pixie-lab 0.4.0__tar.gz → 0.4.1__tar.gz

{pixie_lab-0.4.0 → pixie_lab-0.4.1}/CHANGELOG.md

@@ -11,6 +11,48 @@ operator-facing summary.
 
 ## [Unreleased]
 
+## [0.4.1] - 2026-07-25
+
+### Changed
+
+**New machines default to `pixie-inventory`, one-shot.** A
+freshly-discovered MAC now auto-registers with `pixie-inventory`
+instead of `ipxe-exit`: non-destructive (boots the live env, collects
+lshw + disks, posts them, exits to firmware) and immediately useful --
+every new machine's hardware shows up and the flash modes (which
+require inventory) become available without a manual pass. It is
+one-shot: the first inventory POST flips the binding to `ipxe-exit`, so
+a PXE-first box inventories itself exactly once and never boot-loops.
+With no live env staged the plan degrades to exit, so a bare deploy
+behaves like before until the operator fetches the live env. Override
+per deploy with `PIXIE_DEFAULT_BOOT_MODE` (e.g. `ipxe-exit` for the old
+behaviour).
+
+### Fixed
+
+**Live env boots on arbitrary NICs (netboot-pc initramfs is now
+`MODULES=most`).** The live env fetches its squashfs over HTTP from the
+initramfs before pivot-root, so the target's NIC must be driven from
+inside the initrd. It was built the mkinitramfs default `MODULES=dep` --
+only the build host's drivers (plus the DKMS'd r8125) -- so a target
+with a different NIC came up to `initrd` and then stalled forever at the
+squashfs fetch, silently breaking `pixie-inventory` / `-tui` / `-flash`
+on that box (observed on an ASRock Rack board). The netboot-pc bake now
+sets `MODULES=most`, baking the broad Debian-installer driver set so an
+arbitrary lab machine's NIC (and storage) is alive before the fetch.
+Costs some initramfs size; worth it for an appliance whose job is
+booting unknown hardware.
+
+**No more `${PIXIE_LIVE_ENV_EXTRA_CMDLINE:-}` literal on the kernel
+cmdline.** On a deploy whose compose runner doesn't expand `${VAR:-}`
+(podman-compose passes the unset default through verbatim), the
+container env held the literal string `${PIXIE_LIVE_ENV_EXTRA_CMDLINE:-}`,
+which pixie then appended to every live-env / nbdboot kernel cmdline.
+Harmless (the kernel ignores the unknown token) but wrong. The
+extra-cmdline resolver now treats a value that is nothing but an
+unexpanded `${...}` placeholder as unset, so it can't leak -- fixed for
+any deploy without regenerating compose.
+
 ## [0.4.0] - 2026-07-24
 
 ### Changed

{pixie_lab-0.4.0 → pixie_lab-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pixie-lab
-Version: 0.4.0
+Version: 0.4.1
 Summary: Bare-metal netboot appliance: catalog + fetch + NBD + PXE + TFTP + operator TUI in one container
 Project-URL: Homepage, https://github.com/safl/pixie
 Project-URL: Repository, https://github.com/safl/pixie

{pixie_lab-0.4.0 → pixie_lab-0.4.1}/docs/src/boot-modes.md

@@ -8,14 +8,14 @@ tokens.
 
 ## The six modes
 
-### `ipxe-exit` (default)
+### `ipxe-exit`
 
 Pixie exits the iPXE chain. The target's BIOS boot order picks the
-next bootable device. This is the safe default for a fresh MAC:
-pixie won't reflash a machine or attempt to netboot it until an
-operator has explicitly bound it.
+next bootable device. A pure no-op: pixie won't reflash a machine or
+netboot it. This is where `pixie-inventory` self-terminates to (see
+below), and where an operator parks a machine pixie should leave alone.
 
-### `pixie-inventory`
+### `pixie-inventory` (default)
 
 The target boots pixie's own live env. The `pixie` CLI collects
 disk + NIC + lshw output and POSTs it to `/pxe/<mac>/inventory`,
@@ -23,6 +23,18 @@ then the target reboots to firmware. Prerequisite for
 `pixie-flash-*`: without inventory, pixie doesn't know which disk
 serial to hand the flash pipeline.
 
+This is the **default a freshly-discovered MAC auto-registers with**:
+it's non-destructive (touches no disk) and immediately useful (every
+new machine's hardware shows up on `/ui/machines`, and the flash modes
+become available without a manual pass). It is **one-shot** -- on the
+first successful inventory POST pixie flips the binding to `ipxe-exit`,
+so a PXE-first machine inventories itself exactly once and then stops
+touching the boot (no re-inventory loop). Rebinding to
+`pixie-inventory` buys one more pass. If no live env is staged the plan
+degrades to `unavailable`/exit, so a bare deploy behaves like the old
+exit-by-default until the operator fetches the live env. Set
+`PIXIE_DEFAULT_BOOT_MODE=ipxe-exit` to restore the old exit-by-default.
+
 ### `pixie-tui`
 
 The target boots pixie's live env into an interactive TUI. An
@@ -123,9 +135,11 @@ volumes alone.
 
