## What changed
- Add `//bazel/schema:app-server` to generate stable and experimental schemas from Rust sources without depending on committed precomputed bundles.
- Add `//sdk/python:generated` to generate Python SDK models, the notification registry, and API methods from the stable schema in scratch space, using dependencies from `uv.lock`.
- Add `generate-types --no-format` to skip formatters for build outputs while preserving formatting by default.
## Testing
Extend contract generation tests to regenerate in a temporary SDK copy, checking byte equality for formatted output and AST equality for unformatted output.
GitOrigin-RevId: 9ca7daa8ac0a33c4106a9e95c2f48bbded07df21
## What changed
- Upgrade `rules_python` from 1.7.0 to 2.4.2 and update `MODULE.bazel.lock`.
- Enable `--windows_enable_symlinks` in `.bazelrc`, as `rules_python` 2.x requires symlink support for Windows Python launchers.
GitOrigin-RevId: 303da258c74b18d0d0df8d4eebb830c57f14cca4
## Why
PSEC API symbols can be present on transitional Windows builds where MXC is not enabled. Availability detection needs to verify that a native process security environment can actually be created.
## What changed
- Replace `mxc-sdk` with pinned `appcontainer_common`, `learning_mode_windows`, and `wxc_common` dependencies, and update Cargo and Bazel dependency metadata.
- Use MXC's cached create/close probe for `is_available()` and query native deny-path support through `SecurityEnvironmentApi` before launching requests with denied paths.
- Adapt request construction and the existing policy test to the vector-based environment field, and update the sandbox documentation.
GitOrigin-RevId: e8cc6a35d46884d0a069b747d33e711512ec1596
Use Codex `0.162.1` instead of `0.156.1` for
`exec-server-stable-release-test`, updating the Bazel release archive version,
checksum, and repository reference.
GitOrigin-RevId: 304108b223da1e5506483f53c476a55a8f31ce71
## What changed
- Add `runtime_package` targets for combined, primary, app-server, and Windows helper bundles, plus per-binary release archives.
- Apply release settings automatically and retain unstripped binaries with macOS dSYM or Windows PDB symbols. Require platform-specific symbols and validate that dSYM bundles contain nonempty DWARF data.
- Support a `debug` build mode for faster package smoke builds and configure platform-specific release settings, including native Windows MSVC toolchains.
- Add a composite action that refreshes Cargo workspace metadata, builds the selected archive, and extracts writable files for existing signing and packaging steps.
GitOrigin-RevId: 21109875cde228aaef67b2ba9812b3e4854aee84
## Why
Bazel release builds need Cargo-compatible Rust and native build-script settings. Platform-specific issues also include Windows command-line limits, MSVC runtime conflicts with V8's allocator, and a missing V8 `__clear_cache` symbol on ARM64 musl.
## What changed
- Add `--config=release` settings for thin LTO, four target codegen units, and disabled debug assertions and overflow checks, with separate settings for build tools.
- Add opt-in Cargo release profile support for build-script optimization and debug information, preserving explicit C/C++ flags. Give optimized Bubblewrap builds `-O3`, debug symbols, and enabled native assertions.
- Statically link the MSVC CRT for Rust and C/C++ target and host dependencies, and disable SQLite intrinsics on x64 MSVC to avoid startup crashes on older CPUs.
- Let the Rust process wrapper read its arguments from a multiline parameter file to avoid Windows command-line limits.
- Select the ARM64 musl V8 archive containing compiler-rt builtins and raise the Rust recursion limit to `256` in the app-server client, exec, and TUI entry points for release compilation.
GitOrigin-RevId: 8f61e62b8735c36209ee92e04a0e0339a70badc5
## What changed
- Replace the separate MXC crates with the pinned `mxc-sdk` 1.0.0 dependency and update Cargo and Bazel lockfiles.
- Use the cached PSEC API-set check for availability and the SDK's native deny-path capability check before launch. Native creation and request-specific capabilities are validated at launch.
- Map empty environments to `None` to retain Windows user-profile defaults, while keeping nonempty environments explicit. Document the SDK's `SystemRoot` and `LOCALAPPDATA` requirements.
