chore: upgrade dependencies

.github/actions/setup-swift/action.yml

@@ -13,17 +13,17 @@ runs:
     - name: Setup Swift
       uses: SwiftyLab/setup-swift@latest
       with:
-        swift-version: "6.3.2"
+        swift-version: "6.3.3"
 
     - name: Cache Static Linux SDK
       if: inputs.static-sdk == 'true'
       id: cache-static-sdk
-      uses: actions/cache@v4
+      uses: actions/cache@v6
       with:
         path: ~/.swiftpm/swift-sdks
-        key: static-sdk-6.3.2-${{ runner.arch }}
+        key: static-sdk-6.3.3-${{ runner.arch }}
 
     - name: Install Static Linux SDK
       if: inputs.static-sdk == 'true' && steps.cache-static-sdk.outputs.cache-hit != 'true'
       shell: bash
-      run: swift sdk install https://download.swift.org/swift-6.3.2-release/static-sdk/swift-6.3.2-RELEASE/swift-6.3.2-RELEASE_static-linux-0.1.0.artifactbundle.tar.gz --checksum 3fd798bef6f4408f1ea5a6f94ce4d4052830c4326ab85ebc04f983f01b3da407
+      run: swift sdk install https://download.swift.org/swift-6.3.3-release/static-sdk/swift-6.3.3-RELEASE/swift-6.3.3-RELEASE_static-linux-0.1.0.artifactbundle.tar.gz --checksum 87c3eaf908e67c0e13a84367119e12273cec1d2cd3d81f7d74bb36722d6b607b

.github/workflows/build-image.yml

@@ -19,13 +19,13 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -64,7 +64,7 @@ jobs:
           echo "Computed tag: ${VERSION}"
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/amd64,linux/arm64

.github/workflows/build.yml

@@ -67,7 +67,7 @@ jobs:
           tar czf "agentc-${{ matrix.variant }}.tar.gz" agentc
 
       - name: Upload agentc artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: agentc-${{ matrix.variant }}
           path: agentc-${{ matrix.variant }}.tar.gz
@@ -112,7 +112,7 @@ jobs:
           tar czf "agentc-bootstrap-${{ matrix.variant }}.tar.gz" agentc-bootstrap
 
       - name: Upload bootstrap artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: agentc-bootstrap-${{ matrix.variant }}
           path: agentc-bootstrap-${{ matrix.variant }}.tar.gz
@@ -125,13 +125,13 @@ jobs:
 
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
           merge-multiple: true
 
       - name: Create release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           draft: true
           files: artifacts/*.tar.gz

.github/workflows/test.yml

@@ -37,7 +37,7 @@ jobs:
         uses: ./.github/actions/setup-swift
 
       - name: Cache SPM build artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: .build
           key: spm-unit-${{ matrix.os }}-${{ matrix.arch }}-${{ hashFiles('Package.swift', 'Package.resolved') }}
@@ -82,7 +82,7 @@ jobs:
         uses: ./.github/actions/setup-swift
 
       - name: Cache SPM build artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: .build
           key: spm-runtime-e2e-${{ matrix.os }}-${{ matrix.arch }}-${{ hashFiles('Package.swift', 'Package.resolved') }}
@@ -184,7 +184,7 @@ jobs:
         run: docker save ghcr.io/laosb/claudec:latest | gzip > claudec-image.tar.gz
 
       - name: Upload image artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: claudec-image-${{ matrix.arch }}
           path: claudec-image.tar.gz
@@ -214,15 +214,15 @@ jobs:
           static-sdk: "true"
 
       - name: Cache SPM build artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: .build
           key: spm-integration-${{ matrix.os }}-${{ matrix.arch }}-${{ hashFiles('Package.swift', 'Package.resolved') }}
           restore-keys: |
             spm-integration-${{ matrix.os }}-${{ matrix.arch }}-
 
       - name: Download base image
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: claudec-image-${{ matrix.arch }}
 
@@ -253,7 +253,7 @@ jobs:
           touch ~/.agentc/configurations/.agentc-last-pull
 
       - name: Cache shared test profiles
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.agentc/profiles/__TEST_agentc_shared
@@ -288,15 +288,15 @@ jobs:
           static-sdk: "true"
 
       - name: Cache SPM build artifacts
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: .build
           key: spm-static-${{ matrix.os }}-${{ matrix.arch }}-${{ hashFiles('Package.swift', 'Package.resolved') }}
           restore-keys: |
             spm-static-${{ matrix.os }}-${{ matrix.arch }}-
 
       - name: Download base image
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: claudec-image-${{ matrix.arch }}
 
@@ -331,7 +331,7 @@ jobs:
           touch ~/.agentc/configurations/.agentc-last-pull
 
       - name: Cache shared test profiles
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.agentc/profiles/__TEST_agentc_shared

.github/workflows/toolkit.yml

@@ -72,7 +72,7 @@ jobs:
             ./check/bin/curl -fsS -o /dev/null https://github.com/
 
       - name: Publish release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ steps.manifest.outputs.tag }}
           name: agentc Toolkit v${{ steps.manifest.outputs.version }}

.swift-version

@@ -1 +1 @@
-6.3.2
+6.3.3

BUILD.md

@@ -0,0 +1,148 @@
+# Building agentc
+
+This document covers local development and release-style builds. For installation and day-to-day usage, see [README.md](./README.md).
+
+## Requirements
+
+- **Swift 6.3+**. CI currently uses Swift 6.3.2.
+- **macOS 15+** to build the Apple Containerization backend.
+- **macOS or Linux** to build the Docker backend.
+- A Docker-compatible daemon is only required when running Docker-backed integration tests or using a Docker build locally.
+- A Swift **Static Linux SDK** is required to build the statically linked Linux `agentc` binary or `agentc-bootstrap`.
+
+The package exposes two Swift package traits:
+
+- `ContainerRuntimeAppleContainer` — Apple Containerization, macOS only.
+- `ContainerRuntimeDocker` — Docker Engine API, macOS and Linux.
+
+## Development builds
+
+On macOS, the package defaults to both runtime traits:
+
+```sh
+swift build
+```
+
+For a Docker-only build, including on Linux:
+
+```sh
+swift build --disable-default-traits --traits ContainerRuntimeDocker
+```
+
+To build with both runtimes explicitly on macOS:
+
+```sh
+swift build \
+  --disable-default-traits \
+  --traits ContainerRuntimeAppleContainer,ContainerRuntimeDocker
+```
+
+## Tests
+
+Run the runtime-independent and Docker unit tests with:
+
+```sh
+swift test \
+  --disable-default-traits \
+  --traits ContainerRuntimeDocker \
+  --filter 'AgentIsolationTests|AgentIsolationDockerRuntimeTests'
+```
+
+On macOS, enable both runtime traits when working on Apple Containerization code:
+
+```sh
+swift test \
+  --disable-default-traits \
+  --traits ContainerRuntimeAppleContainer,ContainerRuntimeDocker
+```
+
+The integration test suite also needs a working container runtime, a locally available `agentc-bootstrap`, test images, and agent configurations. See [`.github/workflows/test.yml`](./.github/workflows/test.yml) for the CI setup used by the project.
+
+## Release-style `agentc` builds
+
+`build.sh` builds the `agentc` executable, selects runtime traits, and copies the result to `./agentc`.
+
+```sh
+./build.sh                                      # release build; platform-default runtimes
+./build.sh --debug                              # debug build
+./build.sh --runtimes docker                    # Docker only
+./build.sh --runtimes apple-container,docker    # both runtimes on macOS
+```
+
+Defaults are:
+
+- macOS: `apple-container,docker`
+- Linux: `docker`
+
+When Apple Containerization is included on macOS, `build.sh` ad-hoc signs the executable with the virtualization entitlement.
+
+Set build metadata through environment variables:
+
+```sh
+BUILD_VERSION=1.2.3 BUILD_GIT_SHA=$(git rev-parse HEAD) ./build.sh
+```
+
+These values are reported by `agentc version`. If omitted, the build uses `dev` and the current Git SHA when available.
+
+## Static Linux builds
+
+Install a Swift Static Linux SDK matching your toolchain, then pass its SDK name to `build.sh`:
+
+```sh
+./build.sh --runtimes docker --swift-sdk x86_64-swift-linux-musl
+./build.sh --runtimes docker --swift-sdk aarch64-swift-linux-musl
+```
+
+The CI-pinned Static Linux SDK installation is defined in [`.github/actions/setup-swift/action.yml`](./.github/actions/setup-swift/action.yml).
+
+## Building `agentc-bootstrap`
+
+`agentc-bootstrap` is the in-container entrypoint and is built separately as a statically linked Linux executable:
+
+```sh
+# x64
+swift build \
+  --product agentc-bootstrap \
+  -c release \
+  --swift-sdk x86_64-swift-linux-musl
+
+# arm64
+swift build \
+  --product agentc-bootstrap \
+  -c release \
+  --swift-sdk aarch64-swift-linux-musl
+```
+
+For local development, either install the binary where agentc looks for it:
+
+```sh
+mkdir -p ~/.agentc/bin
+cp .build/<sdk>/release/agentc-bootstrap ~/.agentc/bin/bootstrap
+chmod +x ~/.agentc/bin/bootstrap
+```
+
+or pass it explicitly:
+
+```sh
+./agentc run --bootstrap /path/to/agentc-bootstrap
+```
+
+Released versions of agentc download the matching bootstrap binary automatically on first use.
+
+## Toolkit
+
+The agentc Toolkit is released independently from the main executable. Its contents are defined by [`scripts/toolkit/manifest.sh`](./scripts/toolkit/manifest.sh), and its release workflow lives in [`.github/workflows/toolkit.yml`](./.github/workflows/toolkit.yml).
+
+## Architecture
+
+```text
+agentc (CLI)
+  ├─ AgentIsolation                       runtime-agnostic orchestration
+  ├─ AgentIsolationAppleContainerRuntime  Apple Containerization backend
+  └─ AgentIsolationDockerRuntime          Docker Engine backend
+
+agentc-bootstrap                          in-container initialization/entrypoint
+agentc Toolkit                            curl, jq, ripgrep, CA bundle
+```
+
+`AgentIsolation` depends only on Foundation and `swift-crypto`; runtime-specific dependencies are isolated behind Swift package traits.