fix: serve AI Workspace bridge package from hub

services/ai-workspace-hub/src/server.mjs

@@ -68,6 +68,7 @@ app.post("/api/ai-workspace/hub/v1/agents/:pairingCode/dispatch", requireInterna
 
 app.post("/api/ai-workspace/assistant/v1/actions", requireInternalApi, asyncRoute(proxyAssistantActions));
 app.post("/api/ai-workspace/setup-codes/redeem", asyncRoute(proxySetupCodeRedeem));
+app.get("/api/ai-workspace/bridge-package.tgz", asyncRoute(proxyBridgePackage));
 
 app.post("/api/ai-workspace/hub/v1/assistant-relays/:relayId/actions", requireInternalApi, asyncRoute(callAssistantRelayAction));
 app.post("/api/ai-workspace/hub/v1/assistant-relays/:relayId/poll", requireInternalApi, asyncRoute(pollAssistantRelay));
@@ -324,6 +325,38 @@ async function proxySetupCodeRedeem(req, res) {
   res.send(text);
 }
 
+async function proxyBridgePackage(_req, res) {
+  if (!config.assistantInternalUrl || !config.assistantInternalAccessToken) {
+    res.status(503).json({ ok: false, error: "assistant_bridge_package_proxy_not_configured" });
+    return;
+  }
+  const targetUrl = `${config.assistantInternalUrl.replace(/\/+$/, "")}/api/ai-workspace/assistant/v1/bridge-package.tgz`;
+  const upstream = await fetch(targetUrl, {
+    method: "GET",
+    redirect: "manual",
+    headers: {
+      Accept: "application/octet-stream",
+      Authorization: `Bearer ${config.assistantInternalAccessToken}`,
+    },
+  });
+  const contentType = upstream.headers.get("content-type") || "application/octet-stream";
+  const body = Buffer.from(await upstream.arrayBuffer());
+  res.status(upstream.status);
+  res.setHeader("content-type", contentType);
+  for (const header of [
+    "cache-control",
+    "pragma",
+    "expires",
+    "surrogate-control",
+    "content-disposition",
+    "x-ai-workspace-bridge-package-sha256",
+  ]) {
+    const value = upstream.headers.get(header);
+    if (value) res.setHeader(header, value);
+  }
+  res.send(body);
+}
+
 async function callAssistantRelayAction(req, res) {
   const relayId = cleanRelayId(req.params.relayId);
   if (!relayId) {