Sync upstream/main into fork/main (WI-3327)

.bazelrc

@@ -4,13 +4,23 @@ common --repo_env=BAZEL_NO_APPLE_CPP_TOOLCHAIN=1
 common --xcode_version_config=//:disable_xcode
 
 common --disk_cache=~/.cache/bazel-disk-cache
+common --experimental_disk_cache_gc_max_age=7d
 common --repo_contents_cache=~/.cache/bazel-repo-contents-cache
+common --repo_contents_cache_gc_max_age=7d
 common --repository_cache=~/.cache/bazel-repo-cache
 common --remote_cache_compression
 startup --experimental_remote_repo_contents_cache
+# rules_python 2.x requires symlink support for Windows Python launchers.
+startup --windows_enable_symlinks
 
 common --experimental_platform_in_output_dir
 
+# Match Cargo's MSVC static CRT policy and V8's allocator linkage. Only the
+# MSVC C/C++ toolchain consumes this feature; other toolchains ignore it.
+# Include host dependencies so native build tools use the same runtime.
+build --features=static_link_msvcrt
+build --host_features=static_link_msvcrt
+
 build --workspace_status_command=./scripts/workspace-status.sh
 build:windows --workspace_status_command=./scripts/workspace-status.cmd
 
@@ -37,6 +47,8 @@ common:macos --strategy=CcConfigureMakeRule=remote,sandboxed,local
 common:windows --test_env=SYSTEMROOT
 common:windows --test_env=COMSPEC
 common:windows --test_env=WINDIR
+common:windows --test_env=SystemDrive
+common:windows --test_env=LOCALAPPDATA
 # Rust's libtest harness runs test bodies on std-spawned threads. The default
 # 2 MiB stack can be too small for large async test futures on Windows CI; see
 # https://github.com/openai/codex/pull/19067 for the motivating failure.
@@ -99,6 +111,8 @@ common:remote --jobs=800
 common:ci --remote_download_minimal
 common:ci --keep_going
 common:ci --verbose_failures
+# A failed snapshot assertion should print its diff without leaving a .snap.new after a passing retry.
+test:ci --test_env=INSTA_UPDATE=no
 common:ci --build_metadata=REPO_URL=https://github.com/openai/codex.git
 common:ci --build_metadata=ROLE=CI
 common:ci --build_metadata=VISIBILITY=PUBLIC
@@ -208,22 +222,49 @@ common:ci-v8 --config=ci
 common:ci-v8 --build_metadata=TAG_workflow=v8
 common:ci-v8 --build_metadata=TAG_os=linux
 
