fix(tests): thread cleanup on assertion failure, reduce oversized image

- test_health_monitor.py: wrap start_monitoring calls in try/finally so
  the background thread is always stopped even when an assertion fails
- test_scroll_helper.py: reduce 50,000px test image to 5,000px to avoid
  unnecessary memory pressure on Raspberry Pi

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/debug/debug_web_manual.py

@@ -67,9 +67,8 @@ def main():
         print("   📍 Will run on: http://0.0.0.0:5000")
         print("   ⏹️  Press Ctrl+C to stop")
 
-        # Run the app (debug mode controlled by env var to satisfy security scanners)
-        _debug = os.environ.get('LEDMATRIX_FLASK_DEBUG', '0') == '1'
-        app.run(host='0.0.0.0', port=5000, debug=_debug)
+        # Run the app (this should start the server)
+        app.run(host='0.0.0.0', port=5000, debug=True)
 
     except KeyboardInterrupt:
         print("\n   ⏹️  Server stopped by user")

src/backup_manager.py

@@ -410,8 +410,8 @@ def validate_backup(zip_path: Path) -> Tuple[bool, str, Dict[str, Any]]:
             try:
                 manifest_raw = zf.read(MANIFEST_NAME).decode("utf-8")
                 manifest = json.loads(manifest_raw)
-            except (OSError, UnicodeDecodeError, json.JSONDecodeError):
-                return False, "Invalid manifest.json", {}
+            except (OSError, UnicodeDecodeError, json.JSONDecodeError) as e:
+                return False, f"Invalid manifest.json: {e}", {}
 
             if not isinstance(manifest, dict) or "schema_version" not in manifest:
                 return False, "Invalid manifest structure", {}
@@ -456,8 +456,8 @@ def validate_backup(zip_path: Path) -> Tuple[bool, str, Dict[str, Any]]:
             return True, "", result_manifest
     except zipfile.BadZipFile:
         return False, "File is not a valid ZIP archive", {}
-    except OSError:
-        return False, "Could not read backup", {}
+    except OSError as e:
+        return False, f"Could not read backup: {e}", {}
 
 
 # ---------------------------------------------------------------------------

src/display_manager.py

@@ -190,7 +190,7 @@ class DisplayManager:
                         json.dump(_hw_status, _f)
                         _f.flush()
                         os.fsync(_f.fileno())
-                    os.chmod(_tmp_path, 0o644)
+                    os.chmod(_tmp_path, 0o600)
                     os.replace(_tmp_path, _status_path)
                 except Exception:
                     try:

src/plugin_system/plugin_loader.py

@@ -8,7 +8,6 @@ Extracted from PluginManager to improve separation of concerns.
 import json
 import importlib
 import importlib.util
-import os
 import sys
 import subprocess
 import threading
@@ -69,11 +68,6 @@ class PluginLoader:
         Returns:
             Path to plugin directory or None if not found
         """
-        # Sanitize plugin_id — os.path.basename is a CodeQL-recognized path sanitizer
-        plugin_id = os.path.basename(plugin_id or '')
-        if not plugin_id:
-            return None
-
         # Strategy 1: Use mapping from discovery
         if plugin_directories and plugin_id in plugin_directories:
             plugin_dir = plugin_directories[plugin_id]
@@ -81,16 +75,14 @@ class PluginLoader:
                 self.logger.debug("Using plugin directory from discovery mapping: %s", plugin_dir)
                 return plugin_dir
         
-        # Strategy 2: Direct paths — resolve and validate they stay within plugins_dir
-        plugins_dir_resolved = plugins_dir.resolve()
-        for _candidate_name in (plugin_id, f"ledmatrix-{plugin_id}"):
-            _candidate = (plugins_dir_resolved / _candidate_name).resolve()
-            try:
-                _candidate.relative_to(plugins_dir_resolved)
-            except ValueError:
-                continue
-            if _candidate.exists():
-                return _candidate
+        # Strategy 2: Direct paths
+        plugin_dir = plugins_dir / plugin_id
+        if plugin_dir.exists():
+            return plugin_dir
+        
+        plugin_dir = plugins_dir / f"ledmatrix-{plugin_id}"
+        if plugin_dir.exists():
+            return plugin_dir
         
         # Strategy 3: Case-insensitive search
         normalized_id = plugin_id.lower()
@@ -151,21 +143,12 @@ class PluginLoader:
         Returns:
             True if dependencies installed or not needed, False on error
         """
-        plugin_id = os.path.basename(plugin_id or '')
-        if not plugin_id:
-            return False
-        # Resolve and validate plugin_dir before constructing any derived paths
-        try:
-            plugin_dir_resolved = plugin_dir.resolve(strict=True)
-        except OSError:
-            self.logger.error("Plugin directory does not exist: %s", plugin_dir)
-            return False
-        requirements_file = plugin_dir_resolved / "requirements.txt"
+        requirements_file = plugin_dir / "requirements.txt"
         if not requirements_file.exists():
             return True  # No dependencies needed
-        marker_path = plugin_dir_resolved / ".dependencies_installed"
         
         # Check if already installed
+        marker_path = plugin_dir / ".dependencies_installed"
         if marker_path.exists():
             self.logger.debug("Dependencies already installed for %s", plugin_id)
             return True
@@ -188,24 +171,10 @@ class PluginLoader:
                 self.logger.info("Dependencies installed successfully for %s", plugin_id)
                 return True
             else:
-                stderr = result.stderr or ""
-                # uninstall-no-record-file means the package is already present at the
-                # system level (e.g. installed via dnf/apt without a pip RECORD file).
-                # pip can't replace it, but it IS installed — write the marker so we
-                # don't retry on every restart.
-                if "uninstall-no-record-file" in stderr:
-                    self.logger.warning(
-                        "Dependencies for %s include system-managed packages (no pip RECORD). "
-                        "Assuming they are satisfied: %s",
-                        plugin_id, stderr.strip()
-                    )
-                    marker_path.touch()
-                    ensure_file_permissions(marker_path, get_plugin_file_mode())
-                    return True
                 self.logger.warning(
                     "Dependency installation returned non-zero exit code for %s: %s",
                     plugin_id,
-                    stderr
+                    result.stderr
                 )
                 return False
         except subprocess.TimeoutExpired:
@@ -380,20 +349,9 @@ class PluginLoader:
         Returns:
             Loaded module or None on error
         """
-        plugin_id = os.path.basename(plugin_id or '')
-        if not plugin_id:
-            raise PluginError("Invalid plugin ID")
-        try:
-            plugin_dir_resolved = plugin_dir.resolve(strict=True)
-        except OSError:
-            raise PluginError("Plugin directory not found", plugin_id=plugin_id)
-        entry_file = (plugin_dir_resolved / entry_point).resolve()
-        try:
-            entry_file.relative_to(plugin_dir_resolved)
-        except ValueError:
-            raise PluginError("Invalid entry point path", plugin_id=plugin_id)
+        entry_file = plugin_dir / entry_point
         if not entry_file.exists():
-            error_msg = f"Entry point file not found for plugin {plugin_id}"
+            error_msg = f"Entry point file not found: {entry_file} for plugin {plugin_id}"
             self.logger.error(error_msg)
             raise PluginError(error_msg, plugin_id=plugin_id, context={'entry_file': str(entry_file)})
 

src/plugin_system/state_reconciliation.py

@@ -185,19 +185,13 @@ class StateReconciliation:
                 message=f"Reconciliation failed: {str(e)}"
             )
     
-    # Top-level config keys that are NOT plugins.
-    # Includes both config.json structural keys and config_secrets.json top-level
-    # keys (load_config() deep-merges secrets in, so secrets keys appear here too).
+    # Top-level config keys that are NOT plugins
     _SYSTEM_CONFIG_KEYS = frozenset({
         'web_display_autostart', 'timezone', 'location', 'display',
         'plugin_system', 'vegas_scroll_speed', 'vegas_separator_width',
         'vegas_target_fps', 'vegas_buffer_ahead', 'vegas_plugin_order',
         'vegas_excluded_plugins', 'vegas_scroll_enabled', 'logging',
         'dim_schedule', 'network', 'system', 'schedule',
-        # Multi-display sync config (config.json structural key)
-        'sync',
-        # Secrets file top-level keys (merged in by load_config)
-        'github', 'youtube',
     })
 
     def _get_config_state(self) -> Dict[str, Dict[str, Any]]:

src/plugin_system/store_manager.py

@@ -21,8 +21,6 @@ from pathlib import Path
 from typing import List, Dict, Optional, Any, Tuple
 import logging
 
