refactor(api): resolve sudo/systemctl/reboot/poweroff paths at startup

Use shutil.which() with safe fallbacks for the four privileged binaries
instead of relying on bare names being resolved by the subprocess shell
search. Resolves paths once at module load rather than per-call.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.codacy.yml

@@ -1,7 +0,0 @@
----
-exclude_paths:
-  - "plugin-repos/**"
-  - "plugins/**"
-  - "assets/**"
-  - "test/**"
-  - "scripts/debug/**"

.github/workflows/claude-code-review.yml

@@ -1,44 +0,0 @@
-name: Claude Code Review
-
-on:
-  pull_request:
-    types: [opened, synchronize, ready_for_review, reopened]
-    # Optional: Only run on specific file changes
-    # paths:
-    #   - "src/**/*.ts"
-    #   - "src/**/*.tsx"
-    #   - "src/**/*.js"
-    #   - "src/**/*.jsx"
-
-jobs:
-  claude-review:
-    # Optional: Filter by PR author
-    # if: |
-    #   github.event.pull_request.user.login == 'external-contributor' ||
-    #   github.event.pull_request.user.login == 'new-developer' ||
-    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
-
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code Review
-        id: claude-review
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
-          plugins: 'code-review@claude-code-plugins'
-          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
-

.github/workflows/claude.yml

@@ -1,50 +0,0 @@
-name: Claude Code
-
-on:
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  issues:
-    types: [opened, assigned]
-  pull_request_review:
-    types: [submitted]
-
-jobs:
-  claude:
-    if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-      actions: read # Required for Claude to read CI results on PRs
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Run Claude Code
-        id: claude
-        uses: anthropics/claude-code-action@v1
-        with:
-          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-
-          # This is an optional setting that allows Claude to read CI results on PRs
-          additional_permissions: |
-            actions: read
-
-          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
-          # prompt: 'Update the pull request description to include a summary of changes.'
-
-          # Optional: Add claude_args to customize behavior and configuration
-          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
-          # or https://code.claude.com/docs/en/cli-reference for available options
-          # claude_args: '--allowed-tools Bash(gh pr *)'
-

.github/workflows/security-audit.yml

@@ -1,277 +0,0 @@
-name: Security Audit
-
-on:
-  push:
-    branches:
-      - main
-      - 'feat/**'
-  pull_request:
-    branches:
-      - main
-  schedule:
-    # Weekly full scan — catches new CVEs in existing deps
-    - cron: '0 6 * * 1'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  pull-requests: write
-  security-events: write
-
-jobs:
-
-  # ─────────────────────────────────────────────────────────────────────────
-  # SAST — Static Application Security Testing
-  # ─────────────────────────────────────────────────────────────────────────
-  sast:
-    name: Static Analysis (bandit + semgrep)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      - name: Install SAST tools
-        run: pip install bandit==1.8.3 semgrep
-
-      # Bandit — Python-specific security linter
-      # --exit-zero: findings are warnings, not CI blockers.
-      # The security-report job interprets severity.
-      - name: Run bandit
-        run: |
-          bandit -r src/ web_interface/ \
-            -c bandit.yaml \
-            -f json \
-            -o bandit-results.json \
-            --exit-zero
-
-      # Semgrep — broader pattern-based analysis
-      # || true: prevents network/rate-limit errors from blocking the workflow
-      - name: Run semgrep
-        run: |
-          semgrep --config "p/python" \
-            --config "p/flask" \
-            --json \
-            --output semgrep-results.json \
-            src/ web_interface/ \
-            || true
-
-      - name: Upload SAST artifacts
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: sast-results
-          path: |
-            bandit-results.json
-            semgrep-results.json
-          retention-days: 30
-
-
-  # ─────────────────────────────────────────────────────────────────────────
-  # Dependency Vulnerability Scanning
-  # ─────────────────────────────────────────────────────────────────────────
-  dependency-audit:
-    name: Dependency Audit (pip-audit + safety)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      - name: Install audit tools
-        run: pip install pip-audit safety
-
-      # Install project deps. Hardware-specific packages (rgbmatrix) will fail
-      # to build on Ubuntu runners — || true handles this gracefully.
-      # pip-audit operates on installed packages; partial install is acceptable.
-      - name: Install project dependencies
-        run: |
-          pip install -r requirements.txt || true
-          pip install -r web_interface/requirements.txt || true
-          pip install -r requirements-emulator.txt || true
-
-      - name: Run pip-audit
-        run: |
-          pip-audit --format json --output pip-audit-results.json || true
-
-      - name: Run safety check
-        run: |
-          safety check --output json > safety-results.json 2>&1 || true
-
-      - name: Upload dependency audit artifacts
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: dependency-audit-results
-          path: |
-            pip-audit-results.json
-            safety-results.json
-          retention-days: 30
-
-
-  # ─────────────────────────────────────────────────────────────────────────
-  # Secrets Detection
-  # ─────────────────────────────────────────────────────────────────────────
-  secrets-scan:
-    name: Secrets Scan (gitleaks)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0  # Full history for scanning all commits
-
-      # continue-on-error: config/config_secrets.template.json contains
-      # placeholder strings (YOUR_*) that may trigger gitleaks rules.
-      # The generate_report.py script suppresses these false positives.
-      - name: Run gitleaks
-        uses: gitleaks/gitleaks-action@v2
-        continue-on-error: true
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload secrets scan artifacts
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: secrets-scan-results
-          path: results.sarif
-          retention-days: 30
-
-
-  # ─────────────────────────────────────────────────────────────────────────
-  # LEDMatrix-Specific Security Proofs
-  # ─────────────────────────────────────────────────────────────────────────
-  ledmatrix-security-proofs:
-    name: LEDMatrix Security Proofs
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      - name: Install dependencies
-        run: pip install -r requirements.txt || true
-
-      # Script exits 1 only on CRITICAL findings.
-      # Warnings are reported but do not block the workflow.
-      - name: Run security proofs
-        run: |
-          python scripts/prove_security.py \
-            --output security-proofs-results.json \
-            --verbose
-
-      - name: Upload proofs artifacts
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: security-proofs-results
-          path: security-proofs-results.json
-          retention-days: 30
-
-
-  # ─────────────────────────────────────────────────────────────────────────
-  # Plugin Security Audit
-  # ─────────────────────────────────────────────────────────────────────────
-  plugin-audit:
-    name: Plugin Security Audit
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      # Script exits 1 only on CRITICAL findings (eval/exec in plugins).
-      # Missing manifest.json etc are warnings.
-      - name: Run plugin audit
-        run: |
-          python scripts/audit_plugins.py \
-            --output plugin-audit-results.json \
-            --verbose
-
-      - name: Upload plugin audit artifacts
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: plugin-audit-results
-          path: plugin-audit-results.json
-          retention-days: 30
-
-
-  # ─────────────────────────────────────────────────────────────────────────
-  # Aggregate Report
-  # ─────────────────────────────────────────────────────────────────────────
-  security-report:
-    name: Security Report
-    runs-on: ubuntu-latest
-    needs:
-      - sast
-      - dependency-audit
-      - secrets-scan
-      - ledmatrix-security-proofs
-      - plugin-audit
-    if: always()  # Run even if upstream jobs fail or are skipped
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.11'
-
-      - name: Download all artifacts
-        uses: actions/download-artifact@v4
-        with:
-          path: audit-artifacts/
-
-      - name: Generate consolidated report
-        run: |
-          python scripts/generate_report.py \
-            --artifact-dir audit-artifacts/ \
-            --output security-report.md \
-            --verbose
-
-      - name: Upload consolidated report
-        uses: actions/upload-artifact@v4
-        with:
-          name: security-report
-          path: security-report.md
-          retention-days: 90
-
-      - name: Comment on PR
-        if: github.event_name == 'pull_request'
-        uses: actions/github-script@v7
-        with:
-          script: |
-            const fs = require('fs');
-            const report = fs.readFileSync('security-report.md', 'utf8');
-            // Use sticky comment — update existing comment rather than adding a new one each run
-            const { data: comments } = await github.rest.issues.listComments({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-            });
-            const botComment = comments.find(c =>
-              c.user.type === 'Bot' && c.body.includes('🔒 Security Audit')
-            );
-            if (botComment) {
-              await github.rest.issues.updateComment({
-                comment_id: botComment.id,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                body: report,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                issue_number: context.issue.number,
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                body: report,
-              });
-            }

.github/workflows/test.yml

@@ -1,33 +0,0 @@
-name: Tests
-
-on:
-  pull_request:
-  push:
-    branches: [main]
-
-jobs:
-  plugin-safety:
-    name: Plugin safety harness + unit tests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
-        with:
-          python-version: "3.12"
-          cache: pip
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements.txt -r requirements-test.txt
-          pip install RGBMatrixEmulator
-
-      - name: Run harness + visual rendering tests
-        run: |
-          pytest --no-cov \
-            test/plugins/test_harness.py \
-            test/plugins/test_visual_rendering.py \
-            test/plugins/test_plugin_matrix.py

.github/workflows/tests.yml

@@ -1,46 +0,0 @@
-name: Tests
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    name: pytest (Python ${{ matrix.python-version }})
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ['3.10', '3.11', '3.12']
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-        with:
-          submodules: false  # rgbmatrix submodule not needed in EMULATOR mode
-
-      - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
-        with:
-          python-version: ${{ matrix.python-version }}
-          cache: pip
-
-      - name: Install dependencies
-        run: |
-          python -m pip install --upgrade pip
-          pip install -r requirements.txt
-          # Optional deps that some test modules import
-          pip install scipy psutil Flask-Limiter
-
-      - name: Run tests
-        env:
-          EMULATOR: "true"
-        run: |
-          pytest \
-            -m "not hardware and not slow" \
-            --tb=short

