woods 2.0.0.beta2 → 2.0.0.beta4

data/lib/woods/console/credential_index.rb

@@ -68,6 +68,7 @@ module Woods
       MISSING_KEY_ERRORS = %w[
         ActiveSupport::EncryptedConfiguration::MissingKeyError
         ActiveSupport::EncryptedFile::MissingKeyError
+        ActiveSupport::EncryptedFile::MissingContentError
         ActiveSupport::MessageEncryptor::InvalidMessage
       ].freeze
 
@@ -90,13 +91,19 @@ module Woods
         # @return [CredentialIndex] populated index, or an empty index when
         #   the credentials store can't be opened.
         def build(rails_app:)
-          new(secrets: collect_secrets(rails_app))
+          refresh(rails_app: rails_app)
         rescue StandardError => e
           raise unless missing_key_error?(e)
 
           new(secrets: [])
         end
 
+        # Strict refresh: construct the replacement completely before a caller
+        # installs it. Unlike boot-time .build, errors must preserve the old index.
+        def refresh(rails_app:)
+          new(secrets: collect_secrets(rails_app))
+        end
+
         # Emit a structured log warning when any of the given credentials
         # files has a modification time newer than `process_start`. This
         # catches the common "rotated credentials but forgot to restart"
@@ -136,12 +143,23 @@ module Woods
         private
 
         def collect_secrets(rails_app)
-          config = rails_app.credentials.config
+          config = fresh_credentials(rails_app.credentials).config
           collected = []
           walk(config, collected)
           collected
         end
 
+        def fresh_credentials(credentials)
+          return credentials unless defined?(ActiveSupport::EncryptedConfiguration) &&
+                                    credentials.is_a?(ActiveSupport::EncryptedConfiguration)
+
+          require_relative 'encrypted_credential_snapshot'
+          EncryptedCredentialSnapshot.new(
+            config_path: credentials.content_path, key_path: credentials.key_path,
+            env_key: credentials.env_key, raise_if_missing_key: true
+          )
+        end
+
         def walk(node, collected)
           case node
           when Hash  then node.each_value { |v| walk(v, collected) }

data/lib/woods/console/credential_scanner.rb

@@ -145,9 +145,9 @@ module Woods
 
       # Scan a value (String, Hash, Array, or any other object) for credentials.
       #
-      # Strings are gsub'd against every active pattern. Hash values and Array
-      # elements are walked recursively; keys and non-string scalars
-      # (Integer, Float, true/false, nil) pass through untouched.
+      # Strings and Symbols are scanned against every active pattern. Hash
+      # keys/values and Array elements are walked recursively; numeric values,
+      # booleans, and nil pass through untouched. Symbols retain their type.
       #
       # @param value [Object]
       # @return [Array(Object, Hash{Symbol=>Integer})] two-tuple of the scanned
@@ -155,17 +155,18 @@ module Woods
       #   for patterns that fired — callers should treat a missing key as zero.
       def scan(value)
         counts = {}
-        scanned = walk(value, counts)
+        scanned = walk(value, counts, @secret_index)
         [scanned, counts]
       end
 
       private
 
-      def walk(value, counts)
+      def walk(value, counts, index)
         case value
-        when String then scan_string(value, counts)
-        when Hash   then walk_hash(value, counts)
-        when Array  then value.map { |item| walk(item, counts) }
+        when String then scan_string(value, counts, index)
+        when Symbol then scan_string(value.to_s, counts, index).to_sym
+        when Hash   then walk_hash(value, counts, index)
+        when Array  then value.map { |item| walk(item, counts, index) }
         else value
         end
       end
@@ -177,19 +178,19 @@ module Woods
       # credential-shaped string is emitted as a Symbol after redaction
       # (e.g. `:"[REDACTED]"`). String keys stay Strings. Non-String,
       # non-Symbol keys (Integer, etc.) pass through unchanged.
-      def walk_hash(hash, counts)
+      def walk_hash(hash, counts, index)
         hash.each_with_object({}) do |(key, val), out|
           scanned_key = case key
-                        when String then scan_string(key, counts)
-                        when Symbol then scan_string(key.to_s, counts).to_sym
+                        when String then scan_string(key, counts, index)
+                        when Symbol then scan_string(key.to_s, counts, index).to_sym
                         else             key
                         end
-          out[scanned_key] = walk(val, counts)
+          out[scanned_key] = walk(val, counts, index)
         end
       end
 