- Configure Bazel's LLVM resource compiler for Windows GNU builds, document Cargo's `RC_PATH` requirement, and add `libproc` and `libsandbox` to the macOS SDK libraries.
## Testing
Update the request-building test to verify that nonempty environments remain explicit and empty environments become `None`.
GitOrigin-RevId: f3ccbb92ceaa71f16c5d6cb185a7602a5bb8da53
## What changed
- Move the lint to `nightly-2026-08-20` and Dylint `6.1.0`, updating CI, release artifacts, Bazel configuration, and installation instructions.
- Adapt to the updated rustc and Clippy APIs, including resolving `Option::None` through type aliases when checking for uncommented arguments.
- Set the `chatgpt` crate's `recursion_limit` to `256`.
## Testing
Extend the UI fixture to expect an uncommented-argument warning for `OptionalString::None`, where `OptionalString` aliases `Option<String>`.
GitOrigin-RevId: 34e1b173972f0bfa9b6c8fd3342ca652539efe2f
## What changed
Expose resolved Cargo package versions in `rules_rs` workspace `DEP_DATA` and pass them through `codex_rust_crate` to build scripts, libraries, binaries, and tests. This replaces the hardcoded `0.0.0` build-script version and supplies explicit versions to the other Rust targets.
GitOrigin-RevId: a3555beec3c5ecfc38d69c352b43696986352c49
Daemon tests repeatedly hash large CLI binaries, even in `fastbuild` mode.
Set `blake3`'s build-script `OPT_LEVEL` to `3` and Rust compiler flag to
`-Copt-level=3` so both the native backends and Rust implementation are optimized.
GitOrigin-RevId: ebf9b96255e68ba775443077ebf3fd897282795d
## What changed
- Default `MALLOC_CONF` to `thp:always` for Cargo child processes, including tests and `cargo run`, while preserving an explicitly set value, even if empty.
- Patch `rules_rust` to request transparent huge pages for `codex-rs/` compilation with Linux GNU `rustc` on x86_64 and aarch64. Check policy on the execution worker and enable the setting only when seccomp is disabled, transparent huge pages are permitted, and no allocator, preload, or sanitizer configuration conflicts are detected. Leave the environment unchanged when policy cannot be determined.
GitOrigin-RevId: 3a9b2572ec9e1f30e2f719f30c885914c165eccd
## What changed
Select checksum-pinned `rusty_v8` 150.4.0 release archives and matching Rust bindings for x64 and arm64 macOS and GNU Linux when pointer compression and the V8 sandbox are enabled.
Add `--//:rusty_v8_from_source=true` to select source-built archives and bindings together for custom V8 C++ flags or instrumentation. Fall back to the existing source path when the sandbox or pointer compression settings differ from the published artifacts, and retain source builds for musl Linux and Windows GNU.
On GNU Linux, weaken the ten shared `std::logic_error` and `std::runtime_error` constructor and assignment symbols in the Bazel output so toolchain libc++ definitions take precedence. Preserve the checksum-verified inputs and constructors accepting `std::__Cr::string`.
Document artifact selection, source overrides, and checksum maintenance.
GitOrigin-RevId: cedd474c739ae16e07a78f35459d2c383e5781d8
## Why
Keep source locations available without full debug information in ordinary builds, and retain symbols until release packaging. macOS targets also need to avoid invoking `dsymutil` in Linux remote Rust actions where it is unavailable.
## What changed
- Set Cargo's `dev` profile to `line-tables-only` and let `ci-test` inherit it through `test`. Document environment overrides for full debug information.
- Patch `rules_rs` to use line tables for `fastbuild` and `opt`, full debug information for `dbg`, and no stripping in all three modes.
- Disable split debug information for macOS toolchains, matching Cargo's release policy.
GitOrigin-RevId: 9e92b28f9647cea7dd73084febd84726b1cee279
Update the Bazel release archive version and checksum from `0.153.1` to
`0.156.1`, and point `exec-server-stable-release-test` at the new archive.
GitOrigin-RevId: 1d28566d2447c027a67c4197b213458a0838fde0
## Why
Windows release packages need the voice helper and native audio libraries. Realtime TLS connections on fresh Windows installations also need platform certificate validation so Windows can retrieve missing trusted roots on demand.
## What changed
- Build and sign the voice helper and audio DLLs for Windows x64 and ARM64, bundle a pinned Microsoft CRT DLL, and verify signatures and runtime receipts before packaging.
- Add verified, pinned Cygwin and native build tools plus MSVC linker, compiler, and path handling fixes for the Windows Bazel builds.
- Include voice resources in primary release archives and WinGet packages. Preserve WinGet executable names, update manifest hashes, and recognize the package root through matching entrypoint metadata. Keep Python runtime wheels voice-free to preserve their existing Windows support floor.
- Use Windows platform TLS validation for realtime WebSockets when no custom CA bundle is configured, preserving custom CA behavior.
## Testing
Add coverage for build-input integrity and unsafe paths, signed Windows runtime assembly, WinGet file and hash preservation, package discovery, and TLS trust selection, untrusted certificate rejection, and hostname validation.
GitOrigin-RevId: 423da35872fa5549d69fd4ca97d922bb49599386
## Why
Linux voice needs system ALSA plugins and enough buffering to accommodate PipeWire graph cycles without losing capture samples. Voice startup failures also need actionable diagnostics without exposing native error details.
## What changed
- Build and bundle GNU voice helpers and runtimes with primary Linux musl release archives, and sign the archives. Keep Python wheels free of these libraries to preserve `manylinux_2_17` compatibility.
- Discover ALSA plugins in fixed system directories and increase Linux capture and playback buffering to support larger PipeWire graph cycles.
- Report voice failures by stage, preserve negotiation timeout classification, and discard native error sources. Suppress the misleading `requested` closure message after failure cleanup.
- Add explicit Windows MSVC, pkgconf, and CMake toolchain configuration and preserve host architecture in native build environments.
## Testing
Add coverage for Linux release assembly, ALSA plugin discovery, PipeWire capture and playback, classified startup failures, failure cleanup rendering, and Windows build environment handling.
GitOrigin-RevId: d805eace96a669ce3a4489f12e2db6f68f9f7f53
## Why
The user-verification API previously returned an unsupported provider on macOS. Enable native verification using biometric-protected credentials.
## What changed
- Implement credential status, creation, reuse, deletion, and challenge signing with P-256 Secure Enclave keys in the Data Protection Keychain.
- Require biometric authentication through the key's access-control policy and use a fresh `LAContext` for each signature.
- Report Touch ID hardware support independently of enrollment and current readiness, and map native failures to structured verification errors.
- Serialize credential operations across processes with cancellable file-lock waits. Invalidate pending authentication on cancellation and wait for the signer to exit before releasing the lock.
## Testing
Add unit tests for lock contention and cancellation, authentication teardown and late-result rejection, native error classification, and validation of Secure Enclave key attributes.
GitOrigin-RevId: 93268962cd824b2befc1a0c54b99dcb77a0f1044
The musl CLI allocator needs declared native tools and consistent header
flags. Configure `tikv-jemalloc-sys` to use Bazel's Make toolchain and LLVM's
`llvm-nm` and `llvm-ranlib`, and patch its build script to honor `MAKE`.
Preserve `CFLAGS` and `CXXFLAGS` when generating jemalloc header dependencies
so dependency generation uses the same compiler flags as compilation.
GitOrigin-RevId: 4022b587ce0c8bce9331c541adbdf29c1d245558
## Why
Executor compatibility checks need a build identity that distinguishes commits
and compiler targets independently of the package release version.
## What changed
- Add optional `providerId` to exec-server environment metadata, cached at startup
and returned by initialization and `environment/info`.
- Derive the ID as SHA-256 of `git:<lowercase commit>:<target>`. It identifies a
standard build configuration, not exact executable bytes, and is omitted when
the commit stamp or target is unavailable or invalid.
- Embed the compiler target in `BuildInfo`, preserve compatibility with historical
metadata without a target, and stamp Cargo release builds with `STABLE_GIT_COMMIT`.
- Group Bazel build-script argument files under one `--arg-file` flag to reduce
Windows command-line length while preserving file order.
## Testing
Add deterministic build-ID vectors across targets, commit normalization and invalid
input coverage, and historical metadata compatibility tests. Extend exec-server
coverage for metadata caching and ensure runtime environment overrides cannot
replace the executor's build identity.
GitOrigin-RevId: 125a18c23de7ad006571940ba305836376c983f4
## Why
Stamped Rust binaries consume workspace status files containing build user,
host, and timestamp values. These unrelated values prevent remote cache reuse
when building the same commit across developers and CI workers.
## What changed
Generate a compiler environment file containing only `STABLE_GIT_COMMIT` through
a small stamped template action. Use it for `codex`, `codex-tui`, and
`codex-voice-host`, with Rust binary stamping disabled so their build metadata
input changes only when the embedded commit changes.
Rename the crate macro option from `stamped_binaries` to
`binaries_with_build_commit` and add `bazel_lib` for template expansion.
GitOrigin-RevId: 21d0f2e3df97670a4c2cdbc3d1972cd14cc5b439
## What changed
- Add explicit x64 and ARM64 targets for native builds, runtime preparation, and linking using the existing voice recipes. Each target requires native Windows execution of the matching architecture.
- Declare compiler, SDK, Python, and CMake inputs; require an explicitly supplied Cygwin/pkgconf tool tree and a fixed `SystemRoot`. Validate installed tool selections against the manifest and declared files.
- Pair Windows DLLs with SDK import libraries, preserve plugin and receipt runfiles, and omit Unix runtime-search flags. Use Python for portable payload copying.
- Correct the MSVC ARM64 tool directory casing to `HostArm64` and document provisioning and build commands.
The generic Rust-consumer aliases remain separate; native Windows Bazel execution and consumer validation are still needed to establish complete Windows voice support.
## Testing
Add eight unit tests covering tool selection, path anchoring, invalid inputs, and DLL/import-library copying, plus x64 and ARM64 link smoke targets that reference `gst_version`.
GitOrigin-RevId: fb2b4998e9ffb5b64ca830ebf4bb4633fc959eb9
## Why
The MSVC runtime and Windows SDK repositories discard their tool binaries during setup, leaving native build tools unavailable to Bazel consumers.
## What changed
Patch `windows_support` to retain native MSVC tools and support files, plus the selected SDK's versioned tools, for `x64` and `arm64`. Expose them through opt-in `msvc_tools_x64`, `msvc_tools_arm64`, `winsdk_tools_x64`, and `winsdk_tools_arm64` directory targets.
Exclude the retained tool trees from the existing `sysroot_files`, `headers`, and `libs` targets.
GitOrigin-RevId: df7db08fecfb5e389252332842b8d7361d166891
## What changed
- Export `native_sdk` from the same inspected build as `native_runtime`.
- Configure GLib and GStreamer Rust build scripts to use the declared `pkg-config` executable and SDK, preserving upstream version checks while directing linking to prepared libraries.
- Add `native_link` to expose canonical libraries, development aliases, transitive dependencies, plugins, and the runtime manifest through `CcInfo` and runfiles. Replace GStreamer SDK absolute rpaths with relative Bazel runpaths.
## Testing
Extend the macOS archive preparation test to cover absent and empty SDK output directories, verify SDK file hashes, and check that SDK and runtime manifests share the same source commit and target.
GitOrigin-RevId: 3fc33af06225c69e4c293437f1985290f228dc0a
## What changed
Add `//third_party/voice:native_prefix` to run the existing native build recipe with Bazel-declared archives and toolchain inputs on matching macOS and Linux GNU 2.28 targets for x64 and ARM64. The manual target exports `prefix.tar` and a `built.json` receipt through the `receipt` output group.
Keep macOS actions local to access Apple tools, use Apple's linker for libffi partial links, and preserve compiler runtime flags through libtool on Linux. Surface upstream build failure logs in the Bazel action output.
Document the build's host utility requirements and the distinction between the raw prefix and a relocatable SDK or runtime package.
GitOrigin-RevId: b4917943f621dec07bb994392619e8a42e496b8b
## Why
Native voice builds ignore ambient compiler flags, but need a way to accept declared compiler, linker, and archive-tool inputs.
