CodeRabbit review on #544:
- start_pixlet_editor() unconditionally set PIXLET_EDITOR_HOST=0.0.0.0,
overriding any operator-configured loopback-only value and always exposing
the unauthenticated `pixlet serve` dev process on the LAN (CWE-1188). Use
env.setdefault() so it's only a default; also stop hardcoding 'host' in the
recorded session state so status reporting matches what was actually used.
- test_tools_sections.js asserted an Install button always renders, which
assumes the bridge service is never installed on the test/dev host. Branch
on the same service.installed flag the template itself renders from.
Adds regression coverage in test_starlark_pixlet_routes.py for the
setdefault-vs-override behavior (both the "nothing configured" and
"operator pinned loopback" cases).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S3bPMESe2TfrGvbs1ef9c5
