From a74257732a1ed9d83b057768868657004921a763 Mon Sep 17 00:00:00 2001
From: simosmik <simosmik@gmail.com>
Date: Thu, 5 Mar 2026 16:36:39 +0000
Subject: [PATCH] fix: paths

---
 src/components/plugins/PluginTabContent.tsx | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/components/plugins/PluginTabContent.tsx b/src/components/plugins/PluginTabContent.tsx
index 37a9d268..602824ac 100644
--- a/src/components/plugins/PluginTabContent.tsx
+++ b/src/components/plugins/PluginTabContent.tsx
@@ -68,8 +68,16 @@ export default function PluginTabContent({
 
     (async () => {
       try {
-        // @vite-ignore — path is dynamic at runtime, not a static import
-        const mod = await import(/* @vite-ignore */ `/api/plugins/${encodeURIComponent(pluginName)}/assets/${entryFile}`);
+        // Fetch the plugin JS with auth headers (Cloudflare Worker requires auth on all routes).
+        // Then import it via a Blob URL so the browser never makes an unauthenticated request.
+        const assetUrl = `/api/plugins/${encodeURIComponent(pluginName)}/assets/${entryFile}`;
+        const res = await authenticatedFetch(assetUrl);
+        if (!res.ok) throw new Error(`Failed to fetch plugin (HTTP ${res.status})`);
+        const jsText = await res.text();
+        const blob = new Blob([jsText], { type: 'application/javascript' });
+        const blobUrl = URL.createObjectURL(blob);
+        // @vite-ignore
+        const mod = await import(/* @vite-ignore */ blobUrl).finally(() => URL.revokeObjectURL(blobUrl));
         if (!active || !containerRef.current) return;
 
         moduleRef.current = mod;