woods 1.6.4 → 2.0.0.beta1

data/lib/woods/console/eval_guard.rb

@@ -14,13 +14,15 @@ module Woods
     #
     # ## Reachability (v0.2)
     #
-    # EvalGuard is the first of five controls on the embedded `console_eval`
-    # opt-in path. `EmbeddedExecutor#handle_eval` calls `check!` before
-    # anything else — ahead of the Confirmation prompt, the SafeContext
-    # rollback, the timeout, and the audit log. When the opt-in is off
-    # (the default), `refusal_for('eval')` still short-circuits with the
-    # `eval_disabled` payload and this guard is not reached. See
-    # docs/CONSOLE_MCP_SETUP.md "console_eval opt-in" and backlog B-053.
+    # `EmbeddedExecutor#send_request` already wraps every dispatched tool —
+    # `console_eval` included — inside `SafeContext#execute`'s rolled-back
+    # transaction before `handle_eval` runs at all. Within that,
+    # `handle_eval` calls `EvalGuard#check!` before anything else it
+    # controls: ahead of the Confirmation prompt, the timeout, and the audit
+    # log. When the opt-in is off (the default), `refusal_for('eval')` still
+    # short-circuits with the `eval_disabled` payload and this guard is not
+    # reached. See docs/CONSOLE_MCP_SETUP.md "console_eval opt-in" and
+    # backlog B-053.
     #
     # Bridge-process mode (in development) will call the same guard before
     # shipping the payload to the remote Rails worker.
@@ -98,24 +100,29 @@ module Woods
       #   `remove_method` / `method_defined?` / `prepend` / `include_module`
       #   reflection family.
       # - State mutation: `instance_variable_set` / `instance_variable_get`,
-      #   `class_variable_set` / `class_variable_get` / `freeze` / `taint`.
+      #   `class_variable_set` / `class_variable_get`.
       # - Object-space escapes: `_id2ref`, `each_object`, `const_source_location`.
       # - System / process: `system`, `exec`, `spawn`, `fork`, `popen`, `%x{}`
       #   (AST method name `backtick` / xstr) so they can't be invoked
       #   implicitly.
-      # - File / IO: `open` (bare Kernel#open — the File-specific reader is
-      #   handled separately via CREDENTIAL_FILE_READERS, but the bare
-      #   `Kernel.open("|shell-command")` form is how most shellshock-style
-      #   escapes slip through).
-      # - Network: `URI.open` (when called as `open` on URI, the AST method
-      #   name is `open` so the string match above catches it). HTTP / Socket
-      #   constants are denied separately via DENIED_CONSTANTS.
-      # - Loader: `load`, `require`, `require_relative`, `autoload`.
+      # - Loader: `require`, `require_relative`, `autoload`. Bare `load` is
+      #   NOT in this list (Marshal.load/YAML.load call sites are the ones
+      #   worth denying, and those go through the constant gate below).
       # - Unsafe deserialization: `unsafe_load` / `_load` (Marshal.load and
-      #   YAML.load are denied via DENIED_CONSTANTS + method gate below).
-      # - Threading escapes from SafeContext's rollback: `new` on Thread /
-      #   Fiber / Process is denied via DENIED_CONSTANTS so the
-      #   {Kernel.fork, Thread.new} pair can't slip past.
+      #   YAML.load are denied via DENIED_CONSTANTS on the `Marshal`/`YAML`
+      #   receiver, not through this list).
+      # - Legacy taint-mode escapes: `taint` / `untaint`.
+      #
+      # Bare `open` (Kernel#open, e.g. `open("|shell-command")`) is NOT in
+      # this list and is NOT denied — a receiver-less call has no receiver
+      # for {#refuse_credential_file_read!} to match either. `File.open` /
+      # `IO.open` / `Pathname.new(...).open` are caught only when the
+      # argument looks like a credential path, via CREDENTIAL_FILE_READERS
+      # below. `URI.open` is denied, but via `URI` being a denied receiver
+      # in DENIED_CONSTANTS ({#refuse_denied_constant_receiver!}), not via an
+      # `open` entry here. Threading escapes from SafeContext's rollback
+      # (`Thread.new`, `Fiber.new`, `Process.fork`, ...) are denied the same
+      # way, via their receiver constants.
       DENIED_REFLECTION = %w[
         eval instance_eval class_eval module_eval binding
         instance_exec class_exec module_exec

