woods 1.6.1 → 2.0.0.beta2

data/lib/woods/console/embedded_executor.rb

@@ -5,22 +5,22 @@ require 'timeout'
 require_relative 'audit_logger'
 require_relative 'bridge_protocol'
 require_relative 'confirmation'
+require_relative 'credential_scanner'
 require_relative 'eval_guard'
+require_relative 'input_contract'
 require_relative 'model_validator'
 require_relative 'safe_context'
 require_relative 'scope_predicate_parser'
+require_relative 'sql_validator'
 require_relative 'sql_noise_stripper'
 require_relative 'table_gate'
+require_relative 'tool_specs'
 
 module Woods
   module Console
-    # Drop-in replacement for ConnectionManager + the bridge process that
-    # executes queries directly via ActiveRecord instead of going over the
-    # JSON-lines protocol (see {StubBridge} for the protocol scaffold).
-    #
-    # Implements the same `send_request(Hash) -> Hash` interface as
-    # ConnectionManager, so all existing tool definitions in Server work
-    # unchanged — just pass this where `conn_mgr` goes.
+    # Executes supported Console requests directly through ActiveRecord in a
+    # booted Rails process. Server registration limits callers to the subset
+    # this executor can run with the configured safety controls.
     #
     # @example
     #   executor = EmbeddedExecutor.new(model_validator: validator, safe_context: ctx)
@@ -28,8 +28,6 @@ module Woods
     #   # => { 'ok' => true, 'result' => { 'count' => 42 }, 'timing_ms' => 1.2 }
     #
     class EmbeddedExecutor # rubocop:disable Metrics/ClassLength
-      AGGREGATE_FUNCTIONS = %w[sum average minimum maximum count].freeze
-
       TIER1_TOOLS = BridgeProtocol::TIER1_TOOLS
 
       # Tools gated behind the read_tools_enabled flag.
@@ -37,11 +35,6 @@ module Woods
       # but require explicit opt-in for embedded mode.
       EMBEDDED_READ_TOOLS = %w[sql query].freeze
 
-      MAX_SQL_LIMIT = 10_000
-      MAX_QUERY_LIMIT = 10_000
-
-      MIN_EVAL_TIMEOUT = 1
-      MAX_EVAL_TIMEOUT = 30
       DEFAULT_EVAL_TIMEOUT = 10
 
       # @param model_validator [ModelValidator] Validates model/column names
@@ -97,8 +90,9 @@ module Woods
         refusal = refusal_for(tool)
         return refusal if refusal
 
+        normalize_params!(tool, params)
         start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        result = @safe_context.execute { dispatch(tool, params) }
+        result = @safe_context.execute { with_mysql_quote_modes { dispatch(tool, params) } }
         elapsed = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time) * 1000).round(1)
 
         { 'ok' => true, 'result' => result, 'timing_ms' => elapsed }
@@ -130,12 +124,30 @@ module Woods
         return unless defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
 
         Rails.logger.warn(
-          "[Woods::Console] execution error: #{error.class}: #{error.message}"
+          "[Woods::Console] execution error: #{error.class}: #{scan_log_text(error.message)}"
         )
       rescue StandardError
         # Never let logging break the request path.
       end
 
+      # Layer 2 applied to server-side log text (L11). The client response for
+      # this branch is already sanitized down to the class name, but the log
+      # line carries the adapter's own message — and PG/Mysql2 errors embed the
+      # rejected SQL and, for constraint violations, the offending literal. A
+      # secret pasted into a WHERE clause therefore landed unscanned in the
+      # server log while the response path was scanned. Failure falls back to a
+      # sentinel rather than raw text, mirroring {AuditLogger#redact}.
+      def scan_log_text(text)
+        scanned, = error_log_scanner.scan(text.to_s)
+        scanned
+      rescue StandardError
+        '[REDACTION_FAILED]'
+      end
+
+      def error_log_scanner
+        @error_log_scanner ||= CredentialScanner.new
+      end
+
       # Return a pre-dispatch refusal hash for tools the executor cannot or
       # will not run, else nil to let dispatch proceed.
       #
@@ -158,20 +170,26 @@ module Woods
 
       # Self-describing error for tools the embedded executor cannot run.
       #
-      # `sql`/`query` are gated behind `embedded_read_tools: true` — point the
-      # caller at the flag. Everything else (Tier 2–4 domain/analytics tools)
-      # requires the bridge architecture.
+      # `sql`/`query` are gated behind `embedded_read_tools: true`. Everything
+      # else outside Tier 1 is unavailable through a supported server mode.
+      #
+      # The flag has two names depending on transport: `embedded_read_tools:`
+      # on `Woods::Console::RackMiddleware` (HTTP), or
+      # `config.console_embedded_read_tools` read by `exe/woods-console`
+      # (stdio). This executor runs under both, so the message names both —
+      # naming only one leaves an operator on the other transport with no
+      # idea what to set.
       #
       # @param tool [String] Tool name that was rejected
       # @return [String] Actionable error message
       def unsupported_message(tool)
         if EMBEDDED_READ_TOOLS.include?(tool)
           "Tool '#{tool}' requires embedded_read_tools: true on " \
-            'Woods::Console::RackMiddleware, or use the bridge (Option D). ' \
+            'Woods::Console::RackMiddleware, or config.console_embedded_read_tools = true ' \
+            'for the stdio server (exe/woods-console). ' \
             'See docs/CONSOLE_MCP_SETUP.md.'
         else
-          "Tool '#{tool}' is not available in embedded mode — it requires the " \
-            'bridge architecture (Option D in docs/CONSOLE_MCP_SETUP.md).'
+          "Tool '#{tool}' is not available in a supported Console MCP mode."
         end
       end
 
@@ -190,16 +208,12 @@ module Woods
       # @return [String] Multi-line actionable message.
       def eval_disabled_message
         <<~MSG.strip
-          console_eval is disabled — the unsafe-eval opt-in is off by default.
+          console_eval is not available in a supported Console MCP mode.
           Use console_query (model + select + joins/group_by/having/order) or console_sql
           for anything you were about to run. Both already support aggregates and scoping.
           If you believe eval is still necessary, SHOW your proposed Ruby snippet to the
           user first and let them run it manually — do not retry console_eval automatically.
-          Operators: set WOODS_CONSOLE_UNSAFE_EVAL=true (or console_unsafe_eval_enabled = true)
-          AND wire console_unsafe_eval_confirmation + console_unsafe_eval_audit_log_path.
-          The server refuses to boot with the flag on in Rails.env.production?, and refuses
-          to boot with the flag on but any collaborator missing (fail-closed).
-          See docs/CONSOLE_MCP_SETUP.md "console_eval opt-in" for the full checklist.
+          WOODS_CONSOLE_UNSAFE_EVAL and the legacy collaborator options fail closed at boot.
         MSG
       end
 
@@ -251,19 +265,8 @@ module Woods
         raise
       end
 
-      # Validate + clamp the user-supplied timeout. Accepts a positive
-      # Integer (or nil → default). Everything else is rejected so a
-      # caller passing `timeout: 0` or `timeout: "forever"` hears about
-      # it instead of silently getting MIN_EVAL_TIMEOUT.
       def eval_timeout_from(raw)
-        return DEFAULT_EVAL_TIMEOUT if raw.nil?
-
-        unless raw.is_a?(Integer) && raw.positive?
-          raise ValidationError,
-                "timeout must be a positive integer (#{MIN_EVAL_TIMEOUT}..#{MAX_EVAL_TIMEOUT})"
-        end
-
-        raw.clamp(MIN_EVAL_TIMEOUT, MAX_EVAL_TIMEOUT)
+        raw || DEFAULT_EVAL_TIMEOUT
       end
 
       def guard_check!(code, audit_params)
@@ -396,6 +399,28 @@ module Woods
         end
       end
 
+      def normalize_params!(tool, params)
+        spec = Server::TOOL_SPECS.find { |candidate| candidate.name == "console_#{tool}" }
+        return unless spec
+
+        registered = Server::EXECUTABLE_MODES.values.any? { |names| names.include?(spec.name) }
+        if registered
+          spec.validate_arguments!(params)
+        else
+          # Unregistered specs (console_eval today) never run the full public
+          # JSON Schema here, so without this check a well-formed numeric
+          # string (e.g. `timeout: "15"`) sails straight into normalize!'s
+          # coercion below — silently accepting input the declared schema's
+          # `type: integer` would reject outright. This closes that gap
+          # without changing normalize!'s own messages for malformed/
+          # out-of-bounds values, which are asserted verbatim elsewhere.
+          InputContract.reject_string_typed_integers!(params, spec.properties)
+        end
+        InputContract.normalize!(params, spec.properties)
+      rescue InputContract::ValidationError => e
+        raise ValidationError, e.message
+      end
+
       # @param params [Hash] Must contain 'model' key
       # @raise [ValidationError]
       def validate_model!(params)
@@ -425,7 +450,7 @@ module Woods
         return unless @table_gate
 
         begin
-          @table_gate.check_sql!(sql)
+          @table_gate.check_sql!(sql, dialect: sql_dialect, mysql_modes: mysql_quote_modes)
         rescue TableGateError => e
           raise ValidationError, e.message
         end
@@ -460,7 +485,7 @@ module Woods
       def handle_sample(params)
         validate_select_columns!(params)
         model = resolve_model(params['model'])
-        limit = [params.fetch('limit', 5).to_i, 25].min
+        limit = params.fetch('limit', 5)
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = apply_columns(scope, params['columns'])
         records = scope.order(random_function).limit(limit)
@@ -468,20 +493,45 @@ module Woods
       end
 
       def handle_find(params)
+        validate_find_locator!(params)
+        if params['by']
+          by_columns = params['by'].keys.map(&:to_s)
+          @model_validator.validate_columns!(params['model'], by_columns)
+          by_columns.each { |column| refuse_protected_predicate_column!(column) }
+        end
+        validate_select_columns!(params)
         model = resolve_model(params['model'])
-        record = if params['id']
-                   model.find_by(id: params['id'])
-                 elsif params['by']
-                   model.find_by(params['by'])
-                 end
+        record = params['id'] ? model.find_by(id: params['id']) : model.find_by(params['by'])
         { 'record' => record ? serialize_record(record, params['columns']) : nil }
       end
 
+      # Require exactly one non-empty locator: `id` or a non-empty `by` hash.
+      # `find_by({})` returns an arbitrary row when neither is supplied, and
+      # `find_by` with an empty `by` hash is indistinguishable from that:
+      # both must be refused before any query runs. Defense-in-depth against
+      # the public schema's `oneOf`/`minProperties` constraint (ToolSpec
+      # for console_find), for callers that reach this handler directly.
+      #
+      # @param params [Hash]
+      # @raise [ValidationError] when zero or both locator forms are present
+      def validate_find_locator!(params)
+        has_id = !params['id'].nil?
+        has_by = params['by'].is_a?(Hash) && params['by'].any?
+        return if has_id ^ has_by
+
+        raise ValidationError, 'console_find requires exactly one non-empty locator: id or by' unless has_id && has_by
+
+        raise ValidationError, 'console_find accepts only one locator at a time: id or by, not both'
+      end
+
       def handle_pluck(params)
         columns = params['columns']
+        raise ValidationError, 'columns must contain at least one item' if columns && columns.empty?
+
         @model_validator.validate_columns!(params['model'], columns) if columns
+        refuse_orphan_eav_value_selection!(Array(columns)) if columns
         model = resolve_model(params['model'])
-        limit = [params.fetch('limit', 100).to_i, 1000].min
+        limit = params.fetch('limit', 100)
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = scope.distinct if params['distinct']
         values = scope.limit(limit).pluck(*columns.map(&:to_sym))
@@ -491,12 +541,16 @@ module Woods
       def handle_aggregate(params)
         column = params['column']
         function = params['function']
-        @model_validator.validate_column!(params['model'], column) if column
+        if column
+          @model_validator.validate_column!(params['model'], column)
+          refuse_redacted_aggregate_expression!(column)
+        end
 
-        unless AGGREGATE_FUNCTIONS.include?(function)
+        unless Server::AGGREGATE_FUNCTIONS.include?(function)
           raise ValidationError, "Invalid aggregate function: #{function}. " \
-                                 "Allowed: #{AGGREGATE_FUNCTIONS.join(', ')}"
+                                 "Allowed: #{Server::AGGREGATE_FUNCTIONS.join(', ')}"
         end
+        raise ValidationError, "column is required for #{function} aggregate" if function != 'count' && column.nil?
 
         model = resolve_model(params['model'])
         scope = apply_scope(model, params['scope'], model_name: params['model'])
@@ -511,12 +565,10 @@ module Woods
 
       def handle_association_count(params)
         model = resolve_model(params['model'])
-        record = model.find(params['id'])
         association_name = params['association']
+        reflection = model.reflect_on_association(association_name.to_sym)
 
-        unless model.reflect_on_association(association_name.to_sym)
-          raise ValidationError, "Unknown association '#{association_name}' on #{params['model']}"
-        end
+        raise ValidationError, "Unknown association '#{association_name}' on #{params['model']}" unless reflection
 
         # Defense-in-depth: the parent model passed validate_model!'s
         # gate_model! check, but the association may target a different
@@ -525,11 +577,119 @@ module Woods
         # explicitly before reading any rows from it.
         gate_association!(params['model'], association_name)
 
+        # Validate every request-controlled scope column against the
+        # association's own model before any database I/O runs (not just
+        # before the association is read): `model.find` below is itself a
+        # query, and a request with a bad scope should never reach it.
+        validate_scope_columns!(params['scope'], reflection.klass.name) if params['scope']
+
+        record = model.find(params['id'])
         scope = record.public_send(association_name)
-        scope = apply_scope(scope, params['scope'])
+        scope = apply_scope(scope, params['scope'], model_name: reflection.klass.name) if params['scope']
+        gate_association_sql!(scope)
         { 'count' => scope.count }
       end
 
