woods 1.6.1 → 1.6.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a3bf50a7ad421cc52a336375446c4e08c2583dbf2ce96e4a3038bd8dca7a0ae
-  data.tar.gz: fe9a6512787372c3f3d0cbe4038720f123349b9961c548b1584d21b8b4cbd0fb
+  metadata.gz: b77f03a9d89a92c666a6ef9b8b20ed8583270fa0cfbb923acea9d6fbc973f9d2
+  data.tar.gz: 8336dccba436603daadaccd125888bc40702f16c4f514002bff298c9d8905f9e
 SHA512:
-  metadata.gz: 7070f985d4a9bab191593599e4f4f8c807d0378c8345a9aa8a73c2ac4de0200b7959ffd6bb6a823bb12fd67a4afe90ad6d3475eb16bbb60ac320ead1de114b77
-  data.tar.gz: 3c0cd27167baa9cd7e0245894527760e12bf2d038e57819ffa78468e6f0e6e4122dd144129bcfd769bd89965caad7c997299dfc5de9c1c38dfddb88bab8f2f78
+  metadata.gz: ff12092063cd2a853c293812705b64f38c83da9a682d89bdcf243665ab810b5d5368e2d086a3a2949d885d677845637a3773b58c4322b62e56b83585f6f7e208
+  data.tar.gz: '0329bd31a7ddd6b0d05dedb46b4942a09d5534faf69668e77d45b1b9a8d37f1c3b860cc222446ddef7e64717e716d7388ef1217f3efe80578e481b875a7edba6'

data/CHANGELOG.md

@@ -7,6 +7,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.6.3] - 2026-09-22
+
+### Build
+
+- Add the explicit, no-publish preparation cycle for the 1.6.3 security maintenance release; keep version writes task-owned and publication dependent on a reviewed trusted-main SHA pin.
+
+### Security
+
+- Apply blocked-table policy to resolved model relations and SQLite table syntax before reads, retain table boundaries across comments, and reject quoted spellings of existing denied SQL functions.
+- Scan the serialized Console response after protected-field redaction so Symbol values and custom JSON output cannot bypass credential scanning.
+
+## [1.6.2] - 2026-09-18
+
+### Fixed
+
+- Refresh encrypted Rails credentials from disk when rebuilding the Console credential index, update every live scanner, and preserve the last valid index if refresh fails. Each response uses one consistent index snapshot.
+Keep credential scanner refresh snapshots limited to live weakly referenced
+scanners on older Ruby versions, avoiding unsafe receiver access after garbage
+collection while preserving updates to every live Console server.
+Keep JSON on `>= 2.19.9, < 3` so supported Rails encoders can serialize metadata after a fresh bundle resolution; JSON 3 removes their `quirks_mode` option. Bound MessagePack below 2 and Railties below 9, retaining their existing minimum versions and the strict package-build gate.
+- Preserve version-aware missing-tool guidance with MCP 0.23 by installing its dispatch override before the SDK captures request handlers.
+
+### Build
+
+- Add a no-publish, one-off 1.6.2 maintenance preparation flow and installed-package CI. Disable the legacy automatic publisher; publication requires the trusted main maintenance profile and its reviewed candidate SHA.
+
+### Security
+
+- Require MCP 0.23.0 or newer within the 0.x line for upstream transport security fixes; run `bundle update woods mcp` when upgrading. Ruby 3.0 remains supported. The newer SDK removes the old json-schema/addressable dependency chain. Existing Index and Console HTTP origin settings now reach the SDK Host/Origin guards; cross-origin browser access requires the actual configured port.
+
 ## [1.6.1] - 2026-07-22
 
 ### Fixed

data/CONTRIBUTING.md

@@ -125,3 +125,57 @@ Woods uses runtime introspection, not static parsing. If your feature requires a
 ## License
 
 By contributing, you agree that your contributions will be licensed under the MIT License.
+
+## Maintenance release
+
+This tree has a one-off, no-publish preparation adapter for the reviewed 1.6.3
+security patch while `main` carries the newer 2.0 prerelease line. It does not
+establish a permanent stable branch or authorize another maintenance version.
+The approved target is `release/1.6.3`, based on immutable `v1.6.2`. Create that
+remote target only after the trusted main maintenance policy is reviewed.
+
+From a clean checkout, the only supported transitions are:
+
+```sh
+bin/rake "release:reopen[1.6.3.alpha]"
+# Review and commit the generated development-state diff.
+bin/rake "release:prepare[1.6.3]"
+```
+
+The tasks never commit, tag, push, dispatch or publish. Never edit VERSION or the
+README maintenance `release-state` banner manually. The existing maintenance
+banner must be present; both tasks update it. Prepare also folds classified
+Unreleased notes and optional `changelog/<type>_<slug>.md` entries into a dated
+release heading. Entry files are
+nonempty Markdown without headings; supported types include `fixed`, `security`,
+`build`, and `documentation`. Invalid transitions, dirty trees, malformed notes,
+and missing/duplicate/unknown fences refuse before writes. This legacy profile
+has no v2 migration guide or v2 surface inventory requirement.
+
+CI also runs on pushes to the exact `release/1.6.3` branch, so a private-advisory
+merge receives upstream validation before the trusted-main SHA pin. Publication
+still requires a separate green tag-push run.
+
+Validate the full suite, lint, booted extraction, real Console credential rotation,
+and installed maintenance package tests. CI builds one gem plus its SHA-256
+sidecar into `woods-release-<commit SHA>` and tests that artifact on Ruby 3.0/Rails
+6.0 with exactly MCP 0.23.0 and Ruby 4.0/Rails 8.1 with the latest compatible 0.x SDK.
+MCP >=0.23.0 is required for upstream transport security fixes; update Woods and
+MCP together (`bundle update woods mcp`). Ruby 3.0 remains supported.
+The optional package specs require `WOODS_GEM_PATH` and
+run standalone, without the repository's `spec_helper` or implementation path:
+
+```sh
+ruby -rrubygems -e 'load Gem.bin_path("rspec-core", "rspec")' -- \
+  --options /dev/null spec/integration/maintenance_packaged_gem_spec.rb
+```
+
+Preparation is not publication; check RubyGems before describing 1.6.3 as released.
+The legacy automatic tag publisher is disabled, and Bundler's `release`,
+`release:rubygem_push`, and `release:source_control_push` tasks abort. Only a
+maintainer may later tag the reviewed merge commit and dispatch the trusted
+**main** workflow. That workflow must explicitly allow the exact tag, protected
+maintenance branch, immutable 1.6.2 base, reviewed final candidate SHA, required
+CI jobs, and immutable artifact. An unpinned candidate remains blocked. First merge a reviewed trusted-main profile update pinning `approved_sha` to that
+exact maintenance merge SHA; only then may the maintainer tag it. The
+workflow publishes the already tested gem bytes; never rebuild or publish locally.

data/README.md

@@ -4,6 +4,12 @@
 
 # Woods
 
+<!-- release-state:maintenance-banner -->
+> **Woods 1.6.3: prepared maintenance candidate.** This tree remains on the 1.6 maintenance line.
+> Preparation does not establish publication. Check [RubyGems versions](https://rubygems.org/gems/woods/versions)
+> before selecting an install version. See [maintenance release policy](CONTRIBUTING.md#maintenance-release).
+<!-- release-state:end -->
+
 **Your AI coding assistant is guessing about your Rails app. Woods gives it the real answers.**
 
 Rails hides enormous amounts of behavior behind conventions, concerns, and runtime magic. When you ask an AI assistant "what callbacks fire when a User saves?" or "what routes map to this controller?", it guesses from training data — and gets it wrong. Woods runs *inside* your Rails app, extracts what's actually happening at runtime, and serves that context directly to your AI tools via [MCP](https://modelcontextprotocol.io/).

data/exe/woods-mcp-http

@@ -28,6 +28,7 @@ require_relative '../lib/woods/mcp/server'
 require_relative '../lib/woods/mcp/bootstrapper'
 require_relative '../lib/woods/mcp/bearer_auth'
 require_relative '../lib/woods/mcp/origin_guard'
+require_relative '../lib/woods/mcp/http_transport_options'
 require_relative '../lib/woods/embedding/text_preparer'
 require_relative '../lib/woods/embedding/indexer'
 