.gitignore

@@ -8,7 +8,6 @@ config/config_secrets.json
 config/config.json
 config/config.json.backup
 config/wifi_config.json
-config/uninstalled_plugins.json
 credentials.json
 token.pickle
 

.gitmodules

@@ -1,4 +1,3 @@
 [submodule "rpi-rgb-led-matrix-master"]
 	path = rpi-rgb-led-matrix-master
 	url = https://github.com/hzeller/rpi-rgb-led-matrix.git
-	branch = master

README.md

@@ -1,10 +1,5 @@
 # LEDMatrix
-[![License](https://img.shields.io/badge/license-GPL--3.0-green)](LICENSE)
-[![Discord](https://img.shields.io/badge/Discord-community-5865F2?logo=discord&logoColor=white)](https://discord.gg/RdrC37rEag)
-[![GitHub Stars](https://img.shields.io/github/stars/ChuckBuilds/ledmatrix?style=flat&color=yellow)](https://github.com/ChuckBuilds/ledmatrix)
 [![Codacy Badge](https://app.codacy.com/project/badge/Grade/77fc9b446a5948e5b0aed7a7aaeb1bab)](https://app.codacy.com/gh/ChuckBuilds/LEDMatrix/dashboard?utm_source=gh&utm_medium=referral&utm_content=&utm_campaign=Badge_grade)
-
-
 ## Welcome to LEDMatrix! 
 Welcome to the LEDMatrix Project! This open-source project enables you to run an information-rich display on a Raspberry Pi connected to an LED RGB Matrix panel. Whether you want to see your calendar, weather forecasts, sports scores, stock prices, or any other information at a glance, LEDMatrix brings it all together.
 
@@ -132,15 +127,10 @@ The system supports live, recent, and upcoming game information for multiple spo
 | This project can be finnicky! RGB LED Matrix displays are not built the same or to a high-quality standard. We have seen many displays arrive dead or partially working in our discord. Please purchase from a reputable vendor. |
 
 ### Raspberry Pi
-- Raspberry Pi Zero's don't have enough processing power for this project.
-- **Raspberry Pi 3B, 4, or 5**
+- Raspberry Pi Zero's don't have enough processing power for this project and the Pi 5 is unsupported due to new GPIO output.
+- **Raspberry Pi 3B or 4 (NOT RPi 5!)**  
   [Amazon Affiliate Link – Raspberry Pi 4 4GB RAM](https://amzn.to/4dJixuX)
   [Amazon Affiliate Link – Raspberry Pi 4 8GB RAM](https://amzn.to/4qbqY7F)
-  - **Pi 5 users**: the installer automatically detects Pi 5 and builds the `rpi-rgb-led-matrix` library with RP1 support. If you previously installed on a Pi 4 and migrated the SD card, or if you see `mmap` errors in the logs, force a fresh library build:
-    ```bash
-    sudo RPI_RGB_FORCE_REBUILD=1 ./first_time_install.sh
-    ```
-  - Pi 5 config: leave `rp1_rio` at `0` (PIO mode, default) and set `gpio_slowdown` to `1` or `2`.
 
 
 ### RGB Matrix Bonnet / HAT
@@ -592,7 +582,7 @@ These settings control runtime behavior and GPIO timing:
   - **Critical setting**: Must match your Raspberry Pi model for stability
   - **Raspberry Pi 3**: Use 3
   - **Raspberry Pi 4**: Use 4
-  - **Raspberry Pi 5**: Use 1–2 in PIO mode (`rp1_rio: 0`, the default); start with `1` and increase if you see flickering
+  - **Raspberry Pi 5**: Use 5 (or higher if needed)
   - **Raspberry Pi Zero/1**: Use 1-2
   - Incorrect values can cause display corruption, flickering, or system instability
   - If you experience issues, try adjusting this value up or down by 1

bandit.yaml

@@ -1,33 +0,0 @@
-# bandit.yaml — LEDMatrix bandit configuration
-# https://bandit.readthedocs.io/en/latest/config.html
-#
-# Skips are justified by the specific codebase context documented below.
-# Do not remove skips without updating the justification comment.
-
-skips:
-  # B104: Binding to all interfaces (0.0.0.0)
-  # Intentional — the Flask server binds 0.0.0.0 for LAN access on a Raspberry Pi.
-  # This is not internet-facing and is documented in web_interface/app.py.
-  - B104
-
-  # B603: subprocess call without shell=True
-  # All subprocess.run() calls in this codebase use list arguments (confirmed by
-  # grep — zero uses of shell=True in src/ or web_interface/). List args prevent
-  # shell injection. See src/common/permission_utils.py for the primary usage.
-  - B603
-
-  # B607: Starting a process with a partial executable path
-  # The subprocess calls invoke system utilities (systemctl, sudo, git) by name.
-  # These are fixed-list invocations, not user-controlled, and rely on PATH.
-  - B607
-
-exclude_dirs:
-  - tests
-  - test
-  - venv
-  - .venv
-  - rpi-rgb-led-matrix-master
-  # prove_security.py intentionally contains detection patterns as string literals
-  # (e.g. "eval(", "exec(") to search for in other files — bandit would flag
-  # these as false positives.
-  - scripts/prove_security.py

config/config.template.json

@@ -1,43 +1,43 @@
 {
     "web_display_autostart": true,
     "schedule": {
-        "enabled": false,
+        "enabled": true,
         "mode": "per-day",
         "start_time": "07:00",
         "end_time": "23:00",
         "days": {
             "monday": {
-                "enabled": false,
+                "enabled": true,
                 "start_time": "07:00",
                 "end_time": "23:00"
             },
             "tuesday": {
-                "enabled": false,
+                "enabled": true,
                 "start_time": "07:00",
                 "end_time": "23:00"
             },
             "wednesday": {
-                "enabled": false,
+                "enabled": true,
                 "start_time": "07:00",
                 "end_time": "23:00"
             },
             "thursday": {
-                "enabled": false,
+                "enabled": true,
                 "start_time": "07:00",
                 "end_time": "23:00"
             },
             "friday": {
-                "enabled": false,
+                "enabled": true,
                 "start_time": "07:00",
                 "end_time": "23:00"
             },
             "saturday": {
-                "enabled": false,
+                "enabled": true,
                 "start_time": "07:00",
                 "end_time": "23:00"
             },
             "sunday": {
-                "enabled": false,
+                "enabled": true,
                 "start_time": "07:00",
                 "end_time": "23:00"
             }
@@ -51,46 +51,46 @@
         "end_time": "07:00",
         "days": {
             "monday": {
-                "enabled": false,
+                "enabled": true,
                 "start_time": "20:00",
                 "end_time": "07:00"
             },
             "tuesday": {
-                "enabled": false,
+                "enabled": true,
                 "start_time": "20:00",
                 "end_time": "07:00"
             },
             "wednesday": {
-                "enabled": false,
+                "enabled": true,
                 "start_time": "20:00",
                 "end_time": "07:00"
             },
             "thursday": {
-                "enabled": false,
+                "enabled": true,
                 "start_time": "20:00",
                 "end_time": "07:00"
             },
             "friday": {
-                "enabled": false,
+                "enabled": true,
                 "start_time": "20:00",
                 "end_time": "07:00"
             },
             "saturday": {
-                "enabled": false,
+                "enabled": true,
                 "start_time": "20:00",
                 "end_time": "07:00"
             },
             "sunday": {
-                "enabled": false,
+                "enabled": true,
                 "start_time": "20:00",
                 "end_time": "07:00"
             }
         }
     },
-    "timezone": "America/New_York",
+    "timezone": "America/Chicago",
     "location": {
-        "city": "Tampa",
-        "state": "Florida",
+        "city": "Dallas",
+        "state": "Texas",
         "country": "US"
     },
     "display": {
@@ -112,13 +112,7 @@
             "limit_refresh_rate_hz": 100
         },
         "runtime": {
-            "gpio_slowdown": 3,
-            "rp1_rio": 0
-        },
-        "double_sided": {
-            "enabled": false,
-            "copies": 2,
-            "axis": "horizontal"
+            "gpio_slowdown": 3
         },
         "display_durations": {},
         "use_short_date_format": true,
@@ -132,11 +126,6 @@
             "buffer_ahead": 2
         }
     },
-    "sync": {
-        "role": "standalone",
-        "port": 5765,
-        "follower_position": "left"
-    },
     "plugin_system": {
         "plugins_directory": "plugin-repos",
         "auto_discover": true,

docs/HOW_TO_RUN_TESTS.md

@@ -248,6 +248,7 @@ test/
 ├── test_config_service.py               # Config service tests
 ├── test_config_validation_edge_cases.py # Config edge cases
 ├── test_font_manager.py                 # Font manager tests
+├── test_layout_manager.py               # Layout manager tests
 ├── test_text_helper.py                  # Text helper tests
 ├── test_error_handling.py               # Error handling tests
 ├── test_error_aggregator.py             # Error aggregation tests

docs/PLUGIN_ARCHITECTURE_SPEC.md

@@ -34,16 +34,16 @@ This document outlines the transformation of the LEDMatrix project into a modula
 
 ## Table of Contents
 
-1. [Current Architecture Analysis](#1-current-architecture-analysis)
-2. [Plugin System Design](#2-plugin-system-design)
-3. [Plugin Store & Discovery](#3-plugin-store--discovery)
-4. [Web UI Transformation](#4-web-ui-transformation)
-5. [Migration Strategy](#5-migration-strategy)
-6. [Plugin Developer Guidelines](#6-plugin-developer-guidelines)
-7. [Technical Implementation Details](#7-technical-implementation-details)
-8. [Best Practices & Standards](#8-best-practices--standards)
-9. [Security Considerations](#9-security-considerations)
-10. [Implementation Roadmap](#10-implementation-roadmap)
+1. [Current Architecture Analysis](#current-architecture-analysis)
+2. [Plugin System Design](#plugin-system-design)
+3. [Plugin Store & Discovery](#plugin-store--discovery)
+4. [Web UI Transformation](#web-ui-transformation)
+5. [Migration Strategy](#migration-strategy)
+6. [Plugin Developer Guidelines](#plugin-developer-guidelines)
+7. [Technical Implementation Details](#technical-implementation-details)
+8. [Best Practices & Standards](#best-practices--standards)
+9. [Security Considerations](#security-considerations)
+10. [Implementation Roadmap](#implementation-roadmap)
 
