chore: remove dead modules and unused dependencies (~1,180 LOC)

Deletions, each re-verified with a fresh repo-wide grep (core, web,
scripts, docs, plugin monorepo) immediately before removal:

Modules with zero live importers:
- src/background_cache_mixin.py + src/generic_cache_mixin.py (134+150
  LOC — referenced only by each other)
- src/font_test_manager.py (134 LOC)
- src/image_utils.py (22 LOC, self-documented deprecated)
- src/layout_manager.py (408 LOC — only its own test imported it) +
  test/test_layout_manager.py
- src/common/basketball_plugin_example.py (328 LOC sample)

requirements.txt entries with zero importers in core (pre-plugin-era
manager deps): icalevents, geopy, timezonefinder, unidecode. Plus the
google-auth trio (google-auth-oauthlib, google-auth-httplib2,
google-api-python-client): their only importer is the calendar PLUGIN,
which declares all three in its own requirements.txt (verified in the
monorepo and on an installed copy) — the plugin dependency installer
owns them. Existing venvs are unaffected (removal doesn't uninstall);
fresh installs get them when calendar is installed.

Two stale references cleaned (a comment in test_pillow_compat.py, a
directory listing in HOW_TO_RUN_TESTS.md). Full suite green except the
two documented pre-existing failures (circuit_breaker mock drift, fixed
in #400; clock-simple 64x32 overflow, pre-dates this series); all core
entry modules verified importing cleanly under the emulator.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqzC1nzTWL4kaqgMaQZFam

.github/workflows/claude-code-review.yml

@@ -0,0 +1,44 @@
+name: Claude Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+    # Optional: Only run on specific file changes
+    # paths:
+    #   - "src/**/*.ts"
+    #   - "src/**/*.tsx"
+    #   - "src/**/*.js"
+    #   - "src/**/*.jsx"
+
+jobs:
+  claude-review:
+    # Optional: Filter by PR author
+    # if: |
+    #   github.event.pull_request.user.login == 'external-contributor' ||
+    #   github.event.pull_request.user.login == 'new-developer' ||
+    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
+
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code Review
+        id: claude-review
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
+          plugins: 'code-review@claude-code-plugins'
+          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options
+

.github/workflows/claude.yml

@@ -0,0 +1,50 @@
+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+      actions: read # Required for Claude to read CI results on PRs
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+
+          # This is an optional setting that allows Claude to read CI results on PRs
+          additional_permissions: |
+            actions: read
+
+          # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
+          # prompt: 'Update the pull request description to include a summary of changes.'
+
+          # Optional: Add claude_args to customize behavior and configuration
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options
+          # claude_args: '--allowed-tools Bash(gh pr *)'
+

.github/workflows/security-audit.yml

@@ -0,0 +1,277 @@
+name: Security Audit
+
+on:
+  push:
+    branches:
+      - main
+      - 'feat/**'
+  pull_request:
+    branches:
+      - main
+  schedule:
+    # Weekly full scan — catches new CVEs in existing deps
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+  security-events: write
+
+jobs:
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # SAST — Static Application Security Testing
+  # ─────────────────────────────────────────────────────────────────────────
+  sast:
+    name: Static Analysis (bandit + semgrep)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install SAST tools
+        run: pip install bandit==1.8.3 semgrep
+
+      # Bandit — Python-specific security linter
+      # --exit-zero: findings are warnings, not CI blockers.
+      # The security-report job interprets severity.
+      - name: Run bandit
+        run: |
+          bandit -r src/ web_interface/ \
+            -c bandit.yaml \
+            -f json \
+            -o bandit-results.json \
+            --exit-zero
+
+      # Semgrep — broader pattern-based analysis
+      # || true: prevents network/rate-limit errors from blocking the workflow
+      - name: Run semgrep
+        run: |
+          semgrep --config "p/python" \
+            --config "p/flask" \
+            --json \
+            --output semgrep-results.json \
+            src/ web_interface/ \
+            || true
+
+      - name: Upload SAST artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: sast-results
+          path: |
+            bandit-results.json
+            semgrep-results.json
+          retention-days: 30
+
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Dependency Vulnerability Scanning
+  # ─────────────────────────────────────────────────────────────────────────
+  dependency-audit:
+    name: Dependency Audit (pip-audit + safety)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install audit tools
+        run: pip install pip-audit safety
+
+      # Install project deps. Hardware-specific packages (rgbmatrix) will fail
+      # to build on Ubuntu runners — || true handles this gracefully.
+      # pip-audit operates on installed packages; partial install is acceptable.
+      - name: Install project dependencies
+        run: |
+          pip install -r requirements.txt || true
+          pip install -r web_interface/requirements.txt || true
+          pip install -r requirements-emulator.txt || true
+
+      - name: Run pip-audit
+        run: |
+          pip-audit --format json --output pip-audit-results.json || true
+
+      - name: Run safety check
+        run: |
+          safety check --output json > safety-results.json 2>&1 || true
+
+      - name: Upload dependency audit artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: dependency-audit-results
+          path: |
+            pip-audit-results.json
+            safety-results.json
+          retention-days: 30
+
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Secrets Detection
+  # ─────────────────────────────────────────────────────────────────────────
+  secrets-scan:
+    name: Secrets Scan (gitleaks)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Full history for scanning all commits
+
+      # continue-on-error: config/config_secrets.template.json contains
+      # placeholder strings (YOUR_*) that may trigger gitleaks rules.
+      # The generate_report.py script suppresses these false positives.
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        continue-on-error: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload secrets scan artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: secrets-scan-results
+          path: results.sarif
+          retention-days: 30
+
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # LEDMatrix-Specific Security Proofs
+  # ─────────────────────────────────────────────────────────────────────────
+  ledmatrix-security-proofs:
+    name: LEDMatrix Security Proofs
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: pip install -r requirements.txt || true
+
+      # Script exits 1 only on CRITICAL findings.
+      # Warnings are reported but do not block the workflow.
+      - name: Run security proofs
+        run: |
+          python scripts/prove_security.py \
+            --output security-proofs-results.json \
+            --verbose
+
+      - name: Upload proofs artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: security-proofs-results
+          path: security-proofs-results.json
+          retention-days: 30
+
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Plugin Security Audit
+  # ─────────────────────────────────────────────────────────────────────────
+  plugin-audit:
+    name: Plugin Security Audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      # Script exits 1 only on CRITICAL findings (eval/exec in plugins).
+      # Missing manifest.json etc are warnings.
+      - name: Run plugin audit
+        run: |
+          python scripts/audit_plugins.py \
+            --output plugin-audit-results.json \
+            --verbose
+
+      - name: Upload plugin audit artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: plugin-audit-results
+          path: plugin-audit-results.json
+          retention-days: 30
+
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Aggregate Report
+  # ─────────────────────────────────────────────────────────────────────────
+  security-report:
+    name: Security Report
+    runs-on: ubuntu-latest
+    needs:
+      - sast
+      - dependency-audit
+      - secrets-scan
+      - ledmatrix-security-proofs
+      - plugin-audit
+    if: always()  # Run even if upstream jobs fail or are skipped
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: audit-artifacts/
+
+      - name: Generate consolidated report
+        run: |
+          python scripts/generate_report.py \
+            --artifact-dir audit-artifacts/ \
+            --output security-report.md \
+            --verbose
+
+      - name: Upload consolidated report
+        uses: actions/upload-artifact@v4
+        with:
+          name: security-report
+          path: security-report.md
+          retention-days: 90
+
+      - name: Comment on PR
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const report = fs.readFileSync('security-report.md', 'utf8');
+            // Use sticky comment — update existing comment rather than adding a new one each run
+            const { data: comments } = await github.rest.issues.listComments({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+            });
+            const botComment = comments.find(c =>
+              c.user.type === 'Bot' && c.body.includes('🔒 Security Audit')
+            );
+            if (botComment) {
+              await github.rest.issues.updateComment({
+                comment_id: botComment.id,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: report,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                issue_number: context.issue.number,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                body: report,
+              });
+            }

.github/workflows/test.yml

@@ -0,0 +1,33 @@
+name: Tests
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  plugin-safety:
+    name: Plugin safety harness + unit tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+        with:
+          python-version: "3.12"
+          cache: pip
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt -r requirements-test.txt
+          pip install RGBMatrixEmulator
+
+      - name: Run harness + visual rendering tests
+        run: |
+          pytest --no-cov \
+            test/plugins/test_harness.py \
+            test/plugins/test_visual_rendering.py \
+            test/plugins/test_plugin_matrix.py

.github/workflows/tests.yml

@@ -0,0 +1,46 @@
+name: Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: pytest (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.10', '3.11', '3.12']
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          submodules: false  # rgbmatrix submodule not needed in EMULATOR mode
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          # Optional deps that some test modules import
+          pip install scipy psutil Flask-Limiter
+
+      - name: Run tests
+        env:
+          EMULATOR: "true"
+        run: |
+          pytest \
+            -m "not hardware and not slow" \
+            --tb=short

.gitignore

@@ -8,6 +8,7 @@ config/config_secrets.json
 config/config.json
 config/config.json.backup
 config/wifi_config.json
+config/uninstalled_plugins.json
 credentials.json
 token.pickle
 

bandit.yaml

@@ -0,0 +1,33 @@
+# bandit.yaml — LEDMatrix bandit configuration
+# https://bandit.readthedocs.io/en/latest/config.html
+#
+# Skips are justified by the specific codebase context documented below.
+# Do not remove skips without updating the justification comment.
+
+skips:
+  # B104: Binding to all interfaces (0.0.0.0)
+  # Intentional — the Flask server binds 0.0.0.0 for LAN access on a Raspberry Pi.
+  # This is not internet-facing and is documented in web_interface/app.py.
+  - B104
+
+  # B603: subprocess call without shell=True
+  # All subprocess.run() calls in this codebase use list arguments (confirmed by
+  # grep — zero uses of shell=True in src/ or web_interface/). List args prevent
+  # shell injection. See src/common/permission_utils.py for the primary usage.
+  - B603
+
+  # B607: Starting a process with a partial executable path
+  # The subprocess calls invoke system utilities (systemctl, sudo, git) by name.
+  # These are fixed-list invocations, not user-controlled, and rely on PATH.
+  - B607
+
+exclude_dirs:
+  - tests
+  - test
+  - venv
+  - .venv
+  - rpi-rgb-led-matrix-master
+  # prove_security.py intentionally contains detection patterns as string literals
+  # (e.g. "eval(", "exec(") to search for in other files — bandit would flag
+  # these as false positives.
+  - scripts/prove_security.py

config/config.template.json

@@ -115,6 +115,11 @@
             "gpio_slowdown": 3,
             "rp1_rio": 0
         },
+        "double_sided": {
+            "enabled": false,
+            "copies": 2,
+            "axis": "horizontal"
+        },
         "display_durations": {},
         "use_short_date_format": true,
         "vegas_scroll": {

docs/HOW_TO_RUN_TESTS.md

@@ -248,7 +248,6 @@ test/
 ├── test_config_service.py               # Config service tests
 ├── test_config_validation_edge_cases.py # Config edge cases
 ├── test_font_manager.py                 # Font manager tests
-├── test_layout_manager.py               # Layout manager tests
 ├── test_text_helper.py                  # Text helper tests
 ├── test_error_handling.py               # Error handling tests
 ├── test_error_aggregator.py             # Error aggregation tests

docs/plugin-safety-harness.md

@@ -0,0 +1,136 @@
+# Plugin Safety Harness
+
+Renders a plugin across **every declared screen (mode)** and **a spread of
+matrix sizes**, and fails if any combination crashes, draws past the panel edge,
+or — for plugins that ship golden images — drifts visually. The goal: change a
+plugin without breaking a size or screen you didn't think to test.
+
+## Sizes: a sample, not a fixed list
+
+There is **no fixed set of supported panel sizes** — an RGB matrix build can be
+any width/height and configuration (square, rectangle, 2×2, 4×4, 8×2, long
+strips, tall stacks). Plugins are expected to read dimensions dynamically
+(`self.display_manager.matrix.width/height`) and lay themselves out
+accordingly, so a hardcoded coordinate or unscaled font shows up as a failure
+here.
+
+The harness therefore renders against a **representative sample** that spans the
+axes of variation (`DEFAULT_TEST_SIZES` in `src/plugin_system/testing/sizes.py`),
+not an authoritative list:
+
+Each module is 64×32; entries are real panel-grid arrangements (cols × rows):
+
+| Size    | Grid | Why it's in the sample                     |
+|---------|------|--------------------------------------------|
+| 64×32   | 1×1  | single panel — tightest common rectangle   |
+| 128×32  | 2×1  | the baseline most plugins are tuned for    |
+| 64×64   | 1×2  | stacked — tall-narrow centering            |
+| 128×64  | 2×2  | block — icon scaling / vertical centering  |
+| 256×32  | 4×1  | long strip — wide horizontal layout        |
+| 128×96  | 2×3  | tall — vertical overflow                   |
+| 256×128 | 4×4  | large block — both dimensions big at once  |
+
+**Override the sizes entirely** to test your actual hardware (or any shape):
+
+```bash
+# CLI — one-off:
+python scripts/check_plugin.py --plugin clock-simple --sizes 8x16,64x64,256x32
+
+# pytest — force every plugin onto your panel(s):
+LEDMATRIX_TEST_SIZES="8x16,128x128" pytest test/plugins/test_plugin_matrix.py
+
+# Per-plugin — declare the shapes a plugin targets in its test/harness.json:
+#   { "sizes": [[8, 16], [64, 64]] }
+```
+
+Precedence: `LEDMATRIX_TEST_SIZES` env (global) → per-plugin `harness.json`
+`sizes` → the default sample. Bounds checking adapts to whatever sizes a run
+uses — the backing canvas is padded out to the **largest** panel in the run, so
+a coordinate meant for a big build is still caught when rendering a small one.
+
+## Quick start
+
+```bash
+# Functional + bounds check across all sizes/screens:
+python scripts/check_plugin.py --plugin clock-simple
+
+# Every discovered plugin:
+python scripts/check_plugin.py --all
+
+# Dump PNGs to eyeball each size/screen:
+python scripts/check_plugin.py --plugin ledmatrix-weather --out-dir /tmp/preview
+```
+
+Exit code is non-zero if any `(plugin, size, screen)` fails. Plugins are
+discovered in `plugin-repos/` and `plugins/` (override with `--plugin-dir`).
+
+## What it checks (Phase 1 — always on)
+
+1. **Loads** and builds its mode list.
+2. **Renders every screen** at every size without raising. `update()` may fail
+   (no network in CI) and is tolerated; a crash in `display()` is a failure —
+   `display()` must handle the no-data state.
+3. **Bounds**: nothing is drawn past the right/bottom edge. Implemented by
+   `BoundsCheckingDisplayManager`, which backs the declared panel with an
+   oversized canvas and flags any pixels that land in the margin. (Left/top
+   overflow at negative coordinates and BDF text are not flagged — golden images
+   cover those.)
+
+## Golden images (Phase 2 — opt-in per plugin)
+
+A plugin opts in by committing reference PNGs and (usually) a small harness spec:
+
+```
+plugins/<id>/test/harness.json          # how to render deterministically
+plugins/<id>/test/fixtures/mock.json     # optional cached data
+plugins/<id>/test/golden/<WxH>/<mode>.png
+```
+
+`test/harness.json` keys (all optional):
+
+```json
+{
+  "config":      { "timezone": "UTC" },
+  "mock_data":   "fixtures/mock.json",
+  "freeze_time": "2025-08-01 15:25:00",
+  "skip_update": false,
+  "sizes":       [[128, 32], [128, 64]]
+}
+```
+
+Generate / refresh goldens after an intentional visual change, then review the
+diff before committing:
+
+```bash
+python scripts/check_plugin.py --plugin clock-simple --update-golden \
+  --config '{"timezone":"UTC"}' --freeze-time "2025-08-01 15:25:00"
+```
+
+Comparison is exact by default (`compare_images` in `harness.py` accepts a
+tolerance for known anti-aliasing noise). Determinism requires a pinned Pillow
+and the bundled fonts — keep both stable when regenerating goldens.
+
+## Tests & CI
+
+- `test/plugins/test_harness.py` — unit tests for bounds detection, image
+  comparison, and mode enumeration (run anywhere).
+- `test/plugins/test_plugin_matrix.py` — parametrized over discovered plugins ×
+  sizes × screens; honors each plugin's `test/harness.json` and goldens. Skips
+  when no plugins are present (e.g. a fresh core checkout); set
+  `LEDMATRIX_REQUIRE_PLUGINS=1` in a pipeline where plugins must be present to
+  turn an empty discovery into a hard failure instead. Point it at the monorepo
+  with `LEDMATRIX_PLUGINS_DIR=/path/to/ledmatrix-plugins/plugins`.
+- `.github/workflows/test.yml` — runs the harness + visual tests on every PR.
+
+The plugin monorepo has its own `Plugin Safety` workflow that runs this harness
+against changed plugins on every PR.
+
+## Developer workflow
+
+1. Change the plugin on a branch.
+2. `python scripts/check_plugin.py --plugin <id> --out-dir /tmp/preview` and
+   eyeball the PNGs.
+3. Intentional visual change? `--update-golden`, review diffs, commit goldens.
+4. (Monorepo) bump `manifest.json` version and let the pre-commit hook sync
+   `plugins.json`.
+5. Push — CI re-runs the harness across all sizes and gates the PR.

first_time_install.sh

@@ -15,8 +15,8 @@ on_error() {
     echo "✗ An error occurred during: $CURRENT_STEP (line $line_no, exit $exit_code)" >&2
     if [ -n "${LOG_FILE:-}" ]; then
         echo "See the log for details: $LOG_FILE" >&2
-        echo "-- Last 50 lines from log --" >&2
+        echo "-- Last 100 lines from log --" >&2
-        tail -n 50 "$LOG_FILE" >&2 || true
+        tail -n 100 "$LOG_FILE" >&2 || true
     fi
     echo "\nCommon fixes:" >&2
     echo "- Ensure the Pi is online (try: ping -c1 8.8.8.8)." >&2
@@ -202,8 +202,33 @@ retry() {
     done
 }
 
-apt_update() { retry apt update; }
+# Wait for another apt/dpkg process (commonly unattended-upgrades running
-apt_install() { retry apt install -y "$@"; }
+# shortly after first boot) to release its lock before we try apt ourselves.
+# Without this, apt_update/apt_install can fail outright in the first couple
+# minutes after a fresh Pi OS boot with a generic "Command failed after 3
+# attempts" error.
+wait_for_apt_lock() {
+    command -v flock >/dev/null 2>&1 || return 0
+    local lock_file="/var/lib/dpkg/lock-frontend"
+    local max_wait=180
+    local waited=0
+    local printed=0
+    while ! flock -n "$lock_file" -c true 2>/dev/null; do
+        if [ "$printed" -eq 0 ]; then
+            echo "⚠ Waiting for another apt/dpkg process to finish (e.g. unattended-upgrades on first boot)..."
+            printed=1
+        fi
+        if [ "$waited" -ge "$max_wait" ]; then
+            echo "⚠ Still waiting after ${max_wait}s; proceeding anyway."
+            break
+        fi
+        sleep 5
+        waited=$((waited+5))
+    done
+}
+
+apt_update() { wait_for_apt_lock; retry apt-get -o DPkg::Lock::Timeout=180 update; }
+apt_install() { wait_for_apt_lock; retry apt-get -o DPkg::Lock::Timeout=180 install -y "$@"; }
 apt_remove() { apt-get remove -y "$@" || true; }
 
 check_network() {
@@ -222,6 +247,22 @@ check_network() {
     exit 1
 }
 
+check_disk_space() {
+    command -v df >/dev/null 2>&1 || return 0
+    local available_mb
+    available_mb=$(df -m "$PROJECT_ROOT_DIR" | awk 'NR==2{print $4}')
+    available_mb=${available_mb:-0}
+    if [ "$available_mb" -lt 500 ]; then
+        echo "✗ ERROR: Insufficient disk space: ${available_mb}MB available (need at least 500MB)"
+        echo "  Free up space first, e.g.: sudo apt clean && sudo apt autoremove"
+        exit 1
+    elif [ "$available_mb" -lt 1024 ]; then
+        echo "⚠ Limited disk space: ${available_mb}MB available (recommend at least 1GB for the rpi-rgb-led-matrix build in Step 6)"
+    else
+        echo "✓ Disk space sufficient: ${available_mb}MB available"
+    fi
+}
+
 echo ""
 echo "This script will perform the following steps:"
 echo "1. Install system dependencies"
@@ -271,8 +312,9 @@ CURRENT_STEP="Install system dependencies"
 echo "Step 1: Installing system dependencies..."
 echo "----------------------------------------"
 
-# Ensure network is available before APT operations
+# Pre-flight checks before APT operations
 check_network
+check_disk_space
 
 # Update package list
 apt_update
@@ -684,7 +726,11 @@ if [ -f "$PROJECT_ROOT_DIR/requirements.txt" ]; then
         
         if command -v timeout >/dev/null 2>&1; then
             # Use timeout if available (10 minutes = 600 seconds)
-            if timeout 600 python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --verbose "$line" > "$INSTALL_OUTPUT" 2>&1; then
+            # --ignore-installed: apt-managed packages (e.g. python3-requests)
+            # ship no pip RECORD file, so upgrading them would otherwise abort
+            # with "uninstall-no-record-file"; this lays the new version down
+            # alongside instead of trying to uninstall the apt copy first.
+            if timeout 600 python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --ignore-installed --verbose "$line" > "$INSTALL_OUTPUT" 2>&1; then
                 INSTALL_SUCCESS=true
             else
                 EXIT_CODE=$?
@@ -692,7 +738,7 @@ if [ -f "$PROJECT_ROOT_DIR/requirements.txt" ]; then
                     echo "✗ Timeout (10 minutes) installing: $line"
                     echo "  This package may require building from source, which can be slow on Raspberry Pi."
                     echo "  You can try installing it manually later with:"
-                    echo "    python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --verbose '$line'"
+                    echo "    python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --ignore-installed --verbose '$line'"
                 else
                     echo "✗ Failed to install: $line (exit code: $EXIT_CODE)"
                 fi
@@ -700,7 +746,7 @@ if [ -f "$PROJECT_ROOT_DIR/requirements.txt" ]; then
         else
             # No timeout command available, install without timeout
             echo "  Note: timeout command not available, installation may take a while..."
-            if python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --verbose "$line" > "$INSTALL_OUTPUT" 2>&1; then
+            if python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --ignore-installed --verbose "$line" > "$INSTALL_OUTPUT" 2>&1; then
                 INSTALL_SUCCESS=true
             else
                 EXIT_CODE=$?
@@ -752,7 +798,7 @@ if [ -f "$PROJECT_ROOT_DIR/requirements.txt" ]; then
         echo "  1. Ensure you have enough disk space: df -h"
         echo "  2. Check available memory: free -h"
         echo "  3. Try installing failed packages individually with verbose output:"
-        echo "     python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --verbose <package>"
+        echo "     python3 -m pip install --break-system-packages --no-cache-dir --prefer-binary --ignore-installed --verbose <package>"
         echo "  4. For packages that build from source (like numpy), consider:"
         echo "     - Installing pre-built wheels: python3 -m pip install --only-binary :all: <package>"
         echo "     - Or installing via apt if available: sudo apt install python3-<package>"
@@ -774,7 +820,10 @@ echo ""
 # Install web interface dependencies
 echo "Installing web interface dependencies..."
 if [ -f "$PROJECT_ROOT_DIR/web_interface/requirements.txt" ]; then
-    if python3 -m pip install --break-system-packages --prefer-binary -r "$PROJECT_ROOT_DIR/web_interface/requirements.txt"; then
+    # --ignore-installed: apt-managed packages (e.g. python3-requests) ship no
+    # pip RECORD file, so upgrading them to the version pinned here would
+    # otherwise abort the whole install with "uninstall-no-record-file".
+    if python3 -m pip install --break-system-packages --prefer-binary --ignore-installed -r "$PROJECT_ROOT_DIR/web_interface/requirements.txt"; then
         echo "✓ Web interface dependencies installed"
         # Create marker file to indicate dependencies are installed
         touch "$PROJECT_ROOT_DIR/.web_deps_installed"
@@ -815,24 +864,30 @@ if [ "$_SKIP_BUILD" = "1" ]; then
     echo "rgbmatrix already installed${_skip_suffix}; skipping build (set RPI_RGB_FORCE_REBUILD=1 to force rebuild)."
 else
     # Ensure rpi-rgb-led-matrix submodule is initialized
+    # Wrapper used with retry(): removes any partial clone dir before each attempt
+    # so git clone doesn't fail with "destination path already exists".
+    _clone_rpi_rgb() {
+        rm -rf "$PROJECT_ROOT_DIR/rpi-rgb-led-matrix-master"
+        git clone https://github.com/hzeller/rpi-rgb-led-matrix.git rpi-rgb-led-matrix-master
+    }
     if [ ! -d "$PROJECT_ROOT_DIR/rpi-rgb-led-matrix-master" ]; then
         echo "rpi-rgb-led-matrix-master not found. Initializing git submodule..."
         cd "$PROJECT_ROOT_DIR"
-        
+
         # Try to initialize submodule if .gitmodules exists
         if [ -f "$PROJECT_ROOT_DIR/.gitmodules" ] && grep -q "rpi-rgb-led-matrix" "$PROJECT_ROOT_DIR/.gitmodules"; then
             echo "Initializing rpi-rgb-led-matrix submodule..."
-            if ! git submodule update --init --recursive rpi-rgb-led-matrix-master 2>&1; then
+            if ! retry git submodule update --init --recursive rpi-rgb-led-matrix-master; then
                 echo "⚠ Submodule init failed, cloning directly from GitHub..."
-                git clone https://github.com/hzeller/rpi-rgb-led-matrix.git rpi-rgb-led-matrix-master
+                retry _clone_rpi_rgb
             fi
         else
             # Fallback: clone directly if submodule not configured
             echo "Submodule not configured, cloning directly from GitHub..."
-            git clone https://github.com/hzeller/rpi-rgb-led-matrix.git rpi-rgb-led-matrix-master
+            retry _clone_rpi_rgb
         fi
     fi
-    
+
     # Build and install rpi-rgb-led-matrix Python bindings
     if [ -d "$PROJECT_ROOT_DIR/rpi-rgb-led-matrix-master" ]; then
         # Check if submodule is properly initialized (not empty)
@@ -841,23 +896,34 @@ else
             cd "$PROJECT_ROOT_DIR"
             rm -rf rpi-rgb-led-matrix-master
             if [ -f "$PROJECT_ROOT_DIR/.gitmodules" ] && grep -q "rpi-rgb-led-matrix" "$PROJECT_ROOT_DIR/.gitmodules"; then
-                git submodule update --init --recursive rpi-rgb-led-matrix-master
+                retry git submodule update --init --recursive rpi-rgb-led-matrix-master
             else
-                git clone https://github.com/hzeller/rpi-rgb-led-matrix.git rpi-rgb-led-matrix-master
+                retry _clone_rpi_rgb
             fi
         fi
-        
+
         pushd "$PROJECT_ROOT_DIR/rpi-rgb-led-matrix-master" >/dev/null
         echo "Installing rpi-rgb-led-matrix Python package (scikit-build-core + cmake)..."
         echo "  Build deps required: python-dev-is-python3 cmake"
         echo "  This compiles C++ — may take 2-5 minutes on Pi 4/5..."
-        if ! python3 -m pip install --break-system-packages .; then
+        BUILD_OUTPUT=$(mktemp)
+        BUILD_SUCCESS=false
+        if python3 -m pip install --break-system-packages . > "$BUILD_OUTPUT" 2>&1; then
+            BUILD_SUCCESS=true
+        fi
+        cat "$BUILD_OUTPUT" >> "$LOG_FILE"
+        if [ "$BUILD_SUCCESS" != true ]; then
             echo "✗ Failed to install rpi-rgb-led-matrix Python package"
             echo "  Ensure build tools are installed:"
             echo "  sudo apt install -y python-dev-is-python3 cmake build-essential"
+            echo ""
+            echo "-- Last 50 lines of build output --"
+            tail -n 50 "$BUILD_OUTPUT"
+            rm -f "$BUILD_OUTPUT"
             popd >/dev/null
             exit 1
         fi
+        rm -f "$BUILD_OUTPUT"
         popd >/dev/null
     else
         echo "✗ rpi-rgb-led-matrix-master directory not found at $PROJECT_ROOT_DIR"
@@ -912,11 +978,15 @@ else
     # Try to install dependencies using the smart installer if available
     if [ -f "$PROJECT_ROOT_DIR/scripts/install_dependencies_apt.py" ]; then
         echo "Using smart dependency installer..."
-        python3 "$PROJECT_ROOT_DIR/scripts/install_dependencies_apt.py"
+        # -u: unbuffered stdout/stderr so output is captured in $LOG_FILE in
+        # real time and in order relative to this script's own echo statements
+        python3 -u "$PROJECT_ROOT_DIR/scripts/install_dependencies_apt.py"
     else
         echo "Using pip to install dependencies..."
         if [ -f "$PROJECT_ROOT_DIR/requirements_web_v2.txt" ]; then
-            python3 -m pip install --break-system-packages --prefer-binary -r requirements_web_v2.txt
+            # --ignore-installed: see the Step 5 web_interface/requirements.txt
+            # install above — same apt/pip RECORD-file conflict applies here.
+            python3 -m pip install --break-system-packages --prefer-binary --ignore-installed -r requirements_web_v2.txt
         else
             echo "⚠ requirements_web_v2.txt not found; skipping web dependency install"
         fi

plugin-repos/7-segment-clock

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/7-segment-clock

plugin-repos/baseball-scoreboard

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/baseball-scoreboard

plugin-repos/basketball-scoreboard

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/basketball-scoreboard

plugin-repos/calendar

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/calendar

plugin-repos/christmas-countdown

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/christmas-countdown

plugin-repos/clock-simple

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/clock-simple

plugin-repos/countdown

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/countdown

plugin-repos/f1-scoreboard

@@ -0,0 +1 @@
+/home/chuck/Github/ledmatrix-plugins/plugins/f1-scoreboard

plugin-repos/football-scoreboard

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/football-scoreboard

plugin-repos/hello-world

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/hello-world

plugin-repos/hockey-scoreboard

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/hockey-scoreboard

plugin-repos/ledmatrix-flights

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/ledmatrix-flights

plugin-repos/ledmatrix-leaderboard

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/ledmatrix-leaderboard

plugin-repos/ledmatrix-music

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/ledmatrix-music

plugin-repos/ledmatrix-stocks

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/ledmatrix-stocks

plugin-repos/ledmatrix-weather

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/ledmatrix-weather

plugin-repos/march-madness/config_schema.json

@@ -0,0 +1,138 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "March Madness Plugin Configuration",
+  "type": "object",
+  "properties": {
+    "enabled": {
+      "type": "boolean",
+      "default": false,
+      "description": "Enable the March Madness tournament display"
+    },
+    "leagues": {
+      "type": "object",
+      "title": "Tournament Leagues",
+      "description": "Which NCAA tournaments to display",
+      "properties": {
+        "ncaam": {
+          "type": "boolean",
+          "default": true,
+          "description": "Show NCAA Men's Tournament games"
+        },
+        "ncaaw": {
+          "type": "boolean",
+          "default": true,
+          "description": "Show NCAA Women's Tournament games"
+        }
+      },
+      "additionalProperties": false
+    },
+    "favorite_teams": {
+      "type": "array",
+      "title": "Favorite Teams",
+      "description": "Team abbreviations to highlight (e.g., DUKE, UNC). Leave empty to show all teams equally.",
+      "items": {
+        "type": "string"
+      },
+      "uniqueItems": true,
+      "default": []
+    },
+    "display_options": {
+      "type": "object",
+      "title": "Display Options",
+      "x-collapsed": true,
+      "properties": {
+        "show_seeds": {
+          "type": "boolean",
+          "default": true,
+          "description": "Show tournament seeds (1-16) next to team names"
+        },
+        "show_round_logos": {
+          "type": "boolean",
+          "default": true,
+          "description": "Show round logo separators between game groups"
+        },
+        "highlight_upsets": {
+          "type": "boolean",
+          "default": true,
+          "description": "Highlight upset winners (higher seed beating lower seed) in gold"
+        },
+        "show_bracket_progress": {
+          "type": "boolean",
+          "default": true,
+          "description": "Show which teams are still alive in each region"
+        },
+        "scroll_speed": {
+          "type": "number",
+          "default": 1.0,
+          "minimum": 0.5,
+          "maximum": 5.0,
+          "description": "Scroll speed (pixels per frame)"
+        },
+        "scroll_delay": {
+          "type": "number",
+          "default": 0.02,
+          "minimum": 0.001,
+          "maximum": 0.1,
+          "description": "Delay between scroll frames (seconds)"
+        },
+        "target_fps": {
+          "type": "integer",
+          "default": 120,
+          "minimum": 30,
+          "maximum": 200,
+          "description": "Target frames per second"
+        },
+        "loop": {
+          "type": "boolean",
+          "default": true,
+          "description": "Loop the scroll continuously"
+        },
+        "dynamic_duration": {
+          "type": "boolean",
+          "default": true,
+          "description": "Automatically adjust display duration based on content width"
+        },
+        "min_duration": {
+          "type": "integer",
+          "default": 30,
+          "minimum": 10,
+          "maximum": 300,
+          "description": "Minimum display duration in seconds"
+        },
+        "max_duration": {
+          "type": "integer",
+          "default": 300,
+          "minimum": 30,
+          "maximum": 600,
+          "description": "Maximum display duration in seconds"
+        }
+      },
+      "additionalProperties": false
+    },
+    "data_settings": {
+      "type": "object",
+      "title": "Data Settings",
+      "x-collapsed": true,
+      "properties": {
+        "update_interval": {
+          "type": "integer",
+          "default": 300,
+          "minimum": 60,
+          "maximum": 3600,
+          "description": "How often to refresh tournament data (seconds). Automatically shortens to 60s when live games are detected."
+        },
+        "request_timeout": {
+          "type": "integer",
+          "default": 30,
+          "minimum": 5,
+          "maximum": 60,
+          "description": "API request timeout in seconds"
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "required": ["enabled"],
+  "additionalProperties": false,
+  "x-propertyOrder": ["enabled", "leagues", "favorite_teams", "display_options", "data_settings"]
+}

