ChuckandClaude Opus 5 ff7ff17f46 fix: address Codacy findings on the core audit PR ...

- plugin_manager.prepare_plugin_config: when the fallback legacy-boolean
  pass also fails, log a warning instead of a bare except/pass.
- api_client.js: request() refuses any endpoint that is not a plain path
  under /api/v3 ("//host", backslashes, ".." or "." segments, whitespace,
  control characters) with INVALID_ENDPOINT before calling fetch(), and
  plugin ids are URL-encoded wherever they are put into a URL (also in the
  app-shell batch load).
- test_update_all.js: pins both against the shipped client.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-09-17 12:54:16 -04:00

..

v3

fix: address Codacy findings on the core audit PR

2026-09-17 12:54:16 -04:00