feat: repository prebake for agent runtimes

[zreigz]

Test Plan

Test environment: https://console.your-env.onplural.sh/

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

[linear]

PROD-5150

[soffi-ai]

Soffi AI Summary

This PR introduces a repository prebake system for AI agent runtimes, enabling agent run pods to start with pre-cloned Git repositories already available — eliminating cold-start cloning latency when AI coding agents (Claude, Gemini, Codex, etc.) spin up.

The core idea: a new prebake.sh script (with accompanying Dockerfile) lets operators build an OCI image containing pre-cloned repositories and a manifest.json. An init container then copies the repos into /plural/shared/repos before the agent container starts, so agents have immediate access to source code without waiting for Git clone operations.

On the Go side, a new prebake package in the agentrun-harness reads the manifest and wires the pre-populated repo directory into the agent environment. The AgentRuntime CRD gains a new field to reference the prebake image. Agent system prompt templates (analyze, write, review, babysit) are updated to document repository access conventions, and the environment setup logic is refactored to surface repo paths correctly to Claude, Gemini, and the v1 tool interface.

Changes

Repository prebake for agent runtimes

• Initial implementation of the repository prebake feature: adds the prebake.sh build script, Dockerfile, example config, and README for producing OCI images containing pre-cloned Git repos. (152ee0a)
• Adds the Go prebake package that reads manifest.json from a prebaked image and copies repositories into the agent environment, plus the environment package that wires repo paths into agent run setup. (e4e5874)
• Extends the AgentRuntime CRD type and its generated deepcopy to carry a reference to the prebake OCI image, and threads access through the agentrun controller. (6e7b403)
• Adds the extra shared directory plumbing in the agent run pod spec so the init container's copied repos are visible to the agent container. (52b194f)
• Code-review follow-ups: refactors v1 tool templates, cleans up Claude and Gemini tool wiring, updates system prompt templates (analyze, write, review, babysit) to describe repository paths, and adds comprehensive tests for environment setup, prebake parsing, and tool templates. (1294b3f)
• Syncs generated CRD YAML for AgentRuntime and updates the operator API docs to reflect the new prebake image field. (e54f0d6)
• Improves the updateFromOrigin flow in the prebake logic to handle edge cases when resolving the default branch after a shallow clone. (7627c05)
• Merge commit incorporating upstream master changes during development. (0711cd5)
• Merge commit incorporating upstream master changes during development. (d990e0c)
• Merge commit incorporating upstream master changes during development. (43b023a)
• Merge commit incorporating upstream master changes during development. (9ad77e3)

---

Updated: 2026-09-08 09:05 UTC

Deploy in Soffi

[greptile-apps]

Greptile Summary

The PR adds OCI-backed repository prebaking for agent runtimes, allowing pods to copy matching repositories locally and expose other prebaked repositories as context.

• Adds the AgentRuntime repositoryImage API field and mounts the image into agent-run containers.
• Adds manifest parsing, repository URL matching, local copying, safe-directory setup, and prompt integration.
• Adds a prebake image builder, documentation, samples, and focused tests.

Confidence Score: 4/5

The requested-branch fallback should be fixed before merging because it can silently run an agent against the wrong checkout and pull-request base.

A failed fetch or checkout on the new prebake path is converted to success, after which downstream configuration and prompts proceed as though the requested branch had been honored.

Files Needing Attention: go/deployment-operator/pkg/agentrun-harness/environment/environment.go

Important Files Changed

Filename	Overview
go/deployment-operator/pkg/agentrun-harness/environment/environment.go	Adds prebake copying and safe-directory setup, but silently continues on an explicitly requested branch when fetch or checkout fails.
go/deployment-operator/pkg/agentrun-harness/prebake/prebake.go	Implements manifest loading, path confinement, repository listing, and normalized URL matching with appropriate fallback behavior.
go/deployment-operator/internal/controller/agentrun_pod.go	Adds the repository image volume and read-only mounts to the intended agent-run containers.
go/deployment-operator/dockerfiles/repository-prebake/prebake.sh	Builds validated prebake layouts and sanitizes embedded HTTPS credentials before storing remotes and manifest entries.
go/deployment-operator/pkg/agentrun-harness/tool/v1/tool.go	Supplies available prebaked repositories to system prompt templates while tolerating missing or invalid manifests.

_{Reviews (1): Last reviewed commit: "repository prebake for agent runtimes" | Re-trigger Greptile}

[michaeljguarino]

There has to be a golang based way to do this right? better than shelling out to cp.

[zreigz]

done

[michaeljguarino]

this just copies the repo and configures the upstream, shouldn't we also pull it to grab new changes? It's highly likely it will lag origin, since people will build the prebake image on a cron.

(Doing a pull from a largely cloned repo is still way better than a fresh clone from 0)

[zreigz]

yes right, I've added updateFromOrigin method for it