data/lib/woods/console/input_contract.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+module Woods
+  module Console
+    # Normalizes integer inputs and enforces the bounds declared by a ToolSpec.
+    module InputContract
+      class ValidationError < StandardError; end
+
+      DECIMAL_INTEGER = /\A-?(?:0|[1-9]\d*)\z/
+      private_constant :DECIMAL_INTEGER
+
+      module_function
+
+      def normalize!(arguments, properties)
+        properties.each do |property_name, definition|
+          next unless definition[:type] == 'integer'
+
+          key = argument_key(arguments, property_name)
+          next unless key
+
+          value = parse_integer(arguments[key], property_name)
+          enforce_bounds!(value, property_name, definition)
+          arguments[key] = value
+        end
+
+        arguments
+      end
+
+      # Reject a String value for any integer-typed property, without
+      # attempting to parse it. Used ahead of {normalize!} on paths that skip
+      # full JSON-Schema validation (e.g. an unregistered tool spec): without
+      # this, a well-formed decimal string like `"15"` sails past
+      # {parse_integer} untouched (it's valid input to that method) even
+      # though the declared schema's `type: integer` would reject any String
+      # outright — silently coercing input the public contract disallows.
+      #
+      # @param arguments [Hash] Mutated arguments hash (string or symbol keys)
+      # @param properties [Hash] ToolSpec JSON Schema property definitions
+      # @raise [ValidationError] when an integer-typed property holds a String
+      def reject_string_typed_integers!(arguments, properties)
+        properties.each do |property_name, definition|
+          next unless definition[:type] == 'integer'
+
+          key = argument_key(arguments, property_name)
+          next unless key
+          next unless arguments[key].is_a?(String)
+
+          raise ValidationError, "#{property_name} must be an integer"
+        end
+      end
+
+      def argument_key(arguments, property_name)
+        return property_name if arguments.key?(property_name)
+
+        string_name = property_name.to_s
+        string_name if arguments.key?(string_name)
+      end
+      private_class_method :argument_key
+
+      def parse_integer(value, property_name)
+        return value if value.is_a?(Integer)
+        return Integer(value, 10) if value.is_a?(String) && DECIMAL_INTEGER.match?(value)
+
+        raise ValidationError, "#{property_name} must be an integer"
+      end
+      private_class_method :parse_integer
+
+      def enforce_bounds!(value, property_name, definition)
+        minimum = definition.fetch(:minimum)
+        maximum = definition.fetch(:maximum)
+        return if value.between?(minimum, maximum)
+
+        raise ValidationError, "#{property_name} must be between #{minimum} and #{maximum}"
+      end
+      private_class_method :enforce_bounds!
+    end
+  end
+end

data/lib/woods/console/model_validator.rb

@@ -20,7 +20,11 @@ module Woods
     #
     class ModelValidator
       # @param registry [Hash<String, Array<String>>] Model name => column names mapping
-      # @param table_names [Hash<String, String>] Optional table mapping for EAV provenance
+      # @param table_names [Hash<String, String>] Model name => table name mapping, used to
+      #   resolve a qualified `table.column` reference back to the model that owns it. Optional
+      #   and defaults to empty — callers that don't supply it get every qualified column
+      #   reference rejected by {#validate_table_column!} (fail closed: an unmapped table can't
+      #   be proven safe).
       def initialize(registry:, table_names: {})
         @registry = registry
         @model_by_table = table_names.each_with_object({}) { |(model, table), acc| acc[table.to_s] = model }
@@ -61,12 +65,26 @@ module Woods
         column_names.each { |col| validate_column!(model_name, col) }
       end
 
-      # Return known table columns without guessing an unknown table's shape.
+      # Validate a qualified `table.column` reference against the real
+      # columns of the model that owns `table_name`. Table gating (TableGate)
+      # only checks whether a table is *blocked*; it never confirms the
+      # column exists on that table at all, so a syntactically valid but
+      # nonexistent qualified column previously reached SQL execution and
+      # failed as a generic adapter error instead of a typed one.
+      #
       # @param table_name [String]
-      # @return [Array<String>, nil] nil when this table is not registered
-      def columns_for_table(table_name)
-        model = @model_by_table[table_name.to_s]
-        @registry[model] if model
+      # @param column_name [String]
+      # @return [true]
+      # @raise [ValidationError] if the table is unmapped or the column is unknown on it
+      def validate_table_column!(table_name, column_name)
+        model_name = @model_by_table[table_name.to_s]
+        unless model_name
+          raise ValidationError,
+                "Unknown table '#{table_name}'. Cannot validate qualified column " \
+                "'#{table_name}.#{column_name}'."
+        end
+
+        validate_column!(model_name, column_name)
       end
 
       # List all known model names.

data/lib/woods/console/rack_middleware.rb

@@ -1,11 +1,7 @@
 # frozen_string_literal: true
 
 require 'json'
-require 'woods/mcp/http_transport_options'
 require 'woods/observability/structured_logger'
-require 'woods/mcp/bearer_auth'
-require 'woods/mcp/origin_guard'
-require 'rack/request'
 
 module Woods
   module Console
@@ -21,9 +17,8 @@ module Woods
     #
     #   config.middleware.use Woods::Console::RackMiddleware, path: '/mcp/console'
     #
-    # This mounts 31 console tools at /mcp/console. By default, console_sql and
-    # console_query are blocked in embedded mode and return an "unsupported" error
-    # pointing users to enable the flag.
+    # This mounts the 9 executable Tier 1 tools at /mcp/console. Explicit
+    # read-tool mode registers console_sql and console_query as well.
     #
     # == Enabling the feature
     #
@@ -35,10 +30,12 @@ module Woods
     #     config.console_redacted_columns = %w[api_token password_digest]
     #   end
     #
-    # With the flag off, requests to the mounted path return 410 Gone so
-    # operators can see the endpoint exists but is gated. See
-    # docs/CONSOLE_MCP_SETUP.md for the full security posture (blocked tables,
-    # credential scanner, column/EAV redaction, SafeContext rollback).
+    # With the flag off, requests — including those at the mounted path —
+    # pass through to the app untouched. The Woods railtie mounts this
+    # middleware unconditionally (#183), so a host that has not opted in
+    # must be completely unaffected. See docs/CONSOLE_MCP_SETUP.md for the
+    # full security posture (blocked tables, credential scanner, column/EAV
+    # redaction, SafeContext rollback).
     #
     # == Enabling read tools (console_sql + console_query)
     #
@@ -52,9 +49,11 @@ module Woods
     #
     # Security posture with embedded_read_tools: true:
     #
-    # 1. SqlValidator denylist — console_sql rejects INSERT/UPDATE/DELETE/DROP/TRUNCATE/
-    #    ALTER/CREATE/REPLACE and similar DML/DDL at the string level before any database
-    #    interaction. Only SELECT and WITH...SELECT are allowed.
+    # 1. SqlValidator — console_sql rejects INSERT/UPDATE/DELETE/DROP/TRUNCATE/ALTER/CREATE
+    #    and similar DML/DDL keywords via a denylist at the string level before any database
+    #    interaction. REPLACE is rejected too, but by the separate allowed-prefix check
+    #    (only SELECT, WITH, and EXPLAIN may lead a statement), not the denylist — it isn't
+    #    in SqlValidator::FORBIDDEN_KEYWORDS.
     #
     # 2. SafeContext rollback — every request (including console_query) runs inside
     #    a database transaction that is always rolled back on completion. Even if a
@@ -65,77 +64,65 @@ module Woods
     #    ActiveRecord::Base's pool and returns it after the response. No shared
     #    mutable state leaks between requests.
     #
-    # These three layers make embedded_read_tools: true safe for read-only workloads.
-    # If your threat model requires stricter isolation, use the bridge mode instead
-    # (docs/CONSOLE_MCP_SETUP.md) which runs the executor in a separate process.
+    # These three layers define the supported read-tool posture. Keep read tools
+    # disabled when the host requires a narrower database capability.
     #
-    class RackMiddleware # rubocop:disable Metrics/ClassLength -- mount-local authentication precedes legacy construction
+    class RackMiddleware # rubocop:disable Metrics/ClassLength
       # @param app [#call] The next Rack app in the middleware stack
       # @param path [String] URL path to mount the MCP endpoint (default: '/mcp/console')
-      # @param embedded_read_tools [Boolean] Enable sql/query tools in embedded mode (default: false)
-      # @param unsafe_eval_confirmation [Confirmation, nil] Approval callback for the
-      #   `console_eval` opt-in. Required when `WOODS_CONSOLE_UNSAFE_EVAL=true` (or
-      #   `config.console_unsafe_eval_enabled = true`); the server refuses to boot
-      #   without it. Takes precedence over `config.console_unsafe_eval_confirmation`.
-      # @param unsafe_eval_audit_log_path [String, Pathname, nil] JSONL audit log
-      #   path for every `console_eval` run. Required on the opt-in path. Takes
-      #   precedence over `config.console_unsafe_eval_audit_log_path`.
-      def initialize(app, options = {}, **keywords)
-        raise TypeError, 'middleware options must be a Hash' unless options.is_a?(Hash)
-
-        initialize_options(app, **options, **keywords)
-      end
-
-      def initialize_options(app, path: '/mcp/console', embedded_read_tools: false, origin_policy: nil, # rubocop:disable Metrics/ParameterLists -- preserves legacy eval options alongside the shared HTTP policy
-                             unsafe_eval_confirmation: nil, unsafe_eval_audit_log_path: nil)
+      # @param embedded_read_tools [Boolean, #call] Enable sql/query tools in
+      #   embedded mode (default: false). May be a callable resolved when the
+      #   server is first built — the railtie passes one because middleware
+      #   arguments are captured before config/initializers run (#183).
+      # @param stateless [Boolean, #call] Use modern stateless Streamable HTTP
+      #   semantics (default: true). Set false only for compatibility with a
+      #   client that still requires MCP session IDs.
+      # @param unsafe_eval_confirmation [Confirmation, nil] Legacy option retained
+      #   for compatibility. Passing it fails closed because console_eval is unavailable.
+      # @param unsafe_eval_audit_log_path [String, Pathname, nil] Legacy option retained
+      #   for compatibility. Passing it fails closed because console_eval is unavailable.
+      def initialize(app, path: '/mcp/console', embedded_read_tools: false, # rubocop:disable Metrics/ParameterLists
+                     unsafe_eval_confirmation: nil, unsafe_eval_audit_log_path: nil,
+                     stateless: true)
         @app = app
         @path = path
         @embedded_read_tools = embedded_read_tools
         @unsafe_eval_confirmation = unsafe_eval_confirmation
         @unsafe_eval_audit_log_path = unsafe_eval_audit_log_path
+        @stateless = stateless
         @mutex = Mutex.new
         @transport = nil
-        @origin_policy = origin_policy || Woods::MCP::OriginPolicy.new(
-          allowed_origins: Woods.configuration&.console_mcp_allowed_origins
-        )
-        authenticated = Woods::MCP::BearerAuth.new(
-          method(:handle_request), token: -> { Woods.configuration.console_mcp_token }
-        )
-        @guarded_request = Woods::MCP::OriginGuard.new(authenticated, policy: @origin_policy)
       end
-      private :initialize_options
-
-      DISABLED_BODY = JSON.generate(
-        error: 'woods_console_disabled',
-        message: 'Woods Console MCP is disabled. Set ' \
-                 'Woods.configuration.console_mcp_enabled = true to enable. ' \
-                 'See docs/CONSOLE_MCP_SETUP.md for the full security posture.'
-      ).freeze
 
