Merge nucleic/olive-willow-newt-96nb into dev

images/agent/Dockerfile

@@ -30,6 +30,9 @@ ARG GO_SHA256_ARM64=fe4789e92b1f33358680864bbe8704289e7bb5fc207d80623c308935bd69
 ARG MISE_VERSION=v2026.7.7
 ARG MISE_SHA256_AMD64=0953810c2785eb4a75159f67f8b5721c4f3c80b8a6a812015d5af7d7fbd1b8a4
 ARG MISE_SHA256_ARM64=c4e542b53a15d2ec641e072f7b2d9da8a0554b92fd2c09a51febde32c6080ab8
+ARG SWIFT_VERSION=6.3.3
+ARG SWIFT_SHA256_AMD64=19e0c78cad5418ad48bfa87aa20c53ac9ac9996d1695d04dd94f7c7ea4eb133f
+ARG SWIFT_SHA256_ARM64=ecba8ef87b54a5048d466af500f3169c939a6b8a2cb7c600f76b5184457f293a
 
 # Warm shared caches at fixed world-readable paths (§6.3). Exported here so the BUILD's
 # own installs warm them; the runtime equivalent for agent shells is
@@ -42,7 +45,7 @@ ENV npm_config_cache=/opt/cache/npm \
     RUSTUP_HOME=/opt/rustup \
     GOMODCACHE=/opt/cache/gomod \
     PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers \
-    PATH=/opt/mise/shims:/opt/cache/cargo/bin:/usr/local/go/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin
+    PATH=/opt/mise/shims:/opt/cache/cargo/bin:/usr/local/go/bin:/opt/swift/usr/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin
 
 # The local apt pool (CI's just-built Nucleic packages) rides in only for this stage's
 # installs; the hosted signed repo (naros-keyring, already in the base) is the runtime
@@ -114,6 +117,43 @@ RUN set -eu; \
     mkdir -p /opt/mise/shims; \
     MISE_DATA_DIR=/opt/mise mise --version
 
+# Swift — the swift.org release toolchain (pinned + checksummed, same shape as Go above).
+# Baked because Nucleic itself is a Swift package and agents work on Swift repos all day:
+# swiftc, SwiftPM, swift-testing, sourcekit-lsp and swift-format all run in-container now.
+# It does NOT replace host_exec / the macOS VM for anything Apple-SDK — there is no
+# SwiftUI/AppKit/UIKit or xcodebuild on Linux — but pure-Swift targets build and test here.
+#
+# The `debian12` slice is the newest Debian build swift.org publishes; it runs unmodified on
+# trixie (verified: swift build/test/swiftc on the 26.07 image) once libncurses6 is present,
+# which naros-tier-agent now pulls along with the rest of the toolchain's runtime libs
+# (libxml2, libcurl4, libsqlite3-0, libuuid1, libtinfo6, zlib1g). Debian's own `swiftlang`
+# is deliberately NOT used here: trixie carries 6.0.3, too old for a swift-tools-version 6.2
+# package like this repo's. (The VM desktop rootfs is the mirror-image case — forky's
+# libxml2 soname bump to .so.16 makes the swift.org build unloadable there, so it takes
+# forky's swiftlang 6.2.3 instead; see os/mkimage/profiles/vm-desktop.pkgs.)
+#
+# LLDB is stripped: upstream links it against libpython3.11, which trixie does not ship, so
+# lldb/lldb-dap/liblldb could never load — dropping them keeps 338 MB out of the image and
+# makes `swift repl` fail as a plain "not found" instead of a loader error. Nothing else in
+# the toolchain depends on liblldb (checked via NEEDED).
+RUN set -eu; \
+    case "$TARGETARCH" in \
+      amd64) swift_slice=debian12; swift_sha="$SWIFT_SHA256_AMD64";; \
+      arm64) swift_slice=debian12-aarch64; swift_sha="$SWIFT_SHA256_ARM64";; \
+      *) echo "unsupported TARGETARCH: $TARGETARCH" >&2; exit 1;; \
+    esac; \
+    swift_tag="swift-${SWIFT_VERSION}-RELEASE"; \
+    curl -fsSL "https://download.swift.org/swift-${SWIFT_VERSION}-release/${swift_slice}/${swift_tag}/${swift_tag}-${swift_slice}.tar.gz" \
+      -o /tmp/swift.tgz; \
+    echo "$swift_sha  /tmp/swift.tgz" | sha256sum -c -; \
+    mkdir -p /opt/swift; \
+    tar -C /opt/swift --strip-components=1 -xzf /tmp/swift.tgz; rm /tmp/swift.tgz; \
+    rm -f /opt/swift/usr/bin/lldb /opt/swift/usr/bin/lldb-dap \
+          /opt/swift/usr/bin/lldb-server /opt/swift/usr/bin/lldb-argdumper \
+          /opt/swift/usr/lib/liblldb.so*; \
+    chmod -R a+rX /opt/swift; \
+    swift --version | grep -q "Swift version ${SWIFT_VERSION}"
+
 # Runtime environment for agent shells: cache paths, toolchain PATH entries, mise
 # activation. nash -l sources /etc/profile.d, which is how every containerized exec
 # (ContainerEngine exec → nash -lc) sees this without OCI env.
@@ -192,11 +232,14 @@ RUN set -eu; \
     go_v="$(go version | awk '{print $3}')"; \
     mise_v="$(mise --version 2>/dev/null | awk '{print $1}')"; \
     gcc_v="$(gcc -dumpfullversion)"; \
+    swift_v="$(swift --version | awk '/Swift version/ {print $3; exit}')"; \
     pw_v="$(playwright --version | awk '{print $2}')"; \
     jq --arg node "$node_v" --arg python "$python_v" --arg rust "$rust_v" \
-       --arg go "$go_v" --arg mise "$mise_v" --arg gcc "$gcc_v" --arg playwright "$pw_v" \
+       --arg go "$go_v" --arg mise "$mise_v" --arg gcc "$gcc_v" --arg swift "$swift_v" \
+       --arg playwright "$pw_v" \
        '.tier = "agent" | .variant = "agent" \
-        | .toolchains = {node: $node, python: $python, rust: $rust, go: $go, mise: $mise, gcc: $gcc} \
+        | .toolchains = {node: $node, python: $python, rust: $rust, go: $go, mise: $mise, \
+                         gcc: $gcc, swift: $swift} \
         | .caches = {npm: "/opt/cache/npm", pip: "/opt/cache/pip", uv: "/opt/cache/uv", \
                      cargo: "/opt/cache/cargo", gomod: "/opt/cache/gomod"} \
         | .playwright = {version: $playwright, browsers: "/opt/playwright-browsers", chromium: true}' \

images/agent/files/etc/profile.d/naros-env.sh

@@ -16,11 +16,11 @@ export PLAYWRIGHT_BROWSERS_PATH=/opt/playwright-browsers
 # where the interactive `mise activate` hook would not run.
 export MISE_DATA_DIR=/opt/mise
 
-# Baked toolchains (§6.2): cargo/rustup bins, Go, and the mise shims ahead of them all
-# so `mise use` versions win per-project. Idempotent (guarded) — profile.d can be
-# sourced more than once per session.
+# Baked toolchains (§6.2): cargo/rustup bins, Go, the swift.org toolchain at
+# /opt/swift/usr/bin, and the mise shims ahead of them all so `mise use` versions win
+# per-project. Idempotent (guarded) — profile.d can be sourced more than once per session.
 case ":$PATH:" in
   *:/opt/mise/shims:*) ;;
-  *) PATH="/opt/mise/shims:/opt/cache/cargo/bin:/usr/local/go/bin:$PATH" ;;
+  *) PATH="/opt/mise/shims:/opt/cache/cargo/bin:/usr/local/go/bin:/opt/swift/usr/bin:$PATH" ;;
 esac
 export PATH