woods 1.6.2 → 1.6.4

data/lib/woods/console/embedded_executor.rb

@@ -8,9 +8,13 @@ require_relative 'confirmation'
 require_relative 'eval_guard'
 require_relative 'model_validator'
 require_relative 'safe_context'
+require_relative 'redactor'
 require_relative 'scope_predicate_parser'
 require_relative 'sql_noise_stripper'
+require_relative 'sql_validator'
 require_relative 'table_gate'
+require_relative 'adapter_family'
+require_relative 'sql_output_policy'
 
 module Woods
   module Console
@@ -28,6 +32,8 @@ module Woods
     #   # => { 'ok' => true, 'result' => { 'count' => 42 }, 'timing_ms' => 1.2 }
     #
     class EmbeddedExecutor # rubocop:disable Metrics/ClassLength
+      include SqlOutputPolicy
+
       AGGREGATE_FUNCTIONS = %w[sum average minimum maximum count].freeze
 
       TIER1_TOOLS = BridgeProtocol::TIER1_TOOLS
@@ -46,6 +52,7 @@ module Woods
 
       # @param model_validator [ModelValidator] Validates model/column names
       # @param safe_context [SafeContext] Wraps execution in rolled-back transaction
+      # @param redaction_context [SafeContext, nil] Output policy supplied by the server renderer
       # @param connection [Object, nil] Database connection for adapter detection
       # @param read_tools_enabled [Boolean] Enable sql/query tools in embedded mode (default: false)
       # @param table_gate [TableGate, nil] Enforces console_blocked_tables on every
@@ -68,9 +75,10 @@ module Woods
       #   refusal as before.
       def initialize(model_validator:, safe_context:, connection: nil, read_tools_enabled: false, # rubocop:disable Metrics/ParameterLists
                      table_gate: nil, eval_guard: nil, confirmation: nil, audit_logger: nil,
-                     unsafe_eval_enabled: false)
+                     unsafe_eval_enabled: false, redaction_context: nil)
         @model_validator = model_validator
         @safe_context = safe_context
+        @redaction_context = redaction_context || safe_context
         @connection = connection
         @read_tools_enabled = read_tools_enabled
         @table_gate = table_gate
@@ -98,7 +106,7 @@ module Woods
         return refusal if refusal
 
         start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        result = @safe_context.execute { dispatch(tool, params) }
+        result = @safe_context.execute { dispatch_with_key_redaction(tool, params) }
         elapsed = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time) * 1000).round(1)
 
         { 'ok' => true, 'result' => result, 'timing_ms' => elapsed }
@@ -118,6 +126,60 @@ module Woods
 
       private
 
+      def dispatch_with_key_redaction(tool, params)
+        refuse_protected_scope!(params['scope'])
+        refuse_protected_scope!(params['by']) if tool == 'find'
+        output = dispatch(tool, params)
+        return output if redaction_key_values.empty?
+
+        Redactor.apply(output, typed_redaction_context(tool, params))
+      end
+
+      def typed_redaction_context(tool, params)
+        types = Hash.new { |hash, key| hash[key] = [] }
+        typed_redaction_models(tool, params).each do |name, model|
+          redaction_key_values.each do |pattern|
+            key = pattern['key_column']
+            types[key] << model.type_for_attribute(key) if @model_validator.columns_for(name).include?(key)
+          end
+        end
+        @redaction_context.with_key_value_types(types, raw: %w[sql query].include?(tool))
+      end
+
+      def typed_redaction_models(tool, params)
+        tables = if tool == 'sql'
+                   SqlTableScanner.identifiers_in(params['sql'], dialect: sql_dialect, mysql_modes: mysql_quote_modes)
+                 else
+                   selected_source_tables(params)
+                 end
+        @model_validator.model_names.filter_map do |name|
+          model = resolve_model(name)
+          next unless model.respond_to?(:type_for_attribute)
+          next unless typed_model_source?(model, name, params, tables)
+
+          [name, model]
+        rescue NameError
+          # Injectable registries can describe models without loading Rails.
+          next
+        end
+      end
+
+      def typed_model_source?(model, name, params, tables)
+        return true if name == params['model']
+        return false unless model.respond_to?(:table_name)
+
+        # Match the scanner's unquoted final segment, as the identifier gates
+        # do. Keep all matching models across schemas: every possible type
+        # contributes to masking rather than selecting one ambiguous source.
+        tables.any? { |table| table.split('.').last.casecmp?(model.table_name.split('.').last) }
+      end
+
+      def selected_source_tables(params)
+        Array(params['select'] || params['columns']).filter_map do |column|
+          column.split('.')[0...-1].join('.') if column.include?('.')
+        end
+      end
+
       def sanitize_execution_error(error)
         klass = error.class.name
         # Well-known AR wrappers that contain the adapter error as their cause —
@@ -425,8 +487,9 @@ module Woods
         return unless @table_gate
 
