sync Codefx with Codex rust-v0.166.0

.bazelrc

@@ -45,6 +45,8 @@ common:macos --strategy=CcConfigureMakeRule=remote,sandboxed,local
 common:windows --test_env=SYSTEMROOT
 common:windows --test_env=COMSPEC
 common:windows --test_env=WINDIR
+common:windows --test_env=SystemDrive
+common:windows --test_env=LOCALAPPDATA
 # Rust's libtest harness runs test bodies on std-spawned threads. The default
 # 2 MiB stack can be too small for large async test futures on Windows CI; see
 # https://github.com/openai/codex/pull/19067 for the motivating failure.
@@ -111,8 +113,9 @@ common:ci --build_metadata=REPO_URL=https://github.com/openai/codex.git
 common:ci --build_metadata=ROLE=CI
 common:ci --build_metadata=VISIBILITY=PUBLIC
 
-# Disable disk cache in CI since we have a remote one and aren't using persistent workers.
-common:ci --disk_cache=
+# Keep the local action cache enabled in CI. BuildBuddy remains the preferred
+# remote cache when credentials are available, while this path lets jobs on
+# public runners reuse the same Bazel actions through actions/cache.
 
 # Shared config for the main Bazel CI workflow.
 common:ci-bazel --config=ci
@@ -172,6 +175,10 @@ build:argument-comment-lint --@rules_rust//rust/toolchain/channel=nightly
 # Rearrange caches on Windows so they're on the same volume as the checkout.
 common:ci-windows --config=ci-bazel
 common:ci-windows --build_metadata=TAG_os=windows
+# The Windows GNU test graph uses an MSVC host toolchain for helper binaries
+# and therefore materializes windows_support's MSVC runtime repository. CI has
+# explicitly accepted the Visual Studio terms for these Windows jobs.
+common:ci-windows --repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1
 common:ci-windows --repo_contents_cache=D:/a/.cache/bazel-repo-contents-cache
 # The hidden dynamic-tool callback currently times out on Windows, and ConPTY
 # cannot reliably interrupt foreground processes on Windows Bazel runners.
@@ -196,6 +203,7 @@ common:ci-macos --strategy=TestRunner=darwin-sandbox,local
 # still run against Windows binaries.
 common:ci-windows-cross --config=ci-windows
 common:ci-windows-cross --build_metadata=TAG_windows_cross_compile=true
+common:ci-windows-cross --repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1
 common:ci-windows-cross --host_platform=//:rbe
 common:ci-windows-cross --strategy=TestRunner=local
 # V8 embeds IsolateData offsets in snapshot builtins; Windows snapshots must be
@@ -216,23 +224,6 @@ common:ci-v8 --config=ci
 common:ci-v8 --build_metadata=TAG_workflow=v8
 common:ci-v8 --build_metadata=TAG_os=linux
 
-# Source-built Bazel V8 artifacts use the in-process sandbox by default. This
-# does not affect Cargo's default prebuilt rusty_v8 path.
-common --@v8//:v8_enable_pointer_compression=True
-common --@v8//:v8_enable_sandbox=True
-
-# Keep currently published rusty_v8 release artifacts non-sandboxed until the
-# artifact migration ships matching Rust feature selection for Cargo consumers.
-common:v8-release-compat --@v8//:v8_enable_pointer_compression=False
-common:v8-release-compat --@v8//:v8_enable_sandbox=False
-common:v8-target-x64 --@v8//bazel/config:v8_target_cpu=x64
-common:v8-target-arm64 --@v8//bazel/config:v8_target_cpu=arm64
-
-# Match rusty_v8's upstream GN release contract for published artifacts: every
-# target object uses Chromium's custom libc++ headers and the archive folds in
-# the matching runtime objects.
-common:rusty-v8-upstream-libcxx --@v8//:v8_use_rusty_v8_custom_libcxx=True
-
 # Native Windows MSVC builds inherit the runner's MSVC SDK environment.
 # Client environment capture and repository discovery happen before target
 # transitions, so these runner settings cannot live in runtime_package.bzl.

.codespellignore

@@ -1,7 +1,9 @@
 iTerm
 iTerm2
 numer
+oint
 psuedo
 SOM
 te
 TE
+WRONLY

.github/actions/build-bazel-package-binaries/action.yml

@@ -18,7 +18,7 @@ runs:
         cache-scope: bazel-release
 
     - name: Install Cargo for workspace metadata
-      uses: dtolnay/rust-toolchain@d124f86f28ff42855784ff3319f48ac182c248f8 # 1.99.1
+      uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
 
     - name: Configure MSVC environment
       if: ${{ runner.os == 'Windows' }}

.github/actions/build-cargo-package-binaries/action.yml

@@ -39,7 +39,7 @@ runs:
           *) echo "Unsupported build mode: $BUILD_MODE" >&2; exit 1 ;;
         esac
 
-    - uses: dtolnay/rust-toolchain@d124f86f28ff42855784ff3319f48ac182c248f8 # 1.99.1
+    - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
       with:
         targets: ${{ inputs.target }}
 

.github/actions/build-codex-packages/action.yml

@@ -23,7 +23,7 @@ runs:
       shell: bash
       working-directory: codex-rs
       env:
-        BASE_BINARIES: "codex codex-app-server codex-code-mode-host"
+        BASE_BINARIES: "codex codex-app-server codex-code-mode-host codex-exec-server"
         WINDOWS_ONLY_BINARIES: "codex-command-runner codex-windows-sandbox-setup"
         BUILD_MODE: ${{ inputs.build-mode }}
         BUILD_SYSTEM: ${{ inputs.build-system }}
@@ -138,6 +138,7 @@ runs:
         package_args=(
           --target "$target"
           --code-mode-host-bin "${release_dir}/codex-code-mode-host${exe_suffix}"
+          --exec-server-bin "${release_dir}/codex-exec-server${exe_suffix}"
           --cargo-profile release
           --package-version "$CODEX_PACKAGE_VERSION"
           --force
@@ -183,7 +184,6 @@ runs:
         mkdir -p "${GITHUB_WORKSPACE}/codex-rs/target"
         pytest_args=(
           -v
-          --basetemp "${GITHUB_WORKSPACE}/codex-rs/target/package-smoke-tmp"
           --package-target "$target"
           --symbols-archive "${GITHUB_WORKSPACE}/symbols-dist/${target}/codex-symbols-${target}.tar.gz"
         )
@@ -194,13 +194,17 @@ runs:
           exit 1
         fi
 
+        # Windows setup helpers can finish background ACL work after pytest exits.
+        # Separate roots keep the next run from deleting their executables.
         uv run --frozen pytest "${pytest_args[@]}" \
+          --basetemp "${GITHUB_WORKSPACE}/codex-rs/target/package-smoke-gzip-tmp" \
           --compression gzip \
           --cli-archive "${archive_dir}/codex-package-${target}.tar.gz" \
           --app-server-archive "${archive_dir}/codex-app-server-package-${target}.tar.gz" \
           test_codex_package.py
 
         uv run --frozen pytest "${pytest_args[@]}" \
+          --basetemp "${GITHUB_WORKSPACE}/codex-rs/target/package-smoke-zstd-tmp" \
           --compression zstd \
           --cli-archive "${archive_dir}/codex-package-${target}.tar.zst" \
           --app-server-archive "${archive_dir}/codex-app-server-package-${target}.tar.zst" \

.github/actions/prepare-bazel-ci/action.yml

@@ -21,6 +21,23 @@ outputs:
 runs:
   using: composite
   steps:
+    # GitHub-hosted Linux runners have limited free disk space. A full
+    # cold Bazel graph exhausted the filesystem and prevented cache saves.
+    # These preinstalled SDKs are unused by the Rust/Bazel CI matrix.
+    - name: Reclaim unused runner disk space (Linux)
+      if: runner.os == 'Linux'
+      shell: bash
+      run: |
+        set -euo pipefail
+        for unused_path in /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL; do
+          if [[ -d "$unused_path" ]]; then
+            echo "Removing unused hosted-runner SDK: $unused_path"
+            sudo rm -rf -- "$unused_path"
+          fi
+        done
+        sudo apt-get clean
+        df -h "$GITHUB_WORKSPACE"
+
     - id: setup_ci
       uses: ./.github/actions/setup-ci
 
@@ -113,6 +130,19 @@ runs:
         echo "repository-cache-key=bazel-cache-${CACHE_SCOPE}-${TARGET}-${CACHE_HASH}" >> "${GITHUB_OUTPUT}"
         echo "repository-cache-restore-key=bazel-cache-${CACHE_SCOPE}-${TARGET}-" >> "${GITHUB_OUTPUT}"
 
+    # The repository cache only avoids downloading external archives. Keep the
+    # Bazel action cache separate and share it by target so test, clippy, and
+    # release verification jobs reuse compiled actions without sharing
+    # incompatible platform outputs. The action cache is content addressed by
+    # Bazel, so source changes safely invalidate individual entries.
+    - name: Cache Bazel action outputs
+      uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+      with:
+        path: ~/.cache/bazel-disk-cache
+        key: bazel-action-${{ inputs.cache-scope }}-${{ inputs.target }}-${{ hashFiles('.bazelrc', 'MODULE.bazel', 'MODULE.bazel.lock', 'codex-rs/Cargo.lock', 'codex-rs/Cargo.toml') }}
+        restore-keys: |
+          bazel-action-${{ inputs.cache-scope }}-${{ inputs.target }}-
+
     # Restore the Bazel repository cache explicitly so external dependencies
     # do not need to be re-downloaded on every CI run. Keep restore failures
     # non-fatal so transient cache-service errors degrade to a cold build

.github/actions/run-argument-comment-lint/action.yml

@@ -57,6 +57,7 @@ runs:
       shell: bash
       run: |
         ./.github/scripts/run-argument-comment-lint-bazel.sh \
+          --repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1 \
           --config=argument-comment-lint \
           --platforms=//:local_windows \
           --keep_going \

.github/actions/setup-ci/action.yml

@@ -81,7 +81,7 @@ runs:
       run: mkdir -p "$RUNNER_TEMP/dotslash-curl" && echo retry-all-errors > "$RUNNER_TEMP/dotslash-curl/.curlrc"
 
     - name: Install DotSlash
-      uses: facebook/install-dotslash@1e4e7b3e07eaca387acb98f1d4720e0bee8dbb6a # v2
+      uses: meta/install-dotslash@1e4e7b3e07eaca387acb98f1d4720e0bee8dbb6a # v2
       env:
         CURL_HOME: ${{ runner.temp }}/dotslash-curl
 

.github/scripts/build-codex-package-archive.sh

@@ -136,6 +136,8 @@ case "$target" in
     ;;
 esac
 
+resource_args+=(--exec-server-bin "${entrypoint_dir%/}/codex-exec-server${exe_suffix}")
+
 code_mode_host_bin="${entrypoint_dir%/}/codex-code-mode-host${exe_suffix}"
 if [[ "$code_mode_host_bin_provided" == "false" && -f "$code_mode_host_bin" ]]; then
   resource_args+=(--code-mode-host-bin "$code_mode_host_bin")

.github/scripts/contract_releases.py

@@ -1,6 +1,7 @@
 """Discover and download published Codex packages for contract runners."""
 
