Rename @workbench/connections to @corbits/connections

IMPLEMENTATION.md

@@ -152,7 +152,7 @@ them).
 
 The in-room `connect-github` card and the Plugins/Connections GitHub row
 are **PAT-first** (CL-6345): the person pastes a personal access token;
-the host tests and stores it through `@workbench/connections`' generic
+the host tests and stores it through `@corbits/connections`' generic
 `github/complete` route. The card then flips in place to pick repos
 (`startReviewingRepos`), including when GitHub is already connected —
 the in-room card reads live state; there is no `/new` already-connected
@@ -244,7 +244,7 @@ handshake.
 list a workbench host launches with (`workbenchHostInferencePreferences`
 on the chat adapter; also `tenantDefaultModel` on agent-definition
 routes). It keeps credentialed completion-capable offerings
-(`preferCompletionCapable` in `@workbench/connections/model-capability`
+(`preferCompletionCapable` in `@corbits/connections/model-capability`
 — embedding names never win) and, when any survivor is
 `origin.direct`, picks from that direct set only. Inherit-only catalogs
 still sort among inherited completion rows.

apps/hub/package.json

@@ -63,7 +63,7 @@
     "@intx/workflow-deploy": "workspace:*",
     "@modelcontextprotocol/sdk": "catalog:",
     "@workbench/access-policy": "workspace:*",
-    "@workbench/connections": "workspace:*",
+    "@corbits/connections": "workspace:*",
     "@corbits/hub-api-client": "workspace:*",
     "@corbits/seeding": "workspace:*",
     "@workbench/onboarding": "workspace:*",

apps/hub/src/config.ts

@@ -44,7 +44,7 @@ import {
   envProviderBaseUrlsFrom,
   envProviderKeysFrom,
 } from "@workbench/onboarding";
-import type { SupportedCredentialProvider } from "@workbench/connections/credential-test";
+import type { SupportedCredentialProvider } from "@corbits/connections/credential-test";
 
 const HTTP_URL = /^https?:\/\/.+$/;
 

apps/hub/src/connection-live-reconcile.test.ts

@@ -3,7 +3,7 @@
 // and not persist-only. `createHub` is not booted here; this is the
 // hook body `apps/hub/src/index.ts` fires from `settleServiceConnection`.
 import { describe, expect, test } from "bun:test";
-import { CONNECTOR_REGISTRY } from "@workbench/connections/registry";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
 import { reconcilePinnedToolPackagesAfterConnect } from "./connection-live-reconcile";
 
 describe("reconcilePinnedToolPackagesAfterConnect", () => {

apps/hub/src/connection-live-reconcile.ts

@@ -6,7 +6,7 @@
 // until this pass relaunches it. Persist-only (stamp the pin onto the
 // launch row and leave the run) is the bug: the sidecar keeps the old
 // snapshot.
-import { CONNECTOR_REGISTRY } from "@workbench/connections/registry";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
 
 export type PinnedToolPackageReconcile = {
   reconcilePinnedToolPackages(

apps/hub/src/credential-expiry-sweep.ts

@@ -43,7 +43,7 @@ import {
   mcpSlugOf,
   refreshMcpOAuthTokens,
   type McpOAuthRefreshResult,
-} from "@workbench/connections";
+} from "@corbits/connections";
 import type {
   OAuthClientInformationMixed,
   OAuthTokens,
@@ -356,7 +356,7 @@ export type CredentialExpirySweepDeps = {
    * same redirect URI the original connect used. */
   hubUrl: string;
   /** Re-invokes the MCP SDK's `auth()` orchestrator non-interactively.
-   * Defaults to the real `@workbench/connections` implementation;
+   * Defaults to the real `@corbits/connections` implementation;
    * overridable so a test can stub the authorization server round trip. */
   refreshMcpTokens?: typeof refreshMcpOAuthTokens;
   /** Injectable for deterministic tests; defaults to `Date.now`-backed wall time. */

apps/hub/src/grant-allowance.ts

@@ -5,7 +5,7 @@
 //   - `createMcpServerToolsAllowanceLoader` — the live `tools/list`
 //     read `@corbits/mcp-tools`' `mcp_call` classifier verifies a
 //     downstream tool's `readOnlyHint` claim against, built from the
-//     tenant's stored MCP connection (`@workbench/connections`) and its
+//     tenant's stored MCP connection (`@corbits/connections`) and its
 //     decrypted token, mirroring how `mcp-credential-bindings.ts` names
 //     the same connections for tool delivery.
 //   - `createAllowanceAutoApprover` — the native-resolve binding that
@@ -27,7 +27,7 @@ import {
   withMcpConnection,
   type McpServerToolsLoader,
 } from "@corbits/mcp-tools";
-import { listMcpServerConnections } from "@workbench/connections";
+import { listMcpServerConnections } from "@corbits/connections";
 import { MCP_NO_TOKEN_SENTINEL } from "@corbits/credential-providers";
 
 function bearerFetch(token: string | undefined): typeof fetch {

apps/hub/src/index.ts

@@ -192,8 +192,8 @@ import {
   workflowDisplayName,
   workbenchTemplateLibraryEntries,
 } from "@workbench/templates";
-import { createConnectGithubRoutes } from "@workbench/connections/connect-github-routes";
-import { webhookTriggerName } from "@workbench/connections/connect-github-setup";
+import { createConnectGithubRoutes } from "@corbits/connections/connect-github-routes";
+import { webhookTriggerName } from "@corbits/connections/connect-github-setup";
 import { createTemplateBlockRoutes } from "./templates/template-block-routes";
 import {
   createWorkflowDetailRoute,
@@ -287,7 +287,7 @@ import {
   createPresenceRoutes,
   type PresenceRoomKey,
 } from "@corbits/presence";
-import { supportedCredentialProviders } from "@workbench/connections/credential-test";
+import { supportedCredentialProviders } from "@corbits/connections/credential-test";
 import { createGitWorkflowPusher } from "@corbits/seeding";
 import { createHubAPI } from "@corbits/hub-api-client";
 import {
@@ -305,13 +305,13 @@ import {
   createWorkflowConnectionRoutes,
   DEFAULT_RETURN_PATH_ALLOWLIST,
   listMcpServerConnections,
-} from "@workbench/connections";
-import type { ServiceConnectedHook } from "@workbench/connections";
-import { CONNECTOR_REGISTRY } from "@workbench/connections/registry";
+} from "@corbits/connections";
+import type { ServiceConnectedHook } from "@corbits/connections";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
 import {
   createProviderHealthPort,
   createProviderHealthStore,
-} from "@workbench/connections/provider-health";
+} from "@corbits/connections/provider-health";
 import {
   applyAccessPolicyMigrations,
   createAccessPolicyRoutes,
@@ -762,7 +762,7 @@ export async function createHub(config: HubConfig) {
   // See `./mcp-credential-bindings.ts`'s own doc.
   const mcpCredentialBindingsFor = createMcpCredentialBindingsFor(db);
   // Same owning check GET /connections uses — see
-  // `@workbench/connections`' `workflow-connection-routes.ts` and the
+  // `@corbits/connections`' `workflow-connection-routes.ts` and the
   // `createWorkflowConnectionRoutes` wiring below. Not
   // `listConnectedProviders` (catalog-only).
   const isConnectorConnected = async (tenantId: string, connectorId: string) =>
@@ -2335,7 +2335,7 @@ export async function createHub(config: HubConfig) {
     }),
   );
   // Connections' own OAuth connect flow (CL-6389): `createOAuthConnectRoutes`
-  // (`@workbench/connections`) was exported but never mounted here — every
+  // (`@corbits/connections`) was exported but never mounted here — every
   // provider whose descriptor sets `oauth` (OpenRouter, Hugging Face, and
   // the GitHub App path) needs this to complete a one-click connect from
   // the settings surface above. Follows #115's `mcp-servers/oauth` mount
@@ -3396,7 +3396,7 @@ export async function createHub(config: HubConfig) {
       envAllowedDomains: config.allowedEmailDomains,
       allowUnverifiedEmails: config.allowUnverifiedEmails,
     },
-    // Same provider-health store `@workbench/connections`' own routes
+    // Same provider-health store `@corbits/connections`' own routes
     // report to and clear (CL-6092) — a successful `/complete` here must
     // clear the same record the shell banner's zero-provider "Fix it"
     // routed someone to onboarding to fix.

