@mastra/e2b 0.12.4-alpha.0 → 0.13.0-alpha.1

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { E2BSandbox, type E2BSandboxOptions } from './sandbox/index.js';
 export { E2BProcessManager } from './sandbox/process-manager.js';
 export { createDefaultMountableTemplate, isNamedTemplateSpec, isDeferredNamedTemplateSpec, DEFAULT_NODE_VERSION, type TemplateSpec, type NamedTemplateSpec, type DeferredNamedTemplateSpec, type MountableTemplateResult, type MountableTemplateOptions, } from './utils/template.js';
-export { createRepoTemplate, refreshRepoTemplate, repoTemplateRef, type RepoTemplateOptions, type RepoTemplateIdentity, type RepositoryAccess, type RefreshRepoTemplateResult, } from './utils/repo-template.js';
+export { createRepoTemplate, refreshRepoTemplate, repoTemplateRef, type RepoTemplateOptions, type RepoTemplateRepository, type RepoTemplateIdentity, type RepositoryAccess, type RefreshRepoTemplateResult, } from './utils/repo-template.js';
 export { type E2BS3MountConfig, type E2BGCSMountConfig, type E2BAzureBlobMountConfig, type E2BMountConfig, } from './sandbox/mounts/index.js';
 export { e2bSandboxProvider } from './provider.js';
 export { E2BCodeModeTransport } from './code-mode/transport.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EACL,8BAA8B,EAC9B,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -126,7 +126,7 @@ function validatePrefix(prefix) {
 * Arguments containing only safe characters are returned as-is.
 * All others are wrapped in single quotes with embedded single quotes escaped.
 */
-function shellQuote$1(arg) {
+function shellQuote$2(arg) {
 	if (/^[a-zA-Z0-9._\-/@:=]+$/.test(arg)) return arg;
 	return "'" + arg.replace(/'/g, "'\\''") + "'";
 }
@@ -179,12 +179,12 @@ Error details: ${installResult.stderr || installResult.stdout}`);
 	};
 	if (hasCredentials) {
 		const credentialsContent = useSessionToken ? [
-			`export AWSACCESSKEYID=${shellQuote$1(config.accessKeyId)}`,
-			`export AWSSECRETACCESSKEY=${shellQuote$1(config.secretAccessKey)}`,
-			`export AWSSESSIONTOKEN=${shellQuote$1(config.sessionToken)}`,
-			`export AWS_ACCESS_KEY_ID=${shellQuote$1(config.accessKeyId)}`,
-			`export AWS_SECRET_ACCESS_KEY=${shellQuote$1(config.secretAccessKey)}`,
-			`export AWS_SESSION_TOKEN=${shellQuote$1(config.sessionToken)}`
+			`export AWSACCESSKEYID=${shellQuote$2(config.accessKeyId)}`,
+			`export AWSSECRETACCESSKEY=${shellQuote$2(config.secretAccessKey)}`,
+			`export AWSSESSIONTOKEN=${shellQuote$2(config.sessionToken)}`,
+			`export AWS_ACCESS_KEY_ID=${shellQuote$2(config.accessKeyId)}`,
+			`export AWS_SECRET_ACCESS_KEY=${shellQuote$2(config.secretAccessKey)}`,
+			`export AWS_SESSION_TOKEN=${shellQuote$2(config.sessionToken)}`
 		].join("\n") : `${config.accessKeyId}:${config.secretAccessKey}`;
 		await sandbox.commands.run(`sudo rm -f ${credentialsPath}`);
 		try {
@@ -212,8 +212,8 @@ Error details: ${installResult.stderr || installResult.stdout}`);
 		mountOptions.push("ro");
 		logger.debug(`${LOG_PREFIX} Mounting as read-only`);
 	}
-	const s3fsCmd = `s3fs ${shellQuote$1(bucketArg)} ${shellQuote$1(mountPath)} -o ${mountOptions.join(" -o ")}`;
-	const mountCmd = useSessionToken ? `sudo sh -c ${shellQuote$1(`. ${credentialsPath} && exec ${s3fsCmd}`)}` : `sudo ${s3fsCmd}`;
+	const s3fsCmd = `s3fs ${shellQuote$2(bucketArg)} ${shellQuote$2(mountPath)} -o ${mountOptions.join(" -o ")}`;
