woods 1.6.3 → 1.6.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b77f03a9d89a92c666a6ef9b8b20ed8583270fa0cfbb923acea9d6fbc973f9d2
-  data.tar.gz: 8336dccba436603daadaccd125888bc40702f16c4f514002bff298c9d8905f9e
+  metadata.gz: ec94754e7068662b57f3a9d9b760248189467408bfc98acd9e2485c86547d0d9
+  data.tar.gz: 4675c8abe609f22e8829611ede3be68d43e19bb25a72e791203fe6526dfa9a8f
 SHA512:
-  metadata.gz: ff12092063cd2a853c293812705b64f38c83da9a682d89bdcf243665ab810b5d5368e2d086a3a2949d885d677845637a3773b58c4322b62e56b83585f6f7e208
-  data.tar.gz: '0329bd31a7ddd6b0d05dedb46b4942a09d5534faf69668e77d45b1b9a8d37f1c3b860cc222446ddef7e64717e716d7388ef1217f3efe80578e481b875a7edba6'
+  metadata.gz: '098bf6d0109762c9499908689201d3e4f3b7040621754161696ebc7582d66d2a50fee597102c5248d32d8b1091fbad255d0f4b87dad7f0d72060f56d11c0bf39'
+  data.tar.gz: acdd128027e2b0e0f882cd4af56b431151071fb947e3ba9b4f646452e650c20639d21b6b3062a66eaeb81ab1674ee8d975b8de683da36496ff17e5417f0a8813

data/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.6.4] - 2026-09-26
+
+### Security
+
+- Enforce configured bearer authentication and allowed origins on every enabled Console HTTP mount before constructing its transport, including manually mounted endpoints.
+- Mask protected collection-valued cells completely and redact overlapping credential matches before rewriting response text.
+- Preserve configured SQL redaction and blocked-table boundaries for supported read queries. Ambiguous protected expressions and unsupported result types refuse clearly. Apply MySQL timeout handling to compatible adapters while retaining the legacy tool API and SQL function policy.
+- Isolate retrieval-context cache entries by retriever instance and rotate only that instance's namespace on reload, preventing shared-backend and stale in-flight cache reuse.
+- Refuse unsupported PostgreSQL escaped identifiers in raw Console SQL before query execution. Ordinary quoted identifiers, literal contents, and comments retain their existing behavior.
+- Share validated Console query projections between execution and typed EAV redaction context, including whitespace normalization and legacy comma-separated selections.
+- Preserve configured Console data protections across database adapters, typed attributes, and SQL result shapes.
+- Refuse SQL relation and CTE column alias lists while output redaction is configured, with an explicit redaction-identity error before execution. Direct unaliased projections remain supported.
+- Apply typed key/value redaction consistently to case-variant and schema-qualified source table names, retaining all matching model types when source schemas are ambiguous.
+
+### Documentation
+
+- Clarify supported Console redaction, SQL projection, adapter timeout and HTTP origin behavior, including maintenance-line differences.
+
+### Fixed
+
+- Allow Console middleware construction before Woods configuration is initialized, and run each booted Console contract in its own process across the supported Rails CI matrix.
+- Report invalidly encoded HTTP origin settings with bounded startup diagnostics; preserve existing origin defaults and access checks.
+- HTTP startup diagnostics consistently name `WOODS_MCP_HTTP_ALLOWED_ORIGINS` for malformed origins, including under a POSIX (`C`) locale.
+- Point development package links for `1.6.4.alpha` at the `release/1.6.4` branch, matching the maintenance preparation flow. Prepared `1.6.4` links remain unchanged.
+
 ## [1.6.3] - 2026-09-22
 
 ### Build

data/CONTRIBUTING.md

@@ -128,18 +128,18 @@ By contributing, you agree that your contributions will be licensed under the MI
 
 ## Maintenance release
 
-This tree has a one-off, no-publish preparation adapter for the reviewed 1.6.3
-security patch while `main` carries the newer 2.0 prerelease line. It does not
+This tree has a one-off, no-publish preparation adapter for the reviewed 1.6.4
+security patch while `main` carries the newer 2.1 development line. It does not
 establish a permanent stable branch or authorize another maintenance version.
-The approved target is `release/1.6.3`, based on immutable `v1.6.2`. Create that
+The approved target is `release/1.6.4`, based on immutable `v1.6.3`. Create that
 remote target only after the trusted main maintenance policy is reviewed.
 
 From a clean checkout, the only supported transitions are:
 
 ```sh
-bin/rake "release:reopen[1.6.3.alpha]"
+bin/rake "release:reopen[1.6.4.alpha]"
 # Review and commit the generated development-state diff.
-bin/rake "release:prepare[1.6.3]"
+bin/rake "release:prepare[1.6.4]"
 ```
 
 The tasks never commit, tag, push, dispatch or publish. Never edit VERSION or the
@@ -152,12 +152,15 @@ nonempty Markdown without headings; supported types include `fixed`, `security`,
 and missing/duplicate/unknown fences refuse before writes. This legacy profile
 has no v2 migration guide or v2 surface inventory requirement.
 
-CI also runs on pushes to the exact `release/1.6.3` branch, so a private-advisory
+CI also runs on pushes to the exact `release/1.6.4` branch, so a private-advisory
 merge receives upstream validation before the trusted-main SHA pin. Publication
-still requires a separate green tag-push run.
+still requires a separate green tag-push run. This legacy matrix intentionally
+has no C-locale artifact-reader lane. Its installed maintenance-package and
+backend contracts remain required; do not claim v2 artifact-reader CI coverage
+for this branch.
 
 Validate the full suite, lint, booted extraction, real Console credential rotation,
-and installed maintenance package tests. CI builds one gem plus its SHA-256
+installed maintenance package tests, and the real PostgreSQL/MySQL Console policy lane. CI builds one gem plus its SHA-256
 sidecar into `woods-release-<commit SHA>` and tests that artifact on Ruby 3.0/Rails
 6.0 with exactly MCP 0.23.0 and Ruby 4.0/Rails 8.1 with the latest compatible 0.x SDK.
 MCP >=0.23.0 is required for upstream transport security fixes; update Woods and
@@ -170,12 +173,12 @@ ruby -rrubygems -e 'load Gem.bin_path("rspec-core", "rspec")' -- \
   --options /dev/null spec/integration/maintenance_packaged_gem_spec.rb
 ```
 
-Preparation is not publication; check RubyGems before describing 1.6.3 as released.
+Preparation is not publication; check RubyGems before describing 1.6.4 as released.
 The legacy automatic tag publisher is disabled, and Bundler's `release`,
 `release:rubygem_push`, and `release:source_control_push` tasks abort. Only a
 maintainer may later tag the reviewed merge commit and dispatch the trusted
 **main** workflow. That workflow must explicitly allow the exact tag, protected
-maintenance branch, immutable 1.6.2 base, reviewed final candidate SHA, required
+maintenance branch, immutable 1.6.3 base, reviewed final candidate SHA, required
 CI jobs, and immutable artifact. An unpinned candidate remains blocked. First merge a reviewed trusted-main profile update pinning `approved_sha` to that
 exact maintenance merge SHA; only then may the maintainer tag it. The
 workflow publishes the already tested gem bytes; never rebuild or publish locally.

data/README.md

@@ -5,7 +5,7 @@
 # Woods
 
 <!-- release-state:maintenance-banner -->
-> **Woods 1.6.3: prepared maintenance candidate.** This tree remains on the 1.6 maintenance line.
+> **Woods 1.6.4: prepared maintenance candidate.** This tree remains on the 1.6 maintenance line.
 > Preparation does not establish publication. Check [RubyGems versions](https://rubygems.org/gems/woods/versions)
 > before selecting an install version. See [maintenance release policy](CONTRIBUTING.md#maintenance-release).
