woods 2.0.0 → 2.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2f9ba72b1db1eb0ba7ac57a190a3ae0cfbee5f86fb35684e4abed69bc93aca64
-  data.tar.gz: c8f381b43946794d2e7c9d756b352927e4f7ed050c033774273e79803d78e6d0
+  metadata.gz: c00b317c5f1df618b940db9d8d2b596c27c1538b4d713d60c9263b1f0ab6acae
+  data.tar.gz: b0fceeb5a3220efdd9d3f0f5dd77d9bc12e1d780ddc689dfd2121f163d9ec75d
 SHA512:
-  metadata.gz: d1e1c9f53cb2f148c163cc4b2433896c2d69f382df6212fb4f9ad2af806f8500750614a017ac3617e17880e017e066d56c9f5c42d3415f883e33f2d774b2fa70
-  data.tar.gz: ed939e3dcb486d1fe8c1952ce9141fdeadb0e7c614abf7fafb6420f8782b5147da70aea0632e42e08fae0af6c4991776c34577252d1c69824140d3c723794290
+  metadata.gz: 0ec485c382f5a334d3607f2f18dd1489c02a6de17df0ba8922dd1d7271a36c8ffa1a71ec16346fe148460632e26f7ccbfc51c938ad96d1c8d03e68672d590993
+  data.tar.gz: 011e559a5cbd6478d579c0fc477c020048352b75872daaab75a52df527dd0b2c0e27645f0627321b03a87c9844aa52b7b5f9fab0e90b7e6ec071a244c8697ef1

data/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.0.1] - 2026-09-26
+
+### Documentation
+
+- Clarify supported Console redaction, SQL projection, adapter timeout and HTTP origin behavior, including maintenance-line differences.
+
+### Fixed
+
+- Report invalidly encoded HTTP origin settings with bounded startup diagnostics; preserve existing origin defaults and access checks.
+- Use the same Console configuration error for malformed origins during automatic and manual middleware construction.
+- HTTP startup diagnostics consistently name `WOODS_MCP_HTTP_ALLOWED_ORIGINS` for malformed origins, including under a POSIX (`C`) locale.
+
+### Security
+
+- Refuse unsupported PostgreSQL escaped identifiers in raw Console SQL before query execution. Ordinary quoted identifiers, literal contents, and comments retain their existing behavior.
+- Share validated Console query projections between execution and typed EAV redaction context, including whitespace normalization.
+- Refuse SQL relation and CTE column alias lists while output redaction is configured, with an explicit redaction-identity error before execution. Direct unaliased projections remain supported.
+- Harden Console request validation, protected result handling, and HTTP authentication and origin enforcement.
+- Apply typed key/value redaction consistently to case-variant and schema-qualified source table names, retaining all matching model types when source schemas are ambiguous.
+- Isolate cached retrieval contexts between application instances sharing a cache backend.
+
 ## [2.0.0] - 2026-09-23
 
 ### Added

data/CONTRIBUTING.md

@@ -1,7 +1,7 @@
 # Contributing to Woods
 
 <!-- release-state:contributing-intro -->
-Woods welcomes bug fixes, extractor coverage, storage and retrieval improvements, MCP compatibility work, documentation, and focused performance changes. This guide covers the shared contribution contract. Coding agents working from a source checkout should also read the repository's [AGENTS.md](https://github.com/lost-in-the/woods/blob/v2.0.0/AGENTS.md).
+Woods welcomes bug fixes, extractor coverage, storage and retrieval improvements, MCP compatibility work, documentation, and focused performance changes. This guide covers the shared contribution contract. Coding agents working from a source checkout should also read the repository's [AGENTS.md](https://github.com/lost-in-the/woods/blob/v2.0.1/AGENTS.md).
 <!-- release-state:end -->
 
 ## Choose the right channel
@@ -46,7 +46,7 @@ Create a branch from current `main`. Keep each pull request to one logical chang
 | `plugin/skills/` | Distributed Woods skills (setup/upgrade, MCP configuration, investigation, agent enablement, diagnosis) |
 
 <!-- release-state:contributing-architecture -->
-Read [CLAUDE.md](https://github.com/lost-in-the/woods/blob/v2.0.0/CLAUDE.md) for architecture and implementation gotchas before changing runtime behavior.
+Read [CLAUDE.md](https://github.com/lost-in-the/woods/blob/v2.0.1/CLAUDE.md) for architecture and implementation gotchas before changing runtime behavior.
 <!-- release-state:end -->
 
 ### Agent orientation and static self-map
@@ -460,6 +460,16 @@ fresh tag-push CI run. Updating main's tooling alone never authorizes different
 candidate bytes. Main's v2 release contract remains unchanged. Do not create or
 push tags, dispatch, publish, or claim 1.6.3 is available during preparation.
 
