woods 2.0.0 → 2.0.1

data/lib/woods/mcp/origin_guard.rb

@@ -2,7 +2,7 @@
 
 require 'json'
 
-require_relative '../util/host_guard'
+require_relative 'origin_policy'
 
 module Woods
   module MCP
@@ -21,17 +21,13 @@ module Woods
     # also requiring Host to appear in the allow-list (or to be a loopback
     # address), we close that gap even when Rails is bound to 0.0.0.0.
     #
-    # Port-matching: an allow-list entry WITHOUT a port (`http://localhost`)
-    # matches that host on any port. An entry WITH a port (`http://localhost:3000`)
-    # requires an exact port match. Specify explicit ports when port isolation
-    # matters.
+    # Cross-origin entries match exactly. A portless entry also permits
+    # same-authority requests on other ports; cross-port browser clients need
+    # their actual origin explicitly configured, as required by the SDK.
     #
     # Also answers CORS preflight (OPTIONS) with the matching allow-list.
     class OriginGuard
-      DEFAULT_ALLOWED = %w[
-        http://localhost http://127.0.0.1 http://[::1]
-        https://localhost https://127.0.0.1 https://[::1]
-      ].freeze
+      DEFAULT_ALLOWED = OriginPolicy::DEFAULT_ORIGINS
 
       # Hosts that always pass the Host-header check even without an explicit
       # allow-list entry — they resolve to loopback by definition and cannot
@@ -56,6 +52,7 @@ module Woods
       #   which runs after Rails railtie initializers captured the middleware
       #   arguments — still takes effect (#183). Empty/nil falls back to
       #   {DEFAULT_ALLOWED}.
+      # @param policy [OriginPolicy, nil] Captured policy also passed to the SDK
       # @param path [String, nil] When set, only requests whose PATH_INFO
       #   starts with this prefix are guarded — everything else passes
       #   straight through to the app. Nil (the default) guards every request.
@@ -82,27 +79,35 @@ module Woods
         method = env['REQUEST_METHOD']
         host = env['HTTP_HOST']
 
-        return forbidden if origin && !origin_allowed?(origin)
-        return forbidden_host if host && !host_allowed?(host)
+        return forbidden unless policy.origin_allowed?(origin, host: host)
+        return forbidden_host unless policy.host_allowed?(host)
 
         return preflight(origin) if method == 'OPTIONS'
 
         status, headers, body = @app.call(env)
-        headers = cors_headers(origin).merge(headers) if origin && origin_allowed?(origin)
+        headers = cors_headers(origin).merge(headers) if origin
         [status, headers, body]
       end
 
+      # The same lazily captured immutable policy is passed to the transport.
+      # @return [OriginPolicy]
+      def policy
+        return @policy if @policy
+
+        @policy_mutex.synchronize do
+          @policy ||= OriginPolicy.new(allowed_origins: @allowed_source.call)
+        end
+      end
+
       private
 
-      def initialize_options(app, allowed_origins: nil, path: nil, enabled: nil)
+      def initialize_options(app, allowed_origins: nil, path: nil, enabled: nil, policy: nil)
         @app = app
         @path = path
         @enabled = enabled
-        if allowed_origins.respond_to?(:call)
-          @allowed_source = allowed_origins
-        else
-          build_allow_list(allowed_origins)
-        end
+        @policy = policy
+        @policy_mutex = Mutex.new
+        @allowed_source = allowed_origins.respond_to?(:call) ? allowed_origins : -> { allowed_origins }
       end
 