-# Source-built Bazel V8 artifacts use the in-process sandbox by default. This
-# does not affect Cargo's default prebuilt rusty_v8 path.
-common --@v8//:v8_enable_pointer_compression=True
-common --@v8//:v8_enable_sandbox=True
-
-# Keep currently published rusty_v8 release artifacts non-sandboxed until the
-# artifact migration ships matching Rust feature selection for Cargo consumers.
-common:v8-release-compat --@v8//:v8_enable_pointer_compression=False
-common:v8-release-compat --@v8//:v8_enable_sandbox=False
-common:v8-target-x64 --@v8//bazel/config:v8_target_cpu=x64
-common:v8-target-arm64 --@v8//bazel/config:v8_target_cpu=arm64
-
-# Match rusty_v8's upstream GN release contract for published artifacts: every
-# target object uses Chromium's custom libc++ headers and the archive folds in
-# the matching runtime objects.
-common:rusty-v8-upstream-libcxx --@v8//:v8_use_rusty_v8_custom_libcxx=True
+# Native Windows MSVC builds inherit the runner's MSVC SDK environment.
+# Client environment capture and repository discovery happen before target
+# transitions, so these runner settings cannot live in runtime_package.bzl.
+# Hermetic LLVM targets the GNU ABI on Windows even on an MSVC platform.
+build:ci-windows-msvc --repo_env=BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN=0
+build:ci-windows-msvc --extra_toolchains=@local_config_cc//:cc-toolchain-x64_windows,@local_config_cc//:cc-toolchain-arm64_windows
+build:ci-windows-msvc --action_env=PATH
+build:ci-windows-msvc --host_action_env=PATH
+build:ci-windows-msvc --action_env=INCLUDE
+build:ci-windows-msvc --host_action_env=INCLUDE
+build:ci-windows-msvc --action_env=LIB
+build:ci-windows-msvc --host_action_env=LIB
+build:ci-windows-msvc --action_env=LIBPATH
+build:ci-windows-msvc --host_action_env=LIBPATH
+build:ci-windows-msvc --action_env=SystemRoot
+build:ci-windows-msvc --host_action_env=SystemRoot
+build:ci-windows-msvc --action_env=PROCESSOR_ARCHITECTURE
+build:ci-windows-msvc --host_action_env=PROCESSOR_ARCHITECTURE
+build:ci-windows-msvc --action_env=WindowsSdkDir
+build:ci-windows-msvc --host_action_env=WindowsSdkDir
+build:ci-windows-msvc --action_env=VCINSTALLDIR
+build:ci-windows-msvc --host_action_env=VCINSTALLDIR
+
+# Release profile settings are also defined in codex-rs/Cargo.toml.
+# runtime_package.bzl applies this profile to archive dependencies automatically.
+# Packaging extracts symbols before stripping; the Rust toolchains retain
+# line tables and use split-debuginfo=off. opt mode selects Rust opt-level=3,
+# which disables debug assertions and overflow checks by default.
+build:release --compilation_mode=opt
+build:release --@rules_rust//rust/settings:lto=thin
+build:release --@rules_rust//rust/settings:codegen_units=4
+# Match observed Cargo 1.95 build-tool commands: opt-level=0, assertions off,
+# and rustc's non-incremental default of 16 codegen units (not target's 4).
+build:release --@rules_rust//rust/settings:extra_exec_rustc_flag=-Copt-level=0
+build:release --@rules_rust//rust/settings:extra_exec_rustc_flag=-Ccodegen-units=16
+build:release --@rules_rust//rust/settings:extra_exec_rustc_flag=-Cdebug-assertions=no
+
+# Compatibility: Cargo build scripts consume the Rust profile, including debug
+# info, and choose their native optimization. Preserve explicit user C/C++ flags.
+# Opt in for target and host dependencies; normal Bazel builds keep defaults.
+build:release --features=cargo-release-profile
+build:release --host_features=cargo-release-profile
+# Bubblewrap and voice set release options on their own native rules.
 
 # Optional per-user local overrides.
 try-import %workspace%/user.bazelrc

.codespellignore

@@ -1,7 +1,9 @@
 iTerm
 iTerm2
 numer
+oint
 psuedo
 SOM
 te
 TE
+WRONLY

.gitattributes

@@ -1,3 +1,4 @@
 codex-rs/app-server-protocol/schema/** linguist-generated
 codex-rs/hooks/schema/generated/** linguist-generated
 third_party/voice/sources.json text eol=lf
+patches/v8_array_sort_elements_kind.patch text eol=lf

.github/actions/build-bazel-package-binaries/action.yml

@@ -0,0 +1,35 @@
+name: Build Bazel package binaries
+description: Set up Bazel and stage unstripped runtime package binaries and symbols.
+inputs:
+  target:
+    description: Rust release target triple.
+    required: true
+  build-mode:
+    description: Release optimizations, or debug for faster package smoke builds.
+    default: release
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Bazel
+      uses: ./.github/actions/prepare-bazel-ci
+      with:
+        target: ${{ inputs.target }}
+        cache-scope: bazel-release
+
+    - name: Install Cargo for workspace metadata
+      uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
+
+    - name: Configure MSVC environment
+      if: ${{ runner.os == 'Windows' }}
+      uses: ./.github/actions/setup-msvc-env
+      with:
+        target: ${{ inputs.target }}
+
+    - name: Build Bazel release binaries and symbols
+      uses: ./.github/actions/build-bazel-release
+      with:
+        target: ${{ inputs.target }}
+        bundle: combined
+        release-dir: ${{ env.CARGO_TARGET_DIR }}/${{ inputs.target }}/release
+        build-mode: ${{ inputs.build-mode }}

.github/actions/build-bazel-release/action.yml

@@ -0,0 +1,51 @@
+name: Build Bazel release staging archive
+description: Build a binary/symbol archive and extract writable inputs for existing signing and packaging.
+inputs:
+  target:
+    description: Rust release target triple.
+    required: true
+  bundle:
+    description: Binary bundle (combined, primary, app-server, or helpers).
+    default: combined
+  release-dir:
+    description: Directory where the archive is extracted for signing and packaging.
+    required: true
+  build-mode:
+    description: Release optimizations, or debug for faster package smoke builds.
+    default: release
+
+runs:
+  using: composite
+  steps:
+    - name: Refresh release workspace metadata
+      shell: bash
+      working-directory: ${{ github.workspace }}/codex-rs
+      # Release tags change Cargo.toml; rules_rs needs matching workspace lock entries.
+      run: cargo update --workspace
+
+    - name: Build staging archive
+      shell: bash
+      working-directory: ${{ github.workspace }}
+      env:
+        TARGET: ${{ inputs.target }}
+        BUNDLE: ${{ inputs.bundle }}
+        BUILD_MODE: ${{ inputs.build-mode }}
+        # Keep Git Bash from rewriting Bazel labels as Windows paths.
+        MSYS2_ARG_CONV_EXCL: "*"
+      run: |
+        python3 .github/scripts/run_bazel_with_buildbuddy.py build \
+          ${{ runner.os == 'Windows' && '--config=ci-windows-msvc' || '' }} \
+          ${{ runner.os == 'macOS' && '--config=ci-macos --remote_download_toplevel --build_metadata=VISIBILITY=PRIVATE' || '' }} \
+          "--platforms=@rules_rs//rs/platforms:$TARGET" \
+          "--//codex-rs:runtime_package_build_mode=$BUILD_MODE" \
+          "//codex-rs:runtime_package_$BUNDLE"
+
+    - name: Extract staging archive
+      shell: bash
+      working-directory: ${{ github.workspace }}
+      env:
+        BUNDLE: ${{ inputs.bundle }}
+        RELEASE_DIR: ${{ inputs.release-dir }}
+      run: |
+        mkdir -p "$RELEASE_DIR"
+        tar -xzf "bazel-bin/codex-rs/runtime_package_$BUNDLE.tar.gz" -C "$RELEASE_DIR"

.github/actions/build-cargo-package-binaries/action.yml

@@ -0,0 +1,135 @@
+name: Build Cargo package binaries
+description: Set up Cargo and build unstripped runtime package binaries and symbols.
+inputs:
+  target:
+    description: Rust release target triple.
+    required: true
+  binaries:
+    description: Space-separated binary target names.
+    required: true
+  build-mode:
+    description: Release optimizations, or debug for faster package smoke builds.
+    default: release
+
+runs:
+  using: composite
+  steps:
+    - uses: ./.github/actions/setup-ci
+
+    - name: Configure Cargo release profile
+      shell: bash
+      env:
+        BUILD_MODE: ${{ inputs.build-mode }}
+        # macOS symbol extraction needs packed dSYM bundles before binaries are stripped.
+        CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO: ${{ contains(inputs.target, 'apple-darwin') && 'packed' || 'off' }}
+      run: |
+        set -euo pipefail
+        echo "CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO=$CARGO_PROFILE_RELEASE_SPLIT_DEBUGINFO" >> "$GITHUB_ENV"
+        case "$BUILD_MODE" in
+          release) ;;
+          debug)
+            # Use the release profile so assertions, symbols and packaging match production.
+            # Only trade compiler optimizations for faster builds.
+            {
+              echo "CARGO_PROFILE_RELEASE_OPT_LEVEL=0"
+              echo "CARGO_PROFILE_RELEASE_LTO=off"
+              echo "CARGO_PROFILE_RELEASE_CODEGEN_UNITS=256"
+            } >> "$GITHUB_ENV"
+            ;;
+          *) echo "Unsupported build mode: $BUILD_MODE" >&2; exit 1 ;;
+        esac
+
+    - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
+      with:
+        targets: ${{ inputs.target }}
+
+    - name: Use hermetic Cargo home (musl)
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      working-directory: codex-rs
+      run: |
+        set -euo pipefail
+        cargo_home="${GITHUB_WORKSPACE}/.cargo-home"
+        mkdir -p "${cargo_home}/bin"
+        echo "CARGO_HOME=${cargo_home}" >> "$GITHUB_ENV"
+        echo "${cargo_home}/bin" >> "$GITHUB_PATH"
+        : > "${cargo_home}/config.toml"
+
+    - name: Install Zig
+      if: ${{ runner.os == 'Linux' }}
+      uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
+      with:
+        version: 0.14.0
+        use-cache: false
+
+    - name: Install musl build tools
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      working-directory: codex-rs
+      env:
+        TARGET: ${{ inputs.target }}
+      run: bash "${GITHUB_WORKSPACE}/.github/scripts/install-musl-build-tools.sh"
+
+    - name: Disable aws-lc jitter entropy (musl)
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      working-directory: codex-rs
+      env:
+        TARGET: ${{ inputs.target }}
+      run: |
+        set -euo pipefail
+        # aws-lc's jitter entropy path does not work reliably on musl builders,
+        # so disable it globally and per target.
+        echo "AWS_LC_SYS_NO_JITTER_ENTROPY=1" >> "$GITHUB_ENV"
+        target_no_jitter="AWS_LC_SYS_NO_JITTER_ENTROPY_${TARGET}"
+        target_no_jitter="${target_no_jitter//-/_}"
+        echo "${target_no_jitter}=1" >> "$GITHUB_ENV"
+
+    - name: Configure rusty_v8 artifact overrides and verify checksums
+      uses: ./.github/actions/setup-rusty-v8
+      with:
+        target: ${{ inputs.target }}
+
+    - name: Configure MSVC environment
+      if: ${{ runner.os == 'Windows' }}
+      uses: ./.github/actions/setup-msvc-env
+      with:
+        target: ${{ inputs.target }}
+
+    - name: Build bwrap and export digest
+      if: ${{ runner.os == 'Linux' }}
+      shell: bash
+      working-directory: codex-rs
+      env:
+        TARGET: ${{ inputs.target }}
+      run: |
+        set -euo pipefail
+        cargo build --target "${TARGET}" --release --timings --bin bwrap
+
+        bwrap_path="${CARGO_TARGET_DIR}/${TARGET}/release/bwrap"
+        # Codex embeds this digest at build time and verifies the packaged
+        # bwrap at runtime, so hash its final stripped bytes first.
+        strip --strip-debug --strip-unneeded "$bwrap_path"
+        digest="$(sha256sum "$bwrap_path" | awk '{print $1}')"
+        echo "CODEX_BWRAP_SHA256=${digest}" >> "$GITHUB_ENV"
+
+    - name: Build Codex package binaries
+      shell: bash
+      working-directory: codex-rs
+      env:
+        TARGET: ${{ inputs.target }}
+        BINARIES: ${{ inputs.binaries }}
+      run: |
+        set -euo pipefail
+        build_args=()
+        for binary in $BINARIES; do
+          build_args+=(--bin "$binary")
+        done
+        # SQLite intrinsics can emit instructions unsupported by older x64
+        # CPUs, causing Windows release binaries to crash during startup.
+        if [[ "${TARGET}" == "x86_64-pc-windows-msvc" ]]; then
+          export LIBSQLITE3_FLAGS=SQLITE_DISABLE_INTRINSIC
+        fi
+        STABLE_GIT_COMMIT="$(git rev-parse HEAD)"
+        export STABLE_GIT_COMMIT
+        cargo build --target "${TARGET}" --release --timings "${build_args[@]}"