         begin
-          @table_gate.check_sql!(sql)
-        rescue TableGateError => e
+          SqliteReadGuard.validate!(sql) if sql_dialect == :sqlite
+          @table_gate.check_sql!(sql, dialect: sql_dialect)
+        rescue TableGateError, SqlValidationError => e
           raise ValidationError, e.message
         end
       end
@@ -454,7 +517,7 @@ module Woods
       def handle_count(params)
         model = resolve_model(params['model'])
         scope = apply_scope(model, params['scope'], model_name: params['model'])
-        { 'count' => scope.count }
+        { 'count' => checked_relation(scope).count }
       end
 
       def handle_sample(params)
@@ -463,28 +526,30 @@ module Woods
         limit = [params.fetch('limit', 5).to_i, 25].min
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = apply_columns(scope, params['columns'])
-        records = scope.order(random_function).limit(limit)
+        records = checked_relation(scope.order(random_function).limit(limit))
         { 'records' => serialize_records(records, params['columns']) }
       end
 
       def handle_find(params)
+        validate_select_columns!(params)
         model = resolve_model(params['model'])
+        scope = checked_relation(model)
         record = if params['id']
-                   model.find_by(id: params['id'])
+                   scope.find_by(id: params['id'])
                  elsif params['by']
-                   model.find_by(params['by'])
+                   scope.find_by(params['by'])
                  end
         { 'record' => record ? serialize_record(record, params['columns']) : nil }
       end
 
       def handle_pluck(params)
         columns = params['columns']
-        @model_validator.validate_columns!(params['model'], columns) if columns
+        validate_select_columns!(params)
         model = resolve_model(params['model'])
         limit = [params.fetch('limit', 100).to_i, 1000].min
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = scope.distinct if params['distinct']
-        values = scope.limit(limit).pluck(*columns.map(&:to_sym))
+        values = checked_relation(scope.limit(limit)).pluck(*columns.map(&:to_sym))
         { 'columns' => Array(columns), 'values' => values }
       end
 
@@ -492,6 +557,7 @@ module Woods
         column = params['column']
         function = params['function']
         @model_validator.validate_column!(params['model'], column) if column
+        refuse_redacted_aggregate_expression!(column)
 
         unless AGGREGATE_FUNCTIONS.include?(function)
           raise ValidationError, "Invalid aggregate function: #{function}. " \
@@ -501,6 +567,7 @@ module Woods
         model = resolve_model(params['model'])
         scope = apply_scope(model, params['scope'], model_name: params['model'])
 
+        scope = checked_relation(scope)
         value = if function == 'count'
                   column ? scope.count(column.to_sym) : scope.count
                 else
@@ -511,7 +578,7 @@ module Woods
 
       def handle_association_count(params)
         model = resolve_model(params['model'])
-        record = model.find(params['id'])
+        record = checked_relation(model).find(params['id'])
         association_name = params['association']
 
         unless model.reflect_on_association(association_name.to_sym)
@@ -527,7 +594,22 @@ module Woods
 
         scope = record.public_send(association_name)
         scope = apply_scope(scope, params['scope'])
-        { 'count' => scope.count }
+        { 'count' => checked_relation(scope).count }
+      end
+
+      # Resolve the default scope once and execute the same checked relation.
+      # @param scope [Class, ActiveRecord::Relation] Pending model read
+      # @return [Class, ActiveRecord::Relation] Authorized relation
+      def checked_relation(scope)
+        return scope unless @table_gate
+
+        relation = scope.all
+        gate_sql!(relation.to_sql)
+        relation
+      end
+
+      def sql_dialect
+        AdapterFamily.for(active_connection)
       end
 
       def gate_association!(model_name, association)
@@ -571,11 +653,12 @@ module Woods
         limit = [params.fetch('limit', 10).to_i, 50].min
 