+### 2.0.1 maintenance CI contract
+
+The 2.0.1 candidate uses trusted main's reviewed maintenance profile, not this
+candidate's copy of the release tooling. That profile intentionally omits
+`exact_ci_jobs` and `package_spec`: validation uses the normal v2 required-job
+list and `spec/integration/packaged_gem_spec.rb`, rather than the legacy matrix
+or package spec. The 1.6.4 profile is separate and has no C-locale artifact-reader
+CI lane. Candidate evidence must identify the actual jobs and artifacts tested;
+profile approval and publication remain maintainer steps.
+
 ### Stable branches
 
 A stable branch is `N-M-stable`, cut from the release tag. Create one only when a released line needs a patch after a newer major has shipped on `main`; until then, `main` is the development branch. The explicitly approved short-lived `release/1.6.3` security exception above does not establish an `N-M-stable` branch.

data/docs/CONFIGURATION_REFERENCE.md

@@ -291,6 +291,13 @@ unchanged. This is a reasonable default for hosts that don't bundle `sqlite3`.
 
 ## Retrieval cache options
 
+The 2.0.1 maintenance patch scopes retrieval contexts to one retriever instance.
+Reload retires only that instance's namespace, including results still in flight;
+already-running requests may finish against the previous corpus. Restarting starts
+a fresh context namespace. Retired entries expire under their configured TTL or
+backend eviction; disabling both can retain unused entries indefinitely. Embedding
+caches remain separate and are not cleared by context invalidation.
+
 The optional cache wraps both embedding-provider calls and assembled retrieval
 contexts. It is disabled by default and is separate from the Index Server's
 tool-result `_meta` cache hint.
@@ -682,7 +689,7 @@ deployment guide including defense layers.
 | `console_mcp_enabled` | Boolean | `false` | Master switch. When `false`, stdio exits and the mounted Console middleware passes requests through to Rails. |
 | `console_mcp_http_enabled` | Boolean | `true` | HTTP transport switch; effective only while the master switch is on. Set `false` for stdio-only use without HTTP token validation or an active HTTP endpoint. Read at request time. |
 | `console_mcp_token` | String | `ENV['WOODS_CONSOLE_MCP_TOKEN']` or `nil` | Bearer token required on every enabled Console HTTP request. With both Console flags enabled, production boot raises on a missing token; other environments warn and requests fail closed with 401. A configured token shorter than 32 characters raises at boot while HTTP is enabled. Explicit stdio-only configurations skip HTTP token validation. Generate with `SecureRandom.hex(32)`. |
-| `console_mcp_allowed_origins` | Array\<String\> | `%w[http://localhost http://127.0.0.1 http://[::1]]` | `OriginGuard` allowlist. Port is stripped before comparison, so `http://localhost` matches any localhost port. Override for tunneled / internal-dashboard access. |
+| `console_mcp_allowed_origins` | Array\<String\> | `%w[http://localhost http://127.0.0.1 http://[::1]]` | `OriginGuard` allowlist shared with SDK dispatch. Portless entries permit same-authority requests; cross-origin ports must be listed explicitly. Default HTTP(S) ports normalize to their omitted form. Invalid entries fail at boot. |
 | `console_mcp_path` | String | `/mcp/console` | URL path the Rack middleware responds on. |
 | `console_embedded_read_tools` | Boolean | `false` | Register `console_sql` and `console_query` in supported stdio and Rack modes. |
 | `console_blocked_tables` | Array\<String\> | `Woods::DEFAULT_CONSOLE_BLOCKED_TABLES` | TableGate denylist (case-insensitive). Bare names match every schema; qualified names (`schema.table`) match exactly. |

data/docs/CONSOLE_MCP_SETUP.md

@@ -209,7 +209,10 @@ Rails/MCP host. If a browser-based client sends an `Origin` header from a
 different host, include that exact origin too. This allow-list controls both
 DNS-rebinding Host checks and browser CORS; keep Rails' own `config.hosts`, TLS,
 and proxy rules aligned with it. Server-to-server clients normally omit
-`Origin`, but their request `Host` must still be allowed.
+`Origin`, but a present request `Host` must still be allowed. Supporting security
+revisions deliberately allow configured non-loopback Hosts through the SDK too;
+2.0.0 could refuse them at that inner layer despite the Woods allowlist. This
+widening is limited to the configured authorities and retains bearer auth.
 
 Do not mount `Woods::Console::RackMiddleware` by itself. The Railtie composes
 `OriginGuard`, `BearerAuth`, and the Console middleware in the supported order.
@@ -636,6 +639,9 @@ Redaction is defense-in-depth, prefer not storing plaintext secrets in database
 
 ### `console_redacted_key_values`
 
+See [read policy compatibility](#read-policy-compatibility) for SQL column-list
+restrictions, conservative typed masking, exact key spelling and binary columns.
+
 Column-name redaction falls short when credentials are stored in a **key-value (EAV)** table, e.g. a Stripe Connect `authorizations` row of `{key: "stripe_access_token", value: "sk_live_..."}`. The column holding the secret is called `value`, which is generic: adding `value` to `console_redacted_columns` would over-redact every unrelated row in the table.
 