## What changed
- Add repeated `--c-flag`, `--cxx-flag`, and `--link-flag` options plus optional `--ar` and `--ranlib` paths for Unix builds. Record flags and pass them through CMake, Meson, and libffi, including Objective-C flags on macOS.
- Preserve literal libffi compiler arguments with response files. Reject flags containing whitespace, libffi paths requiring shell quoting, and Unix toolchain overrides on Windows.
- Add a pinned Bazel `pkg-config` tool built with LLVM archive tools and native macOS configure checks. Register the pinned Make toolchain and patch its bootstrap to pass preprocessor flags and enable cross-compilation configuration.
## Testing
Extend native-build tests to verify compiler and linker flags, explicit archive tools, Meson and Objective-C inputs, literal definitions through shell and recursive Make expansion, and rejection of unsupported overrides.
GitOrigin-RevId: e5ea541ec76abfa170f6b0411b0f14cd698c07e7
## Why
The bundled Opus encoder uses CMake and should not depend on tools available on a build worker's `PATH`.
## What changed
- Add `rules_foreign_cc` and provide its pinned CMake and Ninja tools and data to the `opusic-sys` build script.
- Add a CMake toolchain file that selects the declared Ninja executable, resolves the archiver path, and sets the target system and processor from `TARGET`, while retaining Bazel's compiler, SDK, and linker inputs.
GitOrigin-RevId: 48580c506d088d8c76cce958589ff94da458bd79
## What changed
Point the stable exec-server compatibility test at the pinned Codex 0.153.1
Linux x86_64 release and update the release archive checksum.
GitOrigin-RevId: ebbce8d61811ccea09adf7539cd7a85f24cbf97a
## What changed
Patch `rules_rs` to download its pinned `aarch64` and `x86_64` Linux zlib
packages from the dated Ubuntu snapshot. Keep the package versions and SHA-256
checksums unchanged.
GitOrigin-RevId: ec9d48827e08a87a7f93029bc22611b8fd41cc82
## What changed
- Probe whether the native Windows MXC process security environment is usable
when selecting a sandbox.
- Emit `codex.windows_mxc.available` at most once per process, labeled with the
probe result.
- Add the MXC workspace dependencies for Cargo and Bazel, and pin
`tracelogging` to a version compatible with the GNU Windows toolchain.
GitOrigin-RevId: d7cfeed6f0333feda5764e1ee44fe5bbd50f9a58
## What changed
- Pin the GStreamer, codec, native library, and build-tool archives needed by
the native voice runtime, including their SHA-256 digests.
- Add lazy Bazel repositories and a manual `//third_party/voice:sources` target
for fetching and unpacking the pinned archives.
- Add an offline Python adapter that verifies archive identity and extraction
bounds, refuses existing output directories, cleans up failed preparations,
and records a completion receipt.
- Document that this stage prepares source inputs only; it does not compile or
link the libraries or enable voice.
## Testing
- Add unit coverage for digest failures, unsafe links, expansion limits,
cleanup after extraction failures, existing-output preservation, and systems
where archive links cannot be created.
GitOrigin-RevId: 42a71d7b6b91d49b3954a40932033c44f9861f04
## What changed
Point the stable exec-server compatibility test at the pinned Codex 0.150.0
Linux x86_64 release and update the release archive checksum.
GitOrigin-RevId: 6178a1170faffe3dc70c9cfbfcbe3439b201096f
## What changed
- Add a Bazel module extension that downloads checksum-pinned Linux x86-64 Codex release packages, with the Codex release host and GitHub Releases as sources.
- Generate `codex` and `package` filegroups from each package's `codex-package.json` manifest so consumers can address the entrypoint or the complete package contents.
- Register repositories for Codex `0.145.0` and `0.149.1` in `MODULE.bazel`.
GitOrigin-RevId: a73225bae76cf01a588c7e1b570f3fdd9f6e12ab
## What changed
- Configure x86_64 Windows MSVC `rules_rs` toolchains to use the bundled
`rust-lld` linker.
- Make `rules_rust` select the configured direct linker for that target unless
the toolchain explicitly prefers the C compiler driver.
GitOrigin-RevId: 941a1ca42b931cbb9e1c2d68300b8a82a5250be8
## What changed
- Load `proto_library` for the code-mode protocol directly from the
`com_google_protobuf` repository.
- Remove the now-unneeded direct `rules_proto` module dependency.
GitOrigin-RevId: 5a01191b2c46c7fafd263ed93f153a878b09aaa8
## What changed
- Add pinned `windows_support` repositories for the Windows SDK and MSVC runtime on `x64` and `arm64`.
- Require explicit acceptance through `--repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1` before materializing the MSVC runtime.
- Preserve case-only SDK aliases when repositories created on case-insensitive Windows filesystems are consumed by case-sensitive remote executors.
GitOrigin-RevId: c7a5278e87c5e7e25e9c5f60af3d99e19303b0fd
## What changed
- Add the `codex.code_mode.v1` protobuf API for managing code-mode sessions, executions, waits, tool callbacks, notifications, and content results.
- Generate and export the Rust client/server bindings with `tonic` under Cargo.
- Add Bazel protobuf targets and a `prost` toolchain that uses the workspace's Rust runtime versions.
GitOrigin-RevId: 51d9d044e01dab2f4d25ab79aa7a52585485eee3
## Why
Code mode must link against a V8 build with sandbox support, but Windows MSVC
still used upstream non-sandboxed prebuilts and package builds selected the
older release artifact profile.
## What changed
- Enable the `v8_enable_sandbox` feature directly for the code mode runtime.
- Select the `ptrcomp_sandbox_release` archive and bindings in Cargo packaging
and CI, including Windows MSVC release builds.
- Point Bazel's Windows MSVC targets at the sandbox-enabled Codex artifacts and
enable the matching crate feature.
## Testing
Add a runtime test that calls `v8__V8__IsSandboxEnabled()` and verifies that
the linked V8 library has sandbox support enabled.
GitOrigin-RevId: c1b49b44a6ccfea5b5006d69ec7866848d1cddd7
## What changed
- Remove the `v8` 146.4.0 crate archive from `MODULE.bazel`.
- Remove the corresponding bindings, static libraries, and platform filegroups
from `third_party/v8/BUILD.bazel`, leaving the 150.4.0 targets in place.
GitOrigin-RevId: 86f93819c3f3f69217a1273df50702abe04682f4
## What changed
- Upgrade the Rust `v8` crate to `150.4.0` and the Bazel V8 source to
`15.0.245.2`.
- Refresh the prebuilt archives, checksums, LLVM source revisions, Bazel targets,
and downstream V8 patches for the new release.
- Expose the pinned llvm-libc headers under V8's expected include path for
source builds.
GitOrigin-RevId: 91c953b2fb707b221fdd772f9ca88fb71606f70f
## What changed
- Upgrade `rules_rs` from `0.0.58` to `0.0.96` and LLVM from `0.7.9` to
`0.8.11`, updating extension paths, platform constraints, and compatibility
patches for the current APIs.
- Add native `windows-gnullvm` execution support for the argument-comment lint
toolchain while retaining MSVC execution for existing cross-target builds.
- Build `aws-lc-sys` through the Bazel Central Registry `aws-lc` module and
`rules_rs` integration, removing the replaced crate-specific patches.
GitOrigin-RevId: 9829bcdb6ac74e846b713568aac38ea2fa3c42a2
## What changed
- Remove `codex-realtime-webrtc` from the Cargo workspace and Bazel build,
along with its native WebRTC dependency graph.
- Use `blake3`'s pure Rust implementation on
`x86_64-pc-windows-gnullvm`, where the Bazel lint toolchain cannot
reliably materialize the crate's native x86 assembly archives.
GitOrigin-RevId: c382d888cd7ada7a17a7a0dcbdecbe00744f5055
## Summary
- upgrade the bundled OpenSSL source from 3.5.5 to 3.6.3
- update the Bazel `openssl-sys` build dependency to use the upgraded
source crate
- refresh the Bazel module lockfile
## Why
OpenSSL 3.5.5 is within the affected ranges for security issues fixed in
later releases. The Rust `openssl-src` wrapper does not currently
publish OpenSSL 3.5.7, so this moves the vendored Linux musl build to
the available patched 3.6.3 release.
