diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 1bed79c3c..a61f86770 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -10,6 +10,10 @@
      case your host is x86 (or vice-versa). */
   "runArgs": ["--platform=linux/arm64"],
 
+  "features": {
+    "ghcr.io/facebook/devcontainers/features/dotslash:latest": {}
+  },
+
   "containerEnv": {
     "RUST_BACKTRACE": "1",
     "CARGO_TARGET_DIR": "${containerWorkspaceFolder}/codex-rs/target-arm64"
diff --git a/.devcontainer/devcontainer.secure.json b/.devcontainer/devcontainer.secure.json
index 7b05fb9a6..2a0c7b45e 100644
--- a/.devcontainer/devcontainer.secure.json
+++ b/.devcontainer/devcontainer.secure.json
@@ -23,6 +23,9 @@
     "--cap-add=NET_RAW"
   ],
   "init": true,
+  "features": {
+    "ghcr.io/facebook/devcontainers/features/dotslash:latest": {}
+  },
   "updateRemoteUserUID": true,
   "remoteUser": "vscode",
   "workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=delegated",
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 63c6ffe52..155b6dd07 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -81,6 +81,8 @@ jobs:
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           version: "0.11.3"
+      - name: Install DotSlash
+        uses: facebook/install-dotslash@1e4e7b3e07eaca387acb98f1d4720e0bee8dbb6a # v2
       - name: Check formatting (run `just fmt` to fix)
         run: just fmt-check
 
diff --git a/MODULE.bazel b/MODULE.bazel
index 0a2521d75..98619420a 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -3,6 +3,7 @@ module(name = "codex")
 bazel_dep(name = "bazel_skylib", version = "1.9.0")
 bazel_dep(name = "platforms", version = "1.0.0")
 bazel_dep(name = "llvm", version = "0.7.1")
+
 # The upstream LLVM archive contains a few unix-only symlink entries and is
 # missing a couple of MinGW compatibility archives that windows-gnullvm needs
 # during extraction and linking, so patch it until upstream grows native support.
@@ -15,6 +16,7 @@ single_version_override(
         "//patches:llvm_windows_symlink_extract.patch",
     ],
 )
+
 # Abseil picks a MinGW pthread TLS path that does not match our hermetic
 # windows-gnullvm toolchain; force it onto the portable C++11 thread-local path.
 single_version_override(
@@ -86,8 +88,10 @@ single_version_override(
         "//patches:rules_cc_rusty_v8_custom_libcxx.patch",
     ],
 )
+
 bazel_dep(name = "rules_platform", version = "0.1.0")
 bazel_dep(name = "rules_rs", version = "0.0.58")
+
 # `rules_rs` still does not model `windows-gnullvm` as a distinct Windows exec
 # platform, so patch it until upstream grows that support for both x86_64 and
 # aarch64.
@@ -103,6 +107,7 @@ single_version_override(
 )
 
 rules_rust = use_extension("@rules_rs//rs/experimental:rules_rust.bzl", "rules_rust")
+
 # Build-script probe binaries inherit CFLAGS/CXXFLAGS from Bazel's C++
 # toolchain. On `windows-gnullvm`, llvm-mingw does not ship
 # `libssp_nonshared`, so strip the forwarded stack-protector flags there.
@@ -127,22 +132,23 @@ nightly_rust = use_extension(
     "rust",
 )
 nightly_rust.toolchain(
-    versions = ["nightly/2025-09-18"],
     dev_components = True,
     edition = "2024",
+    versions = ["nightly/2025-09-18"],
 )
+
 # Keep Windows exec tools on MSVC so Bazel helper binaries link correctly, but
 # lint crate targets as `windows-gnullvm` to preserve the repo's actual cfgs.
 nightly_rust.repository_set(
     name = "rust_windows_x86_64",
     dev_components = True,
     edition = "2024",
-    exec_triple = "x86_64-pc-windows-msvc",
     exec_compatible_with = [
         "@platforms//cpu:x86_64",
         "@platforms//os:windows",
         "@rules_rs//rs/experimental/platforms/constraints:windows_msvc",
     ],
+    exec_triple = "x86_64-pc-windows-msvc",
     target_compatible_with = [
         "@platforms//cpu:x86_64",
         "@platforms//os:windows",
@@ -170,6 +176,7 @@ toolchains.toolchain(
 use_repo(toolchains, "default_rust_toolchains")
 
 register_toolchains("@default_rust_toolchains//:all")
+
 register_toolchains("@rust_toolchains//:all")
 
 crate = use_extension("@rules_rs//rs:extensions.bzl", "crate")
@@ -241,7 +248,6 @@ crate.annotation(
         "//patches:aws-lc-sys_windows_msvc_memcmp_probe.patch",
     ],
 )
-
 crate.annotation(
     # The build script only validates embedded source/version metadata.
     crate = "rustc_apfloat",
@@ -249,6 +255,7 @@ crate.annotation(
 )
 
 inject_repo(crate, "zstd")
+
 use_repo(crate, "argument_comment_lint_crates")
 
 bazel_dep(name = "bzip2", version = "1.0.8.bcr.3")
@@ -297,14 +304,14 @@ bazel_dep(name = "openssl", version = "3.5.4.bcr.0")
 inject_repo(crate, "xz")
 
 crate.annotation(
+    build_script_data = [
+        "@openssl//:gen_dir",
+    ],
     # Build scripts compile in Bazel's exec configuration, so target-specific
     # optional build deps are otherwise dropped for the musl release platforms.
     build_script_deps = [
         "@crates//:openssl-src-300.5.5+3.5.5",
     ],
-    build_script_data = [
-        "@openssl//:gen_dir",
-    ],
     build_script_env = {
         "OPENSSL_DIR": "$(execpath @openssl//:gen_dir)",
         "OPENSSL_NO_VENDOR": "1",
@@ -323,7 +330,9 @@ crate.annotation(
 )
 
 http_archive = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
 http_file = use_repo_rule("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
+
 new_local_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:local.bzl", "new_local_repository")
 
 include("//bazel/modules:wine.MODULE.bazel")
diff --git a/codex-rs/app-server-protocol/BUILD.bazel b/codex-rs/app-server-protocol/BUILD.bazel
index b95356e74..af8c03968 100644
--- a/codex-rs/app-server-protocol/BUILD.bazel
+++ b/codex-rs/app-server-protocol/BUILD.bazel
@@ -3,5 +3,8 @@ load("//:defs.bzl", "codex_rust_crate")
 codex_rust_crate(
     name = "app-server-protocol",
     crate_name = "codex_app_server_protocol",
-    test_data_extra = glob(["schema/**"], allow_empty = True),
+    test_data_extra = glob(
+        ["schema/**"],
+        allow_empty = True,
+    ),
 )
diff --git a/codex-rs/app-server/BUILD.bazel b/codex-rs/app-server/BUILD.bazel
index 6765141bd..0a91a1e34 100644
--- a/codex-rs/app-server/BUILD.bazel
+++ b/codex-rs/app-server/BUILD.bazel
@@ -3,6 +3,9 @@ load("//:defs.bzl", "codex_rust_crate")
 codex_rust_crate(
     name = "app-server",
     crate_name = "codex_app_server",
+    extra_binaries = [
+        "//codex-rs/bwrap:bwrap",
+    ],
     integration_test_timeout = "long",
     test_shard_counts = {
         # Note app-server-all-test has a large number of integration tests, so
@@ -14,8 +17,5 @@ codex_rust_crate(
         "app-server-all-test": 16,
         "app-server-unit-tests": 8,
     },
-    extra_binaries = [
-        "//codex-rs/bwrap:bwrap",
-    ],
     test_tags = ["no-sandbox"],
 )
diff --git a/codex-rs/app-server/tests/common/BUILD.bazel b/codex-rs/app-server/tests/common/BUILD.bazel
index bf4e465ae..82473248b 100644
--- a/codex-rs/app-server/tests/common/BUILD.bazel
+++ b/codex-rs/app-server/tests/common/BUILD.bazel
@@ -4,4 +4,4 @@ codex_rust_crate(
     name = "common",
     crate_name = "app_test_support",
     crate_srcs = glob(["*.rs"]),
-)
\ No newline at end of file
+)
diff --git a/codex-rs/backend-client/BUILD.bazel b/codex-rs/backend-client/BUILD.bazel
index 359f7e149..5a990abd2 100644
--- a/codex-rs/backend-client/BUILD.bazel
+++ b/codex-rs/backend-client/BUILD.bazel
@@ -2,6 +2,6 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "backend-client",
-    crate_name = "codex_backend_client",
     compile_data = glob(["tests/fixtures/**"]),
+    crate_name = "codex_backend_client",
 )
diff --git a/codex-rs/bwrap/BUILD.bazel b/codex-rs/bwrap/BUILD.bazel
index 3d0b89b96..44adc3feb 100644
--- a/codex-rs/bwrap/BUILD.bazel
+++ b/codex-rs/bwrap/BUILD.bazel
@@ -3,10 +3,10 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "bwrap",
-    crate_name = "codex_bwrap",
     # Bazel wires vendored bubblewrap + libcap via :bwrap-ffi below and sets
     # bwrap_available explicitly, so we skip Cargo's build.rs in Bazel builds.
     build_script_enabled = False,
+    crate_name = "codex_bwrap",
     deps_extra = select({
         "@platforms//os:linux": [":bwrap-ffi"],
         "//conditions:default": [],
@@ -29,7 +29,7 @@ cc_library(
         "-Dmain=bwrap_main",
     ],
     includes = ["."],
-    deps = ["@libcap//:libcap"],
     target_compatible_with = ["@platforms//os:linux"],
     visibility = ["//visibility:private"],
+    deps = ["@libcap"],
 )
diff --git a/codex-rs/codex-client/BUILD.bazel b/codex-rs/codex-client/BUILD.bazel
index b1b1ef765..3d2681911 100644
--- a/codex-rs/codex-client/BUILD.bazel
+++ b/codex-rs/codex-client/BUILD.bazel
@@ -2,6 +2,6 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "codex-client",
-    crate_name = "codex_client",
     compile_data = glob(["tests/fixtures/**"]),
+    crate_name = "codex_client",
 )
diff --git a/codex-rs/collaboration-mode-templates/BUILD.bazel b/codex-rs/collaboration-mode-templates/BUILD.bazel
index 0fbc86ec8..4e6a69f00 100644
--- a/codex-rs/collaboration-mode-templates/BUILD.bazel
+++ b/codex-rs/collaboration-mode-templates/BUILD.bazel
@@ -2,8 +2,8 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "collaboration-mode-templates",
-    crate_name = "codex_collaboration_mode_templates",
     compile_data = glob(["templates/*.md"]),
+    crate_name = "codex_collaboration_mode_templates",
 )
 
 exports_files(
diff --git a/codex-rs/core-plugins/BUILD.bazel b/codex-rs/core-plugins/BUILD.bazel
index aa19b9f36..58503cb03 100644
--- a/codex-rs/core-plugins/BUILD.bazel
+++ b/codex-rs/core-plugins/BUILD.bazel
@@ -2,14 +2,14 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "core-plugins",
-    crate_name = "codex_core_plugins",
     compile_data = glob(
         include = ["**"],
+        allow_empty = True,
         exclude = [
             "**/* *",
             "BUILD.bazel",
             "Cargo.toml",
         ],
-        allow_empty = True,
     ),
+    crate_name = "codex_core_plugins",
 )
diff --git a/codex-rs/core-skills/BUILD.bazel b/codex-rs/core-skills/BUILD.bazel
index e80412a55..77c4253e7 100644
--- a/codex-rs/core-skills/BUILD.bazel
+++ b/codex-rs/core-skills/BUILD.bazel
@@ -2,14 +2,14 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "core-skills",
-    crate_name = "codex_core_skills",
     compile_data = glob(
         include = ["**"],
+        allow_empty = True,
         exclude = [
             "**/* *",
             "BUILD.bazel",
             "Cargo.toml",
         ],
-        allow_empty = True,
     ),
+    crate_name = "codex_core_skills",
 )
diff --git a/codex-rs/core/BUILD.bazel b/codex-rs/core/BUILD.bazel
index 478699c0a..34c2396da 100644
--- a/codex-rs/core/BUILD.bazel
+++ b/codex-rs/core/BUILD.bazel
@@ -2,22 +2,31 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "core",
-    crate_name = "codex_core",
     compile_data = glob(
         include = ["**"],
+        allow_empty = True,
         exclude = [
             "**/* *",
             "BUILD.bazel",
             "Cargo.toml",
         ],
-        allow_empty = True,
     ),
+    crate_name = "codex_core",
+    extra_binaries = [
+        "//codex-rs/bwrap:bwrap",
+        "//codex-rs/linux-sandbox:codex-linux-sandbox",
+        "//codex-rs/rmcp-client:test_stdio_server",
+        "//codex-rs/rmcp-client:test_streamable_http_server",
+        "//codex-rs/cli:codex",
+        "//codex-rs/windows-sandbox-rs:codex-command-runner",
+        "//codex-rs/windows-sandbox-rs:codex-windows-sandbox-setup",
+    ],
+    integration_test_timeout = "long",
     rustc_env = {
         # Keep manifest-root path lookups inside the Bazel execroot for code
         # that relies on env!("CARGO_MANIFEST_DIR").
         "CARGO_MANIFEST_DIR": "codex-rs/core",
     },
-    integration_test_timeout = "long",
     test_data_extra = [
         "config.schema.json",
     ] + glob([
@@ -39,13 +48,4 @@ codex_rust_crate(
     },
     test_tags = ["no-sandbox"],
     unit_test_timeout = "long",
-    extra_binaries = [
-        "//codex-rs/bwrap:bwrap",
-        "//codex-rs/linux-sandbox:codex-linux-sandbox",
-        "//codex-rs/rmcp-client:test_stdio_server",
-        "//codex-rs/rmcp-client:test_streamable_http_server",
-        "//codex-rs/cli:codex",
-        "//codex-rs/windows-sandbox-rs:codex-command-runner",
-        "//codex-rs/windows-sandbox-rs:codex-windows-sandbox-setup",
-    ],
 )
diff --git a/codex-rs/exec-server/BUILD.bazel b/codex-rs/exec-server/BUILD.bazel
index e94a5c004..3a5928189 100644
--- a/codex-rs/exec-server/BUILD.bazel
+++ b/codex-rs/exec-server/BUILD.bazel
@@ -6,15 +6,15 @@ codex_rust_crate(
     deps_extra = [
         "@crates//:toml",
     ],
+    extra_binaries = [
+        "//codex-rs/bwrap:bwrap",
+    ],
+    integration_compile_data_extra = [
+        "src/proto/codex.exec_server.relay.v1.rs",
+    ],
     # Keep the crate's integration tests single-threaded under Bazel because
     # they install process-global test-binary dispatch state, and the remote
     # exec-server cases already rely on serialization around the full CLI path.
     integration_test_args = ["--test-threads=1"],
-    integration_compile_data_extra = [
-        "src/proto/codex.exec_server.relay.v1.rs",
-    ],
-    extra_binaries = [
-        "//codex-rs/bwrap:bwrap",
-    ],
     test_tags = ["no-sandbox"],
 )
diff --git a/codex-rs/execpolicy-legacy/BUILD.bazel b/codex-rs/execpolicy-legacy/BUILD.bazel
index 489288472..28011553b 100644
--- a/codex-rs/execpolicy-legacy/BUILD.bazel
+++ b/codex-rs/execpolicy-legacy/BUILD.bazel
@@ -2,6 +2,6 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "execpolicy-legacy",
-    crate_name = "codex_execpolicy_legacy",
     compile_data = ["src/default.policy"],
+    crate_name = "codex_execpolicy_legacy",
 )
diff --git a/codex-rs/ext/goal/BUILD.bazel b/codex-rs/ext/goal/BUILD.bazel
index e13276ddd..42f2d430e 100644
--- a/codex-rs/ext/goal/BUILD.bazel
+++ b/codex-rs/ext/goal/BUILD.bazel
@@ -2,9 +2,9 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "goal",
-    crate_name = "codex_goal_extension",
     compile_data = glob([
         "templates/**",
     ]),
+    crate_name = "codex_goal_extension",
     integration_compile_data_extra = ["src/accounting.rs"],
 )
diff --git a/codex-rs/ext/image-generation/BUILD.bazel b/codex-rs/ext/image-generation/BUILD.bazel
index 5ed05a5dc..97698380e 100644
--- a/codex-rs/ext/image-generation/BUILD.bazel
+++ b/codex-rs/ext/image-generation/BUILD.bazel
@@ -2,8 +2,8 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "image-generation",
-    crate_name = "codex_image_generation_extension",
     compile_data = [
         "imagegen_description.md",
     ],
+    crate_name = "codex_image_generation_extension",
 )
diff --git a/codex-rs/ext/memories/BUILD.bazel b/codex-rs/ext/memories/BUILD.bazel
index 0d9e20695..20aaa11bc 100644
--- a/codex-rs/ext/memories/BUILD.bazel
+++ b/codex-rs/ext/memories/BUILD.bazel
@@ -2,8 +2,8 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "memories",
-    crate_name = "codex_memories_extension",
     compile_data = glob([
         "templates/**",
     ]),
+    crate_name = "codex_memories_extension",
 )
diff --git a/codex-rs/ext/web-search/BUILD.bazel b/codex-rs/ext/web-search/BUILD.bazel
index e8c26644f..d905d529b 100644
--- a/codex-rs/ext/web-search/BUILD.bazel
+++ b/codex-rs/ext/web-search/BUILD.bazel
@@ -2,8 +2,8 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "web-search",
-    crate_name = "codex_web_search_extension",
     compile_data = [
         "web_run_description.md",
     ],
+    crate_name = "codex_web_search_extension",
 )
diff --git a/codex-rs/features/BUILD.bazel b/codex-rs/features/BUILD.bazel
index c67f572ee..09c03d68e 100644
--- a/codex-rs/features/BUILD.bazel
+++ b/codex-rs/features/BUILD.bazel
@@ -2,13 +2,13 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "features",
-    crate_name = "codex_features",
     compile_data = glob(
         include = ["**"],
+        allow_empty = True,
         exclude = [
             "BUILD.bazel",
             "Cargo.toml",
         ],
-        allow_empty = True,
     ),
+    crate_name = "codex_features",
 )
diff --git a/codex-rs/hooks/BUILD.bazel b/codex-rs/hooks/BUILD.bazel
index 8afd0d9fe..aaf7459da 100644
--- a/codex-rs/hooks/BUILD.bazel
+++ b/codex-rs/hooks/BUILD.bazel
@@ -1,11 +1,14 @@
 load("//:defs.bzl", "codex_rust_crate")
 
-SCHEMA_FIXTURES = glob(["schema/generated/*.json"], allow_empty = False)
+SCHEMA_FIXTURES = glob(
+    ["schema/generated/*.json"],
+    allow_empty = False,
+)
 
 codex_rust_crate(
     name = "hooks",
-    crate_name = "codex_hooks",
     compile_data = SCHEMA_FIXTURES,
+    crate_name = "codex_hooks",
     integration_compile_data_extra = SCHEMA_FIXTURES,
     test_data_extra = SCHEMA_FIXTURES,
 )
diff --git a/codex-rs/login/BUILD.bazel b/codex-rs/login/BUILD.bazel
index 1265a8377..42c5385c5 100644
--- a/codex-rs/login/BUILD.bazel
+++ b/codex-rs/login/BUILD.bazel
@@ -2,10 +2,10 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "login",
-    crate_name = "codex_login",
     compile_data = [
         "src/assets/error.html",
         "src/assets/success.html",
         "src/assets/success_legacy.html",
     ],
+    crate_name = "codex_login",
 )
diff --git a/codex-rs/memories/write/BUILD.bazel b/codex-rs/memories/write/BUILD.bazel
index 9e9029594..8670512e1 100644
--- a/codex-rs/memories/write/BUILD.bazel
+++ b/codex-rs/memories/write/BUILD.bazel
@@ -2,8 +2,8 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "write",
-    crate_name = "codex_memories_write",
     compile_data = glob([
         "templates/**",
     ]),
+    crate_name = "codex_memories_write",
 )
diff --git a/codex-rs/models-manager/BUILD.bazel b/codex-rs/models-manager/BUILD.bazel
index 17be8aeda..584b00056 100644
--- a/codex-rs/models-manager/BUILD.bazel
+++ b/codex-rs/models-manager/BUILD.bazel
@@ -2,9 +2,9 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "models-manager",
-    crate_name = "codex_models_manager",
     compile_data = [
         "models.json",
         "prompt.md",
     ],
+    crate_name = "codex_models_manager",
 )
diff --git a/codex-rs/plugin/BUILD.bazel b/codex-rs/plugin/BUILD.bazel
index 292606ff0..d3474aafb 100644
--- a/codex-rs/plugin/BUILD.bazel
+++ b/codex-rs/plugin/BUILD.bazel
@@ -2,14 +2,14 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "plugin",
-    crate_name = "codex_plugin",
     compile_data = glob(
         include = ["**"],
+        allow_empty = True,
         exclude = [
             "**/* *",
             "BUILD.bazel",
             "Cargo.toml",
         ],
-        allow_empty = True,
     ),
+    crate_name = "codex_plugin",
 )
diff --git a/codex-rs/prompts/BUILD.bazel b/codex-rs/prompts/BUILD.bazel
index d978048ec..4689baafa 100644
--- a/codex-rs/prompts/BUILD.bazel
+++ b/codex-rs/prompts/BUILD.bazel
@@ -2,6 +2,6 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "prompts",
-    crate_name = "codex_prompts",
     compile_data = glob(["templates/**"]),
+    crate_name = "codex_prompts",
 )
diff --git a/codex-rs/protocol/BUILD.bazel b/codex-rs/protocol/BUILD.bazel
index e47bc8c16..105843851 100644
--- a/codex-rs/protocol/BUILD.bazel
+++ b/codex-rs/protocol/BUILD.bazel
@@ -2,6 +2,6 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "protocol",
-    crate_name = "codex_protocol",
     compile_data = glob(["src/prompts/**/*.md"]),
+    crate_name = "codex_protocol",
 )
diff --git a/codex-rs/sandboxing/BUILD.bazel b/codex-rs/sandboxing/BUILD.bazel
index 57837fa80..9c3ce6344 100644
--- a/codex-rs/sandboxing/BUILD.bazel
+++ b/codex-rs/sandboxing/BUILD.bazel
@@ -2,10 +2,10 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "sandboxing",
-    crate_name = "codex_sandboxing",
     compile_data = [
         "src/restricted_read_only_platform_defaults.sbpl",
         "src/seatbelt_base_policy.sbpl",
         "src/seatbelt_network_policy.sbpl",
     ],
+    crate_name = "codex_sandboxing",
 )
diff --git a/codex-rs/shell-command/BUILD.bazel b/codex-rs/shell-command/BUILD.bazel
index 41f2f53f3..9eaa1377a 100644
--- a/codex-rs/shell-command/BUILD.bazel
+++ b/codex-rs/shell-command/BUILD.bazel
@@ -2,6 +2,6 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "shell-command",
-    crate_name = "codex_shell_command",
     compile_data = ["src/command_safety/powershell_parser.ps1"],
+    crate_name = "codex_shell_command",
 )
diff --git a/codex-rs/skills/BUILD.bazel b/codex-rs/skills/BUILD.bazel
index 1c3fc1695..d4c5ad267 100644
--- a/codex-rs/skills/BUILD.bazel
+++ b/codex-rs/skills/BUILD.bazel
@@ -2,14 +2,14 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "skills",
-    crate_name = "codex_skills",
     compile_data = glob(
         include = ["**"],
+        allow_empty = True,
         exclude = [
             "**/* *",
             "BUILD.bazel",
             "Cargo.toml",
         ],
-        allow_empty = True,
     ),
+    crate_name = "codex_skills",
 )
diff --git a/codex-rs/state/BUILD.bazel b/codex-rs/state/BUILD.bazel
index 9225b6c12..8b7c454fd 100644
--- a/codex-rs/state/BUILD.bazel
+++ b/codex-rs/state/BUILD.bazel
@@ -2,11 +2,11 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "state",
-    crate_name = "codex_state",
     compile_data = glob([
         "goals_migrations/**",
         "logs_migrations/**",
         "memory_migrations/**",
         "migrations/**",
     ]),
+    crate_name = "codex_state",
 )
diff --git a/codex-rs/tui/BUILD.bazel b/codex-rs/tui/BUILD.bazel
index 07495c430..297a038ff 100644
--- a/codex-rs/tui/BUILD.bazel
+++ b/codex-rs/tui/BUILD.bazel
@@ -2,28 +2,28 @@ load("//:defs.bzl", "MACOS_WEBRTC_RUSTC_LINK_FLAGS", "codex_rust_crate")
 
