From 00cda4a1ce4b311e215efeadfaf6c7b7fe7edb17 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sat, 8 Aug 2026 23:40:50 -0700
Subject: [PATCH 01/26] fix(bazel): point llvm flag at
 toolchains_llvm_bootstrapped, stop MODULE.bazel.lock drift

---
 .bazelrc | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.bazelrc b/.bazelrc
index de01a87443f..b227d0444e6 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -18,7 +18,15 @@ common --enable_platform_specific_config
 common:linux --host_platform=//:local_linux
 common:windows --host_platform=//:local_windows
 common --@rules_cc//cc/toolchains/args/archiver_flags:use_libtool_on_macos=False
-common --@llvm//config:experimental_stub_libgcc_s
+# The hermetic LLVM toolchain module is imported as toolchains_llvm_bootstrapped
+# (see MODULE.bazel); the upstream @llvm name no longer exists in the repo map.
+common --@toolchains_llvm_bootstrapped//config:experimental_stub_libgcc_s
+
+# Bazelisk picks the latest Bazel (no .bazelversion), and the resolved module
+# graph (rules_cc 0.2.16 vs 0.2.17) differs between runs; both rewrite the
+# committed MODULE.bazel.lock and trip check-clean-worktree. Ignore the lockfile
+# for builds; the repository cache keeps module resolution cheap.
+build --lockfile_mode=off
 
 # TODO(zbarsky): rules_rust doesn't implement this flag properly with remote exec...
 # common --@rules_rust//rust/settings:pipelined_compilation

From 1ff45b1b3163bb65366c898fce60da58880afe80 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sat, 8 Aug 2026 23:43:58 -0700
Subject: [PATCH 02/26] fix(bazel): point v8 platform flags at
 toolchains_llvm_bootstrapped

---
 .github/scripts/rusty_v8_bazel.py      | 4 ++--
 .github/workflows/rusty-v8-release.yml | 2 +-
 .github/workflows/v8-canary.yml        | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/scripts/rusty_v8_bazel.py b/.github/scripts/rusty_v8_bazel.py
index e30efb48f52..a5c674da810 100644
--- a/.github/scripts/rusty_v8_bazel.py
+++ b/.github/scripts/rusty_v8_bazel.py
@@ -65,7 +65,7 @@ def bazel_output_files(
             "cquery",
             "-c",
             compilation_mode,
-            f"--platforms=@llvm//platforms:{platform}",
+            f"--platforms=@toolchains_llvm_bootstrapped//platforms:{platform}",
             *[f"--config={config}" for config in bazel_configs],
             "--output=files",
             expression,
@@ -90,7 +90,7 @@ def bazel_build(
             "build",
             "-c",
             compilation_mode,
-            f"--platforms=@llvm//platforms:{platform}",
+            f"--platforms=@toolchains_llvm_bootstrapped//platforms:{platform}",
             *[f"--config={config}" for config in bazel_configs],
             *download_args,
             *labels,
diff --git a/.github/workflows/rusty-v8-release.yml b/.github/workflows/rusty-v8-release.yml
index 92be3761ddb..1b25e548e73 100644
--- a/.github/workflows/rusty-v8-release.yml
+++ b/.github/workflows/rusty-v8-release.yml
@@ -198,7 +198,7 @@ jobs:
             build
             -c
             opt
-            "--platforms=@llvm//platforms:${PLATFORM}"
+            "--platforms=@toolchains_llvm_bootstrapped//platforms:${PLATFORM}"
             --config=rusty-v8-upstream-libcxx
             "--config=v8-target-${V8_CPU}"
             "${pair_target}"
diff --git a/.github/workflows/v8-canary.yml b/.github/workflows/v8-canary.yml
index efa06aaad74..eb80be06534 100644
--- a/.github/workflows/v8-canary.yml
+++ b/.github/workflows/v8-canary.yml
@@ -240,7 +240,7 @@ jobs:
 
           bazel_args=(
             build
-            "--platforms=@llvm//platforms:${PLATFORM}"
+            "--platforms=@toolchains_llvm_bootstrapped//platforms:${PLATFORM}"
             --config=rusty-v8-upstream-libcxx
             "--config=v8-target-${V8_CPU}"
             "${pair_target}"

From f989d12e499e4688b64cbfad8cf1ab18bbc8deed Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 00:37:25 -0700
Subject: [PATCH 03/26] fix(ci): restore v8 module wiring and fix repo-map
 labels

MODULE.bazel never carried the v8 section after the codex import (#603):
the v8-canary build failed at option load with 'No repository visible as
'@v8''. Restore the full consumer wiring from the pre-import layout with
the currently pinned versions (crate 149.2.0, V8 source 14.9.207.2):

- v8 bazel_dep + archive_override (integrity computed from upstream tarball)
- v8_crate_149_2_0 / v8_crate_146_4_0 http_archive (shas verified)
- rusty_v8_libcxx / rusty_v8_libcxxabi (LLVM 21.1.8 release tarballs)
- rusty_v8_llvm_libc git_repository (chromium mirror pin)
- Windows MSVC http_file archives (shas match the checksum manifest)
- v8_targets new_local_repository + crate.annotation/inject_repo

Rename stale @llvm labels in third_party/v8 to the module's canonical
toolchains_llvm_bootstrapped name, including the @@llvm++glibc/+musl/
+kernel_headers extension-repo labels (the 0.5.6 module generates those
repos under its own canonical name).

check-module-bazel and the rusty_v8_bazel unit tests pass.
---
 MODULE.bazel                         | 126 +++++++++++++++++++++++++++
 third_party/v8/BUILD.bazel           |  28 +++---
 third_party/v8/libcxx.BUILD.bazel    |  14 +--
 third_party/v8/libcxxabi.BUILD.bazel |  14 +--
 4 files changed, 154 insertions(+), 28 deletions(-)

diff --git a/MODULE.bazel b/MODULE.bazel
index 5366f7cc158..22b1fbe2e1d 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -223,3 +223,129 @@ rbe_platform_repository = use_repo_rule("//:rbe.bzl", "rbe_platform_repository")
 rbe_platform_repository(
     name = "rbe_platform",
 )
+
+# ---------------------------------------------------------------------------
+# V8 / rusty_v8 consumer wiring (restored 2026-08-09).
+#
+# The original v8 section was lost when MODULE.bazel was rewritten during the
+# codex import (#603). Rebuilt from the pre-import upstream layout (git history
+# cf7d639e6~1) with the currently pinned versions:
+#   - v8 crate:            149.2.0     (codex-rs/Cargo.lock)
+#   - upstream V8 source:  14.9.207.2  (third_party/v8/README.md)
+# All integrity digests were computed from the pinned upstream artifacts on
+# 2026-08-09; the Windows prebuilt shas match
+# third_party/v8/rusty_v8_149_2_0.sha256.
+# ---------------------------------------------------------------------------
+
+http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
+new_local_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:local.bzl", "new_local_repository")
+git_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
+
+# Maps the third_party/v8 package into a repo so the generated v8 crate rules
+# can consume the per-target archive/binding selectors.
+new_local_repository(
+    name = "v8_targets",
+    build_file = "//third_party/v8:BUILD.bazel",
+    path = "third_party/v8",
+)
+
+crate.annotation(
+    build_script_data = [
+        "@v8_targets//:rusty_v8_archive_for_target",
+        "@v8_targets//:rusty_v8_binding_for_target",
+    ],
+    build_script_env = {
+        "RUSTY_V8_ARCHIVE": "$(execpath @v8_targets//:rusty_v8_archive_for_target)",
+        "RUSTY_V8_SRC_BINDING_PATH": "$(execpath @v8_targets//:rusty_v8_binding_for_target)",
+    },
+    crate = "v8",
+    gen_build_script = "on",
+    patch_args = ["-p1"],
+    patches = [
+        "//patches:rusty_v8_prebuilt_out_dir.patch",
+    ],
+)
+
+inject_repo(crate, "v8_targets")
+
+bazel_dep(name = "v8", version = "14.9.207.2")
+archive_override(
+    module_name = "v8",
+    integrity = "sha256-tflbZE5srqal6leMxJjK/ZQtwpF96OMGJ6avd5lice4=",
+    patch_strip = 3,
+    patches = [
+        "//patches:v8_module_deps.patch",
+        "//patches:v8_bazel_rules.patch",
+        "//patches:v8_source_portability.patch",
+    ],
+    strip_prefix = "v8-14.9.207.2",
+    urls = ["https://github.com/v8/v8/archive/refs/tags/14.9.207.2.tar.gz"],
+)
+
+# rustc-style bindings vendored into the v8 crate archives.
+http_archive(
+    name = "v8_crate_149_2_0",
+    build_file = "//third_party/v8:v8_crate.BUILD.bazel",
+    sha256 = "46dccf61a364b61bbaac70a8ba64a1a1006e87123b7d62eaeec999a3ba31ecdb",
+    strip_prefix = "v8-149.2.0",
+    type = "tar.gz",
+    urls = ["https://static.crates.io/crates/v8/v8-149.2.0.crate"],
+)
+
+# Legacy binding targets in third_party/v8/BUILD.bazel still reference the
+# 146.4.0 crate archive; keep both pinned until those targets are retired.
+http_archive(
+    name = "v8_crate_146_4_0",
+    build_file = "//third_party/v8:v8_crate.BUILD.bazel",
+    sha256 = "d97bcac5cdc5a195a4813f1855a6bc658f240452aac36caa12fd6c6f16026ab1",
+    strip_prefix = "v8-146.4.0",
+    type = "tar.gz",
+    urls = ["https://static.crates.io/crates/v8/v8-146.4.0.crate"],
+)
+
+# Custom libc++/libc++abi sources for the v8 consumer builds, matched to the
+# hermetic toolchain's LLVM 21.1.8. The BUILD overlays live in third_party/v8.
+http_archive(
+    name = "rusty_v8_libcxx",
+    build_file = "//third_party/v8:libcxx.BUILD.bazel",
+    sha256 = "6422a58a5c29b7f4fda224cfdc07842be8a208a61301bbba7a219116e3351809",
+    strip_prefix = "libcxx-21.1.8.src",
+    urls = ["https://github.com/llvm/llvm-project/releases/download/llvmorg-21.1.8/libcxx-21.1.8.src.tar.xz"],
+)
+
+http_archive(
+    name = "rusty_v8_libcxxabi",
+    build_file = "//third_party/v8:libcxxabi.BUILD.bazel",
+    sha256 = "709c9a63bde1e36a80d8675becc38073b85f0fa1b4111e34542b885c9e1239da",
+    strip_prefix = "libcxxabi-21.1.8.src",
+    urls = ["https://github.com/llvm/llvm-project/releases/download/llvmorg-21.1.8/libcxxabi-21.1.8.src.tar.xz"],
+)
+
+# llvm-libc headers (chromium mirror pin, matching upstream codex usage).
+git_repository(
+    name = "rusty_v8_llvm_libc",
+    build_file = "//third_party/v8:llvm_libc.BUILD.bazel",
+    commit = "9309c117ebae84dd2f9df1ef99de4782162527d5",
+    remote = "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
+)
+
+# Prebuilt Windows MSVC archives — the only remaining prebuilt rusty_v8 inputs;
+# every other target is source-built by Bazel.
+http_file(
+    name = "rusty_v8_149_2_0_aarch64_pc_windows_msvc_archive",
+    downloaded_file_path = "rusty_v8_release_aarch64-pc-windows-msvc.lib.gz",
+    sha256 = "923f2b6ccdc14526b814e171e34c9aafd7969f12304948857c6696d022f0fb3c",
+    urls = [
+        "https://github.com/denoland/rusty_v8/releases/download/v149.2.0/rusty_v8_release_aarch64-pc-windows-msvc.lib.gz",
+    ],
+)
+
+http_file(
+    name = "rusty_v8_149_2_0_x86_64_pc_windows_msvc_archive",
+    downloaded_file_path = "rusty_v8_release_x86_64-pc-windows-msvc.lib.gz",
+    sha256 = "12b5a791b54e92f748738ad8d0d12dad8d281a2d836638ad1aa6678e3b855d9a",
+    urls = [
+        "https://github.com/denoland/rusty_v8/releases/download/v149.2.0/rusty_v8_release_x86_64-pc-windows-msvc.lib.gz",
+    ],
+)
diff --git a/third_party/v8/BUILD.bazel b/third_party/v8/BUILD.bazel
index 4edad427310..92235eb1cc1 100644
--- a/third_party/v8/BUILD.bazel
+++ b/third_party/v8/BUILD.bazel
@@ -9,7 +9,7 @@ config_setting(
     constraint_values = [
         "@platforms//cpu:aarch64",
         "@platforms//os:linux",
-        "@llvm//constraints/libc:musl",
+        "@toolchains_llvm_bootstrapped//constraints/libc:musl",
     ],
 )
 
@@ -18,7 +18,7 @@ config_setting(
     constraint_values = [
         "@platforms//cpu:x86_64",
         "@platforms//os:linux",
-        "@llvm//constraints/libc:musl",
+        "@toolchains_llvm_bootstrapped//constraints/libc:musl",
     ],
 )
 
@@ -306,23 +306,23 @@ genrule(
     name = "v8_146_4_0_aarch64_unknown_linux_musl_release",
     srcs = [
         ":v8_146_4_0_aarch64_unknown_linux_musl_release_base",
-        "@llvm//runtimes/compiler-rt:clang_rt.builtins.static",
+        "@toolchains_llvm_bootstrapped//runtimes/compiler-rt:clang_rt.builtins.static",
     ],
     outs = ["libv8_146_4_0_aarch64_unknown_linux_musl.a"],
     cmd = """
       cat > "$(@D)/merge.mri" <<'EOF'
 create $@
 addlib $(location :v8_146_4_0_aarch64_unknown_linux_musl_release_base)
-addlib $(location @llvm//runtimes/compiler-rt:clang_rt.builtins.static)
+addlib $(location @toolchains_llvm_bootstrapped//runtimes/compiler-rt:clang_rt.builtins.static)
 save
 end
 EOF
-      $(location @llvm//tools:llvm-ar) -M < "$(@D)/merge.mri"
-      $(location @llvm//tools:llvm-ranlib) "$@"
+      $(location @toolchains_llvm_bootstrapped//tools:llvm-ar) -M < "$(@D)/merge.mri"
+      $(location @toolchains_llvm_bootstrapped//tools:llvm-ranlib) "$@"
     """,
     tools = [
-        "@llvm//tools:llvm-ar",
-        "@llvm//tools:llvm-ranlib",
+        "@toolchains_llvm_bootstrapped//tools:llvm-ar",
+        "@toolchains_llvm_bootstrapped//tools:llvm-ranlib",
     ],
 )
 
