built-in server, in development and
+      # production alike. Same production server, same shutdown contract as Tina4.run! - one
       # implementation, so the two entry points cannot drift again (the old
       # copy here claimed "we handle DB cleanup" and did no cleanup at all).
       # TINA4_DEFAULT_WEBSERVER=TRUE pins the built-in server even with
@@ -739,7 +751,6 @@ module Tina4
         return
       end
 
-      Tina4::Log.info("Development server: WEBrick")
       server = Tina4::WebServer.new(app, host: options[:host], port: options[:port])
       server.start
     end
@@ -3806,7 +3817,7 @@ module Tina4
         # loopback, not 0.0.0.0. Only the DEFAULT changes: production
         # (TINA4_DEBUG off) keeps 0.0.0.0, and a developer who WANTS network
         # exposure sets TINA4_HOST=0.0.0.0 to override deliberately.
-        Tina4.truthy?(ENV["TINA4_DEBUG"]) ? "127.0.0.1" : DEFAULT_HOST
+        Tina4::Env.is_truthy(ENV["TINA4_DEBUG"]) ? "127.0.0.1" : DEFAULT_HOST
       end
     end
 
@@ -3875,9 +3886,18 @@ module Tina4
 
       # Gemfile
       unless File.exist?(File.join(dir, "Gemfile"))
+        # Same Gemfile `tina4 init ruby` writes. The gem is published as
+        # "tina4ruby" ("tina4-ruby" does not exist, so bundle install failed),
+        # and sqlite3 is an app dependency (ADR-0067): tina4ruby loads it lazily
+        # for the default SQLite database but never declares it.
         File.write(File.join(dir, "Gemfile"), <<~RUBY)
           source "https://rubygems.org"
-          gem "tina4-ruby", "~> 3.0"
+
+          gem "tina4ruby", "~> 3.0"
+
+          # SQLite driver for the default database (TINA4_DATABASE_URL=sqlite:...).
+          # tina4ruby loads it lazily; it is an app dependency, like pg or mysql2.
+          gem "sqlite3"
         RUBY
       end
 

data/lib/tina4/constants.rb

@@ -1,3 +1,9 @@
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 # Tina4 Constants — HTTP status codes and content types.
 #
 # Standard constants for use in route handlers across all Tina4 frameworks.
@@ -59,25 +65,23 @@ module Tina4
     304 => "Not Modified", 307 => "Temporary Redirect", 308 => "Permanent Redirect",
     400 => "Bad Request", 401 => "Unauthorized", 403 => "Forbidden",
     404 => "Not Found", 405 => "Method Not Allowed", 406 => "Not Acceptable",
+    408 => "Request Timeout",
     409 => "Conflict", 410 => "Gone", 413 => "Content Too Large",
     415 => "Unsupported Media Type", 422 => "Unprocessable Content",
-    429 => "Too Many Requests",
+    429 => "Too Many Requests", 431 => "Request Header Fields Too Large",
     500 => "Internal Server Error", 501 => "Not Implemented",
-    502 => "Bad Gateway", 503 => "Service Unavailable", 504 => "Gateway Timeout"
+    502 => "Bad Gateway", 503 => "Service Unavailable", 504 => "Gateway Timeout",
+    505 => "HTTP Version Not Supported"
   }.freeze
 
   # Return the canonical HTTP reason phrase for ``status``.
   #
   # Falls back to a sensible label when an exotic status is used. Never
   # returns an empty string — the HTTP/1.1 status line requires a phrase.
-  # Prefers Rack::Utils::HTTP_STATUS_CODES when Rack is available so the
-  # phrase tracks Rack's mapping, otherwise uses the local table above.
+  # The table is Tina4's own (the phrases match Python's and PHP's); it no
+  # longer defers to Rack::Utils, which is not a dependency.
   def self.http_reason(status)
     code = status.to_i
-    if defined?(Rack::Utils::HTTP_STATUS_CODES)
-      phrase = Rack::Utils::HTTP_STATUS_CODES[code]
-      return phrase if phrase && !phrase.empty?
-    end
     phrase = HTTP_REASON_PHRASES[code]
     return phrase if phrase && !phrase.empty?
     return "OK" if code >= 200 && code < 300

data/lib/tina4/container.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   # Lightweight dependency injection container.

data/lib/tina4/context/chunker.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 # Tina4 Ruby
 #

data/lib/tina4/context.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 # Tina4 Ruby
 #
@@ -6,9 +12,10 @@
 #
 # Lets a Tina4 app ground its own AI assistant on its own source, offline: it
 # walks the project, chunks code on def/class/module boundaries and docs as
-# prose, and answers keyword/fuzzy queries over a SQLite FTS5 index. The
-# sqlite3 gem is already a Tina4-Ruby runtime dependency and modern SQLite ships
-# FTS5 + bm25() built in, so this adds NO new dependency.
+# prose, and answers keyword/fuzzy queries over a SQLite FTS5 index. It uses the
+# sqlite3 gem the APP declares (the `tina4 init ruby` Gemfile carries it; tina4ruby
+# itself does not, ADR-0067) and modern SQLite ships FTS5 + bm25() built in, so
+# this adds NO dependency. Without the gem the index reports itself unavailable.
 #
 # The retrieval core is a thin port of tina4-python's tina4_python/context
 # (itself the proven slice of neemee: SqliteFTS + the stable
@@ -29,6 +36,7 @@ require "pathname"
 require "fileutils"
 require "set"
 require_relative "context/chunker"
+require_relative "sqlite3_gem"
 
 module Tina4
   class Context
@@ -70,7 +78,7 @@ module Tina4
       @available = !!check.call
       return unless @available
 
-      require "sqlite3"
+      Tina4.require_sqlite3!
       parent = File.dirname(@path)
       FileUtils.mkdir_p(parent) unless parent.empty? || parent == "." || File.directory?(parent)
       # One connection guarded by a Mutex — the dev-MCP reload hook may run on a
@@ -82,7 +90,7 @@ module Tina4
     # ── FTS5 availability ───────────────────────────────────────
     # Whether this Ruby's sqlite3 build supports FTS5 (a real in-memory probe).
     def self.fts5_available?
-      require "sqlite3"
+      Tina4.require_sqlite3!
       db = SQLite3::Database.new(":memory:")
       begin
         db.execute("CREATE VIRTUAL TABLE _probe USING fts5(x)")

data/lib/tina4/cors.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 
 module Tina4
   # CORS policy — reads config from env, computes the response headers.
@@ -37,6 +43,13 @@ module Tina4
         @warned = nil
       end
 
+      # The reasons warned about so far in this process - bounded by
+      # construction, never an origin (ADR-0048). Node's corsWarningReasons(),
+      # PHP's CorsMiddleware::warnedReasons().
+      def warned_reasons
+        (@warned || {}).keys.map(&:to_s)
+      end
+
       # The configured origins, split and emptied of blanks.
       def allowed_origins
         config[:origins].split(",").map(&:strip).reject(&:empty?)
@@ -56,8 +69,13 @@ module Tina4
         allowed = allowed_origins
         request_origin = env["HTTP_ORIGIN"]
 
+        # A same-origin request (browsers send Origin on every same-origin
+        # POST/PUT/PATCH/DELETE) is not a CORS request: it is never warned
+        # about. That ONLY silences the warning - it grants no CORS access.
+        cross_origin = present?(request_origin) && !same_origin?(env)
+
         if allowed.empty?
-          warn_once(:unconfigured, request_origin) if present?(request_origin)
+          warn_once(:unconfigured, request_origin) if cross_origin
           return {}
         end
 
@@ -70,7 +88,7 @@ module Tina4
 
         origin = resolve_origin(env)
         if origin.nil?
-          warn_once(:denied, request_origin) if present?(request_origin)
+          warn_once(:denied, request_origin) if cross_origin
           return headers
         end
 
@@ -150,6 +168,22 @@ module Tina4
         %w[true 1 yes].include?(config[:credentials].to_s.downcase)
       end
 
+      # Whether the request's Origin is the request's OWN origin
+      # (tina4-python #139). Own origin = scheme://host[:port], the scheme
+      # proxy-aware (Request.secure_scheme?, X-Forwarded-Proto first hop) and
+      # the host from X-Forwarded-Host, else Host. Both sides are normalised:
+      # lower-cased, default ports (http:80, https:443) dropped.
+      def same_origin?(env)
+        origin = normalize_origin(env["HTTP_ORIGIN"])
+        return false if origin.nil?
+
+        scheme = Tina4::Request.secure_scheme?(env) ? "https" : "http"
+        host = (env["HTTP_X_FORWARDED_HOST"] || env["HTTP_HOST"]).to_s.split(",").first.to_s.strip
+        return false if host.empty?
+
+        origin == normalize_origin("#{scheme}://#{host}")
+      end
+
       private
 
       def load_config
@@ -186,6 +220,20 @@ module Tina4
         !value.nil? && !value.to_s.empty?
       end
 
+      DEFAULT_PORTS = { "http" => 80, "https" => 443 }.freeze
+
+      # "scheme://host[:port]" lower-cased with a default port dropped, or nil
+      # for anything that is not an http(s) origin (e.g. "null").
+      def normalize_origin(value)
+        match = value.to_s.strip.chomp("/").match(%r{\A(https?)://([^/:\s]+|\[[^\]]+\])(?::(\d+))?\z}i)
+        return nil unless match
+
+        scheme = match[1].downcase
+        host = match[2].downcase
+        port = match[3]&.to_i
+        port.nil? || port == DEFAULT_PORTS[scheme] ? "#{scheme}://#{host}" : "#{scheme}://#{host}:#{port}"
+      end
+
       def merge_vary(current, field_name)
         parts = current.to_s.split(",").map(&:strip).reject(&:empty?)
         return parts.join(", ") if parts.any? { |p| p.casecmp?(field_name) }
@@ -193,17 +241,22 @@ module Tina4
         (parts + [field_name]).join(", ")
       end
 
-      # Log an actionable warning at most once per reason per process.
+      # Log an actionable warning at most once per REASON per process.
       #
       # A rejected cross-origin request is otherwise invisible: the browser
       # reports a generic CORS failure and the server log says nothing, so the
       # operator has to read the framework source to find the env var to set.
+      #
+      # BOUNDED (ADR-0048): keyed by reason only, never by origin. Keying
+      # :denied by "denied:<origin>" gave every attacker-chosen Origin header its
+      # own @warned entry (never freed) and its own log line - an unbounded
+      # ledger and an unbounded log. The message still names the origin that
+      # triggered it, the first time per reason.
       def warn_once(reason, request_origin)
         @warned ||= {}
-        key = reason == :denied ? "denied:#{request_origin}" : reason
-        return if @warned[key]
+        return if @warned[reason]
 
-        @warned[key] = true
+        @warned[reason] = true
         Tina4::Log.warning(warning_message(reason, request_origin))
       rescue StandardError
         nil # logging must never break a request
@@ -211,13 +264,16 @@ module Tina4
 
       def warning_message(reason, request_origin)
         case reason
+        # Neither message ever suggests the wildcard: allowing every website to
+        # silence one warning is the wrong fix. Each names the ONE origin to add.
         when :unconfigured
-          "CORS: refused cross-origin request from #{request_origin} - no policy is configured. " \
-            "Set TINA4_CORS_ORIGINS to the origins you want to allow, e.g. " \
-            "TINA4_CORS_ORIGINS=https://app.example.com (or '*' to allow any origin)."
+          "CORS: cross-origin request from #{request_origin}, but no CORS policy is configured, " \
+            "so the browser will block this response. If that origin should be allowed, " \
+            "add it: TINA4_CORS_ORIGINS=#{request_origin}"
         when :denied
           "CORS: origin #{request_origin} is not in TINA4_CORS_ORIGINS (#{config[:origins]}) " \
-            "- the browser will block this response."
+            "- the browser will block this response. If it should be allowed, add it: " \
+            "TINA4_CORS_ORIGINS=#{config[:origins]},#{request_origin}"
         else
           "CORS: TINA4_CORS_CREDENTIALS is true but TINA4_CORS_ORIGINS is '*'. The Fetch Standard " \
             "forbids Access-Control-Allow-Origin: * with credentials, so credentials are NOT being " \

data/lib/tina4/crud.rb

@@ -1,4 +1,10 @@
 # frozen_string_literal: true
+# Copyright (c) 2026 Code Infinity
+# SPDX-License-Identifier: MPL-2.0
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
 require "json"
 
 module Tina4
@@ -59,7 +65,7 @@ module Tina4
         query_params = request.respond_to?(:query) ? request.query : {}
         page       = [(query_params["page"] || 1).to_i, 1].max
         search     = query_params["search"].to_s.strip
-        sort_col   = query_params["sort"] || pk
+        sort_col   = crud_sort_column(model, sql, query_params["sort"], pk)
         sort_dir   = query_params["sort_dir"] == "desc" ? "desc" : "asc"
         offset     = (page - 1) * limit
 
@@ -213,8 +219,8 @@ module Tina4
         # POST create
         Tina4::Router.add("POST", api_path, proc { |req, res|
           begin
-            data = req.body_parsed
-            result = db.insert(table_name, data)
+            data = table_column_attributes(db, table_name, req.body_parsed)
+            db.insert(table_name, data)
             res.json({ data: data, message: "Created" }, status: 201)
           rescue => e
             res.json({ error: e.message }, status: 500)
@@ -225,7 +231,8 @@ module Tina4
         Tina4::Router.add("PUT", "#{api_path}/{id}", proc { |req, res|
           begin
             id = req.params["id"]
-            data = req.body_parsed
+            # The row is addressed by the URL id only, never by a body pk.
+            data = table_column_attributes(db, table_name, req.body_parsed, strip: pk)
             db.update(table_name, data, { pk => id })
             res.json({ data: data, message: "Updated" })
           rescue => e
@@ -245,6 +252,68 @@ module Tina4
         })
       end
 