+	const mountCmd = useSessionToken ? `sudo sh -c ${shellQuote$2(`. ${credentialsPath} && exec ${s3fsCmd}`)}` : `sudo ${s3fsCmd}`;
 	logger.debug(`${LOG_PREFIX} Mounting S3:`, hasCredentials ? mountCmd.replace(credentialsPath, "***") : mountCmd);
 	try {
 		const result = await sandbox.commands.run(mountCmd, { timeoutMs: 6e4 });
@@ -236,7 +236,7 @@ Error details: ${installResult.stderr || installResult.stdout}`);
 	} finally {
 		if (useSessionToken) await removeSessionCredentials();
 	}
-	if ((await sandbox.commands.run(`mountpoint -q ${shellQuote$1(mountPath)}`)).exitCode !== 0) throw new Error(`s3fs returned exit 0 but ${mountPath} is not a mountpoint. The s3fs daemon likely failed during FUSE init (common causes: region mismatch, invalid credentials, or an S3-compatible endpoint that rejects the signature). Re-run inside the sandbox with '-f -o dbglevel=info' to see the underlying error.`);
+	if ((await sandbox.commands.run(`mountpoint -q ${shellQuote$2(mountPath)}`)).exitCode !== 0) throw new Error(`s3fs returned exit 0 but ${mountPath} is not a mountpoint. The s3fs daemon likely failed during FUSE init (common causes: region mismatch, invalid credentials, or an S3-compatible endpoint that rejects the signature). Re-run inside the sandbox with '-f -o dbglevel=info' to see the underlying error.`);
 }
 //#endregion
 //#region src/sandbox/mounts/gcs.ts
@@ -256,7 +256,7 @@ async function mountGCS(mountPath, config, ctx) {
 	}
 	const [uid, gid] = (await sandbox.commands.run("id -u && id -g")).stdout.trim().split("\n");
 	const uidGidFlags = uid && gid ? `--uid=${uid} --gid=${gid}` : "";
-	const onlyDirFlag = config.prefix ? ` --only-dir=${shellQuote$1(validatePrefix(config.prefix))}` : "";
+	const onlyDirFlag = config.prefix ? ` --only-dir=${shellQuote$2(validatePrefix(config.prefix))}` : "";
 	const hasCredentials = !!config.serviceAccountKey;
 	let mountCmd;
 	if (hasCredentials) {
@@ -464,9 +464,9 @@ Error details: ${verifyResult.stderr || verifyResult.stdout || installResult?.st
 	await sandbox.commands.run(`sudo rm -f ${configPath}`);
 	await sandbox.files.write(configPath, yaml);
 	await sandbox.commands.run(`sudo chown root:root ${configPath} && sudo chmod 600 ${configPath}`);
-	await sandbox.commands.run(`sudo rm -rf ${shellQuote$1(cachePath)} && sudo mkdir -p ${shellQuote$1(cachePath)}`);
-	const prefixFlags = prefix ? ` --virtual-directory=true --subdirectory=${shellQuote$1(prefix)}` : "";
-	const mountCmd = `sudo blobfuse2 mount ${shellQuote$1(mountPath)} --config-file=${shellQuote$1(configPath)}${prefixFlags}`;
+	await sandbox.commands.run(`sudo rm -rf ${shellQuote$2(cachePath)} && sudo mkdir -p ${shellQuote$2(cachePath)}`);
+	const prefixFlags = prefix ? ` --virtual-directory=true --subdirectory=${shellQuote$2(prefix)}` : "";
+	const mountCmd = `sudo blobfuse2 mount ${shellQuote$2(mountPath)} --config-file=${shellQuote$2(configPath)}${prefixFlags}`;
 	logger.debug(`${LOG_PREFIX} Mounting Azure Blob:`, mountCmd);
 	try {
 		const result = await sandbox.commands.run(mountCmd, { timeoutMs: 6e4 });
@@ -1593,6 +1593,8 @@ var E2BSandbox = class E2BSandbox extends MastraSandbox {
 };
 //#endregion
 //#region ../../packages/_internals/workspace/dist/index.js
+/** Directory, relative to the template's build cwd, that holds every marker below. */
+const SETUP_MARKER_DIR = ".mastra-sandbox";
 /**
 * Setup completion marker shared by repo templates and their consumers.
 *
@@ -1602,8 +1604,29 @@ var E2BSandbox = class E2BSandbox extends MastraSandbox {
 * booted from the image tell whether the setup it is about to run already
 * happened. Relative to the template's build cwd, which is also the runtime
 * working directory the repo was cloned into.
+*
+* This is the single-repository marker. Templates built from a repository
+* list write one marker per repository instead ({@link repoSetupMarkerPath}).
 */
 const SETUP_MARKER_PATH = ".mastra-sandbox/setup";
+/**
+* Marker for the workspace-level setup of a multi-repository template: the
+* commands that ran at the working directory after every repository was set
+* up. Written even when there were no such commands, so a consumer can tell
+* "ran nothing" from "never built".
+*/
+const WORKSPACE_SETUP_MARKER_PATH = ".mastra-sandbox/workspace-setup";
+/**
+* One line per repository directory whose setup failed while the build was
+* told to continue. Absent when nothing failed. Consumers check this before
+* trusting a per-repository marker: that marker means every step ran, not
+* that every step succeeded.
+*/
+const SETUP_FAILED_MARKER_PATH = ".mastra-sandbox/setup-failed";
+/** Per-repository marker of a multi-repository template, keyed by the clone directory name. */
+function repoSetupMarkerPath(repoDir) {
+	return `${SETUP_MARKER_DIR}/repos/${repoDir}`;
+}
 /** Blank entries never become build steps, so they never count toward the digest either. */
 function normalizeSetupCommands$1(setupCommand) {
 	return (setupCommand === void 0 ? [] : Array.isArray(setupCommand) ? setupCommand : [setupCommand]).filter((command) => command.trim() !== "");
@@ -1613,8 +1636,26 @@ function setupMarkerContent(setupCommand) {
 	return `sha256:${createHash("sha256").update(normalizeSetupCommands$1(setupCommand).join("\n")).digest("hex")}`;
 }
 /** Shell step that writes the marker relative to the cwd. `content` is a digest, so it is shell-safe. */
-function setupMarkerCommand(content) {
-	return `mkdir -p "$(dirname "${SETUP_MARKER_PATH}")" && printf '%s' '${content}' > "${SETUP_MARKER_PATH}"`;
+function setupMarkerCommand(content, markerPath = SETUP_MARKER_PATH) {
+	return `mkdir -p "$(dirname "${markerPath}")" && printf '%s' '${content}' > "${markerPath}"`;
+}
+/** A clone directory name is one path segment of word characters, dots and dashes, so it never needs quoting. */
+const REPO_DIR_PATTERN = /^[\w.-]+$/;
+/**
+* Shell step that runs one setup command inside a repository clone.
+*
+* Without the guard this is the plain `cd "<dir>" && <cmd>` step. With it,
+* the `cd` sits inside the parenthesized group so that the failure branch
+* runs back at the build cwd and the failure list lands at the workspace
+* level, never inside the repository.
+*/
+function guardedSetupCommand({ repoDir, command, continueOnFailure }) {
+	if (!REPO_DIR_PATTERN.test(repoDir)) throw new TypeError(`Repository directory "${repoDir}" must match ${REPO_DIR_PATTERN}.`);
+	if (!continueOnFailure) return `cd "${repoDir}" && ${command}`;
+	return `( cd "${repoDir}" && sh -c ${shellQuote$1(command)} ) || { mkdir -p "${SETUP_MARKER_DIR}" && grep -qxF -- '${repoDir}' "${SETUP_FAILED_MARKER_PATH}" 2>/dev/null || printf '%s\\n' '${repoDir}' >> "${SETUP_FAILED_MARKER_PATH}"; }`;
+}
+function shellQuote$1(value) {
+	return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 function repoCloneCommand({ cloneUrl, destination, branch, tokenEnv }) {
 	return `git ${tokenEnv ? `${gitAuthFlag$1(tokenEnv)} ` : ""}clone --depth=1 --single-branch ${branch ? `--branch ${shellQuote(branch)} ` : ""}${shellQuote(cloneUrl)} ${shellQuote(destination)}`;
@@ -1706,8 +1747,16 @@ function isValidCloneUrl(cloneUrl) {
 */
 function repoTemplateRef(identity) {
 	const name = repoTemplateName(identity);
+	if (identity.repos) {
+		const shas = identity.repos.map((repo) => repo.sha);
+		return shas.every(Boolean) ? `${name}:${shaTag(listSha(shas))}` : `${name}:${CURRENT_TAG}`;
+	}
 	return identity.sha ? `${name}:${shaTag(identity.sha)}` : `${name}:${CURRENT_TAG}`;
 }
+/** One digest over every repository's pinned sha, in caller order. */
+function listSha(shas) {
+	return createHash("sha256").update(shas.map((sha) => sha.toLowerCase()).join(",")).digest("hex");
+}
 function repoTemplateName(identity) {
 	const cloneUrl = normalizeCloneUrl(identity.cloneUrl);
 	const config = [
@@ -1717,7 +1766,13 @@ function repoTemplateName(identity) {
 		identity.buildEnv ? Object.entries(identity.buildEnv).sort(([a], [b]) => a.localeCompare(b)) : null,
 		identity.cpuCount ?? 2,
 		identity.memoryMB ?? 1024,
-		...identity.workingDirectory !== void 0 ? [identity.workingDirectory] : []
+		...identity.workingDirectory !== void 0 ? [identity.workingDirectory] : [],
+		...identity.repos ? [
+			"repos",
+			identity.repos.map((repo) => [normalizeCloneUrl(repo.cloneUrl), repo.setupCommand ?? null]),
+			normalizeSetupCommands(identity.workspaceSetupCommand),
+			identity.continueOnSetupFailure ?? false
+		] : []
 	];
 	const hash = createHash("sha256").update(JSON.stringify(config)).digest("hex").slice(0, 8);
 	const { owner, repo } = parseCloneUrl(cloneUrl);
@@ -1749,7 +1804,9 @@ function shaTag(sha) {
 * setup performs the full clone, so a broken build never wedges a session.
 */
 function createRepoTemplate(options) {
-	if (!options.getRepositoryAccess) return void 0;
+	if (options.getRepositoryAccess && options.repos) throw new TypeError("createRepoTemplate: pass either getRepositoryAccess or repos, not both");
+	if (!options.repos && (options.workspaceSetupCommand !== void 0 || options.continueOnSetupFailure !== void 0)) throw new TypeError("createRepoTemplate: workspaceSetupCommand and continueOnSetupFailure require repos");
+	if (!options.getRepositoryAccess && !options.repos?.length) return void 0;
 	return { resolveSpec: async () => (await resolveSpecAtHead(options)).spec };
 }
 /**
@@ -1761,24 +1818,58 @@ function createRepoTemplate(options) {
 * turns into its default-template fallback rather than a failed start.
 */
 async function resolveSpecAtHead(options) {
-	const access = options.getRepositoryAccess ? await options.getRepositoryAccess().catch(() => void 0) : void 0;
-	const cloneUrl = access?.cloneUrl;
-	if (!cloneUrl) throw new Error("Repo template has no clone URL: repository access returned none.");
-	assertCloneUrl(cloneUrl);
-	const token = access?.authorization?.token;
+	const isList = options.repos !== void 0;
+	const entries = options.repos ? options.repos : options.getRepositoryAccess ? [{
+		getRepositoryAccess: options.getRepositoryAccess,
+		setupCommand: options.setupCommand
+	}] : [];
+	if (entries.length === 0) throw new Error("Repo template has no clone URL: repository access returned none.");
 	const buildEnv = typeof options.buildEnv === "function" ? await options.buildEnv() : options.buildEnv;
-	const resolved = await resolveDefaultBranchHead(cloneUrl, token).catch(() => void 0);
-	const sha = resolved && SHA_PATTERN.test(resolved) ? resolved : void 0;
-	return {
-		spec: buildRepoTemplateSpec({
+	const repos = [];
+	const seenDirs = /* @__PURE__ */ new Map();
+	for (const [index, entry] of entries.entries()) {
+		const access = await entry.getRepositoryAccess().catch(() => void 0);
+		const cloneUrl = access?.cloneUrl;
+		if (!cloneUrl) throw new Error(`Repo template has no clone URL: repository access returned none${isList ? ` (repos[${index}])` : ""}.`);
+		assertCloneUrl(cloneUrl);
+		const repoDir = repoDirName(normalizeCloneUrl(cloneUrl));
+		const other = seenDirs.get(repoDir);
+		if (other) throw new Error(`Repo template: repositories ${other} and ${cloneUrl} would both clone into "${repoDir}"`);
+		seenDirs.set(repoDir, cloneUrl);
+		const token = access?.authorization?.token;
+		const resolved = await resolveDefaultBranchHead(cloneUrl, token).catch(() => void 0);
+		const sha = resolved && SHA_PATTERN.test(resolved) ? resolved : void 0;
+		repos.push({
 			cloneUrl,
-			...sha ? { sha } : {},
-			...normalizeSetupCommands(options.setupCommand).length > 0 ? { setupCommand: options.setupCommand } : {},
-			...buildEnv ? { buildEnv } : {},
-			...options.cpuCount !== void 0 ? { cpuCount: options.cpuCount } : {},
-			...options.memoryMB !== void 0 ? { memoryMB: options.memoryMB } : {},
-			...options.workingDirectory !== void 0 ? { workingDirectory: trimTrailingSlashes(assertWorkingDirectory(options.workingDirectory)) } : {}
-		}, token),
+			repoDir,
+			token,
+			tokenEnv: token ? isList ? `${BUILD_TOKEN_ENV}_${index}` : BUILD_TOKEN_ENV : void 0,
+			sha,
+			setupCommand: entry.setupCommand
+		});
+	}
+	const first = repos[0];
+	const spec = buildRepoTemplateSpec({
+		cloneUrl: first.cloneUrl,
+		...first.sha ? { sha: first.sha } : {},
+		...normalizeSetupCommands(first.setupCommand).length > 0 ? { setupCommand: first.setupCommand } : {},
+		...buildEnv ? { buildEnv } : {},
+		...options.cpuCount !== void 0 ? { cpuCount: options.cpuCount } : {},
+		...options.memoryMB !== void 0 ? { memoryMB: options.memoryMB } : {},
+		...options.workingDirectory !== void 0 ? { workingDirectory: trimTrailingSlashes(assertWorkingDirectory(options.workingDirectory)) } : {},
+		...isList ? {
+			repos: repos.map((repo) => ({
+				cloneUrl: repo.cloneUrl,
+				...repo.sha ? { sha: repo.sha } : {},
+				...normalizeSetupCommands(repo.setupCommand).length > 0 ? { setupCommand: repo.setupCommand } : {}
+			})),
+			...options.workspaceSetupCommand !== void 0 ? { workspaceSetupCommand: options.workspaceSetupCommand } : {},
+			...options.continueOnSetupFailure !== void 0 ? { continueOnSetupFailure: options.continueOnSetupFailure } : {}
+		} : {}
+	}, repos, options.continueOnSetupFailure ?? false);
+	const sha = isList ? repos.every((repo) => repo.sha) ? listSha(repos.map((repo) => repo.sha)) : void 0 : first.sha;
+	return {
+		spec,
 		...sha ? { sha } : {}
 	};
 }
@@ -1828,31 +1919,45 @@ function assertCloneUrl(cloneUrl) {
 * REFERENCE — the token value never appears in the command string, and no
 * credential is written to the build filesystem.
 */
-function gitAuthFlag() {
-	return `-c http.extraheader="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$${BUILD_TOKEN_ENV}" | base64 -w0)"`;
+function gitAuthFlag(tokenEnv) {
+	return `-c http.extraheader="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$${tokenEnv}" | base64 -w0)"`;
 }
-function buildRepoTemplateSpec(identity, token) {
-	const { sha, setupCommand, buildEnv, workingDirectory } = identity;
-	const cloneUrl = normalizeCloneUrl(identity.cloneUrl);
-	const repoDir = repoDirName(cloneUrl);
-	const auth = token ? `${gitAuthFlag()} ` : "";
+function buildRepoTemplateSpec(identity, repos, continueOnFailure) {
+	const { buildEnv, workingDirectory } = identity;
+	const isList = identity.repos !== void 0;
 	let template = createDefaultMountableTemplate().template;
 	const env = { ...buildEnv };
-	if (token) env[BUILD_TOKEN_ENV] = token;
+	for (const repo of repos) if (repo.tokenEnv && repo.token) env[repo.tokenEnv] = repo.token;
 	if (Object.keys(env).length > 0) template = template.setEnvs(env);
 	if (workingDirectory) {
 		const dir = trimTrailingSlashes(workingDirectory);
 		template = template.runCmd(`mkdir -p "${dir}"`).setWorkdir(dir);
 	}
-	template = template.runCmd(repoCloneCommand({
-		cloneUrl,
-		destination: repoDir,
-		...token ? { tokenEnv: BUILD_TOKEN_ENV } : {}
-	}));
-	if (sha) template = template.runCmd(`git -C "${repoDir}" ${auth}fetch origin ${sha}`).runCmd(`git -C "${repoDir}" checkout ${sha}`);
-	const setupCommands = normalizeSetupCommands(setupCommand);
-	for (const command of setupCommands) template = template.runCmd(`cd "${repoDir}" && ${command}`);
-	template = template.runCmd(setupMarkerCommand(setupMarkerContent(setupCommands)));
+	const ordered = [...repos.filter((repo) => !repo.token), ...repos.filter((repo) => repo.token)];
+	for (const repo of ordered) {
+		const { repoDir, sha, tokenEnv } = repo;
+		const cloneUrl = normalizeCloneUrl(repo.cloneUrl);
+		const auth = tokenEnv ? `${gitAuthFlag(tokenEnv)} ` : "";
+		const setupCommands = normalizeSetupCommands(repo.setupCommand);
+		template = template.runCmd(repoCloneCommand({
+			cloneUrl,
+			destination: repoDir,
+			...tokenEnv ? { tokenEnv } : {}
+		}));
+		if (sha) template = template.runCmd(`git -C "${repoDir}" ${auth}fetch origin ${sha}`).runCmd(`git -C "${repoDir}" checkout ${sha}`);
+		for (const command of setupCommands) template = template.runCmd(guardedSetupCommand({
+			repoDir,
+			command,
+			continueOnFailure
+		}));
+		const content = setupMarkerContent(setupCommands);
+		template = template.runCmd(isList ? setupMarkerCommand(content, repoSetupMarkerPath(repoDir)) : setupMarkerCommand(content));
+	}
+	if (isList) {
+		const workspaceCommands = normalizeSetupCommands(identity.workspaceSetupCommand);
+		for (const command of workspaceCommands) template = template.runCmd(command);
+		template = template.runCmd(setupMarkerCommand(setupMarkerContent(workspaceCommands), WORKSPACE_SETUP_MARKER_PATH));
+	}
 	return {
 		ref: repoTemplateRef(identity),
 		template,