@@ -63,10 +64,11 @@ server = Woods::MCP::Server.build(
   index_dir: index_dir, retriever: retriever, snapshot_store: snapshot_store,
   bootstrap_state: bootstrap_state, retriever_reloader: retriever_reloader
 )
-transport = MCP::Server::Transports::StreamableHTTPTransport.new(server)
-server.transport = transport
-
 allowed_origins = ENV.fetch('WOODS_MCP_HTTP_ALLOWED_ORIGINS', '').split(',').map(&:strip).reject(&:empty?)
+transport = MCP::Server::Transports::StreamableHTTPTransport.new(
+  server, **Woods::MCP::HttpTransportOptions.for(allowed_origins)
+)
+server.transport = transport
 
 inner = proc { |env| transport.handle_request(Rack::Request.new(env)) }
 app = token ? Woods::MCP::BearerAuth.new(inner, token: token) : inner

data/lib/woods/console/credential_index.rb

@@ -68,6 +68,7 @@ module Woods
       MISSING_KEY_ERRORS = %w[
         ActiveSupport::EncryptedConfiguration::MissingKeyError
         ActiveSupport::EncryptedFile::MissingKeyError
+        ActiveSupport::EncryptedFile::MissingContentError
         ActiveSupport::MessageEncryptor::InvalidMessage
       ].freeze
 
@@ -90,13 +91,19 @@ module Woods
         # @return [CredentialIndex] populated index, or an empty index when
         #   the credentials store can't be opened.
         def build(rails_app:)
-          new(secrets: collect_secrets(rails_app))
+          refresh(rails_app: rails_app)
         rescue StandardError => e
           raise unless missing_key_error?(e)
 
           new(secrets: [])
         end
 
+        # Strict refresh: construct the replacement completely before a caller
+        # installs it. Unlike boot-time .build, errors must preserve the old index.
+        def refresh(rails_app:)
+          new(secrets: collect_secrets(rails_app))
+        end
+
         # Emit a structured log warning when any of the given credentials
         # files has a modification time newer than `process_start`. This
         # catches the common "rotated credentials but forgot to restart"
@@ -136,12 +143,23 @@ module Woods
         private
 
         def collect_secrets(rails_app)
-          config = rails_app.credentials.config
+          config = fresh_credentials(rails_app.credentials).config
           collected = []
           walk(config, collected)
           collected
         end
 
+        def fresh_credentials(credentials)
+          return credentials unless defined?(ActiveSupport::EncryptedConfiguration) &&
+                                    credentials.is_a?(ActiveSupport::EncryptedConfiguration)
+
+          require_relative 'encrypted_credential_snapshot'
+          EncryptedCredentialSnapshot.new(
+            config_path: credentials.content_path, key_path: credentials.key_path,
+            env_key: credentials.env_key, raise_if_missing_key: true
+          )
+        end
+
         def walk(node, collected)
           case node
           when Hash  then node.each_value { |v| walk(v, collected) }

data/lib/woods/console/credential_scanner.rb

@@ -145,7 +145,7 @@ module Woods
 
       # Scan a value (String, Hash, Array, or any other object) for credentials.
       #
-      # Strings are gsub'd against every active pattern. Hash values and Array
+      # Strings and Symbols are scanned against every active pattern. Hash values and Array
       # elements are walked recursively; keys and non-string scalars
       # (Integer, Float, true/false, nil) pass through untouched.
       #
@@ -155,17 +155,18 @@ module Woods
       #   for patterns that fired — callers should treat a missing key as zero.
       def scan(value)
         counts = {}
-        scanned = walk(value, counts)
+        scanned = walk(value, counts, @secret_index)
         [scanned, counts]
       end
 
       private
 
-      def walk(value, counts)
+      def walk(value, counts, index)
         case value
-        when String then scan_string(value, counts)
-        when Hash   then walk_hash(value, counts)
-        when Array  then value.map { |item| walk(item, counts) }
+        when String then scan_string(value, counts, index)
+        when Symbol then scan_string(value.to_s, counts, index).to_sym
+        when Hash   then walk_hash(value, counts, index)
+        when Array  then value.map { |item| walk(item, counts, index) }
         else value
         end
       end
@@ -177,19 +178,19 @@ module Woods
       # credential-shaped string is emitted as a Symbol after redaction
       # (e.g. `:"[REDACTED]"`). String keys stay Strings. Non-String,
       # non-Symbol keys (Integer, etc.) pass through unchanged.
-      def walk_hash(hash, counts)
+      def walk_hash(hash, counts, index)
         hash.each_with_object({}) do |(key, val), out|
           scanned_key = case key
-                        when String then scan_string(key, counts)
-                        when Symbol then scan_string(key.to_s, counts).to_sym
+                        when String then scan_string(key, counts, index)
+                        when Symbol then scan_string(key.to_s, counts, index).to_sym
                         else             key
                         end
-          out[scanned_key] = walk(val, counts)
+          out[scanned_key] = walk(val, counts, index)
         end
       end
 
-      def scan_string(str, counts)
-        result = redact_indexed_secrets(str, counts)
+      def scan_string(str, counts, index)
+        result = redact_indexed_secrets(str, counts, index)
         result = scan_encoded_forms(result, counts)
         @active_patterns.inject(result) do |acc, (name, pattern)|
           acc.gsub(pattern) do
@@ -290,10 +291,10 @@ module Woods
         printable.to_f / str.length >= PRINTABLE_RATIO_THRESHOLD
       end
 
-      def redact_indexed_secrets(str, counts)
-        return str unless @secret_index&.match?(str)
+      def redact_indexed_secrets(str, counts, index)
+        return str unless index&.match?(str)
 
-        redacted = @secret_index.redact(str)
+        redacted = index.redact(str)
         counts[INDEX_HIT] = (counts[INDEX_HIT] || 0) + redacted.scan(CredentialIndex::REDACTED).size
         redacted
       end

data/lib/woods/console/credential_scanner_registry.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Woods
+  module Console
+    # Coordinates scanner construction and rotation without retaining servers
+    # after their transports release them. Requests keep their own index snapshot.
+    class CredentialScannerRegistry
+      def initialize
+        @scanners = ObjectSpace::WeakMap.new
+        @mutex = Mutex.new
+      end
+
+      def register
+        @mutex.synchronize do
+          scanner = yield
+          # Older Ruby WeakMap implementations validate the value's liveness
+          # when enumerating. Keep the scanner in both weak positions so an
+          # immortal sentinel cannot make an abandoned scanner look live.
+          @scanners[scanner] = scanner
+          scanner
+        end
+      end
+
+      def rebuild
+        @mutex.synchronize do
+          scanners = @scanners.values
+          return nil if scanners.empty?
+
+          index = yield
+          scanners.each { |scanner| scanner.replace_index!(index) }
+          index
+        end
+      end
+    end
+  end
+end

data/lib/woods/console/dispatch_pipeline.rb

@@ -77,15 +77,33 @@ module Woods
         response = @conn_mgr.send_request(request)
         return error_from_response(response, request) unless response['ok']
 
-        result = @ctx.redact(response['result'])
-        result = scan_for_credentials(result, request)
-        text = @renderer ? @renderer.render_default(result) : JSON.pretty_generate(result)
-        success_response(text)
+        render_response(response['result'], request)
       rescue ConnectionError => e
         scanned = scan_for_credentials("Connection error: #{e.message}", request)
         error_response(scanned)
       end
 
+      def render_response(result, request)
+        # Remove protected values before custom serializers run, then scan
+        # the materialized representation consumed by both response renderers.
+        result = @ctx.redact(result)
+        result = JSON.parse(JSON.generate(result))
+        result = @ctx.redact(result)
+        result = scan_for_credentials(result, request)
+        text = @renderer ? @renderer.render_default(result) : JSON.pretty_generate(result)
+        success_response(text)
+      rescue StandardError
+        # SDK 0.x includes uncaught exception messages in its tool errors.
+        # Serializer/parser/renderer messages may contain unscanned values.
+        rendering_error_response(request)
+      end
+
+      def rendering_error_response(request)
+        error_response(scan_for_credentials('Console response could not be serialized safely.', request))
+      rescue StandardError
+        error_response('[REDACTION_FAILED]')
+      end
+
       def error_from_response(response, request)
         error_text = "#{response['error_type']}: #{response['error']}"
         error_text = scan_for_credentials(error_text, request)

