fix(v8): select snapshot arch from target platform

Co-authored-by: Codex <noreply@openai.com>

.bazelrc

@@ -193,5 +193,10 @@ common --@v8//:v8_enable_sandbox=True
 common:v8-release-compat --@v8//:v8_enable_pointer_compression=False
 common:v8-release-compat --@v8//:v8_enable_sandbox=False
 
+# Match rusty_v8's upstream GN release contract for published artifacts: every
+# target object uses Chromium's custom libc++ headers and the archive folds in
+# the matching runtime objects.
+common:rusty-v8-upstream-libcxx --@v8//:v8_use_rusty_v8_custom_libcxx=True
+
 # Optional per-user local overrides.
 try-import %workspace%/user.bazelrc

.codex/skills/update-v8-version/SKILL.md

@@ -0,0 +1,72 @@
+---
+name: update-v8-version
+description: Update Codex's pinned `v8` / `rusty_v8` versions, validate the release-candidate path, and investigate failed V8 canary or artifact builds. Use when asked to bump V8, update `rusty_v8` artifacts, prepare or validate a V8 release candidate, check `v8-canary`, or diagnose why a V8 version update no longer builds.
+---
+
+# Update V8 Version
+
+## Core Workflow
+
+1. Read `third_party/v8/README.md` and follow its version-bump sequence. Treat
+   that document as the release-process source of truth.
+2. Inspect and update the concrete repo surfaces that carry the pin:
+   - `codex-rs/Cargo.toml`
+   - `codex-rs/Cargo.lock`
+   - `MODULE.bazel`
+   - `third_party/v8/BUILD.bazel`
+   - `third_party/v8/README.md`
+   - the matching `third_party/v8/rusty_v8_<version>.sha256` manifest when the
+     remaining prebuilt inputs change
+3. Keep the existing checksum helpers in the loop:
+
+   ```bash
+   python3 .github/scripts/rusty_v8_bazel.py update-module-bazel
+   python3 .github/scripts/rusty_v8_bazel.py check-module-bazel
+   python3 -m unittest discover -s .github/scripts -p test_rusty_v8_bazel.py
+   ```
+
+4. Validate the release-candidate path before broadening the work:
+   - Prefer checking the `v8-canary` CI result for the candidate branch or PR
+     when one exists, using GitHub check tooling or `gh` as appropriate.
+   - If CI is unavailable or the user asked for a local-only check, run the
+     closest local validation that is practical for the changed surface and say
+     explicitly that it is a local substitute, not the full hosted canary.
+5. If the canary path passes, stop there. Summarize the result and encourage the
+   user to commit the candidate changes or proceed with the release flow they
+   requested. Do not publish tags, releases, or pushes unless the user asked.
+
+## Failure Path
+
+Enter this path only when the canary or local build path fails.
+
+1. Capture the failing target, workflow job, and first actionable error.
+2. Compare the currently pinned version with the target version at the relevant
+   upstream tag or SHA. Inspect both:
+   - `denoland/rusty_v8`
+   - upstream V8 source at the target Bazel-pinned version
+3. Track build-relevant deltas rather than broad source churn:
+   - generated binding layout changes
+   - archive or asset naming changes
+   - GN/Bazel target changes
+   - custom libc++ / libc++abi / llvm-libc inputs
+   - sandbox or pointer-compression feature relationships
+   - patch hunks in `patches/` that no longer apply or no longer match upstream
+4. Trace each failing delta back into Codex's build graph:
+   - `MODULE.bazel`
+   - `third_party/v8/BUILD.bazel`
+   - `.github/scripts/rusty_v8_bazel.py`
+   - `.github/workflows/v8-canary.yml`
+   - `.github/workflows/rusty-v8-release.yml`
+5. Update only the pieces required to restore the target version's build and
+   artifact contract. Keep patch explanations and doc changes close to the
+   affected files.
+6. Re-run the focused validation. If it becomes green, return to the normal
+   workflow and stop with a concise summary plus the remaining release step.
+
+## Reporting
+
+- Say whether validation came from hosted `v8-canary` or from a local
+  substitute.
+- Distinguish "version bump complete" from "release published".
+- When blocked, report the upstream delta that matters, the Codex file it hits,
+  and the next concrete fix to try.

.codex/skills/update-v8-version/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Update V8 Version"
+  short_description: "Guide V8 bumps and release validation"
+  default_prompt: "Use $update-v8-version to update Codex to a new v8 release and validate the release-candidate path."

.github/actions/setup-rusty-v8-musl/action.yml

@@ -31,16 +31,14 @@ runs:
         archive_path="${binding_dir}/librusty_v8_release_${TARGET}.a.gz"
         binding_path="${binding_dir}/src_binding_release_${TARGET}.rs"
         checksums_path="${binding_dir}/rusty_v8_release_${TARGET}.sha256"
-        checksums_source="${GITHUB_WORKSPACE}/third_party/v8/rusty_v8_${version//./_}.sha256"
 
         mkdir -p "${binding_dir}"
         curl -fsSL "${base_url}/librusty_v8_release_${TARGET}.a.gz" -o "${archive_path}"
         curl -fsSL "${base_url}/src_binding_release_${TARGET}.rs" -o "${binding_path}"
-        grep -E "  (librusty_v8_release_${TARGET}[.]a[.]gz|src_binding_release_${TARGET}[.]rs)$" \
-          "${checksums_source}" > "${checksums_path}"
+        curl -fsSL "${base_url}/rusty_v8_release_${TARGET}.sha256" -o "${checksums_path}"
 
         if [[ "$(wc -l < "${checksums_path}")" -ne 2 ]]; then
-          echo "Expected exactly two checksums for ${TARGET} in ${checksums_source}" >&2
+          echo "Expected exactly two checksums for ${TARGET} in ${checksums_path}" >&2
           exit 1
         fi
 

.github/scripts/rusty_v8_bazel.py

@@ -5,17 +5,18 @@ from __future__ import annotations
 import argparse
 import gzip
 import hashlib
+import os
 import re
 import shutil
 import subprocess
 import sys
-import tempfile
 import tomllib
 from pathlib import Path
 
 from rusty_v8_module_bazel import (
     RustyV8ChecksumError,
     check_module_bazel,
+    rusty_v8_http_file_versions,
     update_module_bazel,
 )
 
@@ -23,12 +24,16 @@ from rusty_v8_module_bazel import (
 ROOT = Path(__file__).resolve().parents[2]
 MODULE_BAZEL = ROOT / "MODULE.bazel"
 RUSTY_V8_CHECKSUMS_DIR = ROOT / "third_party" / "v8"
-MUSL_RUNTIME_ARCHIVE_LABELS = [
-    "@llvm//runtimes/libcxx:libcxx.static",
-    "@llvm//runtimes/libcxx:libcxxabi.static",
-]
-LLVM_AR_LABEL = "@llvm//tools:llvm-ar"
-LLVM_RANLIB_LABEL = "@llvm//tools:llvm-ranlib"
+RELEASE_ARTIFACT_PROFILE = "release"
+SANDBOX_ARTIFACT_PROFILE = "ptrcomp_sandbox_release"
+ARTIFACT_BAZEL_CONFIGS = ["rusty-v8-upstream-libcxx"]
+
+
+def bazel_remote_args() -> list[str]:
+    buildbuddy_api_key = os.environ.get("BUILDBUDDY_API_KEY")
+    if not buildbuddy_api_key:
+        return []
+    return [f"--remote_header=x-buildbuddy-api-key={buildbuddy_api_key}"]
 
 
 def bazel_execroot() -> Path:
@@ -75,6 +80,7 @@ def bazel_output_files(
             compilation_mode,
             f"--platforms=@llvm//platforms:{platform}",
             *[f"--config={config}" for config in bazel_configs],
+            *bazel_remote_args(),
             "--output=files",
             expression,
         ],
@@ -91,8 +97,10 @@ def bazel_build(
     labels: list[str],
     compilation_mode: str = "fastbuild",
     bazel_configs: list[str] | None = None,
+    download_toplevel: bool = False,
 ) -> None:
     bazel_configs = bazel_configs or []
+    download_args = ["--remote_download_toplevel"] if download_toplevel else []
     subprocess.run(
         [
             "bazel",
@@ -101,6 +109,8 @@ def bazel_build(
             compilation_mode,
             f"--platforms=@llvm//platforms:{platform}",
             *[f"--config={config}" for config in bazel_configs],
+            *bazel_remote_args(),
+            *download_args,
             *labels,
         ],
         cwd=ROOT,
@@ -114,11 +124,15 @@ def ensure_bazel_output_files(
     compilation_mode: str = "fastbuild",
     bazel_configs: list[str] | None = None,
 ) -> list[Path]:
-    outputs = bazel_output_files(platform, labels, compilation_mode, bazel_configs)
-    if all(path.exists() for path in outputs):
-        return outputs
-
-    bazel_build(platform, labels, compilation_mode, bazel_configs)
+    # Bazel output paths can be reused across config flips, so existence alone
+    # does not prove the files match the requested flags.
+    bazel_build(
+        platform,
+        labels,
+        compilation_mode,
+        bazel_configs,
+        download_toplevel=True,
+    )
     outputs = bazel_output_files(platform, labels, compilation_mode, bazel_configs)
     missing = [str(path) for path in outputs if not path.exists()]
     if missing:
@@ -126,9 +140,18 @@ def ensure_bazel_output_files(
     return outputs
 
 
-def release_pair_label(target: str) -> str:
+def artifact_bazel_configs(bazel_configs: list[str] | None = None) -> list[str]:
+    configured = list(ARTIFACT_BAZEL_CONFIGS)
+    for config in bazel_configs or []:
+        if config not in configured:
+            configured.append(config)
+    return configured
+
+
+def release_pair_label(target: str, sandbox: bool = False) -> str:
     target_suffix = target.replace("-", "_")
-    return f"//third_party/v8:rusty_v8_release_pair_{target_suffix}"
+    pair_kind = "sandbox_release_pair" if sandbox else "release_pair"
+    return f"//third_party/v8:rusty_v8_{pair_kind}_{target_suffix}"
 
 
 def resolved_v8_crate_version() -> str:
@@ -169,6 +192,16 @@ def rusty_v8_checksum_manifest_path(version: str) -> Path:
 def command_version(version: str | None) -> str:
     if version is not None:
         return version
+
+    manifest_versions = rusty_v8_http_file_versions(MODULE_BAZEL.read_text())
+    if len(manifest_versions) == 1:
+        return manifest_versions[0]
+    if len(manifest_versions) > 1:
+        raise SystemExit(
+            "expected at most one rusty_v8 http_file version in MODULE.bazel, "
+            f"found: {manifest_versions}; pass --version explicitly"
+        )
+
     return resolved_v8_crate_version()
 
 
@@ -180,66 +213,76 @@ def command_manifest_path(manifest: Path | None, version: str) -> Path:
     return ROOT / manifest
 
 
-def staged_archive_name(target: str, source_path: Path) -> str:
-    if source_path.suffix == ".lib":
-        return f"rusty_v8_release_{target}.lib.gz"
-    return f"librusty_v8_release_{target}.a.gz"
+def staged_archive_name(target: str, source_path: Path, artifact_profile: str) -> str:
+    if target.endswith("-pc-windows-msvc"):
+        return f"rusty_v8_{artifact_profile}_{target}.lib.gz"
+    return f"librusty_v8_{artifact_profile}_{target}.a.gz"
 
 
-def is_musl_archive_target(target: str, source_path: Path) -> bool:
-    return target.endswith("-unknown-linux-musl") and source_path.suffix == ".a"
+def staged_binding_name(target: str, artifact_profile: str) -> str:
+    return f"src_binding_{artifact_profile}_{target}.rs"
 
 
-def single_bazel_output_file(
-    platform: str,
-    label: str,
-    compilation_mode: str = "fastbuild",
-    bazel_configs: list[str] | None = None,
-) -> Path:
-    outputs = ensure_bazel_output_files(platform, [label], compilation_mode, bazel_configs)
-    if len(outputs) != 1:
-        raise SystemExit(f"expected exactly one output for {label}, found {outputs}")
-    return outputs[0]
+def staged_checksums_name(target: str, artifact_profile: str) -> str:
+    return f"rusty_v8_{artifact_profile}_{target}.sha256"
 
 
-def merged_musl_archive(
-    platform: str,
+def stage_artifacts(
+    target: str,
     lib_path: Path,
-    compilation_mode: str = "fastbuild",
-    bazel_configs: list[str] | None = None,
-) -> Path:
-    llvm_ar = single_bazel_output_file(platform, LLVM_AR_LABEL, compilation_mode, bazel_configs)
-    llvm_ranlib = single_bazel_output_file(
-        platform,
-        LLVM_RANLIB_LABEL,
-        compilation_mode,
-        bazel_configs,
-    )
-    runtime_archives = [
-        single_bazel_output_file(platform, label, compilation_mode, bazel_configs)
-        for label in MUSL_RUNTIME_ARCHIVE_LABELS
-    ]
+    binding_path: Path,
+    output_dir: Path,
+    sandbox: bool,
+) -> None:
+    missing_paths = [str(path) for path in [lib_path, binding_path] if not path.exists()]
+    if missing_paths:
+        raise SystemExit(f"missing release outputs for {target}: {missing_paths}")
 
-    temp_dir = Path(tempfile.mkdtemp(prefix="rusty-v8-musl-stage-"))
-    merged_archive = temp_dir / lib_path.name
-    merge_commands = "\n".join(
-        [
-            f"create {merged_archive}",
-            f"addlib {lib_path}",
-            *[f"addlib {archive}" for archive in runtime_archives],
-            "save",
-            "end",
-        ]
-    )
-    subprocess.run(
-        [str(llvm_ar), "-M"],
-        cwd=ROOT,
-        check=True,
-        input=merge_commands,
-        text=True,
-    )
-    subprocess.run([str(llvm_ranlib), str(merged_archive)], cwd=ROOT, check=True)
-    return merged_archive
+    output_dir.mkdir(parents=True, exist_ok=True)
+    artifact_profile = SANDBOX_ARTIFACT_PROFILE if sandbox else RELEASE_ARTIFACT_PROFILE
+    staged_library = output_dir / staged_archive_name(target, lib_path, artifact_profile)
+    staged_binding = output_dir / staged_binding_name(target, artifact_profile)
+
+    with lib_path.open("rb") as src, staged_library.open("wb") as dst:
+        with gzip.GzipFile(
+            filename="",
+            mode="wb",
+            fileobj=dst,
+            compresslevel=6,
+            mtime=0,
+        ) as gz:
+            shutil.copyfileobj(src, gz)
+
+    shutil.copyfile(binding_path, staged_binding)
+
+    staged_checksums = output_dir / staged_checksums_name(target, artifact_profile)
+    with staged_checksums.open("w", encoding="utf-8") as checksums:
+        for path in [staged_library, staged_binding]:
+            digest = hashlib.sha256()
+            with path.open("rb") as artifact:
+                for chunk in iter(lambda: artifact.read(1024 * 1024), b""):
+                    digest.update(chunk)
+            checksums.write(f"{digest.hexdigest()}  {path.name}\n")
+
+    print(staged_library)
+    print(staged_binding)
+    print(staged_checksums)
+
+
+def upstream_release_pair_paths(source_root: Path, target: str) -> tuple[Path, Path]:
+    lib_name = "rusty_v8.lib" if target.endswith("-pc-windows-msvc") else "librusty_v8.a"
+    gn_out = source_root / "target" / target / "release" / "gn_out"
+    return gn_out / "obj" / lib_name, gn_out / "src_binding.rs"
+
+
+def stage_upstream_release_pair(
+    source_root: Path,
+    target: str,
+    output_dir: Path,
+    sandbox: bool = False,
+) -> None:
+    lib_path, binding_path = upstream_release_pair_paths(source_root, target)
+    stage_artifacts(target, lib_path, binding_path, output_dir, sandbox)
 
 
 def stage_release_pair(
@@ -248,10 +291,12 @@ def stage_release_pair(
     output_dir: Path,
     compilation_mode: str = "fastbuild",
     bazel_configs: list[str] | None = None,
+    sandbox: bool = False,
 ) -> None:
+    bazel_configs = artifact_bazel_configs(bazel_configs)
     outputs = ensure_bazel_output_files(
         platform,
-        [release_pair_label(target)],
+        [release_pair_label(target, sandbox)],
         compilation_mode,
         bazel_configs,
     )
@@ -266,39 +311,7 @@ def stage_release_pair(
     except StopIteration as exc:
         raise SystemExit(f"missing Rust binding output for {target}") from exc
 
-    output_dir.mkdir(parents=True, exist_ok=True)
-    staged_library = output_dir / staged_archive_name(target, lib_path)
-    staged_binding = output_dir / f"src_binding_release_{target}.rs"
-    source_archive = (
-        merged_musl_archive(platform, lib_path, compilation_mode, bazel_configs)
-        if is_musl_archive_target(target, lib_path)
-        else lib_path
-    )
-
-    with source_archive.open("rb") as src, staged_library.open("wb") as dst:
-        with gzip.GzipFile(
-            filename="",
-            mode="wb",
-            fileobj=dst,
-            compresslevel=6,
-            mtime=0,
-        ) as gz:
-            shutil.copyfileobj(src, gz)
-
-    shutil.copyfile(binding_path, staged_binding)
-
-    staged_checksums = output_dir / f"rusty_v8_release_{target}.sha256"
-    with staged_checksums.open("w", encoding="utf-8") as checksums:
-        for path in [staged_library, staged_binding]:
-            digest = hashlib.sha256()
-            with path.open("rb") as artifact:
-                for chunk in iter(lambda: artifact.read(1024 * 1024), b""):
-                    digest.update(chunk)
-            checksums.write(f"{digest.hexdigest()}  {path.name}\n")
-
-    print(staged_library)
-    print(staged_binding)
-    print(staged_checksums)
+    stage_artifacts(target, lib_path, binding_path, output_dir, sandbox)
 
 
 def parse_args() -> argparse.Namespace:
@@ -309,6 +322,7 @@ def parse_args() -> argparse.Namespace:
     stage_release_pair_parser.add_argument("--platform", required=True)
     stage_release_pair_parser.add_argument("--target", required=True)
     stage_release_pair_parser.add_argument("--output-dir", required=True)
+    stage_release_pair_parser.add_argument("--sandbox", action="store_true")
     stage_release_pair_parser.add_argument(
         "--bazel-config",
         action="append",
@@ -321,6 +335,14 @@ def parse_args() -> argparse.Namespace:
         choices=["fastbuild", "opt", "dbg"],
     )
 
+    stage_upstream_release_pair_parser = subparsers.add_parser(
+        "stage-upstream-release-pair"
+    )
+    stage_upstream_release_pair_parser.add_argument("--source-root", type=Path, required=True)
+    stage_upstream_release_pair_parser.add_argument("--target", required=True)
+    stage_upstream_release_pair_parser.add_argument("--output-dir", required=True)
+    stage_upstream_release_pair_parser.add_argument("--sandbox", action="store_true")
+
     subparsers.add_parser("resolved-v8-crate-version")
 
     check_module_bazel_parser = subparsers.add_parser("check-module-bazel")
@@ -353,6 +375,15 @@ def main() -> int:
             output_dir=Path(args.output_dir),
             compilation_mode=args.compilation_mode,
             bazel_configs=args.bazel_configs,
+            sandbox=args.sandbox,
+        )
+        return 0
+    if args.command == "stage-upstream-release-pair":
+        stage_upstream_release_pair(
+            source_root=args.source_root,
+            target=args.target,
+            output_dir=Path(args.output_dir),
+            sandbox=args.sandbox,
         )
         return 0
     if args.command == "resolved-v8-crate-version":

.github/scripts/rusty_v8_module_bazel.py

@@ -9,6 +9,7 @@ from pathlib import Path
 
 SHA256_RE = re.compile(r"[0-9a-f]{64}")
 HTTP_FILE_BLOCK_RE = re.compile(r"(?ms)^http_file\(\n.*?^\)\n?")
+HTTP_FILE_VERSION_RE = re.compile(r"^rusty_v8_([0-9]+)_([0-9]+)_([0-9]+)_")
 
 
 class RustyV8ChecksumError(ValueError):
@@ -95,6 +96,18 @@ def rusty_v8_http_files(module_bazel: str, version: str) -> list[RustyV8HttpFile
     return entries
 
 
+def rusty_v8_http_file_versions(module_bazel: str) -> list[str]:
+    versions = set()
+    for match in HTTP_FILE_BLOCK_RE.finditer(module_bazel):
+        name = string_field(match.group(0), "name")
+        if not name:
+            continue
+        version_match = HTTP_FILE_VERSION_RE.match(name)
+        if version_match:
+            versions.add(".".join(version_match.groups()))
+    return sorted(versions)
+
+
 def module_entry_set_errors(
     entries: list[RustyV8HttpFile],
     checksums: dict[str, str],

.github/scripts/test_rusty_v8_bazel.py

@@ -4,11 +4,270 @@ from __future__ import annotations
 
 import textwrap
 import unittest
+from os import environ
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from unittest.mock import patch
 
+import rusty_v8_bazel
 import rusty_v8_module_bazel
 
 
 class RustyV8BazelTest(unittest.TestCase):
+    def test_consumer_selectors_track_resolved_crate_version(self) -> None:
+        build_bazel = (
+            rusty_v8_bazel.ROOT / "third_party" / "v8" / "BUILD.bazel"
+        ).read_text()
+        version_suffix = rusty_v8_bazel.resolved_v8_crate_version().replace(".", "_")
+
+        for selector in [
+            "aarch64_apple_darwin_bazel",
+            "aarch64_pc_windows_gnullvm",
+            "aarch64_pc_windows_msvc",
+            "aarch64_unknown_linux_gnu_bazel",
+            "aarch64_unknown_linux_musl_release_base",
+            "x86_64_apple_darwin_bazel",
+            "x86_64_pc_windows_gnullvm",
+            "x86_64_pc_windows_msvc",
+            "x86_64_unknown_linux_gnu_bazel",
+            "x86_64_unknown_linux_musl_release",
+        ]:
+            self.assertIn(
+                f":v8_{version_suffix}_{selector}",
+                build_bazel,
+            )
+
+        for selector in [
+            "aarch64_apple_darwin",
+            "aarch64_pc_windows_gnullvm",
+            "aarch64_pc_windows_msvc",
+            "aarch64_unknown_linux_gnu",
+            "aarch64_unknown_linux_musl",
+            "x86_64_apple_darwin",
+            "x86_64_pc_windows_gnullvm",
+            "x86_64_pc_windows_msvc",
+            "x86_64_unknown_linux_gnu",
+            "x86_64_unknown_linux_musl",
+        ]:
+            self.assertIn(
+                f":src_binding_release_{selector}_{version_suffix}_release",
+                build_bazel,
+            )
+
+    def test_command_version_tracks_remaining_http_file_assets(self) -> None:
+        with TemporaryDirectory() as temp_dir:
+            module_bazel = Path(temp_dir) / "MODULE.bazel"
+            module_bazel.write_text(
+                textwrap.dedent(
+                    """\
+                    http_file(
+                        name = "rusty_v8_146_4_0_x86_64_unknown_linux_gnu_archive",
+                        downloaded_file_path = "librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
+                        urls = ["https://example.test/archive.gz"],
+                    )
+                    """
+                )
+            )
+
+            with patch.object(rusty_v8_bazel, "MODULE_BAZEL", module_bazel):
+                self.assertEqual("146.4.0", rusty_v8_bazel.command_version(None))
+
+    def test_artifact_bazel_configs_always_enable_upstream_libcxx(self) -> None:
+        self.assertEqual(
+            ["rusty-v8-upstream-libcxx"],
+            rusty_v8_bazel.artifact_bazel_configs(),
+        )
+        self.assertEqual(
+            ["rusty-v8-upstream-libcxx", "v8-release-compat"],
+            rusty_v8_bazel.artifact_bazel_configs(["v8-release-compat"]),
+        )
+        self.assertEqual(
+            ["rusty-v8-upstream-libcxx", "v8-release-compat"],
+            rusty_v8_bazel.artifact_bazel_configs(
+                ["rusty-v8-upstream-libcxx", "v8-release-compat"]
+            ),
+        )
+
+    def test_bazel_remote_args_include_buildbuddy_header_when_present(self) -> None:
+        with patch.dict(environ, {"BUILDBUDDY_API_KEY": "token"}, clear=False):
+            self.assertEqual(
+                ["--remote_header=x-buildbuddy-api-key=token"],
+                rusty_v8_bazel.bazel_remote_args(),
+            )
+
+        with patch.dict(environ, {}, clear=True):
+            self.assertEqual([], rusty_v8_bazel.bazel_remote_args())
+
+    def test_release_pair_labels_and_staged_names_distinguish_sandbox_artifacts(self) -> None:
+        self.assertEqual(
+            "//third_party/v8:rusty_v8_release_pair_x86_64_unknown_linux_musl",
+            rusty_v8_bazel.release_pair_label("x86_64-unknown-linux-musl"),
+        )
+        self.assertEqual(
+            "//third_party/v8:rusty_v8_sandbox_release_pair_x86_64_unknown_linux_musl",
+            rusty_v8_bazel.release_pair_label("x86_64-unknown-linux-musl", sandbox=True),
+        )
+        self.assertEqual(
+            "//third_party/v8:rusty_v8_sandbox_release_pair_x86_64_apple_darwin",
+            rusty_v8_bazel.release_pair_label("x86_64-apple-darwin", sandbox=True),
+        )
+        self.assertEqual(
+            "librusty_v8_release_x86_64-unknown-linux-musl.a.gz",
+            rusty_v8_bazel.staged_archive_name(
+                "x86_64-unknown-linux-musl",
+                Path("libv8.a"),
+                rusty_v8_bazel.RELEASE_ARTIFACT_PROFILE,
+            ),
+        )
+        self.assertEqual(
+            "rusty_v8_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.lib.gz",
+            rusty_v8_bazel.staged_archive_name(
+                "x86_64-pc-windows-msvc",
+                Path("v8.a"),
+                rusty_v8_bazel.SANDBOX_ARTIFACT_PROFILE,
+            ),
+        )
+        self.assertEqual(
+            "src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.rs",
+            rusty_v8_bazel.staged_binding_name(
+                "x86_64-unknown-linux-musl",
+                rusty_v8_bazel.SANDBOX_ARTIFACT_PROFILE,
+            ),
+        )
+        self.assertEqual(
+            "rusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.sha256",
+            rusty_v8_bazel.staged_checksums_name(
+                "x86_64-unknown-linux-musl",
+                rusty_v8_bazel.SANDBOX_ARTIFACT_PROFILE,
+            ),
+        )
+
+    def test_stage_artifacts(self) -> None:
+        with TemporaryDirectory() as source_dir, TemporaryDirectory() as output_dir:
+            source_root = Path(source_dir)
+            archive = source_root / "librusty_v8.a"
+            binding = source_root / "src_binding.rs"
+            archive.write_bytes(b"archive")
+            binding.write_text("binding")
+
+            rusty_v8_bazel.stage_artifacts(
+                "aarch64-apple-darwin",
+                archive,
+                binding,
+                Path(output_dir),
+                sandbox=True,
+            )
+
+            self.assertEqual(
+                {
+                    "librusty_v8_ptrcomp_sandbox_release_aarch64-apple-darwin.a.gz",
+                    "src_binding_ptrcomp_sandbox_release_aarch64-apple-darwin.rs",
+                    "rusty_v8_ptrcomp_sandbox_release_aarch64-apple-darwin.sha256",
+                },
+                {path.name for path in Path(output_dir).iterdir()},
+            )
+
+    def test_upstream_release_pair_paths(self) -> None:
+        self.assertEqual(
+            (
+                Path(
+                    "/tmp/rusty_v8/target/x86_64-apple-darwin/release/gn_out/obj/"
+                    "librusty_v8.a"
+                ),
+                Path(
+                    "/tmp/rusty_v8/target/x86_64-apple-darwin/release/gn_out/"
+                    "src_binding.rs"
+                ),
+            ),
+            rusty_v8_bazel.upstream_release_pair_paths(
+                Path("/tmp/rusty_v8"),
+                "x86_64-apple-darwin",
+            ),
+        )
+        self.assertEqual(
+            (
+                Path(
+                    "/tmp/rusty_v8/target/x86_64-pc-windows-msvc/release/gn_out/"
+                    "obj/rusty_v8.lib"
+                ),
+                Path(
+                    "/tmp/rusty_v8/target/x86_64-pc-windows-msvc/release/gn_out/"
+                    "src_binding.rs"
+                ),
+            ),
+            rusty_v8_bazel.upstream_release_pair_paths(
+                Path("/tmp/rusty_v8"),
+                "x86_64-pc-windows-msvc",
+            ),
+        )
+
+    def test_stage_upstream_release_pair(self) -> None:
+        with TemporaryDirectory() as source_dir, TemporaryDirectory() as output_dir:
+            source_root = Path(source_dir)
+            gn_out = (
+                source_root
+                / "target"
+                / "x86_64-pc-windows-msvc"
+                / "release"
+                / "gn_out"
+            )
+            (gn_out / "obj").mkdir(parents=True)
+            (gn_out / "obj" / "rusty_v8.lib").write_bytes(b"archive")
+            (gn_out / "src_binding.rs").write_text("binding")
+
+            rusty_v8_bazel.stage_upstream_release_pair(
+                source_root,
+                "x86_64-pc-windows-msvc",
+                Path(output_dir),
+                sandbox=True,
+            )
+
+            self.assertEqual(
+                {
+                    "rusty_v8_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.lib.gz",
+                    "src_binding_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.rs",
+                    "rusty_v8_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.sha256",
+                },
+                {path.name for path in Path(output_dir).iterdir()},
+            )
+
+    def test_ensure_bazel_output_files_rebuilds_existing_outputs(self) -> None:
+        with TemporaryDirectory() as output_dir:
+            output = Path(output_dir) / "libv8.a"
+            output.write_bytes(b"archive")
+
+            with (
+                patch.object(rusty_v8_bazel, "bazel_build") as bazel_build,
+                patch.object(
+                    rusty_v8_bazel,
+                    "bazel_output_files",
+                    return_value=[output],
+                ) as bazel_output_files,
+            ):
+                self.assertEqual(
+                    [output],
+                    rusty_v8_bazel.ensure_bazel_output_files(
+                        "macos_arm64",
+                        ["//third_party/v8:pair"],
+                        "opt",
+                        ["rusty-v8-upstream-libcxx"],
+                    ),
+                )
+
+            bazel_build.assert_called_once_with(
+                "macos_arm64",
+                ["//third_party/v8:pair"],
+                "opt",
+                ["rusty-v8-upstream-libcxx"],
+                download_toplevel=True,
+            )
+            bazel_output_files.assert_called_once_with(
+                "macos_arm64",
+                ["//third_party/v8:pair"],
+                "opt",
+                ["rusty-v8-upstream-libcxx"],
+            )
+
     def test_update_module_bazel_replaces_and_inserts_sha256(self) -> None:
         module_bazel = textwrap.dedent(
             """\
@@ -121,6 +380,34 @@ class RustyV8BazelTest(unittest.TestCase):
                 "146.4.0",
             )
 
+    def test_rusty_v8_http_file_versions(self) -> None:
+        module_bazel = textwrap.dedent(
+            """\
+            http_file(
+                name = "rusty_v8_146_4_0_x86_64_unknown_linux_gnu_archive",
+                downloaded_file_path = "archive.gz",
+                urls = ["https://example.test/archive.gz"],
+            )
+
+            http_file(
+                name = "rusty_v8_147_4_0_x86_64_unknown_linux_gnu_archive",
+                downloaded_file_path = "new-archive.gz",
+                urls = ["https://example.test/new-archive.gz"],
+            )
+
+            http_file(
+                name = "unrelated_archive",
+                downloaded_file_path = "other.gz",
+                urls = ["https://example.test/other.gz"],
+            )
+            """
+        )
+
+        self.assertEqual(
+            ["146.4.0", "147.4.0"],
+            rusty_v8_module_bazel.rusty_v8_http_file_versions(module_bazel),
+        )
+
 
 if __name__ == "__main__":
     unittest.main()

.github/workflows/rusty-v8-release.yml

@@ -46,14 +46,14 @@ jobs:
           expected_release_tag="rusty-v8-v${V8_VERSION}"
           release_tag="${GITHUB_REF_NAME}"
           if [[ "${release_tag}" != "${expected_release_tag}" ]]; then
-            echo "Tag ${release_tag} does not match resolved v8 crate version ${V8_VERSION}." >&2
+            echo "Tag ${release_tag} does not match expected release tag ${expected_release_tag}." >&2
             exit 1
           fi
 
           echo "release_tag=${release_tag}" >> "$GITHUB_OUTPUT"
 
   build:
-    name: Build ${{ matrix.target }}
+    name: Build ${{ matrix.variant }} ${{ matrix.target }}
     needs: metadata
     runs-on: ${{ matrix.runner }}
     permissions:
@@ -64,11 +64,77 @@ jobs:
       matrix:
         include:
           - runner: ubuntu-24.04
-            platform: linux_amd64_musl
-            target: x86_64-unknown-linux-musl
+            bazel_config: ci-v8
+            platform: linux_amd64
+            sandbox: false
+            target: x86_64-unknown-linux-gnu
+            variant: release
+          - runner: ubuntu-24.04
+            bazel_config: ci-v8
+            platform: linux_amd64
+            sandbox: true
+            target: x86_64-unknown-linux-gnu
+            variant: ptrcomp-sandbox
           - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
+            platform: linux_arm64
+            sandbox: false
+            target: aarch64-unknown-linux-gnu
+            variant: release
+          - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
+            platform: linux_arm64
+            sandbox: true
+            target: aarch64-unknown-linux-gnu
+            variant: ptrcomp-sandbox
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_amd64
+            sandbox: false
+            target: x86_64-apple-darwin
+            variant: release
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_amd64
+            sandbox: true
+            target: x86_64-apple-darwin
+            variant: ptrcomp-sandbox
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_arm64
+            sandbox: false
+            target: aarch64-apple-darwin
+            variant: release
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_arm64
+            sandbox: true
+            target: aarch64-apple-darwin
+            variant: ptrcomp-sandbox
+          - runner: ubuntu-24.04
+            bazel_config: ci-v8
+            platform: linux_amd64_musl
+            sandbox: false
+            target: x86_64-unknown-linux-musl
+            variant: release
+          - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
             platform: linux_arm64_musl
+            sandbox: false
             target: aarch64-unknown-linux-musl
+            variant: release
+          - runner: ubuntu-24.04
+            bazel_config: ci-v8
+            platform: linux_amd64_musl
+            sandbox: true
+            target: x86_64-unknown-linux-musl
+            variant: ptrcomp-sandbox
+          - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
+            platform: linux_arm64_musl
+            sandbox: true
+            target: aarch64-unknown-linux-musl
+            variant: ptrcomp-sandbox
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -85,61 +151,115 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Set up Rust toolchain for Cargo smoke
+        uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
+        with:
+          toolchain: "1.93.0"
+
       - name: Build Bazel V8 release pair
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
           PLATFORM: ${{ matrix.platform }}
+          SANDBOX: ${{ matrix.sandbox }}
           TARGET: ${{ matrix.target }}
         shell: bash
         run: |
           set -euo pipefail
 
           target_suffix="${TARGET//-/_}"
-          pair_target="//third_party/v8:rusty_v8_release_pair_${target_suffix}"
-          extra_targets=()
-          if [[ "${TARGET}" == *-unknown-linux-musl ]]; then
-            extra_targets=(
-              "@llvm//runtimes/libcxx:libcxx.static"
-              "@llvm//runtimes/libcxx:libcxxabi.static"
-            )
+          pair_kind="release_pair"
+          if [[ "${SANDBOX}" == "true" ]]; then
+            pair_kind="sandbox_release_pair"
           fi
+          pair_target="//third_party/v8:rusty_v8_${pair_kind}_${target_suffix}"
 
           bazel_args=(
             build
             -c
             opt
             "--platforms=@llvm//platforms:${PLATFORM}"
-            --config=v8-release-compat
+            --config=rusty-v8-upstream-libcxx
             "${pair_target}"
-            "${extra_targets[@]}"
             --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
           )
+          if [[ "${SANDBOX}" != "true" ]]; then
+            bazel_args+=(--config=v8-release-compat)
+          fi
 
           bazel \
             --noexperimental_remote_repo_contents_cache \
             "${bazel_args[@]}" \
-            --config=ci-v8 \
+            "--config=${{ matrix.bazel_config }}" \
             "--remote_header=x-buildbuddy-api-key=${BUILDBUDDY_API_KEY}"
 
       - name: Stage release pair
         env:
+          BAZEL_CONFIG: ${{ matrix.bazel_config }}
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
           PLATFORM: ${{ matrix.platform }}
+          SANDBOX: ${{ matrix.sandbox }}
           TARGET: ${{ matrix.target }}
         shell: bash
         run: |
           set -euo pipefail
 
-          python3 .github/scripts/rusty_v8_bazel.py stage-release-pair \
-            --platform "${PLATFORM}" \
-            --target "${TARGET}" \
-            --compilation-mode opt \
-            --bazel-config v8-release-compat \
+          stage_args=(
+            --platform "${PLATFORM}"
+            --target "${TARGET}"
+            --compilation-mode opt
             --output-dir "dist/${TARGET}"
+            --bazel-config "${BAZEL_CONFIG}"
+          )
+          if [[ "${SANDBOX}" == "true" ]]; then
+            stage_args+=(--sandbox)
+          else
+            stage_args+=(--bazel-config v8-release-compat)
+          fi
 
-      - name: Upload staged musl artifacts
+          python3 .github/scripts/rusty_v8_bazel.py stage-release-pair "${stage_args[@]}"
+
+      - name: Smoke test staged artifact with Cargo
+        env:
+          SANDBOX: ${{ matrix.sandbox }}
+          TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          host_arch="$(uname -m)"
+          case "${TARGET}:${host_arch}" in
+            x86_64-apple-darwin:x86_64|aarch64-apple-darwin:arm64|x86_64-unknown-linux-gnu:x86_64|aarch64-unknown-linux-gnu:aarch64)
+              ;;
+            *)
+              echo "Skipping non-native Cargo smoke for ${TARGET} on ${host_arch}."
+              exit 0
+              ;;
+          esac
+
+          archive="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'librusty_v8_*.a.gz' -print -quit)"
+          binding="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'src_binding_*.rs' -print -quit)"
+          if [[ -z "${archive}" || -z "${binding}" ]]; then
+            echo "Missing staged archive or binding for ${TARGET}." >&2
+            exit 1
+          fi
+
+          cargo_args=(test -p codex-v8-poc)
+          if [[ "${SANDBOX}" == "true" ]]; then
+            cargo_args+=(--features sandbox)
+          fi
+
+          (
+            cd codex-rs
+            CARGO_TARGET_DIR="${RUNNER_TEMP}/rusty-v8-cargo-smoke-${TARGET}-${SANDBOX}" \
+            RUSTY_V8_ARCHIVE="${GITHUB_WORKSPACE}/${archive}" \
+            RUSTY_V8_SRC_BINDING_PATH="${GITHUB_WORKSPACE}/${binding}" \
+            cargo "${cargo_args[@]}"
+          )
+
+      - name: Upload staged artifacts
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
-          name: rusty-v8-${{ needs.metadata.outputs.v8_version }}-${{ matrix.target }}
+          name: rusty-v8-${{ needs.metadata.outputs.v8_version }}-${{ matrix.variant }}-${{ matrix.target }}
           path: dist/${{ matrix.target }}/*
 
   publish-release:
@@ -152,7 +272,8 @@ jobs:
       actions: read
 
     steps:
-      - name: Ensure release tag is new
+      - name: Check whether release already exists
+        id: release
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ needs.metadata.outputs.release_tag }}
@@ -161,8 +282,9 @@ jobs:
           set -euo pipefail
 
           if gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" > /dev/null 2>&1; then
-            echo "Release tag ${RELEASE_TAG} already exists; musl artifact tags are immutable." >&2
-            exit 1
+            echo "exists=true" >> "${GITHUB_OUTPUT}"
+          else
+            echo "exists=false" >> "${GITHUB_OUTPUT}"
           fi
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -170,6 +292,7 @@ jobs:
           path: dist
 
       - name: Create GitHub Release
+        if: ${{ steps.release.outputs.exists != 'true' }}
         uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
         with:
           tag_name: ${{ needs.metadata.outputs.release_tag }}
@@ -177,3 +300,14 @@ jobs:
           files: dist/**
           # Keep V8 artifact releases out of Codex's normal "latest release" channel.
           prerelease: true
+
+      - name: Amend existing GitHub Release
+        if: ${{ steps.release.outputs.exists == 'true' }}
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+        with:
+          tag_name: ${{ needs.metadata.outputs.release_tag }}
+          name: ${{ needs.metadata.outputs.release_tag }}
+          files: dist/**
+          overwrite_files: true
+          # Keep V8 artifact releases out of Codex's normal "latest release" channel.
+          prerelease: true

.github/workflows/v8-canary.yml

@@ -3,28 +3,36 @@ name: v8-canary
 on:
   pull_request:
     paths:
+      - ".bazelrc"
       - ".github/actions/setup-bazel-ci/**"
       - ".github/scripts/rusty_v8_bazel.py"
+      - ".github/scripts/rusty_v8_module_bazel.py"
       - ".github/workflows/rusty-v8-release.yml"
       - ".github/workflows/v8-canary.yml"
       - "MODULE.bazel"
       - "MODULE.bazel.lock"
       - "codex-rs/Cargo.toml"
       - "patches/BUILD.bazel"
+      - "patches/llvm_*.patch"
+      - "patches/rules_cc_*.patch"
       - "patches/v8_*.patch"
       - "third_party/v8/**"
   push:
     branches:
       - main
     paths:
+      - ".bazelrc"
       - ".github/actions/setup-bazel-ci/**"
       - ".github/scripts/rusty_v8_bazel.py"
+      - ".github/scripts/rusty_v8_module_bazel.py"
       - ".github/workflows/rusty-v8-release.yml"
       - ".github/workflows/v8-canary.yml"
       - "MODULE.bazel"
       - "MODULE.bazel.lock"
       - "codex-rs/Cargo.toml"
       - "patches/BUILD.bazel"
+      - "patches/llvm_*.patch"
+      - "patches/rules_cc_*.patch"
       - "patches/v8_*.patch"
       - "third_party/v8/**"
   workflow_dispatch:
@@ -59,7 +67,7 @@ jobs:
           echo "version=${version}" >> "$GITHUB_OUTPUT"
 
   build:
-    name: Build ${{ matrix.target }}
+    name: Build ${{ matrix.variant }} ${{ matrix.target }}
     needs: metadata
     runs-on: ${{ matrix.runner }}
     permissions:
@@ -70,12 +78,77 @@ jobs:
       matrix:
         include:
           - runner: ubuntu-24.04
-            platform: linux_amd64_musl
-            target: x86_64-unknown-linux-musl
+            bazel_config: ci-v8
+            platform: linux_amd64
+            sandbox: false
+            target: x86_64-unknown-linux-gnu
+            variant: release
+          - runner: ubuntu-24.04
+            bazel_config: ci-v8
+            platform: linux_amd64
+            sandbox: true
+            target: x86_64-unknown-linux-gnu
+            variant: ptrcomp-sandbox
           - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
+            platform: linux_arm64
+            sandbox: false
+            target: aarch64-unknown-linux-gnu
+            variant: release
+          - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
+            platform: linux_arm64
+            sandbox: true
+            target: aarch64-unknown-linux-gnu
+            variant: ptrcomp-sandbox
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_amd64
+            sandbox: false
+            target: x86_64-apple-darwin
+            variant: release
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_amd64
+            sandbox: true
+            target: x86_64-apple-darwin
+            variant: ptrcomp-sandbox
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_arm64
+            sandbox: false
+            target: aarch64-apple-darwin
+            variant: release
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_arm64
+            sandbox: true
+            target: aarch64-apple-darwin
+            variant: ptrcomp-sandbox
+          - runner: ubuntu-24.04
+            bazel_config: ci-v8
+            platform: linux_amd64_musl
+            sandbox: false
+            target: x86_64-unknown-linux-musl
+            variant: release
+          - runner: ubuntu-24.04
+            bazel_config: ci-v8
+            platform: linux_amd64_musl
+            sandbox: true
+            target: x86_64-unknown-linux-musl
+            variant: ptrcomp-sandbox
+          - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
             platform: linux_arm64_musl
+            sandbox: false
             target: aarch64-unknown-linux-musl
-
+            variant: release
+          - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
+            platform: linux_arm64_musl
+            sandbox: true
+            target: aarch64-unknown-linux-musl
+            variant: ptrcomp-sandbox
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -92,53 +165,247 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Set up Rust toolchain for Cargo smoke
+        uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
+        with:
+          toolchain: "1.93.0"
+
       - name: Build Bazel V8 release pair
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
           PLATFORM: ${{ matrix.platform }}
+          SANDBOX: ${{ matrix.sandbox }}
           TARGET: ${{ matrix.target }}
         shell: bash
         run: |
           set -euo pipefail
 
           target_suffix="${TARGET//-/_}"
-          pair_target="//third_party/v8:rusty_v8_release_pair_${target_suffix}"
-          extra_targets=(
-            "@llvm//runtimes/libcxx:libcxx.static"
-            "@llvm//runtimes/libcxx:libcxxabi.static"
-          )
+          pair_kind="release_pair"
+          if [[ "${SANDBOX}" == "true" ]]; then
+            pair_kind="sandbox_release_pair"
+          fi
+          pair_target="//third_party/v8:rusty_v8_${pair_kind}_${target_suffix}"
 
           bazel_args=(
             build
             "--platforms=@llvm//platforms:${PLATFORM}"
-            --config=v8-release-compat
+            --config=rusty-v8-upstream-libcxx
             "${pair_target}"
-            "${extra_targets[@]}"
             --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
           )
+          if [[ "${SANDBOX}" != "true" ]]; then
+            bazel_args+=(--config=v8-release-compat)
+          fi
 
           bazel \
             --noexperimental_remote_repo_contents_cache \
             "${bazel_args[@]}" \
-            --config=ci-v8 \
+            "--config=${{ matrix.bazel_config }}" \
             "--remote_header=x-buildbuddy-api-key=${BUILDBUDDY_API_KEY}"
 
       - name: Stage release pair
         env:
+          BAZEL_CONFIG: ${{ matrix.bazel_config }}
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
           PLATFORM: ${{ matrix.platform }}
+          SANDBOX: ${{ matrix.sandbox }}
           TARGET: ${{ matrix.target }}
         shell: bash
         run: |
           set -euo pipefail
 
-          python3 .github/scripts/rusty_v8_bazel.py stage-release-pair \
-            --platform "${PLATFORM}" \
-            --target "${TARGET}" \
-            --bazel-config v8-release-compat \
+          stage_args=(
+            --platform "${PLATFORM}"
+            --target "${TARGET}"
             --output-dir "dist/${TARGET}"
+            --bazel-config "${BAZEL_CONFIG}"
+          )
+          if [[ "${SANDBOX}" == "true" ]]; then
+            stage_args+=(--sandbox)
+          else
+            stage_args+=(--bazel-config v8-release-compat)
+          fi
 
-      - name: Upload staged musl artifacts
+          python3 .github/scripts/rusty_v8_bazel.py stage-release-pair "${stage_args[@]}"
+
+      - name: Smoke test staged artifact with Cargo
+        env:
+          SANDBOX: ${{ matrix.sandbox }}
+          TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          host_arch="$(uname -m)"
+          case "${TARGET}:${host_arch}" in
+            x86_64-apple-darwin:x86_64|aarch64-apple-darwin:arm64|x86_64-unknown-linux-gnu:x86_64|aarch64-unknown-linux-gnu:aarch64)
+              ;;
+            *)
+              echo "Skipping non-native Cargo smoke for ${TARGET} on ${host_arch}."
+              exit 0
+              ;;
+          esac
+
+          archive="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'librusty_v8_*.a.gz' -print -quit)"
+          binding="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'src_binding_*.rs' -print -quit)"
+          if [[ -z "${archive}" || -z "${binding}" ]]; then
+            echo "Missing staged archive or binding for ${TARGET}." >&2
+            exit 1
+          fi
+
+          cargo_args=(test -p codex-v8-poc)
+          if [[ "${SANDBOX}" == "true" ]]; then
+            cargo_args+=(--features sandbox)
+          fi
+
+          (
+            cd codex-rs
+            CARGO_TARGET_DIR="${RUNNER_TEMP}/rusty-v8-cargo-smoke-${TARGET}-${SANDBOX}" \
+            RUSTY_V8_ARCHIVE="${GITHUB_WORKSPACE}/${archive}" \
+            RUSTY_V8_SRC_BINDING_PATH="${GITHUB_WORKSPACE}/${binding}" \
+            cargo "${cargo_args[@]}"
+          )
+
+      - name: Upload staged artifacts
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
-          name: v8-canary-${{ needs.metadata.outputs.v8_version }}-${{ matrix.target }}
+          name: v8-canary-${{ needs.metadata.outputs.v8_version }}-${{ matrix.variant }}-${{ matrix.target }}
+          path: dist/${{ matrix.target }}/*
+
+  build-windows-source:
+    name: Build ptrcomp-sandbox ${{ matrix.target }} from source
+    needs: metadata
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: windows-2022
+            target: x86_64-pc-windows-msvc
+          - runner: windows-2022
+            target: aarch64-pc-windows-msvc
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Configure git for upstream checkout
+        shell: bash
+        run: git config --global core.symlinks true
+
+      - name: Check out upstream rusty_v8
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: denoland/rusty_v8
+          ref: v${{ needs.metadata.outputs.v8_version }}
+          path: upstream-rusty-v8
+          submodules: recursive
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: "3.11"
+          architecture: x64
+
+      - name: Set up Codex Rust toolchain for Cargo smoke
+        uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
+        with:
+          toolchain: "1.93.0"
+          targets: ${{ matrix.target }}
+
+      - name: Install rusty_v8 Rust toolchain
+        env:
+          TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          rustup toolchain install 1.91.0 --profile minimal --no-self-update
+          rustup target add --toolchain 1.91.0 "${TARGET}"
+
+      - name: Write upstream submodule status
+        shell: bash
+        working-directory: upstream-rusty-v8
+        run: git submodule status --recursive > git_submodule_status.txt
+
+      - name: Restore upstream source-build cache
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        with:
+          path: |
+            upstream-rusty-v8/target/sccache
+            upstream-rusty-v8/target/${{ matrix.target }}/release/gn_out
+          key: rusty-v8-source-${{ matrix.target }}-sandbox-${{ hashFiles('upstream-rusty-v8/Cargo.lock', 'upstream-rusty-v8/build.rs', 'upstream-rusty-v8/git_submodule_status.txt') }}
+          restore-keys: |
+            rusty-v8-source-${{ matrix.target }}-sandbox-
+
+      - name: Install and start sccache
+        shell: pwsh
+        env:
+          SCCACHE_CACHE_SIZE: 256M
+          SCCACHE_DIR: ${{ github.workspace }}/upstream-rusty-v8/target/sccache
+          SCCACHE_IDLE_TIMEOUT: 0
+        run: |
+          $version = "v0.8.2"
+          $platform = "x86_64-pc-windows-msvc"
+          $basename = "sccache-$version-$platform"
+          $url = "https://github.com/mozilla/sccache/releases/download/$version/$basename.tar.gz"
+          cd ~
+          curl -LO $url
+          tar -xzvf "$basename.tar.gz"
+          . $basename/sccache --start-server
+          echo "$(pwd)/$basename" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+      - name: Install Chromium clang for ARM64 MSVC cross build
+        if: matrix.target == 'aarch64-pc-windows-msvc'
+        shell: bash
+        working-directory: upstream-rusty-v8
+        run: python3 tools/clang/scripts/update.py
+
+      - name: Build upstream rusty_v8 sandbox release pair
+        env:
+          SCCACHE_IDLE_TIMEOUT: 0
+          TARGET: ${{ matrix.target }}
+          V8_FROM_SOURCE: "1"
+        shell: bash
+        working-directory: upstream-rusty-v8
+        run: cargo +1.91.0 build --locked --release --target "${TARGET}" --features v8_enable_sandbox
+
+      - name: Stage upstream sandbox release pair
+        env:
+          TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 .github/scripts/rusty_v8_bazel.py stage-upstream-release-pair \
+            --source-root upstream-rusty-v8 \
+            --target "${TARGET}" \
+            --output-dir "dist/${TARGET}" \
+            --sandbox
+
+      - name: Smoke link staged artifact with Cargo
+        env:
+          TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          archive="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'rusty_v8_*.lib.gz' -print -quit)"
+          binding="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'src_binding_*.rs' -print -quit)"
+          if [[ -z "${archive}" || -z "${binding}" ]]; then
+            echo "Missing staged archive or binding for ${TARGET}." >&2
+            exit 1
+          fi
+
+          (
+            cd codex-rs
+            RUSTY_V8_ARCHIVE="${GITHUB_WORKSPACE}/${archive}" \
+            RUSTY_V8_SRC_BINDING_PATH="${GITHUB_WORKSPACE}/${binding}" \
+            cargo +1.93.0 test -p codex-v8-poc --target "${TARGET}" --features sandbox --no-run
+          )
+
+      - name: Upload staged artifacts
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+        with:
+          name: v8-canary-${{ needs.metadata.outputs.v8_version }}-ptrcomp-sandbox-${{ matrix.target }}
           path: dist/${{ matrix.target }}/*

MODULE.bazel

@@ -10,6 +10,7 @@ single_version_override(
     module_name = "llvm",
     patch_strip = 1,
     patches = [
+        "//patches:llvm_rusty_v8_custom_libcxx.patch",
         "//patches:llvm_windows_symlink_extract.patch",
     ],
 )
@@ -77,6 +78,13 @@ use_repo(osx, "macos_sdk")
 # Needed to disable xcode...
 bazel_dep(name = "apple_support", version = "2.1.0")
 bazel_dep(name = "rules_cc", version = "0.2.16")
+single_version_override(
+    module_name = "rules_cc",
+    patch_strip = 1,
+    patches = [
+        "//patches:rules_cc_rusty_v8_custom_libcxx.patch",
+    ],
+)
 bazel_dep(name = "rules_platform", version = "0.1.0")
 bazel_dep(name = "rules_rs", version = "0.0.58")
 # `rules_rs` still does not model `windows-gnullvm` as a distinct Windows exec
@@ -407,18 +415,18 @@ crate.annotation(
 
 inject_repo(crate, "alsa_lib")
 
-bazel_dep(name = "v8", version = "14.6.202.9")
+bazel_dep(name = "v8", version = "14.9.207.2")
 archive_override(
     module_name = "v8",
-    integrity = "sha256-JphDwLAzsd9KvgRZ7eQvNtPU6qGd3XjFt/a/1QITAJU=",
+    integrity = "sha256-tflbZE5srqal6leMxJjK/ZQtwpF96OMGJ6avd5lice4=",
     patch_strip = 3,
     patches = [
         "//patches:v8_module_deps.patch",
         "//patches:v8_bazel_rules.patch",
         "//patches:v8_source_portability.patch",
     ],
-    strip_prefix = "v8-14.6.202.9",
-    urls = ["https://github.com/v8/v8/archive/refs/tags/14.6.202.9.tar.gz"],
+    strip_prefix = "v8-14.9.207.2",
+    urls = ["https://github.com/v8/v8/archive/refs/tags/14.9.207.2.tar.gz"],
 )
 
 http_archive(
@@ -430,93 +438,53 @@ http_archive(
     urls = ["https://static.crates.io/crates/v8/v8-146.4.0.crate"],
 )
 
-http_file(
-    name = "rusty_v8_146_4_0_aarch64_apple_darwin_archive",
-    downloaded_file_path = "librusty_v8_release_aarch64-apple-darwin.a.gz",
-    sha256 = "bfe2c9be32a56c28546f0f965825ee68fbf606405f310cc4e17b448a568cf98a",
-    urls = [
-        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/librusty_v8_release_aarch64-apple-darwin.a.gz",
-    ],
+http_archive(
+    name = "v8_crate_147_4_0",
+    build_file = "//third_party/v8:v8_crate.BUILD.bazel",
+    sha256 = "2df8fffd507fb18ed000673a83d937f58e60fb07f3306b2274284125b15137cd",
+    strip_prefix = "v8-147.4.0",
+    type = "tar.gz",
+    urls = ["https://static.crates.io/crates/v8/v8-147.4.0.crate"],
+)
+
+git_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
+
+git_repository(
+    name = "rusty_v8_libcxx",
+    build_file = "//third_party/v8:libcxx.BUILD.bazel",
+    commit = "99457fa555797f8c5ac3c076ca288d8481d3b23a",
+    remote = "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
+)
+
+git_repository(
+    name = "rusty_v8_libcxxabi",
+    build_file = "//third_party/v8:libcxxabi.BUILD.bazel",
+    commit = "8f11bb1d4438d0239d0dfc1bd9456a9f31629dda",
+    remote = "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
+)
+
+git_repository(
+    name = "rusty_v8_llvm_libc",
+    build_file = "//third_party/v8:llvm_libc.BUILD.bazel",
+    commit = "cb952785ccee13811f293f3c419958d1e3ddafbf",
+    remote = "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
 )
 
 http_file(
-    name = "rusty_v8_146_4_0_aarch64_unknown_linux_gnu_archive",
-    downloaded_file_path = "librusty_v8_release_aarch64-unknown-linux-gnu.a.gz",
-    sha256 = "dbf165b07c81bdb054bc046b43d23e69fcf7bcc1a4c1b5b4776983a71062ecd8",
-    urls = [
-        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/librusty_v8_release_aarch64-unknown-linux-gnu.a.gz",
-    ],
-)
-
-http_file(
-    name = "rusty_v8_146_4_0_aarch64_pc_windows_msvc_archive",
+    name = "rusty_v8_147_4_0_aarch64_pc_windows_msvc_archive",
     downloaded_file_path = "rusty_v8_release_aarch64-pc-windows-msvc.lib.gz",
-    sha256 = "ed13363659c6d08583ac8fdc40493445c5767d8b94955a4d5d7bb8d5a81f6bf8",
+    sha256 = "1fa3f94d9e09cff1f6bcce94c478e5cb072c0755f6a0357abadb9dd3b48d8127",
     urls = [
-        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/rusty_v8_release_aarch64-pc-windows-msvc.lib.gz",
+        "https://github.com/denoland/rusty_v8/releases/download/v147.4.0/rusty_v8_release_aarch64-pc-windows-msvc.lib.gz",
     ],
 )
 
 http_file(
-    name = "rusty_v8_146_4_0_x86_64_apple_darwin_archive",
-    downloaded_file_path = "librusty_v8_release_x86_64-apple-darwin.a.gz",
-    sha256 = "630cd240f1bbecdb071417dc18387ab81cf67c549c1c515a0b4fcf9eba647bb7",
-    urls = [
-        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/librusty_v8_release_x86_64-apple-darwin.a.gz",
-    ],
-)
-
-http_file(
-    name = "rusty_v8_146_4_0_x86_64_unknown_linux_gnu_archive",
-    downloaded_file_path = "librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
-    sha256 = "e64b4d99e4ae293a2e846244a89b80178ba10382c13fb591c1fa6968f5291153",
-    urls = [
-        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
-    ],
-)
-
-http_file(
-    name = "rusty_v8_146_4_0_x86_64_pc_windows_msvc_archive",
+    name = "rusty_v8_147_4_0_x86_64_pc_windows_msvc_archive",
     downloaded_file_path = "rusty_v8_release_x86_64-pc-windows-msvc.lib.gz",
-    sha256 = "90a9a2346acd3685a355e98df85c24dbe406cb124367d16259a4b5d522621862",
+    sha256 = "e2827ff98b1a9d4c0343000fc5124ac30dfab3007bc0129c168c9355fc2fcd7c",
     urls = [
-        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/rusty_v8_release_x86_64-pc-windows-msvc.lib.gz",
-    ],
-)
-
-http_file(
-    name = "rusty_v8_146_4_0_aarch64_unknown_linux_musl_archive",
-    downloaded_file_path = "librusty_v8_release_aarch64-unknown-linux-musl.a.gz",
-    sha256 = "27a08ed26c34297bfd93e514692ccc44b85f8b15c6aa39cf34e784f84fb37e8e",
-    urls = [
-        "https://github.com/openai/codex/releases/download/rusty-v8-v146.4.0/librusty_v8_release_aarch64-unknown-linux-musl.a.gz",
-    ],
-)
-
-http_file(
-    name = "rusty_v8_146_4_0_aarch64_unknown_linux_musl_binding",
-    downloaded_file_path = "src_binding_release_aarch64-unknown-linux-musl.rs",
-    sha256 = "09f8900ced8297c229246c7a50b2e0ec23c54d0a554f369619cc29863f38dd1a",
-    urls = [
-        "https://github.com/openai/codex/releases/download/rusty-v8-v146.4.0/src_binding_release_aarch64-unknown-linux-musl.rs",
-    ],
-)
-
-http_file(
-    name = "rusty_v8_146_4_0_x86_64_unknown_linux_musl_archive",
-    downloaded_file_path = "librusty_v8_release_x86_64-unknown-linux-musl.a.gz",
-    sha256 = "20d8271ad712323d352c1383c36e3c4b755abc41ece35819c49c75ec7134d2f8",
-    urls = [
-        "https://github.com/openai/codex/releases/download/rusty-v8-v146.4.0/librusty_v8_release_x86_64-unknown-linux-musl.a.gz",
-    ],
-)
-
-http_file(
-    name = "rusty_v8_146_4_0_x86_64_unknown_linux_musl_binding",
-    downloaded_file_path = "src_binding_release_x86_64-unknown-linux-musl.rs",
-    sha256 = "09f8900ced8297c229246c7a50b2e0ec23c54d0a554f369619cc29863f38dd1a",
-    urls = [
-        "https://github.com/openai/codex/releases/download/rusty-v8-v146.4.0/src_binding_release_x86_64-unknown-linux-musl.rs",
+        "https://github.com/denoland/rusty_v8/releases/download/v147.4.0/rusty_v8_release_x86_64-pc-windows-msvc.lib.gz",
     ],
 )
 

codex-rs/Cargo.lock

@@ -1518,9 +1518,9 @@ checksum = "ade8366b8bd5ba243f0a58f036cc0ca8a2f069cff1a2351ef1cac6b083e16fc0"
 
 [[package]]
 name = "calendrical_calculations"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a0b39595c6ee54a8d0900204ba4c401d0ab4eb45adaf07178e8d017541529e7"
+checksum = "5abbd6eeda6885048d357edc66748eea6e0268e3dd11f326fff5bd248d779c26"
 dependencies = [
  "core_maths",
  "displaydoc",
@@ -5039,9 +5039,9 @@ dependencies = [
 
 [[package]]
 name = "diplomat"
-version = "0.14.0"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9adb46b05e2f53dcf6a7dfc242e4ce9eb60c369b6b6eb10826a01e93167f59c6"
+checksum = "7935649d00000f5c5d735448ad3dc07b9738160727017914cf42138b8e8e6611"
 dependencies = [
  "diplomat_core",
  "proc-macro2",
@@ -5051,15 +5051,15 @@ dependencies = [
 
 [[package]]
 name = "diplomat-runtime"
-version = "0.14.0"
+version = "0.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0569bd3caaf13829da7ee4e83dbf9197a0e1ecd72772da6d08f0b4c9285c8d29"
+checksum = "970ac38ad677632efcee6d517e783958da9bc78ec206d8d5e35b459ffc5e4864"
 
 [[package]]
 name = "diplomat_core"
-version = "0.14.0"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51731530ed7f2d4495019abc7df3744f53338e69e2863a6a64ae91821c763df1"
+checksum = "9cf41b94101a4bce993febaf0098092b0bb31deaf0ecaf6e0a2562465f61b383"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5609,9 +5609,9 @@ dependencies = [
 
 [[package]]
 name = "fixed_decimal"
-version = "0.7.1"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35eabf480f94d69182677e37571d3be065822acfafd12f2f085db44fbbcc8e57"
+checksum = "79c3c892f121fff406e5dd6b28c1b30096b95111c30701a899d4f2b18da6d1bd"
 dependencies = [
  "displaydoc",
  "smallvec",
@@ -7454,9 +7454,9 @@ dependencies = [
 
 [[package]]
 name = "icu_calendar"
-version = "2.1.1"
+version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6f0e52e009b6b16ba9c0693578796f2dd4aaa59a7f8f920423706714a89ac4e"
+checksum = "a2b2acc6263f494f1df50685b53ff8e57869e47d5c6fe39c23d518ae9a4f3e45"
 dependencies = [
  "calendrical_calculations",
  "displaydoc",
@@ -7470,18 +7470,19 @@ dependencies = [
 
 [[package]]
 name = "icu_calendar_data"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "527f04223b17edfe0bd43baf14a0cb1b017830db65f3950dc00224860a9a446d"
+checksum = "118577bcf3a0fa7c6ac0a7d6e951814da84ee56b9b1f68fb4d8d10b08cefaf4d"
 
 [[package]]
 name = "icu_collections"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
 dependencies = [
  "displaydoc",
  "potential_utf",
+ "utf8_iter",
  "yoke",
  "zerofrom",
  "zerovec",
@@ -7489,14 +7490,16 @@ dependencies = [
 
 [[package]]
 name = "icu_decimal"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a38c52231bc348f9b982c1868a2af3195199623007ba2c7650f432038f5b3e8e"
+checksum = "288247df2e32aa776ac54fdd64de552149ac43cb840f2761811f0e8d09719dd4"
 dependencies = [
+ "displaydoc",
  "fixed_decimal",
  "icu_decimal_data",
  "icu_locale",
  "icu_locale_core",
+ "icu_plurals",
  "icu_provider",
  "writeable",
  "zerovec",
@@ -7504,15 +7507,15 @@ dependencies = [
 
 [[package]]
 name = "icu_decimal_data"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2905b4044eab2dd848fe84199f9195567b63ab3a93094711501363f63546fef7"
+checksum = "6f14a5ca9e8af29eef62064f269078424283d90dbaffeac5225addf62aaabc22"
 
 [[package]]
 name = "icu_locale"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "532b11722e350ab6bf916ba6eb0efe3ee54b932666afec989465f9243fe6dd60"
+checksum = "d5a396343c7208121dc86e35623d3dfe19814a7613cfd14964994cdc9c9a2e26"
 dependencies = [
  "icu_collections",
  "icu_locale_core",
@@ -7525,9 +7528,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -7539,15 +7542,15 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_data"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c5f1d16b4c3a2642d3a719f18f6b06070ab0aef246a6418130c955ae08aa831"
+checksum = "d5fdcc9ac77c6d74ff5cf6e65ef3181d6af32003b16fce3a77fb451d2f695993"
 
 [[package]]
 name = "icu_normalizer"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -7559,15 +7562,34 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_plurals"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a50023f1d49ad5c4333380328a0d4a19e4b9d6d842ec06639affd5ba47c8103"
+dependencies = [
+ "fixed_decimal",
+ "icu_locale",
+ "icu_plurals_data",
+ "icu_provider",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_plurals_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8485497155dc865f901decb93ecc20d3e467df67bfeceb91e3ba34e2b11e8e1d"
 
 [[package]]
 name = "icu_properties"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
 dependencies = [
  "icu_collections",
  "icu_locale_core",
@@ -7579,15 +7601,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
 
 [[package]]
 name = "icu_provider"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -8969,7 +8991,7 @@ version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.1",
  "chrono",
  "getrandom 0.2.17",
  "http 1.4.0",
@@ -9437,7 +9459,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d8fae84b431384b68627d0f9b3b1245fcf9f46f6c0e3dc902e9dce64edd1967"
 dependencies = [
  "libc",
- "windows-sys 0.45.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -10842,9 +10864,9 @@ dependencies = [
 
 [[package]]
 name = "resb"
-version = "0.1.1"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a067ab3b5ca3b4dc307d0de9cf75f9f5e6ca9717b192b2f28a36c83e5de9e76"
+checksum = "22d392791f3c6802a1905a509e9d1a6039cbbcb5e9e00e5a6d3661f7c874f390"
 dependencies = [
  "potential_utf",
  "serde_core",
@@ -12561,14 +12583,14 @@ dependencies = [
 
 [[package]]
 name = "temporal_capi"
-version = "0.1.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a151e402c2bdb6a3a2a2f3f225eddaead2e7ce7dd5d3fa2090deb11b17aa4ed8"
+checksum = "8a2a1f001e756a9f5f2d175a9965c4c0b3a054f09f30de3a75ab49765f2deb36"
 dependencies = [
  "diplomat",
  "diplomat-runtime",
  "icu_calendar",
- "icu_locale",
+ "icu_locale_core",
  "num-traits",
  "temporal_rs",
  "timezone_provider",
@@ -12578,13 +12600,14 @@ dependencies = [
 
 [[package]]
 name = "temporal_rs"
-version = "0.1.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88afde3bd75d2fc68d77a914bece426aa08aa7649ffd0cdd4a11c3d4d33474d1"
+checksum = "9a902a45282e5175186b21d355efc92564601efe6e2d92818dc9e333d50bd4de"
 dependencies = [
+ "calendrical_calculations",
  "core_maths",
  "icu_calendar",
- "icu_locale",
+ "icu_locale_core",
  "ixdtf",
  "num-traits",
  "timezone_provider",
@@ -12801,9 +12824,9 @@ dependencies = [
 
 [[package]]
 name = "timezone_provider"
-version = "0.1.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df9ba0000e9e73862f3e7ca1ff159e2ddf915c9d8bb11e38a7874760f445d993"
+checksum = "c48f9b04628a2b813051e4dfe97c65281e49625eabd09ec343190e31e399a8c2"
 dependencies = [
  "tinystr",
  "zerotrie",
@@ -12834,9 +12857,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
 dependencies = [
  "displaydoc",
  "serde_core",
@@ -13650,9 +13673,9 @@ dependencies = [
 
 [[package]]
 name = "v8"
-version = "146.4.0"
+version = "147.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d97bcac5cdc5a195a4813f1855a6bc658f240452aac36caa12fd6c6f16026ab1"
+checksum = "2df8fffd507fb18ed000673a83d937f58e60fb07f3306b2274284125b15137cd"
 dependencies = [
  "bindgen",
  "bitflags 2.10.0",
@@ -14081,7 +14104,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -14802,9 +14825,9 @@ dependencies = [
 