 ---
 

docs/plugin-safety-harness.md

@@ -1,136 +0,0 @@
-# Plugin Safety Harness
-
-Renders a plugin across **every declared screen (mode)** and **a spread of
-matrix sizes**, and fails if any combination crashes, draws past the panel edge,
-or — for plugins that ship golden images — drifts visually. The goal: change a
-plugin without breaking a size or screen you didn't think to test.
-
-## Sizes: a sample, not a fixed list
-
-There is **no fixed set of supported panel sizes** — an RGB matrix build can be
-any width/height and configuration (square, rectangle, 2×2, 4×4, 8×2, long
-strips, tall stacks). Plugins are expected to read dimensions dynamically
-(`self.display_manager.matrix.width/height`) and lay themselves out
-accordingly, so a hardcoded coordinate or unscaled font shows up as a failure
-here.
-
-The harness therefore renders against a **representative sample** that spans the
-axes of variation (`DEFAULT_TEST_SIZES` in `src/plugin_system/testing/sizes.py`),
-not an authoritative list:
-
-Each module is 64×32; entries are real panel-grid arrangements (cols × rows):
-
-| Size    | Grid | Why it's in the sample                     |
-|---------|------|--------------------------------------------|
-| 64×32   | 1×1  | single panel — tightest common rectangle   |
-| 128×32  | 2×1  | the baseline most plugins are tuned for    |
-| 64×64   | 1×2  | stacked — tall-narrow centering            |
-| 128×64  | 2×2  | block — icon scaling / vertical centering  |
-| 256×32  | 4×1  | long strip — wide horizontal layout        |
-| 128×96  | 2×3  | tall — vertical overflow                   |
-| 256×128 | 4×4  | large block — both dimensions big at once  |
-
-**Override the sizes entirely** to test your actual hardware (or any shape):
-
-```bash
-# CLI — one-off:
-python scripts/check_plugin.py --plugin clock-simple --sizes 8x16,64x64,256x32
-
-# pytest — force every plugin onto your panel(s):
-LEDMATRIX_TEST_SIZES="8x16,128x128" pytest test/plugins/test_plugin_matrix.py
-
-# Per-plugin — declare the shapes a plugin targets in its test/harness.json:
-#   { "sizes": [[8, 16], [64, 64]] }
-```
-
-Precedence: `LEDMATRIX_TEST_SIZES` env (global) → per-plugin `harness.json`
-`sizes` → the default sample. Bounds checking adapts to whatever sizes a run
-uses — the backing canvas is padded out to the **largest** panel in the run, so
-a coordinate meant for a big build is still caught when rendering a small one.
-
-## Quick start
-
-```bash
-# Functional + bounds check across all sizes/screens:
-python scripts/check_plugin.py --plugin clock-simple
-
-# Every discovered plugin:
-python scripts/check_plugin.py --all
-
-# Dump PNGs to eyeball each size/screen:
-python scripts/check_plugin.py --plugin ledmatrix-weather --out-dir /tmp/preview
-```
-
-Exit code is non-zero if any `(plugin, size, screen)` fails. Plugins are
-discovered in `plugin-repos/` and `plugins/` (override with `--plugin-dir`).
-
-## What it checks (Phase 1 — always on)
-
-1. **Loads** and builds its mode list.
-2. **Renders every screen** at every size without raising. `update()` may fail
-   (no network in CI) and is tolerated; a crash in `display()` is a failure —
-   `display()` must handle the no-data state.
-3. **Bounds**: nothing is drawn past the right/bottom edge. Implemented by
-   `BoundsCheckingDisplayManager`, which backs the declared panel with an
-   oversized canvas and flags any pixels that land in the margin. (Left/top
-   overflow at negative coordinates and BDF text are not flagged — golden images
-   cover those.)
-
-## Golden images (Phase 2 — opt-in per plugin)
-
-A plugin opts in by committing reference PNGs and (usually) a small harness spec:
-
-```
-plugins/<id>/test/harness.json          # how to render deterministically
-plugins/<id>/test/fixtures/mock.json     # optional cached data
-plugins/<id>/test/golden/<WxH>/<mode>.png
-```
-
-`test/harness.json` keys (all optional):
-
-```json
-{
-  "config":      { "timezone": "UTC" },
-  "mock_data":   "fixtures/mock.json",
-  "freeze_time": "2025-08-01 15:25:00",
-  "skip_update": false,
-  "sizes":       [[128, 32], [128, 64]]
-}
-```
-
-Generate / refresh goldens after an intentional visual change, then review the
-diff before committing:
-
-```bash
-python scripts/check_plugin.py --plugin clock-simple --update-golden \
-  --config '{"timezone":"UTC"}' --freeze-time "2025-08-01 15:25:00"
-```
-
-Comparison is exact by default (`compare_images` in `harness.py` accepts a
-tolerance for known anti-aliasing noise). Determinism requires a pinned Pillow
-and the bundled fonts — keep both stable when regenerating goldens.
-
-## Tests & CI
-
-- `test/plugins/test_harness.py` — unit tests for bounds detection, image
-  comparison, and mode enumeration (run anywhere).
-- `test/plugins/test_plugin_matrix.py` — parametrized over discovered plugins ×
-  sizes × screens; honors each plugin's `test/harness.json` and goldens. Skips
-  when no plugins are present (e.g. a fresh core checkout); set
-  `LEDMATRIX_REQUIRE_PLUGINS=1` in a pipeline where plugins must be present to
-  turn an empty discovery into a hard failure instead. Point it at the monorepo
-  with `LEDMATRIX_PLUGINS_DIR=/path/to/ledmatrix-plugins/plugins`.
-- `.github/workflows/test.yml` — runs the harness + visual tests on every PR.
-
-The plugin monorepo has its own `Plugin Safety` workflow that runs this harness
-against changed plugins on every PR.
-
-## Developer workflow
-
-1. Change the plugin on a branch.
-2. `python scripts/check_plugin.py --plugin <id> --out-dir /tmp/preview` and
-   eyeball the PNGs.
-3. Intentional visual change? `--update-golden`, review diffs, commit goldens.
-4. (Monorepo) bump `manifest.json` version and let the pre-commit hook sync
-   `plugins.json`.
-5. Push — CI re-runs the harness across all sizes and gates the PR.

docs/widget-guide.md

@@ -10,98 +10,6 @@ The LEDMatrix Widget Registry system allows plugins to use reusable UI component
 
 ## Available Core Widgets
 
-### Plugin File Manager Widget (`plugin-file-manager`)
-
-Full inline file management UI for plugins that manage files via the `web_ui_actions` system. Renders a card grid, upload zone, create/delete modals, and an entry table editor — entirely inline, no iframe.
-
-`plugin_id` is **automatically injected** from template context. File operations call `/api/v3/plugins/action` immediately on user action; no Save Configuration needed.
-
-**Schema Configuration:**
-```json
-{
-  "file_manager": {
-    "type": "null",
-    "title": "Data Files",
-    "x-widget": "plugin-file-manager",
-    "x-widget-config": {
-      "actions": {
-        "list":   "list-files",
-        "get":    "get-file",
-        "save":   "save-file",
-        "upload": "upload-file",
-        "delete": "delete-file",
-        "create": "create-file",
-        "toggle": "toggle-category"
-      },
-      "upload_hint":      "JSON files with day numbers 1–365 as keys",
-      "directory_label":  "my_data/",
-      "create_fields": [
-        { "key": "category_name", "label": "Category Name",
-          "placeholder": "e.g., my_words", "pattern": "^[a-z0-9_]+$",
-          "hint": "Lowercase letters, numbers, underscores" },
-        { "key": "display_name", "label": "Display Name",
-          "placeholder": "e.g., My Words", "hint": "Optional" }
-      ]
-    }
-  }
-}
-```
-
-**`list` is required** — the widget calls it on render to populate the file grid; omitting it leaves the widget stuck in a loading state. All other actions are optional — omit any key to hide its UI element (e.g., no `create` = no New File button, no `toggle` = no enable/disable switch).
-
-The edit view auto-detects whether file content is tabular (object-of-objects with uniform keys) and shows a paginated table editor with inline cells. Otherwise falls back to a JSON textarea.
-
-**Used by:** of-the-day
-
----
-
-### Time Picker Widget (`time-picker`)
-
-Single time selection using the browser's native time input. Returns a string in `HH:MM` (24-hour) format. Generic — works in any plugin without configuration.
-
-**Schema Configuration:**
-```json
-{
-  "target_time": {
-    "type": "string",
-    "x-widget": "time-picker",
-    "default": "00:00",
-    "x-options": {
-      "placeholder": "Select time",
-      "clearable": true
-    }
-  }
-}
-```
-
-**Used by:** countdown
-
----
-
-### File Upload Single Widget (`file-upload-single`)
-
-Single-image upload for string fields. Uploads to the plugin's asset folder (`assets/plugins/<plugin_id>/uploads/`) and sets the string field value to the returned relative path. Shows a thumbnail preview and a clear button. The `plugin_id` is **automatically injected** from the template context — no need to specify it in the schema.
-
-**Schema Configuration:**
-```json
-{
-  "image_path": {
-    "type": "string",
-    "x-widget": "file-upload-single",
-    "x-upload-config": {
-      "allowed_types": ["image/png", "image/jpeg", "image/bmp", "image/gif"],
-      "max_size_mb": 5
-    }
-  }
-}
-```
-
-Note: Unlike `file-upload` (array-level), this widget is for a single `string` field. It is ideal for per-item images inside `array-table` rows.
-
-**Used by:** countdown
-
----
-
 ### File Upload Widget (`file-upload`)
 