         @model_validator.validate_column!(params['model'], order_by)
+        refuse_protected_predicate_column!(order_by)
         direction = 'desc' unless %w[asc desc].include?(direction)
 
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = apply_columns(scope, params['columns'])
-        records = scope.order(order_by => direction.to_sym).limit(limit)
+        records = checked_relation(scope.order(order_by => direction.to_sym).limit(limit))
         { 'records' => serialize_records(records, params['columns']) }
       end
 
@@ -598,21 +681,33 @@ module Woods
         sql = params['sql']
         raise ValidationError, 'Missing required parameter: sql' unless sql
 
+        raise ValidationError, 'Rejected: console_sql requires a recognized database adapter family.' unless sql_dialect
+
         require_relative 'sql_validator'
-        SqlValidator.new.validate!(sql)
-        # Post-validation, pre-execution TableGate — blocks every configured
-        # table even if the sql is otherwise well-formed.
-        gate_sql!(sql)
+        validate_sql_policy!(sql)
 
         limit = params['limit'] ? [params['limit'].to_i, MAX_SQL_LIMIT].min : nil
-        query_sql = limit ? "SELECT * FROM (#{sql}) AS _limited LIMIT #{limit}" : sql
+        query_sql = limit ? "SELECT * FROM (\n#{sql}\n) AS _limited LIMIT #{limit}" : sql
+        validate_sql_policy!(query_sql) if limit
         result = active_connection.select_all(query_sql)
+        validate_sql_result_types!(result)
 
         { 'columns' => result.columns, 'rows' => result.rows, 'count' => result.rows.size }
       rescue SqlValidationError => e
         raise ValidationError, e.message
       end
 
+      def validate_sql_policy!(sql)
+        # Alias-list identity is its own policy, even when an alias also
+        # looks like a function name to the SQL validator.
+        sql_security_views(sql).each { |stripped| refuse_sql_column_alias_lists!(stripped) }
+        SqlValidator.new(dialect: sql_dialect, mysql_modes: mysql_quote_modes).validate!(sql)
+        validate_protected_sql_usage!(sql)
+        # Check both submitted and wrapped SQL against blocked tables before
+        # the exact final statement reaches the adapter.
+        gate_sql!(sql)
+      end
+
       # Build and execute a structured ActiveRecord query.
       #
       # @param params [Hash] Must contain 'model' and 'select'
@@ -672,7 +767,9 @@ module Woods
         model_name = params['model']
         relation = model.all
 
-        relation = relation.select(*validated_select(params['select'], model_name)) if params['select']
+        # Keep execution and typed source inference on the same validated projection.
+        params['select'] = validated_select(params['select'], model_name) if params['select']
+        relation = relation.select(*params['select']) if params['select']
         relation = relation.joins(params['joins'].map(&:to_sym)) if params['joins']&.any?
         relation = apply_scope(relation, params['scope'], model_name: model_name)
         relation = relation.group(*validated_columns(params['group_by'], model_name)) if params['group_by']&.any?
@@ -689,18 +786,18 @@ module Woods
       # @param model_name [String]
       # @return [Array<String>]
       def validated_select(select, model_name)
-        Array(select).flat_map { |s| s.to_s.split(',') }.map do |expr|
+        expressions = Array(select).flat_map { |s| s.to_s.split(',') }.map do |expr|
           validate_select_expression!(expr.strip, model_name)
         end
+        refuse_orphan_eav_value_selection!(expressions, model_name)
+        expressions
       end
 
       def validate_select_expression!(expr, model_name)
         match = SAFE_SELECT_EXPR.match(expr)
         raise ValidationError, "Rejected select expression: #{expr.inspect}" unless match
 
-        _fn, fn_arg, bare_col, _alias = match.captures
-        column = bare_col || fn_arg
-        validate_column_reference!(column, model_name) unless column == '*'
+        refuse_redacted_select_shapes!(match.captures, model_name)
         expr
       end
 
@@ -713,6 +810,7 @@ module Woods
         Array(columns).flat_map { |c| c.to_s.split(',') }.map do |col|
           col = col.strip
           validate_column_reference!(col, model_name)
+          refuse_protected_predicate_column!(col)
           col
         end
       end
@@ -737,12 +835,12 @@ module Woods
       /ix
       private_constant :HAVING_AGG_TEMPLATE
 
-      def validated_having(having, model_name) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      def validated_having(having, model_name)
         case having
         when Hash
           raise ValidationError, 'having: empty hash' if having.empty?
 
