Merge pull request #23 from ParaToolsInc/llvm-20

Bump default toolchain to LLVM 20

Author: zbeekman

.claude/skills/build/SKILL.md

@@ -23,3 +23,7 @@ Build the project Docker images:
 4. If $ARGUMENTS contains "devtools" or "all":
    - Build devtools: `docker buildx build --builder salt-8cpu -f Dockerfile.devtools -t salt-dev-tools --load .`
 5. Report build success/failure and image sizes via `docker images | grep salt-dev`
+6. If $ARGUMENTS contains "intel" or "ifx":
+   - `docker run -it --name salt-ifx salt-dev-tools install-intel-ifx.sh --trust-intel-repo`
+   - **Reset CMD** (docker commit inherits the running command): `docker commit --change='CMD ["/bin/bash"]' salt-ifx salt-dev-tools:intel-<version>`
+   - `docker rm salt-ifx`

.dockerignore

@@ -4,6 +4,7 @@ Dockerfile.devtools
 **/.DS_Store
 /.github/
 *.md
+!claude-user-CLAUDE.md
 LICENSE
 /patches/README.md
 /patches/LICENSE

.github/workflows/CI.yml

@@ -48,6 +48,8 @@ jobs:
               - 'build-llvm.sh'
               - 'docker-entrypoint.sh'
               - 'install-intel-ifx.sh'
+              - 'claude-statusline.sh'
+              - 'claude-user-CLAUDE.md'
               - 'patches'
               - 'patches/**'
               - '.dockerignore'

.gitignore

@@ -1,2 +1,4 @@
 .claude/worktrees/**
 .claude/settings.local.json
+last-claude-session.txt
+*.tgz

CLAUDE.md

@@ -23,3 +23,52 @@ git clone --recursive git@github.com:ParaToolsInc/salt-dev.git # patches/ submod
 - PDT checksum (`2fc9e86...`) pinned in `Dockerfile` -- update if upstream changes `pdt_lite.tgz`
 - LLVM build: 150-200 min cold, ~4 min with ccache; `ARG PHASED_BUILD=true` enables OOM-aware phased build
 - Intel IFX APT repo has signature verification issues on Debian 13+ (sqv rejects Intel's OpenPGP format); `install-intel-ifx.sh` detects and prompts for `[trusted=yes]`
+- `docker commit` captures the running command as the new `CMD`. After committing a container that ran `install-intel-ifx.sh`, reset `CMD` with: `docker commit --change='CMD ["/bin/bash"]' <container> <image:tag>`
+
+## Working Style
+
+Behavioral guidelines (adapted from [andrej-karpathy-skills](https://github.com/forrestchang/andrej-karpathy-skills/blob/main/CLAUDE.md)) to reduce common LLM coding mistakes. These bias toward caution over speed; use judgment for trivial tasks.
+
+### Think Before Coding
+
+Don't assume. Don't hide confusion. Surface tradeoffs.
+
+- State assumptions explicitly. If uncertain, ask.
+- If multiple interpretations exist, present them -- don't pick silently.
+- If a simpler approach exists, say so. Push back when warranted.
+- If something is unclear, stop. Name what's confusing. Ask.
+
+### Simplicity First
+
+Minimum code that solves the problem. Nothing speculative.
+
+- No features beyond what was asked.
+- No abstractions for single-use code.
+- No "flexibility" or "configurability" that wasn't requested.
+- No error handling for impossible scenarios.
+- If you write 200 lines and it could be 50, rewrite it.
+
+Test: "Would a senior engineer say this is overcomplicated?" If yes, simplify.
+
+### Surgical Changes
+
+Touch only what you must. Clean up only your own mess.
+
+- Don't "improve" adjacent code, comments, or formatting.
+- Don't refactor things that aren't broken.
+- Match existing style, even if you'd do it differently.
+- If you notice unrelated dead code, mention it -- don't delete it.
+- Remove imports/variables/functions that YOUR changes made unused.
+- Don't remove pre-existing dead code unless asked.
+
+Every changed line should trace directly to the user's request.
+
+### Goal-Driven Execution
+
+Define success criteria. Loop until verified.
+
+- "Add validation" -> "Write tests for invalid inputs, then make them pass"
+- "Fix the bug" -> "Write a test that reproduces it, then make it pass"
+- "Refactor X" -> "Ensure tests pass before and after"
+
+For multi-step tasks, state a brief plan with verification per step. Strong success criteria let you loop independently; weak criteria ("make it work") require constant clarification.