 `console_redacted_key_values` takes one or more patterns that describe "when a row has `key_column` set to one of these names, redact its `value_column`":
@@ -700,7 +706,7 @@ these controls, in order:
 
 1. `SqlValidator` rejects DML/DDL (`INSERT`/`UPDATE`/`DELETE`/`MERGE`/`DROP`/`TRUNCATE`/`ALTER`/`CREATE`/`REPLACE`), row-lock clauses (`FOR UPDATE`, `FOR SHARE`, `LOCK IN SHARE MODE`), writable CTEs (every `AS (...)` body, not just the first), `UNION`/`INTO`/`COPY`, multi-statement and comment-hidden injections, and most administrative keywords (`DO`, `SET`, `LISTEN`, `NOTIFY`, `CALL`, `LOAD`, `VACUUM`, `PREPARE`, transaction control, `EXPLAIN ANALYZE`) at the string level. Enforces a read-only **function allowlist** (`ALLOWED_FUNCTIONS`), anything not on it is rejected by name, quoted forms (`"pg_terminate_backend"(…)`) included. Only `SELECT`, `WITH…SELECT`, and plain `EXPLAIN` pass.
 2. `TableGate` refuses any SQL, model, or join that touches a `console_blocked_tables` entry.
-3. `SafeContext` wraps every request in a rolled-back transaction with a short statement timeout. **It does NOT cover async side effects**: ActiveJob `perform_later`, ActionMailer `deliver_later`, direct HTTP egress, `Thread.new`-spawned work, `after_rollback` callbacks, and writes through a different shard all execute as live. Treat the Console MCP as an admin-trust boundary, not a sandbox.
+3. `SafeContext` wraps every request in a rolled-back transaction with an adapter-dependent statement timeout. **It does NOT cover async side effects**: ActiveJob `perform_later`, ActionMailer `deliver_later`, direct HTTP egress, `Thread.new`-spawned work, `after_rollback` callbacks, and writes through a different shard all execute as live. Treat the Console MCP as an admin-trust boundary, not a sandbox.
 4. `CredentialScanner` + column/EAV redaction scrub results.
 
 Keep the flag off when the host requires a narrower database capability.
@@ -718,7 +724,7 @@ supported transport (stdio, Docker/SSH launcher, and HTTP).
 | 1 | Blocked tables | `console_blocked_tables` | Tool dispatch, before executor | Reject any tool call that touches a named table (model, table, or sql arg) |
 | 2 | Credential scanner | `console_disabled_scanner_patterns` (`[:all]` to disable entirely) | After executor, before render | Content-shape redaction of credential-shaped strings anywhere in the response tree |
 | 3 | Column + EAV redaction | `console_redacted_columns`, `console_redacted_key_values` | After executor, before Layer 2 | Identity-based redaction by column name and by key/value row shape |
-| 4 | SqlValidator + SafeContext | built-in | Inside executor | SQL deny-list for `console_sql`; transaction-rollback for every request |
+| 4 | SqlValidator + SafeContext | built-in | Inside executor | SQL validation and function allowlist for `console_sql`; transaction rollback for every request |
 
 Layers 0–3 are configured via `Woods.configure`. Layer 4 is always on and has no knobs. Observability hooks, `console.table_gate.rejected` for Layer 1, `console.credential_scan.hits` for Layer 2, emit structured log lines via `Woods::Observability::StructuredLogger` so operators can audit enforcement without scraping MCP wire traffic.
 
@@ -754,13 +760,20 @@ boundary remain necessary.
 
 ### Statement timeout
 
-Each transaction sets a statement timeout before any query runs. The default is **5000ms** (5 seconds). Timeout enforcement is adapter-specific:
+SafeContext attempts a **5000ms** (5-second) timeout. Support depends on the
+adapter and server; an unsupported setting is skipped and logged when a Rails
+logger is available.
 
 | Adapter | Mechanism | Scope |
 |---------|-----------|-------|
-| PostgreSQL | `SET statement_timeout = '5000ms'` | All statement types |
-| MySQL | `SET max_execution_time = 5000` (session scope; the prior value is restored after the transaction) | SELECT only (MySQL limitation) |
-| Other | Best-effort (skipped gracefully) | n/a |
+| PostgreSQL | `SET LOCAL statement_timeout = '5000ms'` | Transaction-local; discarded on rollback |
+| MySQL | `SET max_execution_time = 5000` | SELECT only; previous session value restored in `ensure` |
+| MariaDB | `SET max_statement_time = 5.0` | Seconds; previous session value restored in `ensure` |
+| SQLite / unrecognized family | No supported per-statement timeout | Do not rely on a query time limit |
+
+Rollback remains active when a timeout setting is unsupported. Recognition of a
+MySQL-family adapter alone does not establish that its server supports the
+corresponding timeout variable.
 
 ### SQL validation (tier 4 `console_sql`)
 
@@ -771,7 +784,7 @@ Validation runs **once**, inside the executor, with the dialect of the live adap
 
 - **Allowed prefixes:** `SELECT`, `WITH...SELECT`, and plain `EXPLAIN`. `EXPLAIN ANALYZE` is rejected, it executes the query rather than just planning it (both the whitespace and `EXPLAIN (ANALYZE, …)` option-list spellings).
 - **Rejected prefixes:** `INSERT`, `UPDATE`, `DELETE`, `MERGE`, `DROP`, `ALTER`, `TRUNCATE`, `CREATE`, `GRANT`, `REVOKE`
-- **Rejected anywhere in query:** `UNION`, `INTO`, `COPY`; row-lock clauses (`FOR UPDATE`, `FOR NO KEY UPDATE`, `FOR SHARE`, `FOR KEY SHARE`, `FOR UPDATE NOWAIT`/`SKIP LOCKED`, MySQL `LOCK IN SHARE MODE`) — these take live row locks even inside the rolled-back transaction. The lock check is adapter-aware: `console_sql` validates with the active adapter's dialect, including MySQL double-quoted strings/backtick identifiers and PostgreSQL quoted identifiers/E-strings. Unknown adapters conservatively scan all supported normalizations. Every view is scanned under both MySQL executable-comment (`/*!...*/`) semantics, so `#` comments and version-guarded comments cannot split a clause apart.
+- **Rejected anywhere in query:** `UNION`, `INTO`, `COPY`; row-lock clauses (`FOR UPDATE`, `FOR NO KEY UPDATE`, `FOR SHARE`, `FOR KEY SHARE`, `FOR UPDATE NOWAIT`/`SKIP LOCKED`, MySQL `LOCK IN SHARE MODE`) — these take live row locks even inside the rolled-back transaction. The lock check is adapter-aware: `console_sql` validates with the active adapter's dialect, including MySQL double-quoted strings/backtick identifiers and PostgreSQL quoted identifiers/E-strings. Direct validator calls without a dialect conservatively scan all supported normalizations; packaged `console_sql` refuses unrecognized adapter families. Every view is scanned under both MySQL executable-comment (`/*!...*/`) semantics, so `#` comments and version-guarded comments cannot split a clause apart.
 - **Function allowlist (the authoritative function control):** every function-call-shaped identifier must appear in `ALLOWED_FUNCTIONS`, a conservative set of pure read-only functions (aggregates, window functions, string/number/date/JSON readers) kept portable across MySQL, PostgreSQL, and SQLite. Anything else is rejected by name, quoted forms (`"pg_terminate_backend"(…)`) included. This is an allowlist because a denylist cannot enumerate every side-effecting function (`nextval`, `pg_advisory_lock`, `pg_terminate_backend`, …). A legacy `DANGEROUS_FUNCTIONS` denylist (`pg_sleep`, `lo_import`, `lo_export`, `pg_read_file`, `pg_write_file`, `load_file`, `sleep`, `benchmark`) still runs first as belt-and-suspenders.
 - **Rejected patterns:** multiple statements (semicolons), writable CTEs (every `AS (...)` body is checked, so a writable CTE in any WITH position is refused — `WITH a AS (SELECT 1), b AS (DELETE FROM users RETURNING *) SELECT * FROM b`), a CTE list attached to top-level DML (`WITH a AS (SELECT 1) DELETE FROM users RETURNING *`), comment-hidden injections
 
@@ -902,3 +915,67 @@ These corrections require `2.0.0.beta4` or a reviewed development revision that
 contains them. Confirm that a patched release is available before selecting it.
 On affected versions, disable Console where these policies are required; Index MCP
 can stay enabled because it reads the published code index separately.
+
+
+## Maintenance policy corrections
+
+The 2.0.1 maintenance patch applies authentication and origin policy to each
+Console HTTP mount. Keep the normal Railtie setup: these additional checks do not
+make an unreviewed manual mount the recommended installation path. Configure
+allowed origins before boot and restart after changes; malformed entries fail
+once at boot with the offending entry identified.
+
+Protected collection values are masked as complete cells. EAV key policy checks
+both stored and cast keys, including in predicates and ordering. Raw SQL refuses
+ambiguous protected source identity, protected whole-row projections, positional
+ordering that could expose protected values, and unsupported result types.
+Explicit unaliased scalar columns and the structured tools are the recovery path.
+
+SQL dialect detection follows adapter ancestry before adapter names. PostgreSQL
+subclasses, Mysql2, MariaDB, Trilogy and SQLite use their applicable policies.
+Genuinely unknown families are refused only by raw `console_sql`; this restriction
+does not disable structured Tier-1 tools. Existing tool opt-ins remain unchanged.
+
+PostgreSQL Unicode-escaped identifiers are refused by `console_sql` before
+execution. Use ordinary identifiers or standard quoted identifiers instead;
+structured query tools are unaffected by this syntax restriction.
+
+### Read policy compatibility
+
+These rules describe the security-patch source; verify the installed revision
+and loaded gem path until its release is published.
+
+- **Column alias lists:** when either `console_redacted_columns` or
+  `console_redacted_key_values` is nonempty, `console_sql` refuses relation
+  and CTE column alias lists before execution, including lists on base tables,
+  derived tables, parenthesized `VALUES` sources and table functions. This applies
+  even when the selected names are not protected and independently of function
+  validation. Ordinary relation
+  aliases, CTEs without column lists and allowed scalar functions remain subject
+  to the normal SQL policy. Use explicit, unaliased protected columns or a
+  structured Console tool.
+- **Conservative typed masking:** EAV type lookup matches the final source-table
+  name case-insensitively and includes every matching registered model, even
+  across schemas. Any matching type can cause masking. This deliberately may
+  mask extra values when table names differ only by case or share that final
+  name; qualifying the table does not narrow that type set.
+- **Exact sensitive values:** `sensitive_keys` compares the stored and cast key
+  values with exact case after string conversion. Configure their actual raw or
+  cast spelling. `CredentialIndex` also matches credential substrings with exact
+  case; it does not decode hexadecimal binary output such as PostgreSQL `bytea`.
+  Binary cells have no general text-scanning guarantee: non-UTF-8 data can fail
+  JSON normalization before scanning. Put binary secret columns in
+  `console_redacted_columns` so they are masked before serialization.
+- **Adapter boundary:** raw `console_sql` requires PostgreSQL, MySQL-family
+  (including Mysql2, MariaDB and Trilogy), or SQLite classification. Compatible
+  subclasses are recognized by ancestry. Unknown families receive a validation
+  refusal for raw SQL; structured tools remain available under their normal
+  gates. See [statement timeouts](#statement-timeout) for adapter limits.
+- **SQL functions and select entries:** 2.x enforces a read-only function
+  allowlist; 1.6.x retains a function denylist. For `console_query`, provide one
+  expression per `select` array entry. 2.x refuses comma-combined entries that
+  1.6.4 splits before validation. Execution and typed redaction use the same
+  validated projection on all patched lines.
+- **Association counts:** polymorphic `belongs_to` counts remain unsupported
+  on this maintenance line and fail closed with a generic execution error.
+  The 2.1 functional correction is not included in this backport.