 import json
+import random
 import re
 import subprocess
 import sys
@@ -16,7 +17,7 @@
 
 def github_read(args: list[str]) -> str:
     """Retry release reads unless the error is known permanent; never retry verification."""
-    for attempt, delay in enumerate((2, 5, 0), start=1):
+    for attempt, delay in enumerate((2, 5, 15, 45, 0), start=1):
         try:
             return subprocess.check_output(
                 args, text=True, stderr=subprocess.PIPE, timeout=120
@@ -58,6 +59,7 @@ def github_read(args: list[str]) -> str:
             )
             if not will_retry:
                 raise
+            delay += random.randint(0, delay // 2)
             print(f"Retrying GitHub release read in {delay}s.", file=sys.stderr)
             time.sleep(delay)
 

.github/scripts/macos-signing/codex-exec-server.entitlements.plist

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict/>
+</plist>

.github/scripts/macos-signing/provisioned_macos_cli_package.py

@@ -19,7 +19,7 @@
 APP = Path("CodexCLI.app")
 EXECUTABLE = APP / "Contents/MacOS/codex"
 SIGNING = Path(__file__).resolve().parent
-HELPERS = ("bin/codex-code-mode-host", "codex-path/rg")
+HELPERS = ("bin/codex-code-mode-host", "bin/codex-exec-server", "codex-path/rg")
 LAUNCHER = """#!/bin/sh
 set -eu
 entry="$0"

.github/scripts/macos-signing/sign_macos_cli_package.py

@@ -2,6 +2,7 @@
 
 import argparse
 import os
+import plistlib
 import subprocess
 import sys
 from pathlib import Path
@@ -134,6 +135,12 @@ def main(configuration: bundle.ProfileConfiguration | None = None):
                     check=True,
                 )
             if relative.startswith("bin/"):
+                # Signing tools may omit the blob when no entitlements are requested.
+                if (
+                    actual.stat().st_size == 0
+                    and plistlib.loads(entitlements.read_bytes()) == {}
+                ):
+                    actual.write_bytes(entitlements.read_bytes())
                 expected = reports / f"{name}-expected.plist"
                 subprocess.run(
                     [

.github/scripts/macos-signing/test_sign_macos_cli_package.py

@@ -34,10 +34,15 @@
         target = Path(args[-1]).name
         if target == "CodexCLI.app":
             source = Path(os.environ["CODEX_REPO_ROOT"]) / "signing-verification/codex-provisioned-entitlements.plist"
-        elif target in ("codex", "codex-code-mode-host"):
+        elif target in ("codex", "codex-code-mode-host", "codex-exec-server"):
             source = Path(os.environ["MOCK_SIGNING_SCRIPTS"]) / (target + ".entitlements.plist")
         else:
             sys.exit(0)
+        if target == "codex-exec-server" and os.environ.get("MOCK_EXECUTOR_ENTITLEMENTS"):
+            sys.stdout.buffer.write(plistlib.dumps({"unexpected": True}))
+            sys.exit(0)
+        if not plistlib.loads(source.read_bytes()) and os.environ.get("MOCK_OMIT_EMPTY_ENTITLEMENTS"):
+            sys.exit(0)
         if os.environ.get("MOCK_WRONG_ENTITLEMENTS"):
             sys.stdout.buffer.write(plistlib.dumps({"unexpected": True}))
         else:
@@ -145,15 +150,21 @@ def run_driver(self, driver, operation, package, env):
         )
 