       # Rack interface — intercepts requests at the configured path.
       #
-      # Returns 410 Gone when Woods.configuration.console_mcp_enabled is false
-      # (the default). This keeps the middleware inert on hosts that have
-      # mounted it but not yet opted into the feature. All other requests at
-      # non-matching paths pass through to the wrapped app unchanged.
+      # The enabled flag is read from Woods.configuration on every request,
+      # never captured at construction: the railtie inserts this middleware
+      # before config/initializers have run (#183). While
+      # `console_mcp_enabled` is false (the default), requests — even at the
+      # mounted path — pass through to the wrapped app unchanged, so a host
+      # that never opted in is completely unaffected. Requests at
+      # non-matching paths always pass through.
       #
       # @param env [Hash] Rack environment
       # @return [Array] Rack response triple
       def call(env)
-        return @app.call(env) unless env['PATH_INFO'].start_with?(@path)
-        return [410, { 'content-type' => 'application/json' }, [DISABLED_BODY]] unless enabled?
+        return @app.call(env) unless env['PATH_INFO'].to_s.start_with?(@path)
+        return @app.call(env) unless enabled?
 
-        @guarded_request.call(env)
+        transport = ensure_transport
+        request_env = env.dup
+        request_env.delete('HTTP_MCP_SESSION_ID') if @stateless_mode
+        transport.handle_request(Rack::Request.new(request_env))
       end
 
       private
 
-      def handle_request(env)
-        ensure_transport.handle_request(Rack::Request.new(env))
-      end
-
+      # Whether the console is enabled, read from the live configuration on
+      # every request. Nil-safe: the railtie mounts this middleware in every
+      # app (#183), including hosts that never called Woods.configure.
       def enabled?
-        Woods.configuration.console_mcp_enabled
+        Woods.configuration&.console_mcp_enabled
       end
 
       # Thread-safe lazy initialization of the MCP server and transport.
@@ -153,8 +140,9 @@ module Woods
           Rails.application.eager_load!
 
           server = build_embedded_server
+          @stateless_mode = resolve_deferred(@stateless)
           @transport = ::MCP::Server::Transports::StreamableHTTPTransport.new(
-            server, **@origin_policy.transport_options
+            server, stateless: @stateless_mode
           )
           server.transport = @transport
           @transport
@@ -204,7 +192,7 @@ module Woods
           safe_context: SafeContext.new(pool: ActiveRecord::Base.connection_pool),
           redacted_columns: Array(config&.console_redacted_columns),
           redacted_key_values: Array(config&.console_redacted_key_values),
-          read_tools_enabled: @embedded_read_tools,
+          read_tools_enabled: resolve_deferred(@embedded_read_tools),
           model_tables: introspection[:tables],
           model_reflections: introspection[:reflections],
           unsafe_eval_confirmation: @unsafe_eval_confirmation,
@@ -259,6 +247,17 @@ module Woods
         end
       end
 
+      # Resolve a constructor option that may have been passed as a callable.
+      # The railtie defers option values because middleware arguments are
+      # captured at railtie-initializer time — before config/initializers
+      # have run (#183).
+      #
+      # @param value [Object, #call]
+      # @return [Object]
+      def resolve_deferred(value)
+        value.respond_to?(:call) ? value.call : value
+      end
+
       def structured_logger
         @structured_logger ||= Woods::Observability::StructuredLogger.new
       end

data/lib/woods/console/redactor.rb

@@ -65,8 +65,7 @@ module Woods
         case key
         when 'record'         then value.is_a?(Hash) ? ctx.redact(value) : value
         when 'records'        then redact_hash_array(value, ctx)
-        when 'rows'           then redact_positional(value, plan)
-        when 'values'         then redact_positional(value, plan, single_column: plan[:column_count] == 1)
+        when 'rows', 'values' then redact_positional(value, plan)
         when 'associations'   then redact_association_map(value, ctx)
         else                       value
         end
@@ -94,8 +93,7 @@ module Woods
       # `columns` header: the column-name mask plus any EAV key-value rules
       # resolved to column indexes.
       def positional_plan(columns, ctx)
-        { column_count: columns.is_a?(Array) ? columns.length : nil,
-          mask: positional_mask(columns, ctx),
+        { mask: positional_mask(columns, ctx),
           kv_rules: positional_kv_rules(columns, ctx) }
       end
 
@@ -125,42 +123,30 @@ module Woods
         return [] unless columns.is_a?(Array)
 
         names = columns.map(&:to_s)
-        ctx.redacted_key_values.filter_map { |pattern| positional_kv_rule(names, pattern, ctx) }
+        ctx.redacted_key_values.filter_map { |pattern| positional_kv_rule(names, pattern) }
       end
 
       # One resolved rule for one EAV pattern, or nil when the header lacks
       # either column. Unambiguous headers get the key/value index pair;
       # duplicated headers get the unconditional mask list.
-      def positional_kv_rule(names, pattern, ctx)
+      def positional_kv_rule(names, pattern)
         key_idxs = names.each_index.select { |i| names[i] == pattern['key_column'] }
         val_idxs = names.each_index.select { |i| names[i] == pattern['value_column'] }
         return nil if key_idxs.empty? || val_idxs.empty?
         return { mask_idxs: val_idxs } unless key_idxs.one? && val_idxs.one?
 
-        { key_idx: key_idxs.first, val_idx: val_idxs.first,
-          key_matches: ->(value) { sensitive_key?(ctx, value, pattern) } }
-      end
-
-      def sensitive_key?(ctx, value, pattern)
-        return ctx.sensitive_key?(value, pattern) if ctx.respond_to?(:sensitive_key?)
-
-        pattern['sensitive_keys'].include?(value.to_s)
+        { key_idx: key_idxs.first, val_idx: val_idxs.first, sensitive: pattern['sensitive_keys'] }
       end
 
       # Redact positional row data using a precomputed plan. Handles both
-      # nested arrays (multi-column pluck, sql/query rows) and single-column
-      # pluck values. Rails collapses the row for single-column pluck, so an
-      # Array/Hash value is still one cell and must be redacted as a whole.
-      def redact_positional(rows, plan, single_column: false)
+      # nested arrays (multi-column pluck, sql/query rows) and flat scalar
+      # arrays (pluck with a single column — Rails collapses the result).
+      def redact_positional(rows, plan)
         return rows unless rows.is_a?(Array)
         return rows if plan[:mask].nil? && plan[:kv_rules].empty?
 
         rows.map do |row|
-          if !single_column && row.is_a?(Array)
-            redact_row(row, plan)
-          else
-            redact_scalar(row, plan[:mask])
-          end
+          row.is_a?(Array) ? redact_row(row, plan) : redact_scalar(row, plan[:mask])
         end
       end
 
@@ -170,7 +156,7 @@ module Woods
           if rule[:mask_idxs]
             # Ambiguous (duplicated) headers: mask every value-named cell.
             rule[:mask_idxs].each { |idx| result[idx] = '[REDACTED]' }
-          elsif rule[:key_matches].call(row[rule[:key_idx]])
+          elsif rule[:sensitive].include?(row[rule[:key_idx]].to_s)
             result[rule[:val_idx]] = '[REDACTED]'
           end
         end

data/lib/woods/console/safe_context.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require_relative 'adapter_family'
-
 # Stub for environments that don't load ActiveRecord
 unless defined?(ActiveRecord::Rollback)
   module ActiveRecord
@@ -15,8 +13,10 @@ module Woods
     #
     # Safety layers:
     # - Every query runs inside a transaction that is always rolled back
-    # - Statement timeout uses `SET LOCAL` so it cannot leak to the next
-    #   pool consumer
+    # - Statement timeout cannot leak to the next pool consumer: PostgreSQL
+    #   uses `SET LOCAL`, which self-discards at transaction end; MySQL has
+    #   no LOCAL equivalent, so its session-scoped `max_execution_time` is
+    #   read before the override and restored in an `ensure` instead
     # - Column redaction replaces sensitive values with "[REDACTED]"
     #
     # == What SafeContext does NOT cover
@@ -185,34 +185,22 @@ module Woods
         apply_key_value_redaction(redacted)
       end
 
-      # Add runtime key types to a request-local redaction view. The original
-      # context and its execution policy are unchanged.
-      # @param types [Hash<String, Array<Object>>] Active Record attribute types
-      # @param raw [Boolean] whether keys are raw database cells
+      # Return a SafeContext that keeps THIS context's execution behavior —
+      # the same pool (or wrapped connection), statement timeout, and
+      # rolled-back transaction — with the given redaction policy applied,
+      # so the executor and the renderer can share one policy-complete
+      # context. A non-empty kwarg defines that list (the documented
+      # configuration surface); an empty kwarg preserves the list this
+      # context already carries, so spec-style wiring that configures
+      # lists on the context keeps working. See {initialize} for the
+      # kwarg shapes.
+      #
       # @return [SafeContext]
-      def with_key_value_types(types, raw: false)
-        dup.tap do |context|
-          context.instance_variable_set(:@key_value_types, types)
-          context.instance_variable_set(:@raw_key_values, raw)
-        end
-      end
-
-      # Match the database spelling and its application representation. If a
-      # type cannot safely transform a key, protect the value rather than
-      # returning a value whose sensitivity could not be established.
-      # @param value [Object] raw or cast EAV key
-      # @param pattern [Hash] normalized EAV policy
-      # @return [Boolean]
-      def sensitive_key?(value, pattern)
-        sensitive = pattern['sensitive_keys']
-        return true if sensitive.include?(value.to_s)
-
-        Array(@key_value_types&.fetch(pattern['key_column'], nil)).any? do |type|
-          alternate = @raw_key_values ? type.deserialize(value) : type.serialize(value)
-          sensitive.include?(alternate.to_s)
-        rescue StandardError
-          true
-        end
+      def with_redaction_policy(redacted_columns: [], redacted_key_values: [])
+        policy_columns = redacted_columns.empty? ? @redacted_columns : redacted_columns
+        policy_key_values = redacted_key_values.empty? ? @redacted_key_values : redacted_key_values
+        SafeContext.new(pool: @pool, timeout_ms: @timeout_ms,
+                        redacted_columns: policy_columns, redacted_key_values: policy_key_values)
       end
 
