[TheGreatAxios]

Summary

CL-8152 (under parent CL-8151): the end state is that workflows/* and
every packages/*-tools package become published npm packages any
Interchange-backed hub can install and deploy through the stock
POST /api/tenants/:id/workflows/deployments route — no Workbench repo
checkout, no vendor/intx reach-through, no Workbench-only hub route.

This PR inventories every import in workflows/* and packages/*tools*
that resolves to something Workbench-internal, and cuts the two real
violations found.

Inventory

Scope scanned: 14 workflows/* packages, 17 packages/*tools* packages
(*-tools, tools-*). Searched for @workbench/* imports, @corbits/chat,
relative paths escaping the package, vendor/intx/* relative paths, and
workspace:* deps on non-publishable (private: true) packages.

File → import	What it is	What was done
packages/connections-tools/src/tool.ts → @workbench/templates/connectors (CONNECTOR_REGISTRY, MCP_PRESETS)	Workbench's concrete, product-specific connector/MCP-preset set, statically baked into the tool bundle	Cut. The bundle now takes connectorRegistry/mcpPresets through its WorkflowConnectionEnv, so any deploying build supplies its own connector lineup — same pattern as every other hub-URL env key this bundle already takes. Tests updated with a small local fixture registry instead of the real product set.
packages/capability-tools/src/client.ts, packages/workflow-authoring-tools/src/client.ts → @corbits/workflows/client (runBearerHeaders, runBearerFetch, runBearerErrorMessage, RunBearerClientConfig)	A ~50-line generic fetch-header helper, reached through @corbits/workflows — a private: true root-bucket package with a large server dependency graph (drizzle-orm, hono, @intx/hub-api, ...), even though the ./client subpath itself is browser-safe	Cut. Each package now carries its own copy (src/run-bearer.ts) rather than depending on a private package just for this.
workflows/assistant/test/manager-tools-scenario.test.ts → connector env	Was previously getting Workbench's real connector set for free via connections-tools' old static import; broke once that import was cut	Fixed: the test now explicitly imports @workbench/templates/connectors as a devDependency (test-only — not part of the published package) and wires it into the env, since this scenario deliberately exercises Myra's real shipped connector lineup.

Everything else scanned came back clean:

• No real @corbits/chat, ../../apps, or ../../vendor imports anywhere
  in scope — the handful of hits were doc comments referencing those
  paths by name, not actual imports.
• vendor/intx/* is reached only through normal @intx/* package deps
  (workspace:* resolving to the vendored copy per VENDORED.md's
  sanctioned vendoring flow) — never a raw relative path into vendor/.
• @corbits/connections/registry and @corbits/connections/mcp-presets
  (used by connections-tools) are explicitly documented, browser-safe,
  generic subpaths of a private package (mirrors @corbits/workflows/client's
  pattern) — noted rather than inlined, per the ticket's own exception for
  a genuinely-needed Workbench-owned service.
• Every other packages/*-tools and workflows/* dependency on a
  workspace:* package not under @corbits//publishable turned out to be
  a devDependency (test-only fixtures, e2e DB harness helpers) — these
  never ship in the published package, so they don't block standalone
  install.

Not fixed (out of scope for this ticket)

• Every *-tools package (and workflows/*) is still package.json
"private": true — flipping that to actually publish is CL-8151's
  broader end state, not this import-cutting pass.
• @corbits/connections itself stays private: true; only its two
  generic subpaths are consumed here (see inventory above).

Test plan

• bun run typecheck
• bun run check:structural (tool-package-freshness required version
  bumps for the three tool packages whose src/ changed:
  @corbits/capability-tools 0.0.5→0.0.6, @corbits/connections-tools
  0.0.8→0.0.9, @corbits/workflow-authoring-tools 0.0.5→0.0.6, with
  matching pin-literal updates in workflows/assistant/src/index.ts)
• bun test in packages/connections-tools, packages/capability-tools,
  packages/workflow-authoring-tools, workflows/assistant
• bun run lint has one pre-existing failure (3 unused-var errors in
  apps/hub/src/index.ts), unrelated to this change and present on
  origin/main before this branch

https://claude.ai/code/session_01RweuMUskU2nvcFhdckc7EG

[linear-code]

CL-8152