 Upload and manage image files with drag-and-drop support, preview, delete, and scheduling.

first_time_install.sh

@@ -15,8 +15,8 @@ on_error() {
     echo "✗ An error occurred during: $CURRENT_STEP (line $line_no, exit $exit_code)" >&2
     if [ -n "${LOG_FILE:-}" ]; then
         echo "See the log for details: $LOG_FILE" >&2
-        echo "-- Last 100 lines from log --" >&2
-        tail -n 100 "$LOG_FILE" >&2 || true
+        echo "-- Last 50 lines from log --" >&2
+        tail -n 50 "$LOG_FILE" >&2 || true
     fi
     echo "\nCommon fixes:" >&2
     echo "- Ensure the Pi is online (try: ping -c1 8.8.8.8)." >&2
@@ -36,17 +36,9 @@ if [ -r /proc/device-tree/model ]; then
     DEVICE_MODEL=$(tr -d '\0' </proc/device-tree/model)
     echo "Detected device: $DEVICE_MODEL"
 else
-    DEVICE_MODEL=""
     echo "⚠ Could not detect Raspberry Pi model (continuing anyway)"
 fi
 
-# Detect Pi 5 for hardware-specific install decisions (RP1 library verification)
-IS_PI5=0
-if echo "${DEVICE_MODEL:-}" | grep -qi "Raspberry Pi 5"; then
-    IS_PI5=1
-    echo "Raspberry Pi 5 detected — will verify RP1 library support."
-fi
-
 # Check OS version - must be Raspberry Pi OS Lite (Trixie)
 echo ""
 echo "Checking operating system requirements..."
@@ -202,33 +194,8 @@ retry() {
     done
 }
 
-# Wait for another apt/dpkg process (commonly unattended-upgrades running
-# shortly after first boot) to release its lock before we try apt ourselves.
-# Without this, apt_update/apt_install can fail outright in the first couple
-# minutes after a fresh Pi OS boot with a generic "Command failed after 3
-# attempts" error.
-wait_for_apt_lock() {
-    command -v flock >/dev/null 2>&1 || return 0
-    local lock_file="/var/lib/dpkg/lock-frontend"
-    local max_wait=180
-    local waited=0
-    local printed=0
-    while ! flock -n "$lock_file" -c true 2>/dev/null; do
-        if [ "$printed" -eq 0 ]; then
-            echo "⚠ Waiting for another apt/dpkg process to finish (e.g. unattended-upgrades on first boot)..."
-            printed=1
-        fi
-        if [ "$waited" -ge "$max_wait" ]; then
-            echo "⚠ Still waiting after ${max_wait}s; proceeding anyway."
-            break
-        fi
-        sleep 5
-        waited=$((waited+5))
-    done
-}
-
-apt_update() { wait_for_apt_lock; retry apt-get -o DPkg::Lock::Timeout=180 update; }
-apt_install() { wait_for_apt_lock; retry apt-get -o DPkg::Lock::Timeout=180 install -y "$@"; }
+apt_update() { retry apt update; }
+apt_install() { retry apt install -y "$@"; }
 apt_remove() { apt-get remove -y "$@" || true; }
 
 check_network() {
@@ -247,22 +214,6 @@ check_network() {
     exit 1
 }
 
-check_disk_space() {
-    command -v df >/dev/null 2>&1 || return 0
-    local available_mb
-    available_mb=$(df -m "$PROJECT_ROOT_DIR" | awk 'NR==2{print $4}')
-    available_mb=${available_mb:-0}
-    if [ "$available_mb" -lt 500 ]; then
-        echo "✗ ERROR: Insufficient disk space: ${available_mb}MB available (need at least 500MB)"
-        echo "  Free up space first, e.g.: sudo apt clean && sudo apt autoremove"
-        exit 1
-    elif [ "$available_mb" -lt 1024 ]; then
-        echo "⚠ Limited disk space: ${available_mb}MB available (recommend at least 1GB for the rpi-rgb-led-matrix build in Step 6)"
-    else
-        echo "✓ Disk space sufficient: ${available_mb}MB available"
-    fi
-}
-
 echo ""
 echo "This script will perform the following steps:"
 echo "1. Install system dependencies"
@@ -308,20 +259,21 @@ else
 fi
 
 echo ""
+CLEAR='
+'
 CURRENT_STEP="Install system dependencies"
 echo "Step 1: Installing system dependencies..."
 echo "----------------------------------------"
 
-# Pre-flight checks before APT operations
+# Ensure network is available before APT operations
 check_network
-check_disk_space
 
 # Update package list
 apt_update
 
 # Install required system packages
 echo "Installing Python packages and dependencies..."
-apt_install python3-pip python3-venv python-dev-is-python3 python3-pil python3-pil.imagetk build-essential python3-setuptools python3-wheel cmake ninja-build
+apt_install python3-pip python3-venv python3-dev python3-pil python3-pil.imagetk build-essential python3-setuptools python3-wheel cython3 scons cmake ninja-build
 
 # Install additional system dependencies that might be needed
 echo "Installing additional system dependencies..."
@@ -719,6 +671,8 @@ if [ -f "$PROJECT_ROOT_DIR/requirements.txt" ]; then
         echo "[$PACKAGE_NUM/$TOTAL_PACKAGES] Installing: $line"
         
         # Check if package is already installed (basic check - may not catch all cases)
+        PACKAGE_NAME=$(echo "$line" | sed -E 's/[<>=!].*$//' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+        
         # Try installing with verbose output and timeout (if available)
         # Use --no-cache-dir to avoid cache issues, --verbose for diagnostics
         INSTALL_OUTPUT=$(mktemp)
@@ -726,11 +680,7 @@ if [ -f "$PROJECT_ROOT_DIR/requirements.txt" ]; then
         
         if command -v timeout >/dev/null 2>&1; then
             # Use timeout if available (10 minutes = 600 seconds)
-            # --ignore-installed: apt-managed packages (e.g. python3-requests)
-            # ship no pip RECORD file, so upgrading them would otherwise abort
-            # with "uninstall-no-record-file"; this lays the new version down
-            # alongside instead of trying to uninstall the apt copy first.
-            if timeout 600 python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --ignore-installed --verbose "$line" > "$INSTALL_OUTPUT" 2>&1; then
+            if timeout 600 python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --verbose "$line" > "$INSTALL_OUTPUT" 2>&1; then
                 INSTALL_SUCCESS=true
             else
                 EXIT_CODE=$?
@@ -738,7 +688,7 @@ if [ -f "$PROJECT_ROOT_DIR/requirements.txt" ]; then
                     echo "✗ Timeout (10 minutes) installing: $line"
                     echo "  This package may require building from source, which can be slow on Raspberry Pi."
                     echo "  You can try installing it manually later with:"
-                    echo "    python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --ignore-installed --verbose '$line'"
+                    echo "    python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --verbose '$line'"
                 else
                     echo "✗ Failed to install: $line (exit code: $EXIT_CODE)"
                 fi
@@ -746,7 +696,7 @@ if [ -f "$PROJECT_ROOT_DIR/requirements.txt" ]; then
         else
             # No timeout command available, install without timeout
             echo "  Note: timeout command not available, installation may take a while..."
-            if python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --ignore-installed --verbose "$line" > "$INSTALL_OUTPUT" 2>&1; then
+            if python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --verbose "$line" > "$INSTALL_OUTPUT" 2>&1; then
                 INSTALL_SUCCESS=true
             else
                 EXIT_CODE=$?
@@ -798,7 +748,7 @@ if [ -f "$PROJECT_ROOT_DIR/requirements.txt" ]; then
         echo "  1. Ensure you have enough disk space: df -h"
         echo "  2. Check available memory: free -h"
         echo "  3. Try installing failed packages individually with verbose output:"
-        echo "     python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --ignore-installed --verbose <package>"
+        echo "     python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --verbose <package>"
         echo "  4. For packages that build from source (like numpy), consider:"
         echo "     - Installing pre-built wheels: python3 -m pip install --only-binary :all: <package>"
         echo "     - Or installing via apt if available: sudo apt install python3-<package>"
@@ -820,10 +770,7 @@ echo ""
 # Install web interface dependencies
 echo "Installing web interface dependencies..."
 if [ -f "$PROJECT_ROOT_DIR/web_interface/requirements.txt" ]; then
-    # --ignore-installed: apt-managed packages (e.g. python3-requests) ship no
-    # pip RECORD file, so upgrading them to the version pinned here would
-    # otherwise abort the whole install with "uninstall-no-record-file".
-    if python3 -m pip install --break-system-packages --prefer-binary --ignore-installed -r "$PROJECT_ROOT_DIR/web_interface/requirements.txt"; then
+    if python3 -m pip install --break-system-packages --prefer-binary -r "$PROJECT_ROOT_DIR/web_interface/requirements.txt"; then
         echo "✓ Web interface dependencies installed"
         # Create marker file to indicate dependencies are installed
         touch "$PROJECT_ROOT_DIR/.web_deps_installed"
@@ -840,54 +787,29 @@ CURRENT_STEP="Build and install rpi-rgb-led-matrix"
 echo "Step 6: Building and installing rpi-rgb-led-matrix..."
 echo "-----------------------------------------------------"
 