data/docs/MCP_HTTP_TRANSPORT.md

@@ -86,16 +86,68 @@ Clients must send `Authorization: Bearer $WOODS_MCP_HTTP_TOKEN` on every request
 
 ### Browser origins (DNS rebinding defense)
 
-A second middleware, `Woods::MCP::OriginGuard`, rejects requests whose `Origin` header is outside an allow-list. Requests without an `Origin` header (curl, MCP stdio clients, server-to-server) pass through, bearer auth still gates them.
+**Unreleased diagnostic correction:** invalid origin encodings also refuse before
+binding HTTP. `woods-mcp-http` exits 2 with one bounded `ConfigurationError`
+message naming the invalid entry; re-enter that origin using an ASCII hostname
+(or its Punycode form). No allowlist keeps the existing defaults. Explicit entries
+are literal origins, not wildcard patterns.
+Retain the actual request Host through a reverse proxy; forwarded headers do not
+replace it. When authentication is configured, requests without Host still pass
+through bearer authentication.
+
+In the 2.0.1 maintenance patch, preflight and SDK dispatch share an immutable
+normalized policy. A configured list replaces the default browser origins;
+include loopback explicitly if needed. Cross-origin ports must match an entry,
+while omitted default HTTP(S) ports match their explicit 80/443 forms. A portless
+entry permits same-authority traffic rather than every cross-port browser origin.
+Console defaults remain HTTP loopback; Index HTTP defaults include HTTP and HTTPS
+loopback. When no list is set, these defaults are unchanged. Invalid entries fail
+at boot, naming the offending entry. Restart after changing the configuration.
+
+A second middleware, `Woods::MCP::OriginGuard`, rejects requests whose `Origin` header is outside an allow-list. Requests without an `Origin` header still pass through Host validation and configured bearer authentication.
 
 | Scenario          | `WOODS_MCP_HTTP_ALLOWED_ORIGINS`      | Origins accepted                                                |
 |--------------------|-----------------------------------------|-------------------------------------------------------------------|
-| default            | unset                                    | `http(s)://localhost`, `127.0.0.1`, `::1` (any port)              |
+| default            | unset                                    | HTTP(S) loopback, matching request authority; explicit entries for cross-port origins              |
 | explicit list      | `https://app.example.com`                | exactly `https://app.example.com`, loopback no longer allowed  |
 | multiple origins   | `https://a.example,https://b.example`    | each listed origin                                                |
 
 `OPTIONS` preflights are answered with the matching `Access-Control-Allow-*` headers; successful responses carry `Access-Control-Allow-Origin` and `Vary: Origin`. `Access-Control-Expose-Headers: Mcp-Session-Id` appears only in legacy session mode (`WOODS_MCP_HTTP_STATELESS=0`).
 
