Route workspace-mcp through API Gateway to bypass SCP Lambda URL block

cdk/lib/agent-claw-stack.ts

@@ -276,6 +276,15 @@ export class AgentClawStack extends cdk.Stack {
       ),
     });
 
+    // workspace-mcp proxy route — no auth (SCP blocks Lambda Function URLs)
+    httpApi.addRoutes({
+      path: '/workspace/{proxy+}',
+      methods: [apigatewayv2.HttpMethod.ANY],
+      integration: new apigatewayv2integrations.HttpLambdaIntegration(
+        'WorkspaceMcpIntegration', workspaceMcpFn
+      ),
+    });
+
     // Set OAUTH_REDIRECT_URI now that we have the API URL
     const oauthRedirectUri = `${httpApi.url}oauth/callback`;
     oauthHandlerFn.addEnvironment('OAUTH_REDIRECT_URI', oauthRedirectUri);