       # @param env [Hash] Rack environment
@@ -114,66 +119,8 @@ module Woods
         true
       end
 
-      # Normalize a raw allow-list into `@allowed` + `@allowed_hosts`.
-      #
-      # @param origins [Array<String>, nil]
-      # @return [Array<String>] the normalized allow-list
-      def build_allow_list(origins)
-        allowed = Array(origins).compact.reject { |o| o.to_s.strip.empty? }.map { |o| normalize(o) }
-        allowed = DEFAULT_ALLOWED.dup if allowed.empty?
-        @allowed_hosts = allowed.map { |o| extract_host(o) }.compact.uniq
-        @allowed = allowed
-      end
-
-      # The allow-list, resolving a deferred source on first use. Memoized —
-      # configuration is settled by the time the first request arrives.
-      #
-      # @return [Array<String>]
-      def allowed
-        @allowed || build_allow_list(@allowed_source.call)
-      end
-
-      # @return [Array<String>] hosts extracted from the allow-list
-      def allowed_hosts
-        allowed
-        @allowed_hosts
-      end
-
-      def normalize(origin)
-        origin.to_s.sub(%r{/\z}, '').downcase
-      end
-
-      def extract_host(origin)
-        host = origin.to_s.sub(%r{\Ahttps?://}, '').sub(%r{/.*\z}, '').downcase
-        host.empty? ? nil : host
-      end
-
-      def host_allowed?(host)
-        # Canonicalize (strip port, trailing dot, IPv6 brackets) via the
-        # shared helper so Qdrant and OriginGuard stay in sync on bypass
-        # notations. `normalized` keeps the port for literal allow-list
-        # lookups; `bare` drops it for loopback matching.
-        normalized = host.to_s.downcase.sub(/\.\z/, '')
-        bare = Util::HostGuard.canonicalize(host)
-
-        # Reject non-canonical numeric hosts. Net::HTTP / getaddrinfo
-        # would happily resolve `0x7f000001` or `2130706433` to 127.0.0.1,
-        # bypassing the loopback allow-list.
-        return false if Util::HostGuard.suspicious_numeric_host?(bare)
-
-        return true if LOOPBACK_HOSTS.include?(bare)
-
-        allowed_hosts.include?(normalized) || allowed_hosts.include?(bare)
-      end
-
-      def origin_allowed?(origin)
-        return false if origin.match?(/[[:cntrl:]]/)
-
-        allowed.include?(normalize(origin)) || allowed.include?(normalize(origin).sub(/:\d+\z/, ''))
-      end
-
       def preflight(origin)
-        headers = origin && origin_allowed?(origin) ? cors_headers(origin) : {}
+        headers = origin ? cors_headers(origin) : {}
         [204, headers, []]
       end
 

data/lib/woods/mcp/origin_policy.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+require 'uri'
+require_relative '../util/host_guard'
+
+module Woods
+  module MCP
+    # Immutable HTTP policy shared by Woods preflight and the MCP transport.
+    # Explicit cross-origin entries normalize HTTP(S) default ports. A portless entry also permits
+    # same-authority requests on another port, which the SDK accepts natively.
+    # No request header is rewritten and SDK rebinding protection stays enabled.
+    class OriginPolicy
+      LOOPBACK_HOSTS = %w[localhost 127.0.0.1 ::1].freeze
+      DEFAULT_ORIGINS = %w[
+        http://localhost http://127.0.0.1 http://[::1]
+        https://localhost https://127.0.0.1 https://[::1]
+      ].freeze
+
+      # @param allowed_origins [Array<String>, nil] Explicit browser origins
+      def initialize(allowed_origins: nil)
+        entries = Array(allowed_origins).compact.reject do |entry|
+          entry.to_s.valid_encoding? && entry.to_s.strip.empty?
+        end
+        @explicit_origins = entries.map { |entry| configured_origin(entry) }.uniq.freeze
+        @allowed = (@explicit_origins.empty? ? DEFAULT_ORIGINS : @explicit_origins).freeze
+        @allowed_hosts = @explicit_origins.map do |origin|
+          host = authority(origin)
+          # SDK bare IPv6 host entries omit brackets; host:port entries retain
+          # them. URI#host alone retains brackets and loses explicit ports.
+          (host.end_with?(']') ? host[1...-1] : host).freeze
+        end.uniq.freeze
+        @transport_options = { allowed_origins: transport_origins, allowed_hosts: @allowed_hosts }.freeze
+        freeze
+      end
+
+      # @return [Hash] Constructor options supported by the MCP SDK
+      attr_reader :transport_options
+
+      # @param host [String, nil] Unmodified HTTP Host header
+      # @return [Boolean] Whether the request authority is allowed
+      def host_allowed?(host)
+        return true if host.nil?
+        return false unless host.is_a?(String) && host.valid_encoding?
+
+        parsed = parsed_origin("http://#{host}")
+        return false unless parsed
+
+        hostname = parsed.hostname.downcase
+        return false if Util::HostGuard.suspicious_numeric_host?(hostname)
+        return true if LOOPBACK_HOSTS.include?(hostname)
+
+        @allowed_hosts.include?(host.downcase) || @allowed_hosts.include?(hostname)
+      end
+
+      # @param origin [String, nil] Unmodified HTTP Origin header
+      # @param host [String, nil] Unmodified HTTP Host header
+      # @return [Boolean] Whether preflight and SDK dispatch can both accept it
+      def origin_allowed?(origin, host:)
+        return true if origin.nil?
+        return false unless parsed_origin(origin)
+
+        normalized = normalized_origin(origin)
+        return true if @explicit_origins.include?(normalized)
+        return false unless @allowed.include?(normalized) || @allowed.include?(normalized.sub(/:\d+\z/, ''))
+        return false unless host.is_a?(String) && host.valid_encoding?
+
+        # Matches the SDK's same-authority rule. The origin's scheme selects
+        # its default port; request.scheme is unreliable behind reverse proxies.
+        default_port = normalized.start_with?('https://') ? ':443' : ':80'
+        authority(normalized).delete_suffix(default_port) == host.downcase.delete_suffix(default_port)
+      end
+
+      private
+
+      def configured_origin(entry)
+        raw = entry.to_s
+        normalized = raw.downcase.sub(%r{/\z}, '') if raw.valid_encoding?
+        unless parsed_origin(normalized)
+          label = raw.b.byteslice(0, 160).inspect
+          raise ArgumentError, "Invalid MCP allowed origin #{label}: expected http(s)://host[:port] without a path"
+        end
+
+        normalized_origin(normalized).freeze
+      end
+
+      def normalized_origin(origin)
+        value = origin.downcase
+        value.delete_suffix(value.start_with?('https://') ? ':443' : ':80')
+      end
+
+      # The SDK compares configured origins literally. Include equivalent
+      # default-port spellings without rewriting the incoming request headers.
+      def transport_origins
+        @explicit_origins.flat_map do |origin|
+          parsed = parsed_origin(origin)
+          default = parsed.scheme == 'https' ? 443 : 80
+          parsed.port == default ? [origin, "#{origin}:#{default}"] : [origin]
+        end.uniq.map(&:freeze).freeze
+      end
+
+      def authority(origin)
+        origin.sub(%r{\Ahttps?://}, '')
+      end
+
+      # Parse only serialized HTTP origins, never URLs with paths, userinfo,
+      # query strings, fragments or whitespace. The comparison layer handles
+      # default-port equivalence separately from parsing.
+      def parsed_origin(origin)
+        return unless origin.is_a?(String) && origin.valid_encoding? && origin.ascii_only?
+        return if origin.match?(/[[:space:][:cntrl:]]/)
+
+        parsed = URI.parse(origin)
+        return unless %w[http https].include?(parsed.scheme&.downcase)
+        return unless parsed.host && !parsed.host.empty?
+        return unless parsed.path.to_s.empty? && !parsed.userinfo && !parsed.query && !parsed.fragment
+        return unless parsed.port&.between?(1, 65_535)
+
+        parsed
+      rescue URI::InvalidURIError, ArgumentError
+        nil
+      end
+    end
+  end
+end

data/lib/woods/railtie_support.rb

@@ -114,6 +114,7 @@ module Woods
         warn_late_console_path(config)
         return unless config.console_mcp_enabled && config.console_mcp_http_enabled
 
+        verify_console_origins!
         require 'woods/mcp/bearer_auth'
         token = config.console_mcp_token.to_s
         if token.empty?
@@ -147,6 +148,13 @@ module Woods
 
       private
 
+      def verify_console_origins!
+        require 'woods/mcp/origin_policy'
+        Woods::MCP::OriginPolicy.new(allowed_origins: config.console_mcp_allowed_origins)
+      rescue ArgumentError => e
+        raise Woods::ConfigurationError, "[Woods Console] #{e.message}"
+      end
+
       # Warn when the configured console path no longer matches the path the
       # stack was mounted at — the path was set after railtie initializers
       # captured the middleware arguments.

data/lib/woods/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Woods
-  VERSION = '2.0.0'
+  VERSION = '2.0.1'
 end

data/plugin/skills/woods-diagnose/SKILL.md

@@ -460,3 +460,14 @@ the named file before moving it aside, or choose a new export directory. Older v
 byte-identical generated assets into `_woods/ownership.json`; changed legacy sidecars may need this
 manual recovery. Never fabricate ownership receipts or remove personal files to silence the error.
 See the installed version's `docs/OBSIDIAN_INTEGRATION.md` for the exact safety contract.
+
+### Console read compatibility on security-patch candidates
+
+Verify the loaded revision for corrections after 2.0.0. Active redaction refuses
+SQL relation/CTE column alias lists; typed EAV matching can intentionally mask
+extra values where tables share a final name or differ only by case. Keep the
+policy enabled and use explicit scalar columns or structured tools. Check exact
+sensitive-key spelling and configure binary secret columns for column redaction.
+Read the [Console compatibility guide](https://github.com/lost-in-the/woods/blob/main/docs/CONSOLE_MCP_SETUP.md#read-policy-compatibility)
+at the installed revision for adapter, timeout and projection limits; a plugin
+update does not patch Woods.