-      def scan_string(str, counts)
-        result = redact_indexed_secrets(str, counts)
+      def scan_string(str, counts, index)
+        result = redact_indexed_secrets(str, counts, index)
         result = scan_encoded_forms(result, counts)
         @active_patterns.inject(result) do |acc, (name, pattern)|
           acc.gsub(pattern) do
@@ -290,10 +291,10 @@ module Woods
         printable.to_f / str.length >= PRINTABLE_RATIO_THRESHOLD
       end
 
-      def redact_indexed_secrets(str, counts)
-        return str unless @secret_index&.match?(str)
+      def redact_indexed_secrets(str, counts, index)
+        return str unless index&.match?(str)
 
-        redacted = @secret_index.redact(str)
+        redacted = index.redact(str)
         counts[INDEX_HIT] = (counts[INDEX_HIT] || 0) + redacted.scan(CredentialIndex::REDACTED).size
         redacted
       end

data/lib/woods/console/credential_scanner_registry.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Woods
+  module Console
+    # Coordinates scanner construction and rotation without retaining servers
+    # after their transports release them. Requests keep their own index snapshot.
+    class CredentialScannerRegistry
+      def initialize
+        @scanners = ObjectSpace::WeakMap.new
+        @mutex = Mutex.new
+      end
+
+      def register
+        @mutex.synchronize do
+          scanner = yield
+          # Older Ruby WeakMap implementations validate the value's liveness
+          # when enumerating. Keep the scanner in both weak positions so an
+          # immortal sentinel cannot make an abandoned scanner look live.
+          @scanners[scanner] = scanner
+          scanner
+        end
+      end
+
+      def rebuild
+        @mutex.synchronize do
+          scanners = @scanners.values
+          return nil if scanners.empty?
+
+          index = yield
+          scanners.each { |scanner| scanner.replace_index!(index) }
+          index
+        end
+      end
+    end
+  end
+end

data/lib/woods/console/dispatch_pipeline.rb

@@ -103,7 +103,14 @@ module Woods
         response = @conn_mgr.send_request(request)
         return error_from_response(response, request) unless response['ok']
 
+        # Materialize the wire representation before policy checks. Otherwise
+        # Symbols and custom serializers can introduce unscanned strings later.
+        # Redact first so protected serializers never run; redact again after
+        # normalization to cover fields introduced by a custom serializer.
+        # Both renderers consume this same JSON-compatible data tree.
         result = @ctx.redact(response['result'])
+        result = JSON.parse(JSON.generate(result))
+        result = @ctx.redact(result)
         result = scan_for_credentials(result, request)
         text = @renderer ? @renderer.render_default(result) : JSON.pretty_generate(result)
         success_response(text)

data/lib/woods/console/embedded_executor.rb

@@ -479,7 +479,7 @@ module Woods
       def handle_count(params)
         model = resolve_model(params['model'])
         scope = apply_scope(model, params['scope'], model_name: params['model'])
-        { 'count' => scope.count }
+        { 'count' => checked_relation(scope).count }
       end
 
       def handle_sample(params)
@@ -488,7 +488,7 @@ module Woods
         limit = params.fetch('limit', 5)
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = apply_columns(scope, params['columns'])
-        records = scope.order(random_function).limit(limit)
+        records = checked_relation(scope.order(random_function).limit(limit))
         { 'records' => serialize_records(records, params['columns']) }
       end
 
@@ -501,7 +501,8 @@ module Woods
         end
         validate_select_columns!(params)
         model = resolve_model(params['model'])
-        record = params['id'] ? model.find_by(id: params['id']) : model.find_by(params['by'])
+        scope = checked_relation(model)
+        record = params['id'] ? scope.find_by(id: params['id']) : scope.find_by(params['by'])
         { 'record' => record ? serialize_record(record, params['columns']) : nil }
       end
 
@@ -534,7 +535,7 @@ module Woods
         limit = params.fetch('limit', 100)
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = scope.distinct if params['distinct']
-        values = scope.limit(limit).pluck(*columns.map(&:to_sym))
+        values = checked_relation(scope.limit(limit)).pluck(*columns.map(&:to_sym))
         { 'columns' => Array(columns), 'values' => values }
       end
 
