From d2c643da060153da255a1cbadc6a1b836d1162b9 Mon Sep 17 00:00:00 2001
From: PThorpe92 <preston@turso.tech>
Date: Mon, 22 Sep 2025 09:41:11 -0400
Subject: [PATCH 1/6] Add cli_only feature to core

---
 core/Cargo.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/core/Cargo.toml b/core/Cargo.toml
index b3898dc1b..7add4af52 100644
--- a/core/Cargo.toml
+++ b/core/Cargo.toml
@@ -30,6 +30,7 @@ serde = ["dep:serde"]
 series = []
 encryption = []
 checksum = []
+cli_only = []
 
 [target.'cfg(target_os = "linux")'.dependencies]
 io-uring = { version = "0.7.5", optional = true }

From cfa89c9ddbfbb75a3a1c363d46166261a58929df Mon Sep 17 00:00:00 2001
From: PThorpe92 <preston@turso.tech>
Date: Mon, 22 Sep 2025 09:41:36 -0400
Subject: [PATCH 2/6] use cli_only feature in CLI Cargo.toml

---
 cli/Cargo.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/cli/Cargo.toml b/cli/Cargo.toml
index d7e9c4c92..1e97383f5 100644
--- a/cli/Cargo.toml
+++ b/cli/Cargo.toml
@@ -28,7 +28,7 @@ ctrlc = "3.4.4"
 dirs = "5.0.1"
 env_logger = { workspace = true }
 libc = "0.2.172"
-turso_core = { path = "../core", default-features = true, features = [] }
+turso_core = { path = "../core", default-features = true, features = ["cli_only"] }
 limbo_completion = { path = "../extensions/completion", features = ["static"] }
 miette = { workspace = true, features = ["fancy"] }
 nu-ansi-term = {version = "0.50.1", features = ["serde", "derive_serde_style"]}

From 4ac4aff30ca096f5e45f95bc5b0f197438650df6 Mon Sep 17 00:00:00 2001
From: PThorpe92 <preston@turso.tech>
Date: Mon, 22 Sep 2025 09:42:07 -0400
Subject: [PATCH 3/6] Add a flag to DatabaseOpts, only for cli_only feature to
 enable rt extension loading

---
 core/lib.rs | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/core/lib.rs b/core/lib.rs
index f7d0421bb..d47c88d85 100644
--- a/core/lib.rs
+++ b/core/lib.rs
@@ -106,6 +106,7 @@ pub struct DatabaseOpts {
     pub enable_indexes: bool,
     pub enable_views: bool,
     pub enable_strict: bool,
+    enable_load_extension: bool,
 }
 
 impl Default for DatabaseOpts {
@@ -115,6 +116,7 @@ impl Default for DatabaseOpts {
             enable_indexes: true,
             enable_views: false,
             enable_strict: false,
+            enable_load_extension: false,
         }
     }
 }
@@ -124,6 +126,12 @@ impl DatabaseOpts {
         Self::default()
     }
 
+    #[cfg(feature = "cli_only")]
+    pub fn turso_cli(mut self) -> Self {
+        self.enable_load_extension = true;
+        self
+    }
+
     pub fn with_mvcc(mut self, enable: bool) -> Self {
         self.enable_mvcc = enable;
         self
@@ -755,6 +763,10 @@ impl Database {
         Ok((io, db))
     }
 
+    pub(crate) fn can_load_extensions(&self) -> bool {
+        self.opts.enable_load_extension
+    }
+
     #[inline]
     pub(crate) fn with_schema_mut<T>(&self, f: impl FnOnce(&mut Schema) -> Result<T>) -> Result<T> {
         let mut schema_ref = self.schema.lock().map_err(|_| LimboError::SchemaLocked)?;

From 8420b9be041d1583dfa9ae327b5ae79aa0bd728b Mon Sep 17 00:00:00 2001
From: PThorpe92 <preston@turso.tech>
Date: Mon, 22 Sep 2025 09:42:28 -0400
Subject: [PATCH 4/6] Disable runtime extension loading unless enabled

---
 core/vdbe/execute.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/core/vdbe/execute.rs b/core/vdbe/execute.rs
index ec1c9b526..efe652686 100644
--- a/core/vdbe/execute.rs
+++ b/core/vdbe/execute.rs
@@ -4781,6 +4781,9 @@ pub fn op_function(
             #[cfg(feature = "fs")]
             #[cfg(not(target_family = "wasm"))]
             ScalarFunc::LoadExtension => {
+                if !program.connection.db.can_load_extensions() {
+                    crate::bail_parse_error!("runtime extension loading is disabled");
+                }
                 let extension = &state.registers[*start_reg];
                 let ext = resolve_ext_path(&extension.get_value().to_string())?;
                 program.connection.load_extension(ext)?;

From 0c54c2b255dae5663c8ff6548dc654cbd16d0af4 Mon Sep 17 00:00:00 2001
From: PThorpe92 <preston@turso.tech>
Date: Mon, 22 Sep 2025 09:42:50 -0400
Subject: [PATCH 5/6] Add `turos_cli` option to CLI DatabaseOpts

---
 cli/app.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/cli/app.rs b/cli/app.rs
index ee432f55d..7b65a2a9c 100644
--- a/cli/app.rs
+++ b/cli/app.rs
@@ -184,7 +184,8 @@ impl Limbo {
                     .with_mvcc(opts.experimental_mvcc)
                     .with_indexes(indexes_enabled)
                     .with_views(opts.experimental_views)
-                    .with_strict(opts.experimental_strict),
+                    .with_strict(opts.experimental_strict)
+                    .turso_cli(),
                 None,
             )?;
             let conn = db.connect()?;

From 10662ee5c5ab2bd913a0cac2415f81ca468d12d2 Mon Sep 17 00:00:00 2001
From: PThorpe92 <preston@turso.tech>
Date: Mon, 22 Sep 2025 09:51:35 -0400
Subject: [PATCH 6/6] Fix error in test missing DatabaseOpts field

---
 core/incremental/cursor.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/core/incremental/cursor.rs b/core/incremental/cursor.rs
index bf500b450..963d813dd 100644
--- a/core/incremental/cursor.rs
+++ b/core/incremental/cursor.rs
@@ -316,6 +316,7 @@ mod tests {
                 enable_indexes: false,
                 enable_views: true,
                 enable_strict: false,
+                enable_load_extension: false,
             },
             None,
         )?;