 codex_rust_crate(
     name = "tui",
-    crate_name = "codex_tui",
     compile_data = glob(
         include = ["**"],
+        allow_empty = True,
         exclude = [
             "**/* *",
             "BUILD.bazel",
             "Cargo.toml",
         ],
-        allow_empty = True,
     ) + [
         "//codex-rs/collaboration-mode-templates:templates/default.md",
         "//codex-rs/collaboration-mode-templates:templates/plan.md",
     ],
+    crate_name = "codex_tui",
+    extra_binaries = [
+        "//codex-rs/cli:codex",
+    ],
+    integration_compile_data_extra = ["src/test_backend.rs"],
+    rustc_flags_extra = MACOS_WEBRTC_RUSTC_LINK_FLAGS,
     test_data_extra = glob([
         "src/**/*.rs",
         "src/**/snapshots/**",
     ]),
-    integration_compile_data_extra = ["src/test_backend.rs"],
-    extra_binaries = [
-        "//codex-rs/cli:codex",
-    ],
-    rustc_flags_extra = MACOS_WEBRTC_RUSTC_LINK_FLAGS,
     test_shard_counts = {
         "tui-unit-tests": 8,
     },
diff --git a/codex-rs/utils/cargo-bin/BUILD.bazel b/codex-rs/utils/cargo-bin/BUILD.bazel
index 273ebd90d..e4a96f5b6 100644
--- a/codex-rs/utils/cargo-bin/BUILD.bazel
+++ b/codex-rs/utils/cargo-bin/BUILD.bazel
@@ -7,11 +7,11 @@ exports_files(
 
 codex_rust_crate(
     name = "cargo-bin",
-    crate_name = "codex_utils_cargo_bin",
     compile_data = ["repo_root.marker"],
+    crate_name = "codex_utils_cargo_bin",
     lib_data_extra = ["repo_root.marker"],
-    test_data_extra = ["repo_root.marker"],
     rustc_env = {
         "CODEX_REPO_ROOT_MARKER": "$(rlocationpath :repo_root.marker)",
     },
+    test_data_extra = ["repo_root.marker"],
 )
diff --git a/codex-rs/v8-poc/BUILD.bazel b/codex-rs/v8-poc/BUILD.bazel
index 05a46451a..a1e875c5d 100644
--- a/codex-rs/v8-poc/BUILD.bazel
+++ b/codex-rs/v8-poc/BUILD.bazel
@@ -2,11 +2,11 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "v8-poc",
-    crate_name = "codex_v8_poc",
     crate_features = select({
         "@rules_rs//rs/experimental/platforms/constraints:windows_msvc": [],
         "//conditions:default": ["sandbox"],
     }),
+    crate_name = "codex_v8_poc",
     deps_extra = ["@crates//:v8"],
 )
 
diff --git a/codex-rs/vendor/BUILD.bazel b/codex-rs/vendor/BUILD.bazel
index a36bfbad0..325b5d35b 100644
--- a/codex-rs/vendor/BUILD.bazel
+++ b/codex-rs/vendor/BUILD.bazel
@@ -12,6 +12,9 @@ filegroup(
 
 filegroup(
     name = "bubblewrap_sources",
-    srcs = [":bubblewrap_c_sources", ":bubblewrap_headers"],
+    srcs = [
+        ":bubblewrap_c_sources",
+        ":bubblewrap_headers",
+    ],
     visibility = ["//visibility:public"],
 )
diff --git a/codex-rs/windows-sandbox-rs/BUILD.bazel b/codex-rs/windows-sandbox-rs/BUILD.bazel
index 7e0de41ec..cb701594c 100644
--- a/codex-rs/windows-sandbox-rs/BUILD.bazel
+++ b/codex-rs/windows-sandbox-rs/BUILD.bazel
@@ -2,8 +2,8 @@ load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "windows-sandbox-rs",
-    crate_name = "codex_windows_sandbox",
     build_script_data = [
         "codex-windows-sandbox-setup.manifest",
     ],
+    crate_name = "codex_windows_sandbox",
 )
diff --git a/docs/install.md b/docs/install.md
index 2cd2cbe5c..4f63765b5 100644
--- a/docs/install.md
+++ b/docs/install.md
@@ -26,6 +26,8 @@ rustup component add rustfmt
 rustup component add clippy
 # Install helper tools used by the workspace justfile:
 cargo install --locked just
+# DotSlash fetches pinned development tools such as buildifier on first use.
+cargo install --locked dotslash
 # Install nextest for the `just test` helper.
 cargo install --locked cargo-nextest
 
diff --git a/justfile b/justfile
index fa32a19e7..560fb1c22 100644
--- a/justfile
+++ b/justfile
@@ -36,7 +36,7 @@ app-server-test-client *args:
     cargo build -p codex-cli
     cargo run -p codex-app-server-test-client -- --codex-bin ./target/debug/codex {args}
 
-# Format the justfile, Rust, Python SDK code, and Python scripts.
+# Format the justfile, Rust, Bazel/Starlark, Python SDK code, and Python scripts.
 fmt:
     {{ python }} ../scripts/format.py
 
diff --git a/rbe.bzl b/rbe.bzl
index a634731ca..57e301ac7 100644
--- a/rbe.bzl
+++ b/rbe.bzl
@@ -31,10 +31,10 @@ platform(
     visibility = ["//visibility:public"],
 )
 """.format(
-    cpu = cpu,
-    arch = exec_arch,
-    image_sha = image_sha
-))
+        cpu = cpu,
+        arch = exec_arch,
+        image_sha = image_sha,
+    ))
 
 rbe_platform_repository = repository_rule(
     implementation = _rbe_platform_repo_impl,
diff --git a/scripts/format.py b/scripts/format.py
index 69bdb5e36..6fa5aab69 100644
--- a/scripts/format.py
+++ b/scripts/format.py
@@ -2,6 +2,7 @@
 """Format repository sources or check that they are already formatted."""
 
 import argparse
+import os
 import shlex
 import subprocess
 import sys
@@ -11,7 +12,6 @@ from pathlib import Path
 
 
 REPO_ROOT = Path(__file__).resolve().parents[1]
-CODEX_RS_ROOT = REPO_ROOT / "codex-rs"
 
 
 @dataclass(frozen=True)
@@ -34,11 +34,62 @@ class FormatterResult:
     returncode: int
 
 
-def formatter_groups(*, check: bool) -> tuple[FormatterGroup, ...]:
-    just_args = ["just", "--unstable", "--fmt"]
-    cargo_args = ["cargo", "fmt", "--", "--config", "imports_granularity=Item"]
+def just_formatter_group(*, check: bool) -> FormatterGroup:
+    args = ["just", "--unstable", "--fmt"]
+    if check:
+        args.append("--check")
+    return FormatterGroup("Just", (Command(tuple(args)),))
+
+
+def rust_formatter_group(*, check: bool) -> FormatterGroup:
+    args = ["cargo", "fmt", "--", "--config", "imports_granularity=Item"]
+    if check:
+        args.append("--check")
+    # Stable rustfmt repeats a nightly-only `imports_granularity` warning
+    # for each crate, so suppress that expected stderr noise.
+    command = Command(
+        tuple(args),
+        REPO_ROOT / "codex-rs",
+        discard_stderr=True,
+    )
+    return FormatterGroup("Rust", (command,))
+
+
+def buildifier_formatter_group(*, check: bool) -> FormatterGroup:
+    repository_files = subprocess.check_output(
+        ["git", "ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+        cwd=REPO_ROOT,
+    ).split(b"\0")
+    buildifier_files: list[str] = []
+    for encoded_path in repository_files:
+        if not encoded_path:
+            continue
+        path = Path(os.fsdecode(encoded_path))
+        name = path.name
+        if (
+            name in {"BUILD", "WORKSPACE", "MODULE.bazel"}
+            or name.startswith(("BUILD.", "WORKSPACE."))
+            or name.endswith((".BUILD.bazel", ".MODULE.bazel", ".bzl", ".sky"))
+            or ".bzl." in name
+            or ".sky." in name
+        ):
+            buildifier_files.append(path.as_posix())
+    buildifier_files.sort()
+
+    # Invoke DotSlash explicitly because Windows does not honor shebangs.
+    buildifier_args = [
+        "dotslash",
+        str(REPO_ROOT / "tools" / "buildifier"),
+        "-mode=check" if check else "-mode=fix",
+        "-lint=off",
+        *buildifier_files,
+    ]
+    return FormatterGroup("Bazel/Starlark", (Command(tuple(buildifier_args)),))
+
+
+def python_sdk_formatter_group(*, check: bool) -> FormatterGroup:
     # Each `--project` retains its local dependency and Ruff configuration context.
-    sdk_uv_run_args = [
+    uv_run_args = [
         "uv",
         "run",
         "--frozen",
@@ -47,66 +98,55 @@ def formatter_groups(*, check: bool) -> tuple[FormatterGroup, ...]:
         "--only-group",
         "format",
     ]
-    scripts_uv_run_args = [
+    format_args = [
+        *uv_run_args,
+        "ruff",
+        "format",
+    ]
+    if check:
+        format_args.append("--check")
+        # `ruff check --diff` reports lint-driven rewrites without changing files.
+        # It is the check-mode counterpart of `--fix --fix-only`, not a full lint gate.
+        lint_args = ["ruff", "check", "--diff"]
+    else:
+        # Ruff's lint fixer and formatter are separate passes: the first applies
+        # fixable lint rewrites, while the second formats source layout.
+        lint_args = ["ruff", "check", "--fix", "--fix-only"]
+
+    return FormatterGroup(
+        "Python SDK",
+        (
+            Command((*uv_run_args, *lint_args, "sdk/python")),
+            Command((*format_args, "sdk/python")),
+        ),
+    )
+
+
+def python_scripts_formatter_group(*, check: bool) -> FormatterGroup:
+    # The SDK and internal scripts intentionally use separate project roots so
+    # uv and Ruff retain each project's configuration context.
+    args = [
         "uv",
         "run",
         "--frozen",
         "--project",
         "scripts",
-    ]
-    sdk_format_args = [
-        *sdk_uv_run_args,
         "ruff",
         "format",
     ]
-    scripts_format_args = [
-        *scripts_uv_run_args,
-        "ruff",
-        "format",
-    ]
-
     if check:
-        just_args.append("--check")
-        cargo_args.append("--check")
-        sdk_format_args.append("--check")
-        scripts_format_args.append("--check")
-        # `ruff check --diff` reports lint-driven rewrites without changing files.
-        # It is the check-mode counterpart of `--fix --fix-only`, not a full lint gate.
-        sdk_lint_args = ["ruff", "check", "--diff"]
-    else:
-        # Ruff's lint fixer and formatter are separate passes: the first applies
-        # fixable lint rewrites, while the second formats source layout.
-        sdk_lint_args = ["ruff", "check", "--fix", "--fix-only"]
+        args.append("--check")
+    args.append("scripts")
+    return FormatterGroup("Python scripts", (Command(tuple(args)),))
 
+
+def formatter_groups(*, check: bool) -> tuple[FormatterGroup, ...]:
     return (
-        FormatterGroup("Just", (Command(tuple(just_args)),)),
-        FormatterGroup(
-            "Rust",
-            # Stable rustfmt repeats a nightly-only `imports_granularity` warning
-            # for each crate, so suppress that expected stderr noise.
-            (Command(tuple(cargo_args), CODEX_RS_ROOT, discard_stderr=True),),
-        ),
-        FormatterGroup(
-            "Python SDK",
-            (
-                Command(
-                    (
-                        *sdk_uv_run_args,
-                        *sdk_lint_args,
-                        "sdk/python",
-                    )
-                ),
-                Command((*sdk_format_args, "sdk/python")),
-            ),
-        ),
-        FormatterGroup(
-            "Python scripts",
-            (
-                # The SDK and internal scripts intentionally use separate project
-                # roots so uv and Ruff retain each project's configuration context.
-                Command((*scripts_format_args, "scripts")),
-            ),
-        ),
+        just_formatter_group(check=check),
+        rust_formatter_group(check=check),
+        buildifier_formatter_group(check=check),
+        python_sdk_formatter_group(check=check),
+        python_scripts_formatter_group(check=check),
     )
 
 
diff --git a/sdk/python/tests/test_artifact_workflow_and_binaries.py b/sdk/python/tests/test_artifact_workflow_and_binaries.py
index 340d016ec..524260035 100644
--- a/sdk/python/tests/test_artifact_workflow_and_binaries.py
+++ b/sdk/python/tests/test_artifact_workflow_and_binaries.py
@@ -108,7 +108,9 @@ def test_root_fmt_recipes_use_shared_formatter_driver() -> None:
     }
     expected = {
         "working_directory": 'set working-directory := "codex-rs"',
-        "fmt_comment": "# Format the justfile, Rust, Python SDK code, and Python scripts.",
+        "fmt_comment": (
+            "# Format the justfile, Rust, Bazel/Starlark, Python SDK code, and Python scripts."
+        ),
         "fmt_commands": ["{{ python }} ../scripts/format.py"],
         "fmt_check_comment": "# Check formatting without modifying files.",
         "fmt_check_commands": ["{{ python }} ../scripts/format.py --check"],
@@ -122,20 +124,38 @@ def test_root_fmt_recipes_use_shared_formatter_driver() -> None:
     )
 
 
-def test_root_format_driver_covers_all_formatter_groups() -> None:
+def test_root_format_driver_covers_all_formatter_groups(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
     """The shared driver should retain every formatter in both modes."""
     script = _load_root_format_script_module()
+    git_ls_files_args = [
+        "git",
+        "ls-files",
+        "-z",
+        "--cached",
+        "--others",
+        "--exclude-standard",
+    ]
+
+    def fake_check_output(args, *, cwd):
+        assert args == git_ls_files_args
+        assert cwd == script.REPO_ROOT
+        return b"MODULE.bazel\0README.md\0third_party/v8/libcxx.BUILD.bazel\0"
+
+    monkeypatch.setattr(script.subprocess, "check_output", fake_check_output)
     formatters = script.formatter_groups(check=False)
     checks = script.formatter_groups(check=True)
 
     assert [group.name for group in formatters] == [
         "Just",
         "Rust",
+        "Bazel/Starlark",
         "Python SDK",
         "Python scripts",
     ]
     assert [group.name for group in checks] == [group.name for group in formatters]
-    assert [len(group.commands) for group in formatters] == [1, 1, 2, 1]
+    assert [len(group.commands) for group in formatters] == [1, 1, 1, 2, 1]
     assert [len(group.commands) for group in checks] == [
         len(group.commands) for group in formatters
     ]
@@ -157,22 +177,22 @@ def test_root_format_driver_covers_all_formatter_groups() -> None:
     )
     assert all(
         command.args[: len(sdk_uv_run_args)] == sdk_uv_run_args
-        for group in (formatters[2], checks[2])
+        for group in (formatters[3], checks[3])
         for command in group.commands
     )
     assert all(
         command.args[: len(scripts_uv_run_args)] == scripts_uv_run_args
-        for group in (formatters[3], checks[3])
+        for group in (formatters[4], checks[4])
         for command in group.commands
     )
-    assert formatters[2].commands[0].args[-5:] == (
+    assert formatters[3].commands[0].args[-5:] == (
         "ruff",
         "check",
         "--fix",
         "--fix-only",
         "sdk/python",
     )
-    assert checks[2].commands[0].args[-4:] == (
+    assert checks[3].commands[0].args[-4:] == (
         "ruff",
         "check",
         "--diff",
@@ -195,11 +215,30 @@ def test_root_format_driver_covers_all_formatter_groups() -> None:
         "imports_granularity=Item",
         "--check",
     )
-    assert [group.commands[-1].args[-3:] for group in formatters[2:]] == [
+    format_buildifier_args = formatters[2].commands[-1].args
+    check_buildifier_args = checks[2].commands[-1].args
+    assert format_buildifier_args[:4] == (
+        "dotslash",
+        str(script.REPO_ROOT / "tools" / "buildifier"),
+        "-mode=fix",
+        "-lint=off",
+    )
+    assert check_buildifier_args[:4] == (
+        "dotslash",
+        str(script.REPO_ROOT / "tools" / "buildifier"),
+        "-mode=check",
+        "-lint=off",
+    )
+    assert format_buildifier_args[4:] == check_buildifier_args[4:]
+    assert format_buildifier_args[4:] == (
+        "MODULE.bazel",
+        "third_party/v8/libcxx.BUILD.bazel",
+    )
+    assert [group.commands[-1].args[-3:] for group in formatters[3:]] == [
         ("ruff", "format", "sdk/python"),
         ("ruff", "format", "scripts"),
     ]
-    assert [group.commands[-1].args[-4:] for group in checks[2:]] == [
+    assert [group.commands[-1].args[-4:] for group in checks[3:]] == [
         ("ruff", "format", "--check", "sdk/python"),
         ("ruff", "format", "--check", "scripts"),
     ]
diff --git a/third_party/v8/BUILD.bazel b/third_party/v8/BUILD.bazel
index 425d81ea8..4edad4273 100644
--- a/third_party/v8/BUILD.bazel
+++ b/third_party/v8/BUILD.bazel
@@ -145,20 +145,20 @@ cc_library(
         ":platform_x86_64_unknown_linux_musl": ["ANDROID_HOST_MUSL"],
         "//conditions:default": [],
     }),
+    visibility = ["//visibility:public"],
     deps = [
         "@rusty_v8_libcxx//:headers",
         "@rusty_v8_libcxxabi//:headers",
     ],
-    visibility = ["//visibility:public"],
 )
 
 cc_library(
     name = "rusty_v8_custom_libcxx_runtime",
+    visibility = ["//visibility:public"],
     deps = [
         "@rusty_v8_libcxx//:libcxx",
         "@rusty_v8_libcxxabi//:libcxxabi",
     ],
-    visibility = ["//visibility:public"],
 )
 
 genrule(
@@ -262,44 +262,44 @@ cc_library(
 
 cc_static_library(
     name = "v8_146_4_0_aarch64_apple_darwin_bazel",
-    deps = [":v8_146_4_0_binding"],
     features = V8_STATIC_LIBRARY_FEATURES,
+    deps = [":v8_146_4_0_binding"],
 )
 
 cc_static_library(
     name = "v8_146_4_0_aarch64_unknown_linux_gnu_bazel",
-    deps = [":v8_146_4_0_binding"],
     features = V8_STATIC_LIBRARY_FEATURES,
+    deps = [":v8_146_4_0_binding"],
 )
 
 cc_static_library(
     name = "v8_146_4_0_aarch64_pc_windows_gnullvm_bazel",
-    deps = [":v8_146_4_0_binding"],
     features = V8_STATIC_LIBRARY_FEATURES,
+    deps = [":v8_146_4_0_binding"],
 )
 
 cc_static_library(
     name = "v8_146_4_0_x86_64_apple_darwin_bazel",
-    deps = [":v8_146_4_0_binding"],
     features = V8_STATIC_LIBRARY_FEATURES,
+    deps = [":v8_146_4_0_binding"],
 )
 
 cc_static_library(
     name = "v8_146_4_0_x86_64_pc_windows_gnullvm_bazel",
-    deps = [":v8_146_4_0_binding"],
     features = V8_STATIC_LIBRARY_FEATURES,
+    deps = [":v8_146_4_0_binding"],
 )
 
 cc_static_library(
     name = "v8_146_4_0_x86_64_unknown_linux_gnu_bazel",
-    deps = [":v8_146_4_0_binding"],
     features = V8_STATIC_LIBRARY_FEATURES,
+    deps = [":v8_146_4_0_binding"],
 )
 
 cc_static_library(
     name = "v8_146_4_0_aarch64_unknown_linux_musl_release_base",
-    deps = [":v8_146_4_0_binding"],
     features = V8_STATIC_LIBRARY_FEATURES,
+    deps = [":v8_146_4_0_binding"],
 )
 
 genrule(
@@ -308,10 +308,6 @@ genrule(
         ":v8_146_4_0_aarch64_unknown_linux_musl_release_base",
         "@llvm//runtimes/compiler-rt:clang_rt.builtins.static",
     ],
-    tools = [
-        "@llvm//tools:llvm-ar",
-        "@llvm//tools:llvm-ranlib",
-    ],
     outs = ["libv8_146_4_0_aarch64_unknown_linux_musl.a"],
     cmd = """
       cat > "$(@D)/merge.mri" <<'EOF'
@@ -324,12 +320,16 @@ EOF
       $(location @llvm//tools:llvm-ar) -M < "$(@D)/merge.mri"
       $(location @llvm//tools:llvm-ranlib) "$@"
     """,
+    tools = [
+        "@llvm//tools:llvm-ar",
+        "@llvm//tools:llvm-ranlib",
+    ],
 )
 
 cc_static_library(
     name = "v8_146_4_0_x86_64_unknown_linux_musl_release",
-    deps = [":v8_146_4_0_binding"],
     features = V8_STATIC_LIBRARY_FEATURES,
+    deps = [":v8_146_4_0_binding"],
 )
 
 filegroup(
@@ -344,35 +344,35 @@ filegroup(
 
 cc_static_library(
     name = "v8_149_2_0_aarch64_apple_darwin_bazel",
+    features = V8_STATIC_LIBRARY_FEATURES,
     deps = [
         ":rusty_v8_custom_libcxx_runtime",
         ":v8_149_2_0_binding",
     ],
-    features = V8_STATIC_LIBRARY_FEATURES,
 )
 
 cc_static_library(
     name = "v8_149_2_0_aarch64_unknown_linux_gnu_bazel",
+    features = V8_STATIC_LIBRARY_FEATURES,
     deps = [
         ":rusty_v8_custom_libcxx_runtime",
         ":v8_149_2_0_binding",
     ],
-    features = V8_STATIC_LIBRARY_FEATURES,
 )
 
 cc_static_library(
     name = "v8_149_2_0_aarch64_pc_windows_gnullvm_bazel",
-    deps = [":v8_149_2_0_binding"],
     features = V8_STATIC_LIBRARY_FEATURES,
+    deps = [":v8_149_2_0_binding"],
 )
 
 cc_static_library(
     name = "v8_149_2_0_aarch64_unknown_linux_musl_release_base",
+    features = V8_STATIC_LIBRARY_FEATURES,
     deps = [
         ":rusty_v8_custom_libcxx_runtime",
         ":v8_149_2_0_binding",
     ],
-    features = V8_STATIC_LIBRARY_FEATURES,
 )
 
 genrule(
@@ -381,10 +381,6 @@ genrule(
         ":v8_149_2_0_aarch64_unknown_linux_musl_release_base",
         "@llvm//runtimes/compiler-rt:clang_rt.builtins.static",
     ],
-    tools = [
-        "@llvm//tools:llvm-ar",
-        "@llvm//tools:llvm-ranlib",
-    ],
     outs = ["libv8_149_2_0_aarch64_unknown_linux_musl.a"],
     cmd = """
       cat > "$(@D)/merge.mri" <<'EOF'
@@ -397,39 +393,43 @@ EOF
       $(location @llvm//tools:llvm-ar) -M < "$(@D)/merge.mri"
       $(location @llvm//tools:llvm-ranlib) "$@"
     """,
+    tools = [
+        "@llvm//tools:llvm-ar",
+        "@llvm//tools:llvm-ranlib",
+    ],
 )
 
 cc_static_library(
     name = "v8_149_2_0_x86_64_apple_darwin_bazel",
+    features = V8_STATIC_LIBRARY_FEATURES,
     deps = [
         ":rusty_v8_custom_libcxx_runtime",
         ":v8_149_2_0_binding",
     ],
-    features = V8_STATIC_LIBRARY_FEATURES,
 )
 
 cc_static_library(
     name = "v8_149_2_0_x86_64_unknown_linux_gnu_bazel",
+    features = V8_STATIC_LIBRARY_FEATURES,
     deps = [
         ":rusty_v8_custom_libcxx_runtime",
         ":v8_149_2_0_binding",
     ],
-    features = V8_STATIC_LIBRARY_FEATURES,
 )
 
 cc_static_library(
     name = "v8_149_2_0_x86_64_pc_windows_gnullvm_bazel",
-    deps = [":v8_149_2_0_binding"],
     features = V8_STATIC_LIBRARY_FEATURES,
+    deps = [":v8_149_2_0_binding"],
 )
 
 cc_static_library(
     name = "v8_149_2_0_x86_64_unknown_linux_musl_release",
+    features = V8_STATIC_LIBRARY_FEATURES,
     deps = [
         ":rusty_v8_custom_libcxx_runtime",
         ":v8_149_2_0_binding",
     ],
-    features = V8_STATIC_LIBRARY_FEATURES,
 )
 
 filegroup(
@@ -475,111 +475,111 @@ filegroup(
 filegroup(
     name = "rusty_v8_release_pair_x86_64_apple_darwin",
     srcs = [
-        ":v8_149_2_0_x86_64_apple_darwin_bazel",
         ":src_binding_release_x86_64_apple_darwin_149_2_0_release",
+        ":v8_149_2_0_x86_64_apple_darwin_bazel",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_aarch64_apple_darwin",
     srcs = [
-        ":v8_149_2_0_aarch64_apple_darwin_bazel",
         ":src_binding_release_aarch64_apple_darwin_149_2_0_release",
+        ":v8_149_2_0_aarch64_apple_darwin_bazel",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_x86_64_unknown_linux_gnu",
     srcs = [
-        ":v8_149_2_0_x86_64_unknown_linux_gnu_bazel",
         ":src_binding_release_x86_64_unknown_linux_gnu_149_2_0_release",
+        ":v8_149_2_0_x86_64_unknown_linux_gnu_bazel",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_aarch64_unknown_linux_gnu",
     srcs = [
-        ":v8_149_2_0_aarch64_unknown_linux_gnu_bazel",
         ":src_binding_release_aarch64_unknown_linux_gnu_149_2_0_release",
+        ":v8_149_2_0_aarch64_unknown_linux_gnu_bazel",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_x86_64_unknown_linux_musl",
     srcs = [
-        ":v8_149_2_0_x86_64_unknown_linux_musl_release",
         ":src_binding_release_x86_64_unknown_linux_musl_149_2_0_release",
+        ":v8_149_2_0_x86_64_unknown_linux_musl_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_aarch64_unknown_linux_musl",
     srcs = [
-        ":v8_149_2_0_aarch64_unknown_linux_musl_release",
         ":src_binding_release_aarch64_unknown_linux_musl_149_2_0_release",
+        ":v8_149_2_0_aarch64_unknown_linux_musl_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_x86_64_pc_windows_msvc",
     srcs = [
-        ":v8_149_2_0_x86_64_pc_windows_msvc",
         ":src_binding_release_x86_64_pc_windows_msvc_149_2_0_release",
+        ":v8_149_2_0_x86_64_pc_windows_msvc",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_aarch64_pc_windows_msvc",
     srcs = [
-        ":v8_149_2_0_aarch64_pc_windows_msvc",
         ":src_binding_release_aarch64_pc_windows_msvc_149_2_0_release",
+        ":v8_149_2_0_aarch64_pc_windows_msvc",
     ],
 )
 
 filegroup(
     name = "rusty_v8_sandbox_release_pair_x86_64_apple_darwin",
     srcs = [
-        ":v8_149_2_0_x86_64_apple_darwin_bazel",
         ":src_binding_release_x86_64_apple_darwin_149_2_0_release",
+        ":v8_149_2_0_x86_64_apple_darwin_bazel",
     ],
 )
 
 filegroup(
     name = "rusty_v8_sandbox_release_pair_aarch64_apple_darwin",
     srcs = [
-        ":v8_149_2_0_aarch64_apple_darwin_bazel",
         ":src_binding_release_aarch64_apple_darwin_149_2_0_release",
+        ":v8_149_2_0_aarch64_apple_darwin_bazel",
     ],
 )
 
 filegroup(
     name = "rusty_v8_sandbox_release_pair_x86_64_unknown_linux_gnu",
     srcs = [
-        ":v8_149_2_0_x86_64_unknown_linux_gnu_bazel",
         ":src_binding_release_x86_64_unknown_linux_gnu_149_2_0_release",
+        ":v8_149_2_0_x86_64_unknown_linux_gnu_bazel",
     ],
 )
 
 filegroup(
     name = "rusty_v8_sandbox_release_pair_aarch64_unknown_linux_gnu",
     srcs = [
-        ":v8_149_2_0_aarch64_unknown_linux_gnu_bazel",
         ":src_binding_release_aarch64_unknown_linux_gnu_149_2_0_release",
+        ":v8_149_2_0_aarch64_unknown_linux_gnu_bazel",
     ],
 )
 
 filegroup(
     name = "rusty_v8_sandbox_release_pair_x86_64_unknown_linux_musl",
     srcs = [
-        ":v8_149_2_0_x86_64_unknown_linux_musl_release",
         ":src_binding_release_x86_64_unknown_linux_musl_149_2_0_release",
+        ":v8_149_2_0_x86_64_unknown_linux_musl_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_sandbox_release_pair_aarch64_unknown_linux_musl",
     srcs = [
-        ":v8_149_2_0_aarch64_unknown_linux_musl_release",
         ":src_binding_release_aarch64_unknown_linux_musl_149_2_0_release",
+        ":v8_149_2_0_aarch64_unknown_linux_musl_release",
     ],
 )
diff --git a/third_party/v8/libcxx.BUILD.bazel b/third_party/v8/libcxx.BUILD.bazel
index dd3f167df..aeff24a8e 100644
--- a/third_party/v8/libcxx.BUILD.bazel
+++ b/third_party/v8/libcxx.BUILD.bazel
@@ -1,5 +1,5 @@
-load("@rules_cc//cc:defs.bzl", "cc_library")
 load("@llvm//toolchain/runtimes:cc_runtime_library.bzl", "cc_runtime_stage0_library")
+load("@rules_cc//cc:defs.bzl", "cc_library")
 
 package(default_visibility = ["//visibility:public"])
 
@@ -135,7 +135,6 @@ cc_runtime_stage0_library(
         ],
         "//conditions:default": [],
     }),
-    includes = ["src"],
     implementation_deps = [
         ":headers",
         ":internal_headers",
@@ -155,4 +154,5 @@ cc_runtime_stage0_library(
         ],
         "//conditions:default": [],
     }),
+    includes = ["src"],
 )
diff --git a/third_party/v8/libcxxabi.BUILD.bazel b/third_party/v8/libcxxabi.BUILD.bazel
index 2afd6b76d..24e8ed5a6 100644
--- a/third_party/v8/libcxxabi.BUILD.bazel
+++ b/third_party/v8/libcxxabi.BUILD.bazel
@@ -1,5 +1,5 @@
-load("@rules_cc//cc:defs.bzl", "cc_library")
 load("@llvm//toolchain/runtimes:cc_runtime_library.bzl", "cc_runtime_stage0_library")
+load("@rules_cc//cc:defs.bzl", "cc_library")
 
 package(default_visibility = ["//visibility:public"])
 
@@ -42,11 +42,6 @@ cc_runtime_stage0_library(
         ":is_linux": ["src/cxa_thread_atexit.cpp"],
         "//conditions:default": [],
     }),
-    textual_hdrs = glob([
-        "src/**/*.def",
-        "src/**/*.h",
-        "src/**/*.inc",
-    ]),
     copts = [
         "-fexceptions",
         "-frtti",
@@ -76,12 +71,11 @@ cc_runtime_stage0_library(
         ],
         "//conditions:default": [],
     }),
-    includes = ["src"],
     implementation_deps = [
         ":headers",
+        "@//third_party/v8/libcxx_config:headers",
         "@rusty_v8_libcxx//:headers",
         "@rusty_v8_libcxx//:internal_headers",
-        "@//third_party/v8/libcxx_config:headers",
     ] + select({
         ":is_linux": [
             "@@llvm++kernel_headers+kernel_headers//:kernel_headers",
@@ -96,4 +90,10 @@ cc_runtime_stage0_library(
         ],
         "//conditions:default": [],
     }),
+    includes = ["src"],
+    textual_hdrs = glob([
+        "src/**/*.def",
+        "src/**/*.h",
+        "src/**/*.inc",
+    ]),
 )
diff --git a/tools/argument-comment-lint/BUILD.bazel b/tools/argument-comment-lint/BUILD.bazel
index 82d280e30..5d2695a80 100644
--- a/tools/argument-comment-lint/BUILD.bazel
+++ b/tools/argument-comment-lint/BUILD.bazel
@@ -4,29 +4,29 @@ exports_files(["lint_aspect.bzl"])
 
 rust_library(
     name = "argument-comment-lint-lib",
-    crate_name = "argument_comment_lint",
-    crate_features = ["bazel_native"],
-    crate_root = "src/lib.rs",
     srcs = [
         "src/comment_parser.rs",
         "src/lib.rs",
     ],
+    crate_features = ["bazel_native"],
+    crate_name = "argument_comment_lint",
+    crate_root = "src/lib.rs",
     edition = "2024",
-    deps = ["@argument_comment_lint_crates//:clippy_utils"],
     tags = ["manual"],
     visibility = ["//visibility:public"],
+    deps = ["@argument_comment_lint_crates//:clippy_utils"],
 )
 
 rust_binary(
     name = "argument-comment-lint-driver",
+    srcs = ["driver.rs"],
     crate_name = "argument_comment_lint_driver",
     crate_root = "driver.rs",
-    srcs = ["driver.rs"],
     edition = "2024",
+    tags = ["manual"],
+    visibility = ["//visibility:public"],
     deps = [
         ":argument-comment-lint-lib",
         "@zlib//:z",
     ],
-    tags = ["manual"],
-    visibility = ["//visibility:public"],
 )
diff --git a/tools/buildifier b/tools/buildifier
new file mode 100755
index 000000000..d18dd60ac
--- /dev/null
+++ b/tools/buildifier
@@ -0,0 +1,73 @@
+#!/usr/bin/env dotslash
+
+{
+  "name": "buildifier",
+  "platforms": {
+    "macos-aarch64": {
+      "size": 7565746,
+      "hash": "sha256",
+      "digest": "62836a9667fa0db309b0d91e840f0a3f2813a9c8ea3e44b9cd58187c90bc88ba",
+      "path": "buildifier",
+      "providers": [
+        {
+          "url": "https://github.com/bazelbuild/buildtools/releases/download/v8.5.1/buildifier-darwin-arm64"
+        }
+      ]
+    },
+    "macos-x86_64": {
+      "size": 7737072,
+      "hash": "sha256",
+      "digest": "31de189e1a3fe53aa9e8c8f74a0309c325274ad19793393919e1ca65163ca1a4",
+      "path": "buildifier",
+      "providers": [
+        {
+          "url": "https://github.com/bazelbuild/buildtools/releases/download/v8.5.1/buildifier-darwin-amd64"
+        }
+      ]
+    },
+    "linux-aarch64": {
+      "size": 7483831,
+      "hash": "sha256",
+      "digest": "947bf6700d708026b2057b09bea09abbc3cafc15d9ecea35bb3885c4b09ccd04",
+      "path": "buildifier",
+      "providers": [
+        {
+          "url": "https://github.com/bazelbuild/buildtools/releases/download/v8.5.1/buildifier-linux-arm64"
+        }
+      ]
+    },
+    "linux-x86_64": {
+      "size": 7757842,
+      "hash": "sha256",
+      "digest": "887377fc64d23a850f4d18a077b5db05b19913f4b99b270d193f3c7334b5a9a7",
+      "path": "buildifier",
+      "providers": [
+        {
+          "url": "https://github.com/bazelbuild/buildtools/releases/download/v8.5.1/buildifier-linux-amd64"
+        }
+      ]
+    },
+    "windows-aarch64": {
+      "size": 7451648,
+      "hash": "sha256",
+      "digest": "55a276ad8b1ff46be48bf64e432264034ea69a45aa3914e89c1d1936f5c2d85c",
+      "path": "buildifier.exe",
+      "providers": [
+        {
+          "url": "https://github.com/bazelbuild/buildtools/releases/download/v8.5.1/buildifier-windows-arm64.exe"
+        }
+      ]
+    },
+    "windows-x86_64": {
+      "size": 7861760,
+      "hash": "sha256",
+      "digest": "f4ecb9c73de2bc38b845d4ee27668f6248c4813a6647db4b4931a7556052e4e1",
+      "path": "buildifier.exe",
+      "providers": [
+        {
+          "url": "https://github.com/bazelbuild/buildtools/releases/download/v8.5.1/buildifier-windows-amd64.exe"
+        }
+      ]
+    }
+  }
+}