-          having.each_key { |k| validate_column_reference!(k.to_s, model_name) }
+          having.each_key { |key| validate_predicate_column_reference!(key.to_s, model_name) }
           [having]
         when Array
           raise ValidationError, 'having: array must be [sql_with_placeholders, *binds]' if having.empty?
@@ -753,8 +851,7 @@ module Woods
 
           # Validate any referenced columns through ModelValidator so
           # aggregate args can't reach the db without a column check.
-          col = match[:col] || match[:arg]
-          validate_column_reference!(col, model_name) if col && col != '*'
+          validate_having_input!(match, model_name)
 
           having
         else
@@ -762,11 +859,22 @@ module Woods
         end
       end
 
+      def validate_having_input!(match, model_name)
+        column = match[:col] || match[:arg]
+        validate_predicate_column_reference!(column, model_name) if column && column != '*'
+        refuse_redacted_aggregate_expression!(column) if match[:agg]
+      end
+
+      def validate_predicate_column_reference!(column, model_name)
+        validate_column_reference!(column, model_name)
+        refuse_protected_predicate_column!(column)
+      end
+
       # Validate `order:` — only Hash `{col => :asc|:desc}` or bare column name.
       def validated_order(order, model_name)
         case order
         when Hash
-          order.each_key { |k| validate_column_reference!(k.to_s, model_name) }
+          order.each_key { |key| validate_predicate_column_reference!(key.to_s, model_name) }
           order.transform_values do |dir|
             dir_sym = dir.to_s.downcase.to_sym
             unless %i[asc desc].include?(dir_sym)
@@ -777,7 +885,7 @@ module Woods
           end
         when String, Symbol
           col = order.to_s.strip
-          validate_column_reference!(col, model_name)
+          validate_predicate_column_reference!(col, model_name)
           col
         else
           raise ValidationError, "order: unsupported type #{order.class}"
@@ -944,6 +1052,7 @@ module Woods
         return unless params['columns']
 
         @model_validator.validate_columns!(params['model'], params['columns'])
+        refuse_orphan_eav_value_selection!(params['columns'], params['model'])
       end
 
       # Apply column selection to a relation.
@@ -983,8 +1092,7 @@ module Woods
       #
       # @return [Arel::Nodes::SqlLiteral]
       def random_function
-        adapter = active_connection.adapter_name.downcase
-        func = adapter.include?('mysql') ? 'RAND' : 'RANDOM'
+        func = AdapterFamily.for(active_connection) == :mysql ? 'RAND' : 'RANDOM'
         Arel.sql("#{func}()")
       end
 

data/lib/woods/console/model_validator.rb

@@ -20,8 +20,10 @@ module Woods
     #
     class ModelValidator
       # @param registry [Hash<String, Array<String>>] Model name => column names mapping
-      def initialize(registry:)
+      # @param table_names [Hash<String, String>] Optional table mapping for EAV provenance
+      def initialize(registry:, table_names: {})
         @registry = registry
+        @model_by_table = table_names.each_with_object({}) { |(model, table), acc| acc[table.to_s] = model }
       end
 
       # Validate that a model name is known.
@@ -59,6 +61,14 @@ module Woods
         column_names.each { |col| validate_column!(model_name, col) }
       end
 
+      # Return known table columns without guessing an unknown table's shape.
+      # @param table_name [String]
+      # @return [Array<String>, nil] nil when this table is not registered
+      def columns_for_table(table_name)
+        model = @model_by_table[table_name.to_s]
+        @registry[model] if model
+      end
+
       # List all known model names.
       #
       # @return [Array<String>]

data/lib/woods/console/rack_middleware.rb

@@ -3,6 +3,9 @@
 require 'json'
 require 'woods/mcp/http_transport_options'
 require 'woods/observability/structured_logger'
+require 'woods/mcp/bearer_auth'
+require 'woods/mcp/origin_guard'
+require 'rack/request'
 
 module Woods
   module Console
@@ -66,7 +69,7 @@ module Woods
     # If your threat model requires stricter isolation, use the bridge mode instead
     # (docs/CONSOLE_MCP_SETUP.md) which runs the executor in a separate process.
     #
-    class RackMiddleware
+    class RackMiddleware # rubocop:disable Metrics/ClassLength -- mount-local authentication precedes legacy construction
       # @param app [#call] The next Rack app in the middleware stack
       # @param path [String] URL path to mount the MCP endpoint (default: '/mcp/console')
       # @param embedded_read_tools [Boolean] Enable sql/query tools in embedded mode (default: false)
@@ -77,8 +80,14 @@ module Woods
       # @param unsafe_eval_audit_log_path [String, Pathname, nil] JSONL audit log
       #   path for every `console_eval` run. Required on the opt-in path. Takes
       #   precedence over `config.console_unsafe_eval_audit_log_path`.
-      def initialize(app, path: '/mcp/console', embedded_read_tools: false,
-                     unsafe_eval_confirmation: nil, unsafe_eval_audit_log_path: nil)
+      def initialize(app, options = {}, **keywords)
+        raise TypeError, 'middleware options must be a Hash' unless options.is_a?(Hash)
+
+        initialize_options(app, **options, **keywords)
+      end
+
+      def initialize_options(app, path: '/mcp/console', embedded_read_tools: false, origin_policy: nil, # rubocop:disable Metrics/ParameterLists -- preserves legacy eval options alongside the shared HTTP policy
+                             unsafe_eval_confirmation: nil, unsafe_eval_audit_log_path: nil)
         @app = app
         @path = path
         @embedded_read_tools = embedded_read_tools
@@ -86,7 +95,15 @@ module Woods
         @unsafe_eval_audit_log_path = unsafe_eval_audit_log_path
         @mutex = Mutex.new
         @transport = nil
+        @origin_policy = origin_policy || Woods::MCP::OriginPolicy.new(
+          allowed_origins: Woods.configuration&.console_mcp_allowed_origins
+        )
+        authenticated = Woods::MCP::BearerAuth.new(
+          method(:handle_request), token: -> { Woods.configuration.console_mcp_token }
+        )
+        @guarded_request = Woods::MCP::OriginGuard.new(authenticated, policy: @origin_policy)
       end
+      private :initialize_options
 
       DISABLED_BODY = JSON.generate(
         error: 'woods_console_disabled',
@@ -108,11 +125,15 @@ module Woods
         return @app.call(env) unless env['PATH_INFO'].start_with?(@path)
         return [410, { 'content-type' => 'application/json' }, [DISABLED_BODY]] unless enabled?
 
-        ensure_transport.handle_request(Rack::Request.new(env))
+        @guarded_request.call(env)
       end
 
       private
 
+      def handle_request(env)
+        ensure_transport.handle_request(Rack::Request.new(env))
+      end
+
       def enabled?
         Woods.configuration.console_mcp_enabled
       end
@@ -133,7 +154,7 @@ module Woods
 
           server = build_embedded_server
           @transport = ::MCP::Server::Transports::StreamableHTTPTransport.new(
-            server, **Woods::MCP::HttpTransportOptions.for(Woods.configuration.console_mcp_allowed_origins)
+            server, **@origin_policy.transport_options
           )
           server.transport = @transport
           @transport
@@ -179,7 +200,7 @@ module Woods
         config = Woods.configuration
         introspection = build_model_introspection
         Server.build_embedded(
-          model_validator: ModelValidator.new(registry: introspection[:registry]),
+          model_validator: ModelValidator.new(registry: introspection[:registry], table_names: introspection[:tables]),
           safe_context: SafeContext.new(pool: ActiveRecord::Base.connection_pool),
           redacted_columns: Array(config&.console_redacted_columns),
           redacted_key_values: Array(config&.console_redacted_key_values),

data/lib/woods/console/redactor.rb

@@ -65,7 +65,8 @@ module Woods
         case key
         when 'record'         then value.is_a?(Hash) ? ctx.redact(value) : value
         when 'records'        then redact_hash_array(value, ctx)
-        when 'rows', 'values' then redact_positional(value, plan)
+        when 'rows'           then redact_positional(value, plan)
+        when 'values'         then redact_positional(value, plan, single_column: plan[:column_count] == 1)
         when 'associations'   then redact_association_map(value, ctx)
         else                       value
         end
@@ -93,7 +94,8 @@ module Woods
       # `columns` header: the column-name mask plus any EAV key-value rules
       # resolved to column indexes.
       def positional_plan(columns, ctx)
-        { mask: positional_mask(columns, ctx),
+        { column_count: columns.is_a?(Array) ? columns.length : nil,
+          mask: positional_mask(columns, ctx),
           kv_rules: positional_kv_rules(columns, ctx) }
       end
 
