From 3bbf0fa79648236ca87b521d0fc7170bcaecbc19 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Wed, 14 Oct 2026 18:20:58 +0200
Subject: [PATCH] fix: let the lite build pass with the plugin proxy and
 secrets routes in the bundle

---
 scripts/lite/lib.mjs | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/lite/lib.mjs b/scripts/lite/lib.mjs
index 0a36aa9f9..a76d2aa2e 100644
--- a/scripts/lite/lib.mjs
+++ b/scripts/lite/lib.mjs
@@ -82,6 +82,10 @@ export const LITE_API_STRING_ALLOWLIST = [
   "/api/plugin-signing-pubkey",
   "/api/admin/plugins",
   "/api/admin/themes",
+  // lib/plugin-sandbox/proxy-client.ts + connect-dialog.ts - only called by
+  // loaded plugins and the plugins settings tab; pluginsEnabled is pinned off.
+  "/api/plugin-proxy",
+  "/api/plugin-secrets",
   // stores/settings-store.ts - settingsSyncEnabled is pinned off.
   "/api/settings",
   // Stalwart's own account discovery (lib/auth/lite-oauth.ts), not a route of this app.