Function reconstituteWorkspace

packages/ai-sandbox-cloudflare/src/runner.ts:105–122

* Rebuild the request's workspace with a real `createSecrets`, pulling each * referenced secret's VALUE from the container env. Secret values never cross * the `POST /run` boundary (`createSecrets` stores them under a non-enumerable * symbol, so serializing the workspace carries only the names) —

(
  workspace: WorkspaceDefinition,
)

 * keyless run.
 */
function reconstituteWorkspace(
  workspace: WorkspaceDefinition,
): WorkspaceDefinition {
  if (workspace.secrets === undefined) return workspace
  const names = Object.keys(workspace.secrets)
  if (names.length === 0) return workspace
  const values: Record<string, string> = {}
  for (const name of names) {
    const value = process.env[name]
    if (value === undefined || value === '') {
      throw new Error(
        `runInContainerHarness: secret "${name}" is not set in the container env`,
      )
    }
    values[name] = value
  }
  return defineWorkspace({ ...workspace, secrets: createSecrets(values) })
}

/**
 * Build the `chat()` stream that runs the harness on THIS container via the