尽快推进：收紧tooldata外部DB边界

check-linuxcnc-tooldata-source-map.sh

@@ -28,6 +28,14 @@ grep -F 'int tool_nml_register(CANON_TOOL_TABLE *tblptr)' \
     "$linuxcnc_root/src/emc/tooldata/tooldata_nml.cc" >/dev/null
 grep -F 'int tooldata_db_init(char progname_plus_args[]' \
     "$linuxcnc_root/src/emc/tooldata/tooldata_db.cc" >/dev/null
+grep -F '#define MAX_DB_PROGRAM_ARGS 10' \
+    "$linuxcnc_root/src/emc/tooldata/tooldata_db.cc" >/dev/null
+grep -F 'char* token = strtok_r(progname_plus_args, " ", &saveptr);' \
+    "$linuxcnc_root/src/emc/tooldata/tooldata_db.cc" >/dev/null
+grep -F 'if (child_argc >= MAX_DB_PROGRAM_ARGS)' \
+    "$linuxcnc_root/src/emc/tooldata/tooldata_db.cc" >/dev/null
+grep -F 'if (access(child_argv[0],X_OK))' \
+    "$linuxcnc_root/src/emc/tooldata/tooldata_db.cc" >/dev/null
 grep -F 'int tooldata_db_getall() {' \
     "$linuxcnc_root/src/emc/tooldata/tooldata_db.cc" >/dev/null
 grep -F 'if (!db_live) {return -1;}' \
@@ -72,6 +80,14 @@ grep -F 'LinuxCNC source basis: src/emc/tooldata/tooldata_mmap.cc provides these
     core/wasm_shims/tooldata/tooldata_mmap_backend.cc >/dev/null
 grep -F 'LinuxCNC source basis: src/emc/tooldata/tooldata_nml.cc and tooldata_db.cc' \
     core/wasm_shims/tooldata/tooldata_runtime_stubs.cc >/dev/null
+grep -F 'constexpr int MAX_DB_PROGRAM_ARGS = 10;' \
+    core/wasm_shims/tooldata/tooldata_runtime_stubs.cc >/dev/null
+grep -F 'strtok_r(progname_plus_args, " ", &saveptr)' \
+    core/wasm_shims/tooldata/tooldata_runtime_stubs.cc >/dev/null
+grep -F 'argc exceeds MAX_DB_PROGRAM_ARGS=%d' \
+    core/wasm_shims/tooldata/tooldata_runtime_stubs.cc >/dev/null
+grep -F 'access(program, X_OK) != 0' \
+    core/wasm_shims/tooldata/tooldata_runtime_stubs.cc >/dev/null
 grep -F 'returns 0 when' core/wasm_shims/tooldata/tooldata_runtime_stubs.cc >/dev/null
 grep -F 'LinuxCNC source basis: src/emc/tooldata/tooldata_common.cc provides' \
     core/wasm_shims/tooldata/tooldata_common_probe_main.cc >/dev/null
@@ -79,6 +95,14 @@ grep -F 'LinuxCNC source basis: src/emc/tooldata/tooldata_mmap.cc, tooldata_nml.
     core/wasm_shims/tooldata/tooldata_probe_main.cc >/dev/null
 grep -F 'tooldata_db_notify() returns 0 without side effects while db_live is' \
     core/wasm_shims/tooldata/tooldata_probe_main.cc >/dev/null
+grep -F 'tooldata_db_init(missing_db_program_with_arg.data(), 1) != -1' \
+    core/wasm_shims/tooldata/tooldata_probe_main.cc >/dev/null
+grep -F 'missing_db_program_with_arg[separator] != 0' \
+    core/wasm_shims/tooldata/tooldata_probe_main.cc >/dev/null
+grep -F 'tooldata_db_init(too_many_db_args, 1) != -1' \
+    core/wasm_shims/tooldata/tooldata_probe_main.cc >/dev/null
+grep -F 'tooldata_db_init(non_db_program, 1) != -1' \
+    core/wasm_shims/tooldata/tooldata_probe_main.cc >/dev/null
 grep -F 'core/wasm_shims/tooldata/tooldata_mmap_backend.cc' docs/linuxcnc-wasm-shims-source-map.md >/dev/null
 grep -F 'core/wasm_shims/tooldata/tooldata_runtime_stubs.cc' docs/linuxcnc-wasm-shims-source-map.md >/dev/null
 
@@ -90,6 +114,9 @@ grep -F 'LinuxCNC source basis: this symbol probe compares the wasm mmap backend
     test-linuxcnc-wasm-tooldata-mmap-symbols.sh >/dev/null
 grep -F 'LinuxCNC source basis: this probe compares wasm-safe tooldata runtime stubs' \
     test-linuxcnc-wasm-tooldata-runtime-symbols.sh >/dev/null
+grep -F '!!!!db_init: argc exceeds MAX_DB_PROGRAM_ARGS=10' \
+    test-linuxcnc-wasm-tooldata-link.sh >/dev/null
+grep -F 'not executable' test-linuxcnc-wasm-tooldata-link.sh >/dev/null
 grep -F 'run_parallel_wasm_probe "LinuxCNC wasm tooldata shim link probe" ./test-linuxcnc-wasm-tooldata-link.sh' \
     build-wasm.sh >/dev/null
 grep -F 'run_parallel_wasm_probe "LinuxCNC wasm tooldata_common link probe" ./test-linuxcnc-wasm-tooldata-common-link.sh' \
@@ -177,6 +204,11 @@ for phrase in [
     "source coverage only",
     "must not become browser API fields",
     "WASM-safe tooldata shims must preserve the LinuxCNC export surface",
+    "must keep external DB services unavailable",
+    "must not fork, exec, poll",
+    "MAX_DB_PROGRAM_ARGS=10",
+    "`strtok_r()` argument splitting",
+    "access(..., X_OK)",
     "inactive-DB return values",
     "./check-linuxcnc-tooldata-source-map.sh",
     "does not interpret G-code",

docs/linuxcnc-tooldata-source-map.md

@@ -37,6 +37,16 @@ source-link/shim guard only; it must not add CNC behavior and must not expand th
 | `test-linuxcnc-wasm-tooldata-mmap-symbols.sh` | Compares wasm mmap backend exports with LinuxCNC `tooldata_mmap.cc`. |
 | `test-linuxcnc-wasm-tooldata-runtime-symbols.sh` | Compares runtime stub exports with LinuxCNC `tooldata_db.cc` and `tooldata_nml.cc`. |
 
+## External DB Stub Boundaries
+
+- `core/wasm_shims/tooldata/tooldata_runtime_stubs.cc` must keep external DB services unavailable for browser-safe probes; it must not fork, exec, poll,
+  or keep a live external database process.
+- `tooldata_db_init()` must preserve the LinuxCNC `MAX_DB_PROGRAM_ARGS=10`, `strtok_r()` argument splitting, and `access(..., X_OK)` rejection edges from
+  `src/emc/tooldata/tooldata_db.cc` before returning `-1`.
+- `tooldata_db_getall()` must return `-1` while `db_live` is false, and
+  `tooldata_db_notify()` must return `0` without side effects while `db_live`
+  is false.
+
 ## Boundaries
 
 - Tool table files referenced by switchkins INI files are source coverage only;