data/plugin/skills/woods-mcp-config/SKILL.md

@@ -214,3 +214,18 @@ returned typed, SHA-guarded `full_evidence` lookup for verification. Published-u
 coordinates are not physical file offsets; unknown generation remains unknown.
 Keep full-source access available. See the canonical
 [evidence contract](https://github.com/lost-in-the/woods/blob/main/docs/RETRIEVAL_GUIDE.md#compact-published-evidence-and-api-outlines).
+
+### HTTP configuration diagnostics on security-patch candidates
+
+Check the installed revision before expecting this unreleased correction. Invalid
+origin settings, including invalidly encoded entries, refuse at boot. The HTTP
+executable reports one configuration diagnostic and exits 2. Correct the named
+entry and restart; keep authentication and origin checks enabled. Follow the
+installed revision's canonical `docs/MCP_HTTP_TRANSPORT.md` for accepted origins.
+
+Use whitespace-free literal origin entries; explicit lists replace browser
+defaults, and wildcard patterns are unsupported. Preserve the real Host behind
+proxies. Verify both preflight and bearer-authenticated dispatch against the
+[HTTP compatibility guide](https://github.com/lost-in-the/woods/blob/main/docs/MCP_HTTP_TRANSPORT.md#origin-configuration-compatibility)
+at the installed revision; configured non-loopback Hosts are passed to the SDK
+in supporting patches.

data/plugin/skills/woods-setup/SKILL.md

@@ -255,3 +255,11 @@ dependents and suggested tests manually; silence is not no impact. Do not clear
 refresh queues when optional hints time out. See the canonical
 [context guide](https://github.com/lost-in-the/woods/blob/main/docs/WATCH_DAEMON.md#optional-bounded-context-hints)
 for output/time limits, container root mapping and emitted-hint suppression.
+
+### Security-patch compatibility preflight
+
+For security-patch candidates after 2.0.0, record the loaded revision and gem
+path as well as the version. Review the [Console compatibility guide](https://github.com/lost-in-the/woods/blob/main/docs/CONSOLE_MCP_SETUP.md#read-policy-compatibility)
+and HTTP origin compatibility at that revision before upgrading an authorized
+Console installation. The plugin does not install these fixes or establish that
+a release is published.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: woods
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.0.1
 platform: ruby
 authors:
 - Leah Armstrong
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-23 00:00:00.000000000 Z
+date: 2026-09-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mcp
@@ -216,6 +216,7 @@ files:
 - lib/woods/checks/moved_messages.rb
 - lib/woods/chunking/chunk.rb
 - lib/woods/chunking/semantic_chunker.rb
+- lib/woods/console/adapter_family.rb
 - lib/woods/console/audit_logger.rb
 - lib/woods/console/bridge_protocol.rb
 - lib/woods/console/confirmation.rb
@@ -376,6 +377,7 @@ files:
 - lib/woods/mcp/index_reader_pinning.rb
 - lib/woods/mcp/initialization_guidance.rb
 - lib/woods/mcp/origin_guard.rb
+- lib/woods/mcp/origin_policy.rb
 - lib/woods/mcp/protocol_policy.rb
 - lib/woods/mcp/provider_probe.rb
 - lib/woods/mcp/published_lexical_retriever.rb
@@ -547,10 +549,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/lost-in-the/woods
-  source_code_uri: https://github.com/lost-in-the/woods/tree/v2.0.0
-  changelog_uri: https://github.com/lost-in-the/woods/blob/v2.0.0/CHANGELOG.md
+  source_code_uri: https://github.com/lost-in-the/woods/tree/v2.0.1
+  changelog_uri: https://github.com/lost-in-the/woods/blob/v2.0.1/CHANGELOG.md
   bug_tracker_uri: https://github.com/lost-in-the/woods/issues
-  documentation_uri: https://github.com/lost-in-the/woods/tree/v2.0.0/docs
+  documentation_uri: https://github.com/lost-in-the/woods/tree/v2.0.1/docs
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []