ci: run Windows argument-comment-lint via native Bazel

.github/actions/setup-bazel-ci/action.yml

@@ -60,8 +60,63 @@ runs:
         # Use the shortest available drive to reduce argv/path length issues,
         # but avoid the drive root because some Windows test launchers mis-handle
         # MANIFEST paths there.
-        $bazelOutputUserRoot = if (Test-Path 'D:\') { 'D:\b' } else { 'C:\b' }
+        $hasDDrive = Test-Path 'D:\'
+        $bazelOutputUserRoot = if ($hasDDrive) { 'D:\b' } else { 'C:\b' }
+        $repoContentsCache = Join-Path $env:RUNNER_TEMP "bazel-repo-contents-cache-$env:GITHUB_RUN_ID-$env:GITHUB_JOB"
         "BAZEL_OUTPUT_USER_ROOT=$bazelOutputUserRoot" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        "BAZEL_REPO_CONTENTS_CACHE=$repoContentsCache" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        if (-not $hasDDrive) {
+          $repositoryCache = Join-Path $env:USERPROFILE '.cache\bazel-repo-cache'
+          "BAZEL_REPOSITORY_CACHE=$repositoryCache" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+        }
+
+    - name: Expose MSVC SDK environment (Windows)
+      if: runner.os == 'Windows'
+      shell: pwsh
+      run: |
+        $vswhere = "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe"
+        if (-not (Test-Path $vswhere)) {
+          throw "vswhere.exe not found"
+        }
+
+        $installPath = & $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath 2>$null
+        if (-not $installPath) {
+          throw "Could not locate a Visual Studio installation with VC tools"
+        }
+
+        $vsDevCmd = Join-Path $installPath 'Common7\Tools\VsDevCmd.bat'
+        if (-not (Test-Path $vsDevCmd)) {
+          throw "VsDevCmd.bat not found at $vsDevCmd"
+        }
+
+        $varsToExport = @(
+          'INCLUDE',
+          'LIB',
+          'LIBPATH',
+          'PATH',
+          'UCRTVersion',
+          'UniversalCRTSdkDir',
+          'VCINSTALLDIR',
+          'VCToolsInstallDir',
+          'WindowsLibPath',
+          'WindowsSdkBinPath',
+          'WindowsSdkDir',
+          'WindowsSDKLibVersion',
+          'WindowsSDKVersion'
+        )
+
+        $envLines = & cmd.exe /c ('"{0}" -no_logo -arch=x64 -host_arch=x64 >nul && set' -f $vsDevCmd)
+        foreach ($line in $envLines) {
+          if ($line -notmatch '^(.*?)=(.*)$') {
+            continue
+          }
+
+          $name = $matches[1]
+          $value = $matches[2]
+          if ($varsToExport -contains $name) {
+            "$name=$value" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          }
+        }
 
     - name: Enable Git long paths (Windows)
       if: runner.os == 'Windows'

.github/scripts/run-argument-comment-lint-bazel.sh

@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ci_config=ci-linux
+case "${RUNNER_OS:-}" in
+  macOS)
+    ci_config=ci-macos
+    ;;
+  Windows)
+    ci_config=ci-windows
+    ;;
+esac
+
+bazel_lint_args=("$@")
+if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+  has_host_platform_override=0
+  for arg in "${bazel_lint_args[@]}"; do
+    if [[ "$arg" == --host_platform=* ]]; then
+      has_host_platform_override=1
+      break
+    fi
+  done
+
+  if [[ $has_host_platform_override -eq 0 ]]; then
+    # The nightly Windows lint toolchain is registered with an MSVC exec
+    # platform even though the lint target platform stays on `windows-gnullvm`.
+    # Override the host platform here so the exec-side helper binaries actually
+    # match the registered toolchain set.
+    bazel_lint_args+=("--host_platform=//:local_windows_msvc")
+  fi
+
+  # Native Windows lint runs need exec-side Rust helper binaries and proc-macros
+  # to use rust-lld instead of the C++ linker path. The default `none`
+  # preference resolves to `cc` when a cc_toolchain is present, which currently
+  # routes these exec actions through clang++ with an argument shape it cannot
+  # consume.
+  bazel_lint_args+=("--@rules_rust//rust/settings:toolchain_linker_preference=rust")
+
+  # Some Rust top-level targets are still intentionally incompatible with the
+  # local Windows MSVC exec platform. Skip those explicit targets so the native
+  # lint aspect can run across the compatible crate graph instead of failing the
+  # whole build after analysis.
+  bazel_lint_args+=("--skip_incompatible_explicit_targets")
+fi
+
+bazel_startup_args=()
+if [[ -n "${BAZEL_OUTPUT_USER_ROOT:-}" ]]; then
+  bazel_startup_args+=("--output_user_root=${BAZEL_OUTPUT_USER_ROOT}")
+fi
+
+run_bazel() {
+  if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+    MSYS2_ARG_CONV_EXCL='*' bazel "$@"
+    return
+  fi
+
+  bazel "$@"
+}
+
+run_bazel_with_startup_args() {
+  if [[ ${#bazel_startup_args[@]} -gt 0 ]]; then
+    run_bazel "${bazel_startup_args[@]}" "$@"
+    return
+  fi
+
+  run_bazel "$@"
+}
+
+read_query_labels() {
+  local query="$1"
+  local query_stdout
+  local query_stderr
+  query_stdout="$(mktemp)"
+  query_stderr="$(mktemp)"
+
+  if ! run_bazel_with_startup_args \
+    --noexperimental_remote_repo_contents_cache \
+    query \
+    --keep_going \
+    --output=label \
+    "$query" >"$query_stdout" 2>"$query_stderr"; then
+    cat "$query_stderr" >&2
+    rm -f "$query_stdout" "$query_stderr"
+    exit 1
+  fi
+
+  cat "$query_stdout"
+  rm -f "$query_stdout" "$query_stderr"
+}
+
+final_build_targets=(//codex-rs/...)
+if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+  # Bazel's local Windows platform currently lacks a default test toolchain for
+  # `rust_test`, so target the concrete Rust crate rules directly. The lint
+  # aspect still walks their crate graph, which preserves incremental reuse for
+  # non-test code while avoiding non-Rust wrapper targets such as platform_data.
+  final_build_targets=()
+  while IFS= read -r label; do
+    [[ -n "$label" ]] || continue
+    final_build_targets+=("$label")
+  done < <(read_query_labels 'kind("rust_(library|binary|proc_macro) rule", //codex-rs/...)')
+
+  if [[ ${#final_build_targets[@]} -eq 0 ]]; then
+    echo "Failed to discover Windows Bazel lint targets." >&2
+    exit 1
+  fi
+fi
+
+./.github/scripts/run-bazel-ci.sh \
+  -- \
+  build \
+  "${bazel_lint_args[@]}" \
+  -- \
+  "${final_build_targets[@]}"