@@ -554,6 +555,7 @@ module Woods
 
         model = resolve_model(params['model'])
         scope = apply_scope(model, params['scope'], model_name: params['model'])
+        scope = checked_relation(scope)
 
         value = if function == 'count'
                   column ? scope.count(column.to_sym) : scope.count
@@ -566,6 +568,7 @@ module Woods
       def handle_association_count(params)
         model = resolve_model(params['model'])
         association_name = params['association']
+        requested_scope = params['scope']
         reflection = model.reflect_on_association(association_name.to_sym)
 
         raise ValidationError, "Unknown association '#{association_name}' on #{params['model']}" unless reflection
@@ -581,15 +584,33 @@ module Woods
         # association's own model before any database I/O runs (not just
         # before the association is read): `model.find` below is itself a
         # query, and a request with a bad scope should never reach it.
-        validate_scope_columns!(params['scope'], reflection.klass.name) if params['scope']
+        validate_scope_columns!(requested_scope, reflection.klass.name) if requested_scope
 
-        record = model.find(params['id'])
+        record = checked_relation(model).find(params['id'])
         scope = record.public_send(association_name)
-        scope = apply_scope(scope, params['scope'], model_name: reflection.klass.name) if params['scope']
+        scope = apply_scope(scope, requested_scope, model_name: reflection.klass.name) if requested_scope
         gate_association_sql!(scope)
         { 'count' => scope.count }
       end
 
+      # Materialize a model's default scope once, inspect the resolved SQL,
+      # and return that same relation for execution. Checking model.table_name
+      # alone misses default scopes that change FROM or introduce joins. Do
+      # not check model.all then issue a fresh query through the model: a
+      # dynamic default scope could differ between the check and execution.
+      # With no TableGate collaborator, retain the ungated executor contract.
+      #
+      # @param scope [Class, ActiveRecord::Relation] Pending model read
+      # @return [Class, ActiveRecord::Relation] Relation authorized for reading
+      # @raise [ValidationError] if its SQL references a blocked table
+      def checked_relation(scope)
+        return scope unless @table_gate
+
+        relation = scope.all
+        gate_sql!(relation.to_sql)
+        relation
+      end
+
       # Defense-in-depth: gate_association! (called by
       # {#handle_association_count} before this) only proves the
       # association's OWN target table isn't blocked. A through-association,
@@ -738,7 +759,7 @@ module Woods
 
         scope = apply_scope(model, params['scope'], model_name: params['model'])
         scope = apply_columns(scope, params['columns'])
-        records = scope.order(order_by => direction.to_sym).limit(limit)
+        records = checked_relation(scope.order(order_by => direction.to_sym).limit(limit))
         { 'records' => serialize_records(records, params['columns']) }
       end
 
@@ -798,13 +819,14 @@ module Woods
       # and PostgreSQL quote/comment grammars differ (`\'` escapes, `#`
       # comments); validating with the matching dialect accepts dialect-valid
       # literals and still rejects every known bypass form. Unknown adapters
-      # return nil and get the conservative both-dialect union.
+      # return nil and get the conservative union of supported dialects.
       #
       # @return [Symbol, nil]
       def sql_dialect
         adapter = active_connection.adapter_name.to_s.downcase
         return :mysql if adapter.include?('mysql')
         return :postgres if adapter.include?('postgre')
+        return :sqlite if adapter.include?('sqlite')
 
         nil
       end
@@ -1491,7 +1513,7 @@ module Woods
         # `SqlNoiseStripper` is the same module SqlValidator uses. The
         # combined single-pass strip_noise resolves comments and literals
         # together so a comment marker inside a literal can't hide a keyword.
-        stripped = SqlNoiseStripper.strip_noise(template)
+        stripped = SqlNoiseStripper.strip_noise(template, dialect: sql_dialect || :postgres, **mysql_quote_modes)
         if SCOPE_TEMPLATE_FORBIDDEN.match?(stripped)
           raise ValidationError,
                 'scope template contains forbidden SQL keywords ' \

data/lib/woods/console/encrypted_credential_snapshot.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'active_support/encrypted_configuration'
+
+module Woods
+  module Console
+    # A private, uncached Rails configuration for one credential-index build.
+    # Unlike Rails' permissive configuration reader, a missing encrypted file
+    # must raise during an explicit refresh rather than erase the last index.
+    class EncryptedCredentialSnapshot < ActiveSupport::EncryptedConfiguration
+      def read
+        ActiveSupport::EncryptedFile.instance_method(:read).bind(self).call
+      end
+    end
+  end
+end

