dev/MODULE.bazel

module(name = "codex")

bazel_dep(name = "bazel_skylib", version = "1.9.0")
bazel_dep(name = "platforms", version = "1.0.0")
bazel_dep(name = "llvm", version = "0.8.11")

# Patch hermetic LLVM for Codex's custom libc++ and Windows gnullvm runtime
# needs that have not landed upstream.
single_version_override(
    module_name = "llvm",
    patch_strip = 1,
    patches = [
        "//patches:llvm_windows_symlink_extract.patch",
    ],
)

# Abseil picks a MinGW pthread TLS path that does not match our hermetic
# windows-gnullvm toolchain; force it onto the portable C++11 thread-local path.
single_version_override(
    module_name = "abseil-cpp",
    patch_strip = 1,
    patches = [
        "//patches:abseil_windows_gnullvm_thread_identity.patch",
    ],
)

register_toolchains("@llvm//toolchain:all")

osx = use_extension("@llvm//extensions:osx.bzl", "osx")
osx.from_archive(
    sha256 = "5f044578cd78a3a9b9c965a42d56bad609ee5d252e1d4e6aa7c42fc3f35fee7b",
    strip_prefix = "Payload/Library/Developer/CommandLineTools/SDKs/MacOSX26.5.sdk",
    type = "pkg",
    urls = [
        "https://swcdn.apple.com/content/downloads/09/08/047-91568-A_Y1CFZWQCD4/4xekpyz43i26dbp4enxfro8eb1q7wiujh5/CLTools_macOSNMOS_SDK.pkg",
    ],
)
osx.frameworks(names = [
    "ApplicationServices",
    "AppKit",
    "ColorSync",
    "CoreFoundation",
    "CoreGraphics",
    "CoreImage",
    "CoreMedia",
    "CoreMIDI",
    "CoreServices",
    "CoreText",
    "CoreVideo",
    "DiskArbitration",
    "AudioToolbox",
    "AVFoundation",
    "AVFAudio",
    "AVRouting",
    "CFNetwork",
    "FontServices",
    "AudioUnit",
    "CoreAudio",
    "CoreAudioTypes",
    "Foundation",
    "ImageIO",
    "IOSurface",
    "IOKit",
    "Kernel",
    "Metal",
    "MetalKit",
    "OpenGL",
    "OSLog",
    "QuartzCore",
    "ScreenCaptureKit",
    "Security",
    "SystemConfiguration",
    "UniformTypeIdentifiers",
    "VideoToolbox",
])
use_repo(osx, "macos_sdk")

# Needed to disable xcode...
bazel_dep(name = "apple_support", version = "2.1.0")
bazel_dep(name = "rules_cc", version = "0.2.16")
bazel_dep(name = "rules_platform", version = "0.1.0")
bazel_dep(name = "aws-lc", version = "5.1.0.bcr.1")
bazel_dep(name = "rules_rs", version = "0.0.96")
single_version_override(
    module_name = "rules_rs",
    patch_strip = 1,
    patches = [
        "//patches:rules_rs_build_script_deps_annotation.patch",
    ],
    version = "0.0.96",
)

rules_rust = use_extension("@rules_rs//rs:rules_rust.bzl", "rules_rust")
rules_rust.patch(
    patches = [
        # Carry the OpenAI setup fix that makes build-script tools available
        # through their runfiles after the rules_rs upgrade.
        "//patches:rules_rust_build_script_tools_transition.patch",
        # Keep direct Windows/MSVC links compatible with hermetic LLVM's
        # non-.lib runtime artifacts.
        "//patches:rules_rust_windows_msvc_direct_link_args.patch",
        # Skip transient native-Windows linker outputs while consolidating
        # dependency search paths.
        "//patches:rules_rust_windows_process_wrapper_skip_temp_outputs.patch",
    ],
    strip = 1,
)
use_repo(rules_rust, "rules_rust")

# argument-comment-lint uses rustc_private and needs nightly rustc-dev
# components. Keep that rules_rust-reexported toolchain separate from the
# default rules_rs toolchains below, which do not expose dev_components.
nightly_rust = use_extension(
    "@rules_rs//rs:rules_rust_reexported_extensions.bzl",
    "rust",
)
nightly_rust.toolchain(
    dev_components = True,
    edition = "2024",
    versions = ["nightly/2025-09-18"],
)

# Keep the reexported extension's default Windows set constrained to MSVC so
# it cannot also match the gnullvm host platform.
nightly_rust.repository_set(
    name = "rust_windows_x86_64",
    dev_components = True,
    edition = "2024",
    exec_compatible_with = [
        "@platforms//cpu:x86_64",
        "@platforms//os:windows",
        "@llvm//constraints/windows/abi:msvc",
    ],
    exec_triple = "x86_64-pc-windows-msvc",
    target_compatible_with = [
        "@platforms//cpu:x86_64",
        "@platforms//os:windows",
        "@llvm//constraints/windows/abi:msvc",
    ],
    target_triple = "x86_64-pc-windows-msvc",
    versions = ["nightly/2025-09-18"],
)

# Also let that MSVC-exec set target gnullvm for existing cross lanes.
nightly_rust.repository_set(
    name = "rust_windows_x86_64",
    target_compatible_with = [
        "@platforms//cpu:x86_64",
        "@platforms//os:windows",
        "@llvm//constraints/windows/abi:gnullvm",
        "@llvm//constraints/windows/crt:msvcrt",
    ],
    target_triple = "x86_64-pc-windows-gnullvm",
)

# Give Windows lint a native gnullvm exec set so proc-macros link against the
# same ABI as hermetic LLVM and BCR AWS-LC.
nightly_rust.repository_set(
    name = "rust_windows_x86_64_gnullvm",
    dev_components = True,
    edition = "2024",
    exec_compatible_with = [
        "@platforms//cpu:x86_64",
        "@platforms//os:windows",
        "@llvm//constraints/windows/abi:gnullvm",
        "@llvm//constraints/windows/crt:msvcrt",
    ],
    exec_triple = "x86_64-pc-windows-gnullvm",
    target_compatible_with = [
        "@platforms//cpu:x86_64",
        "@platforms//os:windows",
        "@llvm//constraints/windows/abi:gnullvm",
        "@llvm//constraints/windows/crt:msvcrt",
    ],
    target_triple = "x86_64-pc-windows-gnullvm",
    versions = ["nightly/2025-09-18"],
)
use_repo(nightly_rust, "rust_toolchains")

toolchains = use_extension("@rules_rs//rs/toolchains:module_extension.bzl", "toolchains")
toolchains.toolchain(
    edition = "2024",
    version = "1.95.0",
)
use_repo(toolchains, "default_rust_toolchains")

register_toolchains("@default_rust_toolchains//:all")

register_toolchains("@rust_toolchains//:all")

rules_rust_bindgen = use_extension(
    "@rules_rs//rs:rules_rust_bindgen.bzl",
    "rules_rust_bindgen",
)
use_repo(rules_rust_bindgen, "rules_rust_bindgen")

register_toolchains("@rules_rust_bindgen//:all")

crate = use_extension("@rules_rs//rs:extensions.bzl", "crate")
crate.from_cargo(
    cargo_lock = "//codex-rs:Cargo.lock",
    cargo_toml = "//codex-rs:Cargo.toml",
    platform_triples = [
        "aarch64-unknown-linux-gnu",
        "aarch64-unknown-linux-musl",
        "aarch64-apple-darwin",
        # Keep both Windows ABIs in the generated Cargo metadata: the V8
        # experiment still consumes release assets that only exist under the
        # MSVC names while targeting the GNU toolchain.
        "aarch64-pc-windows-msvc",
        "aarch64-pc-windows-gnullvm",
        "x86_64-unknown-linux-gnu",
        "x86_64-unknown-linux-musl",
        "x86_64-apple-darwin",
        "x86_64-pc-windows-msvc",
        "x86_64-pc-windows-gnullvm",
    ],
)
crate.from_cargo(
    name = "argument_comment_lint_crates",
    cargo_lock = "//tools/argument-comment-lint:Cargo.lock",
    cargo_toml = "//tools/argument-comment-lint:Cargo.toml",
    platform_triples = [
        "aarch64-unknown-linux-gnu",
        "aarch64-unknown-linux-musl",
        "aarch64-apple-darwin",
        "aarch64-pc-windows-msvc",
        "aarch64-pc-windows-gnullvm",
        "x86_64-unknown-linux-gnu",
        "x86_64-unknown-linux-musl",
        "x86_64-apple-darwin",
        "x86_64-pc-windows-msvc",
        "x86_64-pc-windows-gnullvm",
    ],
)

bazel_dep(name = "zstd", version = "1.5.7")

crate.annotation(
    # The Windows lint toolchain cannot reliably materialize blake3's native x86 assembly archives.
    crate = "blake3",
    crate_features_select = {
        "x86_64-pc-windows-gnullvm": ["pure"],
    },
)
crate.annotation(
    crate = "zstd-sys",
    gen_build_script = "on",
    patch_args = ["-p1"],
    patches = [
        "//patches:zstd-sys_windows_msvc_include_dirs.patch",
    ],
)
crate.annotation(
    crate = "ring",
    patch_args = ["-p1"],
    patches = [
        "//patches:ring_windows_msvc_include_dirs.patch",
    ],
)
crate.annotation(
    additive_build_file = "@rules_rs//3rd_party/aws-lc-sys:additive.BUILD.bazel",
    crate = "aws-lc-sys",
    extra_aliased_targets = {"aws_lc_sys_build_info": "aws_lc_sys_build_info"},
    gen_build_script = "off",
    repositories = ["crates"],
    rustc_flags = ["--cfg=use_bindgen_pregenerated"],
    deps = ["@crates//:aws_lc_sys_build_info"],
)
crate.annotation(
    crate = "aws-lc-rs",
    gen_build_script = "off",
    repositories = ["crates"],
)
crate.annotation(
    # The build script only validates embedded source/version metadata.
    crate = "rustc_apfloat",
    gen_build_script = "off",
)

inject_repo(crate, "aws-lc")

inject_repo(crate, "zstd")

use_repo(crate, "argument_comment_lint_crates")

bazel_dep(name = "bzip2", version = "1.0.8.bcr.3")
single_version_override(
    module_name = "bzip2",
    patch_strip = 1,
    patches = [
        "//patches:bzip2_windows_stack_args.patch",
    ],
)

crate.annotation(
    crate = "bzip2-sys",
    gen_build_script = "off",
    deps = ["@bzip2//:bz2"],
)

inject_repo(crate, "bzip2")

bazel_dep(name = "zlib", version = "1.3.1.bcr.8")

crate.annotation(
    crate = "libz-sys",
    gen_build_script = "on",
)

inject_repo(crate, "zlib")

bazel_dep(name = "xz", version = "5.4.5.bcr.8")
single_version_override(
    module_name = "xz",
    patch_strip = 1,
    patches = [
        "//patches:xz_windows_stack_args.patch",
    ],
)

crate.annotation(
    crate = "lzma-sys",
    gen_build_script = "off",
    deps = ["@xz//:lzma"],
)

bazel_dep(name = "openssl", version = "3.5.4.bcr.0")

inject_repo(crate, "xz")

crate.annotation(
    build_script_data = [
        "@openssl//:gen_dir",
    ],
    # Build scripts compile in Bazel's exec configuration, so target-specific
    # optional build deps are otherwise dropped for the musl release platforms.
    build_script_deps = [
        "@crates//:openssl-src-300.5.5+3.5.5",
    ],
    build_script_env = {
        "OPENSSL_DIR": "$(execpath @openssl//:gen_dir)",
        "OPENSSL_NO_VENDOR": "1",
        "OPENSSL_STATIC": "1",
    },
    crate = "openssl-sys",
    data = ["@openssl//:gen_dir"],
    gen_build_script = "on",
)

inject_repo(crate, "openssl")

crate.annotation(
    crate = "runfiles",
    workspace_cargo_toml = "rust/runfiles/Cargo.toml",
)

http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")

http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")

new_local_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:local.bzl", "new_local_repository")

include("//bazel/modules:wine.MODULE.bazel")

new_local_repository(
    name = "v8_targets",
    build_file = "//third_party/v8:BUILD.bazel",
    path = "third_party/v8",
)

crate.annotation(
    build_script_data = [
        "@v8_targets//:rusty_v8_archive_for_target",
        "@v8_targets//:rusty_v8_binding_for_target",
    ],
    build_script_env = {
        "RUSTY_V8_ARCHIVE": "$(execpath @v8_targets//:rusty_v8_archive_for_target)",
        "RUSTY_V8_SRC_BINDING_PATH": "$(execpath @v8_targets//:rusty_v8_binding_for_target)",
    },
    crate = "v8",
    # Keep the Rust feature aligned with the source-built Bazel artifacts.
    # Windows MSVC still consumes upstream non-sandboxed prebuilts.
    crate_features_select = {
        "aarch64-apple-darwin": ["v8_enable_sandbox"],
        "aarch64-pc-windows-gnullvm": ["v8_enable_sandbox"],
        "aarch64-pc-windows-msvc": ["v8_enable_sandbox"],
        "aarch64-unknown-linux-gnu": ["v8_enable_sandbox"],
        "aarch64-unknown-linux-musl": ["v8_enable_sandbox"],
        "x86_64-apple-darwin": ["v8_enable_sandbox"],
        "x86_64-pc-windows-gnullvm": ["v8_enable_sandbox"],
        "x86_64-pc-windows-msvc": ["v8_enable_sandbox"],
        "x86_64-unknown-linux-gnu": ["v8_enable_sandbox"],
        "x86_64-unknown-linux-musl": ["v8_enable_sandbox"],
    },
    gen_build_script = "on",
    patch_args = ["-p1"],
    patches = [
        "//patches:rusty_v8_prebuilt_out_dir.patch",
    ],
)

inject_repo(crate, "v8_targets")

llvm = use_extension("@llvm//extensions:llvm.bzl", "llvm")
use_repo(llvm, "llvm-project")

crate.annotation(
    # Provide the hermetic SDK path so the build script doesn't try to invoke an unhermetic `xcrun --show-sdk-path`.
    build_script_data = [
        "@macos_sdk//sysroot",
    ],
    build_script_env = {
        "BINDGEN_EXTRA_CLANG_ARGS": "-Xclang -internal-isystem -Xclang $(location @llvm//:builtin_resource_dir)/include",
        "COREAUDIO_SDK_PATH": "$(location @macos_sdk//sysroot)",
        "LIBCLANG_PATH": "$(location @llvm-project//clang:libclang_interface_output)",
    },
    build_script_tools = [
        "@llvm-project//clang:libclang_interface_output",
        "@llvm//:builtin_resource_dir",
    ],
    crate = "coreaudio-sys",
    gen_build_script = "on",
)

inject_repo(crate, "llvm", "llvm-project", "macos_sdk")

crate.annotation(
    # Provide the hermetic SDK path so the build script doesn't try to invoke an unavailable `xcrun --show-sdk-path`.
    build_script_data = [
        "@macos_sdk//sysroot",
    ],
    build_script_env = {
        "WEBRTC_SYS_DARWIN_SDK_PATH": "$(location @macos_sdk//sysroot)",
        "WEBRTC_SYS_LINK_OUT_DIR": "1",
    },
    crate = "webrtc-sys",
    gen_build_script = "on",
    patch_args = ["-p1"],
    patches = [
        "//patches:webrtc-sys_hermetic_darwin_sysroot.patch",
    ],
)

# Fix readme inclusions
crate.annotation(
    crate = "windows-link",
    patch_args = ["-p1"],
    patches = [
        "//patches:windows-link.patch",
    ],
)

bazel_dep(name = "alsa_lib", version = "1.2.9.bcr.4")

crate.annotation(
    crate = "alsa-sys",
    gen_build_script = "off",
    deps = ["@alsa_lib"],
)

inject_repo(crate, "alsa_lib")

bazel_dep(name = "v8", version = "14.6.202.9")
archive_override(
    module_name = "v8",
    integrity = "sha256-JphDwLAzsd9KvgRZ7eQvNtPU6qGd3XjFt/a/1QITAJU=",
    patch_strip = 3,
    patches = [
        "//patches:v8_module_deps.patch",
        "//patches:v8_bazel_rules.patch",
        "//patches:v8_source_portability.patch",
    ],
    strip_prefix = "v8-14.6.202.9",
    urls = ["https://github.com/v8/v8/archive/refs/tags/14.6.202.9.tar.gz"],
)

http_archive(
    name = "v8_crate_150_4_0",
    build_file = "//third_party/v8:v8_crate.BUILD.bazel",
    sha256 = "42a978ff11f15b24e5c05a7123cf2b68f41e763546699781a924ef4e2cf43a49",
    strip_prefix = "v8-150.4.0",
    type = "tar.gz",
    urls = ["https://static.crates.io/crates/v8/v8-146.4.0.crate"],
)

http_file(
    name = "rusty_v8_146_4_0_aarch64_apple_darwin_archive",
    downloaded_file_path = "librusty_v8_release_aarch64-apple-darwin.a.gz",
    sha256 = "bfe2c9be32a56c28546f0f965825ee68fbf606405f310cc4e17b448a568cf98a",
    urls = [
        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/librusty_v8_release_aarch64-apple-darwin.a.gz",
    ],
)

http_file(
    name = "rusty_v8_146_4_0_aarch64_unknown_linux_gnu_archive",
    downloaded_file_path = "librusty_v8_release_aarch64-unknown-linux-gnu.a.gz",
    sha256 = "dbf165b07c81bdb054bc046b43d23e69fcf7bcc1a4c1b5b4776983a71062ecd8",
    urls = [
        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/librusty_v8_release_aarch64-unknown-linux-gnu.a.gz",
    ],
)

http_file(
    name = "rusty_v8_146_4_0_aarch64_pc_windows_msvc_archive",
    downloaded_file_path = "rusty_v8_release_aarch64-pc-windows-msvc.lib.gz",
    sha256 = "ed13363659c6d08583ac8fdc40493445c5767d8b94955a4d5d7bb8d5a81f6bf8",
    urls = [
        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/rusty_v8_release_aarch64-pc-windows-msvc.lib.gz",
    ],
)

http_file(
    name = "rusty_v8_146_4_0_x86_64_apple_darwin_archive",
    downloaded_file_path = "librusty_v8_release_x86_64-apple-darwin.a.gz",
    sha256 = "630cd240f1bbecdb071417dc18387ab81cf67c549c1c515a0b4fcf9eba647bb7",
    urls = [
        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/librusty_v8_release_x86_64-apple-darwin.a.gz",
    ],
)

http_file(
    name = "rusty_v8_146_4_0_x86_64_unknown_linux_gnu_archive",
    downloaded_file_path = "librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
    sha256 = "e64b4d99e4ae293a2e846244a89b80178ba10382c13fb591c1fa6968f5291153",
    urls = [
        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
    ],
)

http_file(
    name = "rusty_v8_146_4_0_x86_64_pc_windows_msvc_archive",
    downloaded_file_path = "rusty_v8_release_x86_64-pc-windows-msvc.lib.gz",
    sha256 = "90a9a2346acd3685a355e98df85c24dbe406cb124367d16259a4b5d522621862",
    urls = [
        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/rusty_v8_release_x86_64-pc-windows-msvc.lib.gz",
    ],
)

http_file(
    name = "rusty_v8_146_4_0_aarch64_unknown_linux_musl_archive",
    downloaded_file_path = "librusty_v8_release_aarch64-unknown-linux-musl.a.gz",
    sha256 = "27a08ed26c34297bfd93e514692ccc44b85f8b15c6aa39cf34e784f84fb37e8e",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v146.4.0/librusty_v8_release_aarch64-unknown-linux-musl.a.gz",
    ],
)

http_file(
    name = "rusty_v8_146_4_0_aarch64_unknown_linux_musl_binding",
    downloaded_file_path = "src_binding_release_aarch64-unknown-linux-musl.rs",
    sha256 = "09f8900ced8297c229246c7a50b2e0ec23c54d0a554f369619cc29863f38dd1a",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v146.4.0/src_binding_release_aarch64-unknown-linux-musl.rs",
    ],
)

http_file(
    name = "rusty_v8_146_4_0_x86_64_unknown_linux_musl_archive",
    downloaded_file_path = "librusty_v8_release_x86_64-unknown-linux-musl.a.gz",
    sha256 = "20d8271ad712323d352c1383c36e3c4b755abc41ece35819c49c75ec7134d2f8",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v146.4.0/librusty_v8_release_x86_64-unknown-linux-musl.a.gz",
    ],
)

http_file(
    name = "rusty_v8_146_4_0_x86_64_unknown_linux_musl_binding",
    downloaded_file_path = "src_binding_release_x86_64-unknown-linux-musl.rs",
    sha256 = "09f8900ced8297c229246c7a50b2e0ec23c54d0a554f369619cc29863f38dd1a",
    urls = [
        "https://github.com/openai/codex/releases/download/rusty-v8-v146.4.0/src_binding_release_x86_64-unknown-linux-musl.rs",
    ],
)

use_repo(crate, "crates")

bazel_dep(name = "libcap", version = "2.27.bcr.1")

rbe_platform_repository = use_repo_rule("//:rbe.bzl", "rbe_platform_repository")

rbe_platform_repository(
    name = "rbe_platform",
)