Configure Dependabot for WTA Rust dependencies

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/tools/wta"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "Asia/Shanghai"
+    open-pull-requests-limit: 5
+    groups:
+      wta-rust-minor-and-patch:
+        applies-to: "version-updates"
+        patterns:
+          - "*"
+        exclude-patterns:
+          - "agent-client-protocol*"
+        update-types:
+          - "minor"
+          - "patch"
+
+    # WTA statically links its Rust dependencies. Before merging an update,
+    # regenerate and commit tools/wta/cgmanifest.json and the WTA block in
+    # NOTICE.md with build/scripts/Generate-WtaThirdPartyNotices.ps1.

.github/instructions/rust-wta.instructions.md

@@ -11,16 +11,17 @@ The repo contains multiple Rust crates (e.g. `installer/bootstrap/`); this file'
 
 ## Toolchain & Build
 
-- **Toolchain is pinned.** `tools/wta/rust-toolchain.toml` pins the channel to `ms-prod-1.93` for CI reproducibility. Do not bump it casually.
+- **Toolchain is pinned.** `tools/wta/rust-toolchain.toml` pins the public channel to `1.93` for local development and GitHub automation. Azure DevOps explicitly overrides it with the matching `ms-prod-1.93` channel. Do not bump either version casually or let them drift.
 - **Static CRT on Windows.** The repo-root `.cargo/config.toml` forces `+crt-static` rustflags for all Windows MSVC targets (`x86_64`, `i686`, `aarch64`). Avoid dependencies that break under static CRT.
 - **Two supported build invocations — don't mix them.** Both of these are valid for WTA local dev:
 
   ```bash
-  cargo build --manifest-path tools/wta/Cargo.toml                              # host target (bare target/)
-  cargo build --target x86_64-pc-windows-msvc --manifest-path tools/wta/Cargo.toml   # explicit target
+  cd tools/wta
+  cargo build                                      # host target (bare target/)
+  cargo build --target x86_64-pc-windows-msvc     # explicit target
   ```
 
-  Pick one and stay with it within a single dev session. The `CascadiaPackage.wapproj` deploy step prefers `tools/wta/target/x86_64-pc-windows-msvc/<profile>/wta.exe` over the bare `tools/wta/target/<profile>/wta.exe`, so if you build once with `--target` and later iterate with plain `cargo build`, the wapproj will silently keep deploying the stale explicit-target binary. See `tools/wta/README.md` and `tools/wta/AGENTS.md` for the host-target workflow.
+  Run Cargo from `tools/wta` so rustup discovers `rust-toolchain.toml`. Pick one invocation and stay with it within a single dev session. The `CascadiaPackage.wapproj` deploy step prefers `tools/wta/target/x86_64-pc-windows-msvc/<profile>/wta.exe` over the bare `tools/wta/target/<profile>/wta.exe`, so if you build once with `--target` and later iterate with plain `cargo build`, the wapproj will silently keep deploying the stale explicit-target binary. See `tools/wta/README.md` and `tools/wta/AGENTS.md` for the host-target workflow.
 
 ## Localization
 
@@ -47,7 +48,6 @@ User-facing strings go through `t!(...)` (rust-i18n) — see `rust-localization.
 `tools/wta/cgmanifest.json` (Component Governance manifest) and the `<!-- BEGIN wta-rust-deps -->` block in `/NOTICE.md` are **generated** from `cargo metadata`. Whenever you change the dependency graph — add/remove/upgrade a direct dep in `tools/wta/Cargo.toml`, run a `cargo update` that substantially shifts `Cargo.lock`, or flip a feature flag that pulls in/drops transitive crates — regenerate both and commit the diff alongside the Cargo change:
 
 ```powershell
-$env:RUSTUP_TOOLCHAIN = 'stable'   # bypass the rust-toolchain.toml pin
 pwsh -File .\build\scripts\Generate-WtaThirdPartyNotices.ps1
 ```
 

.github/skills/add-acp-agent-support/references/validation.md

@@ -43,10 +43,12 @@ Add or update tests for:
 - invalid or empty delegate executable rejection;
 - policy filtering or settings serialization when those paths changed.
 