data/lib/woods/console/rack_middleware.rb

@@ -81,17 +81,12 @@ module Woods
       #   for compatibility. Passing it fails closed because console_eval is unavailable.
       # @param unsafe_eval_audit_log_path [String, Pathname, nil] Legacy option retained
       #   for compatibility. Passing it fails closed because console_eval is unavailable.
-      def initialize(app, path: '/mcp/console', embedded_read_tools: false, # rubocop:disable Metrics/ParameterLists
-                     unsafe_eval_confirmation: nil, unsafe_eval_audit_log_path: nil,
-                     stateless: true)
-        @app = app
-        @path = path
-        @embedded_read_tools = embedded_read_tools
-        @unsafe_eval_confirmation = unsafe_eval_confirmation
-        @unsafe_eval_audit_log_path = unsafe_eval_audit_log_path
-        @stateless = stateless
-        @mutex = Mutex.new
-        @transport = nil
+      # Rails 6.0 forwards middleware options as a positional hash on Ruby 3.
+      # Delegate to explicit keywords to preserve required/unknown option checks.
+      def initialize(app, options = {}, **keywords)
+        raise TypeError, 'middleware options must be a Hash' unless options.is_a?(Hash)
+
+        initialize_options(app, **options, **keywords)
       end
 
       # Rack interface — intercepts requests at the configured path.
@@ -99,7 +94,8 @@ module Woods
       # The enabled flag is read from Woods.configuration on every request,
       # never captured at construction: the railtie inserts this middleware
       # before config/initializers have run (#183). While
-      # `console_mcp_enabled` is false (the default), requests — even at the
+      # `console_mcp_enabled` is false (the default), or HTTP is explicitly
+      # disabled with `console_mcp_http_enabled = false`, requests — even at the
       # mounted path — pass through to the wrapped app unchanged, so a host
       # that never opted in is completely unaffected. Requests at
       # non-matching paths always pass through.
@@ -118,11 +114,24 @@ module Woods
 
       private
 
+      def initialize_options(app, path: '/mcp/console', embedded_read_tools: false, # rubocop:disable Metrics/ParameterLists
+                             unsafe_eval_confirmation: nil, unsafe_eval_audit_log_path: nil,
+                             stateless: true)
+        @app = app
+        @path = path
+        @embedded_read_tools = embedded_read_tools
+        @unsafe_eval_confirmation = unsafe_eval_confirmation
+        @unsafe_eval_audit_log_path = unsafe_eval_audit_log_path
+        @stateless = stateless
+        @mutex = Mutex.new
+        @transport = nil
+      end
+
       # Whether the console is enabled, read from the live configuration on
       # every request. Nil-safe: the railtie mounts this middleware in every
       # app (#183), including hosts that never called Woods.configure.
       def enabled?
-        Woods.configuration&.console_mcp_enabled
+        Woods.configuration&.console_mcp_enabled && Woods.configuration.console_mcp_http_enabled
       end
 
       # Thread-safe lazy initialization of the MCP server and transport.

data/lib/woods/console/server.rb

@@ -14,6 +14,7 @@ require_relative 'audit_logger'
 require_relative 'confirmation'
 require_relative 'console_response_renderer'
 require_relative 'credential_scanner'
+require_relative 'credential_scanner_registry'
 require_relative 'eval_guard'
 require_relative 'table_gate'
 require_relative 'redactor'
@@ -44,10 +45,14 @@ module Woods
     #   transport.open
     #
     module Server # rubocop:disable Metrics/ModuleLength
+      SCANNERS = CredentialScannerRegistry.new
+      private_constant :SCANNERS
+
       class << self # rubocop:disable Metrics/ClassLength
         # Rebuild the boot-time credential index from fresh Rails credentials
-        # and hot-swap it into the active scanner without restarting the process.
+        # and hot-swap it into every live scanner without restarting the process.
         #
+        # Refresh failures propagate without replacing any live index.
         # Host rotation jobs should call this immediately after `rails credentials:edit`
         # changes are deployed. The swap is atomic on MRI (GVL) — in-flight scans see
         # either the old or the new index, never a partial one.
@@ -62,14 +67,11 @@ module Woods
         #   the rebuild was skipped.
         def rebuild_credential_index(rails_app: nil)
           return nil unless credential_defense_enabled?
-          return nil unless @active_scanner
 
           target_app = rails_app || default_rails_app
           return nil unless target_app
 
-          new_index = CredentialIndex.build(rails_app: target_app)
-          @active_scanner.replace_index!(new_index)
-          new_index
+          SCANNERS.rebuild { CredentialIndex.refresh(rails_app: target_app) }
         end
 
         # True when Woods is configured and credential defense is on.
@@ -288,21 +290,21 @@ module Woods
                                        model_reflections: model_reflections)
                        end
 
-          secret_index = build_credential_index(config)
-          disabled_patterns = Array(config&.console_disabled_scanner_patterns)
-          scanner = if disabled_patterns.include?(:all)
-                      nil
-                    else
-                      CredentialScanner.new(
-                        disabled_patterns: disabled_patterns,
-                        secret_index: secret_index
-                      )
-                    end
-          @active_scanner = scanner
+          scanner = build_scanner(config)
 
           ResponseContext.build(safe_ctx: safe_ctx, table_gate: table_gate, credential_scanner: scanner)
         end
 
+        def build_scanner(config)
+          disabled_patterns = Array(config&.console_disabled_scanner_patterns)
+          return nil if disabled_patterns.include?(:all)
+
+          SCANNERS.register do
+            CredentialScanner.new(disabled_patterns: disabled_patterns,
+                                  secret_index: build_credential_index(config))
+          end
+        end
+
         # Build the boot-time credential index from Rails.application's encrypted
         # credentials. Returns nil when credential defense is disabled or when no
         # Rails application is reachable (specs, non-Rails hosts) — the scanner

data/lib/woods/console/sql_noise_stripper.rb

@@ -53,20 +53,21 @@ module Woods
       # single-quote scanner.
       #
       # @param sql [String] the SQL string to process
-      # @param dialect [Symbol] `:postgres` (default) or `:mysql`.
+      # @param dialect [Symbol] `:postgres` (default), `:mysql`, or `:sqlite`.
       #   - `:postgres` — single-quoted strings support `''` as an apostrophe
       #     escape. Backslash is treated literally and does not escape quotes.
       #     Dollar-quoted strings (`$$...$$`, `$tag$...$tag$`) are also stripped.
       #   - `:mysql` — single-quoted strings support both `\'` (backslash-escape)
       #     and `''` (doubled-quote) as apostrophe escapes. Dollar-quoted strings
       #     are not recognized by the combined MySQL security scanner.
+      #   - `:sqlite` — doubled apostrophes escape strings; backslashes and dollar signs are literal.
       # @return [String] a new string with all string literals replaced by `''`
       # @raise [ArgumentError] if an unsupported dialect is provided
       DOLLAR_QUOTED = /\$(\w*)\$.*?\$\1\$/m
       SINGLE_QUOTED_POSTGRES = /'(?:''|[^'])*'/m
       SINGLE_QUOTED_MYSQL    = /'(?:\\.|''|[^'])*'/m
 
-      SUPPORTED_DIALECTS = %i[postgres mysql].freeze
+      SUPPORTED_DIALECTS = %i[postgres mysql sqlite].freeze
       private_constant :SUPPORTED_DIALECTS
 
       def self.strip_literals(sql, dialect: :postgres)
@@ -76,7 +77,7 @@ module Woods
 
         # Strip dollar-quoted strings first so stray apostrophes inside them
         # do not interfere with the single-quote scanner.
-        out = sql.gsub(DOLLAR_QUOTED, "''")
+        out = dialect == :sqlite ? sql : sql.gsub(DOLLAR_QUOTED, "''")
 