 <!-- release-state:end -->

data/exe/woods-console

@@ -78,7 +78,7 @@ rescue StandardError
   next
 end
 
-validator = Woods::Console::ModelValidator.new(registry: registry)
+validator = Woods::Console::ModelValidator.new(registry: registry, table_names: model_tables)
 safe_context = Woods::Console::SafeContext.new(connection: ActiveRecord::Base.connection)
 
 config = Woods.configuration

data/exe/woods-mcp-http

@@ -33,10 +33,24 @@ require_relative '../lib/woods/embedding/text_preparer'
 require_relative '../lib/woods/embedding/indexer'
 
 begin
+  raw_origins = ENV.fetch('WOODS_MCP_HTTP_ALLOWED_ORIGINS', '')
+  unless raw_origins.valid_encoding?
+    invalid_entry = raw_origins.b.split(',').find do |entry|
+      !entry.dup.force_encoding(raw_origins.encoding).valid_encoding?
+    end
+    label = invalid_entry.to_s.b.byteslice(0, 160).inspect
+    raise Woods::ConfigurationError, "Invalid WOODS_MCP_HTTP_ALLOWED_ORIGINS entry #{label}: invalid encoding"
+  end
+  allowed_origins = raw_origins.split(',').map(&:strip).reject(&:empty?)
+  begin
+    origin_policy = Woods::MCP::OriginPolicy.new(allowed_origins: allowed_origins)
+  rescue ArgumentError => e
+    raise Woods::ConfigurationError, "#{e.message} (WOODS_MCP_HTTP_ALLOWED_ORIGINS)"
+  end
   index_dir = Woods::MCP::Bootstrapper.resolve_index_dir(ARGV)
   retriever, bootstrap_state = Woods::MCP::Bootstrapper.build_retriever(index_dir: index_dir)
   snapshot_store = Woods::MCP::Bootstrapper.build_snapshot_store(index_dir)
-rescue Woods::MCP::BootstrapError => e
+rescue Woods::MCP::BootstrapError, Woods::ConfigurationError => e
   warn "[woods-mcp-http] #{e.class.name.split('::').last}: #{e.message}"
   warn "[woods-mcp-http] details: #{e.details.inspect}" if e.respond_to?(:details) && !e.details.empty?
   exit 2
@@ -64,15 +78,14 @@ server = Woods::MCP::Server.build(
   index_dir: index_dir, retriever: retriever, snapshot_store: snapshot_store,
   bootstrap_state: bootstrap_state, retriever_reloader: retriever_reloader
 )
-allowed_origins = ENV.fetch('WOODS_MCP_HTTP_ALLOWED_ORIGINS', '').split(',').map(&:strip).reject(&:empty?)
 transport = MCP::Server::Transports::StreamableHTTPTransport.new(
-  server, **Woods::MCP::HttpTransportOptions.for(allowed_origins)
+  server, **origin_policy.transport_options
 )
 server.transport = transport
 
 inner = proc { |env| transport.handle_request(Rack::Request.new(env)) }
 app = token ? Woods::MCP::BearerAuth.new(inner, token: token) : inner
-app = Woods::MCP::OriginGuard.new(app, allowed_origins: allowed_origins)
+app = Woods::MCP::OriginGuard.new(app, policy: origin_policy)
 
 origin_summary = allowed_origins.empty? ? 'loopback' : allowed_origins.join(',')
 auth_mode = token ? 'bearer' : 'none'

data/lib/woods/cache/cache_middleware.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'digest'
+require 'securerandom'
 require_relative 'cache_store'
 
 module Woods
@@ -403,6 +404,8 @@ module Woods
         @retriever = retriever
         @cache_store = cache_store
         @context_ttl = context_ttl
+        @context_namespace = SecureRandom.hex(16)
+        @context_mutex = Mutex.new
       end
 
       # Expose the wrapped stores so the MCP +reload+ tool and
@@ -414,20 +417,16 @@ module Woods
       def metadata_store = @retriever.metadata_store
       def graph_store    = @retriever.graph_store
 
-      # Invalidate every cached context result. Called from the MCP +reload+
-      # tool after the retriever's stores have been re-hydrated from a fresh
-      # embed — otherwise cached results from the old embedding run would
-      # linger until their TTL expires and contradict the new stores.