.github/scripts/run-bazel-ci.sh

@@ -41,6 +41,15 @@ if [[ -n "${BAZEL_OUTPUT_USER_ROOT:-}" ]]; then
   bazel_startup_args+=("--output_user_root=${BAZEL_OUTPUT_USER_ROOT}")
 fi
 
+run_bazel() {
+  if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+    MSYS2_ARG_CONV_EXCL='*' bazel "$@"
+    return
+  fi
+
+  bazel "$@"
+}
+
 ci_config=ci-linux
 case "${RUNNER_OS:-}" in
   macOS)
@@ -60,7 +69,7 @@ print_bazel_test_log_tails() {
     bazel_info_cmd+=("${bazel_startup_args[@]}")
   fi
 
-  testlogs_dir="$("${bazel_info_cmd[@]}" info bazel-testlogs 2>/dev/null || echo bazel-testlogs)"
+  testlogs_dir="$(run_bazel "${bazel_info_cmd[@]:1}" info bazel-testlogs 2>/dev/null || echo bazel-testlogs)"
 
   local failed_targets=()
   while IFS= read -r target; do
@@ -126,6 +135,41 @@ if [[ $remote_download_toplevel -eq 1 ]]; then
   post_config_bazel_args+=(--remote_download_toplevel)
 fi
 
+if [[ -n "${BAZEL_REPO_CONTENTS_CACHE:-}" ]]; then
+  # Windows self-hosted runners can run multiple Bazel jobs concurrently. Give
+  # each job its own repo contents cache so they do not fight over the shared
+  # path configured in `ci-windows`.
+  post_config_bazel_args+=("--repo_contents_cache=${BAZEL_REPO_CONTENTS_CACHE}")
+fi
+
+if [[ -n "${BAZEL_REPOSITORY_CACHE:-}" ]]; then
+  post_config_bazel_args+=("--repository_cache=${BAZEL_REPOSITORY_CACHE}")
+fi
+
+if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+  windows_action_env_vars=(
+    INCLUDE
+    LIB
+    LIBPATH
+    PATH
+    UCRTVersion
+    UniversalCRTSdkDir
+    VCINSTALLDIR
+    VCToolsInstallDir
+    WindowsLibPath
+    WindowsSdkBinPath
+    WindowsSdkDir
+    WindowsSDKLibVersion
+    WindowsSDKVersion
+  )
+
+  for env_var in "${windows_action_env_vars[@]}"; do
+    if [[ -n "${!env_var:-}" ]]; then
+      post_config_bazel_args+=("--action_env=${env_var}" "--host_action_env=${env_var}")
+    fi
+  done
+fi
+
 bazel_console_log="$(mktemp)"
 trap 'rm -f "$bazel_console_log"' EXIT
 
@@ -149,7 +193,7 @@ if [[ -n "${BUILDBUDDY_API_KEY:-}" ]]; then
     bazel_run_args+=("${post_config_bazel_args[@]}")
   fi
   set +e
-  "${bazel_cmd[@]}" \
+  run_bazel "${bazel_cmd[@]:1}" \
     --noexperimental_remote_repo_contents_cache \
     "${bazel_run_args[@]}" \
     -- \
@@ -184,7 +228,7 @@ else
     bazel_run_args+=("${post_config_bazel_args[@]}")
   fi
   set +e
-  "${bazel_cmd[@]}" \
+  run_bazel "${bazel_cmd[@]:1}" \
     --noexperimental_remote_repo_contents_cache \
     "${bazel_run_args[@]}" \
     -- \

.github/workflows/rust-ci-full.yml

@@ -99,35 +99,27 @@ jobs:
         run: |
           sudo DEBIAN_FRONTEND=noninteractive apt-get update
           sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
-      - name: Install nightly argument-comment-lint toolchain
-        if: ${{ runner.os == 'Windows' }}
-        shell: bash
-        run: |
-          rustup toolchain install nightly-2025-09-18 \
-            --profile minimal \
-            --component llvm-tools-preview \
-            --component rustc-dev \
-            --component rust-src \
-            --no-self-update
-          rustup default nightly-2025-09-18
       - name: Run argument comment lint on codex-rs via Bazel
         if: ${{ runner.os != 'Windows' }}
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
         run: |
-          ./.github/scripts/run-bazel-ci.sh \
-            -- \
-            build \
+          ./.github/scripts/run-argument-comment-lint-bazel.sh \
             --config=argument-comment-lint \
             --keep_going \
-            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
-            -- \
-            //codex-rs/...
-      - name: Run argument comment lint on codex-rs via packaged wrapper
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+      - name: Run argument comment lint on codex-rs via Bazel
         if: ${{ runner.os == 'Windows' }}
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
-        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py
+        run: |
+          ./.github/scripts/run-argument-comment-lint-bazel.sh \
+            --config=argument-comment-lint \
+            --platforms=//:local_windows \
+            --keep_going \
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
 
   # --- CI to validate on different os/targets --------------------------------
   lint_build:

.github/workflows/rust-ci.yml

@@ -159,35 +159,27 @@ jobs:
         run: |
           sudo DEBIAN_FRONTEND=noninteractive apt-get update
           sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends pkg-config libcap-dev
-      - name: Install nightly argument-comment-lint toolchain
-        if: ${{ runner.os == 'Windows' }}
-        shell: bash
-        run: |
-          rustup toolchain install nightly-2025-09-18 \
-            --profile minimal \
-            --component llvm-tools-preview \
-            --component rustc-dev \
-            --component rust-src \
-            --no-self-update
-          rustup default nightly-2025-09-18
       - name: Run argument comment lint on codex-rs via Bazel
         if: ${{ runner.os != 'Windows' }}
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
         run: |
-          ./.github/scripts/run-bazel-ci.sh \
-            -- \
-            build \
+          ./.github/scripts/run-argument-comment-lint-bazel.sh \
             --config=argument-comment-lint \
             --keep_going \
-            --build_metadata=COMMIT_SHA=${GITHUB_SHA} \
-            -- \
-            //codex-rs/...
-      - name: Run argument comment lint on codex-rs via packaged wrapper
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+      - name: Run argument comment lint on codex-rs via Bazel
         if: ${{ runner.os == 'Windows' }}
+        env:
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
-        run: python3 ./tools/argument-comment-lint/run-prebuilt-linter.py
+        run: |
+          ./.github/scripts/run-argument-comment-lint-bazel.sh \
+            --config=argument-comment-lint \
+            --platforms=//:local_windows \
+            --keep_going \
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
 