@@ -379,23 +379,23 @@ genrule(
     name = "v8_149_2_0_aarch64_unknown_linux_musl_release",
     srcs = [
         ":v8_149_2_0_aarch64_unknown_linux_musl_release_base",
-        "@llvm//runtimes/compiler-rt:clang_rt.builtins.static",
+        "@toolchains_llvm_bootstrapped//runtimes/compiler-rt:clang_rt.builtins.static",
     ],
     outs = ["libv8_149_2_0_aarch64_unknown_linux_musl.a"],
     cmd = """
       cat > "$(@D)/merge.mri" <<'EOF'
 create $@
 addlib $(location :v8_149_2_0_aarch64_unknown_linux_musl_release_base)
-addlib $(location @llvm//runtimes/compiler-rt:clang_rt.builtins.static)
+addlib $(location @toolchains_llvm_bootstrapped//runtimes/compiler-rt:clang_rt.builtins.static)
 save
 end
 EOF
-      $(location @llvm//tools:llvm-ar) -M < "$(@D)/merge.mri"
-      $(location @llvm//tools:llvm-ranlib) "$@"
+      $(location @toolchains_llvm_bootstrapped//tools:llvm-ar) -M < "$(@D)/merge.mri"
+      $(location @toolchains_llvm_bootstrapped//tools:llvm-ranlib) "$@"
     """,
     tools = [
-        "@llvm//tools:llvm-ar",
-        "@llvm//tools:llvm-ranlib",
+        "@toolchains_llvm_bootstrapped//tools:llvm-ar",
+        "@toolchains_llvm_bootstrapped//tools:llvm-ranlib",
     ],
 )
 
diff --git a/third_party/v8/libcxx.BUILD.bazel b/third_party/v8/libcxx.BUILD.bazel
index aeff24a8e6a..5cd26bf5eac 100644
--- a/third_party/v8/libcxx.BUILD.bazel
+++ b/third_party/v8/libcxx.BUILD.bazel
@@ -1,4 +1,4 @@
-load("@llvm//toolchain/runtimes:cc_runtime_library.bzl", "cc_runtime_stage0_library")
+load("@toolchains_llvm_bootstrapped//toolchain/runtimes:cc_runtime_library.bzl", "cc_runtime_stage0_library")
 load("@rules_cc//cc:defs.bzl", "cc_library")
 
 package(default_visibility = ["//visibility:public"])
@@ -121,7 +121,7 @@ cc_runtime_stage0_library(
         "_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
         "_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
     ] + select({
-        "@llvm//platforms/config:musl": [
+        "@toolchains_llvm_bootstrapped//platforms/config:musl": [
             # Chromium's checked-in __config_site uses this switch to enable
             # libc++'s musl-specific configuration.
             "ANDROID_HOST_MUSL",
@@ -142,15 +142,15 @@ cc_runtime_stage0_library(
         "@rusty_v8_llvm_libc//:headers",
     ] + select({
         ":is_linux": [
-            "@@llvm++kernel_headers+kernel_headers//:kernel_headers",
+            "@@toolchains_llvm_bootstrapped++kernel_headers+kernel_headers//:kernel_headers",
         ],
         "//conditions:default": [],
     }) + select({
-        "@llvm//platforms/config:gnu": [
-            "@@llvm++glibc+glibc//:gnu_libc_headers",
+        "@toolchains_llvm_bootstrapped//platforms/config:gnu": [
+            "@@toolchains_llvm_bootstrapped++glibc+glibc//:gnu_libc_headers",
         ],
-        "@llvm//platforms/config:musl": [
-            "@@llvm++musl+musl_libc//:musl_libc_headers",
+        "@toolchains_llvm_bootstrapped//platforms/config:musl": [
+            "@@toolchains_llvm_bootstrapped++musl+musl_libc//:musl_libc_headers",
         ],
         "//conditions:default": [],
     }),
diff --git a/third_party/v8/libcxxabi.BUILD.bazel b/third_party/v8/libcxxabi.BUILD.bazel
index 24e8ed5a623..b03acbd03ee 100644
--- a/third_party/v8/libcxxabi.BUILD.bazel
+++ b/third_party/v8/libcxxabi.BUILD.bazel
@@ -1,4 +1,4 @@
-load("@llvm//toolchain/runtimes:cc_runtime_library.bzl", "cc_runtime_stage0_library")
+load("@toolchains_llvm_bootstrapped//toolchain/runtimes:cc_runtime_library.bzl", "cc_runtime_stage0_library")
 load("@rules_cc//cc:defs.bzl", "cc_library")
 
 package(default_visibility = ["//visibility:public"])
@@ -66,7 +66,7 @@ cc_runtime_stage0_library(
         "_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
         "_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
     ] + select({
-        "@llvm//platforms/config:musl": [
+        "@toolchains_llvm_bootstrapped//platforms/config:musl": [
             "ANDROID_HOST_MUSL",
         ],
         "//conditions:default": [],
@@ -78,15 +78,15 @@ cc_runtime_stage0_library(
         "@rusty_v8_libcxx//:internal_headers",
     ] + select({
         ":is_linux": [
-            "@@llvm++kernel_headers+kernel_headers//:kernel_headers",
+            "@@toolchains_llvm_bootstrapped++kernel_headers+kernel_headers//:kernel_headers",
         ],
         "//conditions:default": [],
     }) + select({
-        "@llvm//platforms/config:gnu": [
-            "@@llvm++glibc+glibc//:gnu_libc_headers",
+        "@toolchains_llvm_bootstrapped//platforms/config:gnu": [
+            "@@toolchains_llvm_bootstrapped++glibc+glibc//:gnu_libc_headers",
         ],
-        "@llvm//platforms/config:musl": [
-            "@@llvm++musl+musl_libc//:musl_libc_headers",
+        "@toolchains_llvm_bootstrapped//platforms/config:musl": [
+            "@@toolchains_llvm_bootstrapped++musl+musl_libc//:musl_libc_headers",
         ],
         "//conditions:default": [],
     }),

From b486edd3d45cee8b08ecf3f1719e9c96d86fb890 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 00:42:22 -0700
Subject: [PATCH 04/26] fix(ci): add missing bazel_skylib dep for v8 package

third_party/v8/BUILD.bazel loads @bazel_skylib//rules:copy_file.bzl but
MODULE.bazel never declared the module after the codex import. Pin the
fork's previous version (1.8.2, per pre-import MODULE.bazel).
---
 MODULE.bazel | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MODULE.bazel b/MODULE.bazel
index 22b1fbe2e1d..239e9bf7027 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -37,6 +37,7 @@ use_repo(osx, "macosx15.4.sdk")
 
 # Needed to disable xcode...
 bazel_dep(name = "apple_support", version = "2.1.0")
+bazel_dep(name = "bazel_skylib", version = "1.8.2")
 bazel_dep(name = "rules_cc", version = "0.2.16")
 bazel_dep(name = "rules_platform", version = "0.1.0")
 bazel_dep(name = "rules_rs", version = "0.0.23")

From 819d02d9f792d48120dbd024c5d1d8af474ff5af Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 00:45:58 -0700
Subject: [PATCH 05/26] fix(ci): rename remaining stale @llvm labels to
 toolchains_llvm_bootstrapped

The root BUILD.bazel, bazel/platforms/release_binaries.bzl,
bazel/rules/testing/wine/wine_runtime.bzl, and rbe.bzl still referenced
@llvm//constraints/libc and @llvm//platforms, which are not visible from
the main repo map (the module is pinned as toolchains_llvm_bootstrapped).
Rename them to the canonical name so analysis of //third_party/v8 pair
targets no longer aborts on '//:local_linux'.
---
 BUILD.bazel                               | 2 +-
 bazel/platforms/release_binaries.bzl      | 2 +-
 bazel/rules/testing/wine/wine_runtime.bzl | 2 +-
 rbe.bzl                                   | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/BUILD.bazel b/BUILD.bazel
index a82126e6f1e..61df9c966da 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -9,7 +9,7 @@ platform(
     name = "local_linux",
     constraint_values = [
         # We mark the local platform as glibc-compatible because musl-built rust cannot dlopen proc macros.
-        "@llvm//constraints/libc:gnu.2.28",
+        "@toolchains_llvm_bootstrapped//constraints/libc:gnu.2.28",
     ],
     parents = ["@platforms//host"],
 )
diff --git a/bazel/platforms/release_binaries.bzl b/bazel/platforms/release_binaries.bzl
index 2e2f4450364..94927705d63 100644
--- a/bazel/platforms/release_binaries.bzl
+++ b/bazel/platforms/release_binaries.bzl
@@ -15,7 +15,7 @@ def multiplatform_binaries(name, platforms = PLATFORMS):
     for platform in platforms:
         platform_data(
             name = name + "_" + platform,
-            platform = "@llvm//platforms:" + platform,
+            platform = "@toolchains_llvm_bootstrapped//platforms:" + platform,
             target = name,
             tags = ["manual"],
         )
diff --git a/bazel/rules/testing/wine/wine_runtime.bzl b/bazel/rules/testing/wine/wine_runtime.bzl
index 9f47bdcff00..2df87497094 100644
--- a/bazel/rules/testing/wine/wine_runtime.bzl
+++ b/bazel/rules/testing/wine/wine_runtime.bzl
@@ -14,7 +14,7 @@ _WINE_RUNTIME_DATA = [
 ]
 
 WINE_TEST_TARGET_COMPATIBLE_WITH = [
-    "@llvm//constraints/libc:gnu.2.28",
+    "@toolchains_llvm_bootstrapped//constraints/libc:gnu.2.28",
     "@platforms//cpu:x86_64",
     "@platforms//os:linux",
 ]
diff --git a/rbe.bzl b/rbe.bzl
index 57e301ac776..0cf7c4e9e23 100644
--- a/rbe.bzl
+++ b/rbe.bzl
@@ -18,7 +18,7 @@ platform(
         "@platforms//cpu:{cpu}",
         "@platforms//os:linux",
         "@bazel_tools//tools/cpp:clang",
-        "@llvm//constraints/libc:gnu.2.28",
+        "@toolchains_llvm_bootstrapped//constraints/libc:gnu.2.28",
     ],
     exec_properties = {{
         # Ubuntu-based image that includes git, python3, dotslash, and other

From 48015046928aab8d708ed968d3bc47ecfcf45323 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 00:51:30 -0700
Subject: [PATCH 06/26] fix(ci): define _GNU_SOURCE for custom libc++ builds

V8's ICU torque compile fails against the hermetic glibc headers because
libc++'s __locale_dir/support/linux.h uses iswspace_l/iswprint_l/iswcntrl_l,
which glibc only declares under __USE_GNU. Chromium builds libc++ with
_GNU_SOURCE; mirror that on the custom-libcxx header library and the
libc++ runtime build.
---
 third_party/v8/BUILD.bazel        | 2 +-
 third_party/v8/libcxx.BUILD.bazel | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/third_party/v8/BUILD.bazel b/third_party/v8/BUILD.bazel
index 92235eb1cc1..e1156058e14 100644
--- a/third_party/v8/BUILD.bazel
+++ b/third_party/v8/BUILD.bazel
@@ -144,7 +144,7 @@ cc_library(
         ":platform_aarch64_unknown_linux_musl": ["ANDROID_HOST_MUSL"],
         ":platform_x86_64_unknown_linux_musl": ["ANDROID_HOST_MUSL"],
         "//conditions:default": [],
-    }),
+    }) + ["_GNU_SOURCE"],
     visibility = ["//visibility:public"],
     deps = [
         "@rusty_v8_libcxx//:headers",
diff --git a/third_party/v8/libcxx.BUILD.bazel b/third_party/v8/libcxx.BUILD.bazel
index 5cd26bf5eac..a03906d173d 100644
--- a/third_party/v8/libcxx.BUILD.bazel
+++ b/third_party/v8/libcxx.BUILD.bazel
@@ -111,6 +111,10 @@ cc_runtime_stage0_library(
         "//conditions:default": ["-fPIC"],
     }),
     defines = [
+        # Chromium always builds libc++ with _GNU_SOURCE; without it glibc
+        # does not declare iswspace_l/iswprint_l/... which libc++'s
+        # __locale_dir/support/linux.h relies on.
+        "_GNU_SOURCE",
         "CR_LIBCXX_REVISION=99457fa555797f8c5ac3c076ca288d8481d3b23a",
         "LIBCXX_BUILDING_LIBCXXABI",
         "LIBC_NAMESPACE=__llvm_libc_cr",

From 967ca1f81650dabca2fb6bf13f76d52c2553acda Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 01:28:44 -0700
Subject: [PATCH 07/26] fix(ci): give v8 targets the hermetic C library headers

v8_libbase compiles with -nostdinc++ against the custom libc++ headers,
but the toolchain's builtin include paths put its own libc++ headers
(runtimes/libcxx) before the glibc/musl headers. libc++'s C-compat
wrappers (e.g. <string.h>) rely on #include_next to reach the C library,
so the search dead-ends on the toolchain's libc++ copy and C symbols like
::memcpy never resolve ('reference to unresolved using declaration' in
__functional/hash.h).

Wire the extension-generated C library headers into _default_args deps,
mirroring the libcxx overlay selects (glibc for gnu platforms, musl for
musl), so include_next from the custom libc++ wrappers lands on the real
headers. Also add --verbose_failures to the canary build step so future
failures print the full action command.
---
 .github/workflows/v8-canary.yml |  1 +
 patches/v8_bazel_rules.patch    | 14 +++++++++++++-
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/v8-canary.yml b/.github/workflows/v8-canary.yml
index eb80be06534..0410824ca4b 100644
--- a/.github/workflows/v8-canary.yml
+++ b/.github/workflows/v8-canary.yml
@@ -244,6 +244,7 @@ jobs:
             --config=rusty-v8-upstream-libcxx
             "--config=v8-target-${V8_CPU}"
             "${pair_target}"
+            --verbose_failures
             --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
           )
           if [[ "${SANDBOX}" != "true" ]]; then
diff --git a/patches/v8_bazel_rules.patch b/patches/v8_bazel_rules.patch
index fce2be28949..f100b4e16e2 100644
--- a/patches/v8_bazel_rules.patch
+++ b/patches/v8_bazel_rules.patch
@@ -32,7 +32,7 @@ index bbe1495..6673518 100644
  
  def v8_string(name, default = ""):
      _create_option_string(name = name, build_setting_default = default)
-@@ -97,7 +109,13 @@ v8_config = rule(
+@@ -97,7 +109,25 @@ v8_config = rule(
  
  def _default_args():
      return struct(
@@ -43,6 +43,18 @@ index bbe1495..6673518 100644
 +                "@@//third_party/v8:rusty_v8_custom_libcxx_runtime",
 +            ],
 +            "//conditions:default": [],
++        }) + select({
++            # V8 targets compile against the hermetic C library headers via
++            # libc++'s include_next; without them the C wrappers dead-end on
++            # the toolchain's own libc++ copy and C symbols (e.g. ::memcpy)
++            # never resolve. Mirror the libcxx overlays' platform select.
++            "@toolchains_llvm_bootstrapped//platforms/config:gnu": [
++                "@@toolchains_llvm_bootstrapped++glibc+glibc//:gnu_libc_headers",
++            ],
++            "@toolchains_llvm_bootstrapped//platforms/config:musl": [
++                "@@toolchains_llvm_bootstrapped++musl+musl_libc//:musl_libc_headers",
++            ],
++            "//conditions:default": [],
 +        }),
          defines = select({
              "@v8//bazel/config:is_windows": [

From 1a2c9b7e1725d5428868e28092ec47be075f5033 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 01:36:37 -0700
Subject: [PATCH 08/26] fix(ci): use canonical labels for v8 C-header select
 keys

The v8+ external repo cannot see @toolchains_llvm_bootstrapped by name
(its patched MODULE.bazel does not declare the module). Reference the
gnu/musl config settings via their canonical @@ names, matching how the
libcxx overlays reference the extension repos.
---
 patches/v8_bazel_rules.patch | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/patches/v8_bazel_rules.patch b/patches/v8_bazel_rules.patch
index f100b4e16e2..b8a1c3d5fa6 100644
--- a/patches/v8_bazel_rules.patch
+++ b/patches/v8_bazel_rules.patch
@@ -48,10 +48,10 @@ index bbe1495..6673518 100644
 +            # libc++'s include_next; without them the C wrappers dead-end on
 +            # the toolchain's own libc++ copy and C symbols (e.g. ::memcpy)
 +            # never resolve. Mirror the libcxx overlays' platform select.
-+            "@toolchains_llvm_bootstrapped//platforms/config:gnu": [
++            "@@toolchains_llvm_bootstrapped//platforms/config:gnu": [
 +                "@@toolchains_llvm_bootstrapped++glibc+glibc//:gnu_libc_headers",
 +            ],
-+            "@toolchains_llvm_bootstrapped//platforms/config:musl": [
++            "@@toolchains_llvm_bootstrapped//platforms/config:musl": [
 +                "@@toolchains_llvm_bootstrapped++musl+musl_libc//:musl_libc_headers",
 +            ],
 +            "//conditions:default": [],

From b3f194c87e5ec2aec63afab7d1c0b56ff8fcf9a3 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 01:46:10 -0700
Subject: [PATCH 09/26] fix(ci): expose hermetic C library headers via
 root-repo wrapper

The v8+ external module cannot reference @toolchains_llvm_bootstrapped at
all - its patched MODULE.bazel does not declare the module, so even
canonical labels fail to resolve ('Repository ... is not defined').

Move the gnu/musl platform selection into a root-repo wrapper target
(rusty_v8_c_library_headers) that v8 reaches through the same
@@//third_party/v8:... pattern as the libcxx overlays, and select the
glibc/musl header sets inside the root repo where the toolchain module
and its extension repos are visible.
---
 patches/v8_bazel_rules.patch | 15 ++-------------
 third_party/v8/BUILD.bazel   | 19 +++++++++++++++++++
 2 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/patches/v8_bazel_rules.patch b/patches/v8_bazel_rules.patch
index b8a1c3d5fa6..841c8f391ee 100644
--- a/patches/v8_bazel_rules.patch
+++ b/patches/v8_bazel_rules.patch
@@ -32,7 +32,7 @@ index bbe1495..6673518 100644
  
  def v8_string(name, default = ""):
      _create_option_string(name = name, build_setting_default = default)
-@@ -97,7 +109,25 @@ v8_config = rule(
+@@ -97,7 +109,14 @@ v8_config = rule(
  
  def _default_args():
      return struct(
@@ -41,18 +41,7 @@ index bbe1495..6673518 100644
 +            "@v8//:is_v8_use_rusty_v8_custom_libcxx": [
 +                "@@//third_party/v8:rusty_v8_custom_libcxx_headers",
 +                "@@//third_party/v8:rusty_v8_custom_libcxx_runtime",
-+            ],
-+            "//conditions:default": [],
-+        }) + select({
-+            # V8 targets compile against the hermetic C library headers via
-+            # libc++'s include_next; without them the C wrappers dead-end on
-+            # the toolchain's own libc++ copy and C symbols (e.g. ::memcpy)
-+            # never resolve. Mirror the libcxx overlays' platform select.
-+            "@@toolchains_llvm_bootstrapped//platforms/config:gnu": [
-+                "@@toolchains_llvm_bootstrapped++glibc+glibc//:gnu_libc_headers",
-+            ],
-+            "@@toolchains_llvm_bootstrapped//platforms/config:musl": [
-+                "@@toolchains_llvm_bootstrapped++musl+musl_libc//:musl_libc_headers",
++                "@@//third_party/v8:rusty_v8_c_library_headers",
 +            ],
 +            "//conditions:default": [],
 +        }),
diff --git a/third_party/v8/BUILD.bazel b/third_party/v8/BUILD.bazel
index e1156058e14..22e40217b50 100644
--- a/third_party/v8/BUILD.bazel
+++ b/third_party/v8/BUILD.bazel
@@ -161,6 +161,25 @@ cc_library(
     ],
 )
 
+# Hermetic C library headers for the custom-libc++ builds. libc++'s C-compat
+# wrappers (e.g. <string.h>) reach the C library via #include_next, so the
+# include search must land on the real glibc/musl headers instead of the
+# toolchain's own libc++ copies. v8+ references this wrapper (rather than the
+# toolchain module directly, which is invisible from that external repo).
+cc_library(
+    name = "rusty_v8_c_library_headers",
+    visibility = ["//visibility:public"],
+    deps = select({
+        "@toolchains_llvm_bootstrapped//platforms/config:gnu": [
+            "@@toolchains_llvm_bootstrapped++glibc+glibc//:gnu_libc_headers",
+        ],
+        "@toolchains_llvm_bootstrapped//platforms/config:musl": [
+            "@@toolchains_llvm_bootstrapped++musl+musl_libc//:musl_libc_headers",
+        ],
+        "//conditions:default": [],
+    }),
+)
+
 genrule(
     name = "binding_cc",
     srcs = ["@v8_crate_146_4_0//:binding_cc"],

From 6b916a93e37101e62dd9942cde89c42d051b9990 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 01:53:43 -0700
Subject: [PATCH 10/26] fix(ci): wire C library headers into ICU custom-libcxx
 deps

The patched bazel/BUILD.icu builds icuuc/icui18n with -nostdinc++ and the
custom libc++ headers, so their include_next C-compat wrappers hit the
same dead-end as the v8 targets: no glibc headers in the search path,
C symbols like memcpy/memset unresolved (cmemory.h errors).

Add rusty_v8_c_library_headers to CUSTOM_LIBCXX_DEPS alongside the
headers/runtime wrappers.
---
 patches/v8_bazel_rules.patch | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/patches/v8_bazel_rules.patch b/patches/v8_bazel_rules.patch
index 841c8f391ee..ec945e44f51 100644
--- a/patches/v8_bazel_rules.patch
+++ b/patches/v8_bazel_rules.patch
@@ -384,7 +384,7 @@ diff --git a/orig/v8-14.9.207.2/bazel/BUILD.icu b/mod/v8-14.9.207.2/bazel/BUILD.
 index 5fda2f4..8c3c372 100644
 --- a/orig/v8-14.9.207.2/bazel/BUILD.icu
 +++ b/mod/v8-14.9.207.2/bazel/BUILD.icu
-@@ -1,3 +1,24 @@
+@@ -1,3 +1,25 @@
 +load("@rules_cc//cc:defs.bzl", "cc_library")
 +
 +CUSTOM_LIBCXX_COPTS = select({
@@ -402,6 +402,7 @@ index 5fda2f4..8c3c372 100644
 +    "@v8//:is_v8_use_rusty_v8_custom_libcxx": [
 +        "@@//third_party/v8:rusty_v8_custom_libcxx_headers",
 +        "@@//third_party/v8:rusty_v8_custom_libcxx_runtime",
++        "@@//third_party/v8:rusty_v8_c_library_headers",
 +    ],
 +    "//conditions:default": [],
 +})
@@ -409,7 +410,7 @@ index 5fda2f4..8c3c372 100644
  # Copyright 2021 the V8 project authors. All rights reserved.
  # Use of this source code is governed by a BSD-style license that can be
  # found in the LICENSE file.
-@@ -16,15 +37,12 @@ cc_library(
+@@ -16,15 +38,12 @@ cc_library(
      ]),
      copts = select({
          "@platforms//os:windows": [
@@ -427,7 +428,7 @@ index 5fda2f4..8c3c372 100644
      data = [":icudata"],
      defines = [
          "HAVE_DLOPEN=0",
-@@ -54,6 +72,7 @@ cc_library(
+@@ -54,6 +73,7 @@ cc_library(
          "U_ICUDATAENTRY_IN_COMMON",
      ],
      tags = ["requires-rtti"],
@@ -435,7 +436,7 @@ index 5fda2f4..8c3c372 100644
      alwayslink = 1,
  )
  
-@@ -65,19 +84,16 @@ cc_library(
+@@ -65,19 +85,16 @@ cc_library(
      ]),
      copts = select({
          "@platforms//os:windows": [
@@ -458,7 +459,7 @@ index 5fda2f4..8c3c372 100644
      alwayslink = 1,
  )
  
-@@ -93,13 +109,10 @@ cc_library(
+@@ -93,13 +110,10 @@ cc_library(
      ]),
      copts = select({
          "@platforms//os:windows": [
@@ -474,7 +475,7 @@ index 5fda2f4..8c3c372 100644
      include_prefix = "third_party/icu",
      local_defines = [
          "U_COMMON_IMPLEMENTATION",
-@@ -108,6 +121,6 @@ cc_library(
+@@ -108,6 +122,6 @@ cc_library(
      deps = [
          ":icui18n",
          ":icuuc",

From ff34e24cd0008aa44decd9153c46f88a58071ccc Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 02:18:17 -0700
Subject: [PATCH 11/26] fix(ci): order C library headers before libc++ in linux
 toolchain

With -nostdinc++ the custom libc++ headers (used for the V8 build) and
the toolchain's own libc++ headers both sit before glibc/musl in the
include search path. libc++'s C-compat wrappers reach the C library via
#include_next, so the chain dead-ends on the toolchain's libc++ copy
(identical _LIBCPP_* guards skip its body) and C symbols like ::memcpy
never resolve, even with glibc on the path after it.

Patch the toolchains_llvm_bootstrapped module so linux_toolchain_args
emits the kernel + glibc/musl -isystem paths before the libc++ ones,
keeping linux_target_headers (module map) in sync. The root-repo
rusty_v8_c_library_headers wrapper stays as belt-and-suspenders.
---
 MODULE.bazel                                  |  1 +
 ..._llvm_bootstrapped_c_library_headers.patch | 59 +++++++++++++++++++
 2 files changed, 60 insertions(+)
 create mode 100644 patches/toolchains_llvm_bootstrapped_c_library_headers.patch

diff --git a/MODULE.bazel b/MODULE.bazel
index 239e9bf7027..677d642b23f 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -7,6 +7,7 @@ single_version_override(
     patch_strip = 1,
     patches = [
         "//patches:toolchains_llvm_bootstrapped_resource_dir.patch",
+        "//patches:toolchains_llvm_bootstrapped_c_library_headers.patch",
     ],
 )
 
diff --git a/patches/toolchains_llvm_bootstrapped_c_library_headers.patch b/patches/toolchains_llvm_bootstrapped_c_library_headers.patch
new file mode 100644
index 00000000000..5ed29600dd0
--- /dev/null
+++ b/patches/toolchains_llvm_bootstrapped_c_library_headers.patch
@@ -0,0 +1,59 @@
+diff --git a/toolchain/BUILD.bazel b/toolchain/BUILD.bazel
+index d38c471..6a13459 100644
+--- a/toolchain/BUILD.bazel
++++ b/toolchain/BUILD.bazel
+@@ -222,9 +222,7 @@ cc_args_list(
+ # TODO(zbarsky): This must match llvm/toolchains/llvm.bzl
+ cc_args_list(
+     name = "linux_toolchain_args",
+-    args = [
+-        "//toolchain/args:libcxx_headers_include_search_paths",
+-    ] + select({
++    args = select({
+         "//platforms/config:musl": [
+             "//toolchain/args/linux:kernel_headers_include_search_paths",
+             "//toolchain/args/linux:musl_libc_headers_include_search_paths",
+@@ -234,7 +232,14 @@ cc_args_list(
+             "//toolchain/args/linux:glibc_headers_include_search_paths",
+         ],
+         "//conditions:default": [],
+-    }) + select({
++    }) + [
++        # The C library headers must precede the libc++ headers: libc++'s
++        # C-compat wrappers reach the C library via #include_next, and a
++        # second libc++ copy in the search path (e.g. the custom libc++
++        # used for the V8 build) would otherwise dead-end the chain before
++        # the C library is reached.
++        "//toolchain/args:libcxx_headers_include_search_paths",
++    ] + select({
+         "//platforms/config:musl": [
+             #TODO: Handle musl dynamic linking
+             # musl implies static linking for now
+diff --git a/toolchain/llvm/llvm.bzl b/toolchain/llvm/llvm.bzl
+index 35b5620..f46099c 100644
+--- a/toolchain/llvm/llvm.bzl
++++ b/toolchain/llvm/llvm.bzl
+@@ -186,10 +186,7 @@ def declare_llvm_targets(*, suffix = ""):
+         name = "linux_target_headers",
+         srcs = [
+             ":builtin_headers",
+-            "@toolchains_llvm_bootstrapped//runtimes/libcxx:libcxx_headers_include_search_directory",
+-            "@toolchains_llvm_bootstrapped//runtimes/libcxx:libcxxabi_headers_include_search_directory",
+             "@kernel_headers//:kernel_headers_directory",
+-            "@toolchains_llvm_bootstrapped//sanitizers:sanitizers_headers_include_search_directory",
+         ] + select({
+             "@toolchains_llvm_bootstrapped//platforms/config:musl": [
+                 "@toolchains_llvm_bootstrapped//runtimes/musl:musl_headers_include_search_directory"
+@@ -197,7 +194,11 @@ def declare_llvm_targets(*, suffix = ""):
+             "@toolchains_llvm_bootstrapped//platforms/config:gnu": [
+                 "@toolchains_llvm_bootstrapped//runtimes/glibc:glibc_headers_include_search_directory",
+             ],
+-        }),
++        }) + [
++            "@toolchains_llvm_bootstrapped//runtimes/libcxx:libcxx_headers_include_search_directory",
++            "@toolchains_llvm_bootstrapped//runtimes/libcxx:libcxxabi_headers_include_search_directory",
++            "@toolchains_llvm_bootstrapped//sanitizers:sanitizers_headers_include_search_directory",
++        ],
+     )
+ 
+     # this must match //toolchain:windows_toolchain_args

From 05e7fdab30e28a121146587c23d8c01bf49d1556 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 02:29:20 -0700
Subject: [PATCH 12/26] Revert "fix(ci): order C library headers before libc++
 in linux toolchain"

This reverts commit ff34e24cd0008aa44decd9153c46f88a58071ccc.
---
 MODULE.bazel                                  |  1 -
 ..._llvm_bootstrapped_c_library_headers.patch | 59 -------------------
 2 files changed, 60 deletions(-)
 delete mode 100644 patches/toolchains_llvm_bootstrapped_c_library_headers.patch

diff --git a/MODULE.bazel b/MODULE.bazel
index 677d642b23f..239e9bf7027 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -7,7 +7,6 @@ single_version_override(
     patch_strip = 1,
     patches = [
         "//patches:toolchains_llvm_bootstrapped_resource_dir.patch",
-        "//patches:toolchains_llvm_bootstrapped_c_library_headers.patch",
     ],
 )
 
diff --git a/patches/toolchains_llvm_bootstrapped_c_library_headers.patch b/patches/toolchains_llvm_bootstrapped_c_library_headers.patch
deleted file mode 100644
index 5ed29600dd0..00000000000
--- a/patches/toolchains_llvm_bootstrapped_c_library_headers.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-diff --git a/toolchain/BUILD.bazel b/toolchain/BUILD.bazel
-index d38c471..6a13459 100644
---- a/toolchain/BUILD.bazel
-+++ b/toolchain/BUILD.bazel
-@@ -222,9 +222,7 @@ cc_args_list(
- # TODO(zbarsky): This must match llvm/toolchains/llvm.bzl
- cc_args_list(
-     name = "linux_toolchain_args",
--    args = [
--        "//toolchain/args:libcxx_headers_include_search_paths",
--    ] + select({
-+    args = select({
-         "//platforms/config:musl": [
-             "//toolchain/args/linux:kernel_headers_include_search_paths",
-             "//toolchain/args/linux:musl_libc_headers_include_search_paths",
-@@ -234,7 +232,14 @@ cc_args_list(
-             "//toolchain/args/linux:glibc_headers_include_search_paths",
-         ],
-         "//conditions:default": [],
--    }) + select({
-+    }) + [
-+        # The C library headers must precede the libc++ headers: libc++'s
-+        # C-compat wrappers reach the C library via #include_next, and a
-+        # second libc++ copy in the search path (e.g. the custom libc++
-+        # used for the V8 build) would otherwise dead-end the chain before
-+        # the C library is reached.
-+        "//toolchain/args:libcxx_headers_include_search_paths",
-+    ] + select({
-         "//platforms/config:musl": [
-             #TODO: Handle musl dynamic linking
-             # musl implies static linking for now
-diff --git a/toolchain/llvm/llvm.bzl b/toolchain/llvm/llvm.bzl
-index 35b5620..f46099c 100644
---- a/toolchain/llvm/llvm.bzl
-+++ b/toolchain/llvm/llvm.bzl
-@@ -186,10 +186,7 @@ def declare_llvm_targets(*, suffix = ""):
-         name = "linux_target_headers",
-         srcs = [
-             ":builtin_headers",
--            "@toolchains_llvm_bootstrapped//runtimes/libcxx:libcxx_headers_include_search_directory",
--            "@toolchains_llvm_bootstrapped//runtimes/libcxx:libcxxabi_headers_include_search_directory",
-             "@kernel_headers//:kernel_headers_directory",
--            "@toolchains_llvm_bootstrapped//sanitizers:sanitizers_headers_include_search_directory",
-         ] + select({
-             "@toolchains_llvm_bootstrapped//platforms/config:musl": [
-                 "@toolchains_llvm_bootstrapped//runtimes/musl:musl_headers_include_search_directory"
-@@ -197,7 +194,11 @@ def declare_llvm_targets(*, suffix = ""):
-             "@toolchains_llvm_bootstrapped//platforms/config:gnu": [
-                 "@toolchains_llvm_bootstrapped//runtimes/glibc:glibc_headers_include_search_directory",
-             ],
--        }),
-+        }) + [
-+            "@toolchains_llvm_bootstrapped//runtimes/libcxx:libcxx_headers_include_search_directory",
-+            "@toolchains_llvm_bootstrapped//runtimes/libcxx:libcxxabi_headers_include_search_directory",
-+            "@toolchains_llvm_bootstrapped//sanitizers:sanitizers_headers_include_search_directory",
-+        ],
-     )
- 
-     # this must match //toolchain:windows_toolchain_args

From 7b7f3314ce7e64314c913143533b0e120945b9ee Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 03:14:50 -0700
Subject: [PATCH 13/26] fix(ci): let custom libc++ include_next chains reach
 the C library

The custom libc++ (rusty_v8_libcxx) and the toolchain's own libc++ are
both libc++ 21.1.8 with identical _LIBCPP_*_H include guards. When a
custom header does #include_next <string.h> (or <ctype.h>, <math.h>,
...), the search lands on the toolchain's copy, whose guard is already
defined, so its body - including its own include_next - is skipped and
glibc/musl is never reached: C symbols like ::memcpy stay undeclared.

Restructure the custom copy's C-compat wrappers so the include_next runs
before the include guard (the pattern <wchar.h>/<stdio.h>/<stddef.h>
already use): the toolchain's copy then runs, defines the standard
_LIBCPP_*_H guard (satisfying the <cctype>-style checks), and forwards
to the C library. The remaining wrappers get their guards renamed
(_LIBCPP_CR_*_H) so the chain flows through instead of dead-ending;
their post-include_next bodies are undefs/macros only, so running twice
is harmless. math.h keeps its guard but drops the MSVC-only
_USE_MATH_DEFINES #else branch, which never triggers on our targets.

Verified with a local compile harness replicating the CI include layout
(custom -I, toolchain -isystem, real C library): the patched set
compiles cleanly, the unpatched set reproduces the unresolved-symbol
failures.
---
 MODULE.bazel                               |   4 +
 patches/rusty_v8_libcxx_include_next.patch | 343 +++++++++++++++++++++
 2 files changed, 347 insertions(+)
 create mode 100644 patches/rusty_v8_libcxx_include_next.patch

diff --git a/MODULE.bazel b/MODULE.bazel
index 239e9bf7027..72db7494781 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -313,6 +313,10 @@ http_archive(
     sha256 = "6422a58a5c29b7f4fda224cfdc07842be8a208a61301bbba7a219116e3351809",
     strip_prefix = "libcxx-21.1.8.src",
     urls = ["https://github.com/llvm/llvm-project/releases/download/llvmorg-21.1.8/libcxx-21.1.8.src.tar.xz"],
+    patch_args = ["-p1"],
+    patches = [
+        "//patches:rusty_v8_libcxx_include_next.patch",
+    ],
 )
 
 http_archive(
diff --git a/patches/rusty_v8_libcxx_include_next.patch b/patches/rusty_v8_libcxx_include_next.patch
new file mode 100644
index 00000000000..7237e31ab18
--- /dev/null
+++ b/patches/rusty_v8_libcxx_include_next.patch
@@ -0,0 +1,343 @@
+diff --git a/include/complex.h b/include/complex.h
+index 8a1f926..e0b17be 100644
+--- a/include/complex.h
++++ b/include/complex.h
+@@ -7,9 +7,8 @@
+ //
+ //===----------------------------------------------------------------------===//
+ 
+-#ifndef _LIBCPP_COMPLEX_H
+-#define _LIBCPP_COMPLEX_H
+-
++#ifndef _LIBCPP_CR_COMPLEX_H
++#define _LIBCPP_CR_COMPLEX_H
+ /*
+     complex.h synopsis
+ 
+@@ -33,4 +32,4 @@
+ #  endif
+ #endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+ 
+-#endif // _LIBCPP_COMPLEX_H
++#endif // _LIBCPP_CR_COMPLEX_H
+\ No newline at end of file
+diff --git a/include/ctype.h b/include/ctype.h
+index 066f450..6f35947 100644
+--- a/include/ctype.h
++++ b/include/ctype.h
+@@ -7,9 +7,8 @@
+ //
+ //===----------------------------------------------------------------------===//
+ 
+-#ifndef _LIBCPP_CTYPE_H
+-#define _LIBCPP_CTYPE_H
+-
++#ifndef _LIBCPP_CR_CTYPE_H
++#define _LIBCPP_CR_CTYPE_H
+ /*
+     ctype.h synopsis
+ 
+@@ -62,4 +61,4 @@ int toupper(int c);
+ #  endif
+ #endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+ 
+-#endif // _LIBCPP_CTYPE_H
++#endif // _LIBCPP_CR_CTYPE_H
+\ No newline at end of file
+diff --git a/include/errno.h b/include/errno.h
+index 692f00f..e1eba05 100644
+--- a/include/errno.h
++++ b/include/errno.h
+@@ -7,9 +7,6 @@
+ //
+ //===----------------------------------------------------------------------===//
+ 
+-#ifndef _LIBCPP_ERRNO_H
+-#define _LIBCPP_ERRNO_H
+-
+ /*
+     errno.h synopsis
+ 
+@@ -35,6 +32,9 @@ Macros:
+ #    include_next <errno.h>
+ #  endif
+ 
++#ifndef _LIBCPP_ERRNO_H
++#define _LIBCPP_ERRNO_H
++
+ #  ifdef __cplusplus
+ 
+ #    if !defined(EOWNERDEAD) || !defined(ENOTRECOVERABLE)
+@@ -398,6 +398,5 @@ static const int __elast2 = 105;
+ #    endif
+ 
+ #  endif // __cplusplus
+-#endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+-
+ #endif // _LIBCPP_ERRNO_H
++#endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+diff --git a/include/fenv.h b/include/fenv.h
+index 157c24f..7e9455d 100644
+--- a/include/fenv.h
++++ b/include/fenv.h
+@@ -7,9 +7,8 @@
+ //
+ //===----------------------------------------------------------------------===//
+ 
+-#ifndef _LIBCPP_FENV_H
+-#define _LIBCPP_FENV_H
+-
++#ifndef _LIBCPP_CR_FENV_H
++#define _LIBCPP_CR_FENV_H
+ /*
+     fenv.h synopsis
+ 
+@@ -115,4 +114,4 @@ extern "C++" {
+ #  endif // defined(__cplusplus)
+ #endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+ 
+-#endif // _LIBCPP_FENV_H
++#endif // _LIBCPP_CR_FENV_H
+\ No newline at end of file
+diff --git a/include/float.h b/include/float.h
+index a6e79db..5f70f81 100644
+--- a/include/float.h
++++ b/include/float.h
+@@ -7,9 +7,8 @@
+ //
+ //===----------------------------------------------------------------------===//
+ 
+-#ifndef _LIBCPP_FLOAT_H
+-#define _LIBCPP_FLOAT_H
+-
++#ifndef _LIBCPP_CR_FLOAT_H
++#define _LIBCPP_CR_FLOAT_H
+ /*
+     float.h synopsis
+ 
+@@ -96,4 +95,4 @@ Macros:
+ #  endif // __cplusplus
+ #endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+ 
+-#endif // _LIBCPP_FLOAT_H
++#endif // _LIBCPP_CR_FLOAT_H
+\ No newline at end of file
+diff --git a/include/inttypes.h b/include/inttypes.h
+index 1869284..e3ba718 100644
+--- a/include/inttypes.h
++++ b/include/inttypes.h
+@@ -7,12 +7,12 @@
+ //
+ //===----------------------------------------------------------------------===//
+ 
+-#ifndef _LIBCPP_INTTYPES_H
++#ifndef _LIBCPP_CR_INTTYPES_H
+ // AIX system headers need inttypes.h to be re-enterable while _STD_TYPES_T
+ // is defined until an inclusion of it without _STD_TYPES_T occurs, in which
+ // case the header guard macro is defined.
+ #if !defined(_AIX) || !defined(_STD_TYPES_T)
+-#  define _LIBCPP_INTTYPES_H
++#define _LIBCPP_CR_INTTYPES_H
+ #endif // _STD_TYPES_T
+ 
+ /*
+@@ -265,4 +265,4 @@ uintmax_t wcstoumax(const wchar_t* restrict nptr, wchar_t** restrict endptr, int
+ #  endif // __cplusplus
+ #endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+ 
+-#endif // _LIBCPP_INTTYPES_H
++#endif // _LIBCPP_CR_INTTYPES_H
+\ No newline at end of file
+diff --git a/include/math.h b/include/math.h
+index 929bef6..4cfa7c8 100644
+--- a/include/math.h
++++ b/include/math.h
+@@ -7,9 +7,6 @@
+ //
+ //===----------------------------------------------------------------------===//
+ 
+-#ifndef _LIBCPP_MATH_H
+-#  define _LIBCPP_MATH_H
+-
+ /*
+     math.h synopsis
+ 
+@@ -304,6 +301,9 @@ long double    truncl(long double x);
+ #      include_next <math.h>
+ #    endif
+ 
++#ifndef _LIBCPP_MATH_H
++#  define _LIBCPP_MATH_H
++
+ #    ifdef __cplusplus
+ 
+ // We support including .h headers inside 'extern "C"' contexts, so switch
+@@ -496,20 +496,5 @@ using std::__math::trunc;
+ } // extern "C++"
+ 
+ #    endif // __cplusplus
++#  endif   // _LIBCPP_MATH_H
+ #  endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+-
+-#else // _LIBCPP_MATH_H
+-
+-// This include lives outside the header guard in order to support an MSVC
+-// extension which allows users to do:
+-//
+-// #define _USE_MATH_DEFINES
+-// #include <math.h>
+-//
+-// and receive the definitions of mathematical constants, even if <math.h>
+-// has previously been included.
+-#  if defined(_LIBCPP_MSVCRT) && defined(_USE_MATH_DEFINES)
+-#    include_next <math.h>
+-#  endif
+-
+-#endif // _LIBCPP_MATH_H
+diff --git a/include/stdatomic.h b/include/stdatomic.h
+index 2991030..2ff5581 100644
+--- a/include/stdatomic.h
++++ b/include/stdatomic.h
+@@ -7,9 +7,8 @@
+ //
+ //===----------------------------------------------------------------------===//
+ 
+-#ifndef _LIBCPP_STDATOMIC_H
+-#define _LIBCPP_STDATOMIC_H
+-
++#ifndef _LIBCPP_CR_STDATOMIC_H
++#define _LIBCPP_CR_STDATOMIC_H
+ /*
+     stdatomic.h synopsis
+ 
+@@ -244,4 +243,4 @@ using std::atomic_thread_fence _LIBCPP_USING_IF_EXISTS;
+ #  endif // defined(__cplusplus) && _LIBCPP_STD_VER >= 23
+ #endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+ 
+-#endif // _LIBCPP_STDATOMIC_H
++#endif // _LIBCPP_CR_STDATOMIC_H
+\ No newline at end of file
+diff --git a/include/stdbool.h b/include/stdbool.h
+index c34853b..5aeb68c 100644
+--- a/include/stdbool.h
++++ b/include/stdbool.h
+@@ -7,9 +7,8 @@
+ //
+ //===----------------------------------------------------------------------===//
+ 
+-#ifndef _LIBCPP_STDBOOL_H
+-#define _LIBCPP_STDBOOL_H
+-
++#ifndef _LIBCPP_CR_STDBOOL_H
++#define _LIBCPP_CR_STDBOOL_H
+ /*
+     stdbool.h synopsis
+ 
+@@ -41,4 +40,4 @@ Macros:
+ #  endif
+ #endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+ 
+-#endif // _LIBCPP_STDBOOL_H
++#endif // _LIBCPP_CR_STDBOOL_H
+\ No newline at end of file
+diff --git a/include/string.h b/include/string.h
+index 6bdcd6a..652c3f4 100644
+--- a/include/string.h
++++ b/include/string.h
+@@ -7,9 +7,6 @@
+ //
+ //===----------------------------------------------------------------------===//
+ 
+-#ifndef _LIBCPP_STRING_H
+-#define _LIBCPP_STRING_H
+-
+ /*
+     string.h synopsis
+ 
+@@ -64,6 +61,9 @@ size_t strlen(const char* s);
+ #    include_next <string.h>
+ #  endif
+ 
++#ifndef _LIBCPP_STRING_H
++#define _LIBCPP_STRING_H
++
+ // MSVCRT, GNU libc and its derivates may already have the correct prototype in
+ // <string.h>. This macro can be defined by users if their C library provides
+ // the right signature.
+@@ -110,6 +110,5 @@ inline _LIBCPP_HIDE_FROM_ABI _LIBCPP_PREFERRED_OVERLOAD char* strstr(char* __s1,
+ }
+ } // extern "C++"
+ #  endif
+-#endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+-
+ #endif // _LIBCPP_STRING_H
++#endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+diff --git a/include/tgmath.h b/include/tgmath.h
+index 3f8f14f..5c60eaf 100644
+--- a/include/tgmath.h
++++ b/include/tgmath.h
+@@ -7,9 +7,8 @@
+ //
+ //===----------------------------------------------------------------------===//
+ 
+-#ifndef _LIBCPP_TGMATH_H
+-#define _LIBCPP_TGMATH_H
+-
++#ifndef _LIBCPP_CR_TGMATH_H
++#define _LIBCPP_CR_TGMATH_H
+ /*
+     tgmath.h synopsis
+ 
+@@ -36,4 +35,4 @@
+ #  endif
+ #endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+ 
+-#endif // _LIBCPP_TGMATH_H
++#endif // _LIBCPP_CR_TGMATH_H
+\ No newline at end of file
+diff --git a/include/uchar.h b/include/uchar.h
+index 01e1d57..ee09f93 100644
+--- a/include/uchar.h
++++ b/include/uchar.h
+@@ -7,9 +7,8 @@
+ //
+ //===----------------------------------------------------------------------===//
+ 
+-#ifndef _LIBCPP_UCHAR_H
+-#define _LIBCPP_UCHAR_H
+-
++#ifndef _LIBCPP_CR_UCHAR_H
++#define _LIBCPP_CR_UCHAR_H
+ /*
+     uchar.h synopsis // since C++11
+ 
+@@ -57,4 +56,4 @@ size_t c32rtomb(char* s, char32_t c32, mbstate_t* ps);
+ #  endif // _LIBCPP_CXX03_LANG
+ #endif   // __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+ 
+-#endif // _LIBCPP_UCHAR_H
++#endif // _LIBCPP_CR_UCHAR_H
+\ No newline at end of file
+diff --git a/include/wctype.h b/include/wctype.h
+index 9a5b163..72fdfd5 100644
+--- a/include/wctype.h
++++ b/include/wctype.h
+@@ -7,9 +7,8 @@
+ //
+ //===----------------------------------------------------------------------===//
+ 
+-#ifndef _LIBCPP_WCTYPE_H
+-#define _LIBCPP_WCTYPE_H
+-
++#ifndef _LIBCPP_CR_WCTYPE_H
++#define _LIBCPP_CR_WCTYPE_H
+ /*
+     wctype.h synopsis
+ 
+@@ -91,4 +90,4 @@ wctrans_t wctrans(const char* property);
+ #  endif // __cplusplus
+ #endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+ 
+-#endif // _LIBCPP_WCTYPE_H
++#endif // _LIBCPP_CR_WCTYPE_H
+\ No newline at end of file

From 9a5fa5615d9b58d59ddb794a234403f0bdc550f8 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 16:03:05 -0700
Subject: [PATCH 14/26] fix(ci): restructure custom libc++ wrappers to
 include_next first

The previous approach renamed the custom copy's include guards
(_LIBCPP_*_H -> _LIBCPP_CR_*_H). That fixed the v8/ICU compile layout,
where the toolchain's own libc++ 21.1.8 copy follows in the include
search path and still defines the standard guards - but it broke the
libcxx runtime build itself: that build has no toolchain libc++ copy,
so <cctype>/<cwctype> from src/system_error.cpp never found libc++'s
<ctype.h>/<wctype.h> and the self-check #error fired.

Restructure all 13 C-compat wrappers uniformly to libc++'s own
include_next-before-guard pattern (as <wchar.h>/<stdio.h>/<stddef.h>
already use): the include_next runs first, then the wrapper defines the
STANDARD-named guard. In the v8/ICU layout the toolchain copy runs and
defines the guard (or the custom copy does if it lands there); in the
runtime layout the custom copy defines it. Both layouts satisfy the
<cctype>-style checks and the chain always reaches glibc/musl.

Files: complex.h ctype.h errno.h fenv.h float.h inttypes.h math.h
stdatomic.h stdbool.h string.h tgmath.h uchar.h wctype.h. math.h drops
its MSVC-only _USE_MATH_DEFINES #else branch (never reached on our
targets); uchar.h keeps its has_include_next fallback and defines the
guard after the whole block.

Validated with a local g++ harness replicating both CI include layouts:
patched headers compile in the with-toolchain-copy and without it, and
the unpatched control reproduces the original unresolved-symbol errors.
The patch was applied in a git-initialized checkout mirroring bazel's
patch step (a stray .git in a parent directory previously made git apply
skip silently).
---
 patches/rusty_v8_libcxx_include_next.patch | 325 ++++++++++++---------
 1 file changed, 187 insertions(+), 138 deletions(-)

diff --git a/patches/rusty_v8_libcxx_include_next.patch b/patches/rusty_v8_libcxx_include_next.patch
index 7237e31ab18..38a3eda1544 100644
--- a/patches/rusty_v8_libcxx_include_next.patch
+++ b/patches/rusty_v8_libcxx_include_next.patch
@@ -1,73 +1,78 @@
 diff --git a/include/complex.h b/include/complex.h
-index 8a1f926..e0b17be 100644
+index 8a1f926..4129487 100644
 --- a/include/complex.h
 +++ b/include/complex.h
-@@ -7,9 +7,8 @@
+@@ -7,8 +7,6 @@
  //
  //===----------------------------------------------------------------------===//
  
 -#ifndef _LIBCPP_COMPLEX_H
 -#define _LIBCPP_COMPLEX_H
--
-+#ifndef _LIBCPP_CR_COMPLEX_H
-+#define _LIBCPP_CR_COMPLEX_H
+ 
  /*
      complex.h synopsis
- 
-@@ -33,4 +32,4 @@
+@@ -31,6 +29,7 @@
+ #  elif __has_include_next(<complex.h>)
+ #    include_next <complex.h>
  #  endif
- #endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
- 
--#endif // _LIBCPP_COMPLEX_H
-+#endif // _LIBCPP_CR_COMPLEX_H
-\ No newline at end of file
+-#endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+-
++#ifndef _LIBCPP_COMPLEX_H
++#define _LIBCPP_COMPLEX_H
+ #endif // _LIBCPP_COMPLEX_H
++#endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
 diff --git a/include/ctype.h b/include/ctype.h
-index 066f450..6f35947 100644
+index 066f450..c0d4373 100644
 --- a/include/ctype.h
 +++ b/include/ctype.h
-@@ -7,9 +7,8 @@
+@@ -7,8 +7,6 @@
  //
  //===----------------------------------------------------------------------===//
  
 -#ifndef _LIBCPP_CTYPE_H
 -#define _LIBCPP_CTYPE_H
--
-+#ifndef _LIBCPP_CR_CTYPE_H
-+#define _LIBCPP_CR_CTYPE_H
+ 
  /*
      ctype.h synopsis
- 
-@@ -62,4 +61,4 @@ int toupper(int c);
+@@ -41,6 +39,8 @@ int toupper(int c);
+ #  if __has_include_next(<ctype.h>)
+ #    include_next <ctype.h>
  #  endif
- #endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
++#ifndef _LIBCPP_CTYPE_H
++#define _LIBCPP_CTYPE_H
  
--#endif // _LIBCPP_CTYPE_H
-+#endif // _LIBCPP_CR_CTYPE_H
-\ No newline at end of file
+ #  ifdef __cplusplus
+ 
+@@ -60,6 +60,5 @@ int toupper(int c);
+ #    undef toupper
+ 
+ #  endif
+-#endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+-
+ #endif // _LIBCPP_CTYPE_H
++#endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
 diff --git a/include/errno.h b/include/errno.h
-index 692f00f..e1eba05 100644
+index 692f00f..68edc7e 100644
 --- a/include/errno.h
 +++ b/include/errno.h
-@@ -7,9 +7,6 @@
+@@ -7,8 +7,6 @@
  //
  //===----------------------------------------------------------------------===//
  
 -#ifndef _LIBCPP_ERRNO_H
 -#define _LIBCPP_ERRNO_H
--
+ 
  /*
      errno.h synopsis
- 
-@@ -35,6 +32,9 @@ Macros:
+@@ -34,6 +32,8 @@ Macros:
+ #  if __has_include_next(<errno.h>)
  #    include_next <errno.h>
  #  endif
- 
 +#ifndef _LIBCPP_ERRNO_H
 +#define _LIBCPP_ERRNO_H
-+
+ 
  #  ifdef __cplusplus
  
- #    if !defined(EOWNERDEAD) || !defined(ENOTRECOVERABLE)
 @@ -398,6 +398,5 @@ static const int __elast2 = 105;
  #    endif
  
@@ -77,79 +82,109 @@ index 692f00f..e1eba05 100644
  #endif // _LIBCPP_ERRNO_H
 +#endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
 diff --git a/include/fenv.h b/include/fenv.h
-index 157c24f..7e9455d 100644
+index 157c24f..b1e0679 100644
 --- a/include/fenv.h
 +++ b/include/fenv.h
-@@ -7,9 +7,8 @@
+@@ -7,8 +7,6 @@
  //
  //===----------------------------------------------------------------------===//
  
 -#ifndef _LIBCPP_FENV_H
 -#define _LIBCPP_FENV_H
--
-+#ifndef _LIBCPP_CR_FENV_H
-+#define _LIBCPP_CR_FENV_H
+ 
  /*
      fenv.h synopsis
+@@ -61,6 +59,8 @@ int feupdateenv(const fenv_t* envp);
+ #  if __has_include_next(<fenv.h>)
+ #    include_next <fenv.h>
+ #  endif
++#ifndef _LIBCPP_FENV_H
++#define _LIBCPP_FENV_H
  
-@@ -115,4 +114,4 @@ extern "C++" {
- #  endif // defined(__cplusplus)
- #endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+ #  ifdef __cplusplus
+ 
+@@ -113,6 +113,5 @@ extern "C++" {
+ } // extern "C++"
  
--#endif // _LIBCPP_FENV_H
-+#endif // _LIBCPP_CR_FENV_H
-\ No newline at end of file
+ #  endif // defined(__cplusplus)
+-#endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+-
+ #endif // _LIBCPP_FENV_H
++#endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
 diff --git a/include/float.h b/include/float.h
-index a6e79db..5f70f81 100644
+index a6e79db..0b460e4 100644
 --- a/include/float.h
 +++ b/include/float.h
-@@ -7,9 +7,8 @@
+@@ -7,8 +7,6 @@
  //
  //===----------------------------------------------------------------------===//
  
 -#ifndef _LIBCPP_FLOAT_H
 -#define _LIBCPP_FLOAT_H
--
-+#ifndef _LIBCPP_CR_FLOAT_H
-+#define _LIBCPP_CR_FLOAT_H
+ 
  /*
      float.h synopsis
+@@ -82,6 +80,8 @@ Macros:
+ #  if __has_include_next(<float.h>)
+ #    include_next <float.h>
+ #  endif
++#ifndef _LIBCPP_FLOAT_H
++#define _LIBCPP_FLOAT_H
  
-@@ -96,4 +95,4 @@ Macros:
- #  endif // __cplusplus
- #endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+ #  ifdef __cplusplus
  
--#endif // _LIBCPP_FLOAT_H
-+#endif // _LIBCPP_CR_FLOAT_H
-\ No newline at end of file
+@@ -94,6 +94,5 @@ Macros:
+ #    endif
+ 
+ #  endif // __cplusplus
+-#endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+-
+ #endif // _LIBCPP_FLOAT_H
++#endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
 diff --git a/include/inttypes.h b/include/inttypes.h
-index 1869284..e3ba718 100644
+index 1869284..8322b38 100644
 --- a/include/inttypes.h
 +++ b/include/inttypes.h
-@@ -7,12 +7,12 @@
+@@ -7,14 +7,6 @@
  //
  //===----------------------------------------------------------------------===//
  
 -#ifndef _LIBCPP_INTTYPES_H
-+#ifndef _LIBCPP_CR_INTTYPES_H
- // AIX system headers need inttypes.h to be re-enterable while _STD_TYPES_T
- // is defined until an inclusion of it without _STD_TYPES_T occurs, in which
- // case the header guard macro is defined.
- #if !defined(_AIX) || !defined(_STD_TYPES_T)
+-// AIX system headers need inttypes.h to be re-enterable while _STD_TYPES_T
+-// is defined until an inclusion of it without _STD_TYPES_T occurs, in which
+-// case the header guard macro is defined.
+-#if !defined(_AIX) || !defined(_STD_TYPES_T)
 -#  define _LIBCPP_INTTYPES_H
-+#define _LIBCPP_CR_INTTYPES_H
- #endif // _STD_TYPES_T
- 
+-#endif // _STD_TYPES_T
+-
  /*
-@@ -265,4 +265,4 @@ uintmax_t wcstoumax(const wchar_t* restrict nptr, wchar_t** restrict endptr, int
- #  endif // __cplusplus
- #endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+     inttypes.h synopsis
+ 
+@@ -255,6 +247,14 @@ uintmax_t wcstoumax(const wchar_t* restrict nptr, wchar_t** restrict endptr, int
+ #    include_next <inttypes.h>
+ #  endif
+ 
++#ifndef _LIBCPP_INTTYPES_H
++// AIX system headers need inttypes.h to be re-enterable while _STD_TYPES_T
++// is defined until an inclusion of it without _STD_TYPES_T occurs, in which
++// case the header guard macro is defined.
++#if !defined(_AIX) || !defined(_STD_TYPES_T)
++#  define _LIBCPP_INTTYPES_H
++#endif // _STD_TYPES_T
++
+ #  ifdef __cplusplus
  
--#endif // _LIBCPP_INTTYPES_H
-+#endif // _LIBCPP_CR_INTTYPES_H
-\ No newline at end of file
+ #    include <stdint.h>
+@@ -263,6 +263,5 @@ uintmax_t wcstoumax(const wchar_t* restrict nptr, wchar_t** restrict endptr, int
+ #    undef imaxdiv
+ 
+ #  endif // __cplusplus
+-#endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+-
+ #endif // _LIBCPP_INTTYPES_H
++#endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
 diff --git a/include/math.h b/include/math.h
-index 929bef6..4cfa7c8 100644
+index 929bef6..6121409 100644
 --- a/include/math.h
 +++ b/include/math.h
 @@ -7,9 +7,6 @@
@@ -172,13 +207,10 @@ index 929bef6..4cfa7c8 100644
  #    ifdef __cplusplus
  
  // We support including .h headers inside 'extern "C"' contexts, so switch
-@@ -496,20 +496,5 @@ using std::__math::trunc;
- } // extern "C++"
- 
+@@ -498,18 +498,4 @@ using std::__math::trunc;
  #    endif // __cplusplus
-+#  endif   // _LIBCPP_MATH_H
  #  endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
--
+ 
 -#else // _LIBCPP_MATH_H
 -
 -// This include lives outside the header guard in order to support an MSVC
@@ -193,77 +225,84 @@ index 929bef6..4cfa7c8 100644
 -#    include_next <math.h>
 -#  endif
 -
--#endif // _LIBCPP_MATH_H
+ #endif // _LIBCPP_MATH_H
 diff --git a/include/stdatomic.h b/include/stdatomic.h
-index 2991030..2ff5581 100644
+index 2991030..3482fb3 100644
 --- a/include/stdatomic.h
 +++ b/include/stdatomic.h
-@@ -7,9 +7,8 @@
+@@ -7,8 +7,6 @@
  //
  //===----------------------------------------------------------------------===//
  
 -#ifndef _LIBCPP_STDATOMIC_H
 -#define _LIBCPP_STDATOMIC_H
--
-+#ifndef _LIBCPP_CR_STDATOMIC_H
-+#define _LIBCPP_CR_STDATOMIC_H
+ 
  /*
      stdatomic.h synopsis
+@@ -240,8 +238,9 @@ using std::atomic_thread_fence _LIBCPP_USING_IF_EXISTS;
+ #    if __has_include_next(<stdatomic.h>)
+ #      include_next <stdatomic.h>
+ #    endif
++#ifndef _LIBCPP_STDATOMIC_H
++#define _LIBCPP_STDATOMIC_H
  
-@@ -244,4 +243,4 @@ using std::atomic_thread_fence _LIBCPP_USING_IF_EXISTS;
  #  endif // defined(__cplusplus) && _LIBCPP_STD_VER >= 23
- #endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
- 
--#endif // _LIBCPP_STDATOMIC_H
-+#endif // _LIBCPP_CR_STDATOMIC_H
-\ No newline at end of file
+-#endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+-
+ #endif // _LIBCPP_STDATOMIC_H
++#endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
 diff --git a/include/stdbool.h b/include/stdbool.h
-index c34853b..5aeb68c 100644
+index c34853b..ca4d3f3 100644
 --- a/include/stdbool.h
 +++ b/include/stdbool.h
-@@ -7,9 +7,8 @@
+@@ -7,8 +7,6 @@
  //
  //===----------------------------------------------------------------------===//
  
 -#ifndef _LIBCPP_STDBOOL_H
 -#define _LIBCPP_STDBOOL_H
--
-+#ifndef _LIBCPP_CR_STDBOOL_H
-+#define _LIBCPP_CR_STDBOOL_H
+ 
  /*
      stdbool.h synopsis
- 
-@@ -41,4 +40,4 @@ Macros:
+@@ -31,6 +29,8 @@ Macros:
+ #  if __has_include_next(<stdbool.h>)
+ #    include_next <stdbool.h>
  #  endif
- #endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
++#ifndef _LIBCPP_STDBOOL_H
++#define _LIBCPP_STDBOOL_H
  
--#endif // _LIBCPP_STDBOOL_H
-+#endif // _LIBCPP_CR_STDBOOL_H
-\ No newline at end of file
+ #  ifdef __cplusplus
+ #    undef bool
+@@ -39,6 +39,5 @@ Macros:
+ #    undef __bool_true_false_are_defined
+ #    define __bool_true_false_are_defined 1
+ #  endif
+-#endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+-
+ #endif // _LIBCPP_STDBOOL_H
++#endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
 diff --git a/include/string.h b/include/string.h
-index 6bdcd6a..652c3f4 100644
+index 6bdcd6a..b1de45e 100644
 --- a/include/string.h
 +++ b/include/string.h
-@@ -7,9 +7,6 @@
+@@ -7,8 +7,6 @@
  //
  //===----------------------------------------------------------------------===//
  
 -#ifndef _LIBCPP_STRING_H
 -#define _LIBCPP_STRING_H
--
+ 
  /*
      string.h synopsis
- 
-@@ -64,6 +61,9 @@ size_t strlen(const char* s);
+@@ -63,6 +61,8 @@ size_t strlen(const char* s);
+ #  if __has_include_next(<string.h>)
  #    include_next <string.h>
  #  endif
- 
 +#ifndef _LIBCPP_STRING_H
 +#define _LIBCPP_STRING_H
-+
+ 
  // MSVCRT, GNU libc and its derivates may already have the correct prototype in
  // <string.h>. This macro can be defined by users if their C library provides
- // the right signature.
 @@ -110,6 +110,5 @@ inline _LIBCPP_HIDE_FROM_ABI _LIBCPP_PREFERRED_OVERLOAD char* strstr(char* __s1,
  }
  } // extern "C++"
@@ -273,71 +312,81 @@ index 6bdcd6a..652c3f4 100644
  #endif // _LIBCPP_STRING_H
 +#endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
 diff --git a/include/tgmath.h b/include/tgmath.h
-index 3f8f14f..5c60eaf 100644
+index 3f8f14f..e3df073 100644
 --- a/include/tgmath.h
 +++ b/include/tgmath.h
-@@ -7,9 +7,8 @@
+@@ -7,8 +7,6 @@
  //
  //===----------------------------------------------------------------------===//
  
 -#ifndef _LIBCPP_TGMATH_H
 -#define _LIBCPP_TGMATH_H
--
-+#ifndef _LIBCPP_CR_TGMATH_H
-+#define _LIBCPP_CR_TGMATH_H
+ 
  /*
      tgmath.h synopsis
- 
-@@ -36,4 +35,4 @@
+@@ -33,7 +31,8 @@
+ #    if __has_include_next(<tgmath.h>)
+ #      include_next <tgmath.h>
+ #    endif
++#ifndef _LIBCPP_TGMATH_H
++#define _LIBCPP_TGMATH_H
  #  endif
- #endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
- 
--#endif // _LIBCPP_TGMATH_H
-+#endif // _LIBCPP_CR_TGMATH_H
-\ No newline at end of file
+-#endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+-
+ #endif // _LIBCPP_TGMATH_H
++#endif // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
 diff --git a/include/uchar.h b/include/uchar.h
-index 01e1d57..ee09f93 100644
+index 01e1d57..236caf5 100644
 --- a/include/uchar.h
 +++ b/include/uchar.h
-@@ -7,9 +7,8 @@
+@@ -7,8 +7,6 @@
  //
  //===----------------------------------------------------------------------===//
  
 -#ifndef _LIBCPP_UCHAR_H
 -#define _LIBCPP_UCHAR_H
--
-+#ifndef _LIBCPP_CR_UCHAR_H
-+#define _LIBCPP_CR_UCHAR_H
+ 
  /*
      uchar.h synopsis // since C++11
+@@ -54,7 +52,9 @@ size_t c32rtomb(char* s, char32_t c32, mbstate_t* ps);
+ #      include <stddef.h>
+ #    endif
  
-@@ -57,4 +56,4 @@ size_t c32rtomb(char* s, char32_t c32, mbstate_t* ps);
++#ifndef _LIBCPP_UCHAR_H
++#define _LIBCPP_UCHAR_H
++#endif // _LIBCPP_UCHAR_H
++
  #  endif // _LIBCPP_CXX03_LANG
  #endif   // __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
- 
+-
 -#endif // _LIBCPP_UCHAR_H
-+#endif // _LIBCPP_CR_UCHAR_H
-\ No newline at end of file
 diff --git a/include/wctype.h b/include/wctype.h
-index 9a5b163..72fdfd5 100644
+index 9a5b163..fbdfe3c 100644
 --- a/include/wctype.h
 +++ b/include/wctype.h
-@@ -7,9 +7,8 @@
+@@ -7,8 +7,6 @@
  //
  //===----------------------------------------------------------------------===//
  
 -#ifndef _LIBCPP_WCTYPE_H
 -#define _LIBCPP_WCTYPE_H
--
-+#ifndef _LIBCPP_CR_WCTYPE_H
-+#define _LIBCPP_CR_WCTYPE_H
+ 
  /*
      wctype.h synopsis
+@@ -65,6 +63,8 @@ wctrans_t wctrans(const char* property);
+ #  if __has_include_next(<wctype.h>)
+ #    include_next <wctype.h>
+ #    define _LIBCPP_INCLUDED_C_LIBRARY_WCTYPE_H
++#ifndef _LIBCPP_WCTYPE_H
++#define _LIBCPP_WCTYPE_H
+ #  endif
  
-@@ -91,4 +90,4 @@ wctrans_t wctrans(const char* property);
- #  endif // __cplusplus
- #endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+ #  ifdef __cplusplus
+@@ -89,6 +89,5 @@ wctrans_t wctrans(const char* property);
+ #    undef wctrans
  
--#endif // _LIBCPP_WCTYPE_H
-+#endif // _LIBCPP_CR_WCTYPE_H
-\ No newline at end of file
+ #  endif // __cplusplus
+-#endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)
+-
+ #endif // _LIBCPP_WCTYPE_H
++#endif   // defined(__cplusplus) && __cplusplus < 201103L && defined(_LIBCPP_USE_FROZEN_CXX03_HEADERS)

From d6a8e7d30d2da94f7b0335bffed61038f4910d1c Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 16:39:19 -0700
Subject: [PATCH 15/26] fix(ci): stop linking the toolchain's libc++ into the
 custom-libc++ build

With the custom libc++ runtime now compiling, v8's host-tool links pulled
BOTH the custom libcxx/libcxxabi objects and the toolchain's own
liblibcxx.static.a / liblibcxxabi.static.a (wired in via the cc_toolchain
static_runtime_lib), so every std::* definition in stdexcept.o was
duplicated and ld.lld aborted.

Suppress the toolchain's libc++/libc++abi/libunwind runtime archives when
the use_rusty_v8_custom_libcxx config is active: the custom libcxx
runtime provides libc++ and libc++abi, and a new
static_runtime_lib_no_libcxx filegroup keeps only libunwind.static since
the custom libc++abi calls _Unwind_* without defining it. dynamic_runtime_lib
is switched to :none in that config as well. Other configs are unchanged.

The select key references the main repo's use_rusty_v8_custom_libcxx
config_setting (@@//third_party/v8:...), which mirrors the @v8// flag, so
the toolchain module can react to the flag without depending on v8.
The patch is applied via the existing single_version_override with
patch_strip = 1. Verified against the BCR 0.5.6 source archive
(sha256 matches source.json integrity).
---
 MODULE.bazel                                  |  1 +
 patches/BUILD.bazel                           |  1 +
 ...vm_bootstrapped_rusty_v8_runtime_lib.patch | 44 +++++++++++++++++++
 3 files changed, 46 insertions(+)
 create mode 100644 patches/toolchains_llvm_bootstrapped_rusty_v8_runtime_lib.patch

diff --git a/MODULE.bazel b/MODULE.bazel
index 72db7494781..5175fe52ee4 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -7,6 +7,7 @@ single_version_override(
     patch_strip = 1,
     patches = [
         "//patches:toolchains_llvm_bootstrapped_resource_dir.patch",
+        "//patches:toolchains_llvm_bootstrapped_rusty_v8_runtime_lib.patch",
     ],
 )
 
diff --git a/patches/BUILD.bazel b/patches/BUILD.bazel
index ed141371700..f164ad0eff7 100644
--- a/patches/BUILD.bazel
+++ b/patches/BUILD.bazel
@@ -20,6 +20,7 @@ exports_files([
     "rules_rs_windows_exec_linker.patch",
     "rusty_v8_prebuilt_out_dir.patch",
     "ring_windows_msvc_include_dirs.patch",
+    "toolchains_llvm_bootstrapped_rusty_v8_runtime_lib.patch",
     "v8_bazel_rules.patch",
     "v8_module_deps.patch",
     "v8_source_portability.patch",
diff --git a/patches/toolchains_llvm_bootstrapped_rusty_v8_runtime_lib.patch b/patches/toolchains_llvm_bootstrapped_rusty_v8_runtime_lib.patch
new file mode 100644
index 00000000000..a662e2a5c72
--- /dev/null
+++ b/patches/toolchains_llvm_bootstrapped_rusty_v8_runtime_lib.patch
@@ -0,0 +1,44 @@
+diff --git a/runtimes/BUILD.bazel b/runtimes/BUILD.bazel
+index 03f48fb..189bfdd 100644
+--- a/runtimes/BUILD.bazel
++++ b/runtimes/BUILD.bazel
+@@ -72,6 +72,21 @@ filegroup(
+     visibility = ["//visibility:public"],
+ )
+ 
++# V8's custom-libc++ build ships its own libc++/libc++abi runtime and must
++# not also link the toolchain's copies (duplicate std::* symbols at link
++# time). libunwind is still needed: the custom libc++abi uses its _Unwind_*
++# entry points and does not define them itself.
++filegroup(
++    name = "static_runtime_lib_no_libcxx",
++    srcs = select({
++        "@platforms//os:linux": [
++            "@libunwind//:libunwind.static",
++        ],
++        "//conditions:default": [],
++    }),
++    visibility = ["//visibility:public"],
++)
++
+ cc_library(
+     name = "empty",
+     srcs = ["empty.c"],
+diff --git a/toolchain/cc_toolchain.bzl b/toolchain/cc_toolchain.bzl
+index 01851e2..eef6255 100644
+--- a/toolchain/cc_toolchain.bzl
++++ b/toolchain/cc_toolchain.bzl
+@@ -109,11 +109,13 @@ def cc_toolchain(name, tool_map, module_map = None):
+         tool_map = tool_map,
+         module_map = module_map,
+         static_runtime_lib = select({
++            "@@//third_party/v8:use_rusty_v8_custom_libcxx": "@toolchains_llvm_bootstrapped//runtimes:static_runtime_lib_no_libcxx",
+             "@toolchains_llvm_bootstrapped//toolchain:runtimes_none": "@toolchains_llvm_bootstrapped//runtimes:none",
+             "@toolchains_llvm_bootstrapped//toolchain:runtimes_stage1": "@toolchains_llvm_bootstrapped//runtimes:none",
+             "//conditions:default": "@toolchains_llvm_bootstrapped//runtimes:static_runtime_lib",
+         }),
+         dynamic_runtime_lib = select({
++            "@@//third_party/v8:use_rusty_v8_custom_libcxx": "@toolchains_llvm_bootstrapped//runtimes:none",
+             "@toolchains_llvm_bootstrapped//toolchain:runtimes_none": "@toolchains_llvm_bootstrapped//runtimes:none",
+             "@toolchains_llvm_bootstrapped//toolchain:runtimes_stage1": "@toolchains_llvm_bootstrapped//runtimes:none",
+             "//conditions:default": "@toolchains_llvm_bootstrapped//runtimes:dynamic_runtime_lib",

From e08947dd10cb678c33ad3b4b802093426f796d81 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 16:56:33 -0700
Subject: [PATCH 16/26] fix(ci): gate toolchain runtime suppression on user
 targets

The custom-libcxx config_setting matched for the bootstrap runtime builds
too (runtime_stage stage0/stage1), where the toolchain's runtimes_none /
runtimes_stage1 keys also match - an illegal ambiguous select. Gate the
suppression on a combined config_setting that additionally requires
runtime_stage=complete, so only user targets drop the toolchain's libc++.
---
 ...ins_llvm_bootstrapped_rusty_v8_runtime_lib.patch |  6 +++---
 third_party/v8/BUILD.bazel                          | 13 +++++++++++++
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/patches/toolchains_llvm_bootstrapped_rusty_v8_runtime_lib.patch b/patches/toolchains_llvm_bootstrapped_rusty_v8_runtime_lib.patch
index a662e2a5c72..a1fe33335e4 100644
--- a/patches/toolchains_llvm_bootstrapped_rusty_v8_runtime_lib.patch
+++ b/patches/toolchains_llvm_bootstrapped_rusty_v8_runtime_lib.patch
@@ -25,20 +25,20 @@ index 03f48fb..189bfdd 100644
      name = "empty",
      srcs = ["empty.c"],
 diff --git a/toolchain/cc_toolchain.bzl b/toolchain/cc_toolchain.bzl
-index 01851e2..eef6255 100644
+index 01851e2..6a92376 100644
 --- a/toolchain/cc_toolchain.bzl
 +++ b/toolchain/cc_toolchain.bzl
 @@ -109,11 +109,13 @@ def cc_toolchain(name, tool_map, module_map = None):
          tool_map = tool_map,
          module_map = module_map,
          static_runtime_lib = select({
-+            "@@//third_party/v8:use_rusty_v8_custom_libcxx": "@toolchains_llvm_bootstrapped//runtimes:static_runtime_lib_no_libcxx",
++            "@@//third_party/v8:use_rusty_v8_custom_libcxx_user_targets": "@toolchains_llvm_bootstrapped//runtimes:static_runtime_lib_no_libcxx",
              "@toolchains_llvm_bootstrapped//toolchain:runtimes_none": "@toolchains_llvm_bootstrapped//runtimes:none",
              "@toolchains_llvm_bootstrapped//toolchain:runtimes_stage1": "@toolchains_llvm_bootstrapped//runtimes:none",
              "//conditions:default": "@toolchains_llvm_bootstrapped//runtimes:static_runtime_lib",
          }),
          dynamic_runtime_lib = select({
-+            "@@//third_party/v8:use_rusty_v8_custom_libcxx": "@toolchains_llvm_bootstrapped//runtimes:none",
++            "@@//third_party/v8:use_rusty_v8_custom_libcxx_user_targets": "@toolchains_llvm_bootstrapped//runtimes:none",
              "@toolchains_llvm_bootstrapped//toolchain:runtimes_none": "@toolchains_llvm_bootstrapped//runtimes:none",
              "@toolchains_llvm_bootstrapped//toolchain:runtimes_stage1": "@toolchains_llvm_bootstrapped//runtimes:none",
              "//conditions:default": "@toolchains_llvm_bootstrapped//runtimes:dynamic_runtime_lib",
diff --git a/third_party/v8/BUILD.bazel b/third_party/v8/BUILD.bazel
index 22e40217b50..cdf0042dbb3 100644
--- a/third_party/v8/BUILD.bazel
+++ b/third_party/v8/BUILD.bazel
@@ -29,6 +29,19 @@ config_setting(
     },
 )
 
+# Same as use_rusty_v8_custom_libcxx but only for user targets (runtime
+# stage "complete"). The custom libcxx/libcxxabi runtimes are themselves
+# built with the bootstrap toolchain (runtime_stage stage0/stage1), which
+# must keep the toolchain's runtime wiring for the link to work; the
+# toolchain module selects on this setting to suppress its own libc++.
+config_setting(
+    name = "use_rusty_v8_custom_libcxx_user_targets",
+    flag_values = {
+        "@v8//:v8_use_rusty_v8_custom_libcxx": "True",
+        "@toolchains_llvm_bootstrapped//toolchain:runtime_stage": "complete",
+    },
+)
+
 alias(
     name = "v8_149_2_0_x86_64_pc_windows_msvc",
     actual = "@rusty_v8_149_2_0_x86_64_pc_windows_msvc_archive//file",

From 0af1b1a99c849d443805e552ec78093f98a91a22 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 17:07:43 -0700
Subject: [PATCH 17/26] fix(ci): make the custom-libcxx config settings public

The toolchain module's select on the main-repo config_setting requires
visibility from the module context; private (default) visibility failed
analysis with a Visibility error.
---
 third_party/v8/BUILD.bazel | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/third_party/v8/BUILD.bazel b/third_party/v8/BUILD.bazel
index cdf0042dbb3..123cf9b1b1a 100644
--- a/third_party/v8/BUILD.bazel
+++ b/third_party/v8/BUILD.bazel
@@ -27,6 +27,7 @@ config_setting(
     flag_values = {
         "@v8//:v8_use_rusty_v8_custom_libcxx": "True",
     },
+    visibility = ["//visibility:public"],
 )
 
 # Same as use_rusty_v8_custom_libcxx but only for user targets (runtime
@@ -40,6 +41,7 @@ config_setting(
         "@v8//:v8_use_rusty_v8_custom_libcxx": "True",
         "@toolchains_llvm_bootstrapped//toolchain:runtime_stage": "complete",
     },
+    visibility = ["//visibility:public"],
 )
 
 alias(

From fbbc39cca621bd57489dd0c188f7fd2f838d230d Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 17:20:48 -0700
Subject: [PATCH 18/26] fix(ci): expose runtime_stage to the main repo
 config_setting

The custom-libcxx config_setting gates on the toolchain's runtime_stage
flag, which was package-private; analysis failed with a Visibility error.
Make the string_setting public so the main repo can reference it.
---
 ...ns_llvm_bootstrapped_rusty_v8_runtime_lib.patch | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/patches/toolchains_llvm_bootstrapped_rusty_v8_runtime_lib.patch b/patches/toolchains_llvm_bootstrapped_rusty_v8_runtime_lib.patch
index a1fe33335e4..9e6c4710690 100644
--- a/patches/toolchains_llvm_bootstrapped_rusty_v8_runtime_lib.patch
+++ b/patches/toolchains_llvm_bootstrapped_rusty_v8_runtime_lib.patch
@@ -24,6 +24,20 @@ index 03f48fb..189bfdd 100644
  cc_library(
      name = "empty",
      srcs = ["empty.c"],
+diff --git a/toolchain/BUILD.bazel b/toolchain/BUILD.bazel
+index d38c471..e39c0da 100644
+--- a/toolchain/BUILD.bazel
++++ b/toolchain/BUILD.bazel
+@@ -20,6 +20,9 @@ string_setting(
+         "complete", # depends on above: user programs.
+     ],
+     build_setting_default = "complete",
++    # Referenced by the main repo's config_setting for the custom-libc++
++    # build (use_rusty_v8_custom_libcxx_user_targets).
++    visibility = ["//visibility:public"],
+ )
+ 
+ # Controls whether targets are built with bootstrapped toolchain or prebuilt toolchain.
 diff --git a/toolchain/cc_toolchain.bzl b/toolchain/cc_toolchain.bzl
 index 01851e2..6a92376 100644
 --- a/toolchain/cc_toolchain.bzl

From bbd7caf0f04d173ae628e33c8e638436b10bc1c4 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 9 Aug 2026 18:53:33 -0700
Subject: [PATCH 19/26] fix(ci): compile external C++ deps against the custom
 libc++

aarch64 linux-gnu now fails at link time: abseil's
FormatArgImpl::Dispatch<std::basic_string> is explicitly instantiated in a
.cc compiled against the toolchain's libc++, while v8 (custom libc++,
ABI namespace __Cr) references std::__Cr::basic_string - undefined
symbol.

Wire the existing rules_cc patch (previously written but never applied)
into the rules_cc single_version_override: when the
use_rusty_v8_custom_libcxx config is active, cc_library targets in the
external C++ dependency repos (abseil-cpp+, v8's highway and simdutf)
compile with -nostdinc++ and the custom libc++ headers, so their std
types match v8's __Cr ABI namespace. Other configs and repos are
unaffected.
---
 MODULE.bazel | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/MODULE.bazel b/MODULE.bazel
index 5175fe52ee4..b7e1ad98daa 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -40,6 +40,13 @@ use_repo(osx, "macosx15.4.sdk")
 bazel_dep(name = "apple_support", version = "2.1.0")
 bazel_dep(name = "bazel_skylib", version = "1.8.2")
 bazel_dep(name = "rules_cc", version = "0.2.16")
+single_version_override(
+    module_name = "rules_cc",
+    patch_strip = 1,
+    patches = [
+        "//patches:rules_cc_rusty_v8_custom_libcxx.patch",
+    ],
+)
 bazel_dep(name = "rules_platform", version = "0.1.0")
 bazel_dep(name = "rules_rs", version = "0.0.23")
 

From 8921419d7a33099abc3f749eba9a567ca7550d99 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Mon, 10 Aug 2026 01:09:54 -0700
Subject: [PATCH 20/26] wip: capture 2026-08-02 helios-cli live eval changes
 (autocrlf bypass)

---
 codex-rs/Cargo.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/codex-rs/Cargo.toml b/codex-rs/Cargo.toml
index a39ca2c1cea..27b5649fe3a 100644
--- a/codex-rs/Cargo.toml
+++ b/codex-rs/Cargo.toml
@@ -61,6 +61,7 @@ members = [
     "codex-api",
     "state",
     "codex-experimental-api-macros",
+    "v8-poc",
 ]
 resolver = "2"
 

From 2e88ead1b10d93c1f67a0dfe2dd815f6f7a1fc48 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Mon, 10 Aug 2026 01:17:19 -0700
Subject: [PATCH 21/26] fix(ci): add codex-v8-poc to the cargo workspace

The v8-canary smoke test runs 'cargo test -p codex-v8-poc', and
codex-v8-poc is declared in [workspace.dependencies], but the v8-poc
member was never added to [workspace].members, so cargo resolves no
package by that name and the smoke step fails right after the (now
succeeding) Bazel build. Add the member and regenerate Cargo.lock
(only the codex-v8-poc entry is added; no other resolution changed).
---
 codex-rs/Cargo.lock | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/codex-rs/Cargo.lock b/codex-rs/Cargo.lock
index fee1821a871..e5e902ab6a4 100644
--- a/codex-rs/Cargo.lock
+++ b/codex-rs/Cargo.lock
@@ -4307,6 +4307,14 @@ dependencies = [
  "pretty_assertions",
 ]
 
+[[package]]
+name = "codex-v8-poc"
+version = "0.0.0"
+dependencies = [
+ "pretty_assertions",
+ "v8",
+]
+
 [[package]]
 name = "codex-web-search-extension"
 version = "0.0.0"

From 95c80766c5f4710b278484fbac2d200e3877a574 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Mon, 10 Aug 2026 22:58:22 -0700
Subject: [PATCH 22/26] fix(ci): exclude upstream rusty_v8 checkout from
 clean-worktree gate

The v8-canary windows-source job checks out denoland/rusty_v8 into
upstream-rusty-v8/ inside the workspace, so the final check-clean-worktree
step always flags it as untracked and fails the job after the artifacts
were built, staged, smoke-linked and uploaded successfully. Exclude the
directory in .gitignore: the checkout is intentional, not debris.
---
 .gitignore | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.gitignore b/.gitignore
index 32a2dc23318..bbb12eb6d5b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,6 +8,11 @@ bazel-*
 build/
 out/
 
+# CI: upstream rusty_v8 checkout used by the v8-canary windows-source job.
+# The workflow checks this repo out into the workspace, so exclude it from
+# the check-clean-worktree gate (the checkout is intentional, not debris).
+/upstream-rusty-v8/
+
 # Node.js
 node_modules/
 .pnpm-store/

From eeaab31dd8ab153f5fbddceba3967f4de8631a03 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Tue, 11 Aug 2026 17:24:01 -0700
Subject: [PATCH 23/26] wip: capture 2026-08-02 helios-cli live eval changes
 (autocrlf bypass)

---
 .trunk/trunk.yaml | 151 ++++++++++++++++------------------------------
 1 file changed, 53 insertions(+), 98 deletions(-)

diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index fbb1fbcb053..79a029c9bd5 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -5,109 +5,64 @@
 # https://docs.trunk.io/check/reference
 # =============================================================================
 
+version: 0.1
+
+# CLI version pinned for reproducible runs (matches the version CI downloads).
+cli:
+  version: 1.22.2
+
+# The `trunk` plugin provides the linter/formatter definitions used below.
+# User definitions merge over the plugin: fields set in this file override the
+# plugin, everything else (files, tools, runtimes, version pins) is inherited.
 plugins:
   sources:
     - id: trunk
       ref: v1.2.2
-    - id: community
-      ref: main
+      uri: https://github.com/trunk-io/plugins
 
-# Linters (auto-detected by file type)
-linters:
-  actionlint:
-    enabled: true
-    commands:
-      - name: actionlint
-        run: actionlint ${target}
-        direct_configs:
-          - .github/workflows/*.yml
-  black:
-    enabled: true
-    commands:
-      - name: black
-        run: black --check --line-length 100 ${target}
-        direct_configs:
-          - pyproject.toml
-          - ruff.toml
-  clippy:
-    enabled: true
-    commands:
-      - name: clippy
-        run: cargo clippy --all-targets --all-features -- -D warnings
-  eslint:
-    enabled: true
-    direct_configs:
-      - .eslintrc.*
-      - eslint.config.*
-  golangci-lint:
-    enabled: true
-    direct_configs:
-      - .golangci.yml
-      - .golangci.yaml
-  mypy:
-    enabled: true
-    commands:
-      - name: mypy
-        run: mypy --ignore-missing-imports ${target}
-  ruff:
-    enabled: true
-    commands:
-      - name: ruff
-        run: ruff check --output-format=github ${target}
-        direct_configs:
-          - ruff.toml
-          - pyproject.toml
-  shellcheck:
-    enabled: true
-  taplo:
-    enabled: true
-  yamllint:
-    enabled: true
+lint:
+  # Repo-specific command overrides merged over the plugin definitions.
+  definitions:
+    # black: enforce 100-char line length in both lint and format modes.
+    - name: black
+      commands:
+        - name: lint
+          output: pass_fail
+          run: black --check --line-length 100 ${target}
+          success_codes: [0, 1]
+        - name: format
+          output: rewrite
+          run: black --line-length 100 ${target}
+          success_codes: [0]
+          batch: true
+          in_place: true
+          formatter: true
+    # clippy: lint all targets/features and fail on any warning.
+    - name: clippy
+      commands:
+        - name: lint
+          output: clippy
+          target: ${parent_with(Cargo.toml)}
+          run: cargo clippy --message-format json --all-targets --all-features --locked -- -D warnings
+          success_codes: [0, 101, 383]
+          disable_upstream: true
 
-# Formatters
-formatters:
-  black:
-    enabled: true
-    commands:
-      - name: black
-        run: black --line-length 100 ${target}
-        direct_configs:
-          - pyproject.toml
-  prettier:
-    enabled: true
-    direct_configs:
-      - .prettierrc
-      - prettier.config.*
-  rustfmt:
-    enabled: true
-    commands:
-      - name: rustfmt
-        run: rustfmt ${target}
+  # Enabled tools (plugin defaults unless overridden above).
+  enabled:
+    - actionlint
+    - black
+    - clippy
+    - eslint
+    - golangci-lint
+    - mypy
+    - prettier
+    - ruff
+    - rustfmt
+    - shellcheck
+    - taplo
+    - yamllint
 
-# Actions (CI optimization)
+# Git hooks: run `trunk check` before `git push`.
 actions:
-  trunk-check:
-    enabled: true
-    size: 5GB
-    memory: 16GB
-    disk: 10GB
-  trunk-merge:
-    enabled: true
-    size: 5GB
-  trunk-push:
-    enabled: true
-    size: 5GB
-
-# Caching
-cache:
-  enabled: true
-  storage: local
-
-# CLI
-cli:
-  version: 1.22.2
-
-# Environment
-env:
-  variables:
-    EDITOR: vim
+  enabled:
+    - trunk-check-pre-push

From a0f54ba7d54bb65e63679183206baa97a647a7fc Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Tue, 11 Aug 2026 17:33:54 -0700
Subject: [PATCH 24/26] fix(ci): migrate .trunk/trunk.yaml to the 0.1 schema

Trunk Check has been failing on every PR with config-error findings:
the legacy pre-0.1 schema keys (linters/formatters/actions/cache/env)
are unrecognized by the pinned CLI 1.22.2. Migrate to the modern
schema, preserving the repo's linting intent:

- version: 0.1, cli.version: 1.22.2, plugin source uri added
- lint.definitions: repo-specific command overrides (black line length
  100 for lint+format, clippy --all-targets --all-features -D warnings)
  merged over the trunk plugin definitions
- lint.enabled: same 12 tools as before (plugin defaults otherwise)
- lint.ignore: scope prettier/yamllint off .github/workflows/** - those
  files are covered by actionlint; prettier re-indents `on:`-keyed
  workflow files with a nonstandard style and yamllint's 80-column
  default flags long action refs
- actions.enabled: trunk-check-pre-push (modern successor of the old
  trunk-check action)

Also fix the issues the freshly-running tools surfaced on this branch's
diff:
- actionlint: drop invalid `deployment` key under `environment` and
  quote the `--build_metadata=COMMIT_SHA=$(git rev-parse HEAD)` array
  element (SC2207) in v8-canary.yml and rusty-v8-release.yml
- taplo: add .taplo.toml declaring the repo's 4-space array indent and
  expand the tonic features array to match taplo's output
- add .trunk/.gitignore for trunk's local runtime state (canonical set
  from trunk-io/plugins)

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
---
 .github/workflows/rusty-v8-release.yml |   3 +-
 .github/workflows/v8-canary.yml        |   3 +-
 .taplo.toml                            |   6 ++
 .trunk/.gitignore                      |   8 ++
 .trunk/trunk.yaml                      | 105 ++++++++++++++-----------
 codex-rs/Cargo.toml                    |   5 +-
 6 files changed, 79 insertions(+), 51 deletions(-)
 create mode 100644 .taplo.toml
 create mode 100644 .trunk/.gitignore

diff --git a/.github/workflows/rusty-v8-release.yml b/.github/workflows/rusty-v8-release.yml
index 1b25e548e73..3f9d5855214 100644
--- a/.github/workflows/rusty-v8-release.yml
+++ b/.github/workflows/rusty-v8-release.yml
@@ -66,7 +66,6 @@ jobs:
       actions: read
     environment:
       name: bazel
-      deployment: false
     strategy:
       fail-fast: false
       matrix:
@@ -202,7 +201,7 @@ jobs:
             --config=rusty-v8-upstream-libcxx
             "--config=v8-target-${V8_CPU}"
             "${pair_target}"
-            --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
+            "--build_metadata=COMMIT_SHA=$(git rev-parse HEAD)"
           )
           if [[ "${SANDBOX}" != "true" ]]; then
             bazel_args+=(--config=v8-release-compat)
diff --git a/.github/workflows/v8-canary.yml b/.github/workflows/v8-canary.yml
index 0410824ca4b..0c07ac33269 100644
--- a/.github/workflows/v8-canary.yml
+++ b/.github/workflows/v8-canary.yml
@@ -110,7 +110,6 @@ jobs:
       actions: read
     environment:
       name: bazel
-      deployment: false
     strategy:
       fail-fast: false
       matrix:
@@ -245,7 +244,7 @@ jobs:
             "--config=v8-target-${V8_CPU}"
             "${pair_target}"
             --verbose_failures
-            --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
+            "--build_metadata=COMMIT_SHA=$(git rev-parse HEAD)"
           )
           if [[ "${SANDBOX}" != "true" ]]; then
             bazel_args+=(--config=v8-release-compat)
diff --git a/.taplo.toml b/.taplo.toml
new file mode 100644
index 00000000000..be4ca0506ba
--- /dev/null
+++ b/.taplo.toml
@@ -0,0 +1,6 @@
+# TOML formatting style for this repository (used by the `taplo` linter in
+# .trunk/trunk.yaml). The existing Cargo.toml files indent array entries
+# with 4 spaces, so keep taplo aligned with that instead of its 2-space
+# default.
+[formatting]
+indent_string = "    "
diff --git a/.trunk/.gitignore b/.trunk/.gitignore
new file mode 100644
index 00000000000..1e24652901a
--- /dev/null
+++ b/.trunk/.gitignore
@@ -0,0 +1,8 @@
+*out
+*logs
+*actions
+*notifications
+*tools
+plugins
+user_trunk.yaml
+user.yaml
diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index 79a029c9bd5..88edcb094e3 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -1,3 +1,4 @@
+---
 # =============================================================================
 # Trunk.io — Plugin versions for linting/formatting tools
 # =============================================================================
@@ -9,60 +10,72 @@ version: 0.1
 
 # CLI version pinned for reproducible runs (matches the version CI downloads).
 cli:
-  version: 1.22.2
+    version: 1.22.2
 
 # The `trunk` plugin provides the linter/formatter definitions used below.
 # User definitions merge over the plugin: fields set in this file override the
 # plugin, everything else (files, tools, runtimes, version pins) is inherited.
 plugins:
-  sources:
-    - id: trunk
-      ref: v1.2.2
-      uri: https://github.com/trunk-io/plugins
+    sources:
+        - id: trunk
+          ref: v1.2.2
+          uri: https://github.com/trunk-io/plugins
 
 lint:
-  # Repo-specific command overrides merged over the plugin definitions.
-  definitions:
-    # black: enforce 100-char line length in both lint and format modes.
-    - name: black
-      commands:
-        - name: lint
-          output: pass_fail
-          run: black --check --line-length 100 ${target}
-          success_codes: [0, 1]
-        - name: format
-          output: rewrite
-          run: black --line-length 100 ${target}
-          success_codes: [0]
-          batch: true
-          in_place: true
-          formatter: true
-    # clippy: lint all targets/features and fail on any warning.
-    - name: clippy
-      commands:
-        - name: lint
-          output: clippy
-          target: ${parent_with(Cargo.toml)}
-          run: cargo clippy --message-format json --all-targets --all-features --locked -- -D warnings
-          success_codes: [0, 101, 383]
-          disable_upstream: true
+    # Repo-specific command overrides merged over the plugin definitions.
+    definitions:
+        # black: enforce 100-char line length in both lint and format modes.
+        - name: black
+          commands:
+              - name: lint
+                output: pass_fail
+                run: black --check --line-length 100 ${target}
+                success_codes: [0, 1]
+              - name: format
+                output: rewrite
+                run: black --line-length 100 ${target}
+                success_codes: [0]
+                batch: true
+                in_place: true
+                formatter: true
+        # clippy: lint all targets/features and fail on any warning.
+        - name: clippy
+          commands:
+              - name: lint
+                output: clippy
+                target: ${parent_with(Cargo.toml)}
+                run: >
+                    cargo clippy --message-format json --all-targets
+                    --all-features
+                    --locked -- -D warnings
+                success_codes: [0, 101, 383]
+                disable_upstream: true
 
-  # Enabled tools (plugin defaults unless overridden above).
-  enabled:
-    - actionlint
-    - black
-    - clippy
-    - eslint
-    - golangci-lint
-    - mypy
-    - prettier
-    - ruff
-    - rustfmt
-    - shellcheck
-    - taplo
-    - yamllint
+    # Enabled tools (plugin defaults unless overridden above).
+    enabled:
+        - actionlint
+        - black
+        - clippy
+        - eslint
+        - golangci-lint
+        - mypy
+        - prettier
+        - ruff
+        - rustfmt
+        - shellcheck
+        - taplo
+        - yamllint
+
+    # GitHub workflow files are covered by actionlint (syntax + shellcheck).
+    # prettier's YAML printer re-indents `on:`-keyed workflow files with a
+    # nonstandard style, and yamllint's 80-column default flags long action
+    # refs; neither reflects this repo's intent, so scope both off workflows.
+    ignore:
+        - linters: [prettier, yamllint]
+          paths:
+              - .github/workflows/**
 
 # Git hooks: run `trunk check` before `git push`.
 actions:
-  enabled:
-    - trunk-check-pre-push
+    enabled:
+        - trunk-check-pre-push
diff --git a/codex-rs/Cargo.toml b/codex-rs/Cargo.toml
index 27b5649fe3a..bb391150107 100644
--- a/codex-rs/Cargo.toml
+++ b/codex-rs/Cargo.toml
@@ -373,7 +373,10 @@ tokio-tungstenite = { version = "0.28.0", features = [
     "rustls-tls-native-roots",
 ] }
 tokio-util = "0.7.18"
-tonic = { version = "0.14.3", default-features = false, features = ["channel", "codegen"] }
+tonic = { version = "0.14.3", default-features = false, features = [
+    "channel",
+    "codegen",
+] }
 tonic-prost = "0.14.3"
 toml = "0.9.5"
 toml_edit = "0.24.0"

From 0b86636bce5c1aba42787dfe12c563283d0abb82 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Tue, 11 Aug 2026 17:46:43 -0700
Subject: [PATCH 25/26] fix(ci): pin trunk linter versions in lint.enabled

Unpinned `lint.enabled` entries resolve to the SYSTEM copy of a tool
(trunk logs `@ version:SYSTEM` and never downloads it), so every
trunk-managed tool failed with "Binary not found" on the runner. Pin
each tool to the version it is validated with on this repo:

- actionlint 1.7.8, black 25.9.0, prettier 3.6.2, ruff 0.16.2,
  mypy 2.1.0, taplo 0.10.0, shellcheck 0.10.0, yamllint 1.37.1,
  eslint 8.10.0, golangci-lint 2.6.1
- clippy/rustfmt 1.88.0 (rust toolchain; repo's rust-toolchain.toml
  pins channel = "stable", edition 2024 requires >= 1.85)

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
---
 .trunk/trunk.yaml | 28 +++++++++++++++-------------
 1 file changed, 15 insertions(+), 13 deletions(-)

diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index 88edcb094e3..c74410dfe2b 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -51,20 +51,22 @@ lint:
                 success_codes: [0, 101, 383]
                 disable_upstream: true
 
-    # Enabled tools (plugin defaults unless overridden above).
+    # Enabled tools (plugin defaults unless overridden above). Versions are
+    # pinned explicitly: an unpinned entry resolves to the SYSTEM copy of the
+    # tool instead of a trunk-managed install.
     enabled:
-        - actionlint
-        - black
-        - clippy
-        - eslint
-        - golangci-lint
-        - mypy
-        - prettier
-        - ruff
-        - rustfmt
-        - shellcheck
-        - taplo
-        - yamllint
+        - actionlint@1.7.8
+        - black@25.9.0
+        - clippy@1.88.0
+        - eslint@8.10.0
+        - golangci-lint@2.6.1
+        - mypy@2.1.0
+        - prettier@3.6.2
+        - ruff@0.16.2
+        - rustfmt@1.88.0
+        - shellcheck@0.10.0
+        - taplo@0.10.0
+        - yamllint@1.37.1
 
     # GitHub workflow files are covered by actionlint (syntax + shellcheck).
     # prettier's YAML printer re-indents `on:`-keyed workflow files with a

From cc4b91962321dadbd9ccabb92354a3308d70cac9 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Tue, 11 Aug 2026 17:52:20 -0700
Subject: [PATCH 26/26] fix(ci): bump trunk plugin ref to v1.11.0

The v1.2.2 plugin definitions break with the pinned tool versions:

- taplo: the >=0.8.0 download is a bare .gz single binary; v1.2.2 lacks
  rename_single_file, so the decompressed file name never matches the
  `taplo` binary trunk looks up ("Unable to find binary in PATH").
- ruff: the lint command still passes `--format json`, which was removed
  from ruff in v0.1.0 (now `--output-format`), causing exit_code=2.

v1.11.0 (the ref trunk-action pins) fixes both and requires trunk
>=1.22.2-beta.5, compatible with the pinned cli 1.22.2.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
---
 .trunk/trunk.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index c74410dfe2b..6ddd777b631 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -18,7 +18,7 @@ cli:
 plugins:
     sources:
         - id: trunk
-          ref: v1.2.2
+          ref: v1.11.0
           uri: https://github.com/trunk-io/plugins
 
 lint: