Sync fork with upstream rust-v0.144.0

.bazelrc

@@ -190,7 +190,7 @@ common:ci-windows-cross --strategy=TestRunner=local
 # V8 embeds IsolateData offsets in snapshot builtins; Windows snapshots must be
 # generated by a Windows mksnapshot binary rather than the Linux RBE host tool.
 common:ci-windows-cross --strategy=V8Mksnapshot=local
-common:ci-windows-cross --local_test_jobs=4
+common:ci-windows-cross --local_test_jobs=8
 common:ci-windows-cross --test_env=RUST_TEST_THREADS=1
 # Native Windows CI still covers the PowerShell parser-process tests. The
 # cross-built gnullvm binaries currently hang in those tests when run on the

.github/CODEOWNERS

@@ -1,5 +1,8 @@
 # Core crate ownership.
+/codex-rs/arg0/ @openai/codex-core-agent-team
+/codex-rs/codex-mcp/ @openai/codex-core-agent-team
 /codex-rs/core/ @openai/codex-core-agent-team
+/codex-rs/exec-server/ @openai/codex-core-agent-team
 /codex-rs/exec-server-protocol/ @openai/codex-core-agent-team
 /codex-rs/ext/extension-api/ @openai/codex-core-agent-team
 /codex-rs/prompts/ @openai/codex-core-agent-team

.github/actions/setup-bazel-ci/action.yml

@@ -12,38 +12,24 @@ outputs:
 runs:
   using: composite
   steps:
-    - uses: ./.github/actions/setup-ci
+    - id: setup_ci
+      uses: ./.github/actions/setup-ci
 
     - name: Set up Bazel
       uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
       # Without an explicit Bazelisk version, setup-bazel leaves PATH unchanged
       # and Windows can use the runner's standalone Bazel, ignoring .bazelversion.
       with:
         bazelisk-version: 1.28.1
+        # setup-bazel writes an explicit output_base, which otherwise overrides
+        # BAZEL_OUTPUT_USER_ROOT and leaves Bazel's I/O-heavy trees on C:.
+        output-base: ${{ steps.setup_ci.outputs.bazel-output-base }}
 
     - name: Configure Bazel repository cache
       id: configure_bazel_repository_cache
       shell: pwsh
       run: |
-        # Keep the repository cache under HOME on all runners. Windows `D:\a`
-        # cache paths match `.bazelrc`, but `actions/cache/restore` currently
-        # returns HTTP 400 for that path in the Windows clippy job.
-        $repositoryCachePath = Join-Path $HOME '.cache/bazel-repo-cache'
-        "repository-cache-path=$repositoryCachePath" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
-        "BAZEL_REPOSITORY_CACHE=$repositoryCachePath" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
-
-    - name: Configure Bazel output root (Windows)
-      if: runner.os == 'Windows'
-      shell: pwsh
-      run: |
-        # Use the shortest available drive to reduce argv/path length issues,
-        # but avoid the drive root because some Windows test launchers mis-handle
-        # MANIFEST paths there.
-        $hasDDrive = Test-Path 'D:\'
-        $bazelOutputUserRoot = if ($hasDDrive) { 'D:\b' } else { 'C:\b' }
-        $repoContentsCache = Join-Path $env:RUNNER_TEMP "bazel-repo-contents-cache-$env:GITHUB_RUN_ID-$env:GITHUB_JOB"
-        "BAZEL_OUTPUT_USER_ROOT=$bazelOutputUserRoot" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
-        "BAZEL_REPO_CONTENTS_CACHE=$repoContentsCache" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        "repository-cache-path=$env:BAZEL_REPOSITORY_CACHE" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
 
     - name: Expose MSVC SDK environment (Windows)
       if: runner.os == 'Windows'

.github/actions/setup-ci/action.yml

@@ -1,9 +1,67 @@
 name: setup-ci
 description: Prepare common tools and environment shared by CI jobs.
+outputs:
+  bazel-output-base:
+    description: Filesystem path used for Bazel's output base.
+    value: ${{ steps.configure_ci_build_paths.outputs.bazel-output-base }}
+  cargo-target-dir:
+    description: Filesystem path used for Cargo's target directory.
+    value: ${{ steps.configure_ci_build_paths.outputs.cargo-target-dir }}
 
 runs:
   using: composite
   steps:
+    # setup-ci expects either this step or the Unix fallback below to define
+    # CI_BUILD_ROOT. Windows puts it on a Dev Drive because Cargo and Bazel
+    # spend significant time reading and writing build/cache trees.
+    - name: Configure Dev Drive (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: ./.github/scripts/setup-dev-drive.ps1
+
+    - name: Configure CI build root (Unix)
+      if: runner.os != 'Windows'
+      shell: bash
+      run: echo "CI_BUILD_ROOT=$HOME/.cache/codex-ci" >> "$GITHUB_ENV"
+
+    - name: Configure CI build paths
+      id: configure_ci_build_paths
+      shell: bash
+      run: |
+        set -euo pipefail
+        # setup-bazel passes output_base explicitly, so keep both it and the
+        # user root under the shared build root. Keep these directory names tiny
+        # on every platform so Windows Bazel paths do not overflow argv or
+        # confuse test MANIFEST handling.
+        bazel_output_base="$CI_BUILD_ROOT/o"
+        bazel_output_user_root="$CI_BUILD_ROOT/b"
+        bazel_repository_cache="$CI_BUILD_ROOT/bazel-repository-cache"
+        bazel_repo_contents_cache="$CI_BUILD_ROOT/bazel-repo-contents-cache-$GITHUB_RUN_ID-$GITHUB_JOB"
+        cargo_target_dir="$CI_BUILD_ROOT/cargo-target"
+        tmp="$CI_BUILD_ROOT/tmp"
+
+        build_dirs=(
+          "$bazel_output_base"
+          "$bazel_output_user_root"
+          "$bazel_repository_cache"
+          "$bazel_repo_contents_cache"
+          "$cargo_target_dir"
+          "$tmp"
+        )
+        mkdir -p "${build_dirs[@]}"
+        echo "bazel-output-base=$bazel_output_base" >> "$GITHUB_OUTPUT"
+        echo "cargo-target-dir=$cargo_target_dir" >> "$GITHUB_OUTPUT"
+
+        {
+          echo "BAZEL_OUTPUT_BASE=$bazel_output_base"
+          echo "BAZEL_OUTPUT_USER_ROOT=$bazel_output_user_root"
+          echo "BAZEL_REPOSITORY_CACHE=$bazel_repository_cache"
+          echo "BAZEL_REPO_CONTENTS_CACHE=$bazel_repo_contents_cache"
+          echo "CARGO_TARGET_DIR=$cargo_target_dir"
+          echo "TEMP=$tmp"
+          echo "TMP=$tmp"
+        } >> "$GITHUB_ENV"
+
     - name: Prefer the Git CLI for Cargo git dependencies
       shell: bash
       run: echo "CARGO_NET_GIT_FETCH_WITH_CLI=true" >> "$GITHUB_ENV"

.github/actions/windows-code-sign/action.yml

@@ -48,7 +48,7 @@ runs:
         {
           echo "files<<EOF"
           for binary in ${BINARIES}; do
-            echo "${GITHUB_WORKSPACE}/codex-rs/target/${TARGET}/release/${binary}.exe"
+            echo "${CARGO_TARGET_DIR}/${TARGET}/release/${binary}.exe"
           done
           echo "EOF"
         } >> "$GITHUB_OUTPUT"

.github/scripts/macos-signing/codex-app-server.entitlements.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
+	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+	<true/>
+</dict>
+</plist>

.github/scripts/macos-signing/codex-code-mode-host.entitlements.plist

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
+	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+	<true/>
+</dict>
+</plist>

.github/scripts/macos-signing/codex-responses-api-proxy.entitlements.plist

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
+</dict>
+</plist>

.github/scripts/macos-signing/codex.entitlements.plist

@@ -4,5 +4,7 @@
 <dict>
 	<key>com.apple.security.cs.allow-jit</key>
 	<true/>
+	<key>com.apple.security.cs.allow-unsigned-executable-memory</key>
+	<true/>
 </dict>
 </plist>

.github/scripts/run_bazel_with_buildbuddy.py

@@ -131,25 +131,54 @@ def bazel_args_without_remote_execution(args: Sequence[str]) -> list[str]:
 def bazel_args_with_remote_config(
     args: Sequence[str], env: Mapping[str, str]
 ) -> list[str]:
+    command_idx = next(
+        (idx for idx, arg in enumerate(args) if not arg.startswith("-")),
+        None,
+    )
+    if command_idx is None:
+        raise ValueError("expected a Bazel command")
+
     config = remote_config(args, env)
     if config is None:
-        return bazel_args_without_remote_execution(args)
+        configured_args = bazel_args_without_remote_execution(args)
+    else:
+        # `remote_config()` returns a configuration only when this key is present.
+        api_key = env["BUILDBUDDY_API_KEY"]
+        remote_args = [
+            f"--config={config}",
+            f"--remote_header=x-buildbuddy-api-key={api_key}",
+        ]
+
+        # Insert immediately after the Bazel command. This keeps wrapper-added
+        # options out of positional payloads and lets later CI configs override
+        # shared RBE defaults such as the Windows cross-compilation exec platforms.
+        configured_args = [
+            *args[: command_idx + 1],
+            *remote_args,
+            *args[command_idx + 1 :],
+        ]
 
-    # `remote_config()` returns a configuration only when this key is present.
-    api_key = env["BUILDBUDDY_API_KEY"]
-    remote_args = [
-        f"--config={config}",
-        f"--remote_header=x-buildbuddy-api-key={api_key}",
-    ]
+    try:
+        separator_idx = configured_args.index("--")
+    except ValueError:
+        separator_idx = len(configured_args)
 
-    # Insert immediately after the Bazel command. This keeps wrapper-added
-    # options out of positional payloads and lets later CI configs override
-    # shared RBE defaults such as the Windows cross-compilation exec platforms.
-    insertion_idx = next(
-        (idx + 1 for idx, arg in enumerate(args) if not arg.startswith("-")),
-        len(args),
-    )
-    return [*args[:insertion_idx], *remote_args, *args[insertion_idx:]]
+    cache_args = [
+        f"{option_prefix}{env[env_name]}"
+        for env_name, option_prefix in (
+            ("BAZEL_REPO_CONTENTS_CACHE", "--repo_contents_cache="),
+            ("BAZEL_REPOSITORY_CACHE", "--repository_cache="),
+        )
+        if env.get(env_name)
+        and not any(
+            arg.startswith(option_prefix) for arg in configured_args[:separator_idx]
+        )
+    ]
+    return [
+        *configured_args[:separator_idx],
+        *cache_args,
+        *configured_args[separator_idx:],
+    ]
 
 
 def bazel_command(*args: str, env: Mapping[str, str] | None = None) -> list[str]:

.github/scripts/rusty_v8_bazel.py

@@ -258,21 +258,27 @@ def stage_artifacts(
     print(staged_checksums)
 
 
-def upstream_release_pair_paths(source_root: Path, target: str) -> tuple[Path, Path]:
+def upstream_release_pair_paths(
+    target: str,
+    target_dir: Path,
+) -> tuple[Path, Path]:
     lib_name = (
         "rusty_v8.lib" if target.endswith("-pc-windows-msvc") else "librusty_v8.a"
     )
-    gn_out = source_root / "target" / target / "release" / "gn_out"
+    gn_out = target_dir / target / "release" / "gn_out"
     return gn_out / "obj" / lib_name, gn_out / "src_binding.rs"
 
 
 def stage_upstream_release_pair(
-    source_root: Path,
     target: str,
     output_dir: Path,
+    target_dir: Path,
     sandbox: bool = False,
 ) -> None:
-    lib_path, binding_path = upstream_release_pair_paths(source_root, target)
+    lib_path, binding_path = upstream_release_pair_paths(
+        target,
+        target_dir,
+    )
     stage_artifacts(target, lib_path, binding_path, output_dir, sandbox)
 