   # --- Gatherer job that you mark as the ONLY required status -----------------
   results:

BUILD.bazel

@@ -17,12 +17,19 @@ platform(
 platform(
     name = "local_windows",
     constraint_values = [
-        # We just need to pick one of the ABIs. Do the same one we target.
         "@rules_rs//rs/experimental/platforms/constraints:windows_gnullvm",
     ],
     parents = ["@platforms//host"],
 )
 
+platform(
+    name = "local_windows_msvc",
+    constraint_values = [
+        "@rules_rs//rs/experimental/platforms/constraints:windows_msvc",
+    ],
+    parents = ["@platforms//host"],
+)
+
 alias(
     name = "rbe",
     actual = "@rbe_platform",

MODULE.bazel

@@ -82,6 +82,13 @@ rules_rust = use_extension("@rules_rs//rs/experimental:rules_rust.bzl", "rules_r
 rules_rust.patch(
     patches = [
         "//patches:rules_rust_windows_gnullvm_build_script.patch",
+        "//patches:rules_rust_windows_exec_msvc_build_script_env.patch",
+        "//patches:rules_rust_windows_bootstrap_process_wrapper_linker.patch",
+        "//patches:rules_rust_windows_msvc_direct_link_args.patch",
+        "//patches:rules_rust_windows_exec_bin_target.patch",
+        "//patches:rules_rust_windows_exec_std.patch",
+        "//patches:rules_rust_windows_exec_rustc_dev_rlib.patch",
+        "//patches:rules_rust_repository_set_exec_constraints.patch",
     ],
     strip = 1,
 )
@@ -96,6 +103,35 @@ nightly_rust.toolchain(
     dev_components = True,
     edition = "2024",
 )
+# Keep Windows exec tools on MSVC so Bazel helper binaries link correctly, but
+# lint crate targets as `windows-gnullvm` to preserve the repo's actual cfgs.
+nightly_rust.repository_set(
+    name = "rust_windows_x86_64",
+    dev_components = True,
+    edition = "2024",
+    exec_triple = "x86_64-pc-windows-msvc",
+    exec_compatible_with = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:windows",
+        "@rules_rs//rs/experimental/platforms/constraints:windows_msvc",
+    ],
+    target_compatible_with = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:windows",
+        "@rules_rs//rs/experimental/platforms/constraints:windows_msvc",
+    ],
+    target_triple = "x86_64-pc-windows-msvc",
+    versions = ["nightly/2025-09-18"],
+)
+nightly_rust.repository_set(
+    name = "rust_windows_x86_64",
+    target_compatible_with = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:windows",
+        "@rules_rs//rs/experimental/platforms/constraints:windows_gnullvm",
+    ],
+    target_triple = "x86_64-pc-windows-gnullvm",
+)
 use_repo(nightly_rust, "rust_toolchains")
 
 toolchains = use_extension("@rules_rs//rs/experimental/toolchains:module_extension.bzl", "toolchains")
@@ -163,6 +199,8 @@ crate.annotation(
     patch_args = ["-p1"],
     patches = [
         "//patches:aws-lc-sys_memcmp_check.patch",
+        "//patches:aws-lc-sys_windows_msvc_prebuilt_nasm.patch",
+        "//patches:aws-lc-sys_windows_msvc_memcmp_probe.patch",
     ],
 )
 

codex-rs/core/src/shell_snapshot_tests.rs

@@ -313,9 +313,15 @@ async fn timed_out_snapshot_shell_is_terminated() -> Result<()> {
         shell_snapshot: crate::shell::empty_shell_snapshot_receiver(),
     };
 
-    let err = run_script_with_timeout(&shell, &script, Duration::from_secs(1), true, dir.path())
-        .await
-        .expect_err("snapshot shell should time out");
+    let err = run_script_with_timeout(
+        &shell,
+        &script,
+        Duration::from_secs(1),
+        /*use_login_shell*/ true,
+        dir.path(),
+    )
+    .await
+    .expect_err("snapshot shell should time out");
     assert!(
         err.to_string().contains("timed out"),
         "expected timeout error, got {err:?}"

codex-rs/linux-sandbox/src/landlock.rs

@@ -274,7 +274,10 @@ mod tests {
     #[test]
     fn managed_network_enforces_seccomp_even_for_full_network_policy() {
         assert_eq!(
-            should_install_network_seccomp(NetworkSandboxPolicy::Enabled, true),
+            should_install_network_seccomp(
+                NetworkSandboxPolicy::Enabled,
+                /*allow_network_for_proxy*/ true,
+            ),
             true
         );
     }
@@ -282,7 +285,10 @@ mod tests {
     #[test]
     fn full_network_policy_without_managed_network_skips_seccomp() {
         assert_eq!(
-            should_install_network_seccomp(NetworkSandboxPolicy::Enabled, false),
+            should_install_network_seccomp(
+                NetworkSandboxPolicy::Enabled,
+                /*allow_network_for_proxy*/ false,
+            ),
             false
         );
     }
@@ -291,18 +297,22 @@ mod tests {
     fn restricted_network_policy_always_installs_seccomp() {
         assert!(should_install_network_seccomp(
             NetworkSandboxPolicy::Restricted,
-            false
+            /*allow_network_for_proxy*/ false,
         ));
         assert!(should_install_network_seccomp(
             NetworkSandboxPolicy::Restricted,
-            true
+            /*allow_network_for_proxy*/ true,
         ));
     }
 
     #[test]
     fn managed_proxy_routes_use_proxy_routed_seccomp_mode() {
         assert_eq!(
-            network_seccomp_mode(NetworkSandboxPolicy::Enabled, true, true),
+            network_seccomp_mode(
+                NetworkSandboxPolicy::Enabled,
+                /*allow_network_for_proxy*/ true,
+                /*proxy_routed_network*/ true,
+            ),
             Some(NetworkSeccompMode::ProxyRouted)
         );
     }
@@ -310,7 +320,11 @@ mod tests {
     #[test]
     fn restricted_network_without_proxy_routing_uses_restricted_mode() {
         assert_eq!(
-            network_seccomp_mode(NetworkSandboxPolicy::Restricted, false, false),
+            network_seccomp_mode(
+                NetworkSandboxPolicy::Restricted,
+                /*allow_network_for_proxy*/ false,
+                /*proxy_routed_network*/ false,
+            ),
             Some(NetworkSeccompMode::Restricted)
         );
     }
@@ -318,7 +332,11 @@ mod tests {
     #[test]
     fn full_network_without_managed_proxy_skips_network_seccomp_mode() {
         assert_eq!(
-            network_seccomp_mode(NetworkSandboxPolicy::Enabled, false, false),
+            network_seccomp_mode(
+                NetworkSandboxPolicy::Enabled,
+                /*allow_network_for_proxy*/ false,
+                /*proxy_routed_network*/ false,
+            ),
             None
         );
     }

codex-rs/linux-sandbox/src/proxy_routing.rs

@@ -718,7 +718,8 @@ mod tests {
     #[test]
     fn rewrites_proxy_url_to_local_loopback_port() {
         let rewritten =
-            rewrite_proxy_env_value("socks5h://127.0.0.1:8081", 43210).expect("rewritten value");
+            rewrite_proxy_env_value("socks5h://127.0.0.1:8081", /*local_port*/ 43210)
+                .expect("rewritten value");
         assert_eq!(rewritten, "socks5h://127.0.0.1:43210");
     }
 

patches/BUILD.bazel

@@ -1,7 +1,14 @@
 exports_files([
     "abseil_windows_gnullvm_thread_identity.patch",
     "aws-lc-sys_memcmp_check.patch",
+    "aws-lc-sys_windows_msvc_prebuilt_nasm.patch",
+    "aws-lc-sys_windows_msvc_memcmp_probe.patch",
     "llvm_windows_symlink_extract.patch",
+    "rules_rust_windows_bootstrap_process_wrapper_linker.patch",
+    "rules_rust_windows_exec_bin_target.patch",
+    "rules_rust_windows_exec_std.patch",
+    "rules_rust_repository_set_exec_constraints.patch",
+    "rules_rust_windows_msvc_direct_link_args.patch",
     "rules_rust_windows_gnullvm_build_script.patch",
     "rules_rs_windows_gnullvm_exec.patch",
     "rusty_v8_prebuilt_out_dir.patch",

patches/aws-lc-sys_windows_msvc_memcmp_probe.patch

@@ -0,0 +1,38 @@
+diff --git a/builder/cc_builder.rs b/builder/cc_builder.rs
+--- a/builder/cc_builder.rs
++++ b/builder/cc_builder.rs
+@@ -667,12 +667,24 @@
+         if cargo_env("HOST") != target() {
+             return;
+         }
++
++        let bazel_execroot = Self::bazel_execroot(self.manifest_dir.as_path());
++        if bazel_execroot.is_some() && target().ends_with("windows-msvc") {
++            // This probe guards a GCC memcmp miscompile. Under Bazel's
++            // hermetic Windows/MSVC build-script toolchain we drive clang with
++            // MinGW-flavored CFLAGS, which is good enough for compiling
++            // aws-lc but not for linking and executing this standalone test
++            // binary. Skip the probe in that configuration instead of failing
++            // the whole build script.
++            emit_warning("Skipping memcmp probe for Bazel windows-msvc build scripts.");
++            return;
++        }
+ 
+         let basename = "memcmp_invalid_stripped_check";
+         let exec_path = out_dir().join(basename);
+         let memcmp_build = cc::Build::default();
+         let memcmp_compiler = memcmp_build.get_compiler();
+         if !memcmp_compiler.is_like_clang() && !memcmp_compiler.is_like_gnu() {
+             // The logic below assumes a Clang or GCC compiler is in use
+             return;
+         }
+@@ -701,7 +713,7 @@
+                 memcmp_compile_args.push(flag.into());
+             }
+         }
+ 
+-        if let Some(execroot) = Self::bazel_execroot(self.manifest_dir.as_path()) {
++        if let Some(execroot) = bazel_execroot {
+             // In Bazel build-script sandboxes, `cc` can pass `bazel-out/...` args
+             // relative to the execroot while the process runs from elsewhere.
+             // Normalize those args to absolute paths so this check can still link.

patches/aws-lc-sys_windows_msvc_prebuilt_nasm.patch

@@ -0,0 +1,35 @@
+diff --git a/builder/main.rs b/builder/main.rs
+--- a/builder/main.rs
++++ b/builder/main.rs
+@@ -721,16 +721,29 @@
+ fn get_crate_cflags() -> Option<String> {
+     optional_env_optional_crate_target("TARGET_CFLAGS")
+         .or(optional_env_optional_crate_target("CFLAGS"))
++}
++
++fn is_bazel_windows_msvc_build_script() -> bool {
++    if !target().ends_with("windows-msvc") {
++        return false;
++    }
++
++    let cargo_manifest_dir = cargo_env("CARGO_MANIFEST_DIR");
++    let manifest_dir = Path::new(&cargo_manifest_dir);
++    manifest_dir
++        .components()
++        .any(|component| component.as_os_str() == "bazel-out")
+ }
+ 
+ fn use_prebuilt_nasm() -> bool {
++    let use_prebuilt_for_bazel_windows_msvc = is_bazel_windows_msvc_build_script();
+     target_os() == "windows"
+         && target_arch() == "x86_64"
+         && !is_no_asm()
+-        && !test_nasm_command() // NASM not found in environment
+         && Some(false) != allow_prebuilt_nasm() // not prevented by environment
+         && !is_disable_prebuilt_nasm() // not prevented by feature
+         // permitted by environment or by feature
++        && (use_prebuilt_for_bazel_windows_msvc || !test_nasm_command())
+         && (Some(true) == allow_prebuilt_nasm() || is_prebuilt_nasm())
+ }
+ 
+ fn allow_prebuilt_nasm() -> Option<bool> {

patches/rules_rust_repository_set_exec_constraints.patch

@@ -0,0 +1,26 @@
+# What: let `rules_rust` repository_set entries specify an explicit exec-platform
+# constraint set.
+# Why: codex needs Windows nightly lint toolchains to run helper binaries on an
+# MSVC exec platform while still targeting `windows-gnullvm` crates.
+
+diff --git a/rust/extensions.bzl b/rust/extensions.bzl
+--- a/rust/extensions.bzl
++++ b/rust/extensions.bzl
+@@ -52,6 +52,7 @@ def _rust_impl(module_ctx):
+                 "allocator_library": repository_set.allocator_library,
+                 "dev_components": repository_set.dev_components,
+                 "edition": repository_set.edition,
++                "exec_compatible_with": [str(v) for v in repository_set.exec_compatible_with] if repository_set.exec_compatible_with else None,
+                 "exec_triple": repository_set.exec_triple,
+                 "extra_target_triples": {repository_set.target_triple: [str(v) for v in repository_set.target_compatible_with]},
+                 "name": repository_set.name,
+@@ -166,6 +167,9 @@ _COMMON_TAG_KWARGS = {
+ 
+ _RUST_REPOSITORY_SET_TAG_ATTRS = {
++    "exec_compatible_with": attr.label_list(
++        doc = "Execution platform constraints for this repository_set.",
++    ),
+     "exec_triple": attr.string(
+         doc = "Exec triple for this repository_set.",
+     ),
+     "name": attr.string(

patches/rules_rust_windows_bootstrap_process_wrapper_linker.patch

@@ -0,0 +1,23 @@
+--- a/rust/private/rustc.bzl
++++ b/rust/private/rustc.bzl
+@@ -472,7 +472,19 @@
+         )
+         ld_is_direct_driver = False
+ 
+-    if not ld or toolchain.linker_preference == "rust":
++    # The bootstrap process wrapper is built without the normal rules_rust
++    # process wrapper. On Windows nightly toolchains that expose rust-lld, the
++    # C++ toolchain path currently resolves to clang++ while still emitting
++    # MSVC-style arguments, so prefer rust-lld for this one bootstrap binary
++    # instead of switching all Rust actions over.
++    use_bootstrap_rust_linker = (
++        toolchain.target_os.startswith("windows") and
++        toolchain.linker != None and
++        hasattr(ctx.executable, "_bootstrap_process_wrapper") and
++        not ctx.executable._process_wrapper
++    )
++
++    if not ld or toolchain.linker_preference == "rust" or use_bootstrap_rust_linker:
+         ld = toolchain.linker.path
+         ld_is_direct_driver = toolchain.linker_type == "direct"
+ 

patches/rules_rust_windows_exec_bin_target.patch

@@ -0,0 +1,71 @@
+# What: compile exec-side Rust binaries against the exec Windows triple instead
+# of the lint target triple.
+# Why: Windows native argument-comment-lint keeps the repo target platform on
+# `windows-gnullvm` to preserve cfg coverage, but exec-side helper binaries
+# (build.rs, runners, bootstrap tools) must link as host tools. With
+# `toolchain_linker_preference=rust`, rules_rust was still feeding those exec
+# binaries the `windows-gnullvm` target/std path, which broke linking under the
+# native Bazel lint lane.
+
+diff --git a/rust/private/rustc.bzl b/rust/private/rustc.bzl
+--- a/rust/private/rustc.bzl
++++ b/rust/private/rustc.bzl
+@@ -129,6 +129,20 @@
+     build_setting = config.bool(flag = True),
+ )
+ 
+-def _get_rustc_env(attr, toolchain, crate_name):
++def _effective_target_arch(toolchain, use_exec_target):
++    return toolchain.exec_triple.arch if use_exec_target else toolchain.target_arch
++
++def _effective_target_os(toolchain, use_exec_target):
++    return toolchain.exec_triple.system if use_exec_target else toolchain.target_os
++
++def _effective_target_flag_value(toolchain, use_exec_target):
++    return toolchain.exec_triple.str if use_exec_target else toolchain.target_flag_value
++
++def _effective_rust_std_paths(toolchain, use_exec_target):
++    if use_exec_target:
++        return ["{}/lib/rustlib/{}/lib".format(toolchain.sysroot, toolchain.exec_triple.str)]
++    return toolchain.rust_std_paths
++
++def _get_rustc_env(attr, toolchain, crate_name, use_exec_target = False):
+     """Gathers rustc environment variables
+ 
+@@ -147,6 +161,6 @@
+ 
+     result = {
+-        "CARGO_CFG_TARGET_ARCH": "" if toolchain.target_arch == None else toolchain.target_arch,
+-        "CARGO_CFG_TARGET_OS": "" if toolchain.target_os == None else toolchain.target_os,
++        "CARGO_CFG_TARGET_ARCH": "" if _effective_target_arch(toolchain, use_exec_target) == None else _effective_target_arch(toolchain, use_exec_target),
++        "CARGO_CFG_TARGET_OS": "" if _effective_target_os(toolchain, use_exec_target) == None else _effective_target_os(toolchain, use_exec_target),
+         "CARGO_CRATE_NAME": crate_name,
+         "CARGO_PKG_AUTHORS": "",
+@@ -997,9 +1011,11 @@
+     if build_metadata and not use_json_output:
+         fail("build_metadata requires parse_json_output")
+ 
++    use_exec_target = is_exec_configuration(ctx) and crate_info.type == "bin"
++
+     output_dir = getattr(crate_info.output, "dirname", None)
+     linker_script = getattr(file, "linker_script", None)
+ 
+-    env = _get_rustc_env(attr, toolchain, crate_info.name)
++    env = _get_rustc_env(attr, toolchain, crate_info.name, use_exec_target)
+ 
+     # Wrapper args first
+@@ -1138,5 +1154,5 @@
+     if error_format != "json":
+         # Color is not compatible with json output.
+         rustc_flags.add("--color=always")
+-    rustc_flags.add(toolchain.target_flag_value, format = "--target=%s")
++    rustc_flags.add(_effective_target_flag_value(toolchain, use_exec_target), format = "--target=%s")
+     if hasattr(attr, "crate_features"):
+@@ -1144,6 +1160,6 @@
+     if linker_script:
+         rustc_flags.add(linker_script, format = "--codegen=link-arg=-T%s")
+ 
+     # Tell Rustc where to find the standard library (or libcore)
+-    rustc_flags.add_all(toolchain.rust_std_paths, before_each = "-L", format_each = "%s")
++    rustc_flags.add_all(_effective_rust_std_paths(toolchain, use_exec_target), before_each = "-L", format_each = "%s")
+     rustc_flags.add_all(rust_flags, map_each = map_flag)

patches/rules_rust_windows_exec_msvc_build_script_env.patch

@@ -0,0 +1,111 @@
+diff --git a/cargo/private/cargo_build_script.bzl b/cargo/private/cargo_build_script.bzl
+--- a/cargo/private/cargo_build_script.bzl
++++ b/cargo/private/cargo_build_script.bzl
+@@ -142,40 +142,82 @@ def _strip_stack_protector_for_windows_llvm_mingw(toolchain, args):
+ def _rewrite_windows_exec_msvc_cc_args(toolchain, args):
+     """Translate GNU-flavored cc args when exec-side build scripts target Windows MSVC."""
+     if toolchain.target_flag_value != toolchain.exec_triple.str or not toolchain.exec_triple.str.endswith("-pc-windows-msvc"):
+         return args
+ 
+-    rewritten = []
+-    skip_next = False
+-    for arg in args:
+-        if skip_next:
+-            skip_next = False
+-            continue
++    rewritten = [
++        "-target",
++        toolchain.target_flag_value,
++    ]
++    skip_next = False
++    for index in range(len(args)):
++        arg = args[index]
++
++        if skip_next:
++            skip_next = False
++            continue
+ 
+         if arg == "-target":
+-            skip_next = True
++            skip_next = True
+             continue
+ 
+         if arg.startswith("-target=") or arg.startswith("--target="):
+             continue
+ 
+         if arg == "-nostdlibinc" or arg.startswith("--sysroot"):
+             continue
+ 
+-        if "mingw-w64-" in arg or "mingw_import_libraries_directory" in arg or "mingw_crt_library_search_directory" in arg:
++        if arg.startswith("-fstack-protector") or arg.startswith("-D_FORTIFY_SOURCE="):
+             continue
+ 
+-        if arg.startswith("-fstack-protector"):
+-            continue
+-
+-        if arg.startswith("-D_FORTIFY_SOURCE="):
+-            continue
++        if arg == "-isystem" and index + 1 < len(args):
++            path = args[index + 1]
++            if "mingw-w64-" in path or "mingw_import_libraries_directory" in path or "mingw_crt_library_search_directory" in path:
++                skip_next = True
++                continue
+ 
+         rewritten.append(arg)
+ 
+-    return [
+-        "-target",
+-        toolchain.target_flag_value,
+-    ] + rewritten
++    return rewritten
++
++def _rewrite_windows_exec_msvc_link_args(toolchain, args):
++    """Translate GNU-flavored link args when exec-side build scripts target Windows MSVC."""
++    if toolchain.target_flag_value != toolchain.exec_triple.str or not toolchain.exec_triple.str.endswith("-pc-windows-msvc"):
++        return args
++
++    rewritten = []
++    skip_next = False
++    for index in range(len(args)):
++        arg = args[index]
++
++        if skip_next:
++            skip_next = False
++            continue
++
++        if arg == "--sysroot":
++            skip_next = True
++            continue
++
++        if arg.startswith("--sysroot="):
++            continue
++
++        if arg == "-L" and index + 1 < len(args):
++            path = args[index + 1]
++            if "mingw_import_libraries_directory" in path or "mingw_crt_library_search_directory" in path:
++                skip_next = True
++                continue
++            rewritten.extend([arg, path])
++            skip_next = True
++            continue
++
++        if arg.startswith("-L") and (
++            "mingw_import_libraries_directory" in arg or
++            "mingw_crt_library_search_directory" in arg
++        ):
++            continue
++
++        rewritten.append(arg)
++
++    return rewritten
+ 
+ def get_cc_compile_args_and_env(cc_toolchain, feature_configuration):
+     """Gather cc environment variables from the given `cc_toolchain`
+@@ -509,6 +550,7 @@ def _construct_build_script_env(
+     linker, _, link_args, linker_env = get_linker_and_args(ctx, "bin", toolchain, cc_toolchain, feature_configuration, None)
+     env.update(**linker_env)
+     env["LD"] = linker
++    link_args = _rewrite_windows_exec_msvc_link_args(toolchain, link_args)
+     env["LDFLAGS"] = " ".join(_pwd_flags(link_args))
+ 
+     # Defaults for cxx flags.

patches/rules_rust_windows_exec_rustc_dev_rlib.patch

@@ -0,0 +1,11 @@
+diff --git a/rust/private/repository_utils.bzl b/rust/private/repository_utils.bzl
+--- a/rust/private/repository_utils.bzl
++++ b/rust/private/repository_utils.bzl
+@@ -53,6 +53,7 @@ filegroup(
+             "lib/*{dylib_ext}*",
+             "lib/rustlib/{target_triple}/codegen-backends/*{dylib_ext}",
+             "lib/rustlib/{target_triple}/lib/*{dylib_ext}*",
++            "lib/rustlib/{target_triple}/lib/*.rlib",
+             "lib/rustlib/{target_triple}/lib/*.rmeta",
+         ],
+         allow_empty = True,

patches/rules_rust_windows_exec_std.patch

@@ -0,0 +1,181 @@
+# What: expose an exec-side Rust standard library alongside the target stdlib.
+# Why: mixed Windows toolchains compile repo crates for `windows-gnullvm`, but
+# exec-side helper binaries (build.rs, runners) may need the host MSVC stdlib.
+# The toolchain sysroot must therefore carry both stdlib trees so rustc can
+# resolve the correct one for each `--target`.
+
+diff --git a/rust/toolchain.bzl b/rust/toolchain.bzl
+--- a/rust/toolchain.bzl
++++ b/rust/toolchain.bzl
+@@ -209,6 +209,7 @@ def _generate_sysroot(
+         clippy = None,
+         cargo_clippy = None,
+         llvm_tools = None,
++        exec_rust_std = None,
+         rust_std = None,
+         rustfmt = None,
+         linker = None):
+@@ -312,7 +313,15 @@ def _generate_sysroot(
+ 
+         # Made available to support $(location) expansion in stdlib_linkflags and extra_rustc_flags.
+         transitive_file_sets.append(depset(ctx.files.rust_std))
++
++    sysroot_exec_rust_std = None
++    if exec_rust_std:
++        sysroot_exec_rust_std = _symlink_sysroot_tree(ctx, name, exec_rust_std)
++        transitive_file_sets.extend([sysroot_exec_rust_std])
+ 
++        # Made available to support $(location) expansion in extra_exec_rustc_flags.
++        transitive_file_sets.append(depset(ctx.files.exec_rust_std))
++
+     # Declare a file in the root of the sysroot to make locating the sysroot easy
+     sysroot_anchor = ctx.actions.declare_file("{}/rust.sysroot".format(name))
+     ctx.actions.write(
+@@ -323,6 +332,7 @@ def _generate_sysroot(
+             "cargo-clippy: {}".format(cargo_clippy),
+             "linker: {}".format(linker),
+             "llvm_tools: {}".format(llvm_tools),
++            "exec_rust_std: {}".format(exec_rust_std),
+             "rust_std: {}".format(rust_std),
+             "rustc_lib: {}".format(rustc_lib),
+             "rustc: {}".format(rustc),
+@@ -340,6 +350,7 @@ def _generate_sysroot(
+         cargo_clippy = sysroot_cargo_clippy,
+         clippy = sysroot_clippy,
+         linker = sysroot_linker,
++        exec_rust_std = sysroot_exec_rust_std,
+         rust_std = sysroot_rust_std,
+         rustc = sysroot_rustc,
+         rustc_lib = sysroot_rustc_lib,
+@@ -410,12 +421,14 @@ def _rust_toolchain_impl(ctx):
+         )
+ 
+     rust_std = ctx.attr.rust_std
++    exec_rust_std = ctx.attr.exec_rust_std if ctx.attr.exec_rust_std else rust_std
+ 
+     sysroot = _generate_sysroot(
+         ctx = ctx,
+         rustc = ctx.file.rustc,
+         rustdoc = ctx.file.rust_doc,
+         rustc_lib = ctx.attr.rustc_lib,
++        exec_rust_std = exec_rust_std,
+         rust_std = rust_std,
+         rustfmt = ctx.file.rustfmt,
+         clippy = ctx.file.clippy_driver,
+@@ -452,7 +465,7 @@ def _rust_toolchain_impl(ctx):
+ 
+     expanded_stdlib_linkflags = _expand_flags(ctx, "stdlib_linkflags", rust_std[rust_common.stdlib_info].srcs, make_variables)
+     expanded_extra_rustc_flags = _expand_flags(ctx, "extra_rustc_flags", rust_std[rust_common.stdlib_info].srcs, make_variables)
+-    expanded_extra_exec_rustc_flags = _expand_flags(ctx, "extra_exec_rustc_flags", rust_std[rust_common.stdlib_info].srcs, make_variables)
++    expanded_extra_exec_rustc_flags = _expand_flags(ctx, "extra_exec_rustc_flags", exec_rust_std[rust_common.stdlib_info].srcs, make_variables)
+ 
+     linking_context = cc_common.create_linking_context(
+         linker_inputs = depset([
+@@ -793,6 +806,10 @@ rust_toolchain = rule(
+             doc = "The Rust standard library.",
+             mandatory = True,
+         ),
++        "exec_rust_std": attr.label(
++            doc = "Optional Rust standard library for exec-configuration Rust tools. Defaults to rust_std.",
++            mandatory = False,
++        ),
+         "rustc": attr.label(
+             doc = "The location of the `rustc` binary. Can be a direct source or a filegroup containing one item.",
+             allow_single_file = True,
+diff --git a/rust/private/repository_utils.bzl b/rust/private/repository_utils.bzl
+--- a/rust/private/repository_utils.bzl
++++ b/rust/private/repository_utils.bzl
+@@ -341,6 +341,7 @@ rust_toolchain(
+     name = "{toolchain_name}",
+     rust_doc = "//:rustdoc",
+     rust_std = "//:rust_std-{target_triple}",
++    exec_rust_std = {exec_rust_std_label},
+     rustc = "//:rustc",
+     linker = {linker_label},
+     linker_type = {linker_type},
+@@ -384,6 +385,7 @@ def BUILD_for_rust_toolchain(
+         include_llvm_tools,
+         include_linker,
+         include_objcopy = False,
++        exec_rust_std_label = None,
+         stdlib_linkflags = None,
+         extra_rustc_flags = None,
+         extra_exec_rustc_flags = None,
+@@ -405,6 +407,7 @@ def BUILD_for_rust_toolchain(
+         include_llvm_tools (bool): Whether llvm-tools are present in the toolchain.
+         include_linker (bool): Whether a linker is available in the toolchain.
+         include_objcopy (bool): Whether rust-objcopy is available in the toolchain.
++        exec_rust_std_label (str, optional): Label for an exec-side stdlib when it differs from rust_std.
+         stdlib_linkflags (list, optional): Overridden flags needed for linking to rust
+                                            stdlib, akin to BAZEL_LINKLIBS. Defaults to
+                                            None.
+@@ -453,6 +456,7 @@ def BUILD_for_rust_toolchain(
+         staticlib_ext = system_to_staticlib_ext(target_triple.system),
+         dylib_ext = system_to_dylib_ext(target_triple.system),
+         allocator_library = repr(allocator_library_label),
++        exec_rust_std_label = repr(exec_rust_std_label),
+         global_allocator_library = repr(global_allocator_library_label),
+         stdlib_linkflags = stdlib_linkflags,
+         default_edition = default_edition,
+diff --git a/rust/private/rustc.bzl b/rust/private/rustc.bzl
+--- a/rust/private/rustc.bzl
++++ b/rust/private/rustc.bzl
+@@ -1011,7 +1011,10 @@ def construct_arguments(
+     if build_metadata and not use_json_output:
+         fail("build_metadata requires parse_json_output")
+ 
+-    use_exec_target = is_exec_configuration(ctx) and crate_info.type == "bin"
++    # Exec-configuration crates (build scripts, proc-macros, and their
++    # dependencies) must all target the exec triple so they can link against
++    # each other and the exec-side standard library.
++    use_exec_target = is_exec_configuration(ctx)
+ 
+     output_dir = getattr(crate_info.output, "dirname", None)
+     linker_script = getattr(file, "linker_script", None)
+diff --git a/rust/repositories.bzl b/rust/repositories.bzl
+--- a/rust/repositories.bzl
++++ b/rust/repositories.bzl
+@@ -536,6 +536,18 @@ def _rust_toolchain_tools_repository_impl(ctx):
+     build_components.append(rust_stdlib_content)
+     sha256s.update(rust_stdlib_sha256)
+ 
++    exec_rust_std_label = None
++    if exec_triple.str != target_triple.str:
++        exec_rust_stdlib_content, exec_rust_stdlib_sha256 = load_rust_stdlib(
++            ctx = ctx,
++            target_triple = exec_triple,
++            version = version,
++            iso_date = iso_date,
++        )
++        build_components.append(exec_rust_stdlib_content)
++        sha256s.update(exec_rust_stdlib_sha256)
++        exec_rust_std_label = "//:rust_std-{}".format(exec_triple.str)
++
+     stdlib_linkflags = None
+     if "BAZEL_RUST_STDLIB_LINKFLAGS" in ctx.os.environ:
+         stdlib_linkflags = ctx.os.environ["BAZEL_RUST_STDLIB_LINKFLAGS"].split(":")
+@@ -552,6 +564,7 @@ def _rust_toolchain_tools_repository_impl(ctx):
+         include_llvm_tools = include_llvm_tools,
+         include_linker = include_linker,
+         include_objcopy = include_objcopy,
++        exec_rust_std_label = exec_rust_std_label,
+         extra_rustc_flags = ctx.attr.extra_rustc_flags,
+         extra_exec_rustc_flags = ctx.attr.extra_exec_rustc_flags,
+         opt_level = ctx.attr.opt_level if ctx.attr.opt_level else None,
+@@ -575,8 +588,16 @@ def _rust_toolchain_tools_repository_impl(ctx):
+     if ctx.attr.dev_components:
+         rustc_dev_sha256 = load_rustc_dev_nightly(
+             ctx = ctx,
+             target_triple = target_triple,
+             version = version,
+             iso_date = iso_date,
+         )
+         sha256s.update(rustc_dev_sha256)
++        if exec_triple.str != target_triple.str:
++            exec_rustc_dev_sha256 = load_rustc_dev_nightly(
++                ctx = ctx,
++                target_triple = exec_triple,
++                version = version,
++                iso_date = iso_date,
++            )
++            sha256s.update(exec_rustc_dev_sha256)

patches/rules_rust_windows_gnullvm_build_script.patch

@@ -1,7 +1,7 @@
 diff --git a/cargo/private/cargo_build_script.bzl b/cargo/private/cargo_build_script.bzl
 --- a/cargo/private/cargo_build_script.bzl
 +++ b/cargo/private/cargo_build_script.bzl
-@@ -120,6 +120,25 @@
+@@ -120,6 +120,63 @@
      executable = True,
  )
  