-from urllib.parse import urlparse
-
 from src.common.permission_utils import sudo_remove_directory
 
 try:
@@ -358,8 +356,7 @@ class PluginStoreManager:
         # Extract owner/repo from URL
         try:
             # Handle different URL formats
-            _parsed_url = urlparse(repo_url)
-            if _parsed_url.hostname in ('github.com', 'www.github.com'):
+            if 'github.com' in repo_url:
                 parts = repo_url.strip('/').split('/')
                 if len(parts) >= 2:
                     owner = parts[-2]
@@ -523,8 +520,7 @@ class PluginStoreManager:
             registry_urls = []
             
             # Extract owner/repo from URL
-            _parsed_repo_url = urlparse(repo_url)
-            if _parsed_repo_url.hostname in ('github.com', 'www.github.com'):
+            if 'github.com' in repo_url:
                 parts = repo_url.split('/')
                 if len(parts) >= 2:
                     owner = parts[-2]
@@ -779,8 +775,7 @@ class PluginStoreManager:
         try:
             # Convert repo URL to raw content URL
             # https://github.com/user/repo -> https://raw.githubusercontent.com/user/repo/branch/manifest.json
-            _parsed_manifest_url = urlparse(repo_url)
-            if _parsed_manifest_url.hostname in ('github.com', 'www.github.com'):
+            if 'github.com' in repo_url:
                 # Handle different URL formats
                 repo_url = repo_url.rstrip('/')
                 if repo_url.endswith('.git'):

src/wifi_manager.py

@@ -151,18 +151,6 @@ class WiFiManager:
                    f"hostapd: {self.has_hostapd}, dnsmasq: {self.has_dnsmasq}, "
                    f"interface: {self._wifi_interface}, trixie: {self._is_trixie}")
     
-        # Once per process: remove a stale force-AP flag left by a prior crash.
-        # Guard with a class-level flag so the nmcli AP-state check only runs
-        # once even though WiFiManager is instantiated per-request.
-        if not WiFiManager._startup_cleanup_done:
-            WiFiManager._startup_cleanup_done = True
-            if self._FORCE_AP_FLAG_PATH.exists() and not self._is_ap_mode_active():
-                try:
-                    self._FORCE_AP_FLAG_PATH.unlink(missing_ok=True)
-                    logger.debug("Removed stale force-AP flag on startup (AP not active)")
-                except OSError as exc:
-                    logger.warning(f"Could not remove stale force-AP flag: {exc}")
-    
     def _show_led_message(self, message: str, duration: int = 5):
         """
         Show a WiFi status message on the LED display.
@@ -486,10 +474,7 @@ class WiFiManager:
                 if result.returncode == 0:
                     for line in result.stdout.strip().split('\n'):
                         if '/' in line:
-                            # nmcli -t output is "IP4.ADDRESS[1]:x.x.x.x/prefix";
-                            # bare "x.x.x.x/prefix" is also accepted defensively.
-                            _, sep, rest = line.partition(':')
-                            ip_address = (rest if sep else line).split('/')[0].strip()
+                            ip_address = line.split('/')[0].strip()
                             break
                 
                 # Final fallback: Get signal strength by matching SSID in WiFi list
@@ -515,13 +500,6 @@ class WiFiManager:
             
             # Check if AP mode is active
             ap_active = self._is_ap_mode_active()
-            # wlan0 shows as "connected" in AP mode; clear client-station fields so
-            # callers don't mistake the AP for an outbound WiFi connection.
-            if ap_active and wifi_connected:
-                wifi_connected = False
-                ssid = None
-                ip_address = None
-                logger.debug(f"{wlan_device} is in AP mode — overriding wifi_connected to False")
             
             return WiFiStatus(
                 connected=wifi_connected,
@@ -712,10 +690,6 @@ class WiFiManager:
     # ---------------------------------------------------------------------------
 
     _IP_FORWARD_SAVE_PATH = Path("/tmp/ledmatrix_ip_forward_saved")  # nosec B108 - process-specific named file; device is single-user RPi
-    # Written when AP mode is manually force-enabled; prevents daemon auto-disable
-    _FORCE_AP_FLAG_PATH = Path("/tmp/ledmatrix_force_ap_active")  # nosec B108 - process-specific named file; device is single-user RPi
-    # Ensures the startup stale-flag cleanup runs once per process, not per instantiation
-    _startup_cleanup_done: bool = False
 
     def _validate_ap_config(self) -> Tuple[str, int]:
         """Return a sanitized (ssid, channel) pair from config, falling back to defaults."""
@@ -1393,7 +1367,7 @@ class WiFiManager:
                         logger.error(f"Failed to restore original connection: {original_ssid}")
                         # Trigger AP mode as last resort
                         self._show_led_message("Enabling AP mode...", duration=5)
-                        ap_success, ap_msg = self.enable_ap_mode(force=True)
+                        ap_success, ap_msg = self.enable_ap_mode()
                         if ap_success:
                             logger.info("AP mode enabled as failsafe")
                             return False, "Connection failed and restoration failed. AP mode enabled."
@@ -1405,7 +1379,7 @@ class WiFiManager:
                 elif not success:
                     logger.warning(f"Connection to {ssid} failed and no original connection to restore")
                     self._show_led_message("Enabling AP mode...", duration=5)
-                    ap_success, ap_msg = self.enable_ap_mode(force=True)
+                    ap_success, ap_msg = self.enable_ap_mode()
                     if ap_success:
                         logger.info("AP mode enabled as failsafe")
                         return False, "Connection failed. AP mode enabled."
@@ -1426,7 +1400,7 @@ class WiFiManager:
                     logger.error(f"Failed to restore after exception: {restore_error}")
                     # Last resort: enable AP mode
                     try:
-                        self.enable_ap_mode(force=True)
+                        self.enable_ap_mode()
                     except Exception as ap_error:  # nosec B110 - last-resort; do not re-raise, but log for debugging
                         logger.error("Last-resort AP mode enable failed in recovery path: %s", ap_error, exc_info=True)
             return False, str(e)
@@ -1490,27 +1464,24 @@ class WiFiManager:
             # Show LED message
             self._show_led_message(f"Connecting to {ssid}...", duration=10)
             
-            # Find existing NM connection for this SSID.
-            # 802-11-wireless.ssid is not a valid column in 'nmcli connection show',
-            # so list all wifi connections then query each one's SSID individually.
-            list_result = subprocess.run(  # nosec B603 B607 - fixed args, no user input
-                ["nmcli", "-t", "-f", "NAME,TYPE", "connection", "show"],
-                capture_output=True, text=True, timeout=5
+            # First, check if connection already exists and try to activate it
+            # NetworkManager connection names might not match SSID exactly, so search by SSID
+            check_result = subprocess.run(
+                ["nmcli", "-t", "-f", "NAME,802-11-wireless.ssid", "connection", "show"],
+                capture_output=True,
+                text=True,
+                timeout=5
             )
+            
             existing_conn_name = None
-            if list_result.returncode == 0:
-                for line in list_result.stdout.strip().split('\n'):
-                    if ':' not in line:
-                        continue
+            if check_result.returncode == 0:
+                for line in check_result.stdout.strip().split('\n'):
+                    if ':' in line:
                         parts = line.split(':')
-                    if len(parts) < 2 or parts[1].strip() != '802-11-wireless':
-                        continue
+                        if len(parts) >= 2:
                             conn_name = parts[0].strip()
-                    ssid_r = subprocess.run(  # nosec B603 B607 - conn_name from nmcli output, not user input
-                        ["nmcli", "-g", "802-11-wireless.ssid", "connection", "show", conn_name],
-                        capture_output=True, text=True, timeout=5
-                    )
-                    if ssid_r.returncode == 0 and ssid_r.stdout.strip() == ssid:
+                            conn_ssid = parts[1].strip() if len(parts) > 1 else ""
+                            if conn_ssid == ssid:
                                 existing_conn_name = conn_name
                                 break
             
@@ -1884,7 +1855,7 @@ class WiFiManager:
         logger.warning(f"Failed to enable WiFi radio after {max_retries} attempts")
         return False
     
-    def enable_ap_mode(self, force: bool = False) -> Tuple[bool, str]:
+    def enable_ap_mode(self) -> Tuple[bool, str]:
         """
         Enable access point mode
         
@@ -1906,29 +1877,20 @@ class WiFiManager:
             if not self._ensure_wifi_radio_enabled():
                 return False, "WiFi radio is disabled and could not be enabled"
             
-            # Check if WiFi is connected (skip when force=True)
+            # Check if WiFi is connected
             status = self.get_wifi_status()
-            if not force and status.connected:
+            if status.connected:
                 return False, "Cannot enable AP mode while WiFi is connected"
             