apps/hub/src/mcp-credential-bindings.ts

@@ -3,7 +3,7 @@
 // supplied by the composition root rather than derived by the deploy-time
 // capability walk. `@corbits/mcp-tools`' credential handles are dynamic
 // (one `mcp.<slug>` per tenant-connected server), so this builds one
-// `CredentialBinding` per connection `@workbench/connections`' own
+// `CredentialBinding` per connection `@corbits/connections`' own
 // `listMcpServerConnections` lists for the tenant: `handle` mirrors the
 // `mcp.<slug>` convention `@corbits/mcp-tools`' `mcpCredentialHandle(slug)`
 // resolves against (conforms to `@intx/types`' `ToolCredentialHandle`
@@ -13,7 +13,7 @@
 import type { DB } from "@intx/db";
 import type { CredentialBinding } from "@intx/types";
 import type { McpCredentialBindingsFor } from "@corbits/folded-runs";
-import { listMcpServerConnections } from "@workbench/connections";
+import { listMcpServerConnections } from "@corbits/connections";
 
 const MCP_TOOLS_PACKAGE = "@corbits/mcp-tools";
 

apps/hub/src/pinned-package-credential-bindings.ts

@@ -13,7 +13,7 @@
 import type { CredentialBinding } from "@intx/types";
 import type { ToolPackagePin } from "@intx/types/tool-packages";
 import type { PinnedPackageCredentialBindingsFor } from "@corbits/folded-runs";
-import { CONNECTOR_REGISTRY } from "@workbench/connections/registry";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
 
 export type IsConnectorConnected = (
   tenantId: string,

apps/hub/test/credential-expiry-sweep.test.ts

@@ -17,7 +17,7 @@ import {
   type RefreshableMcpCredential,
 } from "../src/credential-expiry-sweep";
 import type { ExpiringCredential } from "@corbits/notify";
-import type { McpOAuthRefreshResult } from "@workbench/connections";
+import type { McpOAuthRefreshResult } from "@corbits/connections";
 
 const HUB_URL = "http://hub.test";
 

apps/web/package.json

@@ -47,7 +47,7 @@
     "@radix-ui/react-dialog": "^1.1.15",
     "@radix-ui/react-slot": "^1.2.3",
     "@tanstack/react-query": "catalog:",
-    "@workbench/connections": "workspace:*",
+    "@corbits/connections": "workspace:*",
     "@workbench/templates": "workspace:*",
     "arktype": "catalog:",
     "react": "^19.2.0",

apps/web/src/agents-api.ts

@@ -23,7 +23,7 @@ import {
   UnauthenticatedError,
   toAPIQuery,
 } from "@corbits/api-query";
-import { isChatPickerModelName } from "@workbench/connections/model-capability";
+import { isChatPickerModelName } from "@corbits/connections/model-capability";
 import { tenantKeys } from "./query-client";
 
 export type AgentDefinition = typeof WorkflowDefinitionResponse.infer;

apps/web/src/connect-github-actions.ts

@@ -10,7 +10,7 @@
 // (`connect-github-block.tsx`'s `DisconnectedBody`) is what actually asks
 // for the token, so this binding never needs a prompt or a modal of its
 // own. Reading state and starting reviews call the workbench-scoped routes
-// `@workbench/connections`'s `createConnectGithubRoutes` exposes.
+// `@corbits/connections`'s `createConnectGithubRoutes` exposes.
 //
 // `subscribeConnectState` has no server push to fold from yet (connecting a
 // credential publishes no `chat.settings` event of its own — only

apps/web/src/connect-service-actions.ts

@@ -27,8 +27,8 @@ import {
   listMcpPresets,
   McpServersApiError,
 } from "@corbits/plugins-ui";
-import { CONNECTOR_REGISTRY } from "@workbench/connections/registry";
-import { mcpPresetBySlug } from "@workbench/connections/mcp-presets";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
+import { mcpPresetBySlug } from "@corbits/connections/mcp-presets";
 
 function bareConnectorId(connectorId: string): string {
   return connectorId.startsWith("mcp:")

apps/web/src/granola-plugin-availability.ts

@@ -28,7 +28,7 @@ export async function fetchGranolaPluginConnected(
   const parsed = ResolvedCredential(body);
   if (parsed instanceof type.errors) return false;
   // Revoked reads as not connected — same rule as
-  // `@workbench/connections/plugins`' resolveOne.
+  // `@corbits/connections/plugins`' resolveOne.
   return (
     parsed.status === "active" ||
     parsed.status === "expired" ||

apps/web/src/onboarding.ts

@@ -6,7 +6,7 @@
 // so a broken provisioning call never leaves the user silently benchless.
 
 import { type } from "arktype";
-import type { SupportedCredentialProvider } from "@workbench/connections/credential-test";
+import type { SupportedCredentialProvider } from "@corbits/connections/credential-test";
 
 const ProvisionResult = type({
   kind: "'existing-member' | 'provisioned' | 'needs-onboarding'",

apps/web/src/pages/onboarding-page.tsx

@@ -32,7 +32,7 @@ import { Key, WarningCircle } from "@corbits/icons";
 import { WorkbenchLoadingState } from "@corbits/chat-ui";
 import { useCallback, useEffect, useState } from "react";
 import type { FormEvent } from "react";
-import { OLLAMA_PLACEHOLDER_SECRET } from "@workbench/connections/credential-test";
+import { OLLAMA_PLACEHOLDER_SECRET } from "@corbits/connections/credential-test";
 
 import { useNavigate } from "../navigation";
 import {

apps/web/src/pages/plugins-page.tsx

@@ -21,10 +21,10 @@ import {
   PluginConnectPanel,
   type PluginsGalleryTab,
 } from "@corbits/plugins-ui";
-import type { ResolvedPlugin } from "@workbench/connections/plugins";
-import { listPluginsForTenant } from "@workbench/connections/plugins";
-import { CONNECTOR_REGISTRY } from "@workbench/connections/registry";
-import { MCP_PRESETS } from "@workbench/connections/mcp-presets";
+import type { ResolvedPlugin } from "@corbits/connections/plugins";
+import { listPluginsForTenant } from "@corbits/connections/plugins";
+import { CONNECTOR_REGISTRY } from "@corbits/connections/registry";
+import { MCP_PRESETS } from "@corbits/connections/mcp-presets";
 import { Plus, SquaresFour, Warning } from "@corbits/icons";
 import { useCallback, useEffect, useRef, useState } from "react";
 

apps/web/src/shell/provider-health-banner.tsx

@@ -14,8 +14,8 @@
 // nothing unhealthy), and `unhealthy` (guided Fix-it banner).
 
 import { Button } from "@corbits/react-ui";
-import { connectorDescriptors } from "@workbench/connections/registry";
-import type { ClassifiedInferenceFailureCategory } from "@workbench/connections/provider-health";
+import { connectorDescriptors } from "@corbits/connections/registry";
+import type { ClassifiedInferenceFailureCategory } from "@corbits/connections/provider-health";
 import { Warning, X } from "@corbits/icons";
 import { useEffect, useState } from "react";
 
@@ -49,7 +49,7 @@ const COLLAPSE_TRANSITION_MS = 220;
 
 const POLL_ERROR_COPY = "Couldn't check provider health. Try again shortly.";
 
-// The connector registry's own `displayName` (`@workbench/connections/registry`,
+// The connector registry's own `displayName` (`@corbits/connections/registry`,
 // the same browser-safe subpath `plugins.ts` already reads) — never a
 // reinvented title-case of the provider id, which mangles ids like
 // `"google-genai"` or `"opencode-zen"` into nonsense. Falls back to the

apps/web/src/shell/provider-health-context.tsx

@@ -35,7 +35,7 @@ import {
   fetchProviderHealth,
   type ClassifiedInferenceFailureCategory,
   type ProviderHealthRecord,
-} from "@workbench/connections/provider-health";
+} from "@corbits/connections/provider-health";
 
 import { useBench } from "../bench-context";
 

apps/web/test/onboarding.test.tsx

@@ -13,7 +13,7 @@ import { renderToStaticMarkup } from "react-dom/server";
 import {
   OLLAMA_PLACEHOLDER_SECRET,
   supportedCredentialProviders,
-} from "@workbench/connections/credential-test";
+} from "@corbits/connections/credential-test";
 
 import { App } from "../src/app";
 import { NavigationProvider } from "../src/navigation";
@@ -62,7 +62,7 @@ const signedIn: SessionState = {
 describe("CREDENTIAL_PROVIDERS", () => {
   // ProviderPicker (onboarding-page.tsx) renders one card per entry here —
   // this is the data the cards are built from, so covering it covers what
-  // actually shows up: one card per `@workbench/connections` provider the
+  // actually shows up: one card per `@corbits/connections` provider the
   // hub can actually test a credential against, each with a distinct
   // honest one-liner and a real key-console link. Compared against
   // `supportedCredentialProviders()` directly, not a second hand-copied