+      # Retire this retriever's cached contexts after its corpus reloads.
       #
-      # Embedding caches (query → vector) are NOT cleared: the query-vector
-      # mapping is deterministic for a given provider+model and survives any
-      # index reload. Only context results (query → ranked units) go stale.
+      # Each instance owns an unpredictable namespace. Rotation prevents an
+      # in-flight request from repopulating the active cache with old results;
+      # retired entries expire by their TTL. Other retrievers and embedding
+      # caches remain independent, without any global backend deletion.
       #
       # @return [void]
       def invalidate_context_cache!
-        @cache_store.clear(namespace: :context)
-      rescue StandardError => e
-        warn("[Woods] CachedRetriever context-cache invalidation failed: #{e.message}")
+        @context_mutex.synchronize { @context_namespace = SecureRandom.hex(16) }
       end
 
       # Execute the retrieval pipeline with context-level caching.
@@ -474,7 +473,8 @@ module Woods
       # @param exclude_types [Array<String, Symbol>, nil]
       # @return [String]
       def context_key(query, budget, types: nil, exclude_types: nil)
-        Cache.cache_key(:context, query, budget.to_s, fingerprint(types), fingerprint(exclude_types))
+        namespace = @context_mutex.synchronize { @context_namespace }
+        Cache.cache_key(:context, namespace, query, budget.to_s, fingerprint(types), fingerprint(exclude_types))
       end
 
       def fingerprint(types)

data/lib/woods/console/adapter_family.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Woods
+  module Console
+    # Adapter names differ from the SQL grammar and session settings they use.
+    module AdapterFamily
+      # Classify a live connection by adapter ancestry, database configuration,
+      # then its display name. Unknown families remain nil: SQL callers must
+      # refuse rather than silently omit dialect-specific safeguards.
+      # @param connection [Object] Active Record connection or compatible adapter
+      # @return [Symbol, nil] :postgres, :mysql, :sqlite, or unknown
+      def self.for(connection)
+        ancestry = connection.class.ancestors.filter_map(&:name)
+        return :postgres if ancestry.include?('ActiveRecord::ConnectionAdapters::PostgreSQLAdapter')
+        return :mysql if ancestry.any? { |name| name.match?(/::(?:AbstractMysql|Mysql2|Trilogy)Adapter\z/) }
+        return :sqlite if ancestry.include?('ActiveRecord::ConnectionAdapters::SQLite3Adapter')
+
+        from_name(configured_adapter(connection)) || from_name(connection.adapter_name)
+      end
+
+      def self.configured_adapter(connection)
+        return unless connection.respond_to?(:pool) && connection.pool.respond_to?(:db_config)
+
+        connection.pool.db_config.adapter
+      end
+      private_class_method :configured_adapter
+
+      def self.from_name(value)
+        name = value.to_s.downcase
+        return :mysql if name.include?('mysql') || %w[trilogy mariadb].include?(name)
+        return :postgres if name.include?('postgre') || %w[postgis cockroachdb redshift].include?(name)
+        return :sqlite if name.include?('sqlite')
+
+        nil
+      end
+      private_class_method :from_name
+    end
+  end
+end

data/lib/woods/console/credential_index.rb

@@ -46,7 +46,7 @@ module Woods
     #   index.redact("token: sk_live_actual_secret_value")
     #     # => "token: [REDACTED:credential]"
     #
-    class CredentialIndex
+    class CredentialIndex # rubocop:disable Metrics/ClassLength
       # Captured at require time so the mtime-check warning has a stable
       # reference point even if the clock skews later. Frozen immediately
       # to prevent accidental mutation.
@@ -187,7 +187,10 @@ module Woods
       def initialize(secrets:)
         filtered = Array(secrets).select { |s| s.is_a?(String) && s.length >= MIN_LENGTH }
         @secrets = filtered.to_set.freeze
-        @pattern = @secrets.empty? ? nil : Regexp.union(@secrets.to_a)
+        # Regexp alternatives match in order: a shorter prefix must not consume
+        # only the start of a longer indexed credential and expose its suffix.
+        longest_first = @secrets.each_with_index.sort_by { |secret, idx| [-secret.length, idx] }.map(&:first)
+        @pattern = @secrets.empty? ? nil : Regexp.union(longest_first)
       end
 
       # @return [Boolean] true when no secrets were collected (missing key,
@@ -212,7 +215,34 @@ module Woods
       def redact(str)
         return str if empty? || !str.is_a?(String) || !@pattern.match?(str)
 
-        str.gsub(@pattern, REDACTED)
+        offset = 0
+        parts = []
+        redaction_spans(str).each do |start, finish|
+          parts << str[offset...start] << REDACTED
+          offset = finish
+        end
+        parts << str[offset..]
+        parts.join
+      end
+
+      private
+
+      # Search from each match's start, rather than its end, so an overlapping
+      # credential cannot expose its suffix after an earlier replacement.
+      # Union the covered spans before changing the original string.
+      def redaction_spans(str)
+        spans = []
+        offset = 0
+        while (match = @pattern.match(str, offset))
+          start, finish = match.offset(0)
+          if spans.last && start < spans.last[1]
+            spans.last[1] = [spans.last[1], finish].max
+          else
+            spans << [start, finish]
+          end
+          offset = start + 1
+        end
+        spans
       end
     end
   end

data/lib/woods/console/embedded_executor.rb

@@ -8,10 +8,13 @@ require_relative 'confirmation'
 require_relative 'eval_guard'
 require_relative 'model_validator'
 require_relative 'safe_context'
+require_relative 'redactor'
 require_relative 'scope_predicate_parser'
 require_relative 'sql_noise_stripper'
 require_relative 'sql_validator'
 require_relative 'table_gate'
+require_relative 'adapter_family'
+require_relative 'sql_output_policy'
 
 module Woods
   module Console
@@ -29,6 +32,8 @@ module Woods
     #   # => { 'ok' => true, 'result' => { 'count' => 42 }, 'timing_ms' => 1.2 }
     #
     class EmbeddedExecutor # rubocop:disable Metrics/ClassLength
+      include SqlOutputPolicy
+
       AGGREGATE_FUNCTIONS = %w[sum average minimum maximum count].freeze
 
       TIER1_TOOLS = BridgeProtocol::TIER1_TOOLS
@@ -47,6 +52,7 @@ module Woods
 
       # @param model_validator [ModelValidator] Validates model/column names
       # @param safe_context [SafeContext] Wraps execution in rolled-back transaction
+      # @param redaction_context [SafeContext, nil] Output policy supplied by the server renderer
       # @param connection [Object, nil] Database connection for adapter detection
       # @param read_tools_enabled [Boolean] Enable sql/query tools in embedded mode (default: false)
       # @param table_gate [TableGate, nil] Enforces console_blocked_tables on every
@@ -69,9 +75,10 @@ module Woods
       #   refusal as before.
       def initialize(model_validator:, safe_context:, connection: nil, read_tools_enabled: false, # rubocop:disable Metrics/ParameterLists
                      table_gate: nil, eval_guard: nil, confirmation: nil, audit_logger: nil,
-                     unsafe_eval_enabled: false)
+                     unsafe_eval_enabled: false, redaction_context: nil)
         @model_validator = model_validator
         @safe_context = safe_context
+        @redaction_context = redaction_context || safe_context
         @connection = connection
         @read_tools_enabled = read_tools_enabled
         @table_gate = table_gate
@@ -99,7 +106,7 @@ module Woods
         return refusal if refusal
 
         start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        result = @safe_context.execute { dispatch(tool, params) }
+        result = @safe_context.execute { dispatch_with_key_redaction(tool, params) }
         elapsed = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time) * 1000).round(1)
 
         { 'ok' => true, 'result' => result, 'timing_ms' => elapsed }
@@ -119,6 +126,60 @@ module Woods
 
       private
 
+      def dispatch_with_key_redaction(tool, params)
+        refuse_protected_scope!(params['scope'])
+        refuse_protected_scope!(params['by']) if tool == 'find'
+        output = dispatch(tool, params)
+        return output if redaction_key_values.empty?
+
+        Redactor.apply(output, typed_redaction_context(tool, params))
+      end
+
+      def typed_redaction_context(tool, params)
+        types = Hash.new { |hash, key| hash[key] = [] }
+        typed_redaction_models(tool, params).each do |name, model|
+          redaction_key_values.each do |pattern|
+            key = pattern['key_column']
+            types[key] << model.type_for_attribute(key) if @model_validator.columns_for(name).include?(key)
+          end
+        end
+        @redaction_context.with_key_value_types(types, raw: %w[sql query].include?(tool))
+      end
+
+      def typed_redaction_models(tool, params)
+        tables = if tool == 'sql'
+                   SqlTableScanner.identifiers_in(params['sql'], dialect: sql_dialect, mysql_modes: mysql_quote_modes)
+                 else
+                   selected_source_tables(params)
+                 end
+        @model_validator.model_names.filter_map do |name|
+          model = resolve_model(name)
+          next unless model.respond_to?(:type_for_attribute)
+          next unless typed_model_source?(model, name, params, tables)
+
+          [name, model]
+        rescue NameError
+          # Injectable registries can describe models without loading Rails.
+          next
+        end
+      end
+
+      def typed_model_source?(model, name, params, tables)
+        return true if name == params['model']
+        return false unless model.respond_to?(:table_name)
+
+        # Match the scanner's unquoted final segment, as the identifier gates
+        # do. Keep all matching models across schemas: every possible type
+        # contributes to masking rather than selecting one ambiguous source.
+        tables.any? { |table| table.split('.').last.casecmp?(model.table_name.split('.').last) }
+      end
+
+      def selected_source_tables(params)
+        Array(params['select'] || params['columns']).filter_map do |column|
+          column.split('.')[0...-1].join('.') if column.include?('.')
+        end
+      end
+
       def sanitize_execution_error(error)
         klass = error.class.name
         # Well-known AR wrappers that contain the adapter error as their cause —
@@ -427,7 +488,7 @@ module Woods
 
         begin
           SqliteReadGuard.validate!(sql) if sql_dialect == :sqlite
-          @table_gate.check_sql!(sql, dialect: sql_dialect == :sqlite ? :sqlite : nil)
+          @table_gate.check_sql!(sql, dialect: sql_dialect)
         rescue TableGateError, SqlValidationError => e
           raise ValidationError, e.message
         end
@@ -470,6 +531,7 @@ module Woods
       end
 
       def handle_find(params)
+        validate_select_columns!(params)
         model = resolve_model(params['model'])
         scope = checked_relation(model)
         record = if params['id']
@@ -482,7 +544,7 @@ module Woods
 
       def handle_pluck(params)
         columns = params['columns']
-        @model_validator.validate_columns!(params['model'], columns) if columns
+        validate_select_columns!(params)
         model = resolve_model(params['model'])
         limit = [params.fetch('limit', 100).to_i, 1000].min
         scope = apply_scope(model, params['scope'], model_name: params['model'])
@@ -495,6 +557,7 @@ module Woods
         column = params['column']
         function = params['function']
         @model_validator.validate_column!(params['model'], column) if column
+        refuse_redacted_aggregate_expression!(column)
 
         unless AGGREGATE_FUNCTIONS.include?(function)
           raise ValidationError, "Invalid aggregate function: #{function}. " \
@@ -546,11 +609,7 @@ module Woods
       end
 
       def sql_dialect
-        name = active_connection.adapter_name.to_s.downcase
-        return :sqlite if name.include?('sqlite')
-        return :mysql if name.include?('mysql')
-
-        :postgres
+        AdapterFamily.for(active_connection)
       end
 
       def gate_association!(model_name, association)
@@ -594,6 +653,7 @@ module Woods
         limit = [params.fetch('limit', 10).to_i, 50].min
 
         @model_validator.validate_column!(params['model'], order_by)
+        refuse_protected_predicate_column!(order_by)
         direction = 'desc' unless %w[asc desc].include?(direction)
 
         scope = apply_scope(model, params['scope'], model_name: params['model'])
@@ -621,21 +681,33 @@ module Woods
         sql = params['sql']
         raise ValidationError, 'Missing required parameter: sql' unless sql
 
+        raise ValidationError, 'Rejected: console_sql requires a recognized database adapter family.' unless sql_dialect
+
         require_relative 'sql_validator'
-        SqlValidator.new(dialect: sql_dialect).validate!(sql)
-        # Post-validation, pre-execution TableGate — blocks every configured
-        # table even if the sql is otherwise well-formed.
-        gate_sql!(sql)
+        validate_sql_policy!(sql)
 
         limit = params['limit'] ? [params['limit'].to_i, MAX_SQL_LIMIT].min : nil
-        query_sql = limit ? "SELECT * FROM (#{sql}) AS _limited LIMIT #{limit}" : sql
+        query_sql = limit ? "SELECT * FROM (\n#{sql}\n) AS _limited LIMIT #{limit}" : sql
+        validate_sql_policy!(query_sql) if limit
         result = active_connection.select_all(query_sql)
+        validate_sql_result_types!(result)
 
         { 'columns' => result.columns, 'rows' => result.rows, 'count' => result.rows.size }
       rescue SqlValidationError => e
         raise ValidationError, e.message
       end
 
+      def validate_sql_policy!(sql)
+        # Alias-list identity is its own policy, even when an alias also
+        # looks like a function name to the SQL validator.
+        sql_security_views(sql).each { |stripped| refuse_sql_column_alias_lists!(stripped) }
+        SqlValidator.new(dialect: sql_dialect, mysql_modes: mysql_quote_modes).validate!(sql)
+        validate_protected_sql_usage!(sql)
+        # Check both submitted and wrapped SQL against blocked tables before
+        # the exact final statement reaches the adapter.
+        gate_sql!(sql)
+      end
+
       # Build and execute a structured ActiveRecord query.
       #
       # @param params [Hash] Must contain 'model' and 'select'
@@ -695,7 +767,9 @@ module Woods
         model_name = params['model']
         relation = model.all
 
-        relation = relation.select(*validated_select(params['select'], model_name)) if params['select']
+        # Keep execution and typed source inference on the same validated projection.
+        params['select'] = validated_select(params['select'], model_name) if params['select']
+        relation = relation.select(*params['select']) if params['select']
         relation = relation.joins(params['joins'].map(&:to_sym)) if params['joins']&.any?
         relation = apply_scope(relation, params['scope'], model_name: model_name)
         relation = relation.group(*validated_columns(params['group_by'], model_name)) if params['group_by']&.any?
@@ -712,18 +786,18 @@ module Woods
       # @param model_name [String]
       # @return [Array<String>]
       def validated_select(select, model_name)
-        Array(select).flat_map { |s| s.to_s.split(',') }.map do |expr|
+        expressions = Array(select).flat_map { |s| s.to_s.split(',') }.map do |expr|
           validate_select_expression!(expr.strip, model_name)
         end
+        refuse_orphan_eav_value_selection!(expressions, model_name)
+        expressions
       end
 
       def validate_select_expression!(expr, model_name)
         match = SAFE_SELECT_EXPR.match(expr)
         raise ValidationError, "Rejected select expression: #{expr.inspect}" unless match
 
-        _fn, fn_arg, bare_col, _alias = match.captures
-        column = bare_col || fn_arg
-        validate_column_reference!(column, model_name) unless column == '*'
+        refuse_redacted_select_shapes!(match.captures, model_name)
         expr
       end
 
@@ -736,6 +810,7 @@ module Woods
         Array(columns).flat_map { |c| c.to_s.split(',') }.map do |col|
           col = col.strip
           validate_column_reference!(col, model_name)
+          refuse_protected_predicate_column!(col)
           col
         end
       end
@@ -760,12 +835,12 @@ module Woods
       /ix
       private_constant :HAVING_AGG_TEMPLATE
 
-      def validated_having(having, model_name) # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+      def validated_having(having, model_name)
         case having
         when Hash
           raise ValidationError, 'having: empty hash' if having.empty?
 
-          having.each_key { |k| validate_column_reference!(k.to_s, model_name) }
+          having.each_key { |key| validate_predicate_column_reference!(key.to_s, model_name) }
           [having]
         when Array
           raise ValidationError, 'having: array must be [sql_with_placeholders, *binds]' if having.empty?
@@ -776,8 +851,7 @@ module Woods
 
           # Validate any referenced columns through ModelValidator so
           # aggregate args can't reach the db without a column check.
-          col = match[:col] || match[:arg]
-          validate_column_reference!(col, model_name) if col && col != '*'
+          validate_having_input!(match, model_name)
 
           having
         else
@@ -785,11 +859,22 @@ module Woods
         end
       end
 
+      def validate_having_input!(match, model_name)
+        column = match[:col] || match[:arg]
+        validate_predicate_column_reference!(column, model_name) if column && column != '*'
+        refuse_redacted_aggregate_expression!(column) if match[:agg]
+      end
+
+      def validate_predicate_column_reference!(column, model_name)
+        validate_column_reference!(column, model_name)
+        refuse_protected_predicate_column!(column)
+      end
+
       # Validate `order:` — only Hash `{col => :asc|:desc}` or bare column name.
       def validated_order(order, model_name)
         case order
         when Hash
-          order.each_key { |k| validate_column_reference!(k.to_s, model_name) }
+          order.each_key { |key| validate_predicate_column_reference!(key.to_s, model_name) }
           order.transform_values do |dir|
             dir_sym = dir.to_s.downcase.to_sym
             unless %i[asc desc].include?(dir_sym)
@@ -800,7 +885,7 @@ module Woods
           end
         when String, Symbol
           col = order.to_s.strip
-          validate_column_reference!(col, model_name)
+          validate_predicate_column_reference!(col, model_name)
           col
         else
           raise ValidationError, "order: unsupported type #{order.class}"
@@ -967,6 +1052,7 @@ module Woods
         return unless params['columns']
 
         @model_validator.validate_columns!(params['model'], params['columns'])
+        refuse_orphan_eav_value_selection!(params['columns'], params['model'])
       end
 
       # Apply column selection to a relation.
@@ -1006,8 +1092,7 @@ module Woods
       #
       # @return [Arel::Nodes::SqlLiteral]
       def random_function
-        adapter = active_connection.adapter_name.downcase
-        func = adapter.include?('mysql') ? 'RAND' : 'RANDOM'
+        func = AdapterFamily.for(active_connection) == :mysql ? 'RAND' : 'RANDOM'
         Arel.sql("#{func}()")
       end
 

data/lib/woods/console/model_validator.rb

@@ -20,8 +20,10 @@ module Woods
     #
     class ModelValidator
       # @param registry [Hash<String, Array<String>>] Model name => column names mapping
-      def initialize(registry:)
+      # @param table_names [Hash<String, String>] Optional table mapping for EAV provenance
+      def initialize(registry:, table_names: {})
         @registry = registry
+        @model_by_table = table_names.each_with_object({}) { |(model, table), acc| acc[table.to_s] = model }
       end
 
       # Validate that a model name is known.
@@ -59,6 +61,14 @@ module Woods
         column_names.each { |col| validate_column!(model_name, col) }
       end
 
+      # Return known table columns without guessing an unknown table's shape.
+      # @param table_name [String]
+      # @return [Array<String>, nil] nil when this table is not registered
+      def columns_for_table(table_name)
+        model = @model_by_table[table_name.to_s]
+        @registry[model] if model
+      end
+
       # List all known model names.
       #
       # @return [Array<String>]