     def test_standard_and_provisioned_signing_and_verification(self):
-        for provisioned, target in itertools.product(
-            (False, True), ("aarch64-apple-darwin", "x86_64-apple-darwin")
+        for provisioned, target, omit_empty in itertools.product(
+            (False, True),
+            ("aarch64-apple-darwin", "x86_64-apple-darwin"),
+            (False, True),
         ):
             with (
-                self.subTest(provisioned=provisioned, target=target),
+                self.subTest(
+                    provisioned=provisioned, target=target, omit_empty=omit_empty
+                ),
                 tempfile.TemporaryDirectory() as directory,
             ):
                 root = Path(directory).resolve()
                 package, driver, env = self.fixture(root, provisioned, target)
+                if omit_empty:
+                    env["MOCK_OMIT_EMPTY_ENTITLEMENTS"] = "1"
                 result = self.run_driver(driver, "sign", package, env)
                 self.assertEqual(result.returncode, 0, result.stderr)
                 result = self.run_driver(driver, "verify", package, env)
@@ -189,13 +200,13 @@ def test_standard_and_provisioned_signing_and_verification(self):
                 )
                 self.assertEqual(
                     ["--entitlements" in call for call in signing],
-                    [True, True, False],
+                    [True, True, True, False],
                 )
                 self.assertEqual(
                     [call[0] for call in calls if call[0].startswith("notarize")],
                     ["notarize_with_akv.py"]
                     if provisioned
-                    else ["notarize_macos_binary_with_akv.sh"] * 3,
+                    else ["notarize_macos_binary_with_akv.sh"] * 4,
                 )
                 self.assertEqual(
                     [call[1:] for call in calls if call[0] == "lipo"],
@@ -318,7 +329,12 @@ def test_signing_and_notarization_failures_stop_the_driver(self):
 
     def test_verification_rejects_wrong_signing_identity_and_entitlements(self):
         for provisioned, failure in itertools.product(
-            (False, True), ("MOCK_WRONG_SIGNING_IDENTITY", "MOCK_WRONG_ENTITLEMENTS")
+            (False, True),
+            (
+                "MOCK_WRONG_SIGNING_IDENTITY",
+                "MOCK_WRONG_ENTITLEMENTS",
+                "MOCK_EXECUTOR_ENTITLEMENTS",
+            ),
         ):
             with (
                 self.subTest(provisioned=provisioned, failure=failure),

.github/scripts/run-bazel-ci.sh

@@ -324,6 +324,29 @@ if [[ -n "${CODEX_BAZEL_EXECUTION_LOG_COMPACT_DIR:-}" ]]; then
 fi
 
 if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+  # The Windows GNU test graph uses an MSVC host toolchain for helper
+  # binaries. Pass the Visual Studio terms acceptance directly to Bazel's
+  # repository environment so the windows_support module extension receives
+  # it even when the local fallback omits the ci-windows config.
+  post_config_bazel_args+=("--repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1")
+
+  # third_party/voice/windows_native.bzl reads these values during analysis.
+  # Bazel's inherited `--action_env=NAME` form is intentionally rejected here;
+  # pass the runner's concrete values so remote and local Windows actions see
+  # the same fixed host environment.
+  system_root="${SystemRoot:-${SYSTEMROOT:-}}"
+  processor_architecture="${PROCESSOR_ARCHITECTURE:-}"
+  if [[ -z "$system_root" || -z "$processor_architecture" ]]; then
+    echo "SystemRoot and PROCESSOR_ARCHITECTURE must be set for Windows Bazel CI." >&2
+    exit 1
+  fi
+  post_config_bazel_args+=(
+    "--action_env=SystemRoot=${system_root}"
+    "--host_action_env=SystemRoot=${system_root}"
+    "--action_env=PROCESSOR_ARCHITECTURE=${processor_architecture}"
+    "--host_action_env=PROCESSOR_ARCHITECTURE=${processor_architecture}"
+  )
+
   pass_windows_build_env=1
   if [[ $windows_cross_compile -eq 1 && -n "${BUILDBUDDY_API_KEY:-}" ]]; then
     # Remote build actions execute on Linux RBE workers. Passing the Windows

.github/scripts/run-bazel-query-ci.sh

@@ -26,6 +26,13 @@ run_bazel() {
 
 bazel_query_args=(query)
 
+if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+  # Windows GNU lint/test target discovery still uses the MSVC host toolchain
+  # for helper binaries, so match the main CI Bazel invocation's explicit
+  # Visual Studio terms acceptance.
+  bazel_query_args+=(--repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1)
+fi
+
 if [[ -n "${BAZEL_REPO_CONTENTS_CACHE:-}" ]]; then
   bazel_query_args+=("--repo_contents_cache=${BAZEL_REPO_CONTENTS_CACHE}")
 fi