+      # Defense-in-depth: gate_association! (called by
+      # {#handle_association_count} before this) only proves the
+      # association's OWN target table isn't blocked. A through-association,
+      # default_scope, or an applied scope can still render SQL that reaches
+      # a blocked table via a less-obvious join — mirrors handle_query's
+      # re-check of the final rendered SQL. Only renders `to_sql` when a
+      # gate is actually configured — it is otherwise unnecessary AR work on
+      # every request.
+      def gate_association_sql!(scope)
+        gate_sql!(scope.to_sql) if @table_gate
+      end
+
+      # Pure column-name validation for a scope Hash, no relation is built
+      # and no query runs. Reuses ScopePredicateParser's own suffix grammar
+      # so the two never drift.
+      #
+      # @param scope [Hash, nil]
+      # @param model_name [String]
+      # @raise [ValidationError] on an unknown column
+      def validate_scope_columns!(scope, model_name)
+        return unless scope.is_a?(Hash)
+
+        scope.each_key do |raw_key|
+          column = scope_key_column(raw_key)
+          @model_validator.validate_column!(model_name, column)
+          refuse_protected_predicate_column!(column)
+        end
+      end
+
+      # Strip a Ransack-style predicate suffix (e.g. `_matches`, `_gt`) from a
+      # scope Hash key, returning the bare column name underneath.
+      #
+      # @param raw_key [String, Symbol]
+      # @return [String]
+      def scope_key_column(raw_key)
+        key = raw_key.to_s
+        match = ScopePredicateParser::SUFFIX_PATTERN.match(key)
+        match ? key.delete_suffix(match[1]) : key
+      end
+
+      # Refuse a column that is configured as redacted
+      # (`console_redacted_columns`). {SafeContext#redact} only scrubs
+      # sensitive values from serialized *output* — accepting the same
+      # column as a scope/filter key, a find locator, an aggregate target,
+      # or an order_by column lets a caller read its plaintext value via a
+      # comparison, aggregate, or sort-order oracle before redaction ever
+      # runs.
+      #
+      # Matching is case-insensitive: unquoted SQL identifiers are
+      # case-insensitive, so a case variant of a redacted column (`AMOUNT`,
+      # `Password_Digest`) must get this typed refusal rather than fall
+      # through to an existence check.
+      #
+      # @param column [String] bare column name (no schema/table qualifier)
+      # @raise [ValidationError] if the column is on console_redacted_columns
+      def refuse_redacted_column!(column)
+        return unless @safe_context.redacted_columns.any? { |name| name.to_s.casecmp?(column.to_s) }
+
+        raise ValidationError,
+              "Rejected: column '#{column}' is redacted (console_redacted_columns) and cannot be used " \
+              'as a scope, filter, aggregate, find, or order key.'
+      end
+
+      # Refuse a predicate column protected by either redaction layer. This
+      # is narrower than EAV alias/aggregate protection: the key column is
+      # the selector used to identify sensitive rows and remains a valid
+      # predicate, while the value column is the secret-bearing field.
+      #
+      # Both layers match case-insensitively (see {#refuse_redacted_column!}):
+      # a case variant of a protected column must keep the typed refusal.
+      #
+      # @param column [String, Symbol] already-normalized bare or qualified column name
+      # @raise [ValidationError] when the column is protected for predicates
+      def refuse_protected_predicate_column!(column)
+        base = base_column_name(column.to_s)
+        return refuse_redacted_column!(base) if @safe_context.redacted_columns.any? { |name| name.to_s.casecmp?(base) }
+        return unless redacted_eav_value_columns.any? { |name| name.to_s.casecmp?(base) }
+
+        raise ValidationError,
+              "Rejected: EAV value column '#{base}' is redacted (console_redacted_key_values) and cannot " \
+              'be used as a scope, filter, or having predicate.'
+      end
+
+      # Refuse every column referenced by a scope Hash that is protected for
+      # predicates, honoring predicate suffixes (`email_matches`,
+      # `salary_gt`, etc.) the same way {#validate_scope_columns!} does.
+      #
+      # @param scope [Hash]
+      # @raise [ValidationError] on the first protected column found
+      def refuse_redacted_scope_keys!(scope)
+        scope.each_key { |raw_key| refuse_protected_predicate_column!(scope_key_column(raw_key)) }
+      end
+
+      # The value columns of every configured EAV redaction pair.
+      #
+      # @return [Array<String>]
+      def redacted_eav_value_columns
+        @safe_context.redacted_key_values.filter_map { |pattern| pattern['value_column'] }
+      end
+
       def gate_association!(model_name, association)
         return unless @table_gate && association
 
@@ -568,10 +728,13 @@ module Woods
         model = resolve_model(params['model'])
         order_by = params.fetch('order_by', 'created_at')
         direction = params.fetch('direction', 'desc')
-        limit = [params.fetch('limit', 10).to_i, 50].min
+        limit = params.fetch('limit', 10)
 
         @model_validator.validate_column!(params['model'], order_by)
-        direction = 'desc' unless %w[asc desc].include?(direction)
+        refuse_redacted_column!(order_by)
+        unless %w[asc desc].include?(direction)
+          raise ValidationError, "direction must be asc or desc (got #{direction.inspect})"
+        end
 
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = apply_columns(scope, params['columns'])
@@ -599,12 +762,23 @@ module Woods
         raise ValidationError, 'Missing required parameter: sql' unless sql
 
         require_relative 'sql_validator'
-        SqlValidator.new.validate!(sql)
+        SqlValidator.new(dialect: sql_dialect, mysql_modes: mysql_quote_modes).validate!(sql)
+        validate_protected_sql_usage!(sql)
         # Post-validation, pre-execution TableGate — blocks every configured
         # table even if the sql is otherwise well-formed.
         gate_sql!(sql)
 
-        limit = params['limit'] ? [params['limit'].to_i, MAX_SQL_LIMIT].min : nil
+        limit = params['limit']
+        # EXPLAIN's output is plan rows, not the query's own row set: wrapping
+        # it as `SELECT * FROM (EXPLAIN ...) AS _limited LIMIT n` is invalid
+        # SQL that fails as a generic adapter error. Reject the combination
+        # with a typed error instead of advertising a limit EXPLAIN can't honor.
+        if limit && explain_statement?(sql)
+          raise ValidationError, 'limit is not supported with EXPLAIN (EXPLAIN output is plan rows, ' \
+                                 'not the query result set, so it cannot be wrapped and limited). ' \
+                                 'Resubmit without limit.'
+        end
+
         query_sql = limit ? "SELECT * FROM (#{sql}) AS _limited LIMIT #{limit}" : sql
         result = active_connection.select_all(query_sql)
 
@@ -613,6 +787,56 @@ module Woods
         raise ValidationError, e.message
       end
 