 
@@ -330,7 +336,7 @@ def parse_args() -> argparse.Namespace:
         "stage-upstream-release-pair"
     )
     stage_upstream_release_pair_parser.add_argument(
-        "--source-root", type=Path, required=True
+        "--target-dir", type=Path, required=True
     )
     stage_upstream_release_pair_parser.add_argument("--target", required=True)
     stage_upstream_release_pair_parser.add_argument("--output-dir", required=True)
@@ -373,9 +379,9 @@ def main() -> int:
         return 0
     if args.command == "stage-upstream-release-pair":
         stage_upstream_release_pair(
-            source_root=args.source_root,
             target=args.target,
             output_dir=Path(args.output_dir),
+            target_dir=args.target_dir,
             sandbox=args.sandbox,
         )
         return 0

.github/scripts/setup-dev-drive.ps1

@@ -1,14 +1,15 @@
 # Configure a fast drive for Windows CI jobs.
 #
 # GitHub-hosted Windows runners do not always expose a secondary D: volume. When
-# they do not, try to create a Dev Drive VHD and fall back to C: if the runner
-# image does not allow that provisioning path.
+# they do not, create a Dev Drive VHD. CI depends on this path for its
+# build directories where CI spends significant time doing I/O, so fail the
+# job if no real Dev Drive is available.
 
-function Use-FallbackDrive {
-    param([string]$Reason)
+function Test-DevDrive {
+    param([string]$Drive)
 
-    Write-Warning "$Reason Falling back to C:"
-    return "C:"
+    & fsutil devdrv query $Drive *> $null
+    return $LASTEXITCODE -eq 0
 }
 
 function Invoke-BestEffort {
@@ -21,10 +22,14 @@ function Invoke-BestEffort {
     }
 }
 
-if (Test-Path "D:\") {
-    Write-Output "Using existing drive at D:"
+if ((Test-Path "D:\") -and (Test-DevDrive "D:")) {
+    Write-Output "Using existing Dev Drive at D:"
     $Drive = "D:"
 } else {
+    if (Test-Path "D:\") {
+        Write-Output "Existing D: volume is not a Dev Drive; provisioning a new Dev Drive VHD."
+    }
+
     try {
         $VhdPath = Join-Path $env:RUNNER_TEMP "codex-dev-drive.vhdx"
         $SizeBytes = 64GB
@@ -42,21 +47,17 @@ if (Test-Path "D:\") {
 
         $Drive = "$($Volume.DriveLetter):"
 
+        if (-not (Test-DevDrive $Drive)) {
+            throw "Provisioned volume at $Drive did not pass Dev Drive verification."
+        }
+
         Invoke-BestEffort { fsutil devdrv trust $Drive } "Trusting Dev Drive $Drive"
         Invoke-BestEffort { fsutil devdrv enable /disallowAv } "Disabling AV filter attachment for Dev Drives"
-        Invoke-BestEffort { fsutil devdrv query $Drive } "Querying Dev Drive $Drive"
 
         Write-Output "Using Dev Drive at $Drive"
     } catch {
-        $Drive = Use-FallbackDrive "Failed to create Dev Drive: $($_.Exception.Message)"
+        throw "Failed to create Dev Drive: $($_.Exception.Message)"
     }
 }
 
-$Tmp = "$Drive\codex-tmp"
-New-Item -Path $Tmp -ItemType Directory -Force | Out-Null
-
-@(
-    "DEV_DRIVE=$Drive"
-    "TMP=$Tmp"
-    "TEMP=$Tmp"
-) | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+"CI_BUILD_ROOT=$Drive" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append