+### Origin configuration compatibility
+
+These details apply to the supporting security-patch revisions described above.
+
+The Index HTTP launcher names `WOODS_MCP_HTTP_ALLOWED_ORIGINS` and the offending
+entry when refusing malformed origin configuration, including under a POSIX
+(`C`) locale. It emits one diagnostic before index resolution or HTTP binding.
+
+Configured origins are literal values, with lowercasing, one trailing slash
+removed and HTTP(S) default-port normalization. Wildcard-looking hostnames are
+literal hostnames, not patterns. A nonempty explicit list replaces browser-origin
+defaults, including loopback; add the loopback browser origins you need. Console's
+configured defaults are HTTP loopback; the Index defaults include HTTP and HTTPS
+loopback. Loopback **Host** acceptance is separate from browser-origin acceptance.
+
+Ruby-configured 2.x origin entries reject surrounding whitespace; 1.6.4 trims it.
+The `woods-mcp-http` comma-separated environment setting trims each entry on both
+lines. Use whitespace-free values for portable configuration. The exact-port and
+same-authority rules above still apply; literal matching does not imply wildcard
+or arbitrary cross-port access.
+
+The guards read the actual `Origin` and `Host`; `Forwarded` and
+`X-Forwarded-*` do not replace them. Preserve the public Host through a proxy.
+A genuinely absent Host is accepted by the Host policy, but any supplied Origin
+must still pass its own check. Console requests and token-configured Index
+requests still require bearer authentication before dispatch. The loopback-only
+Index mode without a token retains its documented unauthenticated behavior;
+CORS preflights do not dispatch tools.
+
+Malformed Origin/Host values receive constant `403` responses without reflecting
+the values. Invalid Authorization receives `401` when it reaches the auth guard.
+Malformed HTTP framing can instead receive Puma's `400` before Rack runs. Other
+HTTP servers may reject framing at their own boundary.
+
 ### TLS termination
 
 The server speaks plain HTTP. Any deployment beyond a single trusted host should front it with a reverse proxy that handles TLS, HTTP/2, and connection limits.

data/docs/UPGRADING_TO_2.md

@@ -8,6 +8,35 @@ published 1.6.x security patch as the rollback version.
 <!-- release-state:upgrade-availability -->
 <!-- release-state:end -->
 
+## 2.0.1 security maintenance update
+
+This maintenance line adds Console request/output policy corrections and isolates
+retrieval contexts between retriever instances. It does not add the graph or
+extraction features under development for 2.1. Confirm the installed package
+version and use its matching tag documentation.
+
+No index or database schema migration is required. Restart Console/MCP processes
+after upgrading. Explicit malformed HTTP origin entries now fail at boot with the
+offending entry named; fix the entry rather than weakening authentication.
+Automatic and manual Console mounts raise `Woods::ConfigurationError` for these
+settings, including invalidly encoded entries. With
+no allowlist configured, the existing loopback defaults remain unchanged. See
+[HTTP origin matching](MCP_HTTP_TRANSPORT.md#browser-origins-dns-rebinding-defense).
+
+Raw `console_sql` now refuses ambiguous protected results and genuinely unknown
+adapter families. PostgreSQL-subclass adapters retain PostgreSQL handling;
+structured Console tools remain available with other adapters. Prefer explicit
+unaliased scalar projections or structured reads when a query is refused.
+[Console setup](CONSOLE_MCP_SETUP.md#maintenance-policy-corrections) describes the
+compatibility boundary. Context caches refill after restart; retired entries
+follow the configured TTL or backend eviction. See
+[retrieval cache options](CONFIGURATION_REFERENCE.md#retrieval-cache-options).
+Rolling back restores the affected behavior.
+
+Polymorphic `belongs_to` association counts remain unsupported in 2.0.1 and
+1.6.4 and return a generic execution error; the 2.1 functional correction is
+not backported.
+
 ## Upgrade outcome
 
 After this runbook you will have:
@@ -19,6 +48,37 @@ After this runbook you will have:
 - an MCP client connected to the v2 packaged tool surface;
 - a documented way back to v1 if verification fails.
 
+### Console read compatibility
+
+For supporting security-patch revisions, any nonempty column or EAV redaction
+policy makes `console_sql` refuse relation and CTE column alias lists, including
+lists on base tables, derived tables, parenthesized `VALUES` sources and table
+functions, regardless of the selected names. Use explicit, unaliased protected
+columns or structured tools.
+Typed EAV lookup includes all registered models with a case-insensitive matching
+final table name, including across schemas. It can therefore mask extra values;
+qualification does not narrow this conservative type set. Sensitive key values
+still require their exact stored or cast spelling.
+
+The 1.6.x function denylist becomes a read-only function allowlist in 2.x.
+Supply one `console_query` expression per `select` array entry: 2.x refuses
+comma-combined entries that 1.6.4 splits. Raw SQL requires a recognized adapter
+family; structured tools remain available on other adapters. Configure binary
+secret columns explicitly for redaction. See the canonical
+[read policy compatibility](CONSOLE_MCP_SETUP.md#read-policy-compatibility) and
+[statement timeouts](CONSOLE_MCP_SETUP.md#statement-timeout) for limits.
+
+Supporting Console HTTP revisions deliberately permit allowlisted non-loopback
+Hosts through the SDK where 2.0.0 could refuse them. Bearer authentication remains
+required. An explicit origin list replaces browser-origin defaults; wildcards
+are not supported. Ruby-configured 2.x origins reject surrounding whitespace
+that 1.6.4 trims; the HTTP executable trims comma-separated environment entries
+on both lines. Review [HTTP origin configuration](MCP_HTTP_TRANSPORT.md#origin-configuration-compatibility).
+
+Context-cache namespace rotation retires entries for normal TTL or backend
+eviction; disabling both can retain them indefinitely. See
+[retrieval cache options](CONFIGURATION_REFERENCE.md#retrieval-cache-options).
+
 ## What changes
 
