Disallow the undocumented -recovery-db option on the ".recover" command

of the CLI when in --safe mode.

FossilOrigin-Name: 65202440874a7fea5aba262e8e78b97c833147d47837a99f301eca968f9a78b1

manifest

@@ -1,5 +1,5 @@
-C Tweaks\sto\sthe\swcwidth()\salgorithm\sin\sQRF,\sfor\sbetter\sagreement\swith\nthe\sTerminal\son\sUbuntu.\s\sThere\sis\sno\sperfect\ssolution,\sas\sdifferent\nttys\sdo\sthings\sdifferently,\sbut\swe\sshould\stry\sto\sget\sas\sclose\sas\swe\ncan.
-D 2025-11-30T23:09:24.695
+C Disallow\sthe\sundocumented\s-recovery-db\soption\son\sthe\s".recover"\scommand\nof\sthe\sCLI\swhen\sin\s--safe\smode.
+D 2025-12-01T11:07:31.854
 F .fossil-settings/binary-glob 61195414528fb3ea9693577e1980230d78a1f8b0a54c78cf1b9b24d0a409ed6a x
 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1
 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea
@@ -736,7 +736,7 @@ F src/random.c 606b00941a1d7dd09c381d3279a058d771f406c5213c9932bbd93d5587be4b9c
 F src/resolve.c 5616fbcf3b833c7c705b24371828215ad0925d0c0073216c4f153348d5753f0a
 F src/rowset.c 8432130e6c344b3401a8874c3cb49fefe6873fec593294de077afea2dce5ec97
 F src/select.c 6a509cddd815d64f6141e539fff633a518a393772a44dffb4490f7fc3f0d83a9
-F src/shell.c.in c850d2545ba70b4d3b318256b98a65186bceda164c244c02aad5fed58900d164
+F src/shell.c.in 8ec8bf61a3322c5e29c286d4aecbc82e25157df9244cb1a1a1c4e2c49de8b64d
 F src/sqlite.h.in 706cacea5308b0244fb6cec92e08310fb427a125375c64137cc1f878ae4cf5c0
 F src/sqlite3.rc 015537e6ac1eec6c7050e17b616c2ffe6f70fca241835a84a4f0d5937383c479
 F src/sqlite3ext.h 5d5330f5f8461f5ce74960436ddcfa53ecd09c2b8b23901e22ae38aec3243998
@@ -2180,8 +2180,8 @@ F tool/version-info.c 33d0390ef484b3b1cb685d59362be891ea162123cea181cb8e6d2cf6dd
 F tool/warnings-clang.sh bbf6a1e685e534c92ec2bfba5b1745f34fb6f0bc2a362850723a9ee87c1b31a7
 F tool/warnings.sh d924598cf2f55a4ecbc2aeb055c10bd5f48114793e7ba25f9585435da29e7e98
 F tool/win/sqlite.vsix deb315d026cc8400325c5863eef847784a219a2f
-P 484d1fd2a240c8fd006e7794936d6678b8db792a8b2b30d2ae5baf5a1b19463a
-R 421579a1dc9b719bd685b85a638635dd
+P 35f39f7cb1030b1a57f2921f50ab600496fc1e774593717845e87f2e47dc49ba
+R a7ecee17b65f2e02eed8810e0fb1d4ba
 U drh
-Z 45edc4a3bdf06ba616e7832a1c1aa528
+Z 50d000086ea0500f9c141c467282e85a
 # Remove this line to create a well-formed Fossil manifest.

manifest.uuid

@@ -1 +1 @@
-35f39f7cb1030b1a57f2921f50ab600496fc1e774593717845e87f2e47dc49ba
+65202440874a7fea5aba262e8e78b97c833147d47837a99f301eca968f9a78b1

src/shell.c.in

@@ -6896,7 +6896,9 @@ static int recoverDatabaseCmd(ShellState *pState, int nArg, char **azArg){
       pState->db, "main", recoverSqlCb, (void*)pState
   );
 
-  sqlite3_recover_config(p, 789, (void*)zRecoveryDb);  /* Debug use only */
+  if( !pState->bSafeMode ){
+    sqlite3_recover_config(p, 789, (void*)zRecoveryDb);  /* Debug use only */
+  }
   sqlite3_recover_config(p, SQLITE_RECOVER_LOST_AND_FOUND, (void*)zLAF);
   sqlite3_recover_config(p, SQLITE_RECOVER_ROWIDS, (void*)&bRowids);
   sqlite3_recover_config(p, SQLITE_RECOVER_FREELIST_CORRUPT,(void*)&bFreelist);