@@ -112,35 +114,65 @@ module Woods
       # Resolve EAV patterns against a `columns` header into concrete index
       # pairs. A rule only fires when both key_column and value_column are
       # present in the header, and costs nothing per row otherwise.
+      #
+      # A duplicated key or value header (an `AS` alias can shadow the real
+      # column — CON-1) makes index attribution ambiguous: a last-index-wins
+      # lookup would let the shadow steal the mask from the secret. The
+      # executor refuses those selects up front; here, defense-in-depth
+      # fails toward masking — every cell under a value-named header is
+      # redacted unconditionally.
       def positional_kv_rules(columns, ctx)
         return [] unless columns.is_a?(Array)
 
-        index = columns.each_with_index.to_h { |name, idx| [name.to_s, idx] }
-        ctx.redacted_key_values.filter_map do |pattern|
-          key_idx = index[pattern['key_column']]
-          val_idx = index[pattern['value_column']]
-          next unless key_idx && val_idx
+        names = columns.map(&:to_s)
+        ctx.redacted_key_values.filter_map { |pattern| positional_kv_rule(names, pattern, ctx) }
+      end
 
-          { key_idx: key_idx, val_idx: val_idx, sensitive: pattern['sensitive_keys'] }
-        end
+      # One resolved rule for one EAV pattern, or nil when the header lacks
+      # either column. Unambiguous headers get the key/value index pair;
+      # duplicated headers get the unconditional mask list.
+      def positional_kv_rule(names, pattern, ctx)
+        key_idxs = names.each_index.select { |i| names[i] == pattern['key_column'] }
+        val_idxs = names.each_index.select { |i| names[i] == pattern['value_column'] }
+        return nil if key_idxs.empty? || val_idxs.empty?
+        return { mask_idxs: val_idxs } unless key_idxs.one? && val_idxs.one?
+
+        { key_idx: key_idxs.first, val_idx: val_idxs.first,
+          key_matches: ->(value) { sensitive_key?(ctx, value, pattern) } }
+      end
+
+      def sensitive_key?(ctx, value, pattern)
+        return ctx.sensitive_key?(value, pattern) if ctx.respond_to?(:sensitive_key?)
+
+        pattern['sensitive_keys'].include?(value.to_s)
       end
 
       # Redact positional row data using a precomputed plan. Handles both
-      # nested arrays (multi-column pluck, sql/query rows) and flat scalar
-      # arrays (pluck with a single column — Rails collapses the result).
-      def redact_positional(rows, plan)
+      # nested arrays (multi-column pluck, sql/query rows) and single-column
+      # pluck values. Rails collapses the row for single-column pluck, so an
+      # Array/Hash value is still one cell and must be redacted as a whole.
+      def redact_positional(rows, plan, single_column: false)
         return rows unless rows.is_a?(Array)
         return rows if plan[:mask].nil? && plan[:kv_rules].empty?
 
         rows.map do |row|
-          row.is_a?(Array) ? redact_row(row, plan) : redact_scalar(row, plan[:mask])
+          if !single_column && row.is_a?(Array)
+            redact_row(row, plan)
+          else
+            redact_scalar(row, plan[:mask])
+          end
         end
       end
 
       def redact_row(row, plan)
         result = apply_mask(row, plan[:mask])
         plan[:kv_rules].each do |rule|
-          result[rule[:val_idx]] = '[REDACTED]' if rule[:sensitive].include?(row[rule[:key_idx]].to_s)
+          if rule[:mask_idxs]
+            # Ambiguous (duplicated) headers: mask every value-named cell.
+            rule[:mask_idxs].each { |idx| result[idx] = '[REDACTED]' }
+          elsif rule[:key_matches].call(row[rule[:key_idx]])
+            result[rule[:val_idx]] = '[REDACTED]'
+          end
         end
         result
       end