data/lib/woods/console/embedded_executor.rb

@@ -10,6 +10,7 @@ require_relative 'model_validator'
 require_relative 'safe_context'
 require_relative 'scope_predicate_parser'
 require_relative 'sql_noise_stripper'
+require_relative 'sql_validator'
 require_relative 'table_gate'
 
 module Woods
@@ -425,8 +426,9 @@ module Woods
         return unless @table_gate
 
         begin
-          @table_gate.check_sql!(sql)
-        rescue TableGateError => e
+          SqliteReadGuard.validate!(sql) if sql_dialect == :sqlite
+          @table_gate.check_sql!(sql, dialect: sql_dialect == :sqlite ? :sqlite : nil)
+        rescue TableGateError, SqlValidationError => e
           raise ValidationError, e.message
         end
       end
@@ -454,7 +456,7 @@ module Woods
       def handle_count(params)
         model = resolve_model(params['model'])
         scope = apply_scope(model, params['scope'], model_name: params['model'])
-        { 'count' => scope.count }
+        { 'count' => checked_relation(scope).count }
       end
 
       def handle_sample(params)
@@ -463,16 +465,17 @@ module Woods
         limit = [params.fetch('limit', 5).to_i, 25].min
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = apply_columns(scope, params['columns'])
-        records = scope.order(random_function).limit(limit)
+        records = checked_relation(scope.order(random_function).limit(limit))
         { 'records' => serialize_records(records, params['columns']) }
       end
 
       def handle_find(params)
         model = resolve_model(params['model'])
+        scope = checked_relation(model)
         record = if params['id']
-                   model.find_by(id: params['id'])
+                   scope.find_by(id: params['id'])
                  elsif params['by']
-                   model.find_by(params['by'])
+                   scope.find_by(params['by'])
                  end
         { 'record' => record ? serialize_record(record, params['columns']) : nil }
       end
@@ -484,7 +487,7 @@ module Woods
         limit = [params.fetch('limit', 100).to_i, 1000].min
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = scope.distinct if params['distinct']
-        values = scope.limit(limit).pluck(*columns.map(&:to_sym))
+        values = checked_relation(scope.limit(limit)).pluck(*columns.map(&:to_sym))
         { 'columns' => Array(columns), 'values' => values }
       end
 
@@ -501,6 +504,7 @@ module Woods
         model = resolve_model(params['model'])
         scope = apply_scope(model, params['scope'], model_name: params['model'])
 
+        scope = checked_relation(scope)
         value = if function == 'count'
                   column ? scope.count(column.to_sym) : scope.count
                 else
@@ -511,7 +515,7 @@ module Woods
 
       def handle_association_count(params)
         model = resolve_model(params['model'])
-        record = model.find(params['id'])
+        record = checked_relation(model).find(params['id'])
         association_name = params['association']
 
         unless model.reflect_on_association(association_name.to_sym)
@@ -527,7 +531,26 @@ module Woods
 
         scope = record.public_send(association_name)
         scope = apply_scope(scope, params['scope'])
-        { 'count' => scope.count }
+        { 'count' => checked_relation(scope).count }
+      end
+
+      # Resolve the default scope once and execute the same checked relation.
+      # @param scope [Class, ActiveRecord::Relation] Pending model read
+      # @return [Class, ActiveRecord::Relation] Authorized relation
+      def checked_relation(scope)
+        return scope unless @table_gate
+
+        relation = scope.all
+        gate_sql!(relation.to_sql)
+        relation
+      end
+
+      def sql_dialect
+        name = active_connection.adapter_name.to_s.downcase
+        return :sqlite if name.include?('sqlite')
+        return :mysql if name.include?('mysql')
+
+        :postgres
       end
 
       def gate_association!(model_name, association)
@@ -575,7 +598,7 @@ module Woods
 
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = apply_columns(scope, params['columns'])
-        records = scope.order(order_by => direction.to_sym).limit(limit)
+        records = checked_relation(scope.order(order_by => direction.to_sym).limit(limit))
         { 'records' => serialize_records(records, params['columns']) }
       end
 
@@ -599,7 +622,7 @@ module Woods
         raise ValidationError, 'Missing required parameter: sql' unless sql
 
         require_relative 'sql_validator'
-        SqlValidator.new.validate!(sql)
+        SqlValidator.new(dialect: sql_dialect).validate!(sql)
         # Post-validation, pre-execution TableGate — blocks every configured
         # table even if the sql is otherwise well-formed.
         gate_sql!(sql)

data/lib/woods/console/encrypted_credential_snapshot.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'active_support/encrypted_configuration'
+
+module Woods
+  module Console
+    # A private, uncached Rails configuration for one credential-index build.
+    # Unlike Rails' permissive configuration reader, a missing encrypted file
+    # must raise during an explicit refresh rather than erase the last index.
+    class EncryptedCredentialSnapshot < ActiveSupport::EncryptedConfiguration
+      def read
+        ActiveSupport::EncryptedFile.instance_method(:read).bind(self).call
+      end
+    end
+  end
+end

data/lib/woods/console/rack_middleware.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'json'
+require 'woods/mcp/http_transport_options'
 require 'woods/observability/structured_logger'
 
 module Woods
@@ -131,7 +132,9 @@ module Woods
           Rails.application.eager_load!
 
           server = build_embedded_server
-          @transport = ::MCP::Server::Transports::StreamableHTTPTransport.new(server)
+          @transport = ::MCP::Server::Transports::StreamableHTTPTransport.new(
+            server, **Woods::MCP::HttpTransportOptions.for(Woods.configuration.console_mcp_allowed_origins)
+          )
           server.transport = @transport
           @transport
         end

data/lib/woods/console/server.rb

@@ -13,6 +13,7 @@ require_relative 'audit_logger'
 require_relative 'confirmation'
 require_relative 'console_response_renderer'
 require_relative 'credential_scanner'
+require_relative 'credential_scanner_registry'
 require_relative 'eval_guard'
 require_relative 'table_gate'
 require_relative 'redactor'
@@ -34,10 +35,14 @@ module Woods
     #   transport.open
     #
     module Server # rubocop:disable Metrics/ModuleLength
+      SCANNERS = CredentialScannerRegistry.new
+      private_constant :SCANNERS
+
       class << self # rubocop:disable Metrics/ClassLength
         # Rebuild the boot-time credential index from fresh Rails credentials
-        # and hot-swap it into the active scanner without restarting the process.
+        # and hot-swap it into every live scanner without restarting the process.
         #
+        # Refresh failures propagate without replacing any live index.
         # Host rotation jobs should call this immediately after `rails credentials:edit`
         # changes are deployed. The swap is atomic on MRI (GVL) — in-flight scans see
         # either the old or the new index, never a partial one.
@@ -57,14 +62,11 @@ module Woods
         #   the rebuild was skipped.
         def rebuild_credential_index(rails_app: nil)
           return nil unless credential_defense_enabled?
-          return nil unless @active_scanner
 
           target_app = rails_app || default_rails_app
           return nil unless target_app
 
-          new_index = CredentialIndex.build(rails_app: target_app)
-          @active_scanner.replace_index!(new_index)
-          new_index
+          SCANNERS.rebuild { CredentialIndex.refresh(rails_app: target_app) }
         end
 
         # True when Woods is configured and credential defense is on.
@@ -399,21 +401,21 @@ module Woods
                                        model_reflections: model_reflections)
                        end
 
-          secret_index = build_credential_index(config)
-          disabled_patterns = Array(config&.console_disabled_scanner_patterns)
-          scanner = if disabled_patterns.include?(:all)
-                      nil
-                    else
-                      CredentialScanner.new(
-                        disabled_patterns: disabled_patterns,
-                        secret_index: secret_index
-                      )
-                    end
-          @active_scanner = scanner
+          scanner = build_scanner(config)
 
           ResponseContext.build(safe_ctx: safe_ctx, table_gate: table_gate, credential_scanner: scanner)
         end
 
+        def build_scanner(config)
+          disabled_patterns = Array(config&.console_disabled_scanner_patterns)
+          return nil if disabled_patterns.include?(:all)
+
+          SCANNERS.register do
+            CredentialScanner.new(disabled_patterns: disabled_patterns,
+                                  secret_index: build_credential_index(config))
+          end
+        end
+
         # Build the boot-time credential index from Rails.application's encrypted
         # credentials. Returns nil when credential defense is disabled or when no
         # Rails application is reachable (specs, non-Rails hosts) — the scanner