 | v2 change | What can break | Required response |

data/exe/woods-mcp-http

@@ -46,6 +46,20 @@ require_relative '../lib/woods/embedding/text_preparer'
 require_relative '../lib/woods/embedding/indexer'
 
 begin
+  raw_origins = ENV.fetch('WOODS_MCP_HTTP_ALLOWED_ORIGINS', '')
+  unless raw_origins.valid_encoding?
+    invalid_entry = raw_origins.b.split(',').find do |entry|
+      !entry.dup.force_encoding(raw_origins.encoding).valid_encoding?
+    end
+    label = invalid_entry.to_s.b.byteslice(0, 160).inspect
+    raise Woods::ConfigurationError, "Invalid WOODS_MCP_HTTP_ALLOWED_ORIGINS entry #{label}: invalid encoding"
+  end
+  allowed_origins = raw_origins.split(',').map(&:strip).reject(&:empty?)
+  begin
+    origin_policy = Woods::MCP::OriginPolicy.new(allowed_origins: allowed_origins)
+  rescue ArgumentError => e
+    raise Woods::ConfigurationError, "#{e.message} (WOODS_MCP_HTTP_ALLOWED_ORIGINS)"
+  end
   index_dir = Woods::MCP::Bootstrapper.resolve_index_dir(ARGV)
   retriever, bootstrap_state = Woods::MCP::Bootstrapper.build_retriever(index_dir: index_dir)
   snapshot_store = Woods::MCP::Bootstrapper.build_snapshot_store(index_dir)
@@ -96,17 +110,10 @@ server = Woods::MCP::Server.build(
 # hatch is transitional — the spec has removed all three. See
 # docs/MCP_HTTP_TRANSPORT.md#statelessness.
 stateless = !%w[0 false no].include?(ENV.fetch('WOODS_MCP_HTTP_STATELESS', '1').strip.downcase)
-allowed_origins = ENV.fetch('WOODS_MCP_HTTP_ALLOWED_ORIGINS', '').split(',').map(&:strip).reject(&:empty?)
-allowed_hosts = allowed_origins.filter_map do |origin|
-  URI.parse(origin).host
-rescue URI::InvalidURIError
-  nil
-end
 transport = MCP::Server::Transports::StreamableHTTPTransport.new(
   server,
   stateless: stateless,
-  allowed_origins: allowed_origins,
-  allowed_hosts: allowed_hosts
+  **origin_policy.transport_options
 )
 server.transport = transport
 
@@ -116,7 +123,7 @@ inner = proc do |env|
   transport.handle_request(Rack::Request.new(env))
 end
 app = token ? Woods::MCP::BearerAuth.new(inner, token: token) : inner
-app = Woods::MCP::OriginGuard.new(app, allowed_origins: allowed_origins)
+app = Woods::MCP::OriginGuard.new(app, policy: origin_policy)
 
 origin_summary = allowed_origins.empty? ? 'loopback' : allowed_origins.join(',')
 auth_mode = token ? 'bearer' : 'none'

data/lib/woods/cache/cache_middleware.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'digest'
+require 'securerandom'
 require_relative 'cache_store'
 # CachedEmbeddingProvider includes Embedding::Provider::Interface at load
 # time, so the interface must be defined before this file's class bodies run
@@ -408,6 +409,8 @@ module Woods
         @retriever = retriever
         @cache_store = cache_store
         @context_ttl = context_ttl
+        @context_namespace = SecureRandom.hex(16)
+        @context_mutex = Mutex.new
       end
 
       # Expose the wrapped stores so the MCP +reload+ tool and
@@ -427,20 +430,17 @@ module Woods
         @retriever.corpus_status(include_types: include_types) if @retriever.respond_to?(:corpus_status)
       end
 
-      # Invalidate every cached context result. Called from the MCP +reload+
-      # tool after the retriever's stores have been re-hydrated from a fresh
-      # embed — otherwise cached results from the old embedding run would
-      # linger until their TTL expires and contradict the new stores.
+      # Retire this retriever's cached contexts after its corpus reloads.
       #
-      # Embedding caches (query → vector) are NOT cleared: the query-vector
-      # mapping is deterministic for a given provider+model and survives any
-      # index reload. Only context results (query → ranked units) go stale.
+      # Each retriever has its own unpredictable namespace, even when several
+      # applications share a backend. Rotating it also prevents an in-flight
+      # request from repopulating the active cache with a pre-reload result.
+      # Old entries expire by their configured TTL; no global backend deletion
+      # is needed. Embedding caches are independent and remain available.
       #
       # @return [void]
       def invalidate_context_cache!
-        @cache_store.clear(namespace: :context)
-      rescue StandardError => e
-        warn("[Woods] CachedRetriever context-cache invalidation failed: #{e.message}")
+        @context_mutex.synchronize { @context_namespace = SecureRandom.hex(16) }
       end
 
