affad04e22
Add scripts/cuda-kernel-guard.sh — catches CPU/host leaks in .cu files: printf, cudaMalloc/Free, host API calls, double-precision math (exp/log instead of expf/logf), assert, file I/O. Filters comments and trailing /* */ annotations. Zero false positives across 38 production kernels. Extend gpu-hotpath-hook.sh to route .cu/.cuh files to the new guard. Configure ruflo hooks in .claude/settings.json: pre-edit context loading, post-edit pattern learning, post-command metrics, session-end persistence. Fires for subagents too via Claude Code hook system. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
46 lines
1.4 KiB
Bash
Executable File
46 lines
1.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# Claude Code PostToolUse hook: HARD ERROR on GPU→CPU leaks in hot-path files.
|
|
# Reads JSON from stdin (Claude Code hook input), extracts file_path, runs guard.
|
|
# Exit 1 = leak detected → Claude Code blocks the edit and must fix immediately.
|
|
set -euo pipefail
|
|
|
|
INPUT=$(cat)
|
|
FILE=$(echo "$INPUT" | jq -r '.tool_input.file_path // .tool_input.path // empty' 2>/dev/null)
|
|
|
|
if [ -z "$FILE" ] || [ ! -f "$FILE" ]; then
|
|
exit 0
|
|
fi
|
|
|
|
# Check Rust and CUDA files
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
|
|
case "$FILE" in
|
|
*.rs)
|
|
GUARD="$SCRIPT_DIR/gpu-hotpath-guard.sh"
|
|
if [ -x "$GUARD" ]; then
|
|
OUTPUT=$("$GUARD" "$FILE" 2>&1) || {
|
|
echo "⛔ GPU HOT-PATH HARD ERROR in $FILE"
|
|
echo "$OUTPUT"
|
|
echo ""
|
|
echo "CPU usage in GPU hot paths is NOT allowed. Fix the code — do not annotate with // gpu-ok:"
|
|
exit 1
|
|
}
|
|
fi
|
|
;;
|
|
*.cu|*.cuh)
|
|
GUARD="$SCRIPT_DIR/cuda-kernel-guard.sh"
|
|
if [ -x "$GUARD" ]; then
|
|
OUTPUT=$("$GUARD" "$FILE" 2>&1) || {
|
|
echo "⛔ CUDA KERNEL HARD ERROR in $FILE"
|
|
echo "$OUTPUT"
|
|
echo ""
|
|
echo "CPU/host operations in CUDA kernels are NOT allowed."
|
|
exit 1
|
|
}
|
|
fi
|
|
;;
|
|
*) exit 0 ;;
|
|
esac
|
|
|
|
exit 0
|