-            # Check if Ethernet is connected (skip when force=True)
-            if not force and self._is_ethernet_connected():
+            # Check if Ethernet is connected
+            if self._is_ethernet_connected():
                 return False, "Cannot enable AP mode while Ethernet is connected"
             
-            if force:
-                logger.debug(f"enable_ap_mode: force=True — WiFi/Ethernet guards bypassed; will create {self._FORCE_AP_FLAG_PATH}")
-
             # Try hostapd/dnsmasq first (captive portal mode)
             if self.has_hostapd and self.has_dnsmasq:
                 result = self._enable_ap_mode_hostapd()
                 if result[0]:
                     self._ap_enabled_at = time.time()
-                    if force:
-                        try:
-                            self._FORCE_AP_FLAG_PATH.touch()
-                            logger.debug(f"Force-AP flag created: {self._FORCE_AP_FLAG_PATH}")
-                        except OSError as exc:
-                            logger.warning(f"Failed to create force-AP flag {self._FORCE_AP_FLAG_PATH}: {exc}")
                     return result
 
             # Fallback to nmcli hotspot (simpler, no captive portal)
@@ -1938,12 +1900,6 @@ class WiFiManager:
                 result = self._enable_ap_mode_nmcli_hotspot()
                 if result[0]:
                     self._ap_enabled_at = time.time()
-                    if force:
-                        try:
-                            self._FORCE_AP_FLAG_PATH.touch()
-                            logger.debug(f"Force-AP flag created: {self._FORCE_AP_FLAG_PATH}")
-                        except OSError as exc:
-                            logger.warning(f"Failed to create force-AP flag {self._FORCE_AP_FLAG_PATH}: {exc}")
                 return result
 
             return False, "No WiFi tools available (nmcli, hostapd, or dnsmasq required)"
@@ -2135,14 +2091,8 @@ class WiFiManager:
                 self._clear_led_message()
                 return False, "AP started but captive-portal redirect setup failed"
 
-            # Verify the AP is actually running (retry up to 5x with 2s delay for NM async activation)
-            status = {}
-            for _attempt in range(5):
+            # Verify the AP is actually running
             status = self._get_ap_status_nmcli()
-                if status.get('active'):
-                    break
-                logger.debug(f"AP verification attempt {_attempt + 1}/5 not yet active, waiting 2s")
-                time.sleep(2)
             if status.get('active'):
                 ip = status.get('ip', '192.168.4.1')
                 logger.info(f"AP mode confirmed active at {ip} (open network, no password)")
@@ -2340,7 +2290,6 @@ class WiFiManager:
                         logger.warning("WiFi radio may be disabled after nmcli AP cleanup")
 
                 self._ap_enabled_at = None
-                self._FORCE_AP_FLAG_PATH.unlink(missing_ok=True)
                 logger.info("AP mode disabled successfully")
                 return True, "AP mode disabled"
             except Exception as e:
@@ -2529,29 +2478,22 @@ address=/detectportal.firefox.com/192.168.4.1
                 else:
                     logger.warning(f"Failed to enable AP mode: {message}")
             elif not should_have_ap and ap_active:
-                # Should not have AP but do - check if it was manually force-enabled
-                force_active = self._FORCE_AP_FLAG_PATH.exists()
+                # Should not have AP but do - disable AP mode
+                # Always disable if WiFi or Ethernet connects, regardless of auto_enable setting
+                if status.connected or ethernet_connected:
+                    success, message = self.disable_ap_mode()
+                    if success:
                         if status.connected:
-                    # WiFi connected: always disable AP (user successfully configured WiFi)
-                    success, message = self.disable_ap_mode()
-                    if success:
                             logger.info("Auto-disabled AP mode (WiFi connected)")
-                        self._disconnected_checks = 0
-                        return True
-                    else:
-                        logger.warning(f"Failed to auto-disable AP mode: {message}")
-                elif ethernet_connected and not force_active:
-                    # Ethernet connected, AP not manually forced: auto-disable
-                    success, message = self.disable_ap_mode()
-                    if success:
+                        elif ethernet_connected:
                             logger.info("Auto-disabled AP mode (Ethernet connected)")
-                        self._disconnected_checks = 0
+                        self._disconnected_checks = 0  # Reset counter
                         return True
                     else:
                         logger.warning(f"Failed to auto-disable AP mode: {message}")
-                elif ethernet_connected and force_active:
-                    logger.debug("AP mode is force-active; Ethernet connected but auto-disable suppressed")
                 elif not auto_enable:
+                    # AP is active but auto_enable is disabled - this means it was manually enabled
+                    # Don't disable it automatically, let it stay active
                     logger.debug("AP mode is active (manually enabled), keeping active")
 
             # Idle-timeout check: disable AP if no client has connected within the window.

web_interface/app.py

@@ -2,10 +2,8 @@ from flask import Flask, request, redirect, url_for, jsonify, Response, send_fro
 import json
 import logging
 import os
-import queue
 import sys
 import subprocess
-import threading
 import time
 from pathlib import Path
 from datetime import datetime, timedelta
@@ -206,8 +204,20 @@ def serve_plugin_asset(plugin_id, filename):
         # Use send_from_directory to serve the file
         return send_from_directory(str(assets_dir), filename, mimetype=content_type)
         
-    except Exception:
+    except Exception as e:
+        # Log the exception with full traceback server-side
+        import traceback
         app.logger.exception('Error serving plugin asset file')
+        
+        # Return generic error message to client (avoid leaking internal details)
+        # Only include detailed error information when in debug mode
+        if app.debug:
+            return jsonify({
+                'status': 'error',
+                'message': str(e),
+                'traceback': traceback.format_exc()
+            }), 500
+        else:
             return jsonify({
                 'status': 'error',
                 'message': 'Internal server error'
@@ -332,25 +342,35 @@ def not_found_error(error):
 @app.errorhandler(500)
 def internal_error(error):
     """Handle 500 errors."""
+    import traceback
+    error_details = traceback.format_exc()
+    
+    # Log the error
     import logging
     logger = logging.getLogger('web_interface')
-    logger.error("Internal server error", exc_info=True)
+    logger.error(f"Internal server error: {error}", exc_info=True)
+    
+    # Return user-friendly error (hide internal details in production)
     return jsonify({
         'status': 'error',
         'error_code': 'INTERNAL_ERROR',
-        'message': 'An internal error occurred; see logs for details',
+        'message': 'An internal error occurred',
+        'details': error_details if app.debug else None
     }), 500
 
 @app.errorhandler(Exception)
 def handle_exception(error):
     """Handle all unhandled exceptions."""
+    import traceback
     import logging
     logger = logging.getLogger('web_interface')
-    logger.error("Unhandled exception", exc_info=True)
+    logger.error(f"Unhandled exception: {error}", exc_info=True)
+    
     return jsonify({
         'status': 'error',
         'error_code': 'UNKNOWN_ERROR',
-        'message': 'An error occurred; see logs for details',
+        'message': str(error) if app.debug else 'An error occurred',
+        'details': traceback.format_exc() if app.debug else None
     }), 500
 
 # Captive portal redirect middleware
@@ -415,53 +435,13 @@ def add_security_headers(response):
     
     return response
 
-class _StreamBroadcaster:
-    """Fan-out broadcaster: one background generator thread pushes to all SSE clients.
-
-    This means N browser tabs share one generator instead of each running their own,
-    keeping PIL encodes / subprocess forks constant regardless of how many tabs are open.
-    """
-
-    def __init__(self, generator_factory):
-        self._generator_factory = generator_factory
-        self._clients: set = set()
-        self._lock = threading.Lock()
-        self._thread: threading.Thread | None = None
-
-    def subscribe(self) -> queue.Queue:
-        q: queue.Queue = queue.Queue(maxsize=5)
-        with self._lock:
-            self._clients.add(q)
-            if not (self._thread and self._thread.is_alive()):
-                self._thread = threading.Thread(target=self._broadcast, daemon=True)
-                self._thread.start()
-        return q
-
-    def unsubscribe(self, q: queue.Queue) -> None:
-        with self._lock:
-            self._clients.discard(q)
-
-    def _broadcast(self):
-        for data in self._generator_factory():
-            with self._lock:
-                if not self._clients:
-                    # No subscribers — exit so the thread doesn't spin indefinitely.
-                    # subscribe() will restart it when a new client arrives.
-                    break
-                for q in self._clients:
-                    try:
-                        q.put_nowait(data)
-                    except queue.Full:
-                        # Client is reading too slowly; drop the oldest item and
-                        # deliver the latest so the queue never stalls the client.
-                        try:
-                            q.get_nowait()
-                        except queue.Empty:
-                            pass
-                        try:
-                            q.put_nowait(data)
-                        except queue.Full:
-                            pass
+# SSE helper function
+def sse_response(generator_func):
+    """Helper to create SSE responses"""
+    def generate():
+        for data in generator_func():
+            yield f"data: {json.dumps(data)}\n\n"
+    return Response(generate(), mimetype='text/event-stream')
 