         pattern = dialect == :mysql ? SINGLE_QUOTED_MYSQL : SINGLE_QUOTED_POSTGRES
         out.gsub(pattern, "''")
@@ -112,7 +113,7 @@ module Woods
       # still reads as following a boundary once comments are gone.
       #
       # @param sql [String] the SQL string to process
-      # @param dialect [Symbol] `:postgres` (default) or `:mysql` — controls
+      # @param dialect [Symbol] `:postgres` (default), `:mysql`, or `:sqlite` — controls
       #   single-quote escape rules (see {.strip_literals}) and whether `#`
       #   opens a line comment. MySQL quote flags reflect session sql_mode.
       # @return [String] a new string with comments removed and every string
@@ -134,7 +135,8 @@ module Woods
           if ch == "'"
             close = single_quote_end(
               sql, i,
-              backslash_escapes: (mysql && !no_backslash_escapes) || (!mysql && postgres_escape_string?(sql, i))
+              backslash_escapes: (mysql && !no_backslash_escapes) ||
+                (dialect == :postgres && postgres_escape_string?(sql, i))
             )
             if close
               out << "''"
@@ -158,7 +160,7 @@ module Woods
               out << ch
               i += 1
             end
-          elsif mysql && ch == '`'
+          elsif (mysql || dialect == :sqlite) && ch == '`'
             close = quoted_span_end(sql, i, quote: '`', backslash_escapes: false)
             if close
               # Backticks delimit identifiers. Preserve the token for table
@@ -170,7 +172,7 @@ module Woods
               out << ch
               i += 1
             end
-          elsif !mysql && ch == '$' && !preceded_by_word_char?(sql, i) && (tag = dollar_tag_at(sql, i))
+          elsif dialect == :postgres && ch == '$' && !preceded_by_word_char?(sql, i) && (tag = dollar_tag_at(sql, i))
             close = sql.index(tag, i + tag.length)
             if close
               out << "''"

data/lib/woods/console/sql_table_scanner.rb

@@ -167,6 +167,49 @@ module Woods
         results.uniq
       end
 
+      # Table-factor prefixes, retaining commas after balanced subqueries and
+      # JOIN predicates. Each nested FROM/JOIN is also scanned independently.
+      # @param sql [String] noise-stripped SQL
+      # @return [Array<String>]
+      def self.relation_factors(sql)
+        sql.to_enum(:scan, /\b(?:FROM|JOIN)\s+/i).flat_map do
+          suffix = sql[Regexp.last_match.end(0)..]
+          split_top_level_commas(relation_clause(suffix))
+        end
+      end
+
+      # Quoted tokens shield punctuation and clause words; a closing parenthesis
+      # at depth zero ends this query's clause, not a nested table expression.
+      def self.relation_clause(suffix)
+        depth = 0
+        tokens = /
+          "(?:[^"]|"")*"|`(?:[^`]|``)*`|''|[()]|
+          \b(?:WHERE|GROUP|HAVING|ORDER|LIMIT|OFFSET|UNION|INTERSECT|EXCEPT|WINDOW)\b
+        /ix
+        suffix.to_enum(:scan, tokens).each do
+          token = Regexp.last_match[0]
+          start = Regexp.last_match.begin(0)
+          finish = Regexp.last_match.end(0)
+          boundary = token == ')' || relation_keyword_boundary?(suffix[0...start], suffix[finish..], token)
+          return suffix[0...start] if depth.zero? && boundary
+
+          depth += 1 if token == '('
+          depth -= 1 if token == ')'
+        end
+        suffix
+      end
+      private_class_method :relation_clause
+
+      def self.relation_keyword_boundary?(prefix, rest, token)
+        return false unless token.match?(/\A[A-Za-z]/)
+        return false if prefix.strip.empty? || prefix.match?(/(?:,|\bAS)\s*\z/i) || rest.lstrip.start_with?(',')
+        return rest.match?(/\A\s+BY\b/i) if %w[GROUP ORDER].include?(token.upcase)
+        return rest.match?(/\A\s+\w+\s+AS\b/i) if token.casecmp?('WINDOW')
+
+        true
+      end
+      private_class_method :relation_keyword_boundary?
+
       # @api private
       # Every view of the stripped SQL the FROM/JOIN scans must consider for
       # MySQL executable comments (`/*! ... */`). {SqlNoiseStripper} leaves
@@ -203,12 +246,9 @@ module Woods
 
       # @api private
       def self.collect_from_identifiers(sql, results)
-        sql.scan(FROM_CLAUSE) do
-          clause = Regexp.last_match[:clause]
-          split_top_level_commas(clause).each do |chunk|
-            ident = lead_identifier(chunk)
-            results << ident if ident
-          end
+        relation_factors(sql).each do |chunk|
+          ident = lead_identifier(chunk)
+          results << ident if ident
         end
       end
       private_class_method :collect_from_identifiers
@@ -229,7 +269,7 @@ module Woods
         depth = 0
         buf = +''
         parts = []
-        clause.each_char do |ch|
+        clause.scan(/"(?:[^"]|"")*"|`(?:[^`]|``)*`|''|./m).each do |ch|
           case ch
           when '('
             depth += 1