-# On Pi 5, also check that the installed library has rp1_rio support.
-# A library built before Pi 5 support was added imports fine but maps to the
-# Pi 3 peripheral bus address (0x3f000000) instead of the RP1 chip at runtime.
-_HAS_RP1=0
-if python3 -c 'from rgbmatrix import RGBMatrixOptions; assert hasattr(RGBMatrixOptions(), "rp1_rio")' >/dev/null 2>&1; then
-    _HAS_RP1=1
-fi
-
-_SKIP_BUILD=0
+# If already installed and not forcing rebuild, skip expensive build
 if python3 -c 'from rgbmatrix import RGBMatrix, RGBMatrixOptions' >/dev/null 2>&1 && [ "${RPI_RGB_FORCE_REBUILD:-0}" != "1" ]; then
-    if [ "$IS_PI5" = "1" ] && [ "$_HAS_RP1" = "0" ]; then
-        echo "⚠ Pi 5 detected: installed rgbmatrix lacks rp1_rio support (older build)."
-        echo "  Forcing rebuild to get Pi 5 RP1 support..."
-    else
-        _SKIP_BUILD=1
-    fi
-fi
-
-if [ "$_SKIP_BUILD" = "1" ]; then
-    _skip_suffix=""
-    if [ "$IS_PI5" = "1" ]; then _skip_suffix=" with Pi 5 RP1 support"; fi
-    echo "rgbmatrix already installed${_skip_suffix}; skipping build (set RPI_RGB_FORCE_REBUILD=1 to force rebuild)."
+    echo "rgbmatrix Python package already available; skipping build (set RPI_RGB_FORCE_REBUILD=1 to force rebuild)."
 else
     # Ensure rpi-rgb-led-matrix submodule is initialized
-    # Wrapper used with retry(): removes any partial clone dir before each attempt
-    # so git clone doesn't fail with "destination path already exists".
-    _clone_rpi_rgb() {
-        rm -rf "$PROJECT_ROOT_DIR/rpi-rgb-led-matrix-master"
-        git clone https://github.com/hzeller/rpi-rgb-led-matrix.git rpi-rgb-led-matrix-master
-    }
     if [ ! -d "$PROJECT_ROOT_DIR/rpi-rgb-led-matrix-master" ]; then
         echo "rpi-rgb-led-matrix-master not found. Initializing git submodule..."
         cd "$PROJECT_ROOT_DIR"
-
+        
         # Try to initialize submodule if .gitmodules exists
         if [ -f "$PROJECT_ROOT_DIR/.gitmodules" ] && grep -q "rpi-rgb-led-matrix" "$PROJECT_ROOT_DIR/.gitmodules"; then
             echo "Initializing rpi-rgb-led-matrix submodule..."
-            if ! retry git submodule update --init --recursive rpi-rgb-led-matrix-master; then
+            if ! git submodule update --init --recursive rpi-rgb-led-matrix-master 2>&1; then
                 echo "⚠ Submodule init failed, cloning directly from GitHub..."
-                retry _clone_rpi_rgb
+                git clone https://github.com/hzeller/rpi-rgb-led-matrix.git rpi-rgb-led-matrix-master
             fi
         else
             # Fallback: clone directly if submodule not configured
             echo "Submodule not configured, cloning directly from GitHub..."
-            retry _clone_rpi_rgb
+            git clone https://github.com/hzeller/rpi-rgb-led-matrix.git rpi-rgb-led-matrix-master
         fi
     fi
-
+    
     # Build and install rpi-rgb-led-matrix Python bindings
     if [ -d "$PROJECT_ROOT_DIR/rpi-rgb-led-matrix-master" ]; then
         # Check if submodule is properly initialized (not empty)
@@ -896,34 +818,30 @@ else
             cd "$PROJECT_ROOT_DIR"
             rm -rf rpi-rgb-led-matrix-master
             if [ -f "$PROJECT_ROOT_DIR/.gitmodules" ] && grep -q "rpi-rgb-led-matrix" "$PROJECT_ROOT_DIR/.gitmodules"; then
-                retry git submodule update --init --recursive rpi-rgb-led-matrix-master
+                git submodule update --init --recursive rpi-rgb-led-matrix-master
             else
-                retry _clone_rpi_rgb
+                git clone https://github.com/hzeller/rpi-rgb-led-matrix.git rpi-rgb-led-matrix-master
             fi
         fi
-
+        
         pushd "$PROJECT_ROOT_DIR/rpi-rgb-led-matrix-master" >/dev/null
-        echo "Installing rpi-rgb-led-matrix Python package (scikit-build-core + cmake)..."
-        echo "  Build deps required: python-dev-is-python3 cmake"
-        echo "  This compiles C++ — may take 2-5 minutes on Pi 4/5..."
-        BUILD_OUTPUT=$(mktemp)
-        BUILD_SUCCESS=false
-        if python3 -m pip install --break-system-packages . > "$BUILD_OUTPUT" 2>&1; then
-            BUILD_SUCCESS=true
+        echo "Building rpi-rgb-led-matrix Python bindings..."
+        # Build the library first, then Python bindings
+        # The build-python target depends on the library being built
+        if ! make build-python; then
+            echo "✗ Failed to build rpi-rgb-led-matrix Python bindings"
+            echo "  Make sure you have the required build tools installed:"
+            echo "  sudo apt install -y build-essential python3-dev cython3 scons"
+            popd >/dev/null
+            exit 1
         fi
-        cat "$BUILD_OUTPUT" >> "$LOG_FILE"
-        if [ "$BUILD_SUCCESS" != true ]; then
+        cd bindings/python
+        echo "Installing rpi-rgb-led-matrix Python package via pip..."
+        if ! python3 -m pip install --break-system-packages .; then
             echo "✗ Failed to install rpi-rgb-led-matrix Python package"
-            echo "  Ensure build tools are installed:"
-            echo "  sudo apt install -y python-dev-is-python3 cmake build-essential"
-            echo ""
-            echo "-- Last 50 lines of build output --"
-            tail -n 50 "$BUILD_OUTPUT"
-            rm -f "$BUILD_OUTPUT"
             popd >/dev/null
             exit 1
         fi
-        rm -f "$BUILD_OUTPUT"
         popd >/dev/null
     else
         echo "✗ rpi-rgb-led-matrix-master directory not found at $PROJECT_ROOT_DIR"
@@ -945,17 +863,6 @@ except Exception as e:
 PY
     then
         echo "✓ rpi-rgb-led-matrix installed and verified"
-        # Pi 5: confirm the freshly-built library has rp1_rio support
-        if [ "$IS_PI5" = "1" ]; then
-            if python3 -c 'from rgbmatrix import RGBMatrixOptions; assert hasattr(RGBMatrixOptions(), "rp1_rio")' >/dev/null 2>&1; then
-                echo "✓ Pi 5 RP1 (rp1_rio) support confirmed"
-            else
-                echo "⚠ rp1_rio not found after rebuild — the submodule may be an older version."
-                echo "  Try updating the submodule and rebuilding:"
-                echo "    git submodule update --remote rpi-rgb-led-matrix-master"
-                echo "    sudo RPI_RGB_FORCE_REBUILD=1 ./first_time_install.sh"
-            fi
-        fi
     else
         echo "✗ rpi-rgb-led-matrix import test failed"
         exit 1
@@ -978,15 +885,11 @@ else
     # Try to install dependencies using the smart installer if available
     if [ -f "$PROJECT_ROOT_DIR/scripts/install_dependencies_apt.py" ]; then
         echo "Using smart dependency installer..."
-        # -u: unbuffered stdout/stderr so output is captured in $LOG_FILE in
-        # real time and in order relative to this script's own echo statements
-        python3 -u "$PROJECT_ROOT_DIR/scripts/install_dependencies_apt.py"
+        python3 "$PROJECT_ROOT_DIR/scripts/install_dependencies_apt.py"
     else
         echo "Using pip to install dependencies..."
         if [ -f "$PROJECT_ROOT_DIR/requirements_web_v2.txt" ]; then
-            # --ignore-installed: see the Step 5 web_interface/requirements.txt
-            # install above — same apt/pip RECORD-file conflict applies here.
-            python3 -m pip install --break-system-packages --prefer-binary --ignore-installed -r requirements_web_v2.txt
+            python3 -m pip install --break-system-packages --prefer-binary -r requirements_web_v2.txt
         else
             echo "⚠ requirements_web_v2.txt not found; skipping web dependency install"
         fi
@@ -1576,7 +1479,7 @@ echo "WiFi Connection Status:"
 if command -v nmcli >/dev/null 2>&1; then
     WIFI_STATUS=$(nmcli -t -f DEVICE,TYPE,STATE device status 2>/dev/null | grep -i wifi || echo "")
     if [ -n "$WIFI_STATUS" ]; then
-        echo "$WIFI_STATUS" | while IFS=':' read -r _ _ state; do
+        echo "$WIFI_STATUS" | while IFS=':' read -r device type state; do
             if [ "$state" = "connected" ]; then
                 SSID=$(nmcli -t -f active,ssid device wifi 2>/dev/null | grep "^yes:" | cut -d: -f2 | head -1)
                 if [ -n "$SSID" ]; then

plugin-repos/7-segment-clock

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/7-segment-clock

plugin-repos/baseball-scoreboard

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/baseball-scoreboard

plugin-repos/basketball-scoreboard

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/basketball-scoreboard

plugin-repos/calendar

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/calendar

plugin-repos/christmas-countdown

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/christmas-countdown

plugin-repos/clock-simple

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/clock-simple

plugin-repos/countdown

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/countdown

plugin-repos/f1-scoreboard

@@ -1 +0,0 @@
-/home/chuck/Github/ledmatrix-plugins/plugins/f1-scoreboard

plugin-repos/football-scoreboard

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/football-scoreboard

plugin-repos/hello-world

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/hello-world

plugin-repos/hockey-scoreboard

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/hockey-scoreboard

plugin-repos/ledmatrix-flights

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/ledmatrix-flights

plugin-repos/ledmatrix-leaderboard

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/ledmatrix-leaderboard

plugin-repos/ledmatrix-music

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/ledmatrix-music

plugin-repos/ledmatrix-stocks

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/ledmatrix-stocks

plugin-repos/ledmatrix-weather

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/ledmatrix-weather

plugin-repos/march-madness/manager.py

@@ -197,7 +197,7 @@ class MarchMadnessPlugin(BasePlugin):
     # ------------------------------------------------------------------
 
     def _load_round_logos(self) -> None:
-        logo_dir = Path(__file__).parent / "assets" / "logos"
+        logo_dir = Path("assets/sports/ncaa_logos")
         for round_key, filename in ROUND_LOGO_FILES.items():
             path = logo_dir / filename
             try:
@@ -212,7 +212,7 @@ class MarchMadnessPlugin(BasePlugin):
             except Exception:
                 self.logger.exception(f"Unexpected error loading round logo {filename}")
 