-Run the WTA suite from the repository root:
+Run the WTA suite from its crate directory so Cargo uses the pinned toolchain:
 
 ```powershell
-cargo test --manifest-path tools\wta\Cargo.toml
+Push-Location tools\wta
+cargo test
+Pop-Location
 ```
 
 Do not treat a successful build as a substitute for tests; WTA test-only code
@@ -59,7 +61,9 @@ Resolve and stop only the specific live WTA process IDs before rebuilding:
 ```powershell
 Get-Process wta -ErrorAction SilentlyContinue |
     ForEach-Object { Stop-Process -Id $_.Id -Force }
-cargo build --target x86_64-pc-windows-msvc --manifest-path tools\wta\Cargo.toml
+Push-Location tools\wta
+cargo build --target x86_64-pc-windows-msvc
+Pop-Location
 ```
 
 Always use the explicit target for a package-validation cycle because

.github/skills/wta-rust-dependency-update/SKILL.md

@@ -0,0 +1,109 @@
+---
+name: wta-rust-dependency-update
+description: 'Regenerate, review, test, and verify WTA Rust dependency updates and third-party attribution. Use when handling Dependabot PRs for /tools/wta, editing tools/wta/Cargo.toml or Cargo.lock, changing dependency features, finishing or reviewing a WTA dependency PR, or fixing stale NOTICE.md or cgmanifest CI failures.'
+---
+
+# WTA Rust Dependency Update
+
+Keep WTA Cargo dependency changes synchronized with the generated Component
+Governance manifest and third-party notices required for the statically linked
+`wta.exe`.
+
+## When to Use This Skill
+
+- Complete or review a Dependabot PR for `/tools/wta`.
+- Add, remove, or upgrade a dependency in `tools/wta/Cargo.toml`.
+- Update `tools/wta/Cargo.lock` in a way that changes runtime dependencies.
+- Change dependency features that add or remove transitive runtime crates.
+- Fix the **Verify WTA third-party notices** CI failure.
+
+Do not run this workflow for Rust source-only changes that leave the dependency
+graph unchanged.
+
+## Prerequisites
+
+- Run commands from the repository root.
+- Use PowerShell 7 or later (`pwsh`), not Windows PowerShell 5.1.
+- Read `tools/wta/AGENTS.md` and the WTA Rust instructions before changing
+  Cargo files.
+- Preserve unrelated worktree changes; never reset or overwrite them.
+
+## Workflow
+
+1. Inspect the PR or worktree diff and confirm which Cargo manifest, lockfile,
+   or feature change triggered the dependency update.
+2. Choose the safe mode:
+   - For a review-only request, do not run the mutating generator. Inspect the
+     existing diff and continue with the offline `-Verify` command in step 4.
+   - When completing or fixing the update, regenerate both attribution
+     artifacts:
+
+     ```powershell
+     pwsh -File .\build\scripts\Generate-WtaThirdPartyNotices.ps1
+     ```
+
+3. Review the dependency and generated changes together:
+
+   ```powershell
+   $baseRef = gh pr view --json baseRefName --jq .baseRefName 2>$null
+   if ($LASTEXITCODE -eq 0) {
+       git fetch origin $baseRef
+       $compareRef = git merge-base HEAD "origin/$baseRef"
+   } else {
+       $compareRef = 'HEAD'
+   }
+   git diff --check $compareRef --
+   git diff $compareRef -- tools/wta/Cargo.toml tools/wta/Cargo.lock `
+       tools/wta/cgmanifest.json NOTICE.md
+   ```
+
+4. Run the same offline consistency check used by CI:
+
+   ```powershell
+   pwsh -File .\build\scripts\Generate-WtaThirdPartyNotices.ps1 -Verify
+   ```
+
+5. Test and finish:
+   - Run the WTA test suite with the pinned toolchain:
+
+     ```powershell
+     Get-Process wta -ErrorAction SilentlyContinue |
+         ForEach-Object { Stop-Process -Id $_.Id -Force }
+     Push-Location tools/wta
+     cargo test --locked
+     Pop-Location
+     ```
+
+   - If generation produced changes, keep `NOTICE.md` and
+     `tools/wta/cgmanifest.json` in the same PR as the Cargo update.
+   - For a Dependabot branch, add a follow-up commit; do not rewrite the bot
+     commit unless the user explicitly requests it.
+   - If generation produced no changes, do not create an empty attribution
+     commit; report that `-Verify` passed.
+   - Commit or push only when requested. Include all generated attribution
+     changes together and describe them as generated output.
+
+## Completion Gate
+
+- In update/completion mode, the normal generator exits successfully.
+- Generated changes contain only dependency attribution expected from the
+  Cargo update.
+- `git diff --check` passes.
+- `Generate-WtaThirdPartyNotices.ps1 -Verify` reports the same runtime crate
+  count in `cgmanifest.json` and `NOTICE.md`.
+- `cargo test --locked` passes from `tools/wta`.
+- No dependency PR is declared ready while generated artifacts are stale.
+
+## Gotchas
+
+- **Do not edit generated attribution text by hand.** Fix the Cargo metadata or
+  generator and rerun it.
+- **Do not run only `-Verify` after a dependency change.** Verification detects
+  stale artifacts but does not regenerate them.
+- **Do not assume every lockfile change needs an attribution diff.** Dev-only,
+  build-only, or platform-excluded dependency changes may leave runtime output
+  unchanged.
+- **Do not omit `NOTICE.md` when `cgmanifest.json` changes, or vice versa.**
+  They are generated from the same runtime dependency graph.
+- **Review major updates separately.** In particular,
+  `agent-client-protocol*` updates require focused ACP compatibility review.

AGENTS.md

@@ -330,7 +330,9 @@ There are two independent build systems. **Both must be built** before F5.
 # Kill stale WTA processes first
 taskkill //f //im wta.exe 2>/dev/null; true
 
-cargo build --target x86_64-pc-windows-msvc --manifest-path tools/wta/Cargo.toml
+pushd tools/wta
+cargo build --target x86_64-pc-windows-msvc
+popd
 # Output: tools/wta/target/x86_64-pc-windows-msvc/debug/wta.exe
 #
 # Always pass --target explicitly — the wapproj prefers
@@ -379,7 +381,9 @@ flow. Static assets such as `wt-agent-hooks` are not `wta.exe`-only changes.
 ```bash
 # 1. Build WTA (always use --target — see note above)
 taskkill //f //im wta.exe 2>/dev/null; true
-cargo build --target x86_64-pc-windows-msvc --manifest-path tools/wta/Cargo.toml
+pushd tools/wta
+cargo build --target x86_64-pc-windows-msvc
+popd
 
 # 2. Build & run Terminal from VS
 #    F5 in Visual Studio (CascadiaPackage project)

CONTRIBUTING.md

@@ -164,7 +164,7 @@ Once you've discussed your proposed feature/fix/etc. with a team member, and you
 
 Testing is a key component in the development workflow. The C++ Terminal and Console code uses TAEF (the Test Authoring and Execution Framework); the Rust WTA crate uses standard `cargo test`.
 
-If your changes affect existing test cases, or you're working on brand new features and also the accompanying test cases, see [TAEF](./doc/TAEF.md) for more information about how to validate the C++ side locally, and run `cargo test --manifest-path tools/wta/Cargo.toml` for the Rust side.
+If your changes affect existing test cases, or you're working on brand new features and also the accompanying test cases, see [TAEF](./doc/TAEF.md) for more information about how to validate the C++ side locally. For the Rust side, run `cargo test` from `tools/wta` so Cargo uses the pinned toolchain.
 
 ### Code Review
 

NOTICE.md

@@ -1023,7 +1023,7 @@ Applies to 2 crate(s) (directly or via composite identifiers): moxcms v0.8.1, px
 _Canonical text reproduced from upstream `SPDX:BSD-3-Clause`:_
 
 ```
-Copyright (c) <year> <owner>. 
+Copyright (c) <year> <owner>.
 
 Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
 

build/pipelines/templates-v2/job-build-project.yml

@@ -114,6 +114,7 @@ jobs:
     BuildTargetParameter: ' '
     SelectedSigningFragments: ' '
     MSBuildCacheParameters: ' '
+    WtaRustToolchain: ms-prod-1.93
     # When building the unpackaged distribution, build it in portable mode if it's Canary-branded
     ${{ if eq(parameters.branding, 'Canary') }}:
       UnpackagedBuildArguments: -PortableMode
@@ -192,8 +193,9 @@ jobs:
   #   2. Crates resolve through a project-level Azure Artifact Cargo feed
   #      with crates.io upstream, configured in .cargo/config.toml (repo root,
   #      generated by CI — see "Create Cargo registry config" step below).
-  #   3. The Rust version uses the `ms-prod-X.YY` channel, pinned in
-  #      `tools/wta/rust-toolchain.toml`.
+  #   3. Public tooling uses the version in `tools/wta/rust-toolchain.toml`.
+  #      ADO explicitly selects the matching `ms-prod-X.YY` channel through
+  #      `WtaRustToolchain` so internal builds remain 1ES-compliant.
   #   4. Component Governance scanning of Cargo.lock is auto-injected by
   #      1ES PT (no extra task needed here).
   #
@@ -209,10 +211,21 @@ jobs:
   # the C++ build environment), so a misconfigured vcpkg/VS install still
   # cannot poison Rust.
   # ────────────────────────────────────────────────────────────────────────
+  - pwsh: |-
+      $toolchainFile = Get-Content -Raw tools/wta/rust-toolchain.toml
+      if ($toolchainFile -notmatch '(?m)^\s*channel\s*=\s*"(?<version>\d+\.\d+)"\s*$') {
+        throw 'tools/wta/rust-toolchain.toml must pin a public major.minor Rust channel.'
+      }
+      $expectedInternalChannel = "ms-prod-$($Matches.version)"
+      if ('$(WtaRustToolchain)' -ne $expectedInternalChannel) {
+        throw "WtaRustToolchain must be $expectedInternalChannel to match the public Rust pin."
+      }
+    displayName: Verify public and internal Rust pins match
+
   - task: RustInstaller@1
     displayName: Install Rust toolchain (MSRustup)
     inputs:
-      rustVersion: ms-prod-1.93
+      rustVersion: $(WtaRustToolchain)
       toolchainFeed: https://pkgs.dev.azure.com/microsoft/_packaging/RustTools/nuget/v3/index.json
       # NOTE: we deliberately do NOT set `cratesIoFeedOverride` here. That
       # parameter injects an env-var registry override named `ms_crates_io`
@@ -274,6 +287,19 @@ jobs:
   # phase. Fetching upfront keeps `cargo build --frozen` fully offline.
   - script: cargo fetch --manifest-path tools/wta/Cargo.toml --locked
     displayName: Fetch crates (offline-friendly)
+    env:
+      RUSTUP_TOOLCHAIN: $(WtaRustToolchain)
+
+  - pwsh: |-
+      $ErrorActionPreference = 'Stop'
+      & .\build\scripts\Generate-WtaThirdPartyNotices.ps1 -Verify
+      if ($LASTEXITCODE -ne 0) {
+        throw "WTA third-party notice verification failed with exit code $LASTEXITCODE"
+      }
+    displayName: Verify WTA third-party notices
+    condition: and(succeeded(), eq(variables['BuildPlatform'], 'x64'))
+    env:
+      RUSTUP_TOOLCHAIN: $(WtaRustToolchain)
 
   - pwsh: |-
       $ErrorActionPreference = 'Stop'
@@ -292,6 +318,8 @@ jobs:
       }
       if ($LASTEXITCODE -ne 0) { throw "cargo build failed with exit code $LASTEXITCODE" }
     displayName: Build wta (Cargo)
+    env:
+      RUSTUP_TOOLCHAIN: $(WtaRustToolchain)
 
   - pwsh: |-
       $ErrorActionPreference = 'Stop'
@@ -306,6 +334,8 @@ jobs:
       if ($LASTEXITCODE -ne 0) { throw "cargo test failed with exit code $LASTEXITCODE" }
     displayName: Test wta (Cargo)
     condition: ne(variables['BuildPlatform'], 'arm64')
+    env:
+      RUSTUP_TOOLCHAIN: $(WtaRustToolchain)
 
   - template: .\steps-install-vcpkg.yml