 # System status generator for SSE
 def system_status_generator():
@@ -512,8 +492,7 @@ def system_status_generator():
             }
             yield status
         except Exception as e:
-            app.logger.error("SSE generator error", exc_info=True)
-            yield {'error': 'An error occurred; see server logs'}
+            yield {'error': str(e)}
         time.sleep(10)  # Update every 10 seconds (reduced frequency for better performance)
 
 # Display preview generator for SSE
@@ -576,8 +555,7 @@ def display_preview_generator():
                 }
                 
         except Exception as e:
-            app.logger.error("SSE generator error", exc_info=True)
-            yield {'error': 'An error occurred; see server logs'}
+            yield {'error': str(e)}
         
         time.sleep(1.0)  # Check once per second — halves PIL encode overhead vs 0.5s
 
@@ -620,68 +598,36 @@ def logs_generator():
             except subprocess.TimeoutExpired:
                 # Timeout - just skip this update
                 pass
-            except Exception:
-                app.logger.error("Error running journalctl", exc_info=True)
+            except Exception as e:
                 error_data = {
                     'timestamp': time.time(),
-                    'logs': 'Error running journalctl; see server logs'
+                    'logs': f'Error running journalctl: {str(e)}'
                 }
                 yield error_data
 
-        except Exception:
-            app.logger.error("Unexpected error in logs generator", exc_info=True)
+        except Exception as e:
             error_data = {
                 'timestamp': time.time(),
-                'logs': 'Unexpected error in logs generator; see server logs'
+                'logs': f'Unexpected error in logs generator: {str(e)}'
             }
             yield error_data
 
         time.sleep(5)  # Update every 5 seconds (reduced frequency for better performance)
 
-# One broadcaster per stream — shared across all SSE clients
-_stats_broadcaster = _StreamBroadcaster(system_status_generator)
-_display_broadcaster = _StreamBroadcaster(display_preview_generator)
-_logs_broadcaster = _StreamBroadcaster(logs_generator)
-
-
-def _sse_stream(broadcaster: _StreamBroadcaster) -> Response:
-    """Return a streaming SSE response backed by a shared broadcaster."""
-    q = broadcaster.subscribe()
-
-    def generate():
-        try:
-            while True:
-                try:
-                    data = q.get(timeout=30)
-                    yield f"data: {json.dumps(data)}\n\n"
-                except queue.Empty:
-                    # Send an SSE comment heartbeat to keep the connection alive
-                    # through proxies that close idle connections.
-                    yield ": heartbeat\n\n"
-        except GeneratorExit:
-            pass
-        finally:
-            broadcaster.unsubscribe(q)
-
-    return Response(generate(), mimetype='text/event-stream')
-
-
 # SSE endpoints
 @app.route('/api/v3/stream/stats')
 def stream_stats():
-    return _sse_stream(_stats_broadcaster)
+    return sse_response(system_status_generator)
 
 @app.route('/api/v3/stream/display')
 def stream_display():
-    return _sse_stream(_display_broadcaster)
+    return sse_response(display_preview_generator)
 
 @app.route('/api/v3/stream/logs')
 def stream_logs():
-    return _sse_stream(_logs_broadcaster)
+    return sse_response(logs_generator)
 
-# Exempt SSE streams from CSRF and apply a generous rate limit.
-# SSE connections are long-lived HTTP requests, not repeated API calls, so the
-# tight "20 per minute" default would be exhausted quickly on reconnects.
+# Exempt SSE streams from CSRF and add rate limiting
 if csrf:
     csrf.exempt(stream_stats)
     csrf.exempt(stream_display)
@@ -689,9 +635,9 @@ if csrf:
     # Note: api_v3 blueprint is exempted above after registration
 
 if limiter:
-    limiter.limit("200 per minute")(stream_stats)
-    limiter.limit("200 per minute")(stream_display)
-    limiter.limit("200 per minute")(stream_logs)
+    limiter.limit("20 per minute")(stream_stats)
+    limiter.limit("20 per minute")(stream_display)
+    limiter.limit("20 per minute")(stream_logs)
 
 # Main route - redirect to v3 interface as default
 @app.route('/')

web_interface/blueprints/pages_v3.py

@@ -2,8 +2,6 @@ from flask import Blueprint, render_template, flash
 from markupsafe import escape
 import json
 import logging
-import os
-import re
 from pathlib import Path
 from src.web_interface.secret_helpers import mask_secret_fields
 
@@ -86,11 +84,10 @@ def load_partial(partial_name):
         elif partial_name == 'operation-history':
             return _load_operation_history_partial()
         else:
-            return "Partial not found", 404
+            return f"Partial '{partial_name}' not found", 404
 
     except Exception as e:
-        logger.error("Error loading partial %s", partial_name, exc_info=True)
-        return "Error loading partial", 500
+        return f"Error loading partial '{partial_name}': {str(e)}", 500
 
 
 @pages_v3.route('/partials/plugin-config/<plugin_id>')
@@ -98,9 +95,8 @@ def load_plugin_config_partial(plugin_id):
     """Load plugin configuration partial via HTMX - server-side rendered form"""
     try:
         return _load_plugin_config_partial(plugin_id)
-    except Exception:
-        logger.error("Error loading plugin config partial for %s", plugin_id, exc_info=True)
-        return '<div class="text-red-500 p-4">Error loading plugin config; see logs for details</div>', 500
+    except Exception as e:
+        return f'<div class="text-red-500 p-4">Error loading plugin config: {escape(str(e))}</div>', 500
 
 def _load_overview_partial():
     """Load overview partial with system stats"""
@@ -111,8 +107,7 @@ def _load_overview_partial():
             return render_template('v3/partials/overview.html',
                                  main_config=main_config)
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 def _load_general_partial():
     """Load general settings partial"""
@@ -122,8 +117,7 @@ def _load_general_partial():
             return render_template('v3/partials/general.html',
                                  main_config=main_config)
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 def _load_display_partial():
     """Load display settings partial"""
@@ -133,8 +127,7 @@ def _load_display_partial():
             return render_template('v3/partials/display.html',
                                  main_config=main_config)
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 def _load_durations_partial():
     """Load display durations partial"""
@@ -144,8 +137,7 @@ def _load_durations_partial():
             return render_template('v3/partials/durations.html',
                                  main_config=main_config)
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 def _load_schedule_partial():
     """Load schedule settings partial"""
@@ -161,8 +153,7 @@ def _load_schedule_partial():
                                  dim_schedule_config=dim_schedule_config,
                                  normal_brightness=normal_brightness)
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 
 def _load_weather_partial():
@@ -173,8 +164,7 @@ def _load_weather_partial():
             return render_template('v3/partials/weather.html',
                                  main_config=main_config)
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 def _load_stocks_partial():
     """Load stocks configuration partial"""
@@ -184,8 +174,7 @@ def _load_stocks_partial():
             return render_template('v3/partials/stocks.html',
                                  main_config=main_config)
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 def _load_plugins_partial():
     """Load plugins management partial"""
@@ -219,7 +208,7 @@ def _load_plugins_partial():
                             plugin_info.update(fresh_manifest)
                         except Exception as e:
                             # If we can't read the fresh manifest, use the cached one
-                            logger.warning("Could not read fresh manifest for plugin: %s", plugin_id)
+                            print(f"Warning: Could not read fresh manifest for {plugin_id}: {e}")
 
                     # Get enabled status from config (source of truth)
                     # Read from config file first, fall back to plugin instance if config doesn't have the key
@@ -267,13 +256,12 @@ def _load_plugins_partial():
                         'branch': branch
                     })
             except Exception as e:
-                logger.error("Error loading plugin data", exc_info=True)
+                print(f"Error loading plugin data: {e}")
 
         return render_template('v3/partials/plugins.html',
                              plugins=plugins_data)
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 def _load_fonts_partial():
     """Load fonts management partial"""
@@ -283,16 +271,14 @@ def _load_fonts_partial():
         return render_template('v3/partials/fonts.html',
                              fonts=fonts_data)
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 def _load_logs_partial():
     """Load logs viewer partial"""
     try:
         return render_template('v3/partials/logs.html')
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 def _load_raw_json_partial():
     """Load raw JSON editor partial"""
@@ -309,16 +295,14 @@ def _load_raw_json_partial():
                                  main_config_path=pages_v3.config_manager.get_config_path(),
                                  secrets_config_path=pages_v3.config_manager.get_secrets_path())
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 def _load_backup_restore_partial():
     """Load backup & restore partial."""
     try:
         return render_template('v3/partials/backup_restore.html')
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 @pages_v3.route('/setup')
 def captive_setup():
@@ -330,24 +314,21 @@ def _load_wifi_partial():
     try:
         return render_template('v3/partials/wifi.html')
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 def _load_cache_partial():
     """Load cache management partial"""
     try:
         return render_template('v3/partials/cache.html')
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 def _load_operation_history_partial():
     """Load operation history partial"""
     try:
         return render_template('v3/partials/operation_history.html')
     except Exception as e:
-        logger.error("Error loading partial", exc_info=True)
-        return "Error loading partial", 500
+        return f"Error: {str(e)}", 500
 
 
 def _load_plugin_config_partial(plugin_id):
@@ -355,11 +336,6 @@ def _load_plugin_config_partial(plugin_id):
     Load plugin configuration partial - server-side rendered form.
     This replaces the client-side generateConfigForm() JavaScript.
     """
-    # Sanitize with basename (CodeQL-recognized sanitizer) then regex-validate format
-    plugin_id = os.path.basename(plugin_id or '')
-    if not re.match(r'^[a-zA-Z0-9][a-zA-Z0-9._\-:]*$', plugin_id):
-        return '<div class="text-red-500 p-4">Invalid plugin ID</div>', 400
-
     try:
         if not pages_v3.plugin_manager:
             return '<div class="text-red-500 p-4">Plugin manager not available</div>', 500
@@ -368,14 +344,6 @@ def _load_plugin_config_partial(plugin_id):
         if plugin_id.startswith('starlark:'):
             return _load_starlark_config_partial(plugin_id[len('starlark:'):])
 
-        # Resolve and validate all plugin paths against the plugins base directory
-        _plugins_base = Path(pages_v3.plugin_manager.plugins_dir).resolve()
-        _plugin_dir = (_plugins_base / plugin_id).resolve()
-        try:
-            _plugin_dir.relative_to(_plugins_base)
-        except ValueError:
-            return '<div class="text-red-500 p-4">Invalid plugin ID</div>', 400
-
         # Try to get plugin info first
         plugin_info = pages_v3.plugin_manager.get_plugin_info(plugin_id)
         
@@ -385,7 +353,7 @@ def _load_plugin_config_partial(plugin_id):
             plugin_info = pages_v3.plugin_manager.get_plugin_info(plugin_id)
         
         if not plugin_info:
-            return '<div class="text-red-500 p-4">Plugin not found</div>', 404
+            return f'<div class="text-red-500 p-4">Plugin "{escape(plugin_id)}" not found</div>', 404
         
         # Get plugin instance (may be None if not loaded)
         plugin_instance = pages_v3.plugin_manager.get_plugin(plugin_id)
@@ -397,56 +365,59 @@ def _load_plugin_config_partial(plugin_id):
             config = full_config.get(plugin_id, {})
         
         # Load uploaded images from metadata file if images field exists in schema
-        schema_path_temp = _plugin_dir / "config_schema.json"
+        # This ensures uploaded images appear even if config hasn't been saved yet
+        schema_path_temp = Path(pages_v3.plugin_manager.plugins_dir) / plugin_id / "config_schema.json"
         if schema_path_temp.exists():
             try:
                 with open(schema_path_temp, 'r', encoding='utf-8') as f:
                     temp_schema = json.load(f)
+                    # Check if schema has an images field with x-widget: file-upload
                     if (temp_schema.get('properties', {}).get('images', {}).get('x-widget') == 'file-upload' or
                         temp_schema.get('properties', {}).get('images', {}).get('x_widget') == 'file-upload'):
-                        _assets_base = (Path(__file__).parent.parent.parent / 'assets' / 'plugins').resolve()
-                        metadata_file = (_assets_base / plugin_id / 'uploads' / '.metadata.json').resolve()
-                        try:
-                            metadata_file.relative_to(_assets_base)
-                        except ValueError:
-                            metadata_file = None
-                        if metadata_file and metadata_file.exists():
+                        # Load metadata file
+                        # Get PROJECT_ROOT relative to this file
+                        project_root = Path(__file__).parent.parent.parent
+                        metadata_file = project_root / 'assets' / 'plugins' / plugin_id / 'uploads' / '.metadata.json'
+                        if metadata_file.exists():
                             try:
                                 with open(metadata_file, 'r', encoding='utf-8') as mf:
                                     metadata = json.load(mf)
+                                    # Convert metadata dict to list of image objects
                                     images_from_metadata = list(metadata.values())
+                                    # Only use metadata images if config doesn't have images or config images is empty
                                     if not config.get('images') or len(config.get('images', [])) == 0:
                                         config['images'] = images_from_metadata
                                     else:
+                                        # Merge: add metadata images that aren't already in config
                                         config_image_ids = {img.get('id') for img in config.get('images', []) if img.get('id')}
                                         new_images = [img for img in images_from_metadata if img.get('id') not in config_image_ids]
                                         if new_images:
                                             config['images'] = config.get('images', []) + new_images
                             except Exception as e:
-                                logger.warning("Could not load plugin upload metadata: %s", e)
+                                print(f"Warning: Could not load metadata for {plugin_id}: {e}")
             except Exception as e:  # nosec B110 - metadata pre-load is optional; schema loads fully below
                 logger.debug("Metadata pre-load skipped for plugin %s: %s", plugin_id, e)
         
         # Get plugin schema
         schema = {}
-        schema_path = _plugin_dir / "config_schema.json"
+        schema_path = Path(pages_v3.plugin_manager.plugins_dir) / plugin_id / "config_schema.json"
         if schema_path.exists():
             try:
                 with open(schema_path, 'r', encoding='utf-8') as f:
                     schema = json.load(f)
             except Exception as e:
-                logger.warning("Could not load schema for plugin: %s", e)
+                print(f"Warning: Could not load schema for {plugin_id}: {e}")
         
         # Get web UI actions from plugin manifest
         web_ui_actions = []
-        manifest_path = _plugin_dir / "manifest.json"
+        manifest_path = Path(pages_v3.plugin_manager.plugins_dir) / plugin_id / "manifest.json"
         if manifest_path.exists():
             try:
                 with open(manifest_path, 'r', encoding='utf-8') as f:
                     manifest = json.load(f)
                     web_ui_actions = manifest.get('web_ui_actions', [])
             except Exception as e:
-                logger.warning("Could not load manifest for plugin: %s", e)
+                print(f"Warning: Could not load manifest for {plugin_id}: {e}")
         
         # Mask secret fields before rendering template (fail closed — never leak secrets)
         schema_properties = schema.get('properties') if isinstance(schema, dict) else None
@@ -482,24 +453,20 @@ def _load_plugin_config_partial(plugin_id):
         )
         
     except Exception as e:
-        logger.error("Error loading plugin config partial for %s", plugin_id, exc_info=True)
-        return '<div class="text-red-500 p-4">Error loading plugin config; see logs for details</div>', 500
+        import traceback
+        traceback.print_exc()
+        return f'<div class="text-red-500 p-4">Error loading plugin config: {escape(str(e))}</div>', 500
 
 
 def _load_starlark_config_partial(app_id):
     """Load configuration partial for a Starlark app."""
-    # Sanitize with basename (CodeQL-recognized sanitizer) then regex-validate format
-    app_id = os.path.basename(app_id or '')
-    if not re.match(r'^[a-zA-Z0-9][a-zA-Z0-9_\-]*$', app_id):
-        return '<div class="text-red-500 p-4">Invalid app ID</div>', 400
-
     try:
         starlark_plugin = pages_v3.plugin_manager.get_plugin('starlark-apps') if pages_v3.plugin_manager else None
 
         if starlark_plugin and hasattr(starlark_plugin, 'apps'):
             app = starlark_plugin.apps.get(app_id)
             if not app:
-                return '<div class="text-red-500 p-4">Starlark app not found</div>', 404
+                return f'<div class="text-red-500 p-4">Starlark app not found: {app_id}</div>', 404
             return render_template(
                 'v3/partials/starlark_config.html',
                 app_id=app_id,
@@ -515,45 +482,36 @@ def _load_starlark_config_partial(app_id):
             )
 
         # Standalone: read from manifest file
-        starlark_base = (Path(__file__).resolve().parent.parent.parent / 'starlark-apps').resolve()
-        manifest_file = starlark_base / 'manifest.json'
+        manifest_file = Path(__file__).resolve().parent.parent.parent / 'starlark-apps' / 'manifest.json'
         if not manifest_file.exists():
-            return '<div class="text-red-500 p-4">Starlark app not found</div>', 404
+            return f'<div class="text-red-500 p-4">Starlark app not found: {app_id}</div>', 404
 
         with open(manifest_file, 'r') as f:
             manifest = json.load(f)
 
         app_data = manifest.get('apps', {}).get(app_id)
         if not app_data:
-            return '<div class="text-red-500 p-4">Starlark app not found</div>', 404
+            return f'<div class="text-red-500 p-4">Starlark app not found: {app_id}</div>', 404
 
-        # Load schema from schema.json if it exists — validate path stays within starlark_base
+        # Load schema from schema.json if it exists
         schema = None
-        schema_file = (starlark_base / app_id / 'schema.json').resolve()
-        try:
-            schema_file.relative_to(starlark_base)
-        except ValueError:
-            schema_file = None
-        if schema_file and schema_file.exists():
+        schema_file = Path(__file__).resolve().parent.parent.parent / 'starlark-apps' / app_id / 'schema.json'
+        if schema_file.exists():
             try:
                 with open(schema_file, 'r') as f:
                     schema = json.load(f)
             except (OSError, json.JSONDecodeError) as e:
-                logger.warning("Could not load starlark schema for app: %s", e)
+                logger.warning(f"[Pages V3] Could not load schema for {app_id}: {e}", exc_info=True)
 
-        # Load config from config.json if it exists — validate path stays within starlark_base
+        # Load config from config.json if it exists
         config = {}
-        config_file = (starlark_base / app_id / 'config.json').resolve()
-        try:
-            config_file.relative_to(starlark_base)
-        except ValueError:
-            config_file = None
-        if config_file and config_file.exists():
+        config_file = Path(__file__).resolve().parent.parent.parent / 'starlark-apps' / app_id / 'config.json'
+        if config_file.exists():
             try:
                 with open(config_file, 'r') as f:
                     config = json.load(f)
             except (OSError, json.JSONDecodeError) as e:
-                logger.warning("Could not load starlark config for app: %s", e)
+                logger.warning(f"[Pages V3] Could not load config for {app_id}: {e}", exc_info=True)
 
         return render_template(
             'v3/partials/starlark_config.html',
@@ -570,5 +528,5 @@ def _load_starlark_config_partial(app_id):
         )
 
     except Exception as e:
-        logger.error("[Pages V3] Error loading starlark config for app", exc_info=True)
-        return '<div class="text-red-500 p-4">Error loading starlark config; see logs for details</div>', 500
+        logger.exception(f"[Pages V3] Error loading starlark config for {app_id}")
+        return f'<div class="text-red-500 p-4">Error loading starlark config: {str(e)}</div>', 500

web_interface/static/v3/app.js

@@ -1,4 +1,4 @@
-/* global showNotification, updateSystemStats, updateDisplayPreview, htmx */
+/* global showNotification, updateSystemStats, htmx */
 // LED Matrix v3 JavaScript
 // Additional helpers for HTMX and Alpine.js integration
 
@@ -51,8 +51,7 @@ document.body.addEventListener('htmx:afterRequest', function(event) {
     }
 });
 
-// SSE reconnection helper — closes and reopens both SSE streams,
-// reattaching the open/error handlers defined in base.html.
+// SSE reconnection helper
 window.reconnectSSE = function() {
     if (window.statsSource) {
         window.statsSource.close();
@@ -61,18 +60,14 @@ window.reconnectSSE = function() {
             const data = JSON.parse(event.data);
             if (typeof updateSystemStats === 'function') updateSystemStats(data);
         };
-        if (window._statsOpenHandler) window.statsSource.addEventListener('open', window._statsOpenHandler);
-        if (window._statsErrorHandler) window.statsSource.addEventListener('error', window._statsErrorHandler);
     }
 
     if (window.displaySource) {
         window.displaySource.close();
         window.displaySource = new EventSource('/api/v3/stream/display');
-        window.displaySource.onmessage = function(event) {
-            const data = JSON.parse(event.data);
-            if (typeof updateDisplayPreview === 'function') updateDisplayPreview(data);
+        window.displaySource.onmessage = function() {
+            // Handle display updates
         };
-        if (window._displayErrorHandler) window.displaySource.addEventListener('error', window._displayErrorHandler);
     }
 };
 

web_interface/static/v3/js/widgets/base-widget.js

@@ -51,10 +51,8 @@
         sanitizeValue(value) {
             // Base implementation - widgets should override for specific needs
             if (typeof value === 'string') {
-                // Strip all HTML tags via the DOM parser to prevent XSS
-                const div = document.createElement('div');
-                div.textContent = value;
-                return div.textContent;
+                // Basic XSS prevention
+                return value.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
             }
             return value;
         }

web_interface/static/v3/plugins_manager.js

@@ -1442,14 +1442,9 @@ function renderInstalledPlugins(plugins) {
         return;
     }
 
-    // Helper function to escape values for use in HTML attributes
+    // Helper function to escape attributes for use in HTML
     const escapeAttr = (text) => {
-        return (text || '')
-            .replace(/&/g, '&')
-            .replace(/"/g, '"')
-            .replace(/'/g, ''')
-            .replace(/</g, '&lt;')
-            .replace(/>/g, '&gt;');
+        return (text || '').replace(/'/g, "\\'").replace(/"/g, '&quot;');
     };
 
     // Helper function to escape for JavaScript strings (use JSON.stringify for proper escaping)
@@ -4512,8 +4507,6 @@ function syncFormToJson() {
     // Deep merge with existing config to preserve nested structures
     function deepMerge(target, source) {
         for (const key in source) {
-            if (key === '__proto__' || key === 'constructor' || key === 'prototype') continue;
-            if (!Object.prototype.hasOwnProperty.call(source, key)) continue;
             if (source[key] && typeof source[key] === 'object' && !Array.isArray(source[key])) {
                 if (!target[key] || typeof target[key] !== 'object' || Array.isArray(target[key])) {
                     target[key] = {};
@@ -7480,28 +7473,17 @@ setTimeout(function() {
         console.log('installed-plugins-grid not found yet, will retry via event listeners');
     }
 
-    // Also try to attach install button handler after a delay (fallback).
-    // Only run if the install button element is already in the DOM (i.e. the
-    // plugins partial has been loaded); otherwise the htmx:afterSettle listener
-    // below handles it when the tab is first visited.
+    // Also try to attach install button handler after a delay (fallback)
     setTimeout(() => {
-        if (typeof window.attachInstallButtonHandler === 'function' &&
-            document.getElementById('install-plugin-from-url')) {
+        if (typeof window.attachInstallButtonHandler === 'function') {
+            console.log('[FALLBACK] Attempting to attach install button handler...');
             window.attachInstallButtonHandler();
+        } else {
+            console.warn('[FALLBACK] attachInstallButtonHandler not available on window');
         }
     }, 500);
 }, 200);
 
-// Re-run install button wiring after HTMX settles the plugins tab content.
-// Guard with element check so it only fires when the plugins partial is in the DOM,
-// preventing spurious warnings on other tab loads.
-document.addEventListener('htmx:afterSettle', function() {
-    if (document.getElementById('install-plugin-from-url') &&
-        typeof window.attachInstallButtonHandler === 'function') {
-        window.attachInstallButtonHandler();
-    }
-});
-
 // ─── Starlark Apps Integration ──────────────────────────────────────────────
 
 (function() {

web_interface/templates/v3/base.html

@@ -136,7 +136,6 @@
                                 setTimeout(function() {
                                     if (typeof htmx !== 'undefined') {
                                         console.log('HTMX loaded from fallback');
-                                        window.dispatchEvent(new Event('htmx:ready'));
                                         // Load extensions after core loads
                                         loadScript(sseSrc, isAPMode ? 'https://unpkg.com/htmx.org/dist/ext/sse.js' : '/static/v3/js/htmx-sse.js');
                                         loadScript(jsonEncSrc, isAPMode ? 'https://unpkg.com/htmx.org/dist/ext/json-enc.js' : '/static/v3/js/htmx-json-enc.js');
@@ -153,7 +152,6 @@
                         }
                     } else {
                         console.log('HTMX loaded successfully');
-                        window.dispatchEvent(new Event('htmx:ready'));
                         // Load extensions after core loads
                         loadScript(sseSrc, isAPMode ? 'https://unpkg.com/htmx.org/dist/ext/sse.js' : '/static/v3/js/htmx-sse.js');
                         loadScript(jsonEncSrc, isAPMode ? 'https://unpkg.com/htmx.org/dist/ext/json-enc.js' : '/static/v3/js/htmx-json-enc.js');
@@ -351,20 +349,6 @@
                             }
                         }
                     });
-
-                    // Set data-loaded on tab containers after HTMX settles their content,
-                    // preventing repeated re-fetches on every tab switch.
-                    // Scoped to elements with hx-trigger="revealed" (tab containers only) so
-                    // modals and plugin config panels that legitimately reload are unaffected.
-                    document.body.addEventListener('htmx:afterSettle', function(event) {
-                        if (event.detail && event.detail.target) {
-                            var target = event.detail.target;
-                            var trigger = target.getAttribute('hx-trigger') || '';
-                            if (trigger.includes('revealed')) {
-                                target.setAttribute('data-loaded', 'true');
-                            }
-                        }
-                    });
                 } else {
                     if (document.readyState === 'loading') {
                         document.addEventListener('DOMContentLoaded', setupScriptExecution);
@@ -427,9 +411,6 @@
                     .then(html => {
                         clearTimeout(timeout);
                         content.innerHTML = html;
-                        if (typeof htmx !== 'undefined') {
-                            htmx.process(content);
-                        }
                         // Trigger full initialization chain
                         if (window.pluginManager) {
                             window.pluginManager.initialized = false;
@@ -449,7 +430,7 @@
         }
 