-        # March Madness banner logo (also in plugin assets)
+        # March Madness logo
         mm_path = logo_dir / "MARCH_MADNESS.png"
         try:
             img = Image.open(mm_path).convert("RGBA")

plugin-repos/march-madness/requirements.txt

@@ -1,5 +1,4 @@
-requests>=2.33.0
-urllib3>=2.6.3
+requests>=2.28.0
 Pillow>=12.2.0
 pytz>=2022.1
 numpy>=1.24.0

plugin-repos/mqtt-notifications

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/mqtt-notifications

plugin-repos/news

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/news

plugin-repos/odds-ticker

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/odds-ticker

plugin-repos/of-the-day

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/of-the-day

plugin-repos/olympics

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/olympics

plugin-repos/soccer-scoreboard

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/soccer-scoreboard

plugin-repos/starlark-apps/manifest.json

@@ -22,6 +22,5 @@
     "Pillow>=10.0.0",
     "PyYAML>=6.0",
     "requests>=2.31.0"
-  ],
-  "local_only": true
+  ]
 }

plugin-repos/starlark-apps/requirements.txt

@@ -1,3 +1,3 @@
-Pillow>=12.2.0
+Pillow>=10.4.0
 PyYAML>=6.0.2
-requests>=2.33.0
+requests>=2.32.0

plugin-repos/static-image

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/static-image

plugin-repos/stock-news

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/stock-news

plugin-repos/text-display

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/text-display

plugin-repos/ufc-scoreboard

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/ufc-scoreboard

plugin-repos/youtube-stats

@@ -1 +0,0 @@
-../../ledmatrix-plugins/plugins/youtube-stats

requirements-test.txt

@@ -1,9 +0,0 @@
-# Test-only dependencies for the plugin safety harness and pytest suite.
-# Install alongside requirements.txt:  pip install -r requirements.txt -r requirements-test.txt
-#
-# pytest, pytest-cov, pytest-mock, and jsonschema are already pinned (with
-# major-version caps) in requirements.txt, so they are intentionally NOT
-# repeated here — re-pinning pytest to <9 collided with requirements.txt's
-# pytest>=9.0.3,<10 and made the two files impossible to install together.
-# Only declare what requirements.txt doesn't already provide.
-freezegun>=1.2,<2        # deterministic time for golden-image tests

requirements.txt

@@ -3,32 +3,39 @@
 # Tested on Raspbian OS 12 (Bookworm) and 13 (Trixie)
 
 # Image processing
-Pillow>=12.2.0,<13.0.0
+Pillow>=10.4.0,<12.0.0
 numpy>=1.24.0  # For fast array operations in ScrollHelper (compatible with 2.x)
 
 # Timezone handling
 pytz>=2024.2,<2025.0  # Updated for latest timezone data
+timezonefinder>=6.5.0,<7.0.0  # Updated for better performance and accuracy
+geopy>=2.4.1,<3.0.0
 
 # HTTP requests
-requests>=2.33.0,<3.0.0
+requests>=2.32.0,<3.0.0
 
 # Google API integration
+google-auth-oauthlib>=1.2.0,<2.0.0
+google-auth-httplib2>=0.2.0,<1.0.0
+google-api-python-client>=2.147.0,<3.0.0
 
 # Font rendering
 freetype-py>=2.5.1,<3.0.0
 
 # Spotify integration
-spotipy>=2.25.2,<3.0.0
+spotipy>=2.24.0,<3.0.0
 
 # Flask web framework
-Flask>=3.1.3,<4.0.0
+Flask>=3.0.0,<4.0.0
 
 # Text processing
+unidecode>=1.3.8,<2.0.0
 
 # Calendar integration
+icalevents>=0.1.27,<1.0.0
 
 # WebSocket support
-python-socketio>=5.14.0,<6.0.0
+python-socketio>=5.11.0,<6.0.0
 python-engineio>=4.9.0,<5.0.0
 websockets>=12.0,<14.0
 websocket-client>=1.8.0,<2.0.0
@@ -36,11 +43,8 @@ websocket-client>=1.8.0,<2.0.0
 # JSON Schema validation
 jsonschema>=4.20.0,<5.0.0
 
-# Requirement specifier parsing (plugin dependency satisfaction checks)
-packaging>=23.0,<27.0
-
 # Testing dependencies
-pytest>=9.0.3,<10.0.0
+pytest>=7.4.0,<8.0.0
 pytest-cov>=4.1.0,<5.0.0
 pytest-mock>=3.11.0,<4.0.0
 mypy>=1.5.0,<2.0.0

run.py

@@ -51,6 +51,7 @@ if debug_mode:
 
         # Try to import the plugin system directly to get better error info
         print("DEBUG: Attempting to import src.plugin_system...", flush=True)
+        from src.plugin_system import PluginManager
         print("DEBUG: Plugin system import successful", flush=True)
     except ImportError as e:
         print(f"DEBUG: Plugin system import failed: {e}", flush=True)

scripts/add_defaults_to_schemas.py

@@ -9,7 +9,7 @@ and preventing validation errors.
 import json
 import sys
 from pathlib import Path
-from typing import Any, Dict, List
+from typing import Any, Dict, List, Optional
 
 
 def get_default_for_field(prop: Dict[str, Any]) -> Any:

scripts/analyze_plugin_schemas.py

@@ -9,8 +9,9 @@ Analyze all plugin config schemas to identify issues:
 """
 
 import json
+import os
 from pathlib import Path
-from typing import Dict, List, Any
+from typing import Dict, List, Set, Any
 import jsonschema
 from jsonschema import Draft7Validator
 

scripts/audit_plugins.py

@@ -1,296 +0,0 @@
-#!/usr/bin/env python3
-"""
-LEDMatrix Plugin Security Auditor
-
-Performs AST-based security analysis of all Python files in plugin directories.
-Designed to run in CI — exits non-zero on CRITICAL findings only.
-
-Usage:
-    python scripts/audit_plugins.py
-    python scripts/audit_plugins.py --verbose
-    python scripts/audit_plugins.py --plugin hello-world
-    python scripts/audit_plugins.py --output results.json
-"""
-
-import ast
-import argparse
-import json
-import sys
-from dataclasses import dataclass, asdict
-from pathlib import Path
-from datetime import datetime, timezone
-
-PROJECT_ROOT = Path(__file__).resolve().parent.parent
-
-PLUGIN_BASE_DIRS = [
-    PROJECT_ROOT / "plugins",
-    PROJECT_ROOT / "plugin-repos",
-]
-
-
-# ─────────────────────────────────────────────────────────────────────────────
-# Finding dataclass
-# ─────────────────────────────────────────────────────────────────────────────
-
-@dataclass
-class Finding:
-    plugin_id: str
-    file: str
-    line: int
-    severity: str   # CRITICAL | WARNING | INFO
-    rule: str
-    message: str
-
-    def to_dict(self) -> dict:
-        return asdict(self)
-
-
-# ─────────────────────────────────────────────────────────────────────────────
-# AST visitor
-# ─────────────────────────────────────────────────────────────────────────────
-
-class _PluginVisitor(ast.NodeVisitor):
-    """Collect security findings from a single plugin Python file."""
-
-    def __init__(self, filepath: Path, plugin_id: str):
-        self.filepath = filepath
-        self.plugin_id = plugin_id
-        self.findings: list[Finding] = []
-
-    def _add(self, node: ast.AST, severity: str, rule: str, message: str) -> None:
-        self.findings.append(Finding(
-            plugin_id=self.plugin_id,
-            file=str(self.filepath.relative_to(PROJECT_ROOT)),
-            line=getattr(node, "lineno", 0),
-            severity=severity,
-            rule=rule,
-            message=message,
-        ))
-
-    def visit_Call(self, node: ast.Call) -> None:
-        # eval() / exec() — arbitrary code execution
-        if isinstance(node.func, ast.Name):
-            if node.func.id == "eval":
-                self._add(node, "CRITICAL", "PLUGIN-001",
-                          "eval() call — arbitrary code execution risk")
-            elif node.func.id == "exec":
-                self._add(node, "CRITICAL", "PLUGIN-002",
-                          "exec() call — arbitrary code execution risk")
-            elif node.func.id == "compile":
-                self._add(node, "WARNING", "PLUGIN-003",
-                          "compile() call — dynamic code compilation")
-
-        # subprocess.*(shell=True)
-        if isinstance(node.func, ast.Attribute):
-            is_subprocess = (
-                isinstance(node.func.value, ast.Name) and
-                node.func.value.id == "subprocess" and
-                node.func.attr in ("run", "call", "Popen", "check_call", "check_output")
-            )
-            if is_subprocess:
-                for kw in node.keywords:
-                    if (kw.arg == "shell" and
-                            isinstance(kw.value, ast.Constant) and
-                            kw.value.value is True):
-                        self._add(node, "WARNING", "PLUGIN-004",
-                                  f"subprocess.{node.func.attr}(shell=True) — "
-                                  f"shell injection risk if args include user input")
-
-            # os.system() — shell execution
-            is_os_system = (
-                isinstance(node.func.value, ast.Name) and
-                node.func.value.id == "os" and
-                node.func.attr == "system"
-            )
-            if is_os_system:
-                self._add(node, "WARNING", "PLUGIN-005",
-                          "os.system() call — prefer subprocess with list args")
-
-        self.generic_visit(node)
-
-    def visit_Import(self, node: ast.Import) -> None:
-        for alias in node.names:
-            self._check_import(node, alias.name)
-        self.generic_visit(node)
-
-    def visit_ImportFrom(self, node: ast.ImportFrom) -> None:
-        if node.module:
-            self._check_import(node, node.module)
-        self.generic_visit(node)
-
-    def _check_import(self, node: ast.AST, module_name: str) -> None:
-        dangerous = {
-            "ctypes": ("WARNING", "PLUGIN-010", "ctypes import — native code execution"),
-            "cffi": ("WARNING", "PLUGIN-011", "cffi import — native code execution"),
-            "pickle": ("WARNING", "PLUGIN-012",
-                       "pickle import — deserialization can execute arbitrary code"),
-            "marshal": ("WARNING", "PLUGIN-013",
-                        "marshal import — deserialization risk"),
-        }
-        for mod, (severity, rule, msg) in dangerous.items():
-            if module_name == mod or module_name.startswith(mod + "."):
-                self._add(node, severity, rule, msg)
-
-
-# ─────────────────────────────────────────────────────────────────────────────
-# Per-plugin audit
-# ─────────────────────────────────────────────────────────────────────────────
-
-def audit_plugin(plugin_dir: Path) -> list[Finding]:
-    """Audit a single plugin directory. Returns all findings."""
-    findings: list[Finding] = []
-    plugin_id = plugin_dir.name
-
-    # Check for required files
-    for required_file, rule, msg in [
-        ("manifest.json", "PLUGIN-020",
-         "manifest.json missing — plugin may be incomplete"),
-        ("config_schema.json", "PLUGIN-021",
-         "config_schema.json missing — no input validation schema declared"),
-    ]:
-        if not (plugin_dir / required_file).exists():
-            findings.append(Finding(
-                plugin_id=plugin_id,
-                file=str((plugin_dir / required_file).relative_to(PROJECT_ROOT)),
-                line=0,
-                severity="WARNING",
-                rule=rule,
-                message=msg,
-            ))
-
-    # AST analysis of all Python files
-    for py_file in sorted(plugin_dir.rglob("*.py")):
-        try:
-            source = py_file.read_text(encoding="utf-8")
-            tree = ast.parse(source, filename=str(py_file))
-            visitor = _PluginVisitor(py_file, plugin_id)
-            visitor.visit(tree)
-            findings.extend(visitor.findings)
-        except SyntaxError as exc:
-            findings.append(Finding(
-                plugin_id=plugin_id,
-                file=str(py_file.relative_to(PROJECT_ROOT)),
-                line=getattr(exc, "lineno", 0) or 0,
-                severity="WARNING",
-                rule="PLUGIN-030",
-                message=f"Python syntax error — cannot be parsed: {exc}",
-            ))
-        except OSError as exc:
-            findings.append(Finding(
-                plugin_id=plugin_id,
-                file=str(py_file.relative_to(PROJECT_ROOT)),
-                line=0,
-                severity="INFO",
-                rule="PLUGIN-031",
-                message=f"Could not read file: {exc}",
-            ))
-
-    return findings
-
-
-# ─────────────────────────────────────────────────────────────────────────────
-# Main
-# ─────────────────────────────────────────────────────────────────────────────
-
-def main() -> int:
-    parser = argparse.ArgumentParser(
-        description="LEDMatrix plugin security auditor",
-        formatter_class=argparse.RawDescriptionHelpFormatter,
-    )
-    parser.add_argument("--plugin", "-p", default=None,
-                        help="Audit a specific plugin ID only")
-    parser.add_argument("--output", "-o", default=None,
-                        help="Write JSON results to this file")
-    parser.add_argument("--verbose", "-v", action="store_true",
-                        help="Show all findings, not just summary")
-    args = parser.parse_args()
-
-    print("=" * 60)
-    print("LEDMatrix Plugin Security Audit")
-    print(f"Project root: {PROJECT_ROOT}")
-    print("=" * 60)
-
-    all_findings: list[Finding] = []
-    plugins_scanned = 0
-
-    for base_dir in PLUGIN_BASE_DIRS:
-        if not base_dir.exists():
-            if args.verbose:
-                print(f"  ⏭️  Skipping {base_dir.name}/ (directory not found)")
-            continue
-
-        base_label = base_dir.relative_to(PROJECT_ROOT)
-        print(f"\n  Scanning {base_label}/")
-
-        for plugin_dir in sorted(base_dir.iterdir()):
-            if not plugin_dir.is_dir():
-                continue
-            if plugin_dir.name.startswith((".", "_")):
-                continue
-            if args.plugin and plugin_dir.name != args.plugin:
-                continue
-
-            findings = audit_plugin(plugin_dir)
-            all_findings.extend(findings)
-            plugins_scanned += 1
-
-            critical = [f for f in findings if f.severity == "CRITICAL"]
-            warnings = [f for f in findings if f.severity == "WARNING"]
-
-            if critical:
-                icon, label = "🚨", "CRITICAL"
-            elif warnings:
-                icon, label = "⚠️ ", "WARN   "
-            else:
-                icon, label = "✅", "PASS   "
-
-            print(f"    {icon} [{label}] {plugin_dir.name}"
-                  f" — {len(critical)} critical, {len(warnings)} warnings")
-
-            if args.verbose:
-                for f in findings:
-                    severity_icon = {"CRITICAL": "🚨", "WARNING": "⚠️ ", "INFO": "ℹ️ "}.get(
-                        f.severity, "  "
-                    )
-                    print(f"           {severity_icon} {f.rule} {f.file}:{f.line} — {f.message}")
-
-    # Summary
-    critical_findings = [f for f in all_findings if f.severity == "CRITICAL"]
-    warning_findings = [f for f in all_findings if f.severity == "WARNING"]
-
-    print(f"\n{'=' * 60}")
-    print(f"  Plugins scanned : {plugins_scanned}")
-    print(f"  CRITICAL        : {len(critical_findings)}")
-    print(f"  WARNING         : {len(warning_findings)}")
-
-    if critical_findings:
-        print("\n  🚨 CRITICAL findings:")
-        for f in critical_findings:
-            print(f"    {f.plugin_id} | {Path(f.file).name}:{f.line} | {f.message}")
-
-    # Write JSON output
-    if args.output:
-        output_data = {
-            "timestamp": datetime.now(timezone.utc).isoformat(),
-            "plugins_scanned": plugins_scanned,
-            "summary": {
-                "critical": len(critical_findings),
-                "warnings": len(warning_findings),
-            },
-            "findings": [f.to_dict() for f in all_findings],
-        }
-        Path(args.output).write_text(
-            json.dumps(output_data, indent=2), encoding="utf-8"
-        )
-        print(f"\n  Results written to: {args.output}")
-
-    if critical_findings:
-        print("\n  🚨 Blocking — CRITICAL issues must be resolved")
-        return 1
-
-    print("\n  ✅ No critical issues found")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

