[nickklos10]

Summary

In v0.1.1, row filters, masking, and max_rows could be bypassed with ordinary SQL. The validator also rejected common read-only queries (CTEs, UNION, ORDER BY on aliases), which would make LLM-generated SQL fail often. This PR rebuilds column resolution on sqlglot's scope analysis and fixes each bypass.

Bypasses reproduced on 0.1.1 (filter customers: tenant_id = 42, 50 of 500 customers in tenant 42):

Query	0.1.1	This PR
SELECT (SELECT COUNT(*) FROM customers) AS n FROM customers LIMIT 1	500	50
SELECT COUNT(*) FROM (SELECT id, 42 AS tenant_id FROM customers)	500	50
... FROM orders o WHERE o.customer_id IN (SELECT c.id FROM customers c)	filter bound to orders.tenant_id; 2000 rows	203 (correct)
SELECT email AS contact FROM customers with email masked	raw email	[REDACTED]
SELECT id FROM orders LIMIT -1 with max_rows=100	2000 rows	100

Changes

• Scope-aware validation. Columns resolve through sqlglot.optimizer.scope, so CTEs (including recursive CTEs and CTE column lists), UNION/INTERSECT/EXCEPT, derived-table qualifiers, ORDER BY/HAVING on select aliases, and correlated or IN subqueries now validate. Unknown and ambiguous columns still fail closed. ValidationResult.tables lists only physical tables, not CTE names.
• Row filters wrap each table reference. Each reference becomes (SELECT * FROM t WHERE <filter>) AS t, so the filter applies at every scope and cannot bind to another table's column or a spoofed alias. LEFT JOIN semantics are kept, which a per-scope WHERE would break. ⚠️ Rewritten SQL for filtered queries changes shape; the two tests asserting the old form are updated.
• Lineage-based masking. The new ValidationResult.output_masks records a masking mode per output position. Aliases, expressions, CASE, string and json functions, CTEs, derived tables, scalar subqueries, and set-op branches are masked. COUNT(masked_col) is left unmasked. If a row's shape doesn't match the analyzed projection (for example, duplicate column names, or a USING join's star), every value is masked.
• LIMIT cap. Anything other than a non-negative integer literal within max_rows is replaced: LIMIT -1, expressions, subqueries, and FETCH.
• Read-only. SELECT ... INTO is rejected. SQLite is opened with mode=ro, matching the Postgres READ ONLY transaction.
• Missing fixture. A missing SQLite file raises FileNotFoundError instead of silently creating an empty database. eval run exits early with Fixture database not found: <path>.
• Dependency floor. sqlglot>=25.20. The old >=25.0 floor was already broken: 0.1.1's validator uses exp.Alter, which doesn't exist before roughly 25.20.

Testing

• pytest passes locally (354 passed). The 40 new or updated tests fail on main's src/.
• New behavior has a unit test
• Validator/safety changes include a safety-suite case (blocks_select_into)
• User-facing CLI changes have a CLI test (missing fixture DB)
• CHANGELOG.md updated under [Unreleased]
• Eval baseline unchanged: smoke is 3/3, safety is 8/8, and eval check passes against .eval/baseline.json

Also tested:

• Full suite on sqlglot 25.20.0, 27.0.0, 30.0.0, and 30.24.0. One upstream issue: sqlglot before 30.24 drops a CTE column list (r(n)) from SQLite output, so such queries fail at execution. That fails closed.
• Adversarial probes for shadowed CTE/table names, schema-qualified and quoted names, self joins, USING/NATURAL star joins, table-valued functions, and sqlite_master. No leaks; the unsupported forms are rejected.

Not covered:

• The Postgres connector was not run against a live database.
• A masked column used only in a predicate (WHERE email LIKE 'a%') can still allow inference. That behavior is unchanged from 0.1.1.
• ruff check src tests reports 44 findings on main with the unpinned ruff 0.17. This branch adds none.

🤖 Generated with Claude Code