woods 1.6.2 → 1.6.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 135a4869f2fdd230990dc723a96d62f19447e51295768392d25bd0125dd4e25a
-  data.tar.gz: bdce75a6b653bd5da5f3a7f4e7c9180020235f5a232daa5e58a4d439824e9a34
+  metadata.gz: ec94754e7068662b57f3a9d9b760248189467408bfc98acd9e2485c86547d0d9
+  data.tar.gz: 4675c8abe609f22e8829611ede3be68d43e19bb25a72e791203fe6526dfa9a8f
 SHA512:
-  metadata.gz: 7dbe8d5460b1775c4f785954c88539fb29a76ad2878ee58e5e8ca11616787c87a058b9e9a774867f3cff4afe0c1b8ade137fd657f5249995d594e2ce2d7dfd8e
-  data.tar.gz: 99db15fe718972172398fcf1574b33e26e94869beeb0d90c95e7adcb6b41b4a53ad3b3c4fe34067ba01df7e485dec61e73cda5b739dda89dab665f9c6bfb3282
+  metadata.gz: '098bf6d0109762c9499908689201d3e4f3b7040621754161696ebc7582d66d2a50fee597102c5248d32d8b1091fbad255d0f4b87dad7f0d72060f56d11c0bf39'
+  data.tar.gz: acdd128027e2b0e0f882cd4af56b431151071fb947e3ba9b4f646452e650c20639d21b6b3062a66eaeb81ab1674ee8d975b8de683da36496ff17e5417f0a8813

data/CHANGELOG.md

@@ -7,6 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.6.4] - 2026-09-26
+
+### Security
+
+- Enforce configured bearer authentication and allowed origins on every enabled Console HTTP mount before constructing its transport, including manually mounted endpoints.
+- Mask protected collection-valued cells completely and redact overlapping credential matches before rewriting response text.
+- Preserve configured SQL redaction and blocked-table boundaries for supported read queries. Ambiguous protected expressions and unsupported result types refuse clearly. Apply MySQL timeout handling to compatible adapters while retaining the legacy tool API and SQL function policy.
+- Isolate retrieval-context cache entries by retriever instance and rotate only that instance's namespace on reload, preventing shared-backend and stale in-flight cache reuse.
+- Refuse unsupported PostgreSQL escaped identifiers in raw Console SQL before query execution. Ordinary quoted identifiers, literal contents, and comments retain their existing behavior.
+- Share validated Console query projections between execution and typed EAV redaction context, including whitespace normalization and legacy comma-separated selections.
+- Preserve configured Console data protections across database adapters, typed attributes, and SQL result shapes.
+- Refuse SQL relation and CTE column alias lists while output redaction is configured, with an explicit redaction-identity error before execution. Direct unaliased projections remain supported.
+- Apply typed key/value redaction consistently to case-variant and schema-qualified source table names, retaining all matching model types when source schemas are ambiguous.
+
+### Documentation
+
+- Clarify supported Console redaction, SQL projection, adapter timeout and HTTP origin behavior, including maintenance-line differences.
+
+### Fixed
+
+- Allow Console middleware construction before Woods configuration is initialized, and run each booted Console contract in its own process across the supported Rails CI matrix.
+- Report invalidly encoded HTTP origin settings with bounded startup diagnostics; preserve existing origin defaults and access checks.
+- HTTP startup diagnostics consistently name `WOODS_MCP_HTTP_ALLOWED_ORIGINS` for malformed origins, including under a POSIX (`C`) locale.
+- Point development package links for `1.6.4.alpha` at the `release/1.6.4` branch, matching the maintenance preparation flow. Prepared `1.6.4` links remain unchanged.
+
+## [1.6.3] - 2026-09-22
+
+### Build
+
+- Add the explicit, no-publish preparation cycle for the 1.6.3 security maintenance release; keep version writes task-owned and publication dependent on a reviewed trusted-main SHA pin.
+
+### Security
+
+- Apply blocked-table policy to resolved model relations and SQLite table syntax before reads, retain table boundaries across comments, and reject quoted spellings of existing denied SQL functions.
+- Scan the serialized Console response after protected-field redaction so Symbol values and custom JSON output cannot bypass credential scanning.
+
 ## [1.6.2] - 2026-09-18
 
 ### Fixed

data/CONTRIBUTING.md

@@ -128,31 +128,39 @@ By contributing, you agree that your contributions will be licensed under the MI
 
 ## Maintenance release
 
-This tree has a one-off, no-publish preparation adapter for the reviewed 1.6.2
-security patch while `main` carries the newer 2.0 prerelease line. It does not
+This tree has a one-off, no-publish preparation adapter for the reviewed 1.6.4
+security patch while `main` carries the newer 2.1 development line. It does not
 establish a permanent stable branch or authorize another maintenance version.
-The approved target is `release/1.6.2`, based on immutable `v1.6.1`. Create that
+The approved target is `release/1.6.4`, based on immutable `v1.6.3`. Create that
 remote target only after the trusted main maintenance policy is reviewed.
 
 From a clean checkout, the only supported transitions are:
 
 ```sh
-bin/rake "release:reopen[1.6.2.alpha]"
+bin/rake "release:reopen[1.6.4.alpha]"
 # Review and commit the generated development-state diff.
-bin/rake "release:prepare[1.6.2]"
+bin/rake "release:prepare[1.6.4]"
 ```
 
 The tasks never commit, tag, push, dispatch or publish. Never edit VERSION or the
-README maintenance `release-state` banner manually. The first reopen creates that
-banner; prepare updates it and folds classified Unreleased notes and optional
-`changelog/<type>_<slug>.md` entries into a dated release heading. Entry files are
+README maintenance `release-state` banner manually. The existing maintenance
+banner must be present; both tasks update it. Prepare also folds classified
+Unreleased notes and optional `changelog/<type>_<slug>.md` entries into a dated
+release heading. Entry files are
 nonempty Markdown without headings; supported types include `fixed`, `security`,
 `build`, and `documentation`. Invalid transitions, dirty trees, malformed notes,
 and missing/duplicate/unknown fences refuse before writes. This legacy profile
 has no v2 migration guide or v2 surface inventory requirement.
 
+CI also runs on pushes to the exact `release/1.6.4` branch, so a private-advisory
+merge receives upstream validation before the trusted-main SHA pin. Publication
+still requires a separate green tag-push run. This legacy matrix intentionally
+has no C-locale artifact-reader lane. Its installed maintenance-package and
+backend contracts remain required; do not claim v2 artifact-reader CI coverage
+for this branch.
+
 Validate the full suite, lint, booted extraction, real Console credential rotation,
-and installed maintenance package tests. CI builds one gem plus its SHA-256
+installed maintenance package tests, and the real PostgreSQL/MySQL Console policy lane. CI builds one gem plus its SHA-256
 sidecar into `woods-release-<commit SHA>` and tests that artifact on Ruby 3.0/Rails
 6.0 with exactly MCP 0.23.0 and Ruby 4.0/Rails 8.1 with the latest compatible 0.x SDK.
 MCP >=0.23.0 is required for upstream transport security fixes; update Woods and
@@ -165,12 +173,12 @@ ruby -rrubygems -e 'load Gem.bin_path("rspec-core", "rspec")' -- \
   --options /dev/null spec/integration/maintenance_packaged_gem_spec.rb
 ```
 
-Preparation is not publication; check RubyGems before describing 1.6.2 as released.
+Preparation is not publication; check RubyGems before describing 1.6.4 as released.
 The legacy automatic tag publisher is disabled, and Bundler's `release`,
 `release:rubygem_push`, and `release:source_control_push` tasks abort. Only a
 maintainer may later tag the reviewed merge commit and dispatch the trusted
 **main** workflow. That workflow must explicitly allow the exact tag, protected
-maintenance branch, immutable 1.6.1 base, reviewed final candidate SHA, required
+maintenance branch, immutable 1.6.3 base, reviewed final candidate SHA, required
 CI jobs, and immutable artifact. An unpinned candidate remains blocked. First merge a reviewed trusted-main profile update pinning `approved_sha` to that
 exact maintenance merge SHA; only then may the maintainer tag it. The
 workflow publishes the already tested gem bytes; never rebuild or publish locally.

data/README.md

@@ -5,7 +5,7 @@
 # Woods
 
 <!-- release-state:maintenance-banner -->
-> **Woods 1.6.2: prepared maintenance candidate.** This tree remains on the 1.6 maintenance line.
+> **Woods 1.6.4: prepared maintenance candidate.** This tree remains on the 1.6 maintenance line.
 > Preparation does not establish publication. Check [RubyGems versions](https://rubygems.org/gems/woods/versions)
 > before selecting an install version. See [maintenance release policy](CONTRIBUTING.md#maintenance-release).
 <!-- release-state:end -->

data/exe/woods-console

@@ -78,7 +78,7 @@ rescue StandardError
   next
 end
 
-validator = Woods::Console::ModelValidator.new(registry: registry)
+validator = Woods::Console::ModelValidator.new(registry: registry, table_names: model_tables)
 safe_context = Woods::Console::SafeContext.new(connection: ActiveRecord::Base.connection)
 
 config = Woods.configuration

data/exe/woods-mcp-http

@@ -33,10 +33,24 @@ require_relative '../lib/woods/embedding/text_preparer'
 require_relative '../lib/woods/embedding/indexer'
 
 begin
+  raw_origins = ENV.fetch('WOODS_MCP_HTTP_ALLOWED_ORIGINS', '')
+  unless raw_origins.valid_encoding?
+    invalid_entry = raw_origins.b.split(',').find do |entry|
+      !entry.dup.force_encoding(raw_origins.encoding).valid_encoding?
+    end
+    label = invalid_entry.to_s.b.byteslice(0, 160).inspect
+    raise Woods::ConfigurationError, "Invalid WOODS_MCP_HTTP_ALLOWED_ORIGINS entry #{label}: invalid encoding"
+  end
+  allowed_origins = raw_origins.split(',').map(&:strip).reject(&:empty?)
+  begin
+    origin_policy = Woods::MCP::OriginPolicy.new(allowed_origins: allowed_origins)
+  rescue ArgumentError => e
+    raise Woods::ConfigurationError, "#{e.message} (WOODS_MCP_HTTP_ALLOWED_ORIGINS)"
+  end
   index_dir = Woods::MCP::Bootstrapper.resolve_index_dir(ARGV)
   retriever, bootstrap_state = Woods::MCP::Bootstrapper.build_retriever(index_dir: index_dir)
   snapshot_store = Woods::MCP::Bootstrapper.build_snapshot_store(index_dir)
-rescue Woods::MCP::BootstrapError => e
+rescue Woods::MCP::BootstrapError, Woods::ConfigurationError => e
   warn "[woods-mcp-http] #{e.class.name.split('::').last}: #{e.message}"
   warn "[woods-mcp-http] details: #{e.details.inspect}" if e.respond_to?(:details) && !e.details.empty?
   exit 2
@@ -64,15 +78,14 @@ server = Woods::MCP::Server.build(
   index_dir: index_dir, retriever: retriever, snapshot_store: snapshot_store,
   bootstrap_state: bootstrap_state, retriever_reloader: retriever_reloader
 )
-allowed_origins = ENV.fetch('WOODS_MCP_HTTP_ALLOWED_ORIGINS', '').split(',').map(&:strip).reject(&:empty?)
 transport = MCP::Server::Transports::StreamableHTTPTransport.new(
-  server, **Woods::MCP::HttpTransportOptions.for(allowed_origins)
+  server, **origin_policy.transport_options
 )
 server.transport = transport
 
 inner = proc { |env| transport.handle_request(Rack::Request.new(env)) }
 app = token ? Woods::MCP::BearerAuth.new(inner, token: token) : inner
-app = Woods::MCP::OriginGuard.new(app, allowed_origins: allowed_origins)
+app = Woods::MCP::OriginGuard.new(app, policy: origin_policy)
 
 origin_summary = allowed_origins.empty? ? 'loopback' : allowed_origins.join(',')
 auth_mode = token ? 'bearer' : 'none'

data/lib/woods/cache/cache_middleware.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'digest'
+require 'securerandom'
 require_relative 'cache_store'
 
 module Woods
@@ -403,6 +404,8 @@ module Woods
         @retriever = retriever
         @cache_store = cache_store
         @context_ttl = context_ttl
+        @context_namespace = SecureRandom.hex(16)
+        @context_mutex = Mutex.new
       end
 
       # Expose the wrapped stores so the MCP +reload+ tool and
@@ -414,20 +417,16 @@ module Woods
       def metadata_store = @retriever.metadata_store
       def graph_store    = @retriever.graph_store
 
-      # Invalidate every cached context result. Called from the MCP +reload+
-      # tool after the retriever's stores have been re-hydrated from a fresh
-      # embed — otherwise cached results from the old embedding run would
-      # linger until their TTL expires and contradict the new stores.
+      # Retire this retriever's cached contexts after its corpus reloads.
       #
-      # Embedding caches (query → vector) are NOT cleared: the query-vector
-      # mapping is deterministic for a given provider+model and survives any
-      # index reload. Only context results (query → ranked units) go stale.
+      # Each instance owns an unpredictable namespace. Rotation prevents an
+      # in-flight request from repopulating the active cache with old results;
+      # retired entries expire by their TTL. Other retrievers and embedding
+      # caches remain independent, without any global backend deletion.
       #
       # @return [void]
       def invalidate_context_cache!
-        @cache_store.clear(namespace: :context)
-      rescue StandardError => e
-        warn("[Woods] CachedRetriever context-cache invalidation failed: #{e.message}")
+        @context_mutex.synchronize { @context_namespace = SecureRandom.hex(16) }
       end
 
       # Execute the retrieval pipeline with context-level caching.
@@ -474,7 +473,8 @@ module Woods
       # @param exclude_types [Array<String, Symbol>, nil]
       # @return [String]
       def context_key(query, budget, types: nil, exclude_types: nil)
-        Cache.cache_key(:context, query, budget.to_s, fingerprint(types), fingerprint(exclude_types))
+        namespace = @context_mutex.synchronize { @context_namespace }
+        Cache.cache_key(:context, namespace, query, budget.to_s, fingerprint(types), fingerprint(exclude_types))
       end
 
       def fingerprint(types)

data/lib/woods/console/adapter_family.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Woods
+  module Console
+    # Adapter names differ from the SQL grammar and session settings they use.
+    module AdapterFamily
+      # Classify a live connection by adapter ancestry, database configuration,
+      # then its display name. Unknown families remain nil: SQL callers must
+      # refuse rather than silently omit dialect-specific safeguards.
+      # @param connection [Object] Active Record connection or compatible adapter
+      # @return [Symbol, nil] :postgres, :mysql, :sqlite, or unknown
+      def self.for(connection)
+        ancestry = connection.class.ancestors.filter_map(&:name)
+        return :postgres if ancestry.include?('ActiveRecord::ConnectionAdapters::PostgreSQLAdapter')
+        return :mysql if ancestry.any? { |name| name.match?(/::(?:AbstractMysql|Mysql2|Trilogy)Adapter\z/) }
+        return :sqlite if ancestry.include?('ActiveRecord::ConnectionAdapters::SQLite3Adapter')
+
+        from_name(configured_adapter(connection)) || from_name(connection.adapter_name)
+      end
+
+      def self.configured_adapter(connection)
+        return unless connection.respond_to?(:pool) && connection.pool.respond_to?(:db_config)
+
+        connection.pool.db_config.adapter
+      end
+      private_class_method :configured_adapter
+
+      def self.from_name(value)
+        name = value.to_s.downcase
+        return :mysql if name.include?('mysql') || %w[trilogy mariadb].include?(name)
+        return :postgres if name.include?('postgre') || %w[postgis cockroachdb redshift].include?(name)
+        return :sqlite if name.include?('sqlite')
+
+        nil
+      end
+      private_class_method :from_name
+    end
+  end
+end

data/lib/woods/console/credential_index.rb

@@ -46,7 +46,7 @@ module Woods
     #   index.redact("token: sk_live_actual_secret_value")
     #     # => "token: [REDACTED:credential]"
     #
-    class CredentialIndex
+    class CredentialIndex # rubocop:disable Metrics/ClassLength
       # Captured at require time so the mtime-check warning has a stable
       # reference point even if the clock skews later. Frozen immediately
       # to prevent accidental mutation.
@@ -187,7 +187,10 @@ module Woods
       def initialize(secrets:)
         filtered = Array(secrets).select { |s| s.is_a?(String) && s.length >= MIN_LENGTH }
         @secrets = filtered.to_set.freeze
-        @pattern = @secrets.empty? ? nil : Regexp.union(@secrets.to_a)
+        # Regexp alternatives match in order: a shorter prefix must not consume
+        # only the start of a longer indexed credential and expose its suffix.
+        longest_first = @secrets.each_with_index.sort_by { |secret, idx| [-secret.length, idx] }.map(&:first)
+        @pattern = @secrets.empty? ? nil : Regexp.union(longest_first)
       end
 
       # @return [Boolean] true when no secrets were collected (missing key,
@@ -212,7 +215,34 @@ module Woods
       def redact(str)
         return str if empty? || !str.is_a?(String) || !@pattern.match?(str)
 
-        str.gsub(@pattern, REDACTED)
+        offset = 0
+        parts = []
+        redaction_spans(str).each do |start, finish|
+          parts << str[offset...start] << REDACTED
+          offset = finish
+        end
+        parts << str[offset..]
+        parts.join
+      end
+
+      private
+
+      # Search from each match's start, rather than its end, so an overlapping
+      # credential cannot expose its suffix after an earlier replacement.
+      # Union the covered spans before changing the original string.
+      def redaction_spans(str)
+        spans = []
+        offset = 0
+        while (match = @pattern.match(str, offset))
+          start, finish = match.offset(0)
+          if spans.last && start < spans.last[1]
+            spans.last[1] = [spans.last[1], finish].max
+          else
+            spans << [start, finish]
+          end
+          offset = start + 1
+        end
+        spans
       end
     end
   end

data/lib/woods/console/credential_scanner.rb

@@ -145,7 +145,7 @@ module Woods
 
       # Scan a value (String, Hash, Array, or any other object) for credentials.
       #
-      # Strings are gsub'd against every active pattern. Hash values and Array
+      # Strings and Symbols are scanned against every active pattern. Hash values and Array
       # elements are walked recursively; keys and non-string scalars
       # (Integer, Float, true/false, nil) pass through untouched.
       #
@@ -164,6 +164,7 @@ module Woods
       def walk(value, counts, index)
         case value
         when String then scan_string(value, counts, index)
+        when Symbol then scan_string(value.to_s, counts, index).to_sym
         when Hash   then walk_hash(value, counts, index)
         when Array  then value.map { |item| walk(item, counts, index) }
         else value

data/lib/woods/console/dispatch_pipeline.rb

@@ -77,15 +77,33 @@ module Woods
         response = @conn_mgr.send_request(request)
         return error_from_response(response, request) unless response['ok']
 
-        result = @ctx.redact(response['result'])
-        result = scan_for_credentials(result, request)
-        text = @renderer ? @renderer.render_default(result) : JSON.pretty_generate(result)
-        success_response(text)
+        render_response(response['result'], request)
       rescue ConnectionError => e
         scanned = scan_for_credentials("Connection error: #{e.message}", request)
         error_response(scanned)
       end
 
+      def render_response(result, request)
+        # Remove protected values before custom serializers run, then scan
+        # the materialized representation consumed by both response renderers.
+        result = @ctx.redact(result)
+        result = JSON.parse(JSON.generate(result))
+        result = @ctx.redact(result)
+        result = scan_for_credentials(result, request)
+        text = @renderer ? @renderer.render_default(result) : JSON.pretty_generate(result)
+        success_response(text)
+      rescue StandardError
+        # SDK 0.x includes uncaught exception messages in its tool errors.
+        # Serializer/parser/renderer messages may contain unscanned values.
+        rendering_error_response(request)
+      end
+
+      def rendering_error_response(request)
+        error_response(scan_for_credentials('Console response could not be serialized safely.', request))
+      rescue StandardError
+        error_response('[REDACTION_FAILED]')
+      end
+
       def error_from_response(response, request)
         error_text = "#{response['error_type']}: #{response['error']}"
         error_text = scan_for_credentials(error_text, request)