The custom Windows argument-comment-lint job was temporarily moved to
`windows-2022` in #28940 after hermetic LLVM source extraction failed on
the newer runner. This takes the upstream extraction fix so the job can
return to the intended custom runner.
This upgrades `llvm` to `0.7.9` and `rules_cc` to `0.2.18`, refreshes
the module lock, rebases the remaining Windows and custom libc++
patches, drops the obsolete symlink-extraction workaround, and restores
the `windows-x64` runner configuration.
Validation:
- Verified all LLVM patches apply cleanly against the `0.7.9` source.
- Built `@llvm-project//compiler-rt:clang_rt.builtins.static`.
## Why
macOS Bazel jobs fail before target analysis because the pinned Apple
CDN object now returns HTTP 403.
## What
Uprev the pin to Apple's currently live macOS 26.5 Command Line Tools
package, including its checksum and SDK extraction path.
## Validation
- Built `@macos_sdk//sysroot` from a fresh Bazel output root.
- Regenerated and checked `MODULE.bazel.lock`; it remains unchanged.
## Intent
Keep Bazel and Starlark files consistently formatted without requiring
contributors to install or version buildifier themselves.
## Implementation
- Add a SHA-256-pinned, cross-platform DotSlash manifest for buildifier
v8.5.1.
- Run buildifier from the shared `just fmt` and `just fmt-check` driver,
with Windows-safe explicit DotSlash invocation.
- Provision DotSlash in formatting CI and contributor devcontainers, and
document the source-build prerequisite.
- Apply the initial mechanical buildifier formatting baseline.
## Why
We want to make it possible for an app-server orchestrator on one OS to
control an exec-server on another host running a different OS. In
practice this kinda already works if you get lucky and the two hosts
have the same path format, but we mangle quite a lot of operations if
either end is Windows.
We should be able to test the cross-platform interactions for
exec-server, but we want to do this fairly soon and need a lightweight
option for testing. Using Wine to run the Windows side is far from
perfect, but it should give us a decent measure of how well we're
handling the basics of paths, process spawning, shell interaction, etc.
Future changes will add actual exec-server tests and possibly extensions
to the Wine testing environment.
## What
To make the cross-target-triple build easy, these tests are added only
to the Bazel build. This change adds an x86_64 Wine prebuilt managed by
Bazel and some build rules that can set up the needed toolchain
transition.
The support library for running Wine in a test environment created by
the Bazel rules comes with its own basic unit and integration tests.
Their primary priority is to make sure we don't leak child processes on
developer machines and that we can build and launch a basic hello world
binary.
## Validation
Confirmed these new tests are running on the [x86_64 bazel ubuntu
jobs](https://github.com/openai/codex/actions/runs/27446432302/job/81132356855?pr=27937):
```
//bazel/rules/testing/wine:wine-smoke-test (cached) PASSED in 3.7s
//bazel/rules/testing/wine:wine-test-support-unit-tests (cached) PASSED in 15.8s
```
## Why
Windows ARM64 uses 64-bit `long double`, but the LLVM MinGW Bazel
configuration omits the upstream `powl` compatibility source and does
not link the `mingwex` archive that owns it. Cross-linking the release
binary therefore fails with an unresolved `powl` symbol.
## What changed
Patch the LLVM module to compile `math/arm-common/powl.c` into the ARM64
MinGW extension sources and add `-lmingwex` to the Windows toolchain
defaults.
## Validation
- `just bazel-lock-check`
Stack: 3 of 6. Depends on #27322.
## Why
Bazel compiles Cargo build scripts in the exec configuration. For
`openssl-sys`, that means the target-specific optional `openssl-src`
dependency can disappear when producing musl release binaries, even
though the build script still needs the vendored source crate.
## What changed
Patch `rules_rs` to expose its existing unconditional
`build_script_deps` input through `crate.annotation`, then annotate
`openssl-sys` with the pinned `openssl-src` target. Target-derived build
dependencies continue to use the existing selected dependency path.
## Validation
- `just bazel-lock-check`
Stack: 2 of 6. Follows #27321.
Dmitriy Kovalenko