 A binding is what pixie serves a MAC next time it PXEs: a boot mode,
 plus (for the modes that need one) an image, plus (for `nbdboot`) an
-optional overlay alias. A fresh MAC auto-registers as `ipxe-exit` with
-no image on first contact; the machine detail page is where an
-operator promotes it. Saving the bind form persists all three fields
+optional overlay alias. A fresh MAC auto-registers with
+`PIXIE_DEFAULT_BOOT_MODE` (default `pixie-inventory`, which
+self-terminates to `ipxe-exit` after one inventory pass) and no image
+on first contact; the machine detail page is where an operator promotes
+it. Saving the bind form persists all three fields
 together, and the plan renderer reads them per PXE request: it resolves
 the image's netboot bundle, resolves the alias to its overlay (and
 base image), ensures the NBD export is up, and renders the plan. A

{pixie_lab-0.4.0 → pixie_lab-0.4.1}/docs/src/deployment.md

@@ -135,6 +135,13 @@ if HTTP is proxied but NBD is direct.
 to every pixie-live-env chain. Common values are hardware-quirk
 workarounds; see [](hardware-quirks.md).
 
+**`PIXIE_DEFAULT_BOOT_MODE`** (default: `pixie-inventory`) - boot mode a
+freshly-discovered MAC auto-registers with. The default is
+non-destructive (collect + post inventory, then exit) and one-shot (the
+first inventory POST flips it to `ipxe-exit`, so a PXE-first box does
+not re-inventory). Set to `ipxe-exit` for the old exit-by-default
+behaviour. See [](boot-modes.md).
+
 **`PIXIE_DATA_DIR`** (default: `/var/lib/pixie`) - state root. Holds
 `state.db`, `blobs/` (fetched image bytes), `artifacts/` (extracted
 netboot bundles), `overlays/<alias>.qcow2`

pixie_lab-0.4.1/pixie-media/live-build/config/includes.chroot/etc/initramfs-tools/conf.d/pixie-modules-most

@@ -0,0 +1,22 @@
+# pixie netboot-pc live env: bake a BROAD driver set into the initramfs.
+#
+# The live env's very first action after the kernel hands off is to
+# fetch its squashfs over HTTP from the kernel cmdline `fetch=` param
+# (Debian live-boot). That means the target's NIC must be driven from
+# INSIDE the initramfs, before pivot-root -- iPXE loaded vmlinuz+initrd
+# over the firmware's network stack, but from Linux on it's the kernel
+# module that matters.
+#
+# mkinitramfs' default is MODULES=dep: only the drivers the BUILD HOST
+# needs. So the netboot-pc initrd shipped drivers for the builder's NIC
+# (plus the r8125 DKMS hook) and nothing else -- a target with a
+# different NIC (e.g. matx / ASRock Rack) came up to `initrd` and then
+# stalled forever at the squashfs fetch, because its NIC had no driver.
+#
+# MODULES=most bakes the broad Debian-installer driver set, so an
+# arbitrary lab box's NIC (and storage) is alive before the fetch.
+# Costs initramfs size (~2x); acceptable for a netboot appliance whose
+# whole job is booting unknown hardware. Narrow to an explicit NIC list
+# in /etc/initramfs-tools/modules later if size becomes a problem and
+# the target NICs are known.
+MODULES=most

{pixie_lab-0.4.0 → pixie_lab-0.4.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "pixie-lab"
-version = "0.4.0"
+version = "0.4.1"
 description = "Bare-metal netboot appliance: catalog + fetch + NBD + PXE + TFTP + operator TUI in one container"
 readme = "README.md"
 requires-python = ">=3.11"

{pixie_lab-0.4.0 → pixie_lab-0.4.1}/src/pixie/machines/_routes.py

@@ -20,7 +20,7 @@ from pydantic import BaseModel, Field
 from pixie.events._kinds import MACHINE_BINDING_CHANGED, MACHINE_BOUND, MACHINE_DELETED
 from pixie.machines._store import (
     BOOT_MODES,
-    DEFAULT_BOOT_MODE,
+    UNCOMMITTED_BOOT_MODES,
     BadMac,
     MachinesStore,
     normalise_mac,
@@ -165,12 +165,14 @@ def upsert_machine(
         details: dict[str, Any] = {"boot_mode": row.boot_mode}
         if row.image_content_sha256:
             details["image_content_sha256"] = row.image_content_sha256
-        # ``machine.bound`` on a fresh MAC or on a row that was
-        # discovered-only (previous.boot_mode default with no bound
-        # image); ``machine.binding.changed`` when the mode or image
-        # actually shifted between the previous state and the new one.
+        # ``machine.bound`` on a fresh MAC or on a row that was only
+        # auto-registered (an uncommitted mode -- ipxe-exit or
+        # pixie-inventory -- with no bound image, including a machine
+        # that auto-inventoried then flipped back to ipxe-exit);
+        # ``machine.binding.changed`` when the mode or image actually
+        # shifted from a real prior operator bind.
         was_bound = previous is not None and (
-            bool(previous.image_content_sha256) or previous.boot_mode != DEFAULT_BOOT_MODE
+            bool(previous.image_content_sha256) or previous.boot_mode not in UNCOMMITTED_BOOT_MODES
         )
         changed = previous is not None and (
             previous.boot_mode != row.boot_mode

{pixie_lab-0.4.0 → pixie_lab-0.4.1}/src/pixie/machines/_store.py

@@ -46,7 +46,24 @@ target boots into ``unavailable.j2``. Kept close to :data:`BOOT_MODES`
 so a reader adding a mode sees both spots at once."""
 
 BOOT_MODES: frozenset[str] = frozenset({"ipxe-exit", "nbdboot"}) | LIVE_ENV_MODES
-DEFAULT_BOOT_MODE = "ipxe-exit"
+
+# A freshly-discovered MAC auto-registers with this mode. Default is
+# ``pixie-inventory``: non-destructive (boots the live env, collects
+# lshw + disks, POSTs them back, reboots to firmware) and immediately
+# useful -- it populates the machine's inventory and unblocks the flash
+# modes, which require it. Inventory is one-shot: on the first inventory
+# POST the binding auto-flips to ``ipxe-exit`` (see pxe/_routes.py) so a
+# PXE-first machine doesn't re-inventory + boot-loop. Overridable per
+# deploy via ``PIXIE_DEFAULT_BOOT_MODE`` (resolved in web/main.py).
+# ``ipxe-exit`` degrades safely when no live env is staged: the renderer
+# falls back to an exit plan, so a bare deploy behaves like the old
+# default until the operator fetches the live env.
+DEFAULT_BOOT_MODE = "pixie-inventory"
+
+# The non-committal auto states: a machine sitting in one of these with
+# no bound image has not been meaningfully operator-bound yet. Used to
+# tell a first ``machine.bound`` from a later ``machine.binding.changed``.
+UNCOMMITTED_BOOT_MODES: frozenset[str] = frozenset({"ipxe-exit", "pixie-inventory"})
 
 # Presentation metadata for the six boot modes. Ordered
 # passthrough -> diagnostic -> interactive -> destructive so the
@@ -480,10 +497,18 @@ class MachinesStore:
             row = conn.execute("SELECT * FROM machines WHERE mac = ?", (canon,)).fetchone()
         return _row(row)
 
-    def touch_seen(self, mac: str, *, ip: str = "") -> Machine:
+    def touch_seen(
+        self, mac: str, *, ip: str = "", default_boot_mode: str = DEFAULT_BOOT_MODE
+    ) -> Machine:
         """Discovery-side write: create-or-update ``last_seen_at`` +
-        optionally ``last_seen_ip``. Does NOT touch operator fields."""
+        optionally ``last_seen_ip``. Does NOT touch operator fields.
+
+        A brand-new MAC is auto-registered with ``default_boot_mode``
+        (the deploy's ``PIXIE_DEFAULT_BOOT_MODE``, resolved by the
+        caller; falls back to :data:`DEFAULT_BOOT_MODE`). Unknown values
+        are refused here so a bad env can't seed an unrenderable mode."""
         canon = normalise_mac(mac)
+        mode = default_boot_mode if default_boot_mode in BOOT_MODES else DEFAULT_BOOT_MODE
         now = now_iso()
         with _DB_WRITE_LOCK, self._conn() as conn:
             existing = conn.execute("SELECT * FROM machines WHERE mac = ?", (canon,)).fetchone()
@@ -495,7 +520,7 @@ class MachinesStore:
                         discovered_at, last_seen_at, last_seen_ip, updated_at
                     ) VALUES (?, ?, '', ?, ?, ?, ?)
                     """,
-                    (canon, DEFAULT_BOOT_MODE, now, now, ip, now),
+                    (canon, mode, now, now, ip, now),
                 )
             else:
                 conn.execute(

{pixie_lab-0.4.0 → pixie_lab-0.4.1}/src/pixie/pxe/_routes.py

@@ -21,13 +21,14 @@ from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import PlainTextResponse
 
 from pixie.events._kinds import (
+    MACHINE_BINDING_CHANGED,
     MACHINE_DISCOVERED,
     MACHINE_INVENTORY_UPDATED,
     PXE_PLAN_RENDERED,
     PXE_PLAN_UNAVAILABLE,
     PXE_STATUS_RECEIVED,
 )
-from pixie.machines._store import BadMac, MachinesStore, normalise_mac
+from pixie.machines._store import DEFAULT_BOOT_MODE, BadMac, MachinesStore, normalise_mac
 from pixie.pxe._renderer import PlanRenderer, RenderContext
 
 _log = logging.getLogger(__name__)
@@ -132,6 +133,33 @@ async def pxe_inventory(request: Request, mac: str) -> PlainTextResponse:
             summary=f"{canon} posted inventory",
             details=details,
         )
+
+    # Inventory is one-shot