       private
@@ -222,7 +210,7 @@ module Woods
       # clears the thread-local in ensure so a raise mid-block cannot leak
       # a stale connection reference into the next request on this thread.
       def run_with_timeout(connection)
-        previous = Thread.current[LEASED_CONNECTION_KEY]
+        previous_lease = Thread.current[LEASED_CONNECTION_KEY]
         Thread.current[LEASED_CONNECTION_KEY] = connection
         result = nil
         connection.transaction do
@@ -236,7 +224,7 @@ module Woods
         end
         result
       ensure
-        Thread.current[LEASED_CONNECTION_KEY] = previous
+        Thread.current[LEASED_CONNECTION_KEY] = previous_lease
       end
 
       def normalize_key_value_patterns(patterns)
@@ -261,7 +249,7 @@ module Woods
           key_col = pattern['key_column']
           val_col = pattern['value_column']
           next unless hash.key?(key_col) && hash.key?(val_col)
-          next unless sensitive_key?(hash[key_col], pattern)
+          next unless pattern['sensitive_keys'].include?(hash[key_col].to_s)
 
           hash[val_col] = '[REDACTED]'
         end
@@ -277,12 +265,21 @@ module Woods
       # request, background job, etc.). Safe here because every #execute
       # is wrapped in a transaction.
       #
-      # MySQL uses session-scoped `SET max_execution_time` for SELECTs.
-      # Return a callback that restores the previous value before releasing
-      # the pooled connection; rollback alone does not reset this setting.
+      # MySQL has no per-statement equivalent of `SET LOCAL`: `SET
+      # max_execution_time` (applies to SELECT only — DDL and DML statements
+      # cannot be time-limited via this variable) is SESSION scope and
+      # survives ROLLBACK, so left alone it would leak onto the next request
+      # served from the same pooled connection. {#set_mysql_timeout} reads
+      # the session's current value first and returns a Proc that restores
+      # it; the caller runs that Proc in an +ensure+ around the yielded
+      # block.
+      #
+      # @return [Proc, nil] a restore callback for MySQL, or nil when no
+      #   restoration is needed (PostgreSQL's LOCAL scope self-discards; an
+      #   unsupported adapter sets nothing to restore).
       def set_timeout(connection, timeout_ms = @timeout_ms)
         adapter = connection.adapter_name.downcase
-        if AdapterFamily.for(connection) == :mysql
+        if adapter.include?('mysql')
           set_mysql_timeout(connection, timeout_ms)
         else
           connection.execute("SET LOCAL statement_timeout = '#{timeout_ms.to_i}ms'")
@@ -297,14 +294,17 @@ module Woods
         nil
       end
 
+      # Read MySQL's current session-scoped `max_execution_time`, override
+      # it, and return a Proc that restores the value read here. There is no
+      # per-statement `SET LOCAL` on MySQL, so the override otherwise
+      # outlives this transaction's rollback and bleeds onto whatever the
+      # pooled connection serves next.
+      #
+      # @return [Proc] restores the previous session value
       def set_mysql_timeout(connection, timeout_ms)
-        maria = connection.respond_to?(:mariadb?) && connection.mariadb?
-        variable = maria ? 'max_statement_time' : 'max_execution_time'
-        timeout = maria ? timeout_ms.to_i / 1000.0 : timeout_ms.to_i
-        previous_value = Float(connection.select_value("SELECT @@SESSION.#{variable}"))
-        connection.execute("SET #{variable} = #{timeout}")
-        previous_value = previous_value.to_i unless maria
-        -> { connection.execute("SET #{variable} = #{previous_value}") }
+        previous_value = connection.select_value('SELECT @@SESSION.max_execution_time').to_i
+        connection.execute("SET max_execution_time = #{timeout_ms.to_i}")
+        -> { connection.execute("SET max_execution_time = #{previous_value}") }
       end
 
       def warn_timeout_unsupported(adapter, error)