fix: work through the remaining review findings on the editor and bridge

allow_insecure_mqtt (CWE-319, requested): a password with TLS disabled crosses
the network in cleartext. Refused now rather than merely warned about -- but
refused, not forbidden, because unencrypted MQTT on a trusted LAN is a normal
deliberate setup. allow_insecure_mqtt is the explicit acknowledgement, defaults
false, and is coerced like the other booleans so the string "false" cannot
switch the guard off.

starlark.py:796 -- the supported service runs Flask threaded, so two start
requests could each see running=False, each launch an editor, and the second
state write replace the first PID, orphaning a process that holds the display
down with nothing recording it. The check-launch-write sequence now takes a
module-level lock.

starlark.py:848 -- if the state write failed the route returned success with an
editor running and no PID recorded: status and stop both reported no session
while the display stayed down until the timeout expired. It now terminates the
process group and returns an error.

starlark.py:890 -- SIGKILL gives the script's EXIT trap no chance to run, so
nothing hands the display back, yet the response said "the display is
restarting". After an escalation the display is now restarted explicitly, and a
failure to do so returns an error naming the manual step instead of a success.

pixlet_config_editor.sh:184 -- find_pixlet supports Darwin but macOS ships no
timeout(1); GNU coreutils installs it as gtimeout. Resolved up front so the
failure lands before the display is stopped rather than after.

pixlet_config_editor.sh:154 -- wildcard, loopback and an explicit interface
address are three cases, not two. Collapsing the last two printed a URL saying
"localhost" whenever PIXLET_EDITOR_HOST named a LAN address.

tools.html:1254 -- escHtml does not encode single quotes, and the app id was
interpolated into an inline onclick="startPixletEditor('...')", so a directory
containing an apostrophe could break out of the JS string and run script. The
handler binds with addEventListener and reads the id from dataset, where it is
only ever parsed as an HTML attribute.

Tests: test_mqtt_bridge_config_endpoint.py grows to 23 cases covering the opt-in
in both directions. The tools DOM suite gains three guards asserting the edit
buttons carry no inline onclick and pass the id via dataset -- those need jsdom
and did not run here, so CI verifies them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

test/js/dom/test_tools_sections.js

@@ -86,6 +86,17 @@ const get = p => new Promise((res, rej) =>
   ok('editor lists the apps on disk',
      appIds.every(id => $('pixlet-editor-body').textContent.includes(id)), appIds);
   ok('no session banner while idle', !$('pixlet-countdown'));
+  // escHtml does not encode single quotes, so an app id interpolated into an
+  // inline onclick="startPixletEditor('...')" could break out of the JS string
+  // and run script. The id must reach the handler through dataset instead.
+  const editBtns = [...window.document.querySelectorAll('[id^="btn-pixlet-edit-"]')];
+  ok('edit buttons exist', editBtns.length > 0, editBtns.length);
+  ok('edit buttons carry no inline onclick',
+     editBtns.every(b => !b.getAttribute('onclick')),
+     editBtns.map(b => b.getAttribute('onclick')));
+  ok('edit buttons pass the app id via dataset',
+     editBtns.every(b => appIds.includes(b.dataset.appId)),
+     editBtns.map(b => b.dataset.appId));
   ok('warns that the display stops',
      window.document.body.textContent.includes('display stops while a session is open'));
 

test/test_mqtt_bridge_config_endpoint.py

@@ -70,7 +70,10 @@ class TestABodyItCannotApplyIsRejected:
 
 class TestClearPasswordNeedsARealBoolean:
     def _seed(self, cfg, password="hunter2"):
-        cfg.write_text(json.dumps({"mqtt_password": password}), encoding="utf-8")
+        # TLS on so these cases exercise clear_password alone: a stored password
+        # with TLS off is refused by the CWE-319 guard, which is a separate test.
+        cfg.write_text(json.dumps({"mqtt_password": password, "mqtt_tls": True}),
+                       encoding="utf-8")
 
     def _stored(self, cfg):
         return json.loads(cfg.read_text(encoding="utf-8")).get("mqtt_password")
@@ -95,3 +98,41 @@ class TestClearPasswordNeedsARealBoolean:
         self._seed(cfg)
         assert c.put(URL, json={"clear_password": truthy}).status_code == 200
         assert self._stored(cfg) is None
+
+
+class TestCleartextCredentialsNeedAnExplicitOptIn:
+    """CWE-319. A password with TLS off crosses the network in the clear.
+
+    Refused rather than forbidden: unencrypted MQTT on a trusted LAN is a normal
+    deliberate setup, so allow_insecure_mqtt is the explicit acknowledgement.
+    """
+
+    def test_a_password_without_tls_is_refused(self, client):
+        c, _ = client
+        r = c.put(URL, json={"mqtt_password": "hunter2", "mqtt_tls": False})
+        assert r.status_code == 400
+        assert "allow_insecure_mqtt" in r.get_json()["message"]
+
+    def test_the_opt_in_allows_it(self, client):
+        c, cfg = client
+        r = c.put(URL, json={"mqtt_password": "hunter2", "mqtt_tls": False,
+                             "allow_insecure_mqtt": True})
+        assert r.status_code == 200, r.get_json()
+        assert json.loads(cfg.read_text(encoding="utf-8"))["mqtt_password"] == "hunter2"
+
+    def test_tls_on_needs_no_opt_in(self, client):
+        c, _ = client
+        r = c.put(URL, json={"mqtt_password": "hunter2", "mqtt_tls": True})
+        assert r.status_code == 200, r.get_json()
+
+    def test_no_password_is_unaffected(self, client):
+        c, _ = client
+        assert c.put(URL, json={"mqtt_tls": False}).status_code == 200
+
+    def test_the_opt_in_is_a_real_boolean(self, client):
+        """"false" must not switch the guard off, same as clear_password."""
+        c, _ = client
+        r = c.put(URL, json={"mqtt_password": "hunter2", "mqtt_tls": False,
+                             "allow_insecure_mqtt": "false"})
+        assert r.status_code == 400
+