@@ -23,16 +23,56 @@ diff --git a/cargo/private/cargo_build_script.bzl b/cargo/private/cargo_build_sc
 +    # flags through CFLAGS/CXXFLAGS breaks build.rs probe binaries compiled via
 +    # cc-rs.
 +    return [arg for arg in args if not arg.startswith("-fstack-protector")]
++
++def _rewrite_windows_exec_msvc_cc_args(toolchain, args):
++    """Translate GNU-flavored cc args when exec-side build scripts target Windows MSVC."""
++    if toolchain.target_flag_value != toolchain.exec_triple.str or not toolchain.exec_triple.str.endswith("-pc-windows-msvc"):
++        return args
++
++    rewritten = []
++    skip_next = False
++    for arg in args:
++        if skip_next:
++            skip_next = False
++            continue
++
++        if arg == "-target":
++            skip_next = True
++            continue
++
++        if arg.startswith("-target=") or arg.startswith("--target="):
++            continue
++
++        if arg == "-nostdlibinc" or arg.startswith("--sysroot"):
++            continue
++
++        if "mingw-w64-" in arg or "mingw_import_libraries_directory" in arg or "mingw_crt_library_search_directory" in arg:
++            continue
++
++        if arg.startswith("-fstack-protector"):
++            continue
++
++        if arg.startswith("-D_FORTIFY_SOURCE="):
++            continue
++
++        rewritten.append(arg)
++
++    return [
++        "-target",
++        toolchain.target_flag_value,
++    ] + rewritten
 +
  def get_cc_compile_args_and_env(cc_toolchain, feature_configuration):
      """Gather cc environment variables from the given `cc_toolchain`
  
-@@ -503,6 +522,8 @@
+@@ -503,6 +560,10 @@
          if not env["AR"]:
              env["AR"] = cc_toolchain.ar_executable
  
 +        cc_c_args = _strip_stack_protector_for_windows_llvm_mingw(toolchain, cc_c_args)
 +        cc_cxx_args = _strip_stack_protector_for_windows_llvm_mingw(toolchain, cc_cxx_args)
++        cc_c_args = _rewrite_windows_exec_msvc_cc_args(toolchain, cc_c_args)
++        cc_cxx_args = _rewrite_windows_exec_msvc_cc_args(toolchain, cc_cxx_args)
          # Populate CFLAGS and CXXFLAGS that cc-rs relies on when building from source, in particular
          # to determine the deployment target when building for apple platforms (`macosx-version-min`
          # for example, itself derived from the `macos_minimum_os` Bazel argument).

patches/rules_rust_windows_msvc_direct_link_args.patch

@@ -0,0 +1,64 @@
+--- a/rust/private/rustc.bzl
++++ b/rust/private/rustc.bzl
+@@ -2305,7 +2305,7 @@
+         return crate.metadata.dirname
+     return crate.output.dirname
+ 
+-def _portable_link_flags(lib, use_pic, ambiguous_libs, get_lib_name, for_windows = False, for_darwin = False, flavor_msvc = False):
++def _portable_link_flags(lib, use_pic, ambiguous_libs, get_lib_name, for_windows = False, for_darwin = False, flavor_msvc = False, use_direct_driver = False):
+     artifact = get_preferred_artifact(lib, use_pic)
+     if ambiguous_libs and artifact.path in ambiguous_libs:
+         artifact = ambiguous_libs[artifact.path]
+@@ -2344,6 +2344,11 @@
+             artifact.basename.startswith("test-") or artifact.basename.startswith("std-")
+         ):
+             return [] if for_darwin else ["-lstatic=%s" % get_lib_name(artifact)]
++
++        if for_windows and use_direct_driver and not artifact.basename.endswith(".lib"):
++            return [
++                "-Clink-arg={}".format(artifact.path),
++            ]
+ 
+         if flavor_msvc:
+             return [
+@@ -2381,7 +2386,7 @@
+                 ])
+         elif include_link_flags:
+             get_lib_name = get_lib_name_for_windows if flavor_msvc else get_lib_name_default
+-            ret.extend(_portable_link_flags(lib, use_pic, ambiguous_libs, get_lib_name, flavor_msvc = flavor_msvc))
++            ret.extend(_portable_link_flags(lib, use_pic, ambiguous_libs, get_lib_name, flavor_msvc = flavor_msvc, use_direct_driver = use_direct_driver))
+ 
+     # Windows toolchains can inherit POSIX defaults like -pthread from C deps,
+     # which fails to link with the MinGW/LLD toolchain. Drop them here.
+@@ -2558,17 +2563,25 @@
+         else:
+             # For all other crate types we want to link C++ runtime library statically
+             # (for example libstdc++.a or libc++.a).
++            runtime_libs = cc_toolchain.static_runtime_lib(feature_configuration = feature_configuration)
+             args.add_all(
+-                cc_toolchain.static_runtime_lib(feature_configuration = feature_configuration),
++                runtime_libs,
+                 map_each = _get_dirname,
+                 format_each = "-Lnative=%s",
+             )
+             if include_link_flags:
+-                args.add_all(
+-                    cc_toolchain.static_runtime_lib(feature_configuration = feature_configuration),
+-                    map_each = get_lib_name,
+-                    format_each = "-lstatic=%s",
+-                )
++                if toolchain.target_os == "windows" and use_direct_link_driver:
++                    for runtime_lib in runtime_libs.to_list():
++                        if runtime_lib.basename.endswith(".lib"):
++                            args.add(get_lib_name(runtime_lib), format = "-lstatic=%s")
++                        else:
++                            args.add(runtime_lib.path, format = "--codegen=link-arg=%s")
++                else:
++                    args.add_all(
++                        runtime_libs,
++                        map_each = get_lib_name,
++                        format_each = "-lstatic=%s",
++                    )
+ 
+ def _get_dirname(file):
+     """A helper function for `_add_native_link_flags`.