 [[package]]
 name = "yoke"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
@@ -14813,9 +14836,9 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -14948,20 +14971,21 @@ dependencies = [
 
 [[package]]
 name = "zerotrie"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
 dependencies = [
  "displaydoc",
  "yoke",
  "zerofrom",
+ "zerovec",
 ]
 
 [[package]]
 name = "zerovec"
-version = "0.11.5"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
  "serde",
  "yoke",
@@ -14971,9 +14995,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.2"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -15044,9 +15068,9 @@ checksum = "3ff05f8caa9038894637571ae6b9e29466c1f4f829d26c9b28f869a29cbe3445"
 
 [[package]]
 name = "zoneinfo64"
-version = "0.2.1"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2e5597efbe7c421da8a7fd396b20b571704e787c21a272eecf35dfe9d386f0"
+checksum = "ed6eb2607e906160c457fd573e9297e65029669906b9ac8fb1b5cd5e055f0705"
 dependencies = [
  "calendrical_calculations",
  "icu_locale_core",

codex-rs/Cargo.toml

@@ -411,7 +411,7 @@ unicode-width = "0.2"
 url = "2"
 urlencoding = "2.1"
 uuid = "1"
-v8 = "=146.4.0"
+v8 = "=147.4.0"
 vt100 = "0.16.2"
 walkdir = "2.5.0"
 webbrowser = "1.0"

codex-rs/v8-poc/src/lib.rs

@@ -78,4 +78,15 @@ mod tests {
     fn evaluates_string_concatenation() {
         assert_eq!(evaluate_expression("'hello ' + 'world'"), "hello world");
     }
+
+    #[test]
+    fn parses_crdtp_dispatchable_messages() {
+        let cbor = v8::crdtp::json_to_cbor(br#"{"id":7,"method":"Runtime.evaluate","params":{}}"#)
+            .expect("JSON should convert to CBOR");
+        let dispatchable = v8::crdtp::Dispatchable::new(&cbor);
+
+        assert!(dispatchable.ok());
+        assert_eq!(dispatchable.call_id(), 7);
+        assert_eq!(dispatchable.method(), b"Runtime.evaluate");
+    }
 }

patches/BUILD.bazel

@@ -4,6 +4,7 @@ exports_files([
     "aws-lc-sys_windows_msvc_prebuilt_nasm.patch",
     "aws-lc-sys_windows_msvc_memcmp_probe.patch",
     "bzip2_windows_stack_args.patch",
+    "llvm_rusty_v8_custom_libcxx.patch",
     "llvm_windows_symlink_extract.patch",
     "rules_rust_windows_bootstrap_process_wrapper_linker.patch",
     "rules_rust_windows_build_script_runner_paths.patch",
@@ -12,6 +13,7 @@ exports_files([
     "rules_rust_windows_process_wrapper_skip_temp_outputs.patch",
     "rules_rust_windows_msvc_direct_link_args.patch",
     "rules_rust_windows_gnullvm_build_script.patch",
+    "rules_cc_rusty_v8_custom_libcxx.patch",
     "rules_rs_windows_gnullvm_exec.patch",
     "rules_rs_windows_exec_linker.patch",
     "rusty_v8_prebuilt_out_dir.patch",

patches/llvm_rusty_v8_custom_libcxx.patch

@@ -0,0 +1,79 @@
+diff --git a/toolchain/BUILD.bazel b/toolchain/BUILD.bazel
+index fa00156236..bf0ee9d368 100644
+--- a/toolchain/BUILD.bazel
++++ b/toolchain/BUILD.bazel
+@@ -222,11 +222,16 @@ cc_args_list(
+ 
+ # TODO(cerisier): extract those into proper semantic args list.
+ # TODO(zbarsky): This must match llvm/toolchains/llvm.bzl
++_DEFAULT_LIBCXX_HEADER_ARGS = select({
++    "@@//third_party/v8:use_rusty_v8_custom_libcxx": [],
++    "//conditions:default": [
++        "//toolchain/args:libcxx_headers_include_search_paths",
++    ],
++})
++
+ cc_args_list(
+     name = "linux_toolchain_args",
+-    args = [
+-        "//toolchain/args:libcxx_headers_include_search_paths",
+-    ] + select({
++    args = _DEFAULT_LIBCXX_HEADER_ARGS + select({
+         "//platforms/config:musl": [
+             "//toolchain/args/linux:kernel_headers_include_search_paths",
+             "//toolchain/args/linux:musl_libc_headers_include_search_paths",
+@@ -252,8 +257,7 @@ cc_args_list(
+ # TODO(zbarsky): This must match llvm/toolchains/llvm.bzl
+ cc_args_list(
+     name = "windows_toolchain_args",
+-    args = [
+-        "//toolchain/args:libcxx_headers_include_search_paths",
++    args = _DEFAULT_LIBCXX_HEADER_ARGS + [
+         "//toolchain/args/windows:mingw_headers_include_search_paths",
+     ],
+ )
+diff --git a/toolchain/llvm/llvm.bzl b/toolchain/llvm/llvm.bzl
+index d36d8b94bd..97aa879d4a 100644
+--- a/toolchain/llvm/llvm.bzl
++++ b/toolchain/llvm/llvm.bzl
+@@ -186,16 +186,22 @@ def declare_llvm_targets(*, suffix = ""):
+         ],
+     )
+ 
++    default_libcxx_target_headers = select({
++        "@@//third_party/v8:use_rusty_v8_custom_libcxx": [],
++        "//conditions:default": [
++            "@llvm//runtimes/libcxx:libcxx_headers_include_search_directory",
++            "@llvm//runtimes/libcxx:libcxxabi_headers_include_search_directory",
++        ],
++    })
++
+     # This must match //toolchain:linux_toolchain_args
+     include_path(
+         name = "linux_target_headers",
+         srcs = [
+             ":builtin_resource_dir",
+-            "@llvm//runtimes/libcxx:libcxx_headers_include_search_directory",
+-            "@llvm//runtimes/libcxx:libcxxabi_headers_include_search_directory",
+             "@kernel_headers//:kernel_headers_directory",
+             "@llvm//sanitizers:sanitizers_headers_include_search_directory",
+-        ] + select({
++        ] + default_libcxx_target_headers + select({
+             "@llvm//platforms/config:musl": [
+                 "@llvm//runtimes/musl:musl_headers_include_search_directory",
+             ],
+@@ -210,13 +216,11 @@ def declare_llvm_targets(*, suffix = ""):
+         name = "windows_target_headers",
+         srcs = [
+             ":builtin_resource_dir",
+-            "@llvm//runtimes/libcxx:libcxx_headers_include_search_directory",
+-            "@llvm//runtimes/libcxx:libcxxabi_headers_include_search_directory",
+             "@mingw//:mingw_generated_headers_crt_directory",
+             "@mingw//:mingw_w64_headers_include_directory",
+             "@mingw//:mingw_w64_headers_crt_directory",
+             "@mingw//:mingw_w64_winpthreads_include_directory",
+-        ],
++        ] + default_libcxx_target_headers,
+     )
+ 
+     include_path(

patches/rules_cc_rusty_v8_custom_libcxx.patch

@@ -0,0 +1,44 @@
+diff --git a/cc/cc_library.bzl b/cc/cc_library.bzl
+index c45c5fd954..2e3a01f12a 100644
+--- a/cc/cc_library.bzl
++++ b/cc/cc_library.bzl
+@@ -15,5 +15,39 @@
+
+ load("@cc_compatibility_proxy//:proxy.bzl", _cc_library = "cc_library")
+ 
++_RUSTY_V8_CUSTOM_LIBCXX_COPTS = select({
++    "@@//third_party/v8:use_rusty_v8_custom_libcxx": [
++        "-nostdinc++",
++        "-D_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
++        "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE",
++        "-D_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
++        "-D_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
++    ],
++    "//conditions:default": [],
++})
++
++_RUSTY_V8_CUSTOM_LIBCXX_DEPS = select({
++    "@@//third_party/v8:use_rusty_v8_custom_libcxx": [
++        "@@//third_party/v8:rusty_v8_custom_libcxx_headers",
++    ],
++    "//conditions:default": [],
++})
++
++_RUSTY_V8_CUSTOM_LIBCXX_REPOS = [
++    # V8 and ICU are patched in-tree. These external C++ dependencies still
++    # build inside the artifact closure once the LLVM toolchain's default
++    # libc++ headers are suppressed.
++    "@abseil-cpp+",
++    "@v8++http_archive+highway",
++    "@v8++http_archive+simdutf",
++]
++
++def _should_use_rusty_v8_custom_libcxx():
++    return native.repository_name() in _RUSTY_V8_CUSTOM_LIBCXX_REPOS
++
+ def cc_library(**kwargs):
++    if _should_use_rusty_v8_custom_libcxx():
++        kwargs["copts"] = (kwargs.get("copts", []) or []) + _RUSTY_V8_CUSTOM_LIBCXX_COPTS
++        kwargs["deps"] = (kwargs.get("deps", []) or []) + _RUSTY_V8_CUSTOM_LIBCXX_DEPS
++        kwargs["features"] = (kwargs.get("features", []) or []) + ["-module_maps"]
+     _cc_library(**kwargs)

patches/v8_bazel_rules.patch

@@ -7,16 +7,47 @@ diff --git a/orig/v8-14.6.202.11/bazel/defs.bzl b/mod/v8-14.6.202.11/bazel/defs.
 index 9648e4a..88efd41 100644
 --- a/orig/v8-14.6.202.11/bazel/defs.bzl
 +++ b/mod/v8-14.6.202.11/bazel/defs.bzl
-@@ -97,7 +97,7 @@ v8_config = rule(
+@@ -33,9 +33,21 @@
+ )
+ 
+ def v8_flag(name, default = False):
+-    _create_option_flag(name = name, build_setting_default = default)
+-    native.config_setting(name = "is_" + name, flag_values = {name: "True"})
+-    native.config_setting(name = "is_not_" + name, flag_values = {name: "False"})
++    _create_option_flag(
++        name = name,
++        build_setting_default = default,
++        visibility = ["//visibility:public"],
++    )
++    native.config_setting(
++        name = "is_" + name,
++        flag_values = {name: "True"},
++        visibility = ["//visibility:public"],
++    )
++    native.config_setting(
++        name = "is_not_" + name,
++        flag_values = {name: "False"},
++        visibility = ["//visibility:public"],
++    )
+ 
+ def v8_string(name, default = ""):
+     _create_option_string(name = name, build_setting_default = default)
+@@ -97,7 +109,13 @@
  
  def _default_args():
      return struct(
 -        deps = [":define_flags", "@libcxx//:libc++"],
-+        deps = [":define_flags"],
++        deps = [":define_flags"] + select({
++            "@v8//:is_v8_use_rusty_v8_custom_libcxx": [
++                "@@//third_party/v8:rusty_v8_custom_libcxx_headers",
++                "@@//third_party/v8:rusty_v8_custom_libcxx_runtime",
++            ],
++            "//conditions:default": [],
++        }),
          defines = select({
              "@v8//bazel/config:is_windows": [
                  "UNICODE",
-@@ -128,12 +128,6 @@ def _default_args():
+@@ -127,12 +145,15 @@
              ],
              "//conditions:default": [],
          }) + select({
@@ -26,20 +57,29 @@ index 9648e4a..88efd41 100644
 -                "-Wno-deprecated-declarations",
 -                "-std=c++20",
 -            ],
++            "@v8//:is_v8_use_rusty_v8_custom_libcxx": [
++                "-nostdinc++",
++                "-D_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
++                "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE",
++                "-D_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
++                "-D_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
++            ],
++            "//conditions:default": [],
++        }) + select({
              "@v8//bazel/config:is_gcc": [
                  "-Wno-extra",
                  "-Wno-array-bounds",
-@@ -155,7 +149,15 @@ def _default_args():
--            "@v8//bazel/config:is_windows": [
+@@ -152,9 +173,17 @@
+                 "-std=gnu++2a",
+             ],
+             "@v8//bazel/config:is_windows": [
 -                "/std:c++20",
--            ],
--            "//conditions:default": [],
-+            "@v8//bazel/config:is_windows": [
 +                "-Wno-invalid-offsetof",
 +                "-Wno-deprecated-this-capture",
 +                "-Wno-deprecated-declarations",
 +                "-std=c++20",
-+            ],
+             ],
+-            "//conditions:default": [],
 +            "//conditions:default": [
 +                "-Wno-invalid-offsetof",
 +                "-Wno-deprecated-this-capture",
@@ -49,7 +89,9 @@ index 9648e4a..88efd41 100644
          }) + select({
              "@v8//bazel/config:is_gcc_fastbuild": [
                  # Non-debug builds without optimizations fail because
-@@ -180,10 +179,10 @@ def _default_args():
+@@ -178,12 +207,12 @@
+         includes = ["include"],
+         linkopts = select({
              "@v8//bazel/config:is_windows": [
 -                "Winmm.lib",
 -                "DbgHelp.lib",
@@ -64,20 +106,70 @@ index 9648e4a..88efd41 100644
          }) + select({
              ":should_add_rdynamic": ["-rdynamic"],
              "//conditions:default": [],
+@@ -495,6 +524,8 @@ def _mksnapshot(ctx):
+         arguments = [
+             "--embedded_variant=Default",
++            "--target_arch",
++            ctx.attr.target_arch,
+             "--target_os",
+             ctx.attr.target_os,
+             "--startup_src",
+@@ -519,6 +550,7 @@ _v8_mksnapshot = rule(
+             executable = True,
+             cfg = "exec",
+         ),
++        "target_arch": attr.string(mandatory = True),
+         "target_os": attr.string(mandatory = True),
+         "prefix": attr.string(mandatory = True),
+         "suffix": attr.string(mandatory = True),
+@@ -532,6 +564,15 @@ def v8_mksnapshot(name, args, suffix = ""):
+         tool = ":noicu/mksnapshot" + suffix,
+         suffix = suffix,
++        target_arch = select({
++            "@v8//bazel/config:platform_cpu_arm": "arm",
++            "@v8//bazel/config:platform_cpu_arm64": "arm64",
++            "@v8//bazel/config:platform_cpu_ia32": "ia32",
++            "@v8//bazel/config:platform_cpu_ppc64le": "ppc64le",
++            "@v8//bazel/config:platform_cpu_riscv64": "riscv64",
++            "@v8//bazel/config:platform_cpu_s390x": "s390x",
++            "@v8//bazel/config:platform_cpu_x64": "x64",
++        }),
+         target_os = select({
+             "@v8//bazel/config:is_macos": "mac",
+             "@v8//bazel/config:is_windows": "win",
+             "//conditions:default": "",
+@@ -544,6 +585,15 @@ def v8_mksnapshot(name, args, suffix = ""):
+         tool = ":icu/mksnapshot" + suffix,
+         suffix = suffix,
++        target_arch = select({
++            "@v8//bazel/config:platform_cpu_arm": "arm",
++            "@v8//bazel/config:platform_cpu_arm64": "arm64",
++            "@v8//bazel/config:platform_cpu_ia32": "ia32",
++            "@v8//bazel/config:platform_cpu_ppc64le": "ppc64le",
++            "@v8//bazel/config:platform_cpu_riscv64": "riscv64",
++            "@v8//bazel/config:platform_cpu_s390x": "s390x",
++            "@v8//bazel/config:platform_cpu_x64": "x64",
++        }),
+         target_os = select({
+             "@v8//bazel/config:is_macos": "mac",
+             "@v8//bazel/config:is_windows": "win",
+             "//conditions:default": "",
 diff --git a/orig/v8-14.6.202.11/BUILD.bazel b/mod/v8-14.6.202.11/BUILD.bazel
-index 85f31b7..bbc351b 100644
+index 421ebcd..52283ea 100644
 --- a/orig/v8-14.6.202.11/BUILD.bazel
 +++ b/mod/v8-14.6.202.11/BUILD.bazel
-@@ -148,6 +148,8 @@ v8_flag(name = "v8_enable_trace_maps")
+@@ -148,6 +148,10 @@ v8_flag(name = "v8_enable_trace_maps")
  
  v8_flag(name = "v8_enable_v8_checks")
  
 +v8_flag(name = "v8_enable_sandbox")
++
++v8_flag(name = "v8_use_rusty_v8_custom_libcxx")
 +
  v8_flag(name = "v8_enable_verify_csa")
  
  v8_flag(name = "v8_enable_verify_heap")
-@@ -303,7 +305,7 @@ v8_int(
+@@ -313,7 +317,7 @@ v8_int(
  # If no explicit value for v8_enable_pointer_compression, we set it to 'none'.
  v8_string(
      name = "v8_enable_pointer_compression",
@@ -86,7 +178,7 @@ index 85f31b7..bbc351b 100644
  )
  
  # Default setting for v8_enable_pointer_compression.
-@@ -503,6 +505,7 @@ v8_config(
+@@ -513,6 +517,7 @@ v8_config(
          "v8_enable_slow_dchecks": "ENABLE_SLOW_DCHECKS",
          "v8_enable_runtime_call_stats": "V8_RUNTIME_CALL_STATS",
          "v8_enable_snapshot_native_code_counters": "V8_SNAPSHOT_NATIVE_CODE_COUNTERS",
@@ -94,7 +186,7 @@ index 85f31b7..bbc351b 100644
          "v8_enable_trace_maps": "V8_TRACE_MAPS",
          "v8_enable_turbofan": "V8_ENABLE_TURBOFAN",
          "v8_enable_v8_checks": "V8_ENABLE_CHECKS",
-@@ -4077,28 +4080,14 @@ filegroup(
+@@ -4098,28 +4103,14 @@ filegroup(
      }),
  )
  
@@ -129,7 +221,7 @@ index 85f31b7..bbc351b 100644
  )
  
  filegroup(
-@@ -4405,6 +4394,20 @@ genrule(
+@@ -4422,6 +4413,20 @@ genrule(
      srcs = [
          "include/js_protocol.pdl",
          "src/inspector/inspector_protocol_config.json",
@@ -150,7 +242,7 @@ index 85f31b7..bbc351b 100644
      ],
      outs = [
          "include/inspector/Debugger.h",
-@@ -4426,15 +4429,19 @@ genrule(
+@@ -4443,15 +4448,19 @@ genrule(
          "src/inspector/protocol/Schema.cpp",
          "src/inspector/protocol/Schema.h",
      ],
@@ -174,7 +266,7 @@ index 85f31b7..bbc351b 100644
      ],
  )
  
-@@ -4448,6 +4455,15 @@ filegroup(
+@@ -4465,6 +4474,35 @@ filegroup(
      ],
  )
  
@@ -186,11 +278,31 @@ index 85f31b7..bbc351b 100644
 +    strip_include_prefix = "",
 +    visibility = ["//visibility:public"],
 +)
++
++cc_library(
++    name = "rusty_v8_crdtp_headers",
++    hdrs = [
++        "third_party/inspector_protocol/crdtp/cbor.h",
++        "third_party/inspector_protocol/crdtp/dispatch.h",
++        "third_party/inspector_protocol/crdtp/error_support.h",
++        "third_party/inspector_protocol/crdtp/export.h",
++        "third_party/inspector_protocol/crdtp/find_by_first.h",
++        "third_party/inspector_protocol/crdtp/frontend_channel.h",
++        "third_party/inspector_protocol/crdtp/json.h",
++        "third_party/inspector_protocol/crdtp/parser_handler.h",
++        "third_party/inspector_protocol/crdtp/protocol_core.h",
++        "third_party/inspector_protocol/crdtp/serializable.h",
++        "third_party/inspector_protocol/crdtp/span.h",
++        "third_party/inspector_protocol/crdtp/status.h",
++    ],
++    strip_include_prefix = "",
++    visibility = ["//visibility:public"],
++)
 +
  filegroup(
      name = "d8_files",
      srcs = [
-@@ -4567,16 +4583,9 @@ cc_library(
+@@ -4584,16 +4602,9 @@ cc_library(
      ],
  )
  
@@ -210,7 +322,7 @@ index 85f31b7..bbc351b 100644
  )
  
  v8_library(
-@@ -4593,7 +4602,7 @@ v8_library(
+@@ -4610,7 +4621,7 @@ v8_library(
      copts = ["-Wno-implicit-fallthrough"],
      icu_deps = [
          ":icu/generated_torque_definitions_headers",
@@ -219,7 +331,7 @@ index 85f31b7..bbc351b 100644
      ],
      icu_srcs = [
          ":generated_regexp_special_case",
-@@ -4608,7 +4617,7 @@ v8_library(
+@@ -4625,7 +4636,7 @@ v8_library(
      ],
      deps = [
          ":lib_dragonbox",
@@ -228,7 +340,7 @@ index 85f31b7..bbc351b 100644
          ":lib_fp16",
          ":simdutf",
          ":v8_libbase",
-@@ -4664,6 +4673,7 @@ alias(
+@@ -4681,6 +4692,7 @@ alias(
  alias(
      name = "core_lib_icu",
      actual = "icu/v8",
@@ -236,7 +348,7 @@ index 85f31b7..bbc351b 100644
  )
  
  v8_library(
-@@ -4715,7 +4725,7 @@ v8_binary(
+@@ -4732,7 +4744,7 @@ v8_binary(
      ],
      deps = [
          ":v8_libbase",
@@ -245,17 +357,53 @@ index 85f31b7..bbc351b 100644
      ],
  )
  
+@@ -4772,9 +4784,15 @@ v8_binary(
+         ":icu/generated_torque_initializers",
+         ":icu/v8_initializers_files",
+     ],
++    # Match GN's mksnapshot `disable_icf` config. If the linker folds distinct
++    # external-reference helpers together while producing the snapshot, the
++    # final embedder binary may not fold the same pair and startup
++    # deserialization will reject the snapshot.
+     linkopts = select({
+         "@v8//bazel/config:is_android": ["-llog"],
+-        "//conditions:default": [],
++        "@v8//bazel/config:is_macos": ["-Wl,-no_deduplicate"],
++        "@v8//bazel/config:is_windows": ["/OPT:NOICF"],
++        "//conditions:default": ["-Wl,--icf=none"],
+     }),
+     noicu_deps = [":v8_libshared_noicu"],
+     noicu_srcs = [
 diff --git a/orig/v8-14.6.202.11/bazel/BUILD.icu b/mod/v8-14.6.202.11/bazel/BUILD.icu
-index 5fda2f4..381386c 100644
+index 5fda2f4..9729451 100644
 --- a/orig/v8-14.6.202.11/bazel/BUILD.icu
 +++ b/mod/v8-14.6.202.11/bazel/BUILD.icu
-@@ -1,3 +1,5 @@
+@@ -1,3 +1,24 @@
 +load("@rules_cc//cc:defs.bzl", "cc_library")
++
++CUSTOM_LIBCXX_COPTS = select({
++    "@v8//:is_v8_use_rusty_v8_custom_libcxx": [
++        "-nostdinc++",
++        "-D_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
++        "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE",
++        "-D_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
++        "-D_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
++    ],
++    "//conditions:default": [],
++})
++
++CUSTOM_LIBCXX_DEPS = select({
++    "@v8//:is_v8_use_rusty_v8_custom_libcxx": [
++        "@@//third_party/v8:rusty_v8_custom_libcxx_headers",
++        "@@//third_party/v8:rusty_v8_custom_libcxx_runtime",
++    ],
++    "//conditions:default": [],
++})
 +
  # Copyright 2021 the V8 project authors. All rights reserved.
  # Use of this source code is governed by a BSD-style license that can be
  # found in the LICENSE file.
-@@ -16,10 +18,7 @@ cc_library(
+@@ -16,15 +37,12 @@
      ]),
      copts = select({
          "@platforms//os:windows": [
@@ -267,7 +415,21 @@ index 5fda2f4..381386c 100644
          ],
          "//conditions:default": [
              "-Wno-deprecated-declarations",
-@@ -65,10 +64,7 @@ cc_library(
+         ],
+-    }),
++    }) + CUSTOM_LIBCXX_COPTS,
+     data = [":icudata"],
+     defines = [
+         "HAVE_DLOPEN=0",
+@@ -54,6 +72,7 @@
+         "U_ICUDATAENTRY_IN_COMMON",
+     ],
+     tags = ["requires-rtti"],
++    deps = CUSTOM_LIBCXX_DEPS,
+     alwayslink = 1,
+ )
+ 
+@@ -65,19 +84,16 @@
      ]),
      copts = select({
          "@platforms//os:windows": [
@@ -279,7 +441,18 @@ index 5fda2f4..381386c 100644
          ],
          "//conditions:default": [
              "-Wno-deprecated-declarations",
-@@ -93,10 +89,7 @@ cc_library(
+         ],
+-    }),
++    }) + CUSTOM_LIBCXX_COPTS,
+     local_defines = [
+         "U_I18N_IMPLEMENTATION",
+     ],
+-    deps = [":icuuc"],
++    deps = [":icuuc"] + CUSTOM_LIBCXX_DEPS,
+     alwayslink = 1,
+ )
+ 
+@@ -93,13 +109,10 @@
      ]),
      copts = select({
          "@platforms//os:windows": [
@@ -290,4 +463,16 @@ index 5fda2f4..381386c 100644
 +            "-Wno-deprecated-declarations",
          ],
          "//conditions:default": [],
-     }),
+-    }),
++    }) + CUSTOM_LIBCXX_COPTS,
+     include_prefix = "third_party/icu",
+     local_defines = [
+         "U_COMMON_IMPLEMENTATION",
+@@ -108,6 +121,6 @@
+     deps = [
+         ":icui18n",
+         ":icuuc",
+-    ],
++    ] + CUSTOM_LIBCXX_DEPS,
+     alwayslink = 1,
+ )

patches/v8_module_deps.patch

@@ -66,7 +66,7 @@ diff --git a/orig/v8-14.6.202.11/MODULE.bazel b/mod/v8-14.6.202.11/MODULE.bazel
  
  pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
  pip.parse(
-@@ -22,171 +80,3 @@
+@@ -22,179 +80,3 @@
  )
  use_repo(pip, "v8_python_deps")
  
@@ -77,6 +77,7 @@ diff --git a/orig/v8-14.6.202.11/MODULE.bazel b/mod/v8-14.6.202.11/MODULE.bazel
 -    name = "llvm_toolchain",
 -    path = "third_party/llvm-build/Release+Asserts",
 -    config_file_content = """
+-load("@rules_cc//cc:defs.bzl", "CcToolchainConfigInfo", "cc_common")
 -load("@bazel_tools//tools/cpp:cc_toolchain_config_lib.bzl", "feature", "flag_group", "flag_set", "tool_path")
 -
 -def _impl(ctx):
@@ -157,6 +158,7 @@ diff --git a/orig/v8-14.6.202.11/MODULE.bazel b/mod/v8-14.6.202.11/MODULE.bazel
 -
 -    return cc_common.create_cc_toolchain_config_info(
 -        ctx = ctx,
+-        toolchain_identifier = "local_clang",
 -        features = features,
 -        cxx_builtin_include_directories = [
 -            "{WORKSPACE_ROOT}/buildtools/third_party/libc++",
@@ -169,7 +171,6 @@ diff --git a/orig/v8-14.6.202.11/MODULE.bazel b/mod/v8-14.6.202.11/MODULE.bazel
 -            "{WORKSPACE_ROOT}/build/linux/debian_bullseye_amd64-sysroot/usr/include",
 -            "{WORKSPACE_ROOT}/build/linux/debian_bullseye_amd64-sysroot/usr/local/include",
 -        ],
--        toolchain_identifier = "local_clang",
 -        host_system_name = "local",
 -        target_system_name = "local",
 -        target_cpu = "k8",
@@ -187,6 +188,7 @@ diff --git a/orig/v8-14.6.202.11/MODULE.bazel b/mod/v8-14.6.202.11/MODULE.bazel
 -)
 -""",
 -    build_file_content = """
+-load("@rules_cc//cc:defs.bzl", "cc_toolchain")
 -load(":cc_toolchain_config.bzl", "cc_toolchain_config")
 -
 -package(default_visibility = ["//visibility:public"])
@@ -238,6 +240,12 @@ diff --git a/orig/v8-14.6.202.11/MODULE.bazel b/mod/v8-14.6.202.11/MODULE.bazel
 -libcxx_repository(
 -    name = "libcxx",
 -)
+-
+-single_version_override(
+-    module_name = "highway",
+-    patches = ["//bazel/patches:highway_rules_cc.patch"],
+-    patch_strip = 1,
+-)
 diff --git a/orig/v8-14.6.202.11/bazel/highway.patch b/mod/v8-14.6.202.11/bazel/highway.patch
 new file mode 100644
 --- /dev/null

third_party/v8/BUILD.bazel

@@ -22,57 +22,34 @@ config_setting(
     ],
 )
 
-alias(
-    name = "v8_146_4_0_x86_64_apple_darwin",
-    actual = "@rusty_v8_146_4_0_x86_64_apple_darwin_archive//file",
+config_setting(
+    name = "use_rusty_v8_custom_libcxx",
+    flag_values = {
+        "@v8//:v8_use_rusty_v8_custom_libcxx": "True",
+    },
 )
 
 alias(
-    name = "v8_146_4_0_aarch64_apple_darwin",
-    actual = "@rusty_v8_146_4_0_aarch64_apple_darwin_archive//file",
+    name = "v8_147_4_0_x86_64_pc_windows_msvc",
+    actual = "@rusty_v8_147_4_0_x86_64_pc_windows_msvc_archive//file",
 )
 
 alias(
-    name = "v8_146_4_0_x86_64_unknown_linux_gnu",
-    actual = "@rusty_v8_146_4_0_x86_64_unknown_linux_gnu_archive//file",
+    name = "v8_147_4_0_aarch64_pc_windows_msvc",
+    actual = "@rusty_v8_147_4_0_aarch64_pc_windows_msvc_archive//file",
 )
 
 alias(
-    name = "v8_146_4_0_aarch64_unknown_linux_gnu",
-    actual = "@rusty_v8_146_4_0_aarch64_unknown_linux_gnu_archive//file",
-)
-
-alias(
-    name = "v8_146_4_0_x86_64_unknown_linux_musl",
-    actual = "@rusty_v8_146_4_0_x86_64_unknown_linux_musl_archive//file",
-)
-
-alias(
-    name = "v8_146_4_0_aarch64_unknown_linux_musl",
-    actual = "@rusty_v8_146_4_0_aarch64_unknown_linux_musl_archive//file",
-)
-
-alias(
-    name = "v8_146_4_0_x86_64_pc_windows_msvc",
-    actual = "@rusty_v8_146_4_0_x86_64_pc_windows_msvc_archive//file",
-)
-
-alias(
-    name = "v8_146_4_0_aarch64_pc_windows_msvc",
-    actual = "@rusty_v8_146_4_0_aarch64_pc_windows_msvc_archive//file",
-)
-
-alias(
-    name = "v8_146_4_0_aarch64_pc_windows_gnullvm",
+    name = "v8_147_4_0_aarch64_pc_windows_gnullvm",
     # `rusty_v8` only ships prebuilt Windows archives for MSVC. Build the
     # GNU-flavored archive in-tree so windows-gnullvm consumers can link
     # against a matching ABI instead of trying to reuse the MSVC release.
-    actual = ":v8_146_4_0_aarch64_pc_windows_gnullvm_bazel",
+    actual = ":v8_147_4_0_aarch64_pc_windows_gnullvm_bazel",
 )
 
 alias(
-    name = "v8_146_4_0_x86_64_pc_windows_gnullvm",
-    actual = ":v8_146_4_0_x86_64_pc_windows_gnullvm_bazel",
+    name = "v8_147_4_0_x86_64_pc_windows_gnullvm",
+    actual = ":v8_147_4_0_x86_64_pc_windows_gnullvm_bazel",
 )
 
 filegroup(
@@ -96,80 +73,94 @@ filegroup(
 )
 
 alias(
-    name = "src_binding_release_x86_64_unknown_linux_musl",
-    actual = "@rusty_v8_146_4_0_x86_64_unknown_linux_musl_binding//file",
-)
-
-alias(
-    name = "src_binding_release_aarch64_unknown_linux_musl",
-    actual = "@rusty_v8_146_4_0_aarch64_unknown_linux_musl_binding//file",
-)
-
-filegroup(
-    name = "src_binding_release_x86_64_pc_windows_msvc",
-    srcs = ["@v8_crate_146_4_0//:src_binding_release_x86_64_pc_windows_msvc"],
-)
-
-filegroup(
-    name = "src_binding_release_aarch64_pc_windows_msvc",
-    srcs = ["@v8_crate_146_4_0//:src_binding_release_aarch64_pc_windows_msvc"],
-)
-
-alias(
-    name = "src_binding_release_x86_64_pc_windows_gnullvm",
+    name = "src_binding_release_x86_64_pc_windows_gnullvm_147_4_0_release",
     # `rusty_v8` does not publish a Windows GNU binding file. The generated
     # binding only describes this V8 release's C++ API surface, so reuse the
     # Linux release binding while the windows-gnullvm archive build is still
     # experimental.
-    actual = ":src_binding_release_x86_64_unknown_linux_gnu",
+    actual = ":src_binding_release_x86_64_unknown_linux_gnu_147_4_0_release",
 )
 
 alias(
-    name = "src_binding_release_aarch64_pc_windows_gnullvm",
-    actual = ":src_binding_release_aarch64_unknown_linux_gnu",
+    name = "src_binding_release_aarch64_pc_windows_gnullvm_147_4_0_release",
+    actual = ":src_binding_release_aarch64_unknown_linux_gnu_147_4_0_release",
 )
 
 alias(
     name = "rusty_v8_archive_for_target",
     actual = select({
-        "@rules_rs//rs/experimental/platforms/config:aarch64-apple-darwin": ":v8_146_4_0_aarch64_apple_darwin_bazel",
-        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-gnullvm": ":v8_146_4_0_aarch64_pc_windows_gnullvm",
-        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-msvc": ":v8_146_4_0_aarch64_pc_windows_msvc",
-        "@rules_rs//rs/experimental/platforms/config:aarch64-unknown-linux-gnu": ":v8_146_4_0_aarch64_unknown_linux_gnu_bazel",
-        ":platform_aarch64_unknown_linux_musl": ":v8_146_4_0_aarch64_unknown_linux_musl_release_base",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-apple-darwin": ":v8_146_4_0_x86_64_apple_darwin_bazel",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-gnullvm": ":v8_146_4_0_x86_64_pc_windows_gnullvm",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-msvc": ":v8_146_4_0_x86_64_pc_windows_msvc",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-unknown-linux-gnu": ":v8_146_4_0_x86_64_unknown_linux_gnu_bazel",
-        ":platform_x86_64_unknown_linux_musl": ":v8_146_4_0_x86_64_unknown_linux_musl_release",
-        "//conditions:default": ":v8_146_4_0_x86_64_unknown_linux_gnu_bazel",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-apple-darwin": ":v8_147_4_0_aarch64_apple_darwin_bazel",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-gnullvm": ":v8_147_4_0_aarch64_pc_windows_gnullvm",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-msvc": ":v8_147_4_0_aarch64_pc_windows_msvc",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-unknown-linux-gnu": ":v8_147_4_0_aarch64_unknown_linux_gnu_bazel",
+        ":platform_aarch64_unknown_linux_musl": ":v8_147_4_0_aarch64_unknown_linux_musl_release_base",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-apple-darwin": ":v8_147_4_0_x86_64_apple_darwin_bazel",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-gnullvm": ":v8_147_4_0_x86_64_pc_windows_gnullvm",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-msvc": ":v8_147_4_0_x86_64_pc_windows_msvc",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-unknown-linux-gnu": ":v8_147_4_0_x86_64_unknown_linux_gnu_bazel",
+        ":platform_x86_64_unknown_linux_musl": ":v8_147_4_0_x86_64_unknown_linux_musl_release",
+        "//conditions:default": ":v8_147_4_0_x86_64_unknown_linux_gnu_bazel",
     }),
 )
 
 alias(
     name = "rusty_v8_binding_for_target",
     actual = select({
-        "@rules_rs//rs/experimental/platforms/config:aarch64-apple-darwin": ":src_binding_release_aarch64_apple_darwin",
-        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-gnullvm": ":src_binding_release_aarch64_pc_windows_gnullvm",
-        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-msvc": ":src_binding_release_aarch64_pc_windows_msvc",
-        "@rules_rs//rs/experimental/platforms/config:aarch64-unknown-linux-gnu": ":src_binding_release_aarch64_unknown_linux_gnu",
-        ":platform_aarch64_unknown_linux_musl": ":src_binding_release_aarch64_unknown_linux_musl",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-apple-darwin": ":src_binding_release_x86_64_apple_darwin",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-gnullvm": ":src_binding_release_x86_64_pc_windows_gnullvm",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-msvc": ":src_binding_release_x86_64_pc_windows_msvc",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-unknown-linux-gnu": ":src_binding_release_x86_64_unknown_linux_gnu",
-        ":platform_x86_64_unknown_linux_musl": ":src_binding_release_x86_64_unknown_linux_musl",
-        "//conditions:default": ":src_binding_release_x86_64_unknown_linux_gnu",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-apple-darwin": ":src_binding_release_aarch64_apple_darwin_147_4_0_release",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-gnullvm": ":src_binding_release_aarch64_pc_windows_gnullvm_147_4_0_release",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-msvc": ":src_binding_release_aarch64_pc_windows_msvc_147_4_0_release",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-unknown-linux-gnu": ":src_binding_release_aarch64_unknown_linux_gnu_147_4_0_release",
+        ":platform_aarch64_unknown_linux_musl": ":src_binding_release_aarch64_unknown_linux_musl_147_4_0_release",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-apple-darwin": ":src_binding_release_x86_64_apple_darwin_147_4_0_release",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-gnullvm": ":src_binding_release_x86_64_pc_windows_gnullvm_147_4_0_release",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-msvc": ":src_binding_release_x86_64_pc_windows_msvc_147_4_0_release",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-unknown-linux-gnu": ":src_binding_release_x86_64_unknown_linux_gnu_147_4_0_release",
+        ":platform_x86_64_unknown_linux_musl": ":src_binding_release_x86_64_unknown_linux_musl_147_4_0_release",
+        "//conditions:default": ":src_binding_release_x86_64_unknown_linux_gnu_147_4_0_release",
     }),
 )
 
 V8_COPTS = ["-std=c++20"]
 
+V8_CUSTOM_LIBCXX_COPTS = select({
+    ":use_rusty_v8_custom_libcxx": [
+        "-nostdinc++",
+        "-D_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
+        "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE",
+        "-D_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
+        "-D_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
+    ],
+    "//conditions:default": [],
+})
+
 V8_STATIC_LIBRARY_FEATURES = [
     "-symbol_check",
     "-validate-static-library",
 ]
 
+cc_library(
+    name = "rusty_v8_custom_libcxx_headers",
+    defines = select({
+        ":platform_aarch64_unknown_linux_musl": ["ANDROID_HOST_MUSL"],
+        ":platform_x86_64_unknown_linux_musl": ["ANDROID_HOST_MUSL"],
+        "//conditions:default": [],
+    }),
+    deps = [
+        "@rusty_v8_libcxx//:headers",
+        "@rusty_v8_libcxxabi//:headers",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+cc_library(
+    name = "rusty_v8_custom_libcxx_runtime",
+    deps = [
+        "@rusty_v8_libcxx//:libcxx",
+        "@rusty_v8_libcxxabi//:libcxxabi",
+    ],
+    visibility = ["//visibility:public"],
+)
+
 genrule(
     name = "binding_cc",
     srcs = ["@v8_crate_146_4_0//:binding_cc"],
@@ -210,6 +201,65 @@ cc_library(
     ],
 )
 
+genrule(
+    name = "binding_cc_147_4_0",
+    srcs = ["@v8_crate_147_4_0//:binding_cc"],
+    outs = ["binding_147_4_0.cc"],
+    cmd = " ".join([
+        "sed",
+        "-e '/#include \"v8\\/src\\/flags\\/flags.h\"/d'",
+        "-e 's|\"v8/src/libplatform/default-platform.h\"|\"src/libplatform/default-platform.h\"|'",
+        "-e 's|#include \"support.h\"|#include \"support_147_4_0.h\"|'",
+        "-e 's|  namespace i = v8::internal;|  (void)usage;|'",
+        "-e '/using HelpOptions = i::FlagList::HelpOptions;/d'",
+        "-e '/HelpOptions help_options = HelpOptions(HelpOptions::kExit, usage);/d'",
+        "-e 's|  i::FlagList::SetFlagsFromCommandLine(argc, argv, true, help_options);|  v8::V8::SetFlagsFromCommandLine(argc, argv, true);|'",
+        "$(location @v8_crate_147_4_0//:binding_cc)",
+        ">",
+        '"$@"',
+    ]),
+)
+
+genrule(
+    name = "crdtp_binding_cc_147_4_0",
+    srcs = ["@v8_crate_147_4_0//:crdtp_binding_cc"],
+    outs = ["crdtp_binding_147_4_0.cc"],
+    cmd = " ".join([
+        "sed",
+        "-e 's|#include \"support.h\"|#include \"support_147_4_0.h\"|'",
+        "-e 's|\"v8/third_party/inspector_protocol/|\"third_party/inspector_protocol/|g'",
+        "$(location @v8_crate_147_4_0//:crdtp_binding_cc)",
+        ">",
+        '"$@"',
+    ]),
+)
+
+copy_file(
+    name = "support_h_147_4_0",
+    src = "@v8_crate_147_4_0//:support_h",
+    out = "support_147_4_0.h",
+)
+
+cc_library(
+    name = "v8_147_4_0_binding",
+    srcs = [
+        ":binding_cc_147_4_0",
+        ":crdtp_binding_cc_147_4_0",
+    ],
+    hdrs = [":support_h_147_4_0"],
+    copts = V8_COPTS + V8_CUSTOM_LIBCXX_COPTS,
+    deps = [
+        "@v8//:core_lib_icu",
+        "@v8//:rusty_v8_crdtp_headers",
+        "@v8//:rusty_v8_internal_headers",
+    ] + select({
+        ":use_rusty_v8_custom_libcxx": [
+            ":rusty_v8_custom_libcxx_headers",
+        ],
+        "//conditions:default": [],
+    }),
+)
+
 cc_static_library(
     name = "v8_146_4_0_aarch64_apple_darwin_bazel",
     deps = [":v8_146_4_0_binding"],
@@ -292,66 +342,244 @@ filegroup(
     srcs = ["@v8_crate_146_4_0//:src_binding_release_x86_64_unknown_linux_gnu"],
 )
 
+cc_static_library(
+    name = "v8_147_4_0_aarch64_apple_darwin_bazel",
+    deps = [
+        ":rusty_v8_custom_libcxx_runtime",
+        ":v8_147_4_0_binding",
+    ],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_aarch64_unknown_linux_gnu_bazel",
+    deps = [
+        ":rusty_v8_custom_libcxx_runtime",
+        ":v8_147_4_0_binding",
+    ],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_aarch64_pc_windows_gnullvm_bazel",
+    deps = [":v8_147_4_0_binding"],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_aarch64_unknown_linux_musl_release_base",
+    deps = [
+        ":rusty_v8_custom_libcxx_runtime",
+        ":v8_147_4_0_binding",
+    ],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+genrule(
+    name = "v8_147_4_0_aarch64_unknown_linux_musl_release",
+    srcs = [
+        ":v8_147_4_0_aarch64_unknown_linux_musl_release_base",
+        "@llvm//runtimes/compiler-rt:clang_rt.builtins.static",
+    ],
+    tools = [
+        "@llvm//tools:llvm-ar",
+        "@llvm//tools:llvm-ranlib",
+    ],
+    outs = ["libv8_147_4_0_aarch64_unknown_linux_musl.a"],
+    cmd = """
+      cat > "$(@D)/merge.mri" <<'EOF'
+create $@
+addlib $(location :v8_147_4_0_aarch64_unknown_linux_musl_release_base)
+addlib $(location @llvm//runtimes/compiler-rt:clang_rt.builtins.static)
+save
+end
+EOF
+      $(location @llvm//tools:llvm-ar) -M < "$(@D)/merge.mri"
+      $(location @llvm//tools:llvm-ranlib) "$@"
+    """,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_x86_64_apple_darwin_bazel",
+    deps = [
+        ":rusty_v8_custom_libcxx_runtime",
+        ":v8_147_4_0_binding",
+    ],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_x86_64_unknown_linux_gnu_bazel",
+    deps = [
+        ":rusty_v8_custom_libcxx_runtime",
+        ":v8_147_4_0_binding",
+    ],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_x86_64_pc_windows_gnullvm_bazel",
+    deps = [":v8_147_4_0_binding"],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_x86_64_unknown_linux_musl_release",
+    deps = [
+        ":rusty_v8_custom_libcxx_runtime",
+        ":v8_147_4_0_binding",
+    ],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_apple_darwin_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_aarch64_apple_darwin"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_apple_darwin_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_x86_64_apple_darwin"],
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_unknown_linux_gnu_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_aarch64_unknown_linux_gnu"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_unknown_linux_gnu_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_x86_64_unknown_linux_gnu"],
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_unknown_linux_musl_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_aarch64_unknown_linux_gnu"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_unknown_linux_musl_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_x86_64_unknown_linux_gnu"],
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_pc_windows_msvc_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_aarch64_pc_windows_msvc"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_pc_windows_msvc_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_x86_64_pc_windows_msvc"],
+)
+
 filegroup(
     name = "rusty_v8_release_pair_x86_64_apple_darwin",
     srcs = [
-        ":v8_146_4_0_x86_64_apple_darwin",
-        ":src_binding_release_x86_64_apple_darwin",
+        ":v8_147_4_0_x86_64_apple_darwin_bazel",
+        ":src_binding_release_x86_64_apple_darwin_147_4_0_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_aarch64_apple_darwin",
     srcs = [
-        ":v8_146_4_0_aarch64_apple_darwin",
-        ":src_binding_release_aarch64_apple_darwin",
+        ":v8_147_4_0_aarch64_apple_darwin_bazel",
+        ":src_binding_release_aarch64_apple_darwin_147_4_0_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_x86_64_unknown_linux_gnu",
     srcs = [
-        ":v8_146_4_0_x86_64_unknown_linux_gnu",
-        ":src_binding_release_x86_64_unknown_linux_gnu",
+        ":v8_147_4_0_x86_64_unknown_linux_gnu_bazel",
+        ":src_binding_release_x86_64_unknown_linux_gnu_147_4_0_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_aarch64_unknown_linux_gnu",
     srcs = [
-        ":v8_146_4_0_aarch64_unknown_linux_gnu",
-        ":src_binding_release_aarch64_unknown_linux_gnu",
+        ":v8_147_4_0_aarch64_unknown_linux_gnu_bazel",
+        ":src_binding_release_aarch64_unknown_linux_gnu_147_4_0_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_x86_64_unknown_linux_musl",
     srcs = [
-        ":v8_146_4_0_x86_64_unknown_linux_musl_release",
-        ":src_binding_release_x86_64_unknown_linux_musl_release",
+        ":v8_147_4_0_x86_64_unknown_linux_musl_release",
+        ":src_binding_release_x86_64_unknown_linux_musl_147_4_0_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_aarch64_unknown_linux_musl",
     srcs = [
-        ":v8_146_4_0_aarch64_unknown_linux_musl_release",
-        ":src_binding_release_aarch64_unknown_linux_musl_release",
+        ":v8_147_4_0_aarch64_unknown_linux_musl_release",
+        ":src_binding_release_aarch64_unknown_linux_musl_147_4_0_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_x86_64_pc_windows_msvc",
     srcs = [
-        ":v8_146_4_0_x86_64_pc_windows_msvc",
-        ":src_binding_release_x86_64_pc_windows_msvc",
+        ":v8_147_4_0_x86_64_pc_windows_msvc",
+        ":src_binding_release_x86_64_pc_windows_msvc_147_4_0_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_aarch64_pc_windows_msvc",
     srcs = [
-        ":v8_146_4_0_aarch64_pc_windows_msvc",
-        ":src_binding_release_aarch64_pc_windows_msvc",
+        ":v8_147_4_0_aarch64_pc_windows_msvc",
+        ":src_binding_release_aarch64_pc_windows_msvc_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_x86_64_apple_darwin",
+    srcs = [
+        ":v8_147_4_0_x86_64_apple_darwin_bazel",
+        ":src_binding_release_x86_64_apple_darwin_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_aarch64_apple_darwin",
+    srcs = [
+        ":v8_147_4_0_aarch64_apple_darwin_bazel",
+        ":src_binding_release_aarch64_apple_darwin_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_x86_64_unknown_linux_gnu",
+    srcs = [
+        ":v8_147_4_0_x86_64_unknown_linux_gnu_bazel",
+        ":src_binding_release_x86_64_unknown_linux_gnu_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_aarch64_unknown_linux_gnu",
+    srcs = [
+        ":v8_147_4_0_aarch64_unknown_linux_gnu_bazel",
+        ":src_binding_release_aarch64_unknown_linux_gnu_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_x86_64_unknown_linux_musl",
+    srcs = [
+        ":v8_147_4_0_x86_64_unknown_linux_musl_release",
+        ":src_binding_release_x86_64_unknown_linux_musl_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_aarch64_unknown_linux_musl",
+    srcs = [
+        ":v8_147_4_0_aarch64_unknown_linux_musl_release",
+        ":src_binding_release_aarch64_unknown_linux_musl_147_4_0_release",
     ],
 )

third_party/v8/README.md

@@ -20,27 +20,39 @@ artifact contract.
 
 Current pinned versions:
 
-- Rust crate: `v8 = =146.4.0`
-- Embedded upstream V8 source for musl release builds: `14.6.202.9`
+- Rust crate: `v8 = =147.4.0`
+- Embedded upstream V8 source for Bazel-produced release builds: `14.9.207.2`
 
-When bumping the Rust crate version, keep the checked-in checksum manifest and
-`MODULE.bazel` in sync:
+## Updating to a new `v8` release
+
+Use this as the maintainer flow for a version bump:
+
+1. Bump the `v8` crate version and refresh `codex-rs/Cargo.lock`.
+2. Update the Bazel versioned inputs in `MODULE.bazel`, then refresh the
+   matching checksum manifest and generated checksums as described below.
+3. Publish a release-candidate PR and validate that `v8-canary` passes.
+4. If the canary is green, publish the release tag and release build.
+5. Once the release build completes, rerun the build on the candidate branch
+   and verify that the final artifact builds and tests pass.
+
+When changing the remaining prebuilt `rusty_v8` `http_file` inputs, keep the
+checked-in checksum manifest and `MODULE.bazel` in sync:
 
 ```bash
 python3 .github/scripts/rusty_v8_bazel.py update-module-bazel
 python3 .github/scripts/rusty_v8_bazel.py check-module-bazel
 ```
 
-The commands read `third_party/v8/rusty_v8_<crate_version>.sha256` by default
-and validate every matching `rusty_v8_<crate_version>` `http_file` entry.
-CI runs the check command to block checksum drift.
+The commands default to the single `rusty_v8_*` `http_file` version still
+present in `MODULE.bazel` and validate every matching entry. CI runs the check
+command to block checksum drift.
 
 The consumer-facing selectors are:
 
 - `//third_party/v8:rusty_v8_archive_for_target`
 - `//third_party/v8:rusty_v8_binding_for_target`
 
-Musl release assets are expected at the tag:
+Published release assets are expected at the tag:
 
 - `rusty-v8-v<crate_version>`
 
@@ -49,13 +61,45 @@ with these raw asset names:
 - `librusty_v8_release_<target>.a.gz`
 - `src_binding_release_<target>.rs`
 
-The dedicated publishing workflow is `.github/workflows/rusty-v8-release.yml`.
-It builds musl release pairs from source and keeps the release artifacts as the
-statically linked form:
+During the sandbox rollout, sandbox-enabled assets are published alongside those
+current assets on the same tag, with the Rust crate's sandbox feature suffix in
+their raw names:
 
+- `librusty_v8_ptrcomp_sandbox_release_<target>.a.gz`
+- `src_binding_ptrcomp_sandbox_release_<target>.rs`
+
+The dedicated publishing workflow is `.github/workflows/rusty-v8-release.yml`.
+Tagged runs build release artifacts from the Bazel graph itself:
+
+- `//third_party/v8:rusty_v8_release_pair_x86_64_apple_darwin`
+- `//third_party/v8:rusty_v8_release_pair_aarch64_apple_darwin`
+- `//third_party/v8:rusty_v8_release_pair_x86_64_unknown_linux_gnu`
+- `//third_party/v8:rusty_v8_release_pair_aarch64_unknown_linux_gnu`
 - `//third_party/v8:rusty_v8_release_pair_x86_64_unknown_linux_musl`
 - `//third_party/v8:rusty_v8_release_pair_aarch64_unknown_linux_musl`
 
+The same run also builds the matching sandbox pair targets:
+
+- `//third_party/v8:rusty_v8_sandbox_release_pair_x86_64_apple_darwin`
+- `//third_party/v8:rusty_v8_sandbox_release_pair_aarch64_apple_darwin`
+- `//third_party/v8:rusty_v8_sandbox_release_pair_x86_64_unknown_linux_gnu`
+- `//third_party/v8:rusty_v8_sandbox_release_pair_aarch64_unknown_linux_gnu`
+- `//third_party/v8:rusty_v8_sandbox_release_pair_x86_64_unknown_linux_musl`
+- `//third_party/v8:rusty_v8_sandbox_release_pair_aarch64_unknown_linux_musl`
+
+The Bazel graph pins the same libc++, libc++abi, and llvm-libc source revisions
+used by the currently tracked `rusty_v8` source revision, compiles published
+artifact targets with `--config=rusty-v8-upstream-libcxx`, and folds the matching
+runtime objects into the final static archive so Cargo consumers can link it
+with the `v8` crate's default `use_custom_libcxx` feature. The config keeps the
+object files and the bundled runtime on Chromium's `std::__Cr` ABI namespace
+instead of mixing those objects with the toolchain libc++ default namespace.
+
+MSVC is not part of the Bazel-produced matrix yet. The repository's current
+hermetic Windows C++ platform is `windows-gnullvm`/`x86_64-w64-windows-gnu`, so
+it cannot truthfully reproduce upstream's `*-pc-windows-msvc` archives until we
+add a real MSVC-targeting C++ toolchain to the Bazel graph.
+
 Cargo musl builds use `RUSTY_V8_ARCHIVE` plus a downloaded
 `RUSTY_V8_SRC_BINDING_PATH` to point at those `openai/codex` release assets
 directly. We do not use `RUSTY_V8_MIRROR` for musl because the upstream `v8`

third_party/v8/libcxx.BUILD.bazel

@@ -0,0 +1,157 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+load("@llvm//toolchain/runtimes:cc_runtime_library.bzl", "cc_runtime_stage0_library")
+
+package(default_visibility = ["//visibility:public"])
+
+config_setting(
+    name = "is_linux",
+    constraint_values = ["@platforms//os:linux"],
+)
+
+config_setting(
+    name = "is_windows",
+    constraint_values = ["@platforms//os:windows"],
+)
+
+LIBCXX_SRCS = [
+    "src/algorithm.cpp",
+    "src/any.cpp",
+    "src/atomic.cpp",
+    "src/barrier.cpp",
+    "src/bind.cpp",
+    "src/call_once.cpp",
+    "src/charconv.cpp",
+    "src/chrono.cpp",
+    "src/condition_variable.cpp",
+    "src/condition_variable_destructor.cpp",
+    "src/error_category.cpp",
+    "src/exception.cpp",
+    "src/filesystem/directory_iterator.cpp",
+    "src/filesystem/filesystem_error.cpp",
+    "src/filesystem/operations.cpp",
+    "src/filesystem/path.cpp",
+    "src/functional.cpp",
+    "src/future.cpp",
+    "src/hash.cpp",
+    "src/ios.cpp",
+    "src/ios.instantiations.cpp",
+    "src/iostream.cpp",
+    "src/locale.cpp",
+    "src/memory.cpp",
+    "src/mutex.cpp",
+    "src/mutex_destructor.cpp",
+    "src/new.cpp",
+    "src/new_handler.cpp",
+    "src/new_helpers.cpp",
+    "src/optional.cpp",
+    "src/random.cpp",
+    "src/random_shuffle.cpp",
+    "src/regex.cpp",
+    "src/ryu/d2fixed.cpp",
+    "src/ryu/d2s.cpp",
+    "src/ryu/f2s.cpp",
+    "src/shared_mutex.cpp",
+    "src/stdexcept.cpp",
+    "src/string.cpp",
+    "src/strstream.cpp",
+    "src/system_error.cpp",
+    "src/thread.cpp",
+    "src/typeinfo.cpp",
+    "src/valarray.cpp",
+    "src/variant.cpp",
+    "src/vector.cpp",
+    "src/verbose_abort.cpp",
+]
+
+cc_library(
+    name = "headers",
+    hdrs = glob(["include/**"]),
+    strip_include_prefix = "include",
+    deps = ["@//third_party/v8/libcxx_config:headers"],
+)
+
+cc_library(
+    name = "internal_headers",
+    hdrs = glob([
+        "src/**/*.h",
+        "src/**/*.ipp",
+    ]),
+    includes = ["src"],
+)
+
+cc_runtime_stage0_library(
+    name = "libcxx",
+    srcs = LIBCXX_SRCS + select({
+        ":is_linux": [
+            "src/filesystem/directory_entry.cpp",
+            "src/filesystem/filesystem_clock.cpp",
+        ],
+        "//conditions:default": [],
+    }) + select({
+        ":is_windows": [
+            "src/support/win32/locale_win32.cpp",
+            "src/support/win32/support.cpp",
+            "src/support/win32/thread_win32.cpp",
+        ],
+        "//conditions:default": [],
+    }),
+    copts = [
+        "-fexceptions",
+        "-frtti",
+        "-fstrict-aliasing",
+        "-fvisibility=hidden",
+        "-fvisibility-inlines-hidden",
+        "-nostdinc++",
+        "-std=c++23",
+        "-Wno-nullability-completeness",
+        "-Wno-unused-parameter",
+        "-Wundef",
+    ] + select({
+        ":is_windows": ["-Wno-macro-redefined"],
+        "//conditions:default": ["-fPIC"],
+    }),
+    defines = [
+        "CR_LIBCXX_REVISION=99457fa555797f8c5ac3c076ca288d8481d3b23a",
+        "LIBCXX_BUILDING_LIBCXXABI",
+        "LIBC_NAMESPACE=__llvm_libc_cr",
+        "_LIBCPP_BUILDING_LIBRARY",
+        "_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
+        "_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE",
+        "_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
+        "_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
+    ] + select({
+        "@llvm//platforms/config:musl": [
+            # Chromium's checked-in __config_site uses this switch to enable
+            # libc++'s musl-specific configuration.
+            "ANDROID_HOST_MUSL",
+        ],
+        "//conditions:default": [],
+    }) + select({
+        ":is_windows": [
+            "NTDDI_VERSION=NTDDI_WIN7",
+            "WINVER=_WIN32_WINNT_WIN7",
+            "_WIN32_WINNT=_WIN32_WINNT_WIN7",
+        ],
+        "//conditions:default": [],
+    }),
+    includes = ["src"],
+    implementation_deps = [
+        ":headers",
+        ":internal_headers",
+        "@rusty_v8_libcxxabi//:headers",
+        "@rusty_v8_llvm_libc//:headers",
+    ] + select({
+        ":is_linux": [
+            "@@llvm++kernel_headers+kernel_headers//:kernel_headers",
+        ],
+        "//conditions:default": [],
+    }) + select({
+        "@llvm//platforms/config:gnu": [
+            "@@llvm++glibc+glibc//:gnu_libc_headers",
+        ],
+        "@llvm//platforms/config:musl": [
+            "@@llvm++musl+musl_libc//:musl_libc_headers",
+        ],
+        "//conditions:default": [],
+    }),
+)

third_party/v8/libcxx_config/BUILD.bazel

@@ -0,0 +1,12 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cc_library(
+    name = "headers",
+    hdrs = [
+        "__assertion_handler",
+        "__config_site",
+    ],
+    includes = ["."],
+)

third_party/v8/libcxx_config/__assertion_handler

@@ -0,0 +1,27 @@
+// -*- C++ -*-
+
+#ifndef _LIBCPP___ASSERTION_HANDLER
+#define _LIBCPP___ASSERTION_HANDLER
+
+#include <__config>
+#include <__verbose_abort>
+
+#if !defined(_LIBCPP_HAS_NO_PRAGMA_SYSTEM_HEADER)
+#pragma GCC system_header
+#endif
+
+#if defined(OFFICIAL_BUILD) && !defined(DCHECK_ALWAYS_ON)
+
+[[noreturn]] inline _LIBCPP_HIDE_FROM_ABI void __libcpp_hardening_failure() {
+  __builtin_trap();
+}
+
+#define _LIBCPP_ASSERTION_HANDLER(message) ((void)message, __libcpp_hardening_failure())
+
+#else
+
+#define _LIBCPP_ASSERTION_HANDLER(message) _LIBCPP_VERBOSE_ABORT("%s", message)
+
+#endif
+
+#endif  // _LIBCPP___ASSERTION_HANDLER

third_party/v8/libcxx_config/__config_site

@@ -0,0 +1,55 @@
+#ifndef _LIBCPP_CONFIG_SITE
+#define _LIBCPP_CONFIG_SITE
+
+#define _LIBCPP_ABI_NAMESPACE __Cr
+#define _LIBCPP_ABI_VERSION 2
+
+#define _LIBCPP_ABI_FORCE_ITANIUM 0
+#define _LIBCPP_ABI_FORCE_MICROSOFT 0
+#define _LIBCPP_HAS_THREADS 1
+#define _LIBCPP_HAS_MONOTONIC_CLOCK 1
+#define _LIBCPP_HAS_TERMINAL 1
+
+#ifdef ANDROID_HOST_MUSL
+#define _LIBCPP_HAS_MUSL_LIBC 1
+#else
+#define _LIBCPP_HAS_MUSL_LIBC 0
+#endif
+
+#ifdef _WIN32
+#define _LIBCPP_HAS_THREAD_API_PTHREAD 0
+#define _LIBCPP_HAS_THREAD_API_EXTERNAL 0
+#define _LIBCPP_HAS_THREAD_API_WIN32 1
+#else
+#define _LIBCPP_HAS_THREAD_API_PTHREAD 1
+#define _LIBCPP_HAS_THREAD_API_EXTERNAL 0
+#define _LIBCPP_HAS_THREAD_API_WIN32 0
+#endif
+
+#define _LIBCPP_HAS_VENDOR_AVAILABILITY_ANNOTATIONS 0
+#define _LIBCPP_HAS_FILESYSTEM 1
+#define _LIBCPP_HAS_RANDOM_DEVICE 1
+#define _LIBCPP_HAS_LOCALIZATION 1
+#define _LIBCPP_HAS_UNICODE 1
+#define _LIBCPP_HAS_WIDE_CHARACTERS 1
+#define _LIBCPP_HAS_TIME_ZONE_DATABASE 1
+
+#if defined(__APPLE__)
+#define _LIBCPP_PSTL_BACKEND_LIBDISPATCH
+#else
+#define _LIBCPP_PSTL_BACKEND_STD_THREAD
+#endif
+
+#define _LIBCPP_ASSERTION_SEMANTIC_DEFAULT \
+    _LIBCPP_ASSERTION_SEMANTIC_HARDENING_DEPENDENT
+
+#define _LIBCPP_LIBC_PICOLIBC 0
+#define _LIBCPP_LIBC_NEWLIB 0
+
+#define _LIBCPP_NO_AUTO_LINK
+#define _LIBCPP_REMOVE_TRANSITIVE_INCLUDES
+#define _LIBCPP_NO_ABI_TAG
+#define _LIBCPP_VERBOSE_ABORT(...) ::std::__libcpp_verbose_abort(__VA_ARGS__)
+#define _LIBCPP_HAS_NO_INCOMPLETE_PSTL
+
+#endif  // _LIBCPP_CONFIG_SITE

third_party/v8/libcxxabi.BUILD.bazel

@@ -0,0 +1,99 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+load("@llvm//toolchain/runtimes:cc_runtime_library.bzl", "cc_runtime_stage0_library")
+
+package(default_visibility = ["//visibility:public"])
+
+config_setting(
+    name = "is_linux",
+    constraint_values = ["@platforms//os:linux"],
+)
+
+config_setting(
+    name = "is_windows",
+    constraint_values = ["@platforms//os:windows"],
+)
+
+cc_library(
+    name = "headers",
+    hdrs = glob(["include/**"]),
+    strip_include_prefix = "include",
+)
+
+cc_runtime_stage0_library(
+    name = "libcxxabi",
+    srcs = [
+        "src/abort_message.cpp",
+        "src/cxa_aux_runtime.cpp",
+        "src/cxa_default_handlers.cpp",
+        "src/cxa_demangle.cpp",
+        "src/cxa_exception.cpp",
+        "src/cxa_exception_storage.cpp",
+        "src/cxa_guard.cpp",
+        "src/cxa_handlers.cpp",
+        "src/cxa_personality.cpp",
+        "src/cxa_vector.cpp",
+        "src/cxa_virtual.cpp",
+        "src/fallback_malloc.cpp",
+        "src/private_typeinfo.cpp",
+        "src/stdlib_exception.cpp",
+        "src/stdlib_stdexcept.cpp",
+        "src/stdlib_typeinfo.cpp",
+    ] + select({
+        ":is_linux": ["src/cxa_thread_atexit.cpp"],
+        "//conditions:default": [],
+    }),
+    textual_hdrs = glob([
+        "src/**/*.def",
+        "src/**/*.h",
+        "src/**/*.inc",
+    ]),
+    copts = [
+        "-fexceptions",
+        "-frtti",
+        "-fstrict-aliasing",
+        "-fvisibility=hidden",
+        "-fvisibility-inlines-hidden",
+        "-nostdinc++",
+        "-std=c++23",
+        "-Wno-nullability-completeness",
+        "-Wno-unused-parameter",
+        "-Wundef",
+    ] + select({
+        ":is_windows": ["-Wno-macro-redefined"],
+        "//conditions:default": ["-fPIC"],
+    }),
+    defines = [
+        "LIBCXXABI_SILENT_TERMINATE",
+        "_LIBCPP_CONSTINIT=__attribute__((__require_constant_initialization__))",
+        "_LIBCPP_BUILDING_LIBRARY",
+        "_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
+        "_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE",
+        "_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
+        "_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
+    ] + select({
+        "@llvm//platforms/config:musl": [
+            "ANDROID_HOST_MUSL",
+        ],
+        "//conditions:default": [],
+    }),
+    includes = ["src"],
+    implementation_deps = [
+        ":headers",
+        "@rusty_v8_libcxx//:headers",
+        "@rusty_v8_libcxx//:internal_headers",
+        "@//third_party/v8/libcxx_config:headers",
+    ] + select({
+        ":is_linux": [
+            "@@llvm++kernel_headers+kernel_headers//:kernel_headers",
+        ],
+        "//conditions:default": [],
+    }) + select({
+        "@llvm//platforms/config:gnu": [
+            "@@llvm++glibc+glibc//:gnu_libc_headers",
+        ],
+        "@llvm//platforms/config:musl": [
+            "@@llvm++musl+musl_libc//:musl_libc_headers",
+        ],
+        "//conditions:default": [],
+    }),
+)

third_party/v8/llvm_libc.BUILD.bazel

@@ -0,0 +1,10 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cc_library(
+    name = "headers",
+    hdrs = glob(["**/*.h"]),
+    defines = ["LIBC_NAMESPACE=__llvm_libc_cr"],
+    includes = ["."],
+)

third_party/v8/rusty_v8_146_4_0.sha256

@@ -1,10 +0,0 @@
-bfe2c9be32a56c28546f0f965825ee68fbf606405f310cc4e17b448a568cf98a  librusty_v8_release_aarch64-apple-darwin.a.gz
-dbf165b07c81bdb054bc046b43d23e69fcf7bcc1a4c1b5b4776983a71062ecd8  librusty_v8_release_aarch64-unknown-linux-gnu.a.gz
-ed13363659c6d08583ac8fdc40493445c5767d8b94955a4d5d7bb8d5a81f6bf8  rusty_v8_release_aarch64-pc-windows-msvc.lib.gz
-630cd240f1bbecdb071417dc18387ab81cf67c549c1c515a0b4fcf9eba647bb7  librusty_v8_release_x86_64-apple-darwin.a.gz
-e64b4d99e4ae293a2e846244a89b80178ba10382c13fb591c1fa6968f5291153  librusty_v8_release_x86_64-unknown-linux-gnu.a.gz
-90a9a2346acd3685a355e98df85c24dbe406cb124367d16259a4b5d522621862  rusty_v8_release_x86_64-pc-windows-msvc.lib.gz
-27a08ed26c34297bfd93e514692ccc44b85f8b15c6aa39cf34e784f84fb37e8e  librusty_v8_release_aarch64-unknown-linux-musl.a.gz
-09f8900ced8297c229246c7a50b2e0ec23c54d0a554f369619cc29863f38dd1a  src_binding_release_aarch64-unknown-linux-musl.rs
-20d8271ad712323d352c1383c36e3c4b755abc41ece35819c49c75ec7134d2f8  librusty_v8_release_x86_64-unknown-linux-musl.a.gz
-09f8900ced8297c229246c7a50b2e0ec23c54d0a554f369619cc29863f38dd1a  src_binding_release_x86_64-unknown-linux-musl.rs

third_party/v8/rusty_v8_147_4_0.sha256

@@ -0,0 +1,2 @@
+1fa3f94d9e09cff1f6bcce94c478e5cb072c0755f6a0357abadb9dd3b48d8127  rusty_v8_release_aarch64-pc-windows-msvc.lib.gz
+e2827ff98b1a9d4c0343000fc5124ac30dfab3007bc0129c168c9355fc2fcd7c  rusty_v8_release_x86_64-pc-windows-msvc.lib.gz

third_party/v8/v8_crate.BUILD.bazel

@@ -5,6 +5,11 @@ filegroup(
     srcs = ["src/binding.cc"],
 )
 
+filegroup(
+    name = "crdtp_binding_cc",
+    srcs = ["src/crdtp_binding.cc"],
+)
+
 filegroup(
     name = "support_h",
     srcs = ["src/support.h"],