scripts/check_plugin.py

@@ -1,232 +0,0 @@
-#!/usr/bin/env python3
-"""
-Plugin safety checker.
-
-Renders a plugin across every declared screen (mode) and every supported matrix
-size, and fails if any screen crashes, overflows the panel, or (for plugins with
-committed golden images) drifts visually.
-
-Usage:
-    # Functional + bounds check across all sizes/modes:
-    python scripts/check_plugin.py --plugin clock-simple
-
-    # Every discovered plugin:
-    python scripts/check_plugin.py --all
-
-    # Dump PNGs for each size/mode so you can eyeball them:
-    python scripts/check_plugin.py --plugin ledmatrix-weather --out-dir /tmp/preview
-
-    # Refresh committed golden images after an intentional visual change:
-    python scripts/check_plugin.py --plugin clock-simple --update-golden \
-        --mock-data plugins/clock-simple/test/fixtures/mock.json
-
-Exit code is non-zero if any (plugin, size, mode) fails.
-"""
-
-import argparse
-import json
-import os
-import sys
-from pathlib import Path
-from typing import Dict, List, Optional
-
-PROJECT_ROOT = Path(__file__).resolve().parent.parent
-sys.path.insert(0, str(PROJECT_ROOT))
-
-os.environ['EMULATOR'] = 'true'
-
-from src.logging_config import get_logger  # noqa: E402
-from src.plugin_system.testing.loading import (  # noqa: E402
-    find_plugin_dir, load_config_defaults, load_harness_spec,
-)
-from src.plugin_system.testing.harness import (  # noqa: E402
-    RenderResult, render_plugin_matrix, compare_to_goldens, write_goldens,
-)
-from src.plugin_system.testing.sizes import (  # noqa: E402
-    parse_size_token, resolve_test_sizes, safe_mode_filename, size_label,
-)
-
-logger = get_logger("[Check Plugin]")
-
-DEFAULT_SEARCH_DIRS = [
-    str(PROJECT_ROOT / 'plugins'),
-    str(PROJECT_ROOT / 'plugin-repos'),
-]
-
-
-def discover_plugins(search_dirs: List[str]) -> List[str]:
-    """All plugin ids found across the search dirs (dirs containing manifest.json)."""
-    found = []
-    for d in search_dirs:
-        base = Path(d)
-        if not base.exists():
-            continue
-        for child in sorted(base.iterdir()):
-            if (child / 'manifest.json').exists() and child.name not in found:
-                found.append(child.name)
-    return found
-
-
-def parse_sizes(spec: Optional[str]):
-    if not spec:
-        return None
-    sizes = []
-    for token in spec.split(','):
-        if not token.strip():
-            continue
-        try:
-            sizes.append(parse_size_token(token))
-        except ValueError as exc:
-            raise SystemExit(str(exc)) from exc
-    return sizes
-
-
-def check_one(plugin_id: str, search_dirs: List[str], sizes, mock_data: Dict,
-              config: Dict, run_update: bool, out_dir: Optional[Path],
-              update_golden: bool, golden_dir_override: Optional[Path],
-              freeze_time: Optional[str]) -> List[RenderResult]:
-    plugin_dir = find_plugin_dir(plugin_id, search_dirs)
-    if not plugin_dir:
-        logger.error("Plugin '%s' not found in: %s", plugin_id, search_dirs)
-        return [RenderResult(plugin_id, 0, 0, "<not-found>", error="plugin directory not found")]
-
-    # Per-plugin test/harness.json holds the deterministic settings the committed
-    # goldens were generated with (config, mock data, frozen time, sizes). Load
-    # them so the CLI/CI render reproduces the golden the same way the pytest
-    # matrix path does; explicit CLI flags still override the file.
-    spec = load_harness_spec(plugin_dir)
-
-    # config_schema defaults (real-install behavior), then harness.json config,
-    # then CLI --config — most specific wins.
-    full_config = {"enabled": True}
-    full_config.update(load_config_defaults(plugin_dir))
-    full_config.update(spec.get("config", {}))
-    full_config.update(config)
-
-    # Precedence: CLI flag > LEDMATRIX_TEST_SIZES env > harness.json > default.
-    effective_sizes = sizes if sizes else resolve_test_sizes(spec.get("sizes"))
-    # CLI value wins when provided, else fall back to the harness.json setting.
-    effective_mock_data = mock_data or spec.get("mock_data_contents", {})
-    effective_freeze = freeze_time or spec.get("freeze_time")
-    effective_run_update = run_update and not spec.get("skip_update", False)
-
-    results = render_plugin_matrix(
-        plugin_id=plugin_id, plugin_dir=plugin_dir, config=full_config,
-        mock_data=effective_mock_data, sizes=effective_sizes,
-        run_update=effective_run_update, freeze_time=effective_freeze,
-    )
-
-    golden_dir = golden_dir_override or (plugin_dir / 'test' / 'golden')
-    if update_golden:
-        written = write_goldens(results, golden_dir)
-        logger.info("Wrote %d golden image(s) for %s to %s", written, plugin_id, golden_dir)
-    else:
-        compare_to_goldens(results, golden_dir)
-
-    if out_dir:
-        for r in results:
-            if r.image is None:
-                continue
-            dest = out_dir / plugin_id / size_label(r.width, r.height)
-            dest.mkdir(parents=True, exist_ok=True)
-            r.image.save(dest / f"{safe_mode_filename(r.mode)}.png", format="PNG")
-
-    return results
-
-
-def print_report(all_results: Dict[str, List[RenderResult]]) -> bool:
-    """Print a per-plugin grid. Returns True if everything passed."""
-    everything_ok = True
-    for plugin_id, results in all_results.items():
-        print(f"\n=== {plugin_id} ===")
-        for r in results:
-            if r.ok:
-                status = "PASS"
-                detail = ""
-                if r.golden_checked:
-                    detail = " (golden ✓)"
-                if r.update_error is not None:
-                    detail += f" (update warn: {r.update_error})"
-            else:
-                everything_ok = False
-                if r.error is not None:
-                    status, detail = "FAIL", f" error={r.error}"
-                elif r.overflow is not None:
-                    status, detail = "FAIL", f" overflow bbox={r.overflow}"
-                elif r.golden_ok is False:
-                    status = "FAIL"
-                    detail = f" golden drift: {r.golden_diff_pixels}px (max Δ={r.golden_max_delta})"
-                else:
-                    status, detail = "FAIL", ""
-            print(f"  [{status}] {r.size_label:>7}  {r.mode}{detail}")
-    print()
-    return everything_ok
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description="Check a plugin renders safely across sizes & screens")
-    group = parser.add_mutually_exclusive_group(required=True)
-    group.add_argument('--plugin', '-p', help='Plugin id to check')
-    group.add_argument('--all', action='store_true', help='Check every discovered plugin')
-    parser.add_argument('--plugin-dir', '-d', default=None, help='Directory to search for plugins')
-    parser.add_argument('--sizes', default=None, help='Comma-separated WxH list (default: all supported)')
-    parser.add_argument('--config', '-c', default='{}', help='Plugin config overrides as JSON')
-    parser.add_argument('--mock-data', '-m', default=None, help='Path to JSON file with mock cache data')
-    parser.add_argument('--out-dir', '-o', default=None, help='Also dump rendered PNGs here')
-    parser.add_argument('--skip-update', action='store_true', help='Skip calling update()')
-    parser.add_argument('--update-golden', action='store_true', help='Write/refresh golden images')
-    parser.add_argument('--golden-dir', default=None, help='Override golden dir (default: <plugin>/test/golden)')
-    parser.add_argument('--freeze-time', default=None,
-                        help='Freeze wall clock, e.g. "2025-08-01 15:25:00" (for time-dependent plugins)')
-    args = parser.parse_args()
-
-    search_dirs = [args.plugin_dir] if args.plugin_dir else DEFAULT_SEARCH_DIRS
-    sizes = parse_sizes(args.sizes)
-
-    try:
-        config = json.loads(args.config)
-    except json.JSONDecodeError as e:
-        logger.error("Invalid --config JSON: %s", e)
-        return 2
-    if not isinstance(config, dict):
-        logger.error("--config must be a JSON object, got %s", type(config).__name__)
-        return 2
-
-    mock_data = {}
-    if args.mock_data:
-        mock_path = Path(args.mock_data)
-        if not mock_path.exists():
-            logger.error("Mock data file not found: %s", args.mock_data)
-            return 2
-        with open(mock_path) as f:
-            mock_data = json.load(f)
-        if not isinstance(mock_data, dict):
-            logger.error("--mock-data must be a JSON object (key -> cache value), got %s",
-                         type(mock_data).__name__)
-            return 2
-
-    plugin_ids = discover_plugins(search_dirs) if args.all else [args.plugin]
-    if not plugin_ids:
-        logger.error("No plugins found in: %s", search_dirs)
-        return 2
-
-    out_dir = Path(args.out_dir) if args.out_dir else None
-    golden_dir_override = Path(args.golden_dir) if args.golden_dir else None
-
-    all_results: Dict[str, List[RenderResult]] = {}
-    for plugin_id in plugin_ids:
-        all_results[plugin_id] = check_one(
-            plugin_id=plugin_id, search_dirs=search_dirs, sizes=sizes,
-            mock_data=mock_data, config=config, run_update=not args.skip_update,
-            out_dir=out_dir, update_golden=args.update_golden,
-            golden_dir_override=golden_dir_override, freeze_time=args.freeze_time,
-        )
-
-    # When refreshing goldens we skip drift comparison, but a crash or overflow
-    # still means the plugin is broken — never let --update-golden mask that.
-    ok = print_report(all_results)
-    return 0 if ok else 1
-
-
-if __name__ == '__main__':
-    sys.exit(main())

scripts/clear_dependency_markers.sh

@@ -0,0 +1,29 @@
+#!/bin/bash
+# Clear all plugin dependency markers to force fresh dependency check
+# Useful after updating plugins or troubleshooting dependency issues
+
+echo "Clearing plugin dependency markers..."
+
+# Check both possible cache locations
+CACHE_DIRS=(
+    "/var/cache/ledmatrix"
+    "$HOME/.cache/ledmatrix"
+)
+
+for CACHE_DIR in "${CACHE_DIRS[@]}"; do
+    if [ -d "$CACHE_DIR" ]; then
+        echo "Checking $CACHE_DIR..."
+        marker_count=$(find "$CACHE_DIR" -name "plugin_*_deps_installed" 2>/dev/null | wc -l)
+        if [ "$marker_count" -gt 0 ]; then
+            echo "Found $marker_count dependency marker(s) in $CACHE_DIR"
+            find "$CACHE_DIR" -name "plugin_*_deps_installed" -delete
+            echo "Cleared $marker_count marker(s)"
+        else
+            echo "No dependency markers found in $CACHE_DIR"
+        fi
+    fi
+done
+
+echo "Done! Dependency markers cleared."
+echo "Next startup will check and install dependencies as needed."
+

scripts/debug/check_imports.py

@@ -3,6 +3,8 @@
 Check what imports are actually in the app.py file on the Pi
 """
 
+import sys
+import os
 from pathlib import Path
 
 # Read the app.py file and check the import lines

scripts/debug/debug_web_manual.py

@@ -67,9 +67,8 @@ def main():
         print("   📍 Will run on: http://0.0.0.0:5000")
         print("   ⏹️  Press Ctrl+C to stop")
 
-        # Run the app (debug mode controlled by env var to satisfy security scanners)
-        _debug = os.environ.get('LEDMATRIX_FLASK_DEBUG', '0') == '1'
-        app.run(host='0.0.0.0', port=5000, debug=_debug)
+        # Run the app (this should start the server)
+        app.run(host='0.0.0.0', port=5000, debug=True)
 
     except KeyboardInterrupt:
         print("\n   ⏹️  Server stopped by user")

scripts/dev/dev_plugin_setup.sh

@@ -203,7 +203,7 @@ link_github_plugin() {
         log_info "Repository already exists at $target_dir"
         if [[ -d "$target_dir/.git" ]]; then
             log_info "Updating repository..."
-            (cd "$target_dir" && git pull --rebase) || true
+            (cd "$target_dir" && git pull --rebase || true)
         fi
     else
         # Clone the repository