+      # tina4: ADR-0069 - a SQL-mode write body is allow-listed against the
+      # table's REAL columns (matched case-insensitively, written in the
+      # introspected spelling); unknown keys are dropped, is_deleted is never
+      # client-writable, and +strip+ (the pk on update) is removed. Same write
+      # rule as AutoCrud (CRUD-DEC-02).
+      def table_column_attributes(db, table_name, data, strip: nil)
+        return {} unless data.is_a?(Hash)
+
+        columns = db.columns(table_name).to_h { |column| [column[:name].to_s.downcase, column[:name].to_s] }
+        blocked = ["is_deleted", strip.to_s.downcase]
+        data.each_with_object({}) do |(key, value), allowed|
+          column = columns[key.to_s.downcase]
+          next if column.nil? || blocked.include?(column.downcase)
+
+          allowed[column] = value
+        end
+      end
+
+      # tina4: ADR-0069 - ?sort reaches ORDER BY only as a column the source
+      # itself declares: a model's declared field (resolved to its DB column) or
+      # a column of the SQL query's own result set. Anything else falls back to
+      # the primary key - this is a rendered page, not an API, so no error.
+      def crud_sort_column(model, sql, requested, pk)
+        return pk if requested.nil? || requested.empty?
+        return model.resolve_field_column(requested) || pk if model
+
+        sql_result_columns(sql).include?(requested) ? requested : pk
+      end
+
+      # The query with any ORDER BY / LIMIT clause removed, then stripped.
+      #
+      # Line by line with plain string operations - a case-insensitive search
+      # for the keyword, then a cut to the end of that line - so it is linear on
+      # any input (the regex it replaces was flagged as polynomial by CodeQL).
+      # Same result: a keyword is removed with the rest of its line only when at
+      # least one character follows it, and the line break is kept.
+      def strip_order_and_limit(sql)
+        sql.to_s.each_line.map do |line|
+          cut_from_keyword(cut_from_keyword(line, /ORDER BY /i), /LIMIT /i)
+        end.join.strip
+      end
+
+      # +keyword+ is a fixed literal with no quantifier, so the search is linear.
+      def cut_from_keyword(line, keyword)
+        ending = line.end_with?("\n") ? "\n" : ""
+        content = ending.empty? ? line : line[0...-1]
+        at = content.index(keyword)
+        return line if at.nil? || content.length <= at + keyword.source.length
+
+        content[0...at] + ending
+      end
+
+      # Column names of the SQL query's result set, read from one probe row.
+      def sql_result_columns(sql)
+        db = Tina4.database
+        return [] unless db
+
+        base = strip_order_and_limit(sql)
+        row = db.fetch("SELECT * FROM (#{base}) AS _crud_sub", [], limit: 1).first
+        row ? row.keys.map(&:to_s) : []
+      end
+
       # Fetch data using an ORM model class
       def fetch_model_data(model, search: "", sort: "id", sort_dir: "asc", limit: 10, offset: 0)
         order_by = "#{sort} #{sort_dir.upcase}"
@@ -280,12 +349,12 @@ module Tina4
         return [[], 0] unless db
 
         # Wrap the original SQL for sorting
-        query = sql.gsub(/ORDER BY .+$/i, "").gsub(/LIMIT .+$/i, "").strip
-        query += " ORDER BY #{sort} #{sort_dir.upcase}"
+        base = strip_order_and_limit(sql)
+        query = "#{base} ORDER BY #{sort} #{sort_dir.upcase}"
 
         if !search.empty?
           # Wrap in a subquery to add search filtering
-          wrapped = "SELECT * FROM (#{sql.gsub(/ORDER BY .+$/i, '').gsub(/LIMIT .+$/i, '').strip}) AS _crud_sub WHERE "
+          wrapped = "SELECT * FROM (#{base}) AS _crud_sub WHERE "
           columns = extract_columns(sql)
           search_parts = columns.map { |col| "CAST(#{col} AS TEXT) LIKE ?" }
           wrapped += search_parts.join(" OR ")
@@ -293,14 +362,14 @@ module Tina4
           params = columns.map { "%#{search}%" }
 
           # Get total count
-          count_sql = "SELECT COUNT(*) as cnt FROM (#{sql.gsub(/ORDER BY .+$/i, '').gsub(/LIMIT .+$/i, '').strip}) AS _crud_cnt WHERE #{search_parts.join(' OR ')}"
+          count_sql = "SELECT COUNT(*) as cnt FROM (#{base}) AS _crud_cnt WHERE #{search_parts.join(' OR ')}"
           count_result = db.fetch_one(count_sql, params)
           total = count_result ? (count_result[:cnt] || count_result["cnt"] || 0).to_i : 0
 
           results = db.fetch(wrapped, params, limit: limit, offset: offset)
         else
           # Get total count
-          count_sql = "SELECT COUNT(*) as cnt FROM (#{sql.gsub(/ORDER BY .+$/i, '').gsub(/LIMIT .+$/i, '').strip}) AS _crud_cnt"
+          count_sql = "SELECT COUNT(*) as cnt FROM (#{base}) AS _crud_cnt"
           count_result = db.fetch_one(count_sql)
           total = count_result ? (count_result[:cnt] || count_result["cnt"] || 0).to_i : 0