rust-panic-safetylisted

Panic policy for Rust — pick unwind or abort, stop panics at any FFI boundary that must not unwind with catch_unwind, convert them into typed errors and foreign status codes or exceptions, audit unwrap and expect, and keep data valid when a panic passes through. Use when you add or review an extern "C", extern "system", JNI, or UniFFI entry point, set the panic strategy in a Cargo profile, install a panic hook, replace unwrap or expect with typed errors, choose between thiserror and anyhow, debug an abort with no Rust backtrace, or handle a panic in an async task, a spawned thread, or a Drop implementation.
po4yka/rust-skills · ★ 2 · Data & Documents · score 76

Install: claude install-skill po4yka/rust-skills

# Rust panic safety ## Purpose Use this skill when a panic can leave Rust and reach code that cannot handle it. That includes every `extern` entry point, every callback that a foreign runtime calls, every spawned task, and every `Drop` implementation. The skill gives you four things: 1. A panic strategy decision for the crate and the profile. 2. A guard pattern for each boundary shape. 3. A policy for `.unwrap()`, `.expect()`, and typed errors. 4. An audit checklist and a failure triage table. Derive the current state of the workspace from the source tree. Do not trust a memory of where the boundaries are, and do not carry a panic count from one review to the next. ## Start here: find the boundaries ```bash # Every function that foreign code can call. rg -n 'extern "(C|system|C-unwind|system-unwind)"' --type rust # Every symbol that leaves the crate unmangled. rg -n '#\[unsafe\(no_mangle\)\]|#\[no_mangle\]|#\[export_name|#\[unsafe\(export_name' --type rust # Every guard that already exists. rg -n 'catch_unwind|AssertUnwindSafe|with_env' --type rust # Every panic strategy declared in the workspace. rg -n 'panic\s*=\s*"(abort|unwind)"' -g '**/Cargo.toml' ``` Compare list 1 with list 3. Any entry point in list 1 with no guard is a finding. ## Rule 1: a panic must never unwind out of a function the foreign side calls Rust 1.81 and later insert an abort shim on an `extern "C"` boundary. The process dies with `SIGABRT`. Compilers before 1.81 treat the same unwind as un