Dockerfile

@@ -107,15 +107,23 @@ set -euo pipefail
   ccache -s
 
   # Configure the build
+  # LLVM >= 20: openmp moved from PROJECTS to RUNTIMES (hard error in LLVM 21)
+  if [ "${LLVM_VER}" -ge 20 ]; then
+    LLVM_PROJECTS="flang;clang;clang-tools-extra;mlir"
+    LLVM_RUNTIMES="compiler-rt;openmp"
+  else
+    LLVM_PROJECTS="flang;clang;clang-tools-extra;mlir;openmp"
+    LLVM_RUNTIMES="compiler-rt"
+  fi
   CMAKE_EXTRA_ARGS=()
   if uname -a | grep x86 ; then CMAKE_EXTRA_ARGS+=("-DLLVM_TARGETS_TO_BUILD=X86"); fi
   cmake -GNinja \
     -DCMAKE_INSTALL_PREFIX=/tmp/llvm \
     -DCMAKE_MAKE_PROGRAM=/usr/local/bin/ninja \
     -DCMAKE_BUILD_TYPE=Release \
     -DLLVM_CCACHE_BUILD=On \
-    -DLLVM_ENABLE_PROJECTS="flang;clang;clang-tools-extra;mlir;openmp" \
-    -DLLVM_ENABLE_RUNTIMES="compiler-rt" \
+    -DLLVM_ENABLE_PROJECTS="$LLVM_PROJECTS" \
+    -DLLVM_ENABLE_RUNTIMES="$LLVM_RUNTIMES" \
     "${CMAKE_EXTRA_ARGS[@]}" \
     -S /llvm-project/llvm -B /llvm-project/llvm/build
 
@@ -131,7 +139,6 @@ set -euo pipefail
     install-clang-resource-headers
     install-mlir-headers install-mlir-libraries install-mlir-cmake-exports
     install-openmp-resource-headers
-    install-compiler-rt
   )
 
   # LLVM >= 20 renamed the 'flang-new' binary to 'flang' and its install target accordingly
@@ -144,6 +151,13 @@ set -euo pipefail
     install-FortranParser install-FortranRuntime install-FortranSemantics
   )
 
+  # Use install-runtimes (aggregate target) because individual runtime install
+  # targets (e.g. install-omp) aren't forwarded from the ExternalProject sub-build.
+  # Runs after flang so the openmp cmake detects flang and builds Fortran modules.
+  RUNTIME_TARGETS=(
+    install-runtimes
+  )
+
   ccache -s
 
   if ${PHASED_BUILD:-true}; then
@@ -178,10 +192,14 @@ set -euo pipefail
     # Phase 3: Flang targets at full parallelism (OOM .o files pre-built)
     echo "--- Phase 3: Flang targets (parallel, OOM files pre-built) ---"
     build-llvm.sh "${BUILD_LLVM_ARGS[@]}" "${FLANG_TARGETS[@]}"
+
+    # Phase 4: Runtime targets (parallel, requires clang+flang for Fortran modules)
+    echo "--- Phase 4: Runtime targets (parallel) ---"
+    build-llvm.sh "${BUILD_LLVM_ARGS[@]}" "${RUNTIME_TARGETS[@]}"
   else
     # Single pass: all targets at once (use PHASED_BUILD=false to select)
     build-llvm.sh "${BUILD_LLVM_ARGS[@]}" \
-      "${NON_FLANG_TARGETS[@]}" "${FLANG_TARGETS[@]}"
+      "${NON_FLANG_TARGETS[@]}" "${FLANG_TARGETS[@]}" "${RUNTIME_TARGETS[@]}"
   fi
 
   rm -rf /llvm-project/llvm
@@ -262,6 +280,12 @@ COPY --from=builder /usr/local/bin/ninja /usr/local/bin/
 # Copy build results of stage 1 to /usr/local.
 COPY --from=builder /tmp/llvm/ /usr/
 
+# Register LLVM per-target runtime dir with the dynamic linker.
+# LLVM normalizes all triples to include the vendor (x86_64-unknown-linux-gnu),
+# which differs from Debian's multiarch path (x86_64-linux-gnu).
+# hadolint ignore=SC2046
+RUN echo /usr/lib/$(clang -dumpmachine) > /etc/ld.so.conf.d/llvm-runtimes.conf && ldconfig
+
 # Setup ccache
 ENV CCACHE_DIR=/home/salt/ccache
 

Dockerfile.devtools

@@ -42,16 +42,19 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
 set -euo pipefail
   apt-get update
   apt-get install -y --no-install-recommends \
+    bat \
+    bubblewrap \
     emacs-nox \
+    gdb \
     gh \
-    nodejs npm \
-    ripgrep \
-    silversearcher-ag \
     htop \
-    gdb \
     jq \
+    nodejs npm \
     python3 \
-    bat \
+    ripgrep \
+    shellcheck \
+    silversearcher-ag \
+    socat \
     sudo \
     valgrind
   # Symlink batcat to bat for convenience (Debian name conflict)
@@ -61,20 +64,91 @@ set -euo pipefail
   rm -rf /var/lib/apt/lists/*
 EOC
 