       # Execute the retrieval pipeline with context-level caching.
@@ -492,7 +492,8 @@ module Woods
       # @param exclude_types [Array<String, Symbol>, nil]
       # @return [String]
       def context_key(query, budget, types: nil, exclude_types: nil, packages: nil, source_paths: nil, evidence: 'full') # rubocop:disable Metrics/ParameterLists
-        parts = [query, budget.to_s, fingerprint(types), fingerprint(exclude_types)]
+        namespace = @context_mutex.synchronize { @context_namespace }
+        parts = [namespace, query, budget.to_s, fingerprint(types), fingerprint(exclude_types)]
         parts << 'lexical' if mode == :lexical
         parts << JSON.generate(evidence: evidence) unless evidence == 'full'
         if Retrieval::Scope.requested?(packages: packages, source_paths: source_paths)

data/lib/woods/console/adapter_family.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Woods
+  module Console
+    # Adapter names differ from the SQL grammar and session settings they use.
+    module AdapterFamily
+      # Classify a live connection by adapter ancestry, database configuration,
+      # then its display name. Unknown families remain nil: SQL callers must
+      # refuse rather than silently omit dialect-specific safeguards.
+      # @param connection [Object] Active Record connection or compatible adapter
+      # @return [Symbol, nil] :postgres, :mysql, :sqlite, or unknown
+      def self.for(connection)
+        ancestry = connection.class.ancestors.filter_map(&:name)
+        return :postgres if ancestry.include?('ActiveRecord::ConnectionAdapters::PostgreSQLAdapter')
+        return :mysql if ancestry.any? { |name| name.match?(/::(?:AbstractMysql|Mysql2|Trilogy)Adapter\z/) }
+        return :sqlite if ancestry.include?('ActiveRecord::ConnectionAdapters::SQLite3Adapter')
+
+        from_name(configured_adapter(connection)) || from_name(connection.adapter_name)
+      end
+
+      def self.configured_adapter(connection)
+        return unless connection.respond_to?(:pool) && connection.pool.respond_to?(:db_config)
+
+        connection.pool.db_config.adapter
+      end
+      private_class_method :configured_adapter
+
+      def self.from_name(value)
+        name = value.to_s.downcase
+        return :mysql if name.include?('mysql') || %w[trilogy mariadb].include?(name)
+        return :postgres if name.include?('postgre') || %w[postgis cockroachdb redshift].include?(name)
+        return :sqlite if name.include?('sqlite')
+
+        nil
+      end
+      private_class_method :from_name
+    end
+  end
+end

data/lib/woods/console/credential_index.rb

@@ -46,7 +46,7 @@ module Woods
     #   index.redact("token: sk_live_actual_secret_value")
     #     # => "token: [REDACTED:credential]"
     #
-    class CredentialIndex
+    class CredentialIndex # rubocop:disable Metrics/ClassLength
       # Captured at require time so the mtime-check warning has a stable
       # reference point even if the clock skews later. Frozen immediately
       # to prevent accidental mutation.
@@ -187,7 +187,10 @@ module Woods
       def initialize(secrets:)
         filtered = Array(secrets).select { |s| s.is_a?(String) && s.length >= MIN_LENGTH }
         @secrets = filtered.to_set.freeze
-        @pattern = @secrets.empty? ? nil : Regexp.union(@secrets.to_a)
+        # Regexp alternatives match in order: a shorter prefix must not consume
+        # only the start of a longer indexed credential and expose its suffix.
+        longest_first = @secrets.each_with_index.sort_by { |secret, idx| [-secret.length, idx] }.map(&:first)
+        @pattern = @secrets.empty? ? nil : Regexp.union(longest_first)
       end
 
       # @return [Boolean] true when no secrets were collected (missing key,
@@ -212,7 +215,34 @@ module Woods
       def redact(str)
         return str if empty? || !str.is_a?(String) || !@pattern.match?(str)
 
-        str.gsub(@pattern, REDACTED)
+        offset = 0
+        parts = []
+        redaction_spans(str).each do |start, finish|
+          parts << str[offset...start] << REDACTED
+          offset = finish
+        end
+        parts << str[offset..]
+        parts.join
+      end
+
+      private
+
+      # Search from each match's start, rather than its end, so an overlapping
+      # credential cannot expose its suffix after an earlier replacement.
+      # Union the covered spans before changing the original string.
+      def redaction_spans(str)
+        spans = []
+        offset = 0
+        while (match = @pattern.match(str, offset))
+          start, finish = match.offset(0)
+          if spans.last && start < spans.last[1]
+            spans.last[1] = [spans.last[1], finish].max
+          else
+            spans << [start, finish]
+          end
+          offset = start + 1
+        end
+        spans
       end
     end
   end