fix(sqlite): harden pragma policy and db caps#1521
Merged
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
bashkit | 66f7e7c | Commit Preview URL Branch Preview URL |
May 04 2026, 02:44 AM |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
chaliy
added a commit
that referenced
this pull request
May 4, 2026
Minor release bumping `0.3.0` → `0.4.0`. ## Highlights - **Builtin extension abstraction** — New public `Extension` trait groups related builtins for one-call registration on `BashBuilder`/`BashToolBuilder`. TypeScript registration now flows through `TypeScriptExtension`, and `ScriptedTool` reuses a shared `ToolDefExtension` for its per-call logic shell (#1515, #1518). - **Clap-backed custom builtins** — Custom builtins can now be defined declaratively against a `clap` parser, replacing hand-rolled arg parsing for new integrations (#1514). - **SQLite session engine cache** — The `sqlite` builtin keeps a session-scoped engine alive across `exec()` calls, so transactions and prepared state survive multiple shell invocations within one session (#1513). - **SQLite hardening follow-up** — PRAGMA policy parsing now handles SQL comments and quoted/bracket/backtick identifiers (closing a `PRAGMA main."cache_size"` bypass), and `max_db_bytes` is enforced consistently across VFS writes/truncates and memory-backend persistence (#1521). - **Python + toolchain bumps** — Embedded Python (`monty`) bumped to `0.0.17` and Rust toolchain bumped to `1.95.0` across `rust-toolchain.toml` and matching CI workflow refs (#1520). ## Files - `Cargo.toml`, `crates/bashkit-cli/Cargo.toml`, `Cargo.lock` → `0.4.0` - `crates/bashkit-js/package.json`, `crates/bashkit-js/package-lock.json` → `0.4.0` - `CHANGELOG.md` — new `[0.4.0] - 2026-05-04` section On merge, `release.yml` will create the GitHub Release and dispatch the publish workflows for crates.io, PyPI, npm, and Homebrew. **Full Changelog**: v0.3.0...v0.4.0 --- _Generated by [Claude Code](https://claude.ai/code/session_01MTiBUK5YiumTRtqjogv9A5)_
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Harden the experimental SQLite builtin after exploratory black-box and white-box testing.
Why
Exploratory probes found two issues:
PRAGMA main."cache_size"bypassed the deny listmax_db_byteswhile growingSQLite remains opt-in for now.
How
max_db_bytesduring VFS writes/truncates and before memory-backend persistence.Risk
Checklist
Verification:
cargo test --features sqlite -p bashkit --lib sqlitecargo test --features sqlite -p bashkit --test sqlite_security_tests --test sqlite_integration_tests --test sqlite_compat_tests --test sqlite_differential_tests --test sqlite_fuzz_testsjust pre-prcargo run -q -p bashkit-cli -- -c "sqlite :memory: 'PRAGMA main.\"cache_size\"'"