-# Install Claude Code globally via npm
-# Intentionally unpinned: always install latest Claude Code
+# Install Claude Code sandbox runtime globally via npm, then do a
+# native per-user install of Claude Code for the salt user.
+# Intentionally unpinned: always install latest versions
 # hadolint ignore=DL3016
-RUN npm install -g @anthropic-ai/claude-code
+RUN npm install -g @anthropic-ai/claude-code @anthropic-ai/sandbox-runtime
+USER salt
+RUN claude install
+USER root
+RUN npm uninstall -g @anthropic-ai/claude-code
+
+# Install caveman skill (https://github.com/JuliusBrussee/caveman)
+# Pinned to v1.6.0 commit for supply-chain integrity (no curl|bash).
+# Default mode "full" written to ~/.claude/.caveman-active so statusline shows badge
+# from first launch and caveman-activate.js sees existing state on session start.
+ARG CAVEMAN_REF=c2ed24b3e5d412cd0c25197b2bc9af587621fd99
+USER salt
+# hadolint ignore=DL3003
+RUN <<EOC
+#!/usr/bin/env bash
+set -euo pipefail
+  # Pre-seed settings.json so install.sh's backup step has a file to back up
+  mkdir -p ~/.claude
+  [ -f ~/.claude/settings.json ] || echo '{}' > ~/.claude/settings.json
+  git clone https://github.com/JuliusBrussee/caveman /tmp/caveman
+  cd /tmp/caveman
+  git checkout "${CAVEMAN_REF}"
+  bash hooks/install.sh
+  rm -rf /tmp/caveman
+  echo "full" > ~/.claude/.caveman-active
+  # Merge statusLine + attribution into settings.json caveman just wrote.
+  # statusLine references our portable statusline script; attribution disables
+  # co-author lines in commits/PRs (project policy).
+  jq '.statusLine = {"type":"command","command":"bash ~/.claude/statusline-command.sh"} | .attribution = {"commit":"","pr":""}' \
+    ~/.claude/settings.json > /tmp/settings.json
+  mv /tmp/settings.json ~/.claude/settings.json
+EOC
+
+USER root
+
+# Install multithreaded FPM (Fortran Package Manager)
+# install.sh bootstraps fpm from source: downloads a single-file bootstrap,
+# compiles it, then uses it to build the real fpm from the repo with OpenMP.
+# Intentionally unpinned: always install latest FPM from main branch.
+# hadolint ignore=DL3003
+RUN <<EOC
+#!/usr/bin/env bash
+set -euo pipefail
+  git clone --depth 1 https://github.com/fortran-lang/fpm /tmp/fpm
+  cd /tmp/fpm
+  FC=gfortran FFLAGS="-O3 -fopenmp" ./install.sh --prefix=/usr/local
+  rm -rf /tmp/fpm
+EOC
+
+# Install actionlint (GitHub Actions workflow linter)
+# https://github.com/rhysd/actionlint/releases
+ARG ACTIONLINT_VERSION=1.7.11
+ARG ACTIONLINT_SHA256=900919a84f2229bac68ca9cd4103ea297abc35e9689ebb842c6e34a3d1b01b0a
+RUN <<EOC
+#!/usr/bin/env bash
+set -euo pipefail
+  curl -fsSL "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \
+    -o /tmp/actionlint.tar.gz
+  echo "${ACTIONLINT_SHA256}  /tmp/actionlint.tar.gz" | sha256sum -c -
+  tar -xzf /tmp/actionlint.tar.gz -C /usr/local/bin actionlint
+  chmod +x /usr/local/bin/actionlint
+  rm /tmp/actionlint.tar.gz
+EOC
 
 # Copy Intel IFX installer script (run manually when needed)
 COPY install-intel-ifx.sh /usr/local/bin/install-intel-ifx.sh
 RUN chmod +x /usr/local/bin/install-intel-ifx.sh
 
+# Copy Claude Code statusline script (installed into ~/.claude/ by entrypoint)
+COPY claude-statusline.sh /usr/local/share/claude/statusline-command.sh
+
+# Copy user-level CLAUDE.md (installed into ~/.claude/ by entrypoint)
+COPY claude-user-CLAUDE.md /usr/local/share/claude/CLAUDE.md
+
 # Copy entrypoint script
 COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
 RUN chmod +x /usr/local/bin/docker-entrypoint.sh
 
 # Switch to salt user for runtime
+# Explicit HOME survives --user overrides (Docker defaults HOME=/ for unknown UIDs)
+ENV HOME=/home/salt
 USER salt
 WORKDIR /home/salt/src