woods 1.6.2 → 1.6.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 135a4869f2fdd230990dc723a96d62f19447e51295768392d25bd0125dd4e25a
-  data.tar.gz: bdce75a6b653bd5da5f3a7f4e7c9180020235f5a232daa5e58a4d439824e9a34
+  metadata.gz: b77f03a9d89a92c666a6ef9b8b20ed8583270fa0cfbb923acea9d6fbc973f9d2
+  data.tar.gz: 8336dccba436603daadaccd125888bc40702f16c4f514002bff298c9d8905f9e
 SHA512:
-  metadata.gz: 7dbe8d5460b1775c4f785954c88539fb29a76ad2878ee58e5e8ca11616787c87a058b9e9a774867f3cff4afe0c1b8ade137fd657f5249995d594e2ce2d7dfd8e
-  data.tar.gz: 99db15fe718972172398fcf1574b33e26e94869beeb0d90c95e7adcb6b41b4a53ad3b3c4fe34067ba01df7e485dec61e73cda5b739dda89dab665f9c6bfb3282
+  metadata.gz: ff12092063cd2a853c293812705b64f38c83da9a682d89bdcf243665ab810b5d5368e2d086a3a2949d885d677845637a3773b58c4322b62e56b83585f6f7e208
+  data.tar.gz: '0329bd31a7ddd6b0d05dedb46b4942a09d5534faf69668e77d45b1b9a8d37f1c3b860cc222446ddef7e64717e716d7388ef1217f3efe80578e481b875a7edba6'

data/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.6.3] - 2026-09-22
+
+### Build
+
+- Add the explicit, no-publish preparation cycle for the 1.6.3 security maintenance release; keep version writes task-owned and publication dependent on a reviewed trusted-main SHA pin.
+
+### Security
+
+- Apply blocked-table policy to resolved model relations and SQLite table syntax before reads, retain table boundaries across comments, and reject quoted spellings of existing denied SQL functions.
+- Scan the serialized Console response after protected-field redaction so Symbol values and custom JSON output cannot bypass credential scanning.
+
 ## [1.6.2] - 2026-09-18
 
 ### Fixed

data/CONTRIBUTING.md

@@ -128,29 +128,34 @@ By contributing, you agree that your contributions will be licensed under the MI
 
 ## Maintenance release
 
-This tree has a one-off, no-publish preparation adapter for the reviewed 1.6.2
+This tree has a one-off, no-publish preparation adapter for the reviewed 1.6.3
 security patch while `main` carries the newer 2.0 prerelease line. It does not
 establish a permanent stable branch or authorize another maintenance version.
-The approved target is `release/1.6.2`, based on immutable `v1.6.1`. Create that
+The approved target is `release/1.6.3`, based on immutable `v1.6.2`. Create that
 remote target only after the trusted main maintenance policy is reviewed.
 
 From a clean checkout, the only supported transitions are:
 
 ```sh
-bin/rake "release:reopen[1.6.2.alpha]"
+bin/rake "release:reopen[1.6.3.alpha]"
 # Review and commit the generated development-state diff.
-bin/rake "release:prepare[1.6.2]"
+bin/rake "release:prepare[1.6.3]"
 ```
 
 The tasks never commit, tag, push, dispatch or publish. Never edit VERSION or the
-README maintenance `release-state` banner manually. The first reopen creates that
-banner; prepare updates it and folds classified Unreleased notes and optional
-`changelog/<type>_<slug>.md` entries into a dated release heading. Entry files are
+README maintenance `release-state` banner manually. The existing maintenance
+banner must be present; both tasks update it. Prepare also folds classified
+Unreleased notes and optional `changelog/<type>_<slug>.md` entries into a dated
+release heading. Entry files are
 nonempty Markdown without headings; supported types include `fixed`, `security`,
 `build`, and `documentation`. Invalid transitions, dirty trees, malformed notes,
 and missing/duplicate/unknown fences refuse before writes. This legacy profile
 has no v2 migration guide or v2 surface inventory requirement.
 
+CI also runs on pushes to the exact `release/1.6.3` branch, so a private-advisory
+merge receives upstream validation before the trusted-main SHA pin. Publication
+still requires a separate green tag-push run.
+
 Validate the full suite, lint, booted extraction, real Console credential rotation,
 and installed maintenance package tests. CI builds one gem plus its SHA-256
 sidecar into `woods-release-<commit SHA>` and tests that artifact on Ruby 3.0/Rails
@@ -165,12 +170,12 @@ ruby -rrubygems -e 'load Gem.bin_path("rspec-core", "rspec")' -- \
   --options /dev/null spec/integration/maintenance_packaged_gem_spec.rb
 ```
 
-Preparation is not publication; check RubyGems before describing 1.6.2 as released.
+Preparation is not publication; check RubyGems before describing 1.6.3 as released.
 The legacy automatic tag publisher is disabled, and Bundler's `release`,
 `release:rubygem_push`, and `release:source_control_push` tasks abort. Only a
 maintainer may later tag the reviewed merge commit and dispatch the trusted
 **main** workflow. That workflow must explicitly allow the exact tag, protected
-maintenance branch, immutable 1.6.1 base, reviewed final candidate SHA, required
+maintenance branch, immutable 1.6.2 base, reviewed final candidate SHA, required
 CI jobs, and immutable artifact. An unpinned candidate remains blocked. First merge a reviewed trusted-main profile update pinning `approved_sha` to that
 exact maintenance merge SHA; only then may the maintainer tag it. The
 workflow publishes the already tested gem bytes; never rebuild or publish locally.

data/README.md

@@ -5,7 +5,7 @@
 # Woods
 
 <!-- release-state:maintenance-banner -->
-> **Woods 1.6.2: prepared maintenance candidate.** This tree remains on the 1.6 maintenance line.
+> **Woods 1.6.3: prepared maintenance candidate.** This tree remains on the 1.6 maintenance line.
 > Preparation does not establish publication. Check [RubyGems versions](https://rubygems.org/gems/woods/versions)
 > before selecting an install version. See [maintenance release policy](CONTRIBUTING.md#maintenance-release).
 <!-- release-state:end -->

data/lib/woods/console/credential_scanner.rb

@@ -145,7 +145,7 @@ module Woods
 
       # Scan a value (String, Hash, Array, or any other object) for credentials.
       #
-      # Strings are gsub'd against every active pattern. Hash values and Array
+      # Strings and Symbols are scanned against every active pattern. Hash values and Array
       # elements are walked recursively; keys and non-string scalars
       # (Integer, Float, true/false, nil) pass through untouched.
       #
@@ -164,6 +164,7 @@ module Woods
       def walk(value, counts, index)
         case value
         when String then scan_string(value, counts, index)
+        when Symbol then scan_string(value.to_s, counts, index).to_sym
         when Hash   then walk_hash(value, counts, index)
         when Array  then value.map { |item| walk(item, counts, index) }
         else value

data/lib/woods/console/dispatch_pipeline.rb

@@ -77,15 +77,33 @@ module Woods
         response = @conn_mgr.send_request(request)
         return error_from_response(response, request) unless response['ok']
 
-        result = @ctx.redact(response['result'])
-        result = scan_for_credentials(result, request)
-        text = @renderer ? @renderer.render_default(result) : JSON.pretty_generate(result)
-        success_response(text)
+        render_response(response['result'], request)
       rescue ConnectionError => e
         scanned = scan_for_credentials("Connection error: #{e.message}", request)
         error_response(scanned)
       end
 
+      def render_response(result, request)
+        # Remove protected values before custom serializers run, then scan
+        # the materialized representation consumed by both response renderers.
+        result = @ctx.redact(result)
+        result = JSON.parse(JSON.generate(result))
+        result = @ctx.redact(result)
+        result = scan_for_credentials(result, request)
+        text = @renderer ? @renderer.render_default(result) : JSON.pretty_generate(result)
+        success_response(text)
+      rescue StandardError
+        # SDK 0.x includes uncaught exception messages in its tool errors.
+        # Serializer/parser/renderer messages may contain unscanned values.
+        rendering_error_response(request)
+      end
+
+      def rendering_error_response(request)
+        error_response(scan_for_credentials('Console response could not be serialized safely.', request))
+      rescue StandardError
+        error_response('[REDACTION_FAILED]')
+      end
+
       def error_from_response(response, request)
         error_text = "#{response['error_type']}: #{response['error']}"
         error_text = scan_for_credentials(error_text, request)

data/lib/woods/console/embedded_executor.rb

@@ -10,6 +10,7 @@ require_relative 'model_validator'
 require_relative 'safe_context'
 require_relative 'scope_predicate_parser'
 require_relative 'sql_noise_stripper'
+require_relative 'sql_validator'
 require_relative 'table_gate'
 
 module Woods
@@ -425,8 +426,9 @@ module Woods
         return unless @table_gate
 
         begin
-          @table_gate.check_sql!(sql)
-        rescue TableGateError => e
+          SqliteReadGuard.validate!(sql) if sql_dialect == :sqlite
+          @table_gate.check_sql!(sql, dialect: sql_dialect == :sqlite ? :sqlite : nil)
+        rescue TableGateError, SqlValidationError => e
           raise ValidationError, e.message
         end
       end
@@ -454,7 +456,7 @@ module Woods
       def handle_count(params)
         model = resolve_model(params['model'])
         scope = apply_scope(model, params['scope'], model_name: params['model'])
-        { 'count' => scope.count }
+        { 'count' => checked_relation(scope).count }
       end
 
       def handle_sample(params)
@@ -463,16 +465,17 @@ module Woods
         limit = [params.fetch('limit', 5).to_i, 25].min
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = apply_columns(scope, params['columns'])
-        records = scope.order(random_function).limit(limit)
+        records = checked_relation(scope.order(random_function).limit(limit))
         { 'records' => serialize_records(records, params['columns']) }
       end
 
       def handle_find(params)
         model = resolve_model(params['model'])
+        scope = checked_relation(model)
         record = if params['id']
-                   model.find_by(id: params['id'])
+                   scope.find_by(id: params['id'])
                  elsif params['by']
-                   model.find_by(params['by'])
+                   scope.find_by(params['by'])
                  end
         { 'record' => record ? serialize_record(record, params['columns']) : nil }
       end
@@ -484,7 +487,7 @@ module Woods
         limit = [params.fetch('limit', 100).to_i, 1000].min
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = scope.distinct if params['distinct']
-        values = scope.limit(limit).pluck(*columns.map(&:to_sym))
+        values = checked_relation(scope.limit(limit)).pluck(*columns.map(&:to_sym))
         { 'columns' => Array(columns), 'values' => values }
       end
 
@@ -501,6 +504,7 @@ module Woods
         model = resolve_model(params['model'])
         scope = apply_scope(model, params['scope'], model_name: params['model'])
 
+        scope = checked_relation(scope)
         value = if function == 'count'
                   column ? scope.count(column.to_sym) : scope.count
                 else
@@ -511,7 +515,7 @@ module Woods
 
       def handle_association_count(params)
         model = resolve_model(params['model'])
-        record = model.find(params['id'])
+        record = checked_relation(model).find(params['id'])
         association_name = params['association']
 
         unless model.reflect_on_association(association_name.to_sym)
@@ -527,7 +531,26 @@ module Woods
 
         scope = record.public_send(association_name)
         scope = apply_scope(scope, params['scope'])
-        { 'count' => scope.count }
+        { 'count' => checked_relation(scope).count }
+      end
+
+      # Resolve the default scope once and execute the same checked relation.
+      # @param scope [Class, ActiveRecord::Relation] Pending model read
+      # @return [Class, ActiveRecord::Relation] Authorized relation
+      def checked_relation(scope)
+        return scope unless @table_gate
+
+        relation = scope.all
+        gate_sql!(relation.to_sql)
+        relation
+      end
+
+      def sql_dialect
+        name = active_connection.adapter_name.to_s.downcase
+        return :sqlite if name.include?('sqlite')
+        return :mysql if name.include?('mysql')
+
+        :postgres
       end
 
       def gate_association!(model_name, association)
@@ -575,7 +598,7 @@ module Woods
 
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = apply_columns(scope, params['columns'])
-        records = scope.order(order_by => direction.to_sym).limit(limit)
+        records = checked_relation(scope.order(order_by => direction.to_sym).limit(limit))
         { 'records' => serialize_records(records, params['columns']) }
       end
 
@@ -599,7 +622,7 @@ module Woods
         raise ValidationError, 'Missing required parameter: sql' unless sql
 
         require_relative 'sql_validator'
-        SqlValidator.new.validate!(sql)
+        SqlValidator.new(dialect: sql_dialect).validate!(sql)
         # Post-validation, pre-execution TableGate — blocks every configured
         # table even if the sql is otherwise well-formed.
         gate_sql!(sql)

data/lib/woods/console/sql_noise_stripper.rb

@@ -24,7 +24,7 @@ module Woods
     #   SqlNoiseStripper.strip_literals("SELECT 'it\\'s ok' FROM t", dialect: :mysql)
     #   # => "SELECT '' FROM t"
     #
-    module SqlNoiseStripper
+    module SqlNoiseStripper # rubocop:disable Metrics/ModuleLength
       # Strips SQL line comments (`-- ...`) and block comments (`/* ... */`).
       # Line comments are stripped to (but not including) the newline so that
       # newline-separated statement structure is preserved for callers that
@@ -40,7 +40,7 @@ module Woods
 
       def self.strip_comments(sql)
         out = sql.gsub(LINE_COMMENT, '')
-        out.gsub(BLOCK_COMMENT, '')
+        out.gsub(BLOCK_COMMENT, ' ')
       end
 
       # Strips single-quoted string literals and (for the `:postgres` dialect)
@@ -53,7 +53,7 @@ module Woods
       # single-quote scanner.
       #
       # @param sql [String] the SQL string to process
-      # @param dialect [Symbol] `:postgres` (default) or `:mysql`.
+      # @param dialect [Symbol] `:postgres` (default), `:mysql`, or `:sqlite`.
       #   - `:postgres` — single-quoted strings support `''` as an apostrophe
       #     escape. Backslash is treated literally and does not escape quotes.
       #     Dollar-quoted strings (`$$...$$`, `$tag$...$tag$`) are also stripped.
@@ -61,13 +61,14 @@ module Woods
       #     and `''` (doubled-quote) as apostrophe escapes. Dollar-quoted strings
       #     are also stripped (MySQL does not use them, but stripping them is
       #     harmless and keeps the two dialects consistent).
+      #   - `:sqlite` — doubled apostrophes escape strings; dollar signs stay literal.
       # @return [String] a new string with all string literals replaced by `''`
       # @raise [ArgumentError] if an unsupported dialect is provided
       DOLLAR_QUOTED = /\$(\w*)\$.*?\$\1\$/m
       SINGLE_QUOTED_POSTGRES = /'(?:''|[^'])*'/m
       SINGLE_QUOTED_MYSQL    = /'(?:\\.|''|[^'])*'/m
 
-      SUPPORTED_DIALECTS = %i[postgres mysql].freeze
+      SUPPORTED_DIALECTS = %i[postgres mysql sqlite].freeze
       private_constant :SUPPORTED_DIALECTS
 
       def self.strip_literals(sql, dialect: :postgres)
@@ -77,7 +78,7 @@ module Woods
 
         # Strip dollar-quoted strings first so stray apostrophes inside them
         # do not interfere with the single-quote scanner.
-        out = sql.gsub(DOLLAR_QUOTED, "''")
+        out = dialect == :sqlite ? sql : sql.gsub(DOLLAR_QUOTED, "''")
 
         pattern = dialect == :mysql ? SINGLE_QUOTED_MYSQL : SINGLE_QUOTED_POSTGRES
         out.gsub(pattern, "''")
@@ -98,7 +99,7 @@ module Woods
       # character rather than swallowing the rest of the statement.
       #
       # @param sql [String] the SQL string to process
-      # @param dialect [Symbol] `:postgres` (default) or `:mysql` — controls
+      # @param dialect [Symbol] `:postgres` (default), `:mysql`, or `:sqlite` — controls
       #   single-quote escape rules (see {.strip_literals}).
       # @return [String] a new string with comments removed and every string
       #   literal replaced by `''`
@@ -126,7 +127,16 @@ module Woods
               out << ch
               i += 1
             end
-          elsif ch == '$' && (tag = dollar_tag_at(sql, i))
+          elsif ['"', '`'].include?(ch)
+            close = quoted_identifier_end(sql, i, ch)
+            if close
+              out << sql[i...close]
+              i = close
+            else
+              out << ch
+              i += 1
+            end
+          elsif dialect != :sqlite && ch == '$' && (tag = dollar_tag_at(sql, i))
             close = sql.index(tag, i + tag.length)
             if close
               out << "''"
@@ -141,6 +151,7 @@ module Woods
           elsif ch == '/' && sql[i + 1] == '*'
             close = sql.index('*/', i + 2)
             if close
+              out << ' '
               i = close + 2
             else
               # Unterminated block comment: never under-detect. Leave it in
@@ -158,6 +169,23 @@ module Woods
         out
       end
 
+      # Preserve quoted identifiers while shielding their comment markers.
+      # @api private
+      def self.quoted_identifier_end(sql, start, quote)
+        i = start + 1
+        while i < sql.length
+          if sql[i] == quote
+            return i + 1 unless sql[i + 1] == quote
+
+            i += 2
+          else
+            i += 1
+          end
+        end
+        nil
+      end
+      private_class_method :quoted_identifier_end
+
       # Regexp matching a PostgreSQL dollar-quote opening tag (`$$` or
       # `$tag$`) at the start of the given slice.
       DOLLAR_TAG = /\A\$\w*\$/

data/lib/woods/console/sql_table_scanner.rb

@@ -120,11 +120,11 @@ module Woods
       #
       # @param sql [String, nil] the SQL string to scan
       # @return [Array<String>] identifiers in first-encounter order, deduplicated
-      def self.identifiers_in(sql)
+      def self.identifiers_in(sql, dialect: nil)
         return [] if sql.nil? || sql.empty?
 
         results = []
-        %i[postgres mysql].each do |dialect|
+        (dialect ? [dialect] : %i[postgres mysql]).each do |dialect|
           stripped = strip_noise(sql, dialect: dialect)
           collect_join_identifiers(stripped, results)
           collect_from_identifiers(stripped, results)
@@ -132,6 +132,49 @@ module Woods
         results.uniq
       end
 
+      # Table-factor prefixes, retaining commas after balanced subqueries and
+      # JOIN predicates. Each nested FROM/JOIN is also scanned independently.
+      # @param sql [String] noise-stripped SQL
+      # @return [Array<String>]
+      def self.relation_factors(sql)
+        sql.to_enum(:scan, /\b(?:FROM|JOIN)\s+/i).flat_map do
+          suffix = sql[Regexp.last_match.end(0)..]
+          split_top_level_commas(relation_clause(suffix))
+        end
+      end
+
+      # Quoted tokens shield punctuation and clause words; a closing parenthesis
+      # at depth zero ends this query's clause, not a nested table expression.
+      def self.relation_clause(suffix)
+        depth = 0
+        tokens = /
+          "(?:[^"]|"")*"|`(?:[^`]|``)*`|''|[()]|
+          \b(?:WHERE|GROUP|HAVING|ORDER|LIMIT|OFFSET|UNION|INTERSECT|EXCEPT|WINDOW)\b
+        /ix
+        suffix.to_enum(:scan, tokens).each do
+          token = Regexp.last_match[0]
+          start = Regexp.last_match.begin(0)
+          finish = Regexp.last_match.end(0)
+          boundary = token == ')' || relation_keyword_boundary?(suffix[0...start], suffix[finish..], token)
+          return suffix[0...start] if depth.zero? && boundary
+
+          depth += 1 if token == '('
+          depth -= 1 if token == ')'
+        end
+        suffix
+      end
+      private_class_method :relation_clause
+
+      def self.relation_keyword_boundary?(prefix, rest, token)
+        return false unless token.match?(/\A[A-Za-z]/)
+        return false if prefix.strip.empty? || prefix.match?(/(?:,|\bAS)\s*\z/i) || rest.lstrip.start_with?(',')
+        return rest.match?(/\A\s+BY\b/i) if %w[GROUP ORDER].include?(token.upcase)
+        return rest.match?(/\A\s+\w+\s+AS\b/i) if token.casecmp?('WINDOW')
+
+        true
+      end
+      private_class_method :relation_keyword_boundary?
+
       # @api private
       # Comments and literals must be stripped in a single combined pass —
       # stripping them separately lets a comment marker inside a literal
@@ -153,12 +196,9 @@ module Woods
 
       # @api private
       def self.collect_from_identifiers(sql, results)
-        sql.scan(FROM_CLAUSE) do
-          clause = Regexp.last_match[:clause]
-          split_top_level_commas(clause).each do |chunk|
-            ident = lead_identifier(chunk)
-            results << ident if ident
-          end
+        relation_factors(sql).each do |chunk|
+          ident = lead_identifier(chunk)
+          results << ident if ident
         end
       end
       private_class_method :collect_from_identifiers
@@ -169,7 +209,7 @@ module Woods
         depth = 0
         buf = +''
         parts = []
-        clause.each_char do |ch|
+        clause.scan(/"(?:[^"]|"")*"|`(?:[^`]|``)*`|''|./m).each do |ch|
           case ch
           when '('
             depth += 1

data/lib/woods/console/sql_validator.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'woods/console/sql_noise_stripper'
+require 'woods/console/sqlite_read_guard'
 
 # @see Woods
 module Woods
@@ -95,17 +96,17 @@ module Woods
         [kw, /\b#{kw}\b/i]
       end.freeze
 
-      # Frozen map of dangerous function name => regex matching a call to that function.
-      # Used by {#check_dangerous_functions!}.
-      DANGEROUS_FUNCTION_REGEXES = DANGEROUS_FUNCTIONS.to_h do |func|
-        [func, /\b#{func}\s*\(/i]
-      end.freeze
+      # @param dialect [Symbol, nil] Known connection dialect, when available
+      def initialize(dialect: nil)
+        @dialect = dialect
+      end
 
       # @raise [SqlValidationError] if the SQL is not a safe read-only statement
       def validate!(sql)
         raise SqlValidationError, 'SQL is empty' if sql.nil? || sql.strip.empty?
 
         normalized = sql.strip
+        SqliteReadGuard.validate!(normalized) if @dialect == :sqlite
 
         # Reject multiple statements (semicolons not inside string literals)
         if contains_multiple_statements?(normalized)
@@ -152,7 +153,7 @@ module Woods
       # @param sql [String]
       # @return [Boolean]
       def contains_multiple_statements?(sql)
-        stripped = SqlNoiseStripper.strip_noise(sql)
+        stripped = SqlNoiseStripper.strip_noise(sql, dialect: @dialect || :postgres)
         stripped.include?(';')
       end
 
@@ -191,8 +192,12 @@ module Woods
       # @param sql [String]
       # @raise [SqlValidationError] if a dangerous function is found
       def check_dangerous_functions!(sql)
-        DANGEROUS_FUNCTION_REGEXES.each do |func, pattern|
-          raise SqlValidationError, "Rejected: dangerous function #{func} is not allowed" if sql.match?(pattern)
+        view = SqlNoiseStripper.strip_noise(sql, dialect: @dialect || :postgres)
+        view.scan(/(?:"([^"\n]+)"|`([^`]+)`|\b([a-z_][a-z0-9_]*))\s*\(/i) do |quoted, backtick, bare|
+          func = (quoted || backtick || bare).downcase
+          next unless DANGEROUS_FUNCTIONS.include?(func)
+
+          raise SqlValidationError, "Rejected: dangerous function #{func} is not allowed"
         end
       end
 

data/lib/woods/console/sqlite_read_guard.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'woods/console/sql_noise_stripper'
+require 'woods/console/sql_table_scanner'
+
+module Woods
+  module Console
+    # Refuse SQLite-specific syntax outside the scanner's supported grammar.