plugin-repos/march-madness/manager.py

@@ -0,0 +1,910 @@
+"""March Madness Plugin — NCAA Tournament bracket tracker for LED Matrix.
+
+Displays a horizontally-scrolling ticker of NCAA Tournament games grouped by
+round, with seeds, round logos, live scores, and upset highlighting.
+"""
+
+import re
+import threading
+import time
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+import numpy as np
+import pytz
+import requests
+from PIL import Image, ImageDraw, ImageFont
+from requests.adapters import HTTPAdapter
+from urllib3.util.retry import Retry
+
+from src.plugin_system.base_plugin import BasePlugin
+
+try:
+    from src.common.scroll_helper import ScrollHelper
+except ImportError:
+    ScrollHelper = None
+
+
+# ---------------------------------------------------------------------------
+# Constants
+# ---------------------------------------------------------------------------
+
+SCOREBOARD_URLS = {
+    "ncaam": "https://site.api.espn.com/apis/site/v2/sports/basketball/mens-college-basketball/scoreboard",
+    "ncaaw": "https://site.api.espn.com/apis/site/v2/sports/basketball/womens-college-basketball/scoreboard",
+}
+
+ROUND_ORDER = {"NCG": 0, "F4": 1, "E8": 2, "S16": 3, "R32": 4, "R64": 5, "": 6}
+
+ROUND_DISPLAY_NAMES = {
+    "NCG": "Championship",
+    "F4": "Final Four",
+    "E8": "Elite Eight",
+    "S16": "Sweet Sixteen",
+    "R32": "Round of 32",
+    "R64": "Round of 64",
+}
+
+ROUND_LOGO_FILES = {
+    "NCG": "CHAMPIONSHIP.png",
+    "F4": "FINAL_4.png",
+    "E8": "ELITE_8.png",
+    "S16": "SWEET_16.png",
+    "R32": "ROUND_32.png",
+    "R64": "ROUND_64.png",
+}
+
+REGION_ORDER = {"E": 0, "W": 1, "S": 2, "MW": 3, "": 4}
+
+# Colors
+COLOR_WHITE = (255, 255, 255)
+COLOR_GOLD = (255, 215, 0)
+COLOR_GRAY = (160, 160, 160)
+COLOR_DIM = (100, 100, 100)
+COLOR_RED = (255, 60, 60)
+COLOR_GREEN = (60, 200, 60)
+COLOR_BLACK = (0, 0, 0)
+COLOR_DARK_BG = (20, 20, 20)
+
+
+# ---------------------------------------------------------------------------
+# Plugin Class
+# ---------------------------------------------------------------------------
+
+class MarchMadnessPlugin(BasePlugin):
+    """NCAA March Madness tournament bracket tracker."""
+
+    def __init__(
+        self,
+        plugin_id: str,
+        config: Dict[str, Any],
+        display_manager: Any,
+        cache_manager: Any,
+        plugin_manager: Any,
+    ):
+        super().__init__(plugin_id, config, display_manager, cache_manager, plugin_manager)
+
+        # Config
+        leagues_config = config.get("leagues", {})
+        self.show_ncaam: bool = leagues_config.get("ncaam", True)
+        self.show_ncaaw: bool = leagues_config.get("ncaaw", True)
+        self.favorite_teams: List[str] = [t.upper() for t in config.get("favorite_teams", [])]
+
+        display_options = config.get("display_options", {})
+        self.show_seeds: bool = display_options.get("show_seeds", True)
+        self.show_round_logos: bool = display_options.get("show_round_logos", True)
+        self.highlight_upsets: bool = display_options.get("highlight_upsets", True)
+        self.show_bracket_progress: bool = display_options.get("show_bracket_progress", True)
+        self.scroll_speed: float = display_options.get("scroll_speed", 1.0)
+        self.scroll_delay: float = display_options.get("scroll_delay", 0.02)
+        self.target_fps: int = display_options.get("target_fps", 120)
+        self.loop: bool = display_options.get("loop", True)
+        self.dynamic_duration_enabled: bool = display_options.get("dynamic_duration", True)
+        self.min_duration: int = display_options.get("min_duration", 30)
+        self.max_duration: int = display_options.get("max_duration", 300)
+        if self.min_duration > self.max_duration:
+            self.logger.warning(
+                f"min_duration ({self.min_duration}) > max_duration ({self.max_duration}); swapping values"
+            )
+            self.min_duration, self.max_duration = self.max_duration, self.min_duration
+
+        data_settings = config.get("data_settings", {})
+        self.update_interval: int = data_settings.get("update_interval", 300)
+        self.request_timeout: int = data_settings.get("request_timeout", 30)
+
+        # Scrolling flag for display controller
+        self.enable_scrolling = True
+
+        # State
+        self.games_data: List[Dict] = []
+        self.ticker_image: Optional[Image.Image] = None
+        self.last_update: float = 0
+        self.dynamic_duration: float = 60
+        self.total_scroll_width: int = 0
+        self._display_start_time: Optional[float] = None
+        self._end_reached_logged: bool = False
+        self._update_lock = threading.Lock()
+        self._has_live_games: bool = False
+        self._cached_dynamic_duration: Optional[float] = None
+        self._duration_cache_time: float = 0
+
+        # Display dimensions
+        self.display_width: int = self.display_manager.matrix.width
+        self.display_height: int = self.display_manager.matrix.height
+
+        # HTTP session with retry
+        self.session = requests.Session()
+        retry = Retry(total=3, backoff_factor=1, status_forcelist=[429, 500, 502, 503, 504])
+        self.session.mount("https://", HTTPAdapter(max_retries=retry))
+        self.headers = {"User-Agent": "LEDMatrix/2.0"}
+
+        # ScrollHelper
+        if ScrollHelper:
+            self.scroll_helper = ScrollHelper(self.display_width, self.display_height, logger=self.logger)
+            if hasattr(self.scroll_helper, "set_frame_based_scrolling"):
+                self.scroll_helper.set_frame_based_scrolling(True)
+            self.scroll_helper.set_scroll_speed(self.scroll_speed)
+            self.scroll_helper.set_scroll_delay(self.scroll_delay)
+            if hasattr(self.scroll_helper, "set_target_fps"):
+                self.scroll_helper.set_target_fps(self.target_fps)
+            self.scroll_helper.set_dynamic_duration_settings(
+                enabled=self.dynamic_duration_enabled,
+                min_duration=self.min_duration,
+                max_duration=self.max_duration,
+                buffer=0.1,
+            )
+        else:
+            self.scroll_helper = None
+            self.logger.warning("ScrollHelper not available")
+
+        # Fonts
+        self.fonts = self._load_fonts()
+
+        # Logos
+        self._round_logos: Dict[str, Image.Image] = {}
+        self._team_logo_cache: Dict[str, Optional[Image.Image]] = {}
+        self._march_madness_logo: Optional[Image.Image] = None
+        self._load_round_logos()
+
+        self.logger.info(
+            f"MarchMadnessPlugin initialized — NCAAM: {self.show_ncaam}, "
+            f"NCAAW: {self.show_ncaaw}, favorites: {self.favorite_teams}"
+        )
+
+    # ------------------------------------------------------------------
+    # Fonts
+    # ------------------------------------------------------------------
+
+    def _load_fonts(self) -> Dict[str, ImageFont.FreeTypeFont]:
+        fonts = {}
+        try:
+            fonts["score"] = ImageFont.truetype("assets/fonts/PressStart2P-Regular.ttf", 10)
+        except IOError:
+            fonts["score"] = ImageFont.load_default()
+        try:
+            fonts["time"] = ImageFont.truetype("assets/fonts/PressStart2P-Regular.ttf", 8)
+        except IOError:
+            fonts["time"] = ImageFont.load_default()
+        try:
+            fonts["detail"] = ImageFont.truetype("assets/fonts/4x6-font.ttf", 6)
+        except IOError:
+            fonts["detail"] = ImageFont.load_default()
+        return fonts
+
+    # ------------------------------------------------------------------
+    # Logo loading
+    # ------------------------------------------------------------------
+
+    def _load_round_logos(self) -> None:
+        logo_dir = Path(__file__).parent / "assets" / "logos"
+        for round_key, filename in ROUND_LOGO_FILES.items():
+            path = logo_dir / filename
+            try:
+                img = Image.open(path).convert("RGBA")
+                # Resize to fit display height
+                target_h = self.display_height - 4
+                ratio = target_h / img.height
+                target_w = int(img.width * ratio)
+                self._round_logos[round_key] = img.resize((target_w, target_h), Image.Resampling.LANCZOS)
+            except (OSError, ValueError) as e:
+                self.logger.warning(f"Could not load round logo {filename}: {e}")
+            except Exception:
+                self.logger.exception(f"Unexpected error loading round logo {filename}")
+
+        # March Madness banner logo (also in plugin assets)
+        mm_path = logo_dir / "MARCH_MADNESS.png"
+        try:
+            img = Image.open(mm_path).convert("RGBA")
+            target_h = self.display_height - 4
+            ratio = target_h / img.height
+            target_w = int(img.width * ratio)
+            self._march_madness_logo = img.resize((target_w, target_h), Image.Resampling.LANCZOS)
+        except (OSError, ValueError) as e:
+            self.logger.warning(f"Could not load March Madness logo: {e}")
+        except Exception:
+            self.logger.exception("Unexpected error loading March Madness logo")
+
+    def _get_team_logo(self, abbr: str) -> Optional[Image.Image]:
+        if abbr in self._team_logo_cache:
+            return self._team_logo_cache[abbr]
+        logo_dir = Path("assets/sports/ncaa_logos")
+        path = logo_dir / f"{abbr}.png"
+        try:
+            img = Image.open(path).convert("RGBA")
+            target_h = self.display_height - 6
+            ratio = target_h / img.height
+            target_w = int(img.width * ratio)
+            img = img.resize((target_w, target_h), Image.Resampling.LANCZOS)
+            self._team_logo_cache[abbr] = img
+            return img
+        except (FileNotFoundError, OSError, ValueError):
+            self._team_logo_cache[abbr] = None
+            return None
+        except Exception:
+            self.logger.exception(f"Unexpected error loading team logo for {abbr}")
+            self._team_logo_cache[abbr] = None
+            return None
+
+    # ------------------------------------------------------------------
+    # Data fetching
+    # ------------------------------------------------------------------
+
+    def _is_tournament_window(self) -> bool:
+        today = datetime.now(pytz.utc)
+        return (3, 10) <= (today.month, today.day) <= (4, 10)
+
+    def _fetch_tournament_data(self) -> List[Dict]:
+        """Fetch tournament games from ESPN scoreboard API."""
+        all_games: List[Dict] = []
+
+        leagues = []
+        if self.show_ncaam:
+            leagues.append("ncaam")
+        if self.show_ncaaw:
+            leagues.append("ncaaw")
+
+        for league_key in leagues:
+            url = SCOREBOARD_URLS.get(league_key)
+            if not url:
+                continue
+
+            cache_key = f"march_madness_{league_key}_scoreboard"
+            cache_max_age = 60 if self._has_live_games else self.update_interval
+            cached = self.cache_manager.get(cache_key, max_age=cache_max_age)
+            if cached:
+                all_games.extend(cached)
+                continue
+
+            try:
+                # NCAA basketball scoreboard without dates param returns current games
+                params = {"limit": 1000, "groups": 100}
+                resp = self.session.get(url, params=params, headers=self.headers, timeout=self.request_timeout)
+                resp.raise_for_status()
+                data = resp.json()
+                events = data.get("events", [])
+
+                league_games = []
+                for event in events:
+                    game = self._parse_event(event, league_key)
+                    if game:
+                        league_games.append(game)
+
+                self.cache_manager.set(cache_key, league_games)
+                self.logger.info(f"Fetched {len(league_games)} {league_key} tournament games")
+                all_games.extend(league_games)
+
+            except Exception:
+                self.logger.exception(f"Error fetching {league_key} tournament data")
+
+        return all_games
+
+    def _parse_event(self, event: Dict, league_key: str) -> Optional[Dict]:
+        """Parse an ESPN event into a game dict."""
+        competitions = event.get("competitions", [])
+        if not competitions:
+            return None
+        comp = competitions[0]
+
+        # Confirm tournament game
+        comp_type = comp.get("type", {})
+        is_tournament = comp_type.get("abbreviation") == "TRNMNT"
+        notes = comp.get("notes", [])
+        headline = ""
+        if notes:
+            headline = notes[0].get("headline", "")
+            if not is_tournament and "Championship" in headline:
+                is_tournament = True
+        if not is_tournament:
+            return None
+
+        # Status
+        status = comp.get("status", {}).get("type", {})
+        state = status.get("state", "pre")
+        status_detail = status.get("shortDetail", "")
+
+        # Teams
+        competitors = comp.get("competitors", [])
+        home_team = next((c for c in competitors if c.get("homeAway") == "home"), None)
+        away_team = next((c for c in competitors if c.get("homeAway") == "away"), None)
+        if not home_team or not away_team:
+            return None
+
+        home_abbr = home_team.get("team", {}).get("abbreviation", "???")
+        away_abbr = away_team.get("team", {}).get("abbreviation", "???")
+        home_score = home_team.get("score", "0")
+        away_score = away_team.get("score", "0")
+
+        # Seeds
+        home_seed = home_team.get("curatedRank", {}).get("current", 0)
+        away_seed = away_team.get("curatedRank", {}).get("current", 0)
+        if home_seed >= 99:
+            home_seed = 0
+        if away_seed >= 99:
+            away_seed = 0
+
+        # Round and region
+        tournament_round = self._parse_round(headline)
+        tournament_region = self._parse_region(headline)
+
+        # Date/time
+        date_str = event.get("date", "")
+        start_time_utc = None
+        game_date = ""
+        game_time = ""
+        try:
+            if date_str.endswith("Z"):
+                date_str = date_str.replace("Z", "+00:00")
+            dt = datetime.fromisoformat(date_str)
+            if dt.tzinfo is None:
+                start_time_utc = dt.replace(tzinfo=pytz.UTC)
+            else:
+                start_time_utc = dt.astimezone(pytz.UTC)
+            local = start_time_utc.astimezone(pytz.timezone("US/Eastern"))
+            game_date = local.strftime("%-m/%-d")
+            game_time = local.strftime("%-I:%M%p").replace("AM", "am").replace("PM", "pm")
+        except (ValueError, AttributeError):
+            pass
+
+        # Period / clock for live games
+        period = 0
+        clock = ""
+        period_text = ""
+        is_halftime = False
+        if state == "in":
+            status_obj = comp.get("status", {})
+            period = status_obj.get("period", 0)
+            clock = status_obj.get("displayClock", "")
+            detail_lower = status_detail.lower()
+            uses_quarters = league_key == "ncaaw" or "quarter" in detail_lower or detail_lower.startswith("q")
+            if period <= (4 if uses_quarters else 2):
+                period_text = f"Q{period}" if uses_quarters else f"H{period}"
+            else:
+                ot_num = period - (4 if uses_quarters else 2)
+                period_text = f"OT{ot_num}" if ot_num > 1 else "OT"
+            if "halftime" in detail_lower:
+                is_halftime = True
+        elif state == "post":
+            period_text = status.get("shortDetail", "Final")
+            if "Final" not in period_text:
+                period_text = "Final"
+
+        # Determine winner and upset
+        is_final = state == "post"
+        is_upset = False
+        winner_side = ""
+        if is_final:
+            try:
+                h = int(float(home_score))
+                a = int(float(away_score))
+                if h > a:
+                    winner_side = "home"
+                    if home_seed > away_seed > 0:
+                        is_upset = True
+                elif a > h:
+                    winner_side = "away"
+                    if away_seed > home_seed > 0:
+                        is_upset = True
+            except (ValueError, TypeError):
+                pass
+
+        return {
+            "id": event.get("id", ""),
+            "league": league_key,
+            "home_abbr": home_abbr,
+            "away_abbr": away_abbr,
+            "home_score": str(home_score),
+            "away_score": str(away_score),
+            "home_seed": home_seed,
+            "away_seed": away_seed,
+            "tournament_round": tournament_round,
+            "tournament_region": tournament_region,
+            "state": state,
+            "is_final": is_final,
+            "is_live": state == "in",
+            "is_upcoming": state == "pre",
+            "is_halftime": is_halftime,
+            "period": period,
+            "period_text": period_text,
+            "clock": clock,
+            "status_detail": status_detail,
+            "game_date": game_date,
+            "game_time": game_time,
+            "start_time_utc": start_time_utc,
+            "is_upset": is_upset,
+            "winner_side": winner_side,
+            "headline": headline,
+        }
+
+    @staticmethod
+    def _parse_round(headline: str) -> str:
+        hl = headline.lower()
+        if "national championship" in hl:
+            return "NCG"
+        if "final four" in hl:
+            return "F4"
+        if "elite 8" in hl or "elite eight" in hl:
+            return "E8"
+        if "sweet 16" in hl or "sweet sixteen" in hl:
+            return "S16"
+        if "2nd round" in hl or "second round" in hl:
+            return "R32"
+        if "1st round" in hl or "first round" in hl:
+            return "R64"
+        return ""
+
+    @staticmethod
+    def _parse_region(headline: str) -> str:
+        if "East Region" in headline:
+            return "E"
+        if "West Region" in headline:
+            return "W"
+        if "South Region" in headline:
+            return "S"
+        if "Midwest Region" in headline:
+            return "MW"
+        m = re.search(r"Regional (\d+)", headline)
+        if m:
+            return f"R{m.group(1)}"
+        return ""
+
+    # ------------------------------------------------------------------
+    # Game processing
+    # ------------------------------------------------------------------
+
+    def _process_games(self, games: List[Dict]) -> Dict[str, List[Dict]]:
+        """Group games by round, sorted by round significance then region/seed."""
+        grouped: Dict[str, List[Dict]] = {}
+        for game in games:
+            rnd = game.get("tournament_round", "")
+            grouped.setdefault(rnd, []).append(game)
+
+        # Sort each round's games by region then seed matchup
+        for rnd, round_games in grouped.items():
+            round_games.sort(
+                key=lambda g: (
+                    REGION_ORDER.get(g.get("tournament_region", ""), 4),
+                    min(g.get("away_seed", 99), g.get("home_seed", 99)),
+                )
+            )
+
+        return grouped
+
+    # ------------------------------------------------------------------
+    # Rendering
+    # ------------------------------------------------------------------
+
+    def _draw_text_with_outline(
+        self,
+        draw: ImageDraw.Draw,
+        text: str,
+        xy: tuple,
+        font: ImageFont.FreeTypeFont,
+        fill: tuple = COLOR_WHITE,
+        outline: tuple = COLOR_BLACK,
+    ) -> None:
+        x, y = xy
+        for dx in (-1, 0, 1):
+            for dy in (-1, 0, 1):
+                if dx or dy:
+                    draw.text((x + dx, y + dy), text, font=font, fill=outline)
+        draw.text((x, y), text, font=font, fill=fill)
+
+    def _create_round_separator(self, round_key: str) -> Image.Image:
+        """Create a separator tile for a tournament round."""
+        height = self.display_height
+        name = ROUND_DISPLAY_NAMES.get(round_key, round_key)
+        font = self.fonts["time"]
+
+        # Measure text
+        tmp = Image.new("RGB", (1, 1))
+        tmp_draw = ImageDraw.Draw(tmp)
+        text_width = int(tmp_draw.textlength(name, font=font))
+
+        # Logo on each side
+        logo = self._round_logos.get(round_key, self._march_madness_logo)
+        logo_w = logo.width if logo else 0
+        padding = 6
+
+        total_w = padding + logo_w + padding + text_width + padding + logo_w + padding
+        total_w = max(total_w, 80)
+
+        img = Image.new("RGB", (total_w, height), COLOR_DARK_BG)
+        draw = ImageDraw.Draw(img)
+
+        # Draw logos
+        x = padding
+        if logo:
+            logo_y = (height - logo.height) // 2
+            img.paste(logo, (x, logo_y), logo)
+            x += logo_w + padding
+
+        # Draw round name
+        text_y = (height - 8) // 2  # 8px font
+        self._draw_text_with_outline(draw, name, (x, text_y), font, fill=COLOR_GOLD)
+        x += text_width + padding
+
+        if logo:
+            logo_y = (height - logo.height) // 2
+            img.paste(logo, (x, logo_y), logo)
+
+        return img
+
+    def _create_game_tile(self, game: Dict) -> Image.Image:
+        """Create a single game tile for the scrolling ticker."""
+        height = self.display_height
+        font_score = self.fonts["score"]
+        font_time = self.fonts["time"]
+        font_detail = self.fonts["detail"]
+
+        # Load team logos
+        away_logo = self._get_team_logo(game["away_abbr"])
+        home_logo = self._get_team_logo(game["home_abbr"])
+        logo_w = 0
+        if away_logo:
+            logo_w = max(logo_w, away_logo.width)
+        if home_logo:
+            logo_w = max(logo_w, home_logo.width)
+        if logo_w == 0:
+            logo_w = 24
+
+        # Build text elements
+        away_seed_str = f"({game['away_seed']})" if self.show_seeds and game.get("away_seed", 0) > 0 else ""
+        home_seed_str = f"({game['home_seed']})" if self.show_seeds and game.get("home_seed", 0) > 0 else ""
+        away_text = f"{away_seed_str}{game['away_abbr']}"
+        home_text = f"{game['home_abbr']}{home_seed_str}"
+
+        # Measure text widths
+        tmp = Image.new("RGB", (1, 1))
+        tmp_draw = ImageDraw.Draw(tmp)
+        away_text_w = int(tmp_draw.textlength(away_text, font=font_detail))
+        home_text_w = int(tmp_draw.textlength(home_text, font=font_detail))
+
+        # Center content: status line
+        if game["is_live"]:
+            if game["is_halftime"]:
+                status_text = "Halftime"
+            else:
+                status_text = f"{game['period_text']} {game['clock']}".strip()
+        elif game["is_final"]:
+            status_text = game.get("period_text", "Final")
+        else:
+            status_text = f"{game['game_date']} {game['game_time']}".strip()
+
+        status_w = int(tmp_draw.textlength(status_text, font=font_time))
+
+        # Score line (for live/final)
+        score_text = ""
+        if game["is_live"] or game["is_final"]:
+            score_text = f"{game['away_score']}-{game['home_score']}"
+        score_w = int(tmp_draw.textlength(score_text, font=font_score)) if score_text else 0
+
+        # Calculate tile width
+        h_pad = 4
+        center_w = max(status_w, score_w, 40)
+        tile_w = h_pad + logo_w + h_pad + away_text_w + h_pad + center_w + h_pad + home_text_w + h_pad + logo_w + h_pad
+
+        img = Image.new("RGB", (tile_w, height), COLOR_BLACK)
+        draw = ImageDraw.Draw(img)
+
+        # Paste away logo
+        x = h_pad
+        if away_logo:
+            logo_y = (height - away_logo.height) // 2
+            img.paste(away_logo, (x, logo_y), away_logo)
+        x += logo_w + h_pad
+
+        # Away team text (seed + abbr)
+        is_fav_away = game["away_abbr"] in self.favorite_teams if self.favorite_teams else False
+        away_color = COLOR_GOLD if is_fav_away else COLOR_WHITE
+        if game["is_final"] and game["winner_side"] == "away" and self.highlight_upsets and game["is_upset"]:
+            away_color = COLOR_GOLD
+        team_text_y = (height - 6) // 2 - 5  # Upper half
+        self._draw_text_with_outline(draw, away_text, (x, team_text_y), font_detail, fill=away_color)
+        x += away_text_w + h_pad
+
+        # Center block
+        center_x = x
+        center_mid = center_x + center_w // 2
+
+        # Status text (top center of center block)
+        status_x = center_mid - status_w // 2
+        status_y = 2
+        status_color = COLOR_GREEN if game["is_live"] else COLOR_GRAY
+        self._draw_text_with_outline(draw, status_text, (status_x, status_y), font_time, fill=status_color)
+
+        # Score (bottom center of center block, for live/final)
+        if score_text:
+            score_x = center_mid - score_w // 2
+            score_y = height - 13
+            # Upset highlighting
+            if game["is_final"] and game["is_upset"] and self.highlight_upsets:
+                score_color = COLOR_GOLD
+            elif game["is_live"]:
+                score_color = COLOR_WHITE
+            else:
+                score_color = COLOR_WHITE
+            self._draw_text_with_outline(draw, score_text, (score_x, score_y), font_score, fill=score_color)
+
+        # Date for final games (below score)
+        if game["is_final"] and game.get("game_date"):
+            date_w = int(draw.textlength(game["game_date"], font=font_detail))
+            date_x = center_mid - date_w // 2
+            date_y = height - 6
+            self._draw_text_with_outline(draw, game["game_date"], (date_x, date_y), font_detail, fill=COLOR_DIM)
+
+        x = center_x + center_w + h_pad
+
+        # Home team text
+        is_fav_home = game["home_abbr"] in self.favorite_teams if self.favorite_teams else False
+        home_color = COLOR_GOLD if is_fav_home else COLOR_WHITE
+        if game["is_final"] and game["winner_side"] == "home" and self.highlight_upsets and game["is_upset"]:
+            home_color = COLOR_GOLD
+        self._draw_text_with_outline(draw, home_text, (x, team_text_y), font_detail, fill=home_color)
+        x += home_text_w + h_pad
+
+        # Paste home logo
+        if home_logo:
+            logo_y = (height - home_logo.height) // 2
+            img.paste(home_logo, (x, logo_y), home_logo)
+
+        return img
+
+    def _create_ticker_image(self) -> None:
+        """Build the full scrolling ticker image from game tiles."""
+        if not self.games_data:
+            self.ticker_image = None
+            if self.scroll_helper:
+                self.scroll_helper.clear_cache()
+            return
+
+        grouped = self._process_games(self.games_data)
+        content_items: List[Image.Image] = []
+
+        # Order rounds by significance (most important first)
+        sorted_rounds = sorted(grouped.keys(), key=lambda r: ROUND_ORDER.get(r, 6))
+
+        for rnd in sorted_rounds:
+            games = grouped[rnd]
+            if not games:
+                continue
+
+            # Add round separator
+            if self.show_round_logos and rnd:
+                separator = self._create_round_separator(rnd)
+                content_items.append(separator)
+
+            # Add game tiles
+            for game in games:
+                tile = self._create_game_tile(game)
+                content_items.append(tile)
+
+        if not content_items:
+            self.ticker_image = None
+            if self.scroll_helper:
+                self.scroll_helper.clear_cache()
+            return
+
+        if not self.scroll_helper:
+            self.ticker_image = None
+            return
+
+        gap_width = 16
+
+        # Use ScrollHelper to create the scrolling image
+        self.ticker_image = self.scroll_helper.create_scrolling_image(
+            content_items=content_items,
+            item_gap=gap_width,
+            element_gap=0,
+        )
+
+        self.total_scroll_width = self.scroll_helper.total_scroll_width
+        self.dynamic_duration = self.scroll_helper.get_dynamic_duration()
+
+        self.logger.info(
+            f"Ticker image created: {self.ticker_image.width}px wide, "
+            f"{len(self.games_data)} games, dynamic_duration={self.dynamic_duration:.0f}s"
+        )
+
+    # ------------------------------------------------------------------
+    # Plugin lifecycle
+    # ------------------------------------------------------------------
+
+    def update(self) -> None:
+        """Fetch and process tournament data."""
+        if not self.enabled:
+            return
+
+        current_time = time.time()
+        # Use shorter interval if live games detected
+        interval = 60 if self._has_live_games else self.update_interval
+        if current_time - self.last_update < interval:
+            return
+
+        with self._update_lock:
+            self.last_update = current_time
+
+            if not self._is_tournament_window():
+                self.logger.debug("Outside tournament window, skipping fetch")
+                self.games_data = []
+                self.ticker_image = None
+                if self.scroll_helper:
+                    self.scroll_helper.clear_cache()
+                return
+
+            try:
+                games = self._fetch_tournament_data()
+                self._has_live_games = any(g["is_live"] for g in games)
+                self.games_data = games
+                self._create_ticker_image()
+                self.logger.info(
+                    f"Updated: {len(games)} games, "
+                    f"live={self._has_live_games}"
+                )
+            except Exception as e:
+                self.logger.error(f"Update error: {e}", exc_info=True)
+
+    def display(self, force_clear: bool = False) -> None:
+        """Render one scroll frame."""
+        if not self.enabled:
+            return
+
+        if force_clear or self._display_start_time is None:
+            self._display_start_time = time.time()
+            if self.scroll_helper:
+                self.scroll_helper.reset_scroll()
+            self._end_reached_logged = False
+
+        if not self.games_data or self.ticker_image is None:
+            self._display_fallback()
+            return
+
+        if not self.scroll_helper:
+            self._display_fallback()
+            return
+
+        try:
+            if self.loop or not self.scroll_helper.is_scroll_complete():
+                self.scroll_helper.update_scroll_position()
+            elif not self._end_reached_logged:
+                self.logger.info("Scroll complete")
+                self._end_reached_logged = True
+
+            visible = self.scroll_helper.get_visible_portion()
+            if visible is None:
+                self._display_fallback()
+                return
+
+            self.dynamic_duration = self.scroll_helper.get_dynamic_duration()
+
+            matrix_w = self.display_manager.matrix.width
+            matrix_h = self.display_manager.matrix.height
+            if not hasattr(self.display_manager, "image") or self.display_manager.image is None:
+                self.display_manager.image = Image.new("RGB", (matrix_w, matrix_h), COLOR_BLACK)
+            self.display_manager.image.paste(visible, (0, 0))
+            self.display_manager.update_display()
+            self.scroll_helper.log_frame_rate()
+
+        except Exception as e:
+            self.logger.error(f"Display error: {e}", exc_info=True)
+            self._display_fallback()
+
+    def _display_fallback(self) -> None:
+        w = self.display_manager.matrix.width
+        h = self.display_manager.matrix.height
+        img = Image.new("RGB", (w, h), COLOR_BLACK)
+        draw = ImageDraw.Draw(img)
+
+        if self._is_tournament_window():
+            text = "No games"
+        else:
+            text = "Off-season"
+
+        text_w = int(draw.textlength(text, font=self.fonts["time"]))
+        text_x = (w - text_w) // 2
+        text_y = (h - 8) // 2
+        draw.text((text_x, text_y), text, font=self.fonts["time"], fill=COLOR_GRAY)
+
+        # Show March Madness logo if available
+        if self._march_madness_logo:
+            logo_y = (h - self._march_madness_logo.height) // 2
+            img.paste(self._march_madness_logo, (2, logo_y), self._march_madness_logo)
+
+        self.display_manager.image = img
+        self.display_manager.update_display()
+
+    # ------------------------------------------------------------------
+    # Duration / cycle management
+    # ------------------------------------------------------------------
+
+    def get_display_duration(self) -> float:
+        current_time = time.time()
+        if self._cached_dynamic_duration is not None:
+            cache_age = current_time - self._duration_cache_time
+            if cache_age < 5.0:
+                return self._cached_dynamic_duration
+
+        self._cached_dynamic_duration = self.dynamic_duration
+        self._duration_cache_time = current_time
+        return self.dynamic_duration
+
+    def supports_dynamic_duration(self) -> bool:
+        if not self.enabled:
+            return False
+        return self.dynamic_duration_enabled
+
+    def is_cycle_complete(self) -> bool:
+        if not self.supports_dynamic_duration():
+            return True
+        if self._display_start_time is not None and self.dynamic_duration > 0:
+            elapsed = time.time() - self._display_start_time
+            if elapsed >= self.dynamic_duration:
+                return True
+        if not self.loop and self.scroll_helper and self.scroll_helper.is_scroll_complete():
+            return True
+        return False
+
+    def reset_cycle_state(self) -> None:
+        super().reset_cycle_state()
+        self._display_start_time = None
+        self._end_reached_logged = False
+        if self.scroll_helper:
+            self.scroll_helper.reset_scroll()
+
+    # ------------------------------------------------------------------
+    # Vegas mode
+    # ------------------------------------------------------------------
+
+    def get_vegas_content(self):
+        if not self.games_data:
+            return None
+        tiles = []
+        for game in self.games_data:
+            tiles.append(self._create_game_tile(game))
+        return tiles if tiles else None
+
+    def get_vegas_content_type(self) -> str:
+        return "multi"
+
+    # ------------------------------------------------------------------
+    # Info / cleanup
+    # ------------------------------------------------------------------
+
+    def get_info(self) -> Dict:
+        info = super().get_info()
+        info["total_games"] = len(self.games_data)
+        info["has_live_games"] = self._has_live_games
+        info["dynamic_duration"] = self.dynamic_duration
+        info["tournament_window"] = self._is_tournament_window()
+        return info
+
+    def cleanup(self) -> None:
+        self.games_data = []
+        self.ticker_image = None
+        if self.scroll_helper:
+            self.scroll_helper.clear_cache()
+        self._team_logo_cache.clear()
+        if self.session:
+            self.session.close()
+            self.session = None
+        super().cleanup()

