woods 1.6.3 → 1.6.4

data/lib/woods/mcp/origin_policy.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require 'uri'
+require_relative '../util/host_guard'
+
+module Woods
+  module MCP
+    # One immutable policy for the outer Rack guard and the legacy MCP SDK.
+    # Keep SDK rebinding protection active and pass original request headers.
+    class OriginPolicy
+      LOOPBACK_HOSTS = %w[localhost 127.0.0.1 ::1].freeze
+      DEFAULT_ORIGINS = %w[
+        http://localhost http://127.0.0.1 http://[::1]
+        https://localhost https://127.0.0.1 https://[::1]
+      ].freeze
+
+      attr_reader :transport_options
+
+      def initialize(allowed_origins: nil)
+        entries = Array(allowed_origins).compact.reject do |entry|
+          entry.to_s.valid_encoding? && entry.to_s.strip.empty?
+        end
+        @explicit = entries.map { |entry| configured_origin(entry) }.uniq.freeze
+        @allowed = @explicit.empty? ? DEFAULT_ORIGINS : @explicit
+        @hosts = @explicit.map do |origin|
+          host = authority(origin)
+          (host.end_with?(']') ? host[1...-1] : host).freeze
+        end.uniq.freeze
+        @transport_options = if @explicit.empty?
+                               {}.freeze
+                             else
+                               { allowed_origins: transport_origins, allowed_hosts: @hosts }.freeze
+                             end
+        freeze
+      end
+
+      def host_allowed?(host)
+        return true if host.nil?
+        return false unless host.is_a?(String) && host.valid_encoding?
+
+        parsed = parsed_origin("http://#{host}")
+        return false unless parsed
+
+        hostname = parsed.hostname.downcase
+        return false if Util::HostGuard.suspicious_numeric_host?(hostname)
+        return true if LOOPBACK_HOSTS.include?(hostname)
+
+        @hosts.include?(host.downcase) || @hosts.include?(hostname)
+      end
+
+      def origin_allowed?(origin, host:)
+        return true if origin.nil?
+        return false unless parsed_origin(origin)
+
+        normalized = normalized_origin(origin)
+        return true if @explicit.include?(normalized)
+        return false unless @allowed.include?(normalized) || @allowed.include?(normalized.sub(/:\d+\z/, ''))
+        return false unless host.is_a?(String) && host.valid_encoding?
+
+        default_port = normalized.start_with?('https://') ? ':443' : ':80'
+        authority(normalized).delete_suffix(default_port) == host.downcase.delete_suffix(default_port)
+      end
+
+      private
+
+      def configured_origin(entry)
+        raw = entry.to_s
+        value = raw.strip.downcase.delete_suffix('/') if raw.valid_encoding?
+        unless parsed_origin(value)
+          label = raw.b.byteslice(0, 160).inspect
+          raise ArgumentError, "Invalid MCP allowed origin #{label}: expected http(s)://host[:port] without a path"
+        end
+
+        normalized_origin(value).freeze
+      end
+
+      def normalized_origin(origin)
+        value = origin.downcase
+        value.delete_suffix(value.start_with?('https://') ? ':443' : ':80')
+      end
+
+      # SDK 0.23 and 0.25 compare explicit entries literally. Both default-port
+      # spellings are needed for cross-origin requests; same-authority matching
+      # is otherwise performed independently by both layers.
+      def transport_origins
+        @explicit.flat_map do |origin|
+          parsed = parsed_origin(origin)
+          port = parsed.scheme == 'https' ? 443 : 80
+          parsed.port == port ? [origin, "#{origin}:#{port}"] : [origin]
+        end.uniq.map(&:freeze).freeze
+      end
+
+      def authority(origin)
+        origin.sub(%r{\Ahttps?://}, '')
+      end
+
+      def parsed_origin(origin)
+        return unless origin.is_a?(String) && origin.valid_encoding? && origin.ascii_only?
+        return if origin.match?(/[[:space:][:cntrl:]]/)
+
+        parsed = URI.parse(origin)
+        return unless %w[http https].include?(parsed.scheme&.downcase)
+        return unless parsed.host && !parsed.host.empty?
+        return unless parsed.path.to_s.empty? && !parsed.userinfo && !parsed.query && !parsed.fragment
+        return unless parsed.port&.between?(1, 65_535)
+
+        parsed
+      rescue URI::InvalidURIError, ArgumentError
+        nil
+      end
+    end
+  end
+end

data/lib/woods/railtie.rb

@@ -34,7 +34,7 @@ module Woods
       )
     end
 
-    initializer 'woods.console_mcp' do |app|
+    initializer 'woods.console_mcp' do |app| # rubocop:disable Metrics/BlockLength -- validates and scopes the legacy HTTP middleware stack
       config = Woods.configuration
       next unless config.console_mcp_enabled
 
@@ -63,15 +63,22 @@ module Woods
         next
       end
 
+      if token.to_s.length < Woods::MCP::BearerAuth::MIN_TOKEN_LENGTH
+        raise Woods::ConfigurationError, '[Woods Console] console_mcp_token must be at least 32 characters.'
+      end
+
       # Origin guard first — rejects cross-origin POSTs before any auth cost.
       # BearerAuth next — requires `Authorization: Bearer <token>` on every request.
-      app.middleware.use(Woods::MCP::OriginGuard, allowed_origins: Array(config.console_mcp_allowed_origins))
-      app.middleware.use(Woods::MCP::BearerAuth, token: token)
+      origin_policy = Woods::MCP::OriginPolicy.new(allowed_origins: config.console_mcp_allowed_origins)
+      app.middleware.use(Woods::MCP::OriginGuard, policy: origin_policy, path: config.console_mcp_path)
+      app.middleware.use(Woods::MCP::BearerAuth,
+                         token: -> { Woods.configuration.console_mcp_token }, path: config.console_mcp_path)
 
       app.middleware.use(
         Woods::Console::RackMiddleware,
         path: config.console_mcp_path,
-        embedded_read_tools: config.console_embedded_read_tools
+        embedded_read_tools: config.console_embedded_read_tools,
+        origin_policy: origin_policy
       )
     end
   end

data/lib/woods/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Woods
-  VERSION = '1.6.3'
+  VERSION = '1.6.4'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: woods
 version: !ruby/object:Gem::Version
-  version: 1.6.3
+  version: 1.6.4
 platform: ruby
 authors:
 - Leah Armstrong
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-22 00:00:00.000000000 Z
+date: 2026-09-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mcp
@@ -152,6 +152,7 @@ files:
 - lib/woods/cache/solid_cache_store.rb
 - lib/woods/chunking/chunk.rb
 - lib/woods/chunking/semantic_chunker.rb
+- lib/woods/console/adapter_family.rb
 - lib/woods/console/adapters/cache_adapter.rb
 - lib/woods/console/adapters/good_job_adapter.rb
 - lib/woods/console/adapters/job_adapter.rb
@@ -178,6 +179,7 @@ files:
 - lib/woods/console/scope_predicate_parser.rb
 - lib/woods/console/server.rb
 - lib/woods/console/sql_noise_stripper.rb
+- lib/woods/console/sql_output_policy.rb
 - lib/woods/console/sql_table_scanner.rb
 - lib/woods/console/sql_validator.rb
 - lib/woods/console/sqlite_read_guard.rb
@@ -281,6 +283,7 @@ files:
 - lib/woods/mcp/http_transport_options.rb
 - lib/woods/mcp/index_reader.rb
 - lib/woods/mcp/origin_guard.rb
+- lib/woods/mcp/origin_policy.rb
 - lib/woods/mcp/provider_probe.rb
 - lib/woods/mcp/renderers/claude_renderer.rb
 - lib/woods/mcp/renderers/json_renderer.rb
@@ -360,10 +363,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/lost-in-the/woods
-  source_code_uri: https://github.com/lost-in-the/woods/tree/v1.6.3
-  changelog_uri: https://github.com/lost-in-the/woods/blob/v1.6.3/CHANGELOG.md
+  source_code_uri: https://github.com/lost-in-the/woods/tree/v1.6.4
+  changelog_uri: https://github.com/lost-in-the/woods/blob/v1.6.4/CHANGELOG.md
   bug_tracker_uri: https://github.com/lost-in-the/woods/issues
-  documentation_uri: https://github.com/lost-in-the/woods/tree/v1.6.3/docs
+  documentation_uri: https://github.com/lost-in-the/woods/tree/v1.6.4/docs
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []