repository prebake for agent runtimes

[zreigz]

Test Plan

Test environment: https://console.your-env.onplural.sh/

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).

Plural Flow: console

[linear]

PROD-5150

[soffi-ai]

Soffi AI Summary

This PR introduces a repository pre-bake system for agent runtimes, allowing AI coding agent pods to start with pre-cloned Git repositories already available — eliminating the cold-clone latency that would otherwise occur at agent startup.

The core idea is to build an OCI image containing pre-cloned repositories and a manifest.json, which an init container then copies into /plural/shared/repos before the agent process starts. This is surfaced through:

1. A new prebake.sh bash script (dockerfiles/repository-prebake/) that reads a YAML config listing repositories, clones them into a staging directory, writes a manifest.json, and builds + optionally pushes an OCI image — all using the caller's existing Git credentials.
2. A new Go prebake package (pkg/agentrun-harness/prebake/) that reads the manifest.json embedded in a prebake image and makes repository metadata available to the agent harness at runtime.
3. A new Environment abstraction (pkg/agentrun-harness/environment/) that encapsulates the shared runtime environment for agent runs, simplifying how the harness wires together repos, tools, and working directories.
4. AgentRuntime CRD extension — a new RepositoryPrebakeImage field is added to the AgentRuntime spec so operators can declaratively specify which prebake image to mount into agent pods.
5. Agent pod construction updates (internal/controller/agentrun_pod.go) to mount the prebake image as an init container and expose the repos to the agent container via a shared volume.
6. Updated system prompt templates (analyze.md.tmpl, write.md.tmpl, babysit.md.tmpl) to inform agents about pre-available repositories in their working environment.
7. Tool layer updates across Claude, Gemini, and the v1 tool interface to pass environment context (including pre-cloned repo paths) into agent tool invocations.

Changes

Repository pre-bake for agent runtimes

• Introduces the repository pre-bake system: a bash script to build OCI images with pre-cloned repos, a Go prebake package to read the embedded manifest at runtime, and wiring to mount pre-baked repos into AI agent pods via an init container. Adds the RepositoryPrebakeImage field to the AgentRuntime CRD. (152ee0a)
• Merge commit syncing the feature branch with upstream master. (0711cd5)
• Adds the logic to copy pre-baked repositories from the OCI init container into the agent pod's shared volume, making them accessible to the agent process at startup. (e4e5874)
• Adds the Environment abstraction and wires prebake repository access into the agent harness tool layer (Claude, Gemini, v1), exposing pre-cloned repo paths to agent tool invocations. (6e7b403)
• Adds the extra staging directory structure and supporting config files (Dockerfile, example repos YAML, README) for the repository prebake image builder tooling. (52b194f)

---

Updated: 2026-08-31 08:21 UTC

Deploy in Soffi

[greptile-apps]

Greptile Summary

The PR adds OCI-backed repository prebaking for agent runtimes, allowing pods to copy matching repositories locally and expose other prebaked repositories as context.

• Adds the AgentRuntime repositoryImage API field and mounts the image into agent-run containers.
• Adds manifest parsing, repository URL matching, local copying, safe-directory setup, and prompt integration.
• Adds a prebake image builder, documentation, samples, and focused tests.

Confidence Score: 4/5

The requested-branch fallback should be fixed before merging because it can silently run an agent against the wrong checkout and pull-request base.

A failed fetch or checkout on the new prebake path is converted to success, after which downstream configuration and prompts proceed as though the requested branch had been honored.

Files Needing Attention: go/deployment-operator/pkg/agentrun-harness/environment/environment.go

Important Files Changed

Filename	Overview
go/deployment-operator/pkg/agentrun-harness/environment/environment.go	Adds prebake copying and safe-directory setup, but silently continues on an explicitly requested branch when fetch or checkout fails.
go/deployment-operator/pkg/agentrun-harness/prebake/prebake.go	Implements manifest loading, path confinement, repository listing, and normalized URL matching with appropriate fallback behavior.
go/deployment-operator/internal/controller/agentrun_pod.go	Adds the repository image volume and read-only mounts to the intended agent-run containers.
go/deployment-operator/dockerfiles/repository-prebake/prebake.sh	Builds validated prebake layouts and sanitizes embedded HTTPS credentials before storing remotes and manifest entries.
go/deployment-operator/pkg/agentrun-harness/tool/v1/tool.go	Supplies available prebaked repositories to system prompt templates while tolerating missing or invalid manifests.

_{Reviews (1): Last reviewed commit: "repository prebake for agent runtimes" | Re-trigger Greptile}