+      # @param sql [String] Validated SQL (already passed SqlValidator)
+      # @return [Boolean] true when the statement starts with EXPLAIN
+      def explain_statement?(sql)
+        sql.strip.match?(/\AEXPLAIN\b/i)
+      end
+
+      # The SQL dialect the active connection will parse the statement
+      # under, for {SqlValidator}'s dialect-aware lock-clause check. MySQL
+      # and PostgreSQL quote/comment grammars differ (`\'` escapes, `#`
+      # comments); validating with the matching dialect accepts dialect-valid
+      # literals and still rejects every known bypass form. Unknown adapters
+      # return nil and get the conservative both-dialect union.
+      #
+      # @return [Symbol, nil]
+      def sql_dialect
+        adapter = active_connection.adapter_name.to_s.downcase
+        return :mysql if adapter.include?('mysql')
+        return :postgres if adapter.include?('postgre')
+
+        nil
+      end
+
+      # Keep session reads local to this request and execution context. Restore
+      # the previous cache for nested requests, including when dispatch raises.
+      def with_mysql_quote_modes
+        previous = Thread.current[:woods_console_mysql_quote_modes]
+        Thread.current[:woods_console_mysql_quote_modes] = {}
+        yield
+      ensure
+        Thread.current[:woods_console_mysql_quote_modes] = previous
+      end
+
+      # Read the executing session, not adapter defaults or a cached boot value.
+      # The request runs inside SafeContext on active_connection throughout.
+      def mysql_quote_modes
+        return {} unless sql_dialect == :mysql
+
+        connection = active_connection
+        cache = Thread.current[:woods_console_mysql_quote_modes]
+        return cache[connection] if cache&.key?(connection)
+
+        modes = connection.select_value('SELECT @@SESSION.sql_mode').to_s.upcase.split(',')
+        result = {
+          ansi_quotes: modes.include?('ANSI_QUOTES'),
+          no_backslash_escapes: modes.include?('NO_BACKSLASH_ESCAPES')
+        }
+        cache[connection] = result if cache
+        result
+      end
+
       # Build and execute a structured ActiveRecord query.
       #
       # @param params [Hash] Must contain 'model' and 'select'
@@ -638,23 +862,42 @@ module Woods
       # @param params [Hash] Query parameters (select, joins, scope, group_by, having, order, limit)
       # @return [ActiveRecord::Relation]
       def build_query_relation(model, params)
-        relation = apply_query_clauses(model, params)
-        limit = params['limit'] ? [params['limit'].to_i, MAX_QUERY_LIMIT].min : MAX_QUERY_LIMIT
+        clauses = validated_query_clauses(model, params)
+        relation = apply_query_clauses(model, params, clauses)
+        limit = params.fetch('limit', 10_000)
         relation.limit(limit)
       end
 
+      # Validate every structured query clause before any ActiveRecord
+      # relation method can run. This keeps redaction-oracle refusals typed
+      # and prevents malformed predicates from reaching Arel/adapter code.
+      #
+      # @param model [Class] ActiveRecord model class
+      # @param params [Hash]
+      # @return [Hash] normalized, validated query clauses
+      def validated_query_clauses(model, params)
+        model_name = params['model']
+        {
+          select: params['select'] ? validated_select(params['select'], model_name) : nil,
+          joins: validated_query_joins(model, params['joins']),
+          scope: params.key?('scope') ? validated_query_scope(params['scope'], model_name, model) : nil,
+          group_by: params['group_by']&.any? ? validated_columns(params['group_by'], model_name) : nil,
+          having: params['having'] ? validated_having(params['having'], model_name) : nil,
+          order: params['order'] ? validated_order(params['order'], model_name) : nil
+        }
+      end
+
+      def validated_query_joins(model, joins)
+        return nil unless joins&.any?
+
+        validate_joins!(model, joins)
+        joins.map(&:to_sym)
+      end
+
       # Optional aggregate-expression wrappers accepted inside a `select`.
       # Anything else must be a bare column name validated against the model.
       # Matching is case-insensitive; the trailing `AS alias` is optional and
       # the alias itself must be an identifier — it can't carry SQL.
-      SAFE_SELECT_EXPR = /
-        \A\s*
-        (?:(SUM|AVG|MIN|MAX|COUNT)\s*\(\s*(\*|\w+(?:\.\w+)?)\s*\)|(\w+(?:\.\w+)?))
-        (?:\s+AS\s+(\w+))?
-        \s*\z
-      /ix
-      private_constant :SAFE_SELECT_EXPR
-
       # Apply select/joins/scope/group/having/order clauses to a relation.
       #
       # Validates every user-supplied column/alias through the ModelValidator
@@ -666,42 +909,242 @@ module Woods
       #
       # @param model [Class] ActiveRecord model class
       # @param params [Hash]
+      # @param clauses [Hash] prevalidated query clauses
       # @return [ActiveRecord::Relation]
       # @raise [ValidationError] on unsafe column/expression input
-      def apply_query_clauses(model, params) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize
+      def apply_query_clauses(model, params, clauses)
         model_name = params['model']
         relation = model.all
 
-        relation = relation.select(*validated_select(params['select'], model_name)) if params['select']
-        relation = relation.joins(params['joins'].map(&:to_sym)) if params['joins']&.any?
-        relation = apply_scope(relation, params['scope'], model_name: model_name)
-        relation = relation.group(*validated_columns(params['group_by'], model_name)) if params['group_by']&.any?
-        relation = relation.having(*validated_having(params['having'], model_name)) if params['having']
-        relation = relation.order(validated_order(params['order'], model_name)) if params['order']
+        relation = relation.select(*clauses[:select]) if clauses[:select]
+        relation = relation.joins(clauses[:joins]) if clauses[:joins]
+        relation = apply_scope(relation, clauses[:scope], model_name: model_name) if params.key?('scope')
+        relation = relation.group(*clauses[:group_by]) if clauses[:group_by]
+        relation = relation.having(*clauses[:having]) if clauses[:having]
+        relation = relation.order(clauses[:order]) if clauses[:order]
         relation
       end
 
       # Normalize `select:` into an array of safe expressions. Each element
       # must be a column name (optionally qualified and/or aliased) or a
-      # whitelisted aggregate call over a column.
+      # whitelisted aggregate call over a column. The list is then validated
+      # as a set: positional EAV redaction resolves key/value columns by
+      # header name and needs BOTH headers present, so a value column
+      # selected without its paired key column would return plaintext.
       #
       # @param select [String, Array<String>]
       # @param model_name [String]
       # @return [Array<String>]
       def validated_select(select, model_name)
-        Array(select).flat_map { |s| s.to_s.split(',') }.map do |expr|
+        expressions = Array(select).map do |expr|
           validate_select_expression!(expr.strip, model_name)
         end
+        refuse_orphan_eav_value_selection!(expressions)
+        expressions
+      end
+
+      # Refuse an EAV value column whose paired key column is missing from
+      # the select set. The per-expression checks ({#validate_select_expression!})
+      # already refused aliases and aggregates over protected columns, so
+      # what reaches here unaliased can only be direct column selection —
+      # and the positional redactor masks the value cell only when the key
+      # column is in the same header. Requiring the key column keeps direct
+      # EAV reads working ({Woods::Console::Redactor} masks the value);
+      # refusing outright would break legitimate key/value reads.
+      #
+      # @param expressions [Array<String>] validated select expressions
+      # @raise [ValidationError] when a value column is selected without its key
+      def refuse_orphan_eav_value_selection!(expressions)
+        selected = directly_selected_columns(expressions)
+
+        @safe_context.redacted_key_values.each do |pattern|
+          next unless selected.include?(pattern['value_column'])
+          next if selected.include?(pattern['key_column'])
+
+          raise ValidationError,
+                "Rejected: selecting EAV value column '#{pattern['value_column']}' without its paired " \
+                "key column '#{pattern['key_column']}' bypasses redaction; select both columns so the " \
+                'value can be masked.'
+        end
       end
 
+      # The bare, unaliased columns referenced by a validated select list.
+      # Aggregates and aliases cannot appear here — the per-expression
+      # validation refuses them over protected columns before this runs.
+      #
+      # @param expressions [Array<String>]
+      # @return [Array<String>]
+      def directly_selected_columns(expressions)
+        expressions.filter_map do |expr|
+          match = Server::SELECT_EXPRESSION_REGEXP.match(expr)
+          next unless match
+
+          fn_arg, bare_col, alias_name = match.captures[1..]
+          next if fn_arg || alias_name
+
+          base_column_name(bare_col)
+        end
+      end
+
+      # Validate one select expression against the model and the redaction
+      # configuration.
+      #
+      # Exactly four shapes are refused (redaction stays positional by
+      # output header — {Woods::Console::Redactor} masks by column name, so
+      # any construct that renames or shadows an output header would carry
+      # plaintext past it):
+      #   1. an `AS` alias over a `console_redacted_columns` column
+      #      (`password_digest AS note` returns plaintext under the `note`
+      #      header, which no redaction rule matches);
+      #   2. an aggregate over a `console_redacted_columns` column, aliased
+      #      or bare (`SUM(salary)` leaks the aggregate of a column whose
+      #      individual values are masked — {#handle_aggregate} refuses the
+      #      same column via {#refuse_redacted_column!});
+      #   3. an `AS` alias over either column of a
+      #      `console_redacted_key_values` pair (the positional EAV rule
+      #      resolves key/value columns by header name, so renaming either
+      #      header silently disarms it);
+      #   4. any `AS` alias whose NAME collides with a protected header
+      #      (`id AS value` duplicates the EAV value header; positional
+      #      index resolution could then mask the shadow instead of the
+      #      secret — the aliased source being harmless is exactly what
+      #      makes the shape dangerous).
+      #
+      # Direct, unaliased selection of a redacted column REMAINS ALLOWED:
+      # the output header keeps the column's real name, and the positional
+      # redactor masks the value. Aliasing a non-redacted column stays
+      # allowed.
+      #
+      # @param expr [String] a single select expression
+      # @param model_name [String]
+      # @return [String] the expression, unchanged, once validated
+      # @raise [ValidationError] on an unsafe expression or a refused shape
       def validate_select_expression!(expr, model_name)
-        match = SAFE_SELECT_EXPR.match(expr)
+        match = Server::SELECT_EXPRESSION_REGEXP.match(expr)
         raise ValidationError, "Rejected select expression: #{expr.inspect}" unless match
 
-        _fn, fn_arg, bare_col, _alias = match.captures
+        refuse_redacted_select_shapes!(match.captures, model_name)
+        expr
+      end
+
+      # Column-existence check plus the three redaction-refusal shapes; see
+      # {#validate_select_expression!} for the shape list.
+      #
+      # @param captures [Array] {Server::SELECT_EXPRESSION_REGEXP} captures
+      # @param model_name [String]
+      # @raise [ValidationError] on an unknown column or a refused shape
+      def refuse_redacted_select_shapes!(captures, model_name)
+        fn, fn_arg, bare_col, alias_name = captures
         column = bare_col || fn_arg
         validate_column_reference!(column, model_name) unless column == '*'
-        expr
+
+        refuse_protected_alias_target!(alias_name) if alias_name
+        refuse_redacted_select_alias!(bare_col, alias_name) if alias_name
+        refuse_redacted_aggregate_expression!(fn_arg) if fn
+      end
+
+      # Refuse an `AS` alias whose NAME collides with a protected output
+      # header (shape 4 in {#validate_select_expression!}). The positional
+      # redactor resolves masks by header name; an alias naming a redacted
+      # or EAV column duplicates that header, and the duplicate can steal
+      # the mask from the real column's cell. Case-insensitive: unquoted
+      # SQL identifiers fold, so a case-variant alias lands on the same
+      # output header.
+      #
+      # @param alias_name [String] the `AS` alias
+      # @raise [ValidationError] when the alias names a protected header
+      def refuse_protected_alias_target!(alias_name)
+        return unless protected_column_name?(alias_name)
+
+        raise ValidationError,
+              "Rejected: alias '#{alias_name}' names a protected output header; an alias must not " \
+              'collide with a redacted or EAV column name.'
+      end
+
+      # @param name [String]
+      # @return [Boolean] whether either redaction layer protects the name
+      def protected_column_name?(name)
+        casecmp_member?(@safe_context.redacted_columns, name) ||
+          casecmp_member?(redacted_kv_columns, name)
+      end
+
+      # Case-insensitive membership, matching unquoted SQL identifier
+      # semantics (the predicate refusals already compare this way).
+      #
+      # @param list [Array<String>]
+      # @param name [String]
+      # @return [Boolean]
+      def casecmp_member?(list, name)
+        list.any? { |entry| entry.to_s.casecmp?(name.to_s) }
+      end
+
+      # Refuse an `AS` alias over a column protected by either redaction
+      # layer. A no-op when +alias_name+ is nil. See
+      # {#validate_select_expression!} for why the alias is refused while
+      # direct selection is not.
+      #
+      # @param column [String, nil] bare or qualified column reference
+      # @param alias_name [String, nil] the `AS` alias
+      # @raise [ValidationError] when the aliased column is protected
+      def refuse_redacted_select_alias!(column, alias_name)
+        return unless column
+
+        base = base_column_name(column)
+        if casecmp_member?(@safe_context.redacted_columns, base)
+          raise ValidationError,
+                "Rejected: aliasing redacted column '#{base}' as '#{alias_name}' bypasses output " \
+                'redaction. Select it unaliased; the value is masked.'
+        end
+
+        return unless casecmp_member?(redacted_kv_columns, base)
+
+        raise ValidationError,
+              "Rejected: aliasing redacted key/value column '#{base}' as '#{alias_name}' bypasses " \
+              'EAV output redaction. Select it unaliased.'
+      end
+
+      # Refuse an aggregate call over a column protected by either redaction
+      # layer, mirroring {#handle_aggregate}'s {#refuse_redacted_column!} for
+      # the aggregate expressions accepted inside `select`. The EAV check
+      # covers both columns of every `console_redacted_key_values` pair: an
+      # aggregate over the value column (e.g. `MAX(amount)` over the rows a
+      # sensitive key selects) reads the redacted value itself, and the key
+      # column is refused for symmetry with the alias rule.
+      #
+      # @param column [String, nil] aggregate argument (`*` is never redacted)
+      # @raise [ValidationError] when the aggregated column is protected
+      def refuse_redacted_aggregate_expression!(column)
+        return if column.nil? || column == '*'
+
+        base = base_column_name(column)
+        if casecmp_member?(@safe_context.redacted_columns, base)
+          raise ValidationError,
+                "Rejected: aggregating redacted column '#{base}' reads its value; it cannot be used " \
+                'as an aggregate input.'
+        end
+
+        return unless casecmp_member?(redacted_kv_columns, base)
+
+        raise ValidationError,
+              "Rejected: aggregating redacted key/value column '#{base}' reads its value; it cannot " \
+              'be used as an aggregate input.'
+      end
+
+      # The key and value columns of every configured EAV redaction pair.
+      #
+      # @return [Array<String>]
+      def redacted_kv_columns
+        @safe_context.redacted_key_values
+                     .flat_map { |pattern| [pattern['key_column'], pattern['value_column']] }
+      end
+
+      # Strip a `table.` qualifier, returning the bare column name that
+      # redaction configuration is keyed on.
+      #
+      # @param column [String]
+      # @return [String]
+      def base_column_name(column)
+        column.split('.').last
       end
 
       # Validate group_by entries — bare columns only (no functions, no SQL).
@@ -713,6 +1156,7 @@ module Woods
         Array(columns).flat_map { |c| c.to_s.split(',') }.map do |col|
           col = col.strip
           validate_column_reference!(col, model_name)
+          refuse_protected_predicate_column!(col)
           col
         end
       end
@@ -726,58 +1170,152 @@ module Woods
       # Anything else is rejected — raw strings (e.g. `"1=1 UNION SELECT
       # password_digest FROM users"`) used to flow straight through and
       # enable SELECT-based exfiltration despite the SafeContext rollback.
-      HAVING_AGG_TEMPLATE = /
-        \A\s*
-        (?:
-          (?<col>\w+(?:\.\w+)?)
-          |
-          (?<agg>SUM|AVG|MIN|MAX|COUNT)\s*\(\s*(?<arg>\*|\w+(?:\.\w+)?)\s*\)
-        )
-        \s*(?<op>=|!=|<>|<=|>=|<|>)\s*\?\s*\z
-      /ix
-      private_constant :HAVING_AGG_TEMPLATE
-
-      def validated_having(having, model_name) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      def validated_having(having, model_name)
         case having
         when Hash
           raise ValidationError, 'having: empty hash' if having.empty?
 
-          having.each_key { |k| validate_column_reference!(k.to_s, model_name) }
+          having.each_key do |k|
+            validate_column_reference!(k.to_s, model_name)
+            refuse_protected_predicate_column!(k)
+          end
           [having]
         when Array
-          raise ValidationError, 'having: array must be [sql_with_placeholders, *binds]' if having.empty?
+          validated_having_array!(having, model_name)
+        else
+          raise ValidationError, "having: unsupported type #{having.class}"
+        end
+      end
+
+      # Validate the `[template, bind]` array form of `having:`.
+      #
+      # @param having [Array] `[template, bind]`
+      # @param model_name [String]
+      # @return [Array] `having`, unchanged, once validated
+      def validated_having_array!(having, model_name)
+        unless having.length == 2 && having.first.is_a?(String)
+          raise ValidationError, 'having must contain exactly one template and one bind value'
+        end
+
+        template = having.first
+        match = Server::HAVING_TEMPLATE_REGEXP.match(template)
+        raise ValidationError, "having: unsupported SQL template #{template.inspect}" unless match
+
+        # Validate any referenced columns through ModelValidator so
+        # aggregate args can't reach the db without a column check.
+        col = match[1] || match[3]
+        validate_column_reference!(col, model_name) if col && col != '*'
+        refuse_protected_having_reference!(match)
+        validate_having_bind!(having.last)
+
+        having
+      end
+
+      # Redaction oracle refusal for a HAVING template. A predicate over a
+      # protected column leaks its value through repeated guesses — the
+      # response reveals whether any row satisfied the comparison.
+      # Aggregates are refused over both redaction layers (the EAV pair
+      # columns, matching {#refuse_redacted_aggregate_expression!} for
+      # select); bare-column predicates are refused over protected
+      # predicate columns: console_redacted_columns and EAV value columns.
+      #
+      # @param match [MatchData] {Server::HAVING_TEMPLATE_REGEXP} match
+      # @raise [ValidationError] when the referenced column is protected
+      def refuse_protected_having_reference!(match)
+        return refuse_protected_predicate_column!(match[1]) if match[1]
+        return if match[3].nil? || match[3] == '*'
+
+        refuse_redacted_aggregate_expression!(match[3])
+      end
 
-          template = having.first.to_s
-          match = HAVING_AGG_TEMPLATE.match(template)
-          raise ValidationError, "having: unsupported SQL template #{template.inspect}" unless match
+      # Defense-in-depth: the public schema already restricts the bind to a
+      # scalar JSON type (see tool_specs.rb), but a container (Hash/Array)
+      # bind that reaches AR's `?` placeholder fails as a generic adapter
+      # error, not a typed one: reject it here too, mirroring
+      # apply_query_scope's bind check.
+      def validate_having_bind!(bind)
+        case bind
+        when String, Numeric, true, false, nil
+          nil
+        else
+          raise ValidationError, 'having bind must be a string, number, boolean, or null'
+        end
+      end
 
-          # Validate any referenced columns through ModelValidator so
-          # aggregate args can't reach the db without a column check.
-          col = match[:col] || match[:arg]
-          validate_column_reference!(col, model_name) if col && col != '*'
+      # Apply the public console_query scope contract. Query arrays are
+      # intentionally narrower than the legacy Tier 1 executor form: exactly
+      # one safe column comparison template and one bind value.
+      def apply_query_scope(relation, scope, model_name)
+        apply_scope(relation, validated_query_scope(scope, model_name, nil), model_name: model_name)
+      end
 
-          having
+      # Validate a console_query scope. +model+ is the already-resolved
+      # ActiveRecord class: its own table name lets a `table.column`
+      # placeholder scope validate the column against the model's own
+      # columns (public/executor parity) even when the ModelValidator
+      # carries no table_names mapping. A nil +model+ falls back to the
+      # strict qualified-reference resolution.
+      def validated_query_scope(scope, model_name, model)
+        if scope.is_a?(Hash)
+          validate_scope_columns!(scope, model_name)
+          return scope
+        end
+
+        unless scope.is_a?(Array) && scope.length == 2 && scope.first.is_a?(String)
+          raise ValidationError, 'scope must be an object or exact ["column OP ?", bind] array'
+        end
+
+        case scope.last
+        when String, Numeric, true, false, nil
+          nil
         else
-          raise ValidationError, "having: unsupported type #{having.class}"
+          raise ValidationError, 'scope bind must be a string, number, boolean, or null'
         end
+
+        match = Server::QUERY_SCOPE_TEMPLATE_REGEXP.match(scope.first)
+        raise ValidationError, "scope: unsupported SQL template #{scope.first.inspect}" unless match
+
+        # Redaction refusal runs BEFORE column resolution: a redacted column
+        # referenced through any case variant (`Users.Password_Digest = ?`)
+        # must get the typed redaction refusal, never a pass-through to the
+        # existence check (whose case-sensitive column lookup would report a
+        # generic "Unknown column" instead).
+        refuse_protected_predicate_column!(match[1])
+        validate_column_reference!(match[1], model_name, own_table: own_table_name(model))
+        scope
+      end
+
+      # The queried model's own table name, when resolvable. Test doubles
+      # may not implement `table_name`; a nil result keeps the strict
+      # qualified-reference resolution instead of the own-table shortcut.
+      #
+      # @param model [Class, nil]
+      # @return [String, nil]
+      def own_table_name(model)
+        return nil unless model.respond_to?(:table_name)
+
+        model.table_name.to_s
       end
 
       # Validate `order:` — only Hash `{col => :asc|:desc}` or bare column name.
       def validated_order(order, model_name)
         case order
         when Hash
-          order.each_key { |k| validate_column_reference!(k.to_s, model_name) }
+          order.each_key do |key|
+            validate_column_reference!(key.to_s, model_name)
+            refuse_protected_predicate_column!(key)
+          end
           order.transform_values do |dir|
-            dir_sym = dir.to_s.downcase.to_sym
-            unless %i[asc desc].include?(dir_sym)
+            unless dir.to_s.match?(Server::ORDER_DIRECTION_REGEXP)
               raise ValidationError, "order direction must be :asc or :desc (got #{dir.inspect})"
             end
 
-            dir_sym
+            dir.to_s.downcase.to_sym
           end
         when String, Symbol
           col = order.to_s.strip
           validate_column_reference!(col, model_name)
+          refuse_protected_predicate_column!(col)
           col
         else
           raise ValidationError, "order: unsupported type #{order.class}"
@@ -791,19 +1329,23 @@ module Woods
       # blocked-table reference into `select`/`order`/`having` via a
       # qualified column like `users.password_digest`. Bare columns validate
       # against the active model through ModelValidator.
-      def validate_column_reference!(column, model_name)
+      #
+      # +own_table+ is the queried model's own table name, supplied by the
+      # console_query scope path: a `table.column` reference whose table is
+      # the model's own table validates the column against that same model,
+      # exactly like the bare form. This cannot smuggle a foreign table
+      # (the qualifier is checked for equality, not looked up), so redaction
+      # and TableGate still apply to the reference as a whole. Any other
+      # qualified reference keeps the strict cross-table resolution through
+      # {ModelValidator#validate_table_column!}, which fails closed when the
+      # table side cannot be proven.
+      #
+      # @param column [String] bare or `table.column` reference
+      # @param model_name [String]
+      # @param own_table [String, nil] the queried model's own table name
+      def validate_column_reference!(column, model_name, own_table: nil)
         if column.include?('.')
-          table, col = column.split('.', 2)
-          unless safe_identifier?(table) && safe_identifier?(col)
-            raise ValidationError, "Rejected column reference: #{column.inspect}"
-          end
-
-          # Gate the table side through TableGate if one is configured.
-          begin
-            @table_gate&.check_table!(table)
-          rescue TableGateError => e
-            raise ValidationError, e.message
-          end
+          validate_qualified_column_reference!(column, model_name, own_table)
         else
           raise ValidationError, "Rejected column reference: #{column.inspect}" unless safe_identifier?(column)
 
@@ -811,8 +1353,55 @@ module Woods
         end
       end
 
+      # The qualified `table.column` half of {#validate_column_reference!}.
+      # The table half must be a safe identifier and unblocked (TableGate)
+      # before column ownership is resolved: +own_table+ (the queried
+      # model's own table name) short-circuits resolution to that model's
+      # own columns, exactly like the bare form; the qualifier is compared
+      # case-insensitively (unquoted SQL identifiers are case-insensitive)
+      # against that one table name, never looked up, so this cannot
+      # smuggle a foreign table and redaction still applies to the
+      # reference as a whole. The column half keeps ModelValidator's exact
+      # existence check, identical to the bare-column form. Anything else
+      # resolves through {ModelValidator#validate_table_column!}, which
+      # fails closed when the table side cannot be proven.
+      #
+      # @param column [String] a `table.column` reference
+      # @param model_name [String]
+      # @param own_table [String, nil] the queried model's own table name
+      def validate_qualified_column_reference!(column, model_name, own_table)
+        table, col = column.split('.', 2)
+        unless safe_identifier?(table) && safe_identifier?(col)
+          raise ValidationError, "Rejected column reference: #{column.inspect}"
+        end
+
+        # Gate the table side through TableGate if one is configured.
+        begin
+          @table_gate&.check_table!(table)
+        rescue TableGateError => e
+          raise ValidationError, e.message
+        end
+
+        if own_table && table.casecmp?(own_table)
+          # TableGate only proves `table` isn't *blocked* — it says nothing
+          # about whether `col` actually exists there. Validate ownership
+          # against the real schema before this reference can reach SQL.
+          @model_validator.validate_column!(model_name, col)
+        else
+          @model_validator.validate_table_column!(table, col)
+        end
+      end
+
       def safe_identifier?(name)
-        name.is_a?(String) && name.match?(/\A[a-zA-Z_][a-zA-Z0-9_]*\z/)
+        name.is_a?(String) && name.match?(Server::SAFE_IDENTIFIER_REGEXP)
+      end
+
+      def validate_joins!(model, joins)
+        joins.each do |association|
+          next if model.reflect_on_association(association.to_sym)
+
+          raise ValidationError, "Unknown association '#{association}' on #{model.name}"
+        end
       end
 
       # ── Helpers ──────────────────────────────────────────────────────────
@@ -820,24 +1409,24 @@ module Woods
       # Apply scope conditions (WHERE clauses) to a relation.
       #
       # Accepts Hash form for equality or Ransack-style predicate suffixes
-      # (e.g., `{total_refund_gt: 0, status_in: ['paid','refunded']}`), or
-      # Array form for parameterized SQL (e.g., JSON column queries like
-      # ["preferences->>'theme' = ?", "dark"]).
+      # (e.g., `{total_refund_gt: 0, status_in: ['paid','refunded']}`). The
+      # array branch is used only after console_query's narrower contract has
+      # validated an exact `["column OP ?", bind]` pair.
       #
-      # When `model_name` is supplied and the Hash contains at least one key
-      # with a recognised predicate suffix, the ScopePredicateParser builds
-      # safe Arel nodes. Plain equality hashes skip the parser entirely.
+      # When `model_name` is supplied, ScopePredicateParser validates every
+      # equality and predicate column before applying the scope.
       #
       # @param relation [ActiveRecord::Relation, Class] Model or relation
       # @param scope [Hash, Array, nil] Filter conditions
-      # @param model_name [String, nil] Model name for column validation (predicate path only)
+      # @param model_name [String, nil] Model name for Hash key validation
       # @return [ActiveRecord::Relation]
       def apply_scope(relation, scope, model_name: nil)
         case scope
         when Hash
           return relation unless scope.any?
 
-          if model_name && predicate_suffix?(scope)
+          refuse_redacted_scope_keys!(scope)
+          if model_name
             parser = ScopePredicateParser.new(model_name: model_name, model_validator: @model_validator)
             parser.parse(relation, scope)
           else
@@ -846,14 +1435,8 @@ module Woods
         when Array
           return relation unless scope.any?
 
-          # Array form is `[template, *binds]`. The previous implementation
-          # splatted directly into `where(*scope)`, which is the
-          # `where(raw_sql_string)` arity — unbounded SQL injection. A
-          # caller could pass `["EXISTS (SELECT 1 FROM users WHERE
-          # password_digest LIKE 'a%')"]` and turn `console_count` /
-          # `console_pluck` into a boolean exfiltration oracle against
-          # any table the DB user can read (TableGate doesn't fire on
-          # the rendered Tier-1 SQL). Validate the template now.
+          # Keep defense-in-depth validation here even though the registered
+          # query schema and apply_query_scope enforce a narrower array form.
           validate_scope_array!(scope)
           relation.where(*scope)
         else
@@ -918,18 +1501,12 @@ module Woods
 
         placeholder_count = template.scan('?').size
         bind_count = scope.length - 1
-        return if placeholder_count == bind_count
-
-        raise ValidationError,
-              "scope template expects #{placeholder_count} bind(s), got #{bind_count}"
-      end
+        unless placeholder_count == bind_count
+          raise ValidationError,
+                "scope template expects #{placeholder_count} bind(s), got #{bind_count}"
+        end
 
-      # Returns true if any key in the hash has a recognised predicate suffix.
-      #
-      # @param scope [Hash]
-      # @return [Boolean]
-      def predicate_suffix?(scope)
-        scope.any? { |k, _| ScopePredicateParser::SUFFIX_PATTERN.match?(k.to_s) }
+        refuse_protected_predicate_references!(template)
       end
 
       # Validate that any requested +columns+ are real model columns before
@@ -944,6 +1521,86 @@ module Woods
         return unless params['columns']
 
         @model_validator.validate_columns!(params['model'], params['columns'])
+        refuse_orphan_eav_value_selection!(params['columns'])
+      end
+
+      # Raw SQL preserves redaction identity only for direct, unaliased
+      # protected columns in the outer SELECT list. Aliases, aggregates,
+      # predicates, CTEs, and other result shapes can rename a protected
+      # value or turn it into an oracle, so they fail closed before execution.
+      def validate_protected_sql_usage!(sql)
+        protected = (@safe_context.redacted_columns + redacted_kv_columns).uniq
+        referenced = protected.select { |column| sql_identifier_referenced?(sql, column) }
+        return if referenced.empty?
+
+        stripped = SqlNoiseStripper.strip_noise(sql, dialect: sql_dialect || :postgres, **mysql_quote_modes)
+        expressions, tail = protected_sql_projection(stripped)
+        selected = expressions.filter_map { |expression| direct_sql_column_name(expression) }
+        unsafe = unsafe_protected_sql_column(referenced, expressions, selected, tail)
+        return unless unsafe
+
+        raise ValidationError,
+              "Rejected: console_sql uses protected column '#{unsafe}' in an alias, aggregate, predicate, or " \
+              'unpaired EAV shape that cannot preserve redaction identity. Select protected columns directly ' \
+              'and unaliased, or use a structured Console tool.'
+      end
+
+      def unsafe_protected_sql_column(referenced, expressions, selected, tail)
+        referenced.find do |column|
+          unsafe_protected_sql_reference?(column, expressions, selected, tail)
+        end || orphan_eav_sql_value(selected)
+      end
+
+      def protected_sql_projection(stripped)
+        match = /\ASELECT\s+(.*?)\s+FROM\b/im.match(stripped)
+        return [[], stripped] unless match
+
+        [sql_projection_expressions(match[1]), stripped[match.end(1)..]]
+      end
+
+      def unsafe_protected_sql_reference?(column, expressions, selected, tail)
+        unsafe_projection = expressions.any? do |expression|
+          sql_identifier_referenced?(expression, column) && direct_sql_column_name(expression) != column
+        end
+        unsafe_tail = protected_sql_predicate_column?(column) && sql_identifier_referenced?(tail, column)
+        !selected.include?(column) || unsafe_projection || unsafe_tail
+      end
+
+      def protected_sql_predicate_column?(column)
+        @safe_context.redacted_columns.include?(column) || redacted_eav_value_columns.include?(column)
+      end
+
+      def orphan_eav_sql_value(selected)
+        pattern = @safe_context.redacted_key_values.find do |candidate|
+          selected.include?(candidate['value_column']) && !selected.include?(candidate['key_column'])
+        end
+        pattern&.fetch('value_column')
+      end
+
+      def sql_projection_expressions(projection)
+        projection.split(',').map(&:strip)
+      end
+
+      def direct_sql_column_name(expression)
+        identifier = /(?:[A-Za-z_]\w*|"(?:""|[^"])+"|`(?:``|[^`])+`)/
+        match = /\A(?:#{identifier}\.)?(#{identifier})\z/.match(expression)
+        return unless match
+
+        match[1].sub(/\A["`]/, '').sub(/["`]\z/, '').gsub('""', '"').gsub('``', '`')
+      end
+
+      # Defense-in-depth for legacy Tier 1 scope arrays with more than one
+      # bind. The public schema currently admits only Hash scopes, but direct
+      # bridge callers still reach this validator.
+      def refuse_protected_predicate_references!(template)
+        protected = (@safe_context.redacted_columns + redacted_eav_value_columns).uniq
+        referenced = protected.find { |column| sql_identifier_referenced?(template, column) }
+        refuse_protected_predicate_column!(referenced) if referenced
+      end
+
+      def sql_identifier_referenced?(sql, column)
+        stripped = SqlNoiseStripper.strip_noise(sql, dialect: sql_dialect || :postgres, **mysql_quote_modes)
+        stripped.match?(/(?<![A-Za-z0-9_$])#{Regexp.escape(column)}(?![A-Za-z0-9_$])/i)
       end
 
       # Apply column selection to a relation.