plugin-repos/march-madness/manifest.json

@@ -0,0 +1,37 @@
+{
+  "id": "march-madness",
+  "name": "March Madness",
+  "version": "1.0.0",
+  "description": "NCAA March Madness tournament bracket tracker with round branding, seeded matchups, live scores, and upset highlighting",
+  "author": "ChuckBuilds",
+  "category": "sports",
+  "tags": [
+    "ncaa",
+    "basketball",
+    "march-madness",
+    "tournament",
+    "bracket",
+    "scrolling"
+  ],
+  "repo": "https://github.com/ChuckBuilds/ledmatrix-plugins",
+  "branch": "main",
+  "plugin_path": "plugins/march-madness",
+  "versions": [
+    {
+      "version": "1.0.0",
+      "ledmatrix_min": "2.0.0",
+      "released": "2026-02-16"
+    }
+  ],
+  "stars": 0,
+  "downloads": 0,
+  "last_updated": "2026-02-16",
+  "verified": true,
+  "screenshot": "",
+  "display_modes": [
+    "march_madness"
+  ],
+  "dependencies": {},
+  "entry_point": "manager.py",
+  "class_name": "MarchMadnessPlugin"
+}

plugin-repos/march-madness/requirements.txt

@@ -0,0 +1,5 @@
+requests>=2.33.0
+urllib3>=2.6.3
+Pillow>=12.2.0
+pytz>=2022.1
+numpy>=1.24.0

plugin-repos/mqtt-notifications

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/mqtt-notifications

plugin-repos/news

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/news

plugin-repos/odds-ticker

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/odds-ticker

plugin-repos/of-the-day

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/of-the-day

plugin-repos/olympics

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/olympics

plugin-repos/soccer-scoreboard

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/soccer-scoreboard

plugin-repos/static-image

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/static-image

plugin-repos/stock-news

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/stock-news

plugin-repos/text-display

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/text-display

plugin-repos/ufc-scoreboard

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/ufc-scoreboard

plugin-repos/youtube-stats

@@ -0,0 +1 @@
+../../ledmatrix-plugins/plugins/youtube-stats

requirements-test.txt

@@ -0,0 +1,9 @@
+# Test-only dependencies for the plugin safety harness and pytest suite.
+# Install alongside requirements.txt:  pip install -r requirements.txt -r requirements-test.txt
+#
+# pytest, pytest-cov, pytest-mock, and jsonschema are already pinned (with
+# major-version caps) in requirements.txt, so they are intentionally NOT
+# repeated here — re-pinning pytest to <9 collided with requirements.txt's
+# pytest>=9.0.3,<10 and made the two files impossible to install together.
+# Only declare what requirements.txt doesn't already provide.
+freezegun>=1.2,<2        # deterministic time for golden-image tests

requirements.txt

@@ -8,16 +8,11 @@ numpy>=1.24.0  # For fast array operations in ScrollHelper (compatible with 2.x)
 
 # Timezone handling
 pytz>=2024.2,<2025.0  # Updated for latest timezone data
-timezonefinder>=6.5.0,<7.0.0  # Updated for better performance and accuracy
-geopy>=2.4.1,<3.0.0
 
 # HTTP requests
 requests>=2.33.0,<3.0.0
 
 # Google API integration
-google-auth-oauthlib>=1.2.0,<2.0.0
-google-auth-httplib2>=0.2.0,<1.0.0
-google-api-python-client>=2.147.0,<3.0.0
 
 # Font rendering
 freetype-py>=2.5.1,<3.0.0
@@ -29,10 +24,8 @@ spotipy>=2.25.2,<3.0.0
 Flask>=3.1.3,<4.0.0
 
 # Text processing
-unidecode>=1.3.8,<2.0.0
 
 # Calendar integration
-icalevents>=0.1.27,<1.0.0
 
 # WebSocket support
 python-socketio>=5.14.0,<6.0.0
@@ -43,6 +36,9 @@ websocket-client>=1.8.0,<2.0.0
 # JSON Schema validation
 jsonschema>=4.20.0,<5.0.0
 
+# Requirement specifier parsing (plugin dependency satisfaction checks)
+packaging>=23.0,<27.0
+
 # Testing dependencies
 pytest>=9.0.3,<10.0.0
 pytest-cov>=4.1.0,<5.0.0

scripts/audit_plugins.py

@@ -0,0 +1,296 @@
+#!/usr/bin/env python3
+"""
+LEDMatrix Plugin Security Auditor
+
+Performs AST-based security analysis of all Python files in plugin directories.
+Designed to run in CI — exits non-zero on CRITICAL findings only.
+
+Usage:
+    python scripts/audit_plugins.py
+    python scripts/audit_plugins.py --verbose
+    python scripts/audit_plugins.py --plugin hello-world
+    python scripts/audit_plugins.py --output results.json
+"""
+
+import ast
+import argparse
+import json
+import sys
+from dataclasses import dataclass, asdict
+from pathlib import Path
+from datetime import datetime, timezone
+
+PROJECT_ROOT = Path(__file__).resolve().parent.parent
+
+PLUGIN_BASE_DIRS = [
+    PROJECT_ROOT / "plugins",
+    PROJECT_ROOT / "plugin-repos",
+]
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Finding dataclass
+# ─────────────────────────────────────────────────────────────────────────────
+
+@dataclass
+class Finding:
+    plugin_id: str
+    file: str
+    line: int
+    severity: str   # CRITICAL | WARNING | INFO
+    rule: str
+    message: str
+
+    def to_dict(self) -> dict:
+        return asdict(self)
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# AST visitor
+# ─────────────────────────────────────────────────────────────────────────────
+
+class _PluginVisitor(ast.NodeVisitor):
+    """Collect security findings from a single plugin Python file."""
+
+    def __init__(self, filepath: Path, plugin_id: str):
+        self.filepath = filepath
+        self.plugin_id = plugin_id
+        self.findings: list[Finding] = []
+
+    def _add(self, node: ast.AST, severity: str, rule: str, message: str) -> None:
+        self.findings.append(Finding(
+            plugin_id=self.plugin_id,
+            file=str(self.filepath.relative_to(PROJECT_ROOT)),
+            line=getattr(node, "lineno", 0),
+            severity=severity,
+            rule=rule,
+            message=message,
+        ))
+
+    def visit_Call(self, node: ast.Call) -> None:
+        # eval() / exec() — arbitrary code execution
+        if isinstance(node.func, ast.Name):
+            if node.func.id == "eval":
+                self._add(node, "CRITICAL", "PLUGIN-001",
+                          "eval() call — arbitrary code execution risk")
+            elif node.func.id == "exec":
+                self._add(node, "CRITICAL", "PLUGIN-002",
+                          "exec() call — arbitrary code execution risk")
+            elif node.func.id == "compile":
+                self._add(node, "WARNING", "PLUGIN-003",
+                          "compile() call — dynamic code compilation")
+
+        # subprocess.*(shell=True)
+        if isinstance(node.func, ast.Attribute):
+            is_subprocess = (
+                isinstance(node.func.value, ast.Name) and
+                node.func.value.id == "subprocess" and
+                node.func.attr in ("run", "call", "Popen", "check_call", "check_output")
+            )
+            if is_subprocess:
+                for kw in node.keywords:
+                    if (kw.arg == "shell" and
+                            isinstance(kw.value, ast.Constant) and
+                            kw.value.value is True):
+                        self._add(node, "WARNING", "PLUGIN-004",
+                                  f"subprocess.{node.func.attr}(shell=True) — "
+                                  f"shell injection risk if args include user input")
+
+            # os.system() — shell execution
+            is_os_system = (
+                isinstance(node.func.value, ast.Name) and
+                node.func.value.id == "os" and
+                node.func.attr == "system"
+            )
+            if is_os_system:
+                self._add(node, "WARNING", "PLUGIN-005",
+                          "os.system() call — prefer subprocess with list args")
+
+        self.generic_visit(node)
+
+    def visit_Import(self, node: ast.Import) -> None:
+        for alias in node.names:
+            self._check_import(node, alias.name)
+        self.generic_visit(node)
+
+    def visit_ImportFrom(self, node: ast.ImportFrom) -> None:
+        if node.module:
+            self._check_import(node, node.module)
+        self.generic_visit(node)
+
+    def _check_import(self, node: ast.AST, module_name: str) -> None:
+        dangerous = {
+            "ctypes": ("WARNING", "PLUGIN-010", "ctypes import — native code execution"),
+            "cffi": ("WARNING", "PLUGIN-011", "cffi import — native code execution"),
+            "pickle": ("WARNING", "PLUGIN-012",
+                       "pickle import — deserialization can execute arbitrary code"),
+            "marshal": ("WARNING", "PLUGIN-013",
+                        "marshal import — deserialization risk"),
+        }
+        for mod, (severity, rule, msg) in dangerous.items():
+            if module_name == mod or module_name.startswith(mod + "."):
+                self._add(node, severity, rule, msg)
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Per-plugin audit
+# ─────────────────────────────────────────────────────────────────────────────
+
+def audit_plugin(plugin_dir: Path) -> list[Finding]:
+    """Audit a single plugin directory. Returns all findings."""
+    findings: list[Finding] = []
+    plugin_id = plugin_dir.name
+
+    # Check for required files
+    for required_file, rule, msg in [
+        ("manifest.json", "PLUGIN-020",
+         "manifest.json missing — plugin may be incomplete"),
+        ("config_schema.json", "PLUGIN-021",
+         "config_schema.json missing — no input validation schema declared"),
+    ]:
+        if not (plugin_dir / required_file).exists():
+            findings.append(Finding(
+                plugin_id=plugin_id,
+                file=str((plugin_dir / required_file).relative_to(PROJECT_ROOT)),
+                line=0,
+                severity="WARNING",
+                rule=rule,
+                message=msg,
+            ))
+
+    # AST analysis of all Python files
+    for py_file in sorted(plugin_dir.rglob("*.py")):
+        try:
+            source = py_file.read_text(encoding="utf-8")
+            tree = ast.parse(source, filename=str(py_file))
+            visitor = _PluginVisitor(py_file, plugin_id)
+            visitor.visit(tree)
+            findings.extend(visitor.findings)
+        except SyntaxError as exc:
+            findings.append(Finding(
+                plugin_id=plugin_id,
+                file=str(py_file.relative_to(PROJECT_ROOT)),
+                line=getattr(exc, "lineno", 0) or 0,
+                severity="WARNING",
+                rule="PLUGIN-030",
+                message=f"Python syntax error — cannot be parsed: {exc}",
+            ))
+        except OSError as exc:
+            findings.append(Finding(
+                plugin_id=plugin_id,
+                file=str(py_file.relative_to(PROJECT_ROOT)),
+                line=0,
+                severity="INFO",
+                rule="PLUGIN-031",
+                message=f"Could not read file: {exc}",
+            ))
+
+    return findings
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Main
+# ─────────────────────────────────────────────────────────────────────────────
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description="LEDMatrix plugin security auditor",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    parser.add_argument("--plugin", "-p", default=None,
+                        help="Audit a specific plugin ID only")
+    parser.add_argument("--output", "-o", default=None,
+                        help="Write JSON results to this file")
+    parser.add_argument("--verbose", "-v", action="store_true",
+                        help="Show all findings, not just summary")
+    args = parser.parse_args()
+
+    print("=" * 60)
+    print("LEDMatrix Plugin Security Audit")
+    print(f"Project root: {PROJECT_ROOT}")
+    print("=" * 60)
+
+    all_findings: list[Finding] = []
+    plugins_scanned = 0
+
+    for base_dir in PLUGIN_BASE_DIRS:
+        if not base_dir.exists():
+            if args.verbose:
+                print(f"  ⏭️  Skipping {base_dir.name}/ (directory not found)")
+            continue
+
+        base_label = base_dir.relative_to(PROJECT_ROOT)
+        print(f"\n  Scanning {base_label}/")
+
+        for plugin_dir in sorted(base_dir.iterdir()):
+            if not plugin_dir.is_dir():
+                continue
+            if plugin_dir.name.startswith((".", "_")):
+                continue
+            if args.plugin and plugin_dir.name != args.plugin:
+                continue
+
+            findings = audit_plugin(plugin_dir)
+            all_findings.extend(findings)
+            plugins_scanned += 1
+
+            critical = [f for f in findings if f.severity == "CRITICAL"]
+            warnings = [f for f in findings if f.severity == "WARNING"]
+
+            if critical:
+                icon, label = "🚨", "CRITICAL"
+            elif warnings:
+                icon, label = "⚠️ ", "WARN   "
+            else:
+                icon, label = "✅", "PASS   "
+
+            print(f"    {icon} [{label}] {plugin_dir.name}"
+                  f" — {len(critical)} critical, {len(warnings)} warnings")
+
+            if args.verbose:
+                for f in findings:
+                    severity_icon = {"CRITICAL": "🚨", "WARNING": "⚠️ ", "INFO": "ℹ️ "}.get(
+                        f.severity, "  "
+                    )
+                    print(f"           {severity_icon} {f.rule} {f.file}:{f.line} — {f.message}")
+
+    # Summary
+    critical_findings = [f for f in all_findings if f.severity == "CRITICAL"]
+    warning_findings = [f for f in all_findings if f.severity == "WARNING"]
+
+    print(f"\n{'=' * 60}")
+    print(f"  Plugins scanned : {plugins_scanned}")
+    print(f"  CRITICAL        : {len(critical_findings)}")
+    print(f"  WARNING         : {len(warning_findings)}")
+
+    if critical_findings:
+        print("\n  🚨 CRITICAL findings:")
+        for f in critical_findings:
+            print(f"    {f.plugin_id} | {Path(f.file).name}:{f.line} | {f.message}")
+
+    # Write JSON output
+    if args.output:
+        output_data = {
+            "timestamp": datetime.now(timezone.utc).isoformat(),
+            "plugins_scanned": plugins_scanned,
+            "summary": {
+                "critical": len(critical_findings),
+                "warnings": len(warning_findings),
+            },
+            "findings": [f.to_dict() for f in all_findings],
+        }
+        Path(args.output).write_text(
+            json.dumps(output_data, indent=2), encoding="utf-8"
+        )
+        print(f"\n  Results written to: {args.output}")
+
+    if critical_findings:
+        print("\n  🚨 Blocking — CRITICAL issues must be resolved")
+        return 1
+
+    print("\n  ✅ No critical issues found")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/check_plugin.py

@@ -0,0 +1,232 @@
+#!/usr/bin/env python3
+"""
+Plugin safety checker.
+
+Renders a plugin across every declared screen (mode) and every supported matrix
+size, and fails if any screen crashes, overflows the panel, or (for plugins with
+committed golden images) drifts visually.
+
+Usage:
+    # Functional + bounds check across all sizes/modes:
+    python scripts/check_plugin.py --plugin clock-simple
+
+    # Every discovered plugin:
+    python scripts/check_plugin.py --all
+
+    # Dump PNGs for each size/mode so you can eyeball them:
+    python scripts/check_plugin.py --plugin ledmatrix-weather --out-dir /tmp/preview
+
+    # Refresh committed golden images after an intentional visual change:
+    python scripts/check_plugin.py --plugin clock-simple --update-golden \
+        --mock-data plugins/clock-simple/test/fixtures/mock.json
+
+Exit code is non-zero if any (plugin, size, mode) fails.
+"""
+
+import argparse
+import json
+import os
+import sys
+from pathlib import Path
+from typing import Dict, List, Optional
+
+PROJECT_ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(PROJECT_ROOT))
+
+os.environ['EMULATOR'] = 'true'
+
+from src.logging_config import get_logger  # noqa: E402
+from src.plugin_system.testing.loading import (  # noqa: E402
+    find_plugin_dir, load_config_defaults, load_harness_spec,
+)
+from src.plugin_system.testing.harness import (  # noqa: E402
+    RenderResult, render_plugin_matrix, compare_to_goldens, write_goldens,
+)
+from src.plugin_system.testing.sizes import (  # noqa: E402
+    parse_size_token, resolve_test_sizes, safe_mode_filename, size_label,
+)
+
+logger = get_logger("[Check Plugin]")
+
+DEFAULT_SEARCH_DIRS = [
+    str(PROJECT_ROOT / 'plugins'),
+    str(PROJECT_ROOT / 'plugin-repos'),
+]
+
+
+def discover_plugins(search_dirs: List[str]) -> List[str]:
+    """All plugin ids found across the search dirs (dirs containing manifest.json)."""
+    found = []
+    for d in search_dirs:
+        base = Path(d)
+        if not base.exists():
+            continue
+        for child in sorted(base.iterdir()):
+            if (child / 'manifest.json').exists() and child.name not in found:
+                found.append(child.name)
+    return found
+
+
+def parse_sizes(spec: Optional[str]):
+    if not spec:
+        return None
+    sizes = []
+    for token in spec.split(','):
+        if not token.strip():
+            continue
+        try:
+            sizes.append(parse_size_token(token))
+        except ValueError as exc:
+            raise SystemExit(str(exc)) from exc
+    return sizes
+
+
+def check_one(plugin_id: str, search_dirs: List[str], sizes, mock_data: Dict,
+              config: Dict, run_update: bool, out_dir: Optional[Path],
+              update_golden: bool, golden_dir_override: Optional[Path],
+              freeze_time: Optional[str]) -> List[RenderResult]:
+    plugin_dir = find_plugin_dir(plugin_id, search_dirs)
+    if not plugin_dir:
+        logger.error("Plugin '%s' not found in: %s", plugin_id, search_dirs)
+        return [RenderResult(plugin_id, 0, 0, "<not-found>", error="plugin directory not found")]
+
+    # Per-plugin test/harness.json holds the deterministic settings the committed
+    # goldens were generated with (config, mock data, frozen time, sizes). Load
+    # them so the CLI/CI render reproduces the golden the same way the pytest
+    # matrix path does; explicit CLI flags still override the file.
+    spec = load_harness_spec(plugin_dir)
+
+    # config_schema defaults (real-install behavior), then harness.json config,
+    # then CLI --config — most specific wins.
+    full_config = {"enabled": True}
+    full_config.update(load_config_defaults(plugin_dir))
+    full_config.update(spec.get("config", {}))
+    full_config.update(config)
+
+    # Precedence: CLI flag > LEDMATRIX_TEST_SIZES env > harness.json > default.
+    effective_sizes = sizes if sizes else resolve_test_sizes(spec.get("sizes"))
+    # CLI value wins when provided, else fall back to the harness.json setting.
+    effective_mock_data = mock_data or spec.get("mock_data_contents", {})
+    effective_freeze = freeze_time or spec.get("freeze_time")
+    effective_run_update = run_update and not spec.get("skip_update", False)
+
+    results = render_plugin_matrix(
+        plugin_id=plugin_id, plugin_dir=plugin_dir, config=full_config,
+        mock_data=effective_mock_data, sizes=effective_sizes,
+        run_update=effective_run_update, freeze_time=effective_freeze,
+    )
+
+    golden_dir = golden_dir_override or (plugin_dir / 'test' / 'golden')
+    if update_golden:
+        written = write_goldens(results, golden_dir)
+        logger.info("Wrote %d golden image(s) for %s to %s", written, plugin_id, golden_dir)
+    else:
+        compare_to_goldens(results, golden_dir)
+
+    if out_dir:
+        for r in results:
+            if r.image is None:
+                continue
+            dest = out_dir / plugin_id / size_label(r.width, r.height)
+            dest.mkdir(parents=True, exist_ok=True)
+            r.image.save(dest / f"{safe_mode_filename(r.mode)}.png", format="PNG")
+
+    return results
+
+
+def print_report(all_results: Dict[str, List[RenderResult]]) -> bool:
+    """Print a per-plugin grid. Returns True if everything passed."""
+    everything_ok = True
+    for plugin_id, results in all_results.items():
+        print(f"\n=== {plugin_id} ===")
+        for r in results:
+            if r.ok:
+                status = "PASS"
+                detail = ""
+                if r.golden_checked:
+                    detail = " (golden ✓)"
+                if r.update_error is not None:
+                    detail += f" (update warn: {r.update_error})"
+            else:
+                everything_ok = False
+                if r.error is not None:
+                    status, detail = "FAIL", f" error={r.error}"
+                elif r.overflow is not None:
+                    status, detail = "FAIL", f" overflow bbox={r.overflow}"
+                elif r.golden_ok is False:
+                    status = "FAIL"
+                    detail = f" golden drift: {r.golden_diff_pixels}px (max Δ={r.golden_max_delta})"
+                else:
+                    status, detail = "FAIL", ""
+            print(f"  [{status}] {r.size_label:>7}  {r.mode}{detail}")
+    print()
+    return everything_ok
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Check a plugin renders safely across sizes & screens")
+    group = parser.add_mutually_exclusive_group(required=True)
+    group.add_argument('--plugin', '-p', help='Plugin id to check')
+    group.add_argument('--all', action='store_true', help='Check every discovered plugin')
+    parser.add_argument('--plugin-dir', '-d', default=None, help='Directory to search for plugins')
+    parser.add_argument('--sizes', default=None, help='Comma-separated WxH list (default: all supported)')
+    parser.add_argument('--config', '-c', default='{}', help='Plugin config overrides as JSON')
+    parser.add_argument('--mock-data', '-m', default=None, help='Path to JSON file with mock cache data')
+    parser.add_argument('--out-dir', '-o', default=None, help='Also dump rendered PNGs here')
+    parser.add_argument('--skip-update', action='store_true', help='Skip calling update()')
+    parser.add_argument('--update-golden', action='store_true', help='Write/refresh golden images')
+    parser.add_argument('--golden-dir', default=None, help='Override golden dir (default: <plugin>/test/golden)')
+    parser.add_argument('--freeze-time', default=None,
+                        help='Freeze wall clock, e.g. "2025-08-01 15:25:00" (for time-dependent plugins)')
+    args = parser.parse_args()
+
+    search_dirs = [args.plugin_dir] if args.plugin_dir else DEFAULT_SEARCH_DIRS
+    sizes = parse_sizes(args.sizes)
+
+    try:
+        config = json.loads(args.config)
+    except json.JSONDecodeError as e:
+        logger.error("Invalid --config JSON: %s", e)
+        return 2
+    if not isinstance(config, dict):
+        logger.error("--config must be a JSON object, got %s", type(config).__name__)
+        return 2
+
+    mock_data = {}
+    if args.mock_data:
+        mock_path = Path(args.mock_data)
+        if not mock_path.exists():
+            logger.error("Mock data file not found: %s", args.mock_data)
+            return 2
+        with open(mock_path) as f:
+            mock_data = json.load(f)
+        if not isinstance(mock_data, dict):
+            logger.error("--mock-data must be a JSON object (key -> cache value), got %s",
+                         type(mock_data).__name__)
+            return 2
+
+    plugin_ids = discover_plugins(search_dirs) if args.all else [args.plugin]
+    if not plugin_ids:
+        logger.error("No plugins found in: %s", search_dirs)
+        return 2
+
+    out_dir = Path(args.out_dir) if args.out_dir else None
+    golden_dir_override = Path(args.golden_dir) if args.golden_dir else None
+
+    all_results: Dict[str, List[RenderResult]] = {}
+    for plugin_id in plugin_ids:
+        all_results[plugin_id] = check_one(
+            plugin_id=plugin_id, search_dirs=search_dirs, sizes=sizes,
+            mock_data=mock_data, config=config, run_update=not args.skip_update,
+            out_dir=out_dir, update_golden=args.update_golden,
+            golden_dir_override=golden_dir_override, freeze_time=args.freeze_time,
+        )
+
+    # When refreshing goldens we skip drift comparison, but a crash or overflow
+    # still means the plugin is broken — never let --update-golden mask that.
+    ok = print_report(all_results)
+    return 0 if ok else 1
+
+
+if __name__ == '__main__':
+    sys.exit(main())

scripts/clear_dependency_markers.sh

@@ -1,29 +0,0 @@
-#!/bin/bash
-# Clear all plugin dependency markers to force fresh dependency check
-# Useful after updating plugins or troubleshooting dependency issues
-
-echo "Clearing plugin dependency markers..."
-
-# Check both possible cache locations
-CACHE_DIRS=(
-    "/var/cache/ledmatrix"
-    "$HOME/.cache/ledmatrix"
-)
-
-for CACHE_DIR in "${CACHE_DIRS[@]}"; do
-    if [ -d "$CACHE_DIR" ]; then
-        echo "Checking $CACHE_DIR..."
-        marker_count=$(find "$CACHE_DIR" -name "plugin_*_deps_installed" 2>/dev/null | wc -l)
-        if [ "$marker_count" -gt 0 ]; then
-            echo "Found $marker_count dependency marker(s) in $CACHE_DIR"
-            find "$CACHE_DIR" -name "plugin_*_deps_installed" -delete
-            echo "Cleared $marker_count marker(s)"
-        else
-            echo "No dependency markers found in $CACHE_DIR"
-        fi
-    fi
-done
-
-echo "Done! Dependency markers cleared."
-echo "Next startup will check and install dependencies as needed."
-

scripts/dev/test_pillow_compat.py

@@ -55,7 +55,7 @@ def main():
     failures += not check("draw.textbbox",
         lambda: draw.textbbox((0, 0), "Test", font=font))
 
-    print("\nResampling (used in logo_helper, image_utils, sports base):")
+    print("\nResampling (used in logo_helper, sports base):")
     logo = Image.new('RGBA', (200, 200), (255, 128, 0, 200))
     failures += not check("Image.Resampling.LANCZOS exists",
         lambda: str(Image.Resampling.LANCZOS))

scripts/fix_perms/safe_pip_install.sh

@@ -0,0 +1,74 @@
+#!/bin/bash
+# safe_pip_install.sh — Install a requirements.txt as root after validating
+# that the resolved path is the project's own requirements.txt or a plugin's
+# requirements.txt under plugin-repos/ or plugins/.
+#
+# This script is intended to be called via sudo from the web interface, so
+# that packages a plugin declares end up visible to ledmatrix.service (which
+# runs as root) rather than only to whichever non-root user runs the web
+# interface. Plugin code already runs as root once loaded, so installing its
+# declared dependencies as root is not a new trust boundary.
+#
+# Usage: safe_pip_install.sh <requirements_txt_path>
+
+set -euo pipefail
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $0 <requirements_txt_path>" >&2
+    exit 1
+fi
+
+TARGET="$1"
+
+# Determine the project root (parent of scripts/fix_perms/)
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+# Allowed locations (resolved, no trailing slash):
+#   - the project's own requirements.txt
+#   - any requirements.txt under plugin-repos/ or plugins/
+ALLOWED_EXACT="$(realpath --canonicalize-missing "$PROJECT_ROOT/requirements.txt")"
+ALLOWED_BASES=(
+    "$(realpath --canonicalize-missing "$PROJECT_ROOT/plugin-repos")"
+    "$(realpath --canonicalize-missing "$PROJECT_ROOT/plugins")"
+)
+
+# Resolve the target path (follow symlinks); works even if it doesn't exist.
+RESOLVED_TARGET="$(realpath --canonicalize-missing "$TARGET")"
+
+# Must be named requirements.txt — never install from an arbitrary file.
+if [ "$(basename "$RESOLVED_TARGET")" != "requirements.txt" ]; then
+    echo "DENIED: $RESOLVED_TARGET is not a requirements.txt file" >&2
+    exit 2
+fi
+
+ALLOWED=false
+if [ "$RESOLVED_TARGET" = "$ALLOWED_EXACT" ]; then
+    ALLOWED=true
+else
+    for BASE in "${ALLOWED_BASES[@]}"; do
+        if [[ "$RESOLVED_TARGET" == "$BASE/"* ]]; then
+            ALLOWED=true
+            break
+        fi
+    done
+fi
+
+if [ "$ALLOWED" = false ]; then
+    echo "DENIED: $RESOLVED_TARGET is not an allowed requirements.txt location" >&2
+    echo "Allowed: $ALLOWED_EXACT, or any requirements.txt under: ${ALLOWED_BASES[*]}" >&2
+    exit 2
+fi
+
+if [ ! -f "$RESOLVED_TARGET" ]; then
+    echo "ERROR: $RESOLVED_TARGET does not exist" >&2
+    exit 3
+fi
+
+PYTHON_PATH="$(command -v python3)"
+# --ignore-installed: root's site-packages often has apt/dpkg-managed copies
+# of common libraries (requests, urllib3, ...) with no pip RECORD file, which
+# pip refuses to uninstall in place ("Cannot uninstall: no RECORD file was
+# found"). This tells pip to install the newer version alongside rather than
+# aborting the whole requirements.txt install over one such conflict.
+exec "$PYTHON_PATH" -m pip install --break-system-packages --ignore-installed -r "$RESOLVED_TARGET"

scripts/generate_report.py

@@ -0,0 +1,297 @@
+#!/usr/bin/env python3
+"""
+Security Report Generator
+
+Aggregates JSON output from all CI security audit jobs into a single
+Markdown report suitable for PR comments and artifact storage.
+
+Expected artifact layout (from actions/download-artifact@v4):
+    <artifact-dir>/
+        sast-results/
+            bandit-results.json
+            semgrep-results.json
+        dependency-audit-results/
+            pip-audit-results.json
+            safety-results.json
+        secrets-scan-results/
+            gitleaks-results.json
+        security-proofs-results/
+            security-proofs-results.json
+        plugin-audit-results/
+            plugin-audit-results.json
+
+Usage:
+    python scripts/generate_report.py --artifact-dir audit-artifacts/ --output report.md
+    python scripts/generate_report.py --artifact-dir audit-artifacts/ --output report.md --verbose
+"""
+
+import argparse
+import json
+import sys
+from pathlib import Path
+from datetime import datetime, timezone
+
+PROJECT_ROOT = Path(__file__).resolve().parent.parent
+
+# Gitleaks matches containing these strings are template placeholders, not real secrets
+_GITLEAKS_SUPPRESS = [
+    "YOUR_",
+    "PLACEHOLDER",
+    "_HERE",
+    "example.com",
+    "config_secrets.template",
+]
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Helpers
+# ─────────────────────────────────────────────────────────────────────────────
+
+def _load(path: Path) -> dict | list | None:
+    """Load JSON file, returning None on any error."""
+    try:
+        return json.loads(path.read_text(encoding="utf-8"))
+    except (json.JSONDecodeError, FileNotFoundError, OSError):
+        return None
+
+
+def _md_table_row(*cells: str) -> str:
+    return "| " + " | ".join(str(c) for c in cells) + " |"
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Per-tool summarizers
+# Returns: (markdown_lines: list[str], critical_count: int)
+# ─────────────────────────────────────────────────────────────────────────────
+
+def _summarize_bandit(artifact_dir: Path) -> tuple[list[str], int]:
+    data = _load(artifact_dir / "sast-results" / "bandit-results.json")
+    if data is None:
+        return ["_bandit results not available_"], 0
+
+    results = data.get("results", [])
+    high = [r for r in results if r.get("issue_severity") == "HIGH"]
+    medium = [r for r in results if r.get("issue_severity") == "MEDIUM"]
+    low = [r for r in results if r.get("issue_severity") == "LOW"]
+
+    lines = [
+        f"**Bandit**: {len(high)} HIGH · {len(medium)} MEDIUM · {len(low)} LOW"
+    ]
+
+    if high:
+        lines += [
+            "",
+            "| Severity | File | Line | Issue |",
+            "| --- | --- | --- | --- |",
+        ]
+        for r in high[:10]:
+            fname = Path(r.get("filename", "")).name
+            lines.append(_md_table_row(
+                "HIGH", f"`{fname}`",
+                str(r.get("line_number", "?")),
+                r.get("issue_text", "")
+            ))
+        if len(high) > 10:
+            lines.append(f"_… and {len(high) - 10} more HIGH findings_")
+
+    return lines, len(high)
+
+
+def _summarize_pip_audit(artifact_dir: Path) -> tuple[list[str], int]:
+    data = _load(artifact_dir / "dependency-audit-results" / "pip-audit-results.json")
+    if data is None:
+        return ["_pip-audit results not available_"], 0
+
+    # pip-audit JSON format: {"dependencies": [{"name": ..., "vulns": [...]}]}
+    vulns: list[dict] = []
+    for dep in data.get("dependencies", []):
+        for v in dep.get("vulns", []):
+            vulns.append({"package": dep.get("name", "?"), **v})
+
+    lines = [f"**pip-audit**: {len(vulns)} vulnerabilities found"]
+
+    if vulns:
+        lines += ["", "| Package | ID | Fix |", "| --- | --- | --- |"]
+        for v in vulns[:10]:
+            fix = v.get("fix_versions", ["none"])
+            fix_str = ", ".join(fix) if fix else "none"
+            lines.append(_md_table_row(
+                v.get("package", "?"),
+                v.get("id", "?"),
+                fix_str,
+            ))
+
+    # Treat known vulnerabilities as warnings, not critical (they may be unavoidable)
+    return lines, 0
+
+
+def _summarize_gitleaks(artifact_dir: Path) -> tuple[list[str], int]:
+    data = _load(artifact_dir / "secrets-scan-results" / "gitleaks-results.json")
+    if data is None:
+        return ["_gitleaks results not available_"], 0
+
+    if not isinstance(data, list):
+        data = []
+
+    real_findings = []
+    suppressed = 0
+    for finding in data:
+        secret_val = str(finding.get("Secret", "") or finding.get("Match", ""))
+        if any(p in secret_val for p in _GITLEAKS_SUPPRESS):
+            suppressed += 1
+        else:
+            real_findings.append(finding)
+
+    lines = [
+        f"**Gitleaks**: {len(real_findings)} finding(s) "
+        f"({suppressed} suppressed as template placeholders)"
+    ]
+
+    if real_findings:
+        lines += ["", "| Rule | File | Line | Description |", "| --- | --- | --- | --- |"]
+        for f in real_findings[:10]:
+            fname = Path(f.get("File", "")).name
+            lines.append(_md_table_row(
+                f.get("RuleID", "?"),
+                f"`{fname}`",
+                str(f.get("StartLine", "?")),
+                f.get("Description", ""),
+            ))
+
+    critical = len(real_findings)  # any real secret is critical
+    return lines, critical
+
+
+def _summarize_security_proofs(artifact_dir: Path) -> tuple[list[str], int]:
+    data = _load(artifact_dir / "security-proofs-results" / "security-proofs-results.json")
+    if data is None:
+        return ["_security proofs results not available_"], 0
+
+    if not isinstance(data, list):
+        data = []
+
+    critical = [r for r in data if r.get("severity") == "CRITICAL"]
+    warnings = [r for r in data if r.get("severity") == "WARNING"]
+    passed = [r for r in data if r.get("severity") == "PASS"]
+    skipped = [r for r in data if r.get("severity") == "SKIP"]
+
+    lines = [
+        f"**Security Proofs**: "
+        f"{len(passed)} PASS · {len(warnings)} WARN · "
+        f"{len(critical)} CRITICAL · {len(skipped)} SKIP",
+        "",
+    ]
+
+    _icon = {"PASS": "✅", "INFO": "ℹ️", "WARNING": "⚠️",
+             "CRITICAL": "🚨", "SKIP": "⏭️"}
+    for r in data:
+        icon = _icon.get(r.get("severity", ""), "❓")
+        lines.append(
+            f"- {icon} **{r.get('test_id', '?')}**: {r.get('message', '')}"
+        )
+        if r.get("details") and r.get("severity") in ("CRITICAL", "WARNING"):
+            lines.append(f"  - _{r['details']}_")
+
+    return lines, len(critical)
+
+
+def _summarize_plugin_audit(artifact_dir: Path) -> tuple[list[str], int]:
+    data = _load(artifact_dir / "plugin-audit-results" / "plugin-audit-results.json")
+    if data is None:
+        return ["_plugin audit results not available_"], 0
+
+    summary = data.get("summary", {})
+    findings = data.get("findings", [])
+    critical_findings = [f for f in findings if f.get("severity") == "CRITICAL"]
+    warning_findings = [f for f in findings if f.get("severity") == "WARNING"]
+
+    lines = [
+        f"**Plugin Audit**: {data.get('plugins_scanned', '?')} plugins scanned — "
+        f"{summary.get('critical', 0)} CRITICAL · {summary.get('warnings', 0)} WARNINGS"
+    ]
+
+    if critical_findings:
+        lines += ["", "| Plugin | File | Line | Rule | Message |",
+                  "| --- | --- | --- | --- | --- |"]
+        for f in critical_findings[:10]:
+            fname = Path(f.get("file", "")).name
+            lines.append(_md_table_row(
+                f.get("plugin_id", "?"),
+                f"`{fname}`",
+                str(f.get("line", "?")),
+                f.get("rule", "?"),
+                f.get("message", ""),
+            ))
+
+    if warning_findings and not critical_findings:
+        lines.append(f"\n_{len(warning_findings)} warning(s) found — see artifact for details_")
+
+    return lines, summary.get("critical", 0)
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Main
+# ─────────────────────────────────────────────────────────────────────────────
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description="Generate consolidated security audit report",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    parser.add_argument("--artifact-dir", required=True,
+                        help="Directory containing downloaded CI artifacts")
+    parser.add_argument("--output", "-o", required=True,
+                        help="Output Markdown file path")
+    parser.add_argument("--verbose", "-v", action="store_true")
+    args = parser.parse_args()
+
+    artifact_dir = Path(args.artifact_dir)
+    timestamp = datetime.now(timezone.utc).strftime("%Y-%m-%d %H:%M UTC")
+
+    bandit_lines, bandit_crit = _summarize_bandit(artifact_dir)
+    pip_audit_lines, pip_audit_crit = _summarize_pip_audit(artifact_dir)
+    gitleaks_lines, gitleaks_crit = _summarize_gitleaks(artifact_dir)
+    proofs_lines, proofs_crit = _summarize_security_proofs(artifact_dir)
+    plugins_lines, plugins_crit = _summarize_plugin_audit(artifact_dir)
+
+    total_critical = bandit_crit + pip_audit_crit + gitleaks_crit + proofs_crit + plugins_crit
+    overall = "ACTION REQUIRED 🚨" if total_critical > 0 else "PASSED ✅"
+
+    def section(title: str, lines: list[str]) -> str:
+        return f"### {title}\n\n" + "\n".join(lines) + "\n"
+
+    report = f"""## 🔒 Security Audit — {overall}
+
+_Generated: {timestamp}_
+
+| Critical | High/Warn | Overall |
+| :---: | :---: | :---: |
+| {'🚨 ' + str(total_critical) if total_critical else '✅ 0'} | ⚠️ see below | {overall} |
+
+---
+
+{section('SAST — Bandit', bandit_lines)}
+{section('Dependencies — pip-audit', pip_audit_lines)}
+{section('Secrets — Gitleaks', gitleaks_lines)}
+{section('LEDMatrix Security Proofs', proofs_lines)}
+{section('Plugin Security Audit', plugins_lines)}
+---
+
+_Total critical findings: **{total_critical}**_
+"""
+
+    output_path = Path(args.output)
+    output_path.write_text(report, encoding="utf-8")
+
+    if args.verbose:
+        print(f"  Report written to: {output_path}")
+        print(f"  Status: {overall}")
+        print(f"  Critical findings: {total_critical}")
+        print(f"    bandit={bandit_crit}  pip-audit={pip_audit_crit}  "
+              f"gitleaks={gitleaks_crit}  proofs={proofs_crit}  plugins={plugins_crit}")
+
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/install/configure_web_sudo.sh

@@ -33,6 +33,7 @@ POWEROFF_PATH=$(command -v poweroff)  || true
 BASH_PATH=$(command -v bash)        || true
 JOURNALCTL_PATH=$(command -v journalctl) || true
 SAFE_RM_PATH="$PROJECT_ROOT/scripts/fix_perms/safe_plugin_rm.sh"
+SAFE_PIP_INSTALL_PATH="$PROJECT_ROOT/scripts/fix_perms/safe_pip_install.sh"
 
 # Validate required commands (systemctl, bash, python3 are essential)
 for CMD_NAME in SYSTEMCTL_PATH BASH_PATH PYTHON_PATH; do
@@ -48,11 +49,15 @@ if [ ${#MISSING_CMDS[@]} -gt 0 ]; then
     exit 1
 fi
 
-# Validate helper script exists
+# Validate helper scripts exist
 if [ ! -f "$SAFE_RM_PATH" ]; then
     echo "Error: Safe plugin removal helper not found: $SAFE_RM_PATH" >&2
     exit 1
 fi
+if [ ! -f "$SAFE_PIP_INSTALL_PATH" ]; then
+    echo "Error: Safe pip install helper not found: $SAFE_PIP_INSTALL_PATH" >&2
+    exit 1
+fi
 
 echo "Command paths:"
 echo "  Python: $PYTHON_PATH"
@@ -62,6 +67,7 @@ echo "  Poweroff: ${POWEROFF_PATH:-(not found, skipping)}"
 echo "  Bash: $BASH_PATH"
 echo "  Journalctl: ${JOURNALCTL_PATH:-(not found, skipping)}"
 echo "  Safe plugin rm: $SAFE_RM_PATH"
+echo "  Safe pip install: $SAFE_PIP_INSTALL_PATH"
 
 # Create a temporary sudoers file
 TEMP_SUDOERS="/tmp/ledmatrix_web_sudoers_$$"
@@ -101,13 +107,22 @@ TEMP_SUDOERS="/tmp/ledmatrix_web_sudoers_$$"
     fi
 
     # Required: python3, bash
-    echo "$WEB_USER ALL=(ALL) NOPASSWD: $PYTHON_PATH $PROJECT_DIR/display_controller.py"
+    # NOTE: display_controller.py/start_display.sh/stop_display.sh live at the
-    echo "$WEB_USER ALL=(ALL) NOPASSWD: $BASH_PATH $PROJECT_DIR/start_display.sh"
+    # project root, not under scripts/install/ (where this script lives) —
-    echo "$WEB_USER ALL=(ALL) NOPASSWD: $BASH_PATH $PROJECT_DIR/stop_display.sh"
+    # must use PROJECT_ROOT here, not PROJECT_DIR.
+    echo "$WEB_USER ALL=(ALL) NOPASSWD: $PYTHON_PATH $PROJECT_ROOT/display_controller.py"
+    echo "$WEB_USER ALL=(ALL) NOPASSWD: $BASH_PATH $PROJECT_ROOT/start_display.sh"
+    echo "$WEB_USER ALL=(ALL) NOPASSWD: $BASH_PATH $PROJECT_ROOT/stop_display.sh"
     echo ""
     echo "# Allow web user to remove plugin directories via vetted helper script"
     echo "# The helper validates that the target path resolves inside plugin-repos/ or plugins/"
     echo "$WEB_USER ALL=(ALL) NOPASSWD: $BASH_PATH $SAFE_RM_PATH *"
+    echo ""
+    echo "# Allow web user to install a plugin's requirements.txt as root via vetted"
+    echo "# helper script, so packages are visible to root-run ledmatrix.service"
+    echo "# (not just the web interface's own user). The helper validates the target"
+    echo "# is requirements.txt at the project root or under plugin-repos/ or plugins/."
+    echo "$WEB_USER ALL=(ALL) NOPASSWD: $BASH_PATH $SAFE_PIP_INSTALL_PATH *"
 } > "$TEMP_SUDOERS"
 
 echo ""
@@ -126,6 +141,7 @@ echo "- Run display_controller.py directly"
 echo "- Execute start_display.sh and stop_display.sh"
 echo "- Reboot and shutdown the system"
 echo "- Remove plugin directories (for update/uninstall when root-owned files block deletion)"
+echo "- Install plugin/base requirements.txt as root (so ledmatrix.service can see them)"
 echo ""
 
 # Ask for confirmation
@@ -147,6 +163,13 @@ fi
 if ! sudo chmod 755 "$SAFE_RM_PATH"; then
     echo "Warning: Could not set permissions on $SAFE_RM_PATH"
 fi
+echo "Hardening safe_pip_install.sh ownership..."
+if ! sudo chown root:root "$SAFE_PIP_INSTALL_PATH"; then
+    echo "Warning: Could not set ownership on $SAFE_PIP_INSTALL_PATH"
+fi
+if ! sudo chmod 755 "$SAFE_PIP_INSTALL_PATH"; then
+    echo "Warning: Could not set permissions on $SAFE_PIP_INSTALL_PATH"
+fi
 
 if sudo cp "$TEMP_SUDOERS" /etc/sudoers.d/ledmatrix_web; then
     echo "Configuration applied successfully!"
@@ -160,7 +183,7 @@ if sudo cp "$TEMP_SUDOERS" /etc/sudoers.d/ledmatrix_web; then
         echo "✗ systemctl status ledmatrix.service - Failed"
     fi
     
-    if sudo -n test -f "$PROJECT_DIR/start_display.sh"; then
+    if sudo -n test -f "$PROJECT_ROOT/start_display.sh"; then
         echo "✓ File access test - OK"
     else
         echo "✗ File access test - Failed"

scripts/install/one-shot-install.sh

@@ -340,9 +340,14 @@ main() {
     echo ""
     
     # Execute with proper error handling and non-interactive mode
-    # Temporarily disable errexit to capture exit code instead of exiting immediately
+    # Temporarily disable errexit AND the ERR trap to capture exit code instead of
+    # exiting immediately. `set +e` alone does not suppress the ERR trap, so without
+    # `trap '' ERR` a non-zero exit from first_time_install.sh would trigger on_error
+    # here with the generic "Main installation" message instead of the detailed
+    # if/else handling below.
     set +e
-    
+    trap '' ERR
+
     # Check /tmp permissions - only fix if actually wrong (common in automated scenarios)
     # When running manually, /tmp usually has correct permissions (1777)
     TMP_PERMS=$(stat -c '%a' /tmp 2>/dev/null || echo "unknown")
@@ -370,6 +375,7 @@ main() {
         sudo -E env TMPDIR=/tmp LEDMATRIX_ASSUME_YES=1 bash ./first_time_install.sh -y </dev/null
     fi
     INSTALL_EXIT_CODE=$?
+    trap 'on_error $LINENO' ERR  # Re-enable ERR trap
     set -e  # Re-enable errexit
     
     if [ $INSTALL_EXIT_CODE -eq 0 ]; then

scripts/install_dependencies_apt.py

@@ -6,82 +6,143 @@ then falls back to pip with --break-system-packages
 
 import subprocess
 import sys
+import tempfile
 import warnings
+from collections import deque
 from pathlib import Path
+from typing import List, Tuple
 
-def install_via_apt(package_name):
+# How many trailing lines of a failed command's output to keep for the
-    """Try to install a package via apt."""
+# end-of-run failure summary. Keeps the root cause near the end of the log,
-    try:
+# which is where first_time_install.sh's error handler tails from.
-        # Map pip package names to apt package names
+ERROR_TAIL_LINES = 15
-        apt_package_map = {
+
-            'flask': 'python3-flask',
+
-            'PIL': 'python3-pil',
+def _run(cmd: List[str]) -> Tuple[bool, str]:
-            'freetype': 'python3-freetype',
+    """Run a command, streaming combined stdout/stderr to a temp file.
-            'psutil': 'python3-psutil',
+
-            'werkzeug': 'python3-werkzeug',
+    Returns (success, output) instead of raising, so callers can report
-            'numpy': 'python3-numpy',
+    *why* a command failed rather than just that it failed. `output` is
-            'requests': 'python3-requests',
+    bounded to the last ERROR_TAIL_LINES lines so failures from very
-            'python-dateutil': 'python3-dateutil',
+    chatty commands (e.g. pip build logs) don't get buffered in memory.
-            'pytz': 'python3-tz',
+    """
-            'geopy': 'python3-geopy',
+    with tempfile.TemporaryFile(mode='w+b') as f:
-            'unidecode': 'python3-unidecode',
+        result = subprocess.run(cmd, stdout=f, stderr=subprocess.STDOUT)  # nosec B603 B607 - hardcoded apt/pip args  # nosemgrep
-            'websockets': 'python3-websockets',
+        f.seek(0)
-            'websocket-client': 'python3-websocket-client'
+        # Stream line-by-line so only the last ERROR_TAIL_LINES are ever held
-        }
+        # in memory, regardless of how much output the command produced.
-        
+        tail = deque(
-        apt_package = apt_package_map.get(package_name, f'python3-{package_name}')
+            (line.decode('utf-8', errors='replace').rstrip('\n') for line in f),
-        
+            maxlen=ERROR_TAIL_LINES,
-        print(f"Trying to install {apt_package} via apt...")
+        )
-        subprocess.check_call([
+    return result.returncode == 0, '\n'.join(tail)
-            'sudo', 'apt', 'update'
+
-        ], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+
-        
+def install_via_apt(package_name: str) -> Tuple[bool, str]:
-        subprocess.check_call([
+    """Try to install a package via apt. Returns (success, output)."""
-            'sudo', 'apt', 'install', '-y', apt_package
+    # Map pip package names to apt package names
-        ], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+    apt_package_map = {
-        
+        'flask': 'python3-flask',
+        'PIL': 'python3-pil',
+        'freetype': 'python3-freetype',
+        'psutil': 'python3-psutil',
+        'werkzeug': 'python3-werkzeug',
+        'numpy': 'python3-numpy',
+        'requests': 'python3-requests',
+        'python-dateutil': 'python3-dateutil',
+        'pytz': 'python3-tz',
+        'geopy': 'python3-geopy',
+        'unidecode': 'python3-unidecode',
+        'websockets': 'python3-websockets',
+        'websocket-client': 'python3-websocket-client'
+    }
+
+    apt_package = apt_package_map.get(package_name, f'python3-{package_name}')
+
+    print(f"Trying to install {apt_package} via apt...")
+    success, output = _run(['sudo', 'apt-get', '-o', 'DPkg::Lock::Timeout=180', 'install', '-y', apt_package])
+    if success:
         print(f"Successfully installed {apt_package} via apt")
-        return True
+        return True, ""
-        
-    except subprocess.CalledProcessError:
-        print(f"Failed to install {package_name} via apt, will try pip")
-        return False
 
-def install_via_pip(package_name):
+    print(f"Failed to install {apt_package} via apt, will try pip")
+    return False, output
+
+
+def install_via_pip(package_name: str) -> Tuple[bool, str]:
     """Install a package via pip with --break-system-packages and --prefer-binary.
 
     --break-system-packages allows pip to install into the system Python on
     Debian/Ubuntu-based systems without a virtual environment.
     --prefer-binary prefers pre-built wheels over source distributions to avoid
     exhausting /tmp space during compilation.
-    """
+    --ignore-installed stops pip from trying to *uninstall* packages that were
-    try:
+    installed by apt (e.g. python3-requests). Those Debian packages ship no
-        print(f"Installing {package_name} via pip...")
+    pip RECORD file, so an uninstall attempt fails with "uninstall-no-record-file"
-        subprocess.check_call([
+    and aborts the whole install. With --ignore-installed, pip lays the new
-            sys.executable, '-m', 'pip', 'install', '--break-system-packages', '--prefer-binary', package_name
+    version down in /usr/local where it shadows the apt copy instead of removing
-        ])
+    it. This matters when a pip dependency (google-api-python-client pulls a
-        print(f"Successfully installed {package_name} via pip")
+    newer requests) needs to upgrade an apt-managed package.
-        return True
-    except subprocess.CalledProcessError as e:
-        print(f"Failed to install {package_name} via pip: {e}")
-        return False
 
-def check_package_installed(package_name):
+    Returns (success, output).
+    """
+    print(f"Installing {package_name} via pip...")
+    success, output = _run([
+        sys.executable, '-m', 'pip', 'install',
+        '--break-system-packages', '--prefer-binary', '--ignore-installed', package_name
+    ])
+    if success:
+        print(f"Successfully installed {package_name} via pip")
+        return True, ""
+
+    print(f"Failed to install {package_name} via pip (see failure summary at end of log)")
+    return False, output
+
+
+# Distribution (pip/apt) names whose importable module name differs.
+IMPORT_NAME_MAP = {
+    'python-dateutil': 'dateutil',
+    'websocket-client': 'websocket',
+}
+
+
+def check_package_installed(package_name: str) -> bool:
     """Check if a package is already installed."""
+    import_name = IMPORT_NAME_MAP.get(package_name, package_name)
     # Suppress deprecation warnings when checking if packages are installed
     # (we're just checking, not using them)
     with warnings.catch_warnings():
         warnings.filterwarnings('ignore', category=DeprecationWarning)
         try:
-            __import__(package_name)
+            __import__(import_name)
             return True
         except ImportError:
             return False
 
+
+def print_failure_summary(failed_packages: List[str], failure_details: dict) -> None:
+    print("\n" + "=" * 60)
+    print("DEPENDENCY INSTALLATION FAILURES - DETAILS")
+    print("=" * 60)
+    for package in failed_packages:
+        print(f"\nPackage: {package}")
+        print("-" * 40)
+        output = failure_details.get(package, "").strip()
+        if not output:
+            print("  (no output captured)")
+            continue
+        for line in output.splitlines()[-ERROR_TAIL_LINES:]:
+            print(f"  {line}")
+    print("=" * 60)
+
+
 def main():
     """Main installation function."""
     print("Installing dependencies for LED Matrix Web Interface V2...")
-    
+
+    print("Refreshing apt package index...")
+    _run(['sudo', 'apt', 'update'])  # best-effort; individual installs surface their own errors
+
     # List of required packages
     required_packages = [
         'flask',
@@ -98,19 +159,23 @@ def main():
         'websockets',
         'websocket-client'
     ]
-    
+
     failed_packages = []
-    
+    failure_details = {}
+
     for package in required_packages:
         if check_package_installed(package):
             print(f"{package} is already installed")
             continue
-            
+
         # Try apt first, then pip
-        if not install_via_apt(package):
+        ok, apt_output = install_via_apt(package)
-            if not install_via_pip(package):
+        if not ok:
+            ok, pip_output = install_via_pip(package)
+            if not ok:
                 failed_packages.append(package)
-    
+                failure_details[package] = pip_output or apt_output
+
     # Install packages that don't have apt equivalents
     special_packages = [
         'timezonefinder>=6.5.0,<7.0.0',
@@ -122,47 +187,49 @@ def main():
         'python-socketio>=5.11.0,<6.0.0',
         'python-engineio>=4.9.0,<5.0.0'
     ]
-    
+
     for package in special_packages:
-        if not install_via_pip(package):
+        ok, pip_output = install_via_pip(package)
+        if not ok:
             failed_packages.append(package)
-    
+            failure_details[package] = pip_output
+
     # Install rgbmatrix module from local source (optional - may already be installed in Step 6)
     # Check if already installed first
     if check_package_installed('rgbmatrix'):
         print("rgbmatrix module already installed, skipping...")
     else:
         print("Installing rgbmatrix module from local source...")
-        try:
+        # Get project root (parent of scripts directory)
-            # Get project root (parent of scripts directory)
+        PROJECT_ROOT = Path(__file__).parent.parent
-            PROJECT_ROOT = Path(__file__).parent.parent
+        rgbmatrix_path = PROJECT_ROOT / 'rpi-rgb-led-matrix-master' / 'bindings' / 'python'
-            rgbmatrix_path = PROJECT_ROOT / 'rpi-rgb-led-matrix-master' / 'bindings' / 'python'
+        if rgbmatrix_path.exists():
-            if rgbmatrix_path.exists():
+            # Check if the module has been built (look for setup.py)
-                # Check if the module has been built (look for setup.py)
+            setup_py = rgbmatrix_path / 'setup.py'
-                setup_py = rgbmatrix_path / 'setup.py'
+            if setup_py.exists():
-                if setup_py.exists():
+                # Try installing - use regular install, not editable mode
-                    # Try installing - use regular install, not editable mode
+                # This is optional for web interface and should already be installed in Step 6
-                    # This is optional for web interface and should already be installed in Step 6
+                ok, output = _run([sys.executable, '-m', 'pip', 'install', '--break-system-packages', str(rgbmatrix_path)])
-                    subprocess.check_call([
+                if ok:
-                        sys.executable, '-m', 'pip', 'install', '--break-system-packages', str(rgbmatrix_path)
-                    ], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
                     print("rgbmatrix module installed successfully")
                 else:
-                    print("Warning: rgbmatrix setup.py not found, module may need to be built first")
+                    # Don't fail the whole installation - rgbmatrix is optional for web interface
-                    print("  This is normal if Step 6 hasn't completed yet.")
+                    # and should be installed in Step 6 of first_time_install.sh
+                    print("Warning: Failed to install rgbmatrix module:")
+                    for line in output.strip().splitlines()[-ERROR_TAIL_LINES:]:
+                        print(f"  {line}")
+                    print("  This is normal if rgbmatrix hasn't been built yet (Step 6).")
+                    print("  The web interface will work without it.")
             else:
-                print("Warning: rgbmatrix source not found (this is normal if Step 6 hasn't run yet)")
+                print("Warning: rgbmatrix setup.py not found, module may need to be built first")
-        except subprocess.CalledProcessError as e:
+                print("  This is normal if Step 6 hasn't completed yet.")
-            # Don't fail the whole installation - rgbmatrix is optional for web interface
+        else:
-            # and should be installed in Step 6 of first_time_install.sh
+            print("Warning: rgbmatrix source not found (this is normal if Step 6 hasn't run yet)")
-            print(f"Warning: Failed to install rgbmatrix module: {e}")
+
-            print("  This is normal if rgbmatrix hasn't been built yet (Step 6).")
-            print("  The web interface will work without it.")
-            # Don't add to failed_packages since it's optional
-    
     if failed_packages:
         print(f"\nFailed to install the following packages: {failed_packages}")
         print("You may need to install them manually or check your system configuration.")
+        print_failure_summary(failed_packages, failure_details)
         return False
     else:
         print("\nAll dependencies installed successfully!")

scripts/prove_security.py

@@ -0,0 +1,504 @@
+#!/usr/bin/env python3
+"""
+LEDMatrix Security Proof Tests
+
+Automated proofs that run in CI to verify security properties hold on every
+commit. Inspired by the Huntarr security review approach of using standard
+tooling to confirm specific vulnerability classes are absent.
+
+Usage:
+    python scripts/prove_security.py
+    python scripts/prove_security.py --verbose
+    python scripts/prove_security.py --output results.json
+
+Exit code: 1 only if CRITICAL findings are detected. Warnings are reported
+but do not block CI.
+"""
+
+import ast
+import argparse
+import json
+import re
+import sys
+from dataclasses import dataclass, asdict
+from pathlib import Path
+
+PROJECT_ROOT = Path(__file__).resolve().parent.parent
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Result dataclass
+# ─────────────────────────────────────────────────────────────────────────────
+
+@dataclass
+class TestResult:
+    test_id: str
+    severity: str   # PASS | INFO | WARNING | CRITICAL | SKIP
+    message: str
+    details: str = ""
+
+    def to_dict(self) -> dict:
+        return asdict(self)
+
+    @property
+    def icon(self) -> str:
+        return {
+            "PASS": "✅",
+            "INFO": "ℹ️ ",
+            "WARNING": "⚠️ ",
+            "CRITICAL": "🚨",
+            "SKIP": "⏭️ ",
+        }.get(self.severity, "❓")
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# T1: Plugin Loading / Zip Slip
+# ─────────────────────────────────────────────────────────────────────────────
+
+def test_t1a_zip_slip_protection() -> TestResult:
+    """
+    Verify that zip-slip protection exists in store_manager.py.
+
+    The protection lives at src/plugin_system/store_manager.py and uses
+    Path.is_relative_to() to validate each zip member before extraction.
+    This test confirms the guard is present — it should always pass green.
+    """
+    store_manager = PROJECT_ROOT / "src" / "plugin_system" / "store_manager.py"
+    if not store_manager.exists():
+        return TestResult("T1a", "CRITICAL",
+                          "store_manager.py not found",
+                          f"Expected at {store_manager}")
+
+    content = store_manager.read_text(encoding="utf-8")
+
+    has_relative_to = "is_relative_to" in content
+    has_log_message = "Zip-slip detected" in content
+
+    if not has_relative_to:
+        return TestResult("T1a", "CRITICAL",
+                          "Zip-slip protection (is_relative_to) NOT FOUND in store_manager.py",
+                          "The is_relative_to() guard must be present before zipfile.extractall()")
+
+    if not has_log_message:
+        return TestResult("T1a", "WARNING",
+                          "is_relative_to() found but 'Zip-slip detected' log message missing",
+                          "Verify the protection block is still active and the log was not removed")
+
+    return TestResult("T1a", "PASS",
+                      "Zip-slip protection verified",
+                      "is_relative_to() guard + 'Zip-slip detected' log present in store_manager.py")
+
+
+def test_t1b_dangerous_plugin_calls() -> list[TestResult]:
+    """
+    Scan plugin directories for dangerous function calls (eval, exec).
+    These represent arbitrary code execution risks in plugin code.
+    """
+    results = []
+    plugin_dirs = [
+        PROJECT_ROOT / "plugins",
+        PROJECT_ROOT / "plugin-repos",
+    ]
+
+    violations: list[str] = []
+    files_scanned = 0
+
+    for base in plugin_dirs:
+        if not base.exists():
+            continue
+        for plugin_dir in sorted(base.iterdir()):
+            if not plugin_dir.is_dir() or plugin_dir.name.startswith(('.', '_')):
+                continue
+            for py_file in plugin_dir.rglob("*.py"):
+                files_scanned += 1
+                try:
+                    source = py_file.read_text(encoding="utf-8")
+                    tree = ast.parse(source, filename=str(py_file))
+                    for node in ast.walk(tree):
+                        if isinstance(node, ast.Call) and isinstance(node.func, ast.Name):
+                            if node.func.id in ("eval", "exec"):
+                                rel = py_file.relative_to(PROJECT_ROOT)
+                                violations.append(
+                                    f"{rel}:{node.lineno} — {node.func.id}() call")
+                except (SyntaxError, OSError):
+                    pass
+
+    if violations:
+        results.append(TestResult(
+            "T1b", "CRITICAL",
+            f"Dangerous function calls found in plugins ({len(violations)} instance(s))",
+            "; ".join(violations[:10])
+        ))
+    else:
+        results.append(TestResult(
+            "T1b", "PASS",
+            f"No eval()/exec() calls found in plugins",
+            f"{files_scanned} plugin Python files scanned"
+        ))
+
+    return results
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# T2: API Surface Inventory
+# ─────────────────────────────────────────────────────────────────────────────
+
+def test_t2a_api_surface_inventory() -> TestResult:
+    """
+    Document the API surface area.
+
+    This app intentionally has no authentication (local-only Raspberry Pi
+    design, documented in web_interface/app.py). This test produces an
+    inventory for audit purposes and warns only if the design-intent comment
+    is removed from app.py (which would indicate someone deleted the rationale
+    without adding auth, rather than a deliberate undocumented change).
+    """
+    api_file = PROJECT_ROOT / "web_interface" / "blueprints" / "api_v3.py"
+    app_file = PROJECT_ROOT / "web_interface" / "app.py"
+
+    if not api_file.exists():
+        return TestResult("T2a", "WARNING", "api_v3.py not found", str(api_file))
+
+    api_content = api_file.read_text(encoding="utf-8")
+    routes = re.findall(r"@api_v3\.route\('([^']+)'", api_content)
+
+    csrf_documented = False
+    if app_file.exists():
+        app_content = app_file.read_text(encoding="utf-8")
+        csrf_documented = "CSRF protection disabled for local-only" in app_content
+
+    summary = (
+        f"{len(routes)} API routes in api_v3.py. "
+        f"No auth decorators (intentional local-only design). "
+        f"CSRF disabled: {'YES — design intent documented in app.py' if csrf_documented else 'YES — but design intent comment NOT found in app.py'}. "
+        f"Rate limiting: 1000/min."
+    )
+
+    if not csrf_documented:
+        return TestResult(
+            "T2a", "WARNING",
+            "CSRF is disabled but the design-intent comment is missing from app.py",
+            "Add the rationale comment back, or add proper CSRF protection if "
+            "the app is now internet-facing"
+        )
+
+    return TestResult("T2a", "INFO", "API surface documented", summary)
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# T3: Secrets & Credential Handling
+# ─────────────────────────────────────────────────────────────────────────────
+
+# Patterns that suggest real credentials (must be >8 chars, not placeholders)
+_SECRET_PATTERNS = [
+    (r'(?i)password\s*=\s*["\'](?!none|empty|placeholder|example|test|default|""|'')[^"\']{8,}["\']', "WARNING"),
+    (r'(?i)api[_-]?key\s*=\s*["\'](?!none|empty|placeholder|YOUR_|example|test)[^"\']{16,}["\']', "WARNING"),
+    (r'(?i)secret\s*=\s*["\'](?!none|empty|placeholder|YOUR_|example|test)[^"\']{16,}["\']', "WARNING"),
+    # Real GitHub token pattern
+    (r'ghp_[a-zA-Z0-9]{36}', "CRITICAL"),
+    # Generic long bearer tokens
+    (r'Bearer\s+[a-zA-Z0-9\-_\.]{32,}', "WARNING"),
+]
+
+_TEMPLATE_SKIP_STRINGS = [
+    "YOUR_", "PLACEHOLDER", "_HERE", "example.com", "config_secrets.template",
+    "prove_security",  # this file itself
+]
+
+_SCAN_DIRS = ["src", "web_interface", "scripts"]
+
+
+def test_t3a_hardcoded_secrets() -> TestResult:
+    """Scan source code for hardcoded credentials."""
+    violations: list[str] = []
+
+    for dir_name in _SCAN_DIRS:
+        scan_dir = PROJECT_ROOT / dir_name
+        if not scan_dir.exists():
+            continue
+        for py_file in scan_dir.rglob("*.py"):
+            # Skip test files and this script
+            if "test" in str(py_file).lower() or "prove_security" in str(py_file):
+                continue
+            try:
+                content = py_file.read_text(encoding="utf-8")
+            except OSError:
+                continue
+
+            for pattern, severity in _SECRET_PATTERNS:
+                for match in re.finditer(pattern, content):
+                    line_content = match.group(0)
+                    # Skip lines containing template placeholder strings
+                    if any(skip in line_content for skip in _TEMPLATE_SKIP_STRINGS):
+                        continue
+                    rel = py_file.relative_to(PROJECT_ROOT)
+                    line_no = content[: match.start()].count("\n") + 1
+                    violations.append(
+                        f"[{severity}] {rel}:{line_no} — {line_content[:60]}"
+                    )
+
+    critical_violations = [v for v in violations if "[CRITICAL]" in v]
+    if critical_violations:
+        return TestResult(
+            "T3a", "CRITICAL",
+            f"Hardcoded secrets found ({len(critical_violations)} critical)",
+            "; ".join(critical_violations[:5])
+        )
+    if violations:
+        return TestResult(
+            "T3a", "WARNING",
+            f"Potential hardcoded secrets found ({len(violations)} instance(s))",
+            "; ".join(violations[:5])
+        )
+
+    return TestResult("T3a", "PASS", "No hardcoded secrets detected",
+                      f"Scanned {', '.join(_SCAN_DIRS)}")
+
+
+def test_t3b_plaintext_password_storage() -> TestResult:
+    """
+    Check for user account password storage without hashing.
+
+    The LEDMatrix app has no user account system, so this should produce INFO.
+    It would only CRITICAL if someone added user auth and stored passwords without hashing.
+
+    We require all three of: a password *variable assignment or DB operation*,
+    a clear storage call (INSERT / db commit / ORM save), and no hashing lib present
+    — to avoid false positives from files that contain 'password' for WiFi handling
+    and '.save()' for image/file saving in unrelated functions.
+    """
+    hashing_libs = ["bcrypt", "argon2", "pbkdf2", "scrypt",
+                    "generate_password_hash", "hashpw", "make_password"]
+    # Patterns that indicate password being stored in a database / ORM context.
+    # Must be specific enough to avoid matching set.add(), file.save(), etc.
+    db_storage_patterns = ["INSERT INTO", "db.session", "session.add(", "session.commit(", "orm.save"]
+
+    password_storage_found = False
+
+    for dir_name in _SCAN_DIRS:
+        scan_dir = PROJECT_ROOT / dir_name
+        if not scan_dir.exists():
+            continue
+        for py_file in scan_dir.rglob("*.py"):
+            try:
+                content = py_file.read_text(encoding="utf-8")
+            except OSError:
+                continue
+            # Require DB/ORM context specifically — not just any .save() call
+            if ("password" in content.lower() and
+                    any(store in content for store in db_storage_patterns) and
+                    not any(h in content for h in hashing_libs)):
+                password_storage_found = True
+
+    if password_storage_found:
+        return TestResult(
+            "T3b", "CRITICAL",
+            "Potential plaintext password storage in database/ORM detected",
+            "Found password + database storage operations without a recognized hashing library"
+        )
+
+    return TestResult("T3b", "INFO",
+                      "No plaintext password storage detected",
+                      "App has no user account system — expected result")
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# T4: Path Traversal
+# ─────────────────────────────────────────────────────────────────────────────
+
+def test_t4a_path_traversal() -> TestResult:
+    """
+    Verify static file serving uses send_from_directory (safe) rather than
+    open() with user-supplied paths. Also checks for extractall() calls that
+    lack the is_relative_to() guard.
+    """
+    issues: list[str] = []
+
+    app_file = PROJECT_ROOT / "web_interface" / "app.py"
+    if app_file.exists():
+        content = app_file.read_text(encoding="utf-8")
+        # The file-serve route should use send_from_directory or commonpath
+        if "send_from_directory" not in content and "commonpath" not in content:
+            issues.append("app.py: file-serve routes may not use send_from_directory/commonpath")
+
+    # Check all extractall() calls have a preceding is_relative_to guard
+    for py_file in (PROJECT_ROOT / "src").rglob("*.py"):
+        try:
+            content = py_file.read_text(encoding="utf-8")
+        except OSError:
+            continue
+        if "extractall(" in content and "is_relative_to" not in content:
+            rel = py_file.relative_to(PROJECT_ROOT)
+            issues.append(f"{rel}: extractall() without is_relative_to() guard")
+
+    if issues:
+        return TestResult(
+            "T4a", "WARNING",
+            f"Potential path traversal patterns found ({len(issues)})",
+            "; ".join(issues)
+        )
+
+    return TestResult("T4a", "PASS",
+                      "Path traversal mitigations verified",
+                      "send_from_directory/commonpath used for file serving; "
+                      "extractall() calls have is_relative_to() guards")
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# T5: Auth Bypass Patterns
+# ─────────────────────────────────────────────────────────────────────────────
+
+def test_t5a_auth_bypass_patterns() -> TestResult:
+    """
+    Look for broken auth bypass patterns — not the intentional no-auth design
+    (T2a covers that), but patterns that suggest auth was INTENDED to exist
+    but has an exploitable bypass: broad substring matching, debug-mode skips,
+    or if-True conditions.
+    """
+    bypass_signals = [
+        (r'if\s+True\s*:', "if True: bypass"),
+        (r'if\s+debug\s*:', "debug-mode auth skip"),
+        (r'request\.path\s+in\s+', "substring path matching in auth (Huntarr pattern)"),
+        (r'EXEMPT_ROUTES\s*=', "exempt routes list"),
+    ]
+
+    findings: list[str] = []
+
+    for dir_name in ["src", "web_interface"]:
+        scan_dir = PROJECT_ROOT / dir_name
+        if not scan_dir.exists():
+            continue
+        for py_file in scan_dir.rglob("*.py"):
+            try:
+                content = py_file.read_text(encoding="utf-8")
+            except OSError:
+                continue
+            for pattern, label in bypass_signals:
+                if re.search(pattern, content):
+                    # Only flag if the file also contains auth-related terms
+                    if any(auth in content.lower() for auth in
+                           ["auth", "login", "authenticate", "token", "permission"]):
+                        rel = py_file.relative_to(PROJECT_ROOT)
+                        findings.append(f"{rel}: {label}")
+
+    if findings:
+        return TestResult(
+            "T5a", "WARNING",
+            f"Potential auth bypass patterns found ({len(findings)})",
+            "; ".join(findings[:5])
+        )
+
+    return TestResult("T5a", "PASS",
+                      "No auth bypass patterns detected",
+                      "Checked src/ and web_interface/ for bypass signals")
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# T6: Docker / Container Hardening
+# ─────────────────────────────────────────────────────────────────────────────
+
+def test_t6_docker_hardening() -> TestResult:
+    """Container security — skipped if no Dockerfile exists."""
+    dockerfile = PROJECT_ROOT / "Dockerfile"
+    if not dockerfile.exists():
+        return TestResult("T6", "SKIP",
+                          "No Dockerfile found — container security scan not applicable",
+                          "If Docker support is added in future, enable hadolint/trivy scanning "
+                          "in .github/workflows/security-audit.yml")
+
+    content = dockerfile.read_text(encoding="utf-8")
+    issues: list[str] = []
+
+    # Check for non-root USER directive
+    user_lines = [l for l in content.splitlines() if l.strip().startswith("USER")]
+    if not user_lines or user_lines[-1].strip() == "USER root":
+        issues.append("Container runs as root — use USER directive to drop privileges")
+
+    # Check for pinned base image tags
+    from_lines = [l for l in content.splitlines() if l.strip().startswith("FROM")]
+    for from_line in from_lines:
+        parts = from_line.split()
+        if len(parts) >= 2:
+            image = parts[1]
+            if ":" not in image or image.endswith(":latest"):
+                issues.append(f"Unpinned base image: {image}")
+
+    if issues:
+        return TestResult("T6", "WARNING",
+                          f"Dockerfile hardening issues ({len(issues)})",
+                          "; ".join(issues))
+
+    return TestResult("T6", "PASS", "Dockerfile hardening checks passed", "")
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Runner
+# ─────────────────────────────────────────────────────────────────────────────
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description="LEDMatrix security proof tests",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    parser.add_argument("--output", "-o", default=None,
+                        help="Write JSON results to this file")
+    parser.add_argument("--verbose", "-v", action="store_true",
+                        help="Show details for each check")
+    args = parser.parse_args()
+
+    print("=" * 60)
+    print("LEDMatrix Security Proof Tests")
+    print(f"Project root: {PROJECT_ROOT}")
+    print("=" * 60)
+
+    all_results: list[TestResult] = []
+
+    # Run all test groups
+    all_results.append(test_t1a_zip_slip_protection())
+    all_results.extend(test_t1b_dangerous_plugin_calls())
+    all_results.append(test_t2a_api_surface_inventory())
+    all_results.append(test_t3a_hardcoded_secrets())
+    all_results.append(test_t3b_plaintext_password_storage())
+    all_results.append(test_t4a_path_traversal())
+    all_results.append(test_t5a_auth_bypass_patterns())
+    all_results.append(test_t6_docker_hardening())
+
+    # Print results
+    print()
+    for r in all_results:
+        line = f"  {r.icon} [{r.severity:<8}] {r.test_id}: {r.message}"
+        print(line)
+        if args.verbose and r.details:
+            print(f"             {r.details}")
+
+    # Tally
+    critical = [r for r in all_results if r.severity == "CRITICAL"]
+    warnings = [r for r in all_results if r.severity == "WARNING"]
+    passed = [r for r in all_results if r.severity == "PASS"]
+    skipped = [r for r in all_results if r.severity == "SKIP"]
+
+    print()
+    print(f"  Results: {len(passed)} PASS  {len(warnings)} WARN  "
+          f"{len(critical)} CRITICAL  {len(skipped)} SKIP")
+
+    # Write JSON output
+    if args.output:
+        output_data = [r.to_dict() for r in all_results]
+        Path(args.output).write_text(
+            json.dumps(output_data, indent=2), encoding="utf-8"
+        )
+        print(f"  Results written to: {args.output}")
+
+    if critical:
+        print(f"\n  🚨 {len(critical)} CRITICAL issue(s) found — blocking")
+        return 1
+
+    if warnings:
+        print(f"\n  ⚠️  {len(warnings)} warning(s) found — non-blocking")
+
+    print("\n  ✅ All checks passed (warnings are non-blocking)")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/render_plugin.py

@@ -17,7 +17,6 @@ import os
 import json
 import argparse
 from pathlib import Path
-from typing import Any, Dict, Optional, Sequence, Union
 
 # Add project root to path
 PROJECT_ROOT = Path(__file__).resolve().parent.parent
@@ -28,49 +27,15 @@ os.environ['EMULATOR'] = 'true'
 
 # Import logger after path setup so src.logging_config is importable
 from src.logging_config import get_logger  # noqa: E402
+from src.plugin_system.testing.loading import (  # noqa: E402
+    find_plugin_dir, load_manifest, load_config_defaults,
+)
 logger = get_logger("[Render Plugin]")
 
 MIN_DIMENSION = 1
 MAX_DIMENSION = 512
 
 
-def find_plugin_dir(plugin_id: str, search_dirs: Sequence[Union[str, Path]]) -> Optional[Path]:
-    """Find a plugin directory by searching multiple paths."""
-    from src.plugin_system.plugin_loader import PluginLoader
-    loader = PluginLoader()
-    for search_dir in search_dirs:
-        search_path = Path(search_dir)
-        if not search_path.exists():
-            continue
-        result = loader.find_plugin_directory(plugin_id, search_path)
-        if result:
-            return Path(result)
-    return None
-
-
-def load_manifest(plugin_dir: Path) -> Dict[str, Any]:
-    """Load and return manifest.json from plugin directory."""
-    manifest_path = plugin_dir / 'manifest.json'
-    if not manifest_path.exists():
-        raise FileNotFoundError(f"No manifest.json in {plugin_dir}")
-    with open(manifest_path, 'r') as f:
-        return json.load(f)
-
-
-def load_config_defaults(plugin_dir: Path) -> Dict[str, Any]:
-    """Extract default values from config_schema.json."""
-    schema_path = plugin_dir / 'config_schema.json'
-    if not schema_path.exists():
-        return {}
-    with open(schema_path, 'r') as f:
-        schema = json.load(f)
-    defaults: Dict[str, Any] = {}
-    for key, prop in schema.get('properties', {}).items():
-        if 'default' in prop:
-            defaults[key] = prop['default']
-    return defaults
-
-
 def main() -> int:
     """Load a plugin, call update() + display(), and save the result as a PNG image."""
     parser = argparse.ArgumentParser(description='Render a plugin display to a PNG image')

src/background_cache_mixin.py

@@ -1,134 +0,0 @@
-"""
-Background Cache Mixin for Sports Managers
-
-This mixin provides common caching functionality to eliminate code duplication
-across all sports managers. It implements the background service cache pattern
-where Recent/Upcoming managers consume data from the background service cache.
-"""
-
-import time
-from typing import Dict, Optional, Any, Callable
-
-
-class BackgroundCacheMixin:
-    """
-    Mixin class that provides background service cache functionality to sports managers.
-    
-    This mixin eliminates code duplication by providing a common implementation
-    for the background service cache pattern used across all sports managers.
-    
-    Note: For non-sports managers (weather, stocks, news, etc.), use
-    GenericCacheMixin instead. See src/generic_cache_mixin.py for details.
-    """
-    
-    def _fetch_data_with_background_cache(self, 
-                                        sport_key: str, 
-                                        api_fetch_method: Callable,
-                                        live_manager_class: type = None) -> Optional[Dict]:
-        """
-        Common logic for fetching data with background service cache support.
-        
-        This method implements the background service cache pattern:
-        1. Live managers always fetch fresh data
-        2. Recent/Upcoming managers try background cache first
-        3. Fallback to direct API call if background data unavailable
-        
-        Args:
-            sport_key: Sport identifier (e.g., 'nba', 'nfl', 'ncaa_fb')
-            api_fetch_method: Method to call for direct API fetch
-            live_manager_class: Class to check if this is a live manager
-            
-        Returns:
-            Cached or fresh data from API
-        """
-        start_time = time.time()
-        cache_hit = False
-        cache_source = None
-        
-        try:
-            # For Live managers, always fetch fresh data
-            if live_manager_class and isinstance(self, live_manager_class):
-                self.logger.info(f"[{sport_key.upper()}] Live manager - fetching fresh data")
-                result = api_fetch_method(use_cache=False)
-                cache_source = "live_fresh"
-            else:
-                # For Recent/Upcoming managers, try background service cache first
-                cache_key = self.cache_manager.generate_sport_cache_key(sport_key)
-                
-                # Check if background service has fresh data
-                if self.cache_manager.is_background_data_available(cache_key, sport_key):
-                    cached_data = self.cache_manager.get_background_cached_data(cache_key, sport_key)
-                    if cached_data:
-                        self.logger.info(f"[{sport_key.upper()}] Using background service cache for {cache_key}")
-                        result = cached_data
-                        cache_hit = True
-                        cache_source = "background_cache"
-                    else:
-                        self.logger.warning(f"[{sport_key.upper()}] Background cache check passed but no data returned for {cache_key}")
-                        result = None
-                        cache_source = "background_miss"
-                else:
-                    self.logger.info(f"[{sport_key.upper()}] Background data not available for {cache_key}")
-                    result = None
-                    cache_source = "background_unavailable"
-                
-                # Fallback to direct API call if background data not available
-                if result is None:
-                    self.logger.info(f"[{sport_key.upper()}] Fetching directly from API for {cache_key}")
-                    result = api_fetch_method(use_cache=True)
-                    cache_source = "api_fallback"
-            
-            # Record performance metrics
-            duration = time.time() - start_time
-            self.cache_manager.record_fetch_time(duration)
-            
-            # Log performance metrics
-            self._log_fetch_performance(sport_key, duration, cache_hit, cache_source)
-            
-            return result
-            
-        except Exception as e:
-            duration = time.time() - start_time
-            self.logger.error(f"[{sport_key.upper()}] Error in background cache fetch after {duration:.2f}s: {e}")
-            self.cache_manager.record_fetch_time(duration)
-            raise
-    
-    def _log_fetch_performance(self, sport_key: str, duration: float, cache_hit: bool, cache_source: str):
-        """
-        Log detailed performance metrics for fetch operations.
-        
-        Args:
-            sport_key: Sport identifier
-            duration: Fetch operation duration in seconds
-            cache_hit: Whether this was a cache hit
-            cache_source: Source of the data (background_cache, api_fallback, etc.)
-        """
-        # Log basic performance info
-        self.logger.info(f"[{sport_key.upper()}] Fetch completed in {duration:.2f}s "
-                        f"(cache_hit={cache_hit}, source={cache_source})")
-        
-        # Log detailed metrics every 10 operations
-        if hasattr(self, '_fetch_count'):
-            self._fetch_count += 1
-        else:
-            self._fetch_count = 1
-            
-        if self._fetch_count % 10 == 0:
-            metrics = self.cache_manager.get_cache_metrics()
-            self.logger.info(f"[{sport_key.upper()}] Cache Performance Summary - "
-                           f"Hit Rate: {metrics['cache_hit_rate']:.2%}, "
-                           f"Background Hit Rate: {metrics['background_hit_rate']:.2%}, "
-                           f"API Calls Saved: {metrics['api_calls_saved']}")
-    
-    def get_cache_performance_summary(self) -> Dict[str, Any]:
-        """
-        Get cache performance summary for this manager.
-        
-        Returns:
-            Dictionary containing cache performance metrics
-        """
-        return self.cache_manager.get_cache_metrics()
-    
-    def log_cache_performance(self):
-        """Log current cache performance metrics."""
-        self.cache_manager.log_cache_metrics()

src/cache/disk_cache.py

@@ -68,14 +68,15 @@ class DiskCache:
             return None
         return os.path.join(self.cache_dir, f"{key}.json")
     
-    def get(self, key: str, max_age: int = 300) -> Optional[Dict[str, Any]]:
+    def get(self, key: str, max_age: Optional[int] = 300) -> Optional[Dict[str, Any]]:
         """
         Get data from disk cache.
-        
+
         Args:
             key: Cache key
-            max_age: Maximum age in seconds
+            max_age: Maximum age in seconds; None disables age-based expiry
-            
+                (the record never counts as stale). Mirrors MemoryCache.get.
+
         Returns:
             Cached data or None if not found or expired
         """
@@ -105,7 +106,13 @@ class DiskCache:
                     record_ts = None
             
             now = time.time()
-            if record_ts is None or (now - record_ts) <= max_age:
+            # max_age=None means "never expires" (mirrors MemoryCache and the
+            # cache_manager docstring). Guard it explicitly — otherwise the
+            # comparison below raises TypeError and the record is treated as a
+            # miss, which silently breaks callers that persist long-lived state
+            # via get(key, max_age=None) (e.g. plugin health/metrics that must
+            # survive restarts and be read cross-process).
+            if record_ts is None or max_age is None or (now - record_ts) <= max_age:
                 return record
             else:
                 # Stale on disk; keep file for potential diagnostics but treat as miss

src/cache_manager.py

@@ -1,3 +1,28 @@
+"""
+Cache Manager — multi-tier response cache for the LEDMatrix application.
+
+:class:`CacheManager` provides a unified caching layer used by all plugins
+to reduce external API calls and survive network outages gracefully.
+
+Two storage tiers
+-----------------
+* **Memory tier** (:class:`~src.cache.memory_cache.MemoryCache`): fast LRU
+  cache (up to 1 000 entries by default).  Hit on this tier before touching
+  disk.
+* **Disk tier** (:class:`~src.cache.disk_cache.DiskCache`): filesystem-backed
+  persistent store that survives process restarts.
+
+Data written to cache is serialised as JSON.  :class:`DateTimeEncoder` handles
+``datetime`` objects transparently so callers don't have to pre-serialise them.
+
+Typical plugin usage::
+
+    data = self.cache_manager.get_cached_data('my_key', max_age=300)
+    if data is None:
+        data = fetch_from_api()
+        self.cache_manager.save_cache('my_key', data)
+"""
+
 import json
 import os
 import time
@@ -15,7 +40,10 @@ from src.cache.cache_metrics import CacheMetrics
 from src.logging_config import get_logger
 
 class DateTimeEncoder(json.JSONEncoder):
+    """JSON encoder that serialises ``datetime`` objects as ISO-8601 strings."""
+
     def default(self, obj):
+        """Return ISO-8601 string for datetime; delegate all other types to the base encoder."""
         if isinstance(obj, datetime):
             return obj.isoformat()
         return super().default(obj)
@@ -546,9 +574,19 @@ class CacheManager:
         }
         return self.save_cache(data_type, cache_data)
 
-    def get(self, key: str, max_age: int = 300) -> Optional[Dict[str, Any]]:
+    def get(self, key: str, max_age: Optional[int] = 300,
-        """Get data from cache if it exists and is not stale."""
+            memory_ttl: Optional[int] = None) -> Optional[Dict[str, Any]]:
-        cached_data = self.get_cached_data(key, max_age)
+        """Get data from cache if it exists and is not stale.
+
+        Args:
+            key: Cache key
+            max_age: Max age (seconds) for the on-disk entry; None never expires.
+            memory_ttl: Max age (seconds) for the in-memory entry. Pass 0 to
+                bypass the memory tier and force a fresh read from disk — used by
+                cross-process readers that must observe another process's latest
+                write rather than a stale first snapshot. Defaults to max_age.
+        """
+        cached_data = self.get_cached_data(key, max_age, memory_ttl=memory_ttl)
         if cached_data and 'data' in cached_data:
             return cached_data['data']
         return cached_data

src/common/basketball_plugin_example.py

@@ -1,328 +0,0 @@
-"""
-Example: Basketball Plugin using LEDMatrix Common Helpers
-
-This example shows how to refactor the basketball plugin to use the
-ledmatrix-common package for cleaner, more maintainable code.
-"""
-
-from pathlib import Path
-from typing import Any, Dict, List, Optional
-
-
-# Import common helpers
-from src.common import (
-    LogoHelper, TextHelper, APIHelper, DisplayHelper, 
-    GameHelper, ConfigHelper
-)
-from src.plugin_system.base_plugin import BasePlugin
-
-
-class BasketballPluginManager(BasePlugin):
-    """
-    Basketball scoreboard plugin using LEDMatrix Common helpers.
-    
-    This version is much cleaner and more maintainable than the original
-    because it delegates common functionality to the shared helpers.
-    """
-    
-    def __init__(
-        self,
-        plugin_id: str,
-        config: Dict[str, Any],
-        display_manager,
-        cache_manager,
-        plugin_manager
-    ):
-        """Initialize the basketball plugin with common helpers."""
-        super().__init__(plugin_id, config, display_manager, cache_manager, plugin_manager)
-        
-        # Get display dimensions
-        self.display_width = display_manager.matrix.width
-        self.display_height = display_manager.matrix.height
-        
-        # Initialize common helpers
-        self._init_helpers()
-        
-        # Load configuration
-        self._load_config()
-        
-        # State tracking
-        self.current_games = []
-        self.current_game = None
-        
-        # Log initialization
-        enabled_leagues = [k for k, v in self.league_configs.items() if v['enabled']]
-        self.logger.info(f"Basketball plugin initialized with leagues: {enabled_leagues}")
-    
-    def _init_helpers(self):
-        """Initialize all common helpers."""
-        # Logo helper for team logos
-        self.logo_helper = LogoHelper(
-            display_width=self.display_width,
-            display_height=self.display_height,
-            logger=self.logger
-        )
-        
-        # Text helper for rendering
-        self.text_helper = TextHelper(logger=self.logger)
-        self.fonts = self.text_helper.load_fonts()
-        
-        # API helper for ESPN data
-        self.api_helper = APIHelper(
-            cache_manager=self.cache_manager,
-            logger=self.logger
-        )
-        
-        # Display helper for layouts
-        self.display_helper = DisplayHelper(
-            display_width=self.display_width,
-            display_height=self.display_height,
-            logger=self.logger
-        )
-        
-        # Game helper for data processing
-        self.game_helper = GameHelper(
-            timezone_str=self.config.get('timezone', 'UTC'),
-            logger=self.logger
-        )
-        
-        # Config helper for configuration management
-        self.config_helper = ConfigHelper(logger=self.logger)
-    
-    def _load_config(self):
-        """Load and validate configuration."""
-        # Get basketball-specific config
-        basketball_config = self.config_helper.get_sports_config(self.config, 'basketball')
-        
-        # Build league configurations
-        self.league_configs = {
-            'nba': {
-                'enabled': basketball_config.get('nba_enabled', True),
-                'url': 'https://site.api.espn.com/apis/site/v2/sports/basketball/nba/scoreboard',
-                'logo_dir': Path('assets/sports/nba_logos'),
-                'favorite_teams': basketball_config.get('nba_favorite_teams', []),
-                'display_modes': {
-                    'nba_live': basketball_config.get('nba_display_modes_live', True),
-                    'nba_recent': basketball_config.get('nba_display_modes_recent', True),
-                    'nba_upcoming': basketball_config.get('nba_display_modes_upcoming', True),
-                },
-            },
-            'wnba': {
-                'enabled': basketball_config.get('wnba_enabled', False),
-                'url': 'https://site.api.espn.com/apis/site/v2/sports/basketball/wnba/scoreboard',
-                'logo_dir': Path('assets/sports/wnba_logos'),
-                'favorite_teams': basketball_config.get('wnba_favorite_teams', []),
-                'display_modes': {
-                    'wnba_live': basketball_config.get('wnba_display_modes_live', True),
-                    'wnba_recent': basketball_config.get('wnba_display_modes_recent', True),
-                    'wnba_upcoming': basketball_config.get('wnba_display_modes_upcoming', True),
-                },
-            },
-            'ncaam': {
-                'enabled': basketball_config.get('ncaam_basketball_enabled', False),
-                'url': 'https://site.api.espn.com/apis/site/v2/sports/basketball/mens-college-basketball/scoreboard',
-                'logo_dir': Path('assets/sports/ncaa_logos'),
-                'favorite_teams': basketball_config.get('ncaam_basketball_favorite_teams', []),
-                'display_modes': {
-                    'ncaam_basketball_live': basketball_config.get('ncaam_basketball_display_modes_live', True),
-                    'ncaam_basketball_recent': basketball_config.get('ncaam_basketball_display_modes_recent', True),
-                    'ncaam_basketball_upcoming': basketball_config.get('ncaam_basketball_display_modes_upcoming', True),
-                },
-            },
-            'ncaaw': {
-                'enabled': basketball_config.get('ncaaw_basketball_enabled', False),
-                'url': 'https://site.api.espn.com/apis/site/v2/sports/basketball/womens-college-basketball/scoreboard',
-                'logo_dir': Path('assets/sports/ncaa_logos'),
-                'favorite_teams': basketball_config.get('ncaaw_basketball_favorite_teams', []),
-                'display_modes': {
-                    'ncaaw_basketball_live': basketball_config.get('ncaaw_basketball_display_modes_live', True),
-                    'ncaaw_basketball_recent': basketball_config.get('ncaaw_basketball_display_modes_recent', True),
-                    'ncaaw_basketball_upcoming': basketball_config.get('ncaaw_basketball_display_modes_upcoming', True),
-                },
-            },
-        }
-    
-    def update(self) -> None:
-        """Update game data for all enabled leagues."""
-        try:
-            all_games = []
-            
-            for league_key, league_config in self.league_configs.items():
-                if not league_config['enabled']:
-                    continue
-                
-                games = self._fetch_league_games(league_key, league_config)
-                for game in games:
-                    game['league_key'] = league_key
-                    game['league_config'] = league_config
-                all_games.extend(games)
-            
-            self.current_games = all_games
-            self.logger.debug(f"Updated basketball data: {len(all_games)} total games")
-            
-        except Exception as e:
-            self.logger.error(f"Error updating basketball data: {e}", exc_info=True)
-    
-    def _fetch_league_games(self, league_key: str, league_config: Dict) -> List[Dict]:
-        """Fetch games for a specific league using API helper."""
-        try:
-            # Use API helper to fetch ESPN data with caching
-            data = self.api_helper.fetch_espn_scoreboard(
-                sport='basketball',
-                league=league_key,
-                cache_key=f"basketball_{league_key}",
-                cache_ttl=300  # 5 minutes cache
-            )
-            
-            if not data:
-                return []
-            
-            # Use game helper to process events
-            events = data.get('events', [])
-            games = self.game_helper.process_games(events, sport='basketball')
-            
-            # Add logo paths to games
-            for game in games:
-                logo_dir = league_config['logo_dir']
-                game['home_logo_path'] = logo_dir / f"{game['home_abbr']}.png"
-                game['away_logo_path'] = logo_dir / f"{game['away_abbr']}.png"
-            
-            return games
-            
-        except Exception as e:
-            self.logger.error(f"Error fetching {league_key} games: {e}", exc_info=True)
-            return []
-    
-    def display(self, force_clear: bool = False, display_mode: str = None) -> None:
-        """Display basketball games using display helper."""
-        try:
-            mode = display_mode or self._determine_display_mode()
-            
-            if not mode:
-                self._display_no_games()
-                return
-            
-            # Filter games for mode
-            filtered_games = self._filter_games_for_mode(mode)
-            
-            if not filtered_games:
-                self._display_no_games()
-                return
-            
-            # Display first game
-            self.current_game = filtered_games[0]
-            self._draw_scorebug_layout(self.current_game, force_clear)
-            
-        except Exception as e:
-            self.logger.error(f"Error displaying game: {e}", exc_info=True)
-    
-    def _determine_display_mode(self) -> Optional[str]:
-        """Determine display mode based on available games."""
-        # Priority: live > recent > upcoming
-        for game in self.current_games:
-            if game.get('is_live'):
-                return f"{game['league_key']}_live"
-        for game in self.current_games:
-            if game.get('is_final'):
-                return f"{game['league_key']}_recent"
-        for game in self.current_games:
-            if game.get('is_upcoming'):
-                return f"{game['league_key']}_upcoming"
-        return None
-    
-    def _filter_games_for_mode(self, mode: str) -> List[Dict]:
-        """Filter games based on display mode."""
-        filtered = []
-        
-        for game in self.current_games:
-            league_config = game.get('league_config', {})
-            display_modes = league_config.get('display_modes', {})
-            
-            if mode in display_modes and display_modes[mode]:
-                if 'live' in mode and game.get('is_live'):
-                    filtered.append(game)
-                elif 'recent' in mode and game.get('is_final'):
-                    filtered.append(game)
-                elif 'upcoming' in mode and game.get('is_upcoming'):
-                    filtered.append(game)
-        
-        return filtered[:5]
-    
-    def _draw_scorebug_layout(self, game: Dict, force_clear: bool = False) -> None:
-        """Draw the basketball scorebug layout using display helper."""
-        try:
-            # Load logos using logo helper
-            home_logo = self.logo_helper.load_logo(
-                game['home_abbr'], 
-                game['home_logo_path']
-            )
-            away_logo = self.logo_helper.load_logo(
-                game['away_abbr'], 
-                game['away_logo_path']
-            )
-            
-            if not home_logo or not away_logo:
-                self.logger.error("Failed to load logos")
-                self._display_error("Logo Error")
-                return
-            
-            # Use display helper to create scorebug layout
-            final_img = self.display_helper.draw_scorebug_layout(
-                game_data=game,
-                fonts=self.fonts,
-                home_logo=home_logo,
-                away_logo=away_logo
-            )
-            
-            # Display the image
-            self.display_manager.image.paste(final_img, (0, 0))
-            self.display_manager.update_display()
-            
-        except Exception as e:
-            self.logger.error(f"Error drawing scorebug: {e}", exc_info=True)
-    
-    def _display_no_games(self) -> None:
-        """Display 'no games' message using display helper."""
-        try:
-            img = self.display_helper.draw_no_data_message("No Games")
-            self.display_manager.image = img.copy()
-            self.display_manager.update_display()
-        except Exception as e:
-            self.logger.error(f"Error displaying no games: {e}", exc_info=True)
-    
-    def _display_error(self, message: str) -> None:
-        """Display error message using display helper."""
-        try:
-            img = self.display_helper.draw_error_message(message)
-            self.display_manager.image = img.copy()
-            self.display_manager.update_display()
-        except Exception as e:
-            self.logger.error(f"Error displaying error message: {e}", exc_info=True)
-    
-    def get_display_duration(self) -> float:
-        """Get display duration."""
-        return self.config.get('display_duration', 15)
-    
-    def cleanup(self) -> None:
-        """Cleanup resources."""
-        self.current_games = []
-        self.logger.info("Basketball plugin cleaned up")
-
-
-# Example usage and benefits:
-"""
-Benefits of using LEDMatrix Common helpers:
-
-1. **Cleaner Code**: The plugin is much shorter and more readable
-2. **Reusable Components**: Common functionality is shared across plugins
-3. **Better Testing**: Each helper can be tested independently
-4. **Easier Maintenance**: Bug fixes in helpers benefit all plugins
-5. **Consistent Behavior**: All plugins use the same underlying logic
-6. **Reduced Dependencies**: Plugins don't need to import LEDMatrix core
-7. **Better Error Handling**: Centralized error handling in helpers
-8. **Configuration Management**: Consistent config handling across plugins
-
-The original basketball plugin was 326 lines. This version is much cleaner
-and delegates most functionality to the common helpers, making it easier to
-maintain and extend.
-"""