EasyEffects-PresetCTRL: New plugin

[Nuddel69]

Plugin

• Id: nuddel69/easyeffects-presetctrl
• New plugin
• Update to an existing plugin (version bumped in plugin.toml)

What it does

Switch EasyEffects output presets from a simple widget

External dependencies

easyeffects

Testing

• Tested on Niri
• Tested on Hyprland
• Tested on Sway
• Tested on another compositor:
• Noctalia version tested against: 5.0.0_beta.8-1-dirty
• Plugin API level: 3

Screenshots / Videos

Checklist

• The directory name matches the part of id after the / in plugin.toml exactly.
• It ships plugin.toml, README.md, thumbnail.webp, and translations/en.json.
• README.md follows the
  README template, documents
  every entry id and dependency, and includes exact panel IPC commands and launcher prefixes where applicable.
• I created thumbnail.webp with the thumbnail generator.
• version follows semver and is bumped in this PR; plugin_api is the oldest API level this plugin requires.
• Every non-English translation in this PR uses a locale supported by Noctalia core, and I can read, write, and
  understand that language well enough to review and maintain it (no unreviewed machine/LLM translations).
• I did not edit catalog.toml; CI generates it.
• This PR touches exactly one plugin directory.

Code review attestation

Plugins run as trusted, unsandboxed Luau in the user's session. Confirm:

• The code is readable and not obfuscated, minified, or generated.
• It does not download and execute remote code.
• Every network call, filesystem write, and spawned process is something the description above accounts for.
• I have the right to publish this code under the license declared in plugin.toml.

[ItsLemmy]

1. blocking - easyeffects-presetctrl/picker.luau:78

The selected preset name is concatenated into a command passed to noctalia.runStream. Preset text comes from
easyeffects -p without validation or shell escaping at easyeffects-presetctrl/picker.luau:54. runStream executes
the command through /bin/sh -c at ../noctalia-shell/src/scripting/luau_host.cpp:2381.

Double quotes do not prevent command substitution, and embedded quotes can break out of the quoted argument. A
crafted preset name can therefore execute arbitrary commands in the user's session when selected. Pass arguments
without a shell or apply complete shell escaping before execution.

2. non-blocking - easyeffects-presetctrl/picker.luau:65

The "Enable EasyEffects?" toggle only changes the local enabled variable and rerenders its label. It never enables,
disables, starts, or stops EasyEffects. The shipped control reports a state change that has no effect.
easyeffects-presetctrl/README.md:40 also identifies enable/disable as unfinished. Remove the control until
implemented, or connect it to the documented behavior.

3. non-blocking - easyeffects-presetctrl/README.md:35

The README documents show-glyph and show-label, but the manifest defines show_glyph and show_label at
easyeffects-presetctrl/plugin.toml:24 and easyeffects-presetctrl/plugin.toml:37. The documented setting names do not
match the plugin configuration keys.