- Dropped a pointless f-string prefix (no placeholders) on the default
plugin description.
- Replaced two bare except:pass/continue blocks (manifest.json listing,
config_schema.json parsing) with a logged warning before falling
through to the same skip-this-entry behavior -- same control flow,
now visible in logs instead of silent.
Skipped as false positives (verified against actual usage, not fixed):
- Jinja2 Environment(autoescape=False) -- this env renders manager.py.j2,
a Python source-code generator, never HTML; autoescaping would corrupt
generated code. Flagged by a generic XSS rule that assumes all Jinja2
environments render HTML.
- "Flask route directly returning a formatted string" on _as_rgb_filter
-- that's a Jinja *filter* function, not a Flask route.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEZK1P1Q1fu5pcuVrkrCFZ
Web UI (/composer/) for building a working LEDMatrix plugin without
writing Python: drop elements (text, time, date, countdown, scrolling
text, bar/waveform, groups, custom config variables) onto a canvas
matching the real panel's pixel grid, configure them with live preview,
then generate a real plugin (manager.py + manifest.json + config_schema.json)
from manager.py.j2 -- downloadable as a ZIP or installed directly.
NOTE: composer_bp is not yet registered in web_interface/app.py, so this
blueprint is currently inert. Split out of the original chore/dead-code-
removal commit, which had accidentally bundled this in alongside unrelated
dead-code deletions; app.py registration was not part of that commit
either and still needs to be added before this is reachable.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEZK1P1Q1fu5pcuVrkrCFZ
