SwiftSQLite: sandboxed sqlite3 command for SwiftBash (M0–M6)

[ronaldmannak]

Implements PLAN.md (rev. 2) — a sandboxed sqlite3 command for SwiftBash, backed by a vendored, compile-time-hardened libsqlite3. Milestones M0–M6 (M7, the optional shim VFS, deferred per §13).

Layers

• CSQLite — vendored SQLite amalgamation with §6 hardening flags (OMIT_LOAD_EXTENSION, DQS=0, USE_URI=0, …) + a committed C shim for the variadic sqlite3_db_config. The amalgamation is not committed: scripts/fetch-sqlite.sh downloads + SHA3-256-verifies it (pinned in Sources/CSQLite/VERSION), mirroring SwiftBash's fetch-bun-webkit.sh.
• SwiftSQLiteKit (SwiftBash-agnostic) — the SQLiteConnection actor: gated open (NOFOLLOW, no URI), authorizer policy (deny ATTACH/all user PRAGMA/schema + reserved _audit* writes, default-deny), runtime hardening, row cap, timeout + interrupt-on-cancel, and a two-tier audit (attempted via the authorizer; committed via the update/commit/rollback hooks) flushed outside the DB.
• SwiftSQLiteBash — SqliteCommand (argv/options/stdin, 5 output modes, safe dot-commands via sqlite_schema, disabled ones error), the §4 native-file contract guard, and Shell.registerSQLiteCommands(at:).

Tests (§12)

Engine CRUD/value/error mapping, row-cap truncation, timeout interrupt, open-gate rejection; every authorizer denial; audit semantics (committed in both streams, a rolled-back DELETE only in attempted, the file trail surviving DROP TABLE); the contract-guard matrix and SQL escape hatches end-to-end.

⚠️ Please note for review

• This was authored in an environment with no Swift toolchain (couldn't install one — download.swift.org was network-blocked), so it is grounded in SwiftBash's actual public APIs read from source, but not compiler-verified by me. This PR's CI run is the first real compile/test — I'm watching it and will push fixes for whatever it flags.
• The SQLite SHA3-256 is pinned, so CI fetches → verifies → builds → tests on macOS (Xcode 26 / Swift 6.2) and Linux (swift:6.2-noble). Toolchain pins may need adjusting to your runners; Swift ≥ 6.2 is required because SwiftBash's manifest declares tools-version 6.2.

See PLAN.md for the full design and README.md for build/usage.

https://claude.ai/code/session_01AdvNtQ7wCMVy8etacVQbjg

---

Generated by Claude Code