+    # This is a conservative read boundary, not a general-purpose SQL parser.
+    module SqliteReadGuard
+      SIMPLE_IDENTIFIER = /\A[A-Za-z_][A-Za-z0-9_]*\z/
+      UNSUPPORTED_SYNTAX = /\b(?:FROM|JOIN)(?=['"`(])/i
+      QUOTED_IDENTIFIER = /"(?:[^"]|"")*"|`(?:[^`]|``)*`/
+
+      # @param sql [String] SQL to execute on SQLite
+      # @raise [SqlValidationError] when an identifier or table factor cannot be checked
+      # @return [void]
+      def self.validate!(sql)
+        view = SqlNoiseStripper.strip_noise(sql, dialect: :sqlite)
+        refuse! if view.match?(UNSUPPORTED_SYNTAX)
+        SqlTableScanner.relation_factors(view).each do |factor|
+          factor.scan(QUOTED_IDENTIFIER) { |quoted| refuse! unless quoted[1...-1].match?(SIMPLE_IDENTIFIER) }
+          refuse! unless supported_factor?(factor.strip)
+        end
+      end
+
+      # A SELECT/WITH subquery has its own independently scanned table factors.
+      # Parenthesized table groups and string-quoted names are refused rather
+      # than silently omitted from the blocked-table scan.
+      def self.supported_factor?(factor)
+        return true if factor.match?(/\A\(\s*(?:SELECT|WITH)\b/i)
+
+        match = SqlTableScanner::LEAD_IDENT.match(factor)
+        match && factor[match.end(0)..].match?(/\A(?:\s|,|\)|\z)/)
+      end
+      private_class_method :supported_factor?
+
+      def self.refuse!
+        raise SqlValidationError,
+              'Rejected: unsupported SQLite identifier or table-reference syntax. ' \
+              'Use simple bare or double-quoted identifiers and SELECT subqueries.'
+      end
+      private_class_method :refuse!
+    end
+  end
+end

data/lib/woods/console/table_gate.rb

@@ -32,10 +32,10 @@ module Woods
 
       def active? = !(@blocked_bare.empty? && @blocked_qualified.empty?)
 
-      def check_sql!(sql)
+      def check_sql!(sql, dialect: nil)
         return unless active? && sql&.length&.positive?
 
-        SqlTableScanner.identifiers_in(sql).each do |raw|
+        SqlTableScanner.identifiers_in(sql, dialect: dialect).each do |raw|
           raise TableGateError, reject_message(raw) if blocked?(raw)
         end
       end

data/lib/woods/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Woods
-  VERSION = '1.6.2'
+  VERSION = '1.6.3'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: woods
 version: !ruby/object:Gem::Version
-  version: 1.6.2
+  version: 1.6.3
 platform: ruby
 authors:
 - Leah Armstrong
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-18 00:00:00.000000000 Z
+date: 2026-09-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mcp
@@ -180,6 +180,7 @@ files:
 - lib/woods/console/sql_noise_stripper.rb
 - lib/woods/console/sql_table_scanner.rb
 - lib/woods/console/sql_validator.rb
+- lib/woods/console/sqlite_read_guard.rb
 - lib/woods/console/table_gate.rb
 - lib/woods/console/tool_specs.rb
 - lib/woods/console/tools/tier1.rb
@@ -359,10 +360,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/lost-in-the/woods
-  source_code_uri: https://github.com/lost-in-the/woods/tree/v1.6.2
-  changelog_uri: https://github.com/lost-in-the/woods/blob/v1.6.2/CHANGELOG.md
+  source_code_uri: https://github.com/lost-in-the/woods/tree/v1.6.3
+  changelog_uri: https://github.com/lost-in-the/woods/blob/v1.6.3/CHANGELOG.md
   bug_tracker_uri: https://github.com/lost-in-the/woods/issues
-  documentation_uri: https://github.com/lost-in-the/woods/tree/v1.6.2/docs
+  documentation_uri: https://github.com/lost-in-the/woods/tree/v1.6.3/docs
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []