fix(bootstrap): align the package version and block it from run-fns

[sroussey]

Stacked on #672 (claude/libs-issues-triage-prs-mh6x2o-574). This branch is #672 rebased onto origin/main, plus one commit.

⚠️ Read the diff from the commit, not from the base comparison. Because of that rebase the base branch is stale (it predates 0.3.39), so GitHub's comparison against it shows ~141 files — almost all of it main's drift, not this change. The actual change is 5 files / +193 −2, in commit d879ae38. Against main the branch is 24 files: #672's packages/bootstrap plus this commit. Retargeting this PR to main, or rebasing #672 itself, makes the comparison readable — recommended before review.

The rebase finding (reported first, because it changes the story)

At the #672 branch head there is nothing to fix. Verified before touching anything: every workspace and the root manifest read 0.3.38 — 43 manifests, one distinct version. The defect exists only relative to main, which released 0.3.39 (f9f4b34b chore: release 0.3.39 for 41 packages) after packages/bootstrap was branched.

After rebasing onto origin/main (clean — no conflicts, not even in bun.lock), the counts are:

{ '0.3.39': 42, '0.3.38': 1 }
  ODD: packages/bootstrap 0.3.38

42 = the root plus 41 workspaces; the straggler is the new package.

(a) What breaks

bunset --patch --all bumps each manifest from its own current value, not from a family value. So the next release takes the other 42 to 0.3.40 and publishes @workglow/bootstrap at 0.3.39 — still one behind, and one behind forever, since every subsequent release repeats the offset. packages/workglow declares "@workglow/bootstrap": "workspace:*" (verified), which resolves at publish time to whatever is on disk, so the meta-package would ship declaring a dependency on the stale version. Nothing in the release path notices.

Fixed by setting packages/bootstrap to 0.3.39 and regenerating the lockfile. The bun.lock diff is that version field and nothing else (shown in the commit).

Test: packages/test/src/test/util/WorkspaceVersions.test.ts asserts the set of version values across the root manifest and every packages/*, providers/*, examples/* manifest has size 1, and names the manifests per version so a failure says which file to edit. Private workspaces are included on purpose — bunset --all bumps packages/test, providers/aws and providers/cloudflare too, so exempting them would recreate the same hole one tier down. RED immediately after the rebase (expected 2 to be 1, listing packages/bootstrap/package.json alone against the other 42), green after the bump.

(b) bootstrapWorkglow is importable from a run-fn

eslint.config.js:73 blocks globalServiceRegistry / credential-store imports inside **/*_JobRunFns.ts — but only from @workglow/util and @workglow/util/worker. @workglow/bootstrap now exports bootstrapWorkglow(), which calls registerAllDefaults(globalServiceRegistry) and setLogger(..., globalServiceRegistry). It sits at the ai tier, so any providers/* run-fn can import it directly and the existing guard says nothing.

@workglow/bootstrap and workglow/bootstrap (the meta-package republishes the same surface, one specifier away) are added to paths, blocking the modules wholesale rather than by importNames: the package's entire public surface is registry mutation, so a name list would be the whole surface and would drift the moment one was added. The message keeps the voice of the existing two — a run-fn executes in a worker with its own globalServiceRegistry, so bootstrapWorkglow mutates a registry the main thread never sees; resolve the services in the task class and pass them through the serialized job input.

Test: scripts/eslintRestrictedImports.test.ts, using the ESLint Node API with lintText and a synthetic providers/openai/src/ai/common/Fixture_JobRunFns.ts filePath. No file is written — the path only has to match the config glob — and the config uses a plain parser with no type-aware project service, so the whole file runs in ~6s. Asserts:

• the bootstrap import yields exactly one no-restricted-imports error (RED today: zero);
• the workglow/bootstrap subpath likewise (RED today: zero);
• the same import under a non-run-fn path yields none;
• the existing globalServiceRegistry from @workglow/util case still errors;
• an unrelated @workglow/util import (uuid4) still passes — proving that entry stays name-scoped while the new ones are wholesale.

Verification

• bun scripts/test.ts util unit vitest — 56 files, 767 passed / 10 skipped.
• bun scripts/test.ts scripts vitest — 3 files, 15 tests, all passing.
• bun scripts/test.ts --check-sections — every test file still reachable, so both new files run in CI.
• RED confirmed for both halves by reverting each change in isolation and re-running.
• npx prettier --check on all changed files — clean.

Two notes on the environment, stated rather than glossed:

• The first util run failed 2 files (BootstrapReadme, BootstrapPackageExports) because packages/bootstrap/dist did not exist in this checkout — use-source had been run before the package was added, so it had no stubs. bun run use-source (which writes only gitignored stubs) fixed it and both went green. Not related to this change, but worth knowing for anyone else picking the branch up after a rebase.
• npx tsgo -p packages/test/tsconfig.json reports ~4925 error lines in this checkout with and without this change, identically, and none mention the new files. That config is not a usable signal here (source-stub mode with no built declarations), so the new tests were verified by running them rather than by typechecking that project.

---

Generated by Claude Code

[sroussey]

Superseded by a8f1f30 on claude/libs-issues-triage-prs-mh6x2o-574 (#672). Closing.

This branch was a divergent re-do of #672 rather than a stack on top of it — its merge-base with #672 is 8e2cea5, before either branch's bootstrap work — so it did not actually merge (add/add conflict on packages/bootstrap/package.json, plus bun.lock), despite showing as mergeable.

Comparing the two heads directly, every packages/bootstrap source file is byte-identical between them, and #672 had already absorbed the README, LICENSE, exports test, README test, license field and the dropped bun target. What remained unique here was:

• packages/test/src/test/util/WorkspaceVersions.test.ts
• scripts/eslintRestrictedImports.test.ts
• the @workglow/bootstrap / workglow/bootstrap restriction in eslint.config.js
• packages/bootstrap 0.3.38 → 0.3.39

The first three were applied to #672 unchanged. The version bump was deliberately not carried over: it is only correct in the presence of this branch's main merge. On #672 the root, all siblings and packages/bootstrap are consistently at 0.3.38, so WorkspaceVersions passes there as-is — applying the bump alone would have failed the very test it ships with.

Verified on #672 after the cherry-pick: WorkspaceVersions 2/2, eslintRestrictedImports 5/5, scripts section green, and --check-sections reports every test file reachable.

Bringing main into #672 is still worth doing, but as its own change rather than bundled into a version-and-lint PR.

---

Generated by Claude Code