         // Fallback if HTMX doesn't load within 5 seconds
-        var _pluginsFallbackTimer = setTimeout(() => {
+        setTimeout(() => {
             if (typeof htmx === 'undefined') {
                 console.warn('HTMX not loaded after 5 seconds, using direct fetch for plugins');
                 // Load plugins tab content directly regardless of active tab,
@@ -457,7 +438,6 @@
                 loadPluginsDirect();
             }
         }, 5000);
-        window.addEventListener('htmx:ready', function() { clearTimeout(_pluginsFallbackTimer); }, { once: true });
     </script>
     <!-- Alpine.js app function - defined early so it's available when Alpine initializes -->
     <script>
@@ -1050,9 +1030,6 @@
                             .then(html => {
                                 overviewContent.innerHTML = html;
                                 overviewContent.setAttribute('data-loaded', 'true');
-                                if (typeof htmx !== 'undefined') {
-                                    htmx.process(overviewContent);
-                                }
                                 // Re-initialize Alpine.js for the new content
                                 if (window.Alpine) {
                                     window.Alpine.initTree(overviewContent);
@@ -1081,7 +1058,7 @@
                 });
                 
                 // Also try direct load if HTMX doesn't load within 5 seconds
-                var _overviewFallbackTimer = setTimeout(() => {
+                setTimeout(() => {
                     if (typeof htmx === 'undefined') {
                         console.warn('HTMX not loaded after 5 seconds, using direct fetch for content');
                         const appElement = document.querySelector('[x-data="app()"]');
@@ -1093,7 +1070,6 @@
                         }
                     }
                 }, 5000);
-                window.addEventListener('htmx:ready', function() { clearTimeout(_overviewFallbackTimer); }, { once: true });
             </script>
 
             <!-- General tab -->
@@ -1370,64 +1346,34 @@
 
     <!-- SSE connection for real-time updates -->
     <script>
-        // Assign to window so reconnectSSE() in app.js can reach them.
-        window.statsSource = new EventSource('/api/v3/stream/stats');
-        window.displaySource = new EventSource('/api/v3/stream/display');
+        // Connect to SSE streams
+        const statsSource = new EventSource('/api/v3/stream/stats');
+        const displaySource = new EventSource('/api/v3/stream/display');
 
-        window.statsSource.onmessage = function(event) {
+        statsSource.onmessage = function(event) {
             const data = JSON.parse(event.data);
             updateSystemStats(data);
         };
 
-        window.displaySource.onmessage = function(event) {
+        displaySource.onmessage = function(event) {
             const data = JSON.parse(event.data);
             updateDisplayPreview(data);
         };
 
-        function _setConnectionStatus(connected, reconnecting) {
-            const el = document.getElementById('connection-status');
-            if (!el) return;
-            if (connected) {
-                el.innerHTML = `
+        // Connection status
+        statsSource.addEventListener('open', function() {
+            document.getElementById('connection-status').innerHTML = `
                 <div class="w-2 h-2 bg-green-500 rounded-full"></div>
                 <span class="text-gray-600">Connected</span>
             `;
-            } else if (reconnecting) {
-                el.innerHTML = `
-                    <div class="w-2 h-2 bg-yellow-500 rounded-full animate-pulse"></div>
-                    <span class="text-gray-600">Reconnecting…</span>
-                `;
-            } else {
-                el.innerHTML = `
+        });
+
+        statsSource.addEventListener('error', function() {
+            document.getElementById('connection-status').innerHTML = `
                 <div class="w-2 h-2 bg-red-500 rounded-full"></div>
-                    <span class="text-gray-600" title="Connection lost — try refreshing the page">Disconnected</span>
+                <span class="text-gray-600">Disconnected</span>
             `;
-            }
-        }
-
-        var _statsErrorCount = 0;
-
-        // Named on window so reconnectSSE() in app.js can reattach them after
-        // replacing the EventSource instances.
-        window._statsOpenHandler = function() {
-            _statsErrorCount = 0;
-            _setConnectionStatus(true, false);
-        };
-        window._statsErrorHandler = function() {
-            _statsErrorCount++;
-            // EventSource readyState 0 = CONNECTING (auto-retrying), 2 = CLOSED
-            var reconnecting = window.statsSource.readyState === EventSource.CONNECTING;
-            _setConnectionStatus(false, reconnecting && _statsErrorCount <= 3);
-        };
-        window._displayErrorHandler = function() {
-            // Display stream errors don't change the status badge but log to console
-            // so failures aren't completely silent.
-            console.warn('LEDMatrix: display preview stream error (readyState=' + window.displaySource.readyState + ')');
-        };
-
-        window.statsSource.addEventListener('open', window._statsOpenHandler);
-        window.statsSource.addEventListener('error', window._statsErrorHandler);
-        window.displaySource.addEventListener('error', window._displayErrorHandler);
+        });
 
         function updateSystemStats(data) {
             // Update CPU in header
@@ -1870,18 +1816,13 @@
                             htmx.trigger(contentEl, 'revealed');
                         }
                     } else {
-                        // HTMX is still loading asynchronously — retry when it signals ready,
-                        // or fall back to direct fetch if it fails to load entirely.
-                        const self = this;
-                        function onReady() { window.removeEventListener('htmx-load-failed', onFailed); self.loadTabContent(tab); }
-                        function onFailed() {
-                            window.removeEventListener('htmx:ready', onReady);
-                            if (tab === 'overview' && typeof loadOverviewDirect === 'function') loadOverviewDirect();
-                            else if (tab === 'wifi' && typeof loadWifiDirect === 'function') loadWifiDirect();
-                            else if (tab === 'plugins' && typeof loadPluginsDirect === 'function') loadPluginsDirect();
+                        // HTMX not available, use direct fetch
+                        console.warn('HTMX not available, using direct fetch for tab:', tab);
+                        if (tab === 'overview' && typeof loadOverviewDirect === 'function') {
+                            loadOverviewDirect();
+                        } else if (tab === 'wifi' && typeof loadWifiDirect === 'function') {
+                            loadWifiDirect();
                         }
-                        window.addEventListener('htmx:ready', onReady, { once: true });
-                        window.addEventListener('htmx-load-failed', onFailed, { once: true });
                     }
                 },
 

web_interface/templates/v3/index.html

@@ -73,7 +73,7 @@
             <button hx-post="/api/v3/system/action"
                     hx-vals='{"action": "start_display"}'
                     hx-swap="none"
-                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined') { var m='Display started',s='success'; try { var d=JSON.parse(event.detail.xhr.responseText); m=d.message||m; s=d.status||s; } catch(e) { s=(event.detail.xhr&&event.detail.xhr.status>=400?'error':s); } showNotification(m,s); }"
+                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined' && event.detail.xhr && event.detail.xhr.responseJSON) { showNotification(event.detail.xhr.responseJSON.message || 'Display started', event.detail.xhr.responseJSON.status || 'success'); }"
                     class="inline-flex items-center px-4 py-2 border border-transparent text-sm font-medium rounded-md text-white bg-green-600 hover:bg-green-700">
                 <i class="fas fa-play mr-2"></i>
                 Start Display
@@ -82,7 +82,7 @@
             <button hx-post="/api/v3/system/action"
                     hx-vals='{"action": "stop_display"}'
                     hx-swap="none"
-                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined') { var m='Display stopped',s='success'; try { var d=JSON.parse(event.detail.xhr.responseText); m=d.message||m; s=d.status||s; } catch(e) { s=(event.detail.xhr&&event.detail.xhr.status>=400?'error':s); } showNotification(m,s); }"
+                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined' && event.detail.xhr && event.detail.xhr.responseJSON) { showNotification(event.detail.xhr.responseJSON.message || 'Display stopped', event.detail.xhr.responseJSON.status || 'success'); }"
                     class="inline-flex items-center px-4 py-2 border border-transparent text-sm font-medium rounded-md text-white bg-red-600 hover:bg-red-700">
                 <i class="fas fa-stop mr-2"></i>
                 Stop Display
@@ -91,7 +91,7 @@
             <button hx-post="/api/v3/system/action"
                     hx-vals='{"action": "git_pull"}'
                     hx-swap="none"
-                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined') { var m='Code update completed',s='info'; try { var d=JSON.parse(event.detail.xhr.responseText); m=d.message||m; s=d.status||s; } catch(e) { s=(event.detail.xhr&&event.detail.xhr.status>=400?'error':s); } showNotification(m,s); }"
+                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined' && event.detail.xhr && event.detail.xhr.responseJSON) { showNotification(event.detail.xhr.responseJSON.message || 'Code update completed', event.detail.xhr.responseJSON.status || 'info'); }"
                     class="inline-flex items-center px-4 py-2 border border-gray-300 text-sm font-medium rounded-md text-gray-700 bg-white hover:bg-gray-50">
                 <i class="fas fa-download mr-2"></i>
                 Update Code
@@ -101,7 +101,7 @@
                     hx-vals='{"action": "reboot_system"}'
                     hx-confirm="Are you sure you want to reboot the system?"
                     hx-swap="none"
-                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined') { var m='System rebooting...',s='info'; try { var d=JSON.parse(event.detail.xhr.responseText); m=d.message||m; s=d.status||s; } catch(e) { s=(event.detail.xhr&&event.detail.xhr.status>=400?'error':s); } showNotification(m,s); }"
+                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined' && event.detail.xhr && event.detail.xhr.responseJSON) { showNotification(event.detail.xhr.responseJSON.message || 'System rebooting...', event.detail.xhr.responseJSON.status || 'info'); }"
                     class="inline-flex items-center px-4 py-2 border border-transparent text-sm font-medium rounded-md text-white bg-yellow-600 hover:bg-yellow-700">
                 <i class="fas fa-power-off mr-2"></i>
                 Reboot System

web_interface/templates/v3/partials/overview.html

@@ -151,7 +151,7 @@
             <button hx-post="/api/v3/system/action"
                     hx-vals='{"action": "start_display"}'
                     hx-swap="none"
-                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined') { var m='Display started',s='success'; try { var d=JSON.parse(event.detail.xhr.responseText); m=d.message||m; s=d.status||s; } catch(e) { s=(event.detail.xhr&&event.detail.xhr.status>=400?'error':s); } showNotification(m,s); }"
+                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined' && event.detail.xhr && event.detail.xhr.responseJSON) { showNotification(event.detail.xhr.responseJSON.message || 'Display started', event.detail.xhr.responseJSON.status || 'success'); }"
                     class="inline-flex items-center px-4 py-2 border border-transparent text-base font-semibold rounded-md text-white bg-green-600 hover:bg-green-700">
                 <i class="fas fa-play mr-2"></i>
                 Start Display
@@ -160,7 +160,7 @@
             <button hx-post="/api/v3/system/action"
                     hx-vals='{"action": "stop_display"}'
                     hx-swap="none"
-                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined') { var m='Display stopped',s='success'; try { var d=JSON.parse(event.detail.xhr.responseText); m=d.message||m; s=d.status||s; } catch(e) { s=(event.detail.xhr&&event.detail.xhr.status>=400?'error':s); } showNotification(m,s); }"
+                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined' && event.detail.xhr && event.detail.xhr.responseJSON) { showNotification(event.detail.xhr.responseJSON.message || 'Display stopped', event.detail.xhr.responseJSON.status || 'success'); }"
                     class="inline-flex items-center px-4 py-2 border border-transparent text-base font-semibold rounded-md text-white bg-red-600 hover:bg-red-700">
                 <i class="fas fa-stop mr-2"></i>
                 Stop Display
@@ -170,7 +170,7 @@
                     hx-vals='{"action": "git_pull"}'
                     hx-confirm="This will stash any local changes and update the code. Continue?"
                     hx-swap="none"
-                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined') { var m='Code update completed',s='info'; try { var d=JSON.parse(event.detail.xhr.responseText); m=d.message||m; s=d.status||s; } catch(e) { s=(event.detail.xhr&&event.detail.xhr.status>=400?'error':s); } showNotification(m,s); }"
+                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined' && event.detail.xhr && event.detail.xhr.responseJSON) { showNotification(event.detail.xhr.responseJSON.message || 'Code update completed', event.detail.xhr.responseJSON.status || 'info'); }"
                     class="inline-flex items-center px-4 py-2 border border-gray-300 text-base font-semibold rounded-md text-gray-900 bg-white hover:bg-gray-50">
                 <i class="fas fa-download mr-2"></i>
                 Update Code
@@ -180,7 +180,7 @@
                     hx-vals='{"action": "reboot_system"}'
                     hx-confirm="Are you sure you want to reboot the system?"
                     hx-swap="none"
-                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined') { var m='System rebooting...',s='info'; try { var d=JSON.parse(event.detail.xhr.responseText); m=d.message||m; s=d.status||s; } catch(e) { s=(event.detail.xhr&&event.detail.xhr.status>=400?'error':s); } showNotification(m,s); }"
+                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined' && event.detail.xhr && event.detail.xhr.responseJSON) { showNotification(event.detail.xhr.responseJSON.message || 'System rebooting...', event.detail.xhr.responseJSON.status || 'info'); }"
                     class="inline-flex items-center px-4 py-2 border border-transparent text-base font-semibold rounded-md text-white bg-yellow-600 hover:bg-yellow-700">
                 <i class="fas fa-power-off mr-2"></i>
                 Reboot System
@@ -190,7 +190,7 @@
                     hx-vals='{"action": "shutdown_system"}'
                     hx-confirm="Are you sure you want to shut down the system? This will power off the Raspberry Pi."
                     hx-swap="none"
-                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined') { var m='System shutting down...',s='info'; try { var d=JSON.parse(event.detail.xhr.responseText); m=d.message||m; s=d.status||s; } catch(e) { s=(event.detail.xhr&&event.detail.xhr.status>=400?'error':s); } showNotification(m,s); }"
+                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined' && event.detail.xhr && event.detail.xhr.responseJSON) { showNotification(event.detail.xhr.responseJSON.message || 'System shutting down...', event.detail.xhr.responseJSON.status || 'info'); }"
                     class="inline-flex items-center px-4 py-2 border border-transparent text-base font-semibold rounded-md text-white bg-red-800 hover:bg-red-900">
                 <i class="fas fa-power-off mr-2"></i>
                 Shutdown System
@@ -199,7 +199,7 @@
             <button hx-post="/api/v3/system/action"
                     hx-vals='{"action": "restart_display_service"}'
                     hx-swap="none"
-                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined') { var m='Display service restarted',s='success'; try { var d=JSON.parse(event.detail.xhr.responseText); m=d.message||m; s=d.status||s; } catch(e) { s=(event.detail.xhr&&event.detail.xhr.status>=400?'error':s); } showNotification(m,s); }"
+                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined' && event.detail.xhr && event.detail.xhr.responseJSON) { showNotification(event.detail.xhr.responseJSON.message || 'Display service restarted', event.detail.xhr.responseJSON.status || 'success'); }"
                     class="inline-flex items-center px-4 py-2 border border-gray-300 text-base font-semibold rounded-md text-gray-900 bg-white hover:bg-gray-50">
                 <i class="fas fa-redo mr-2"></i>
                 Restart Display Service
@@ -208,7 +208,7 @@
             <button hx-post="/api/v3/system/action"
                     hx-vals='{"action": "restart_web_service"}'
                     hx-swap="none"
-                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined') { var m='Web service restarted',s='success'; try { var d=JSON.parse(event.detail.xhr.responseText); m=d.message||m; s=d.status||s; } catch(e) { s=(event.detail.xhr&&event.detail.xhr.status>=400?'error':s); } showNotification(m,s); }"
+                    hx-on:htmx:after-request="if (typeof showNotification !== 'undefined' && event.detail.xhr && event.detail.xhr.responseJSON) { showNotification(event.detail.xhr.responseJSON.message || 'Web service restarted', event.detail.xhr.responseJSON.status || 'success'); }"
                     class="inline-flex items-center px-4 py-2 border border-gray-300 text-base font-semibold rounded-md text-gray-900 bg-white hover:bg-gray-50">
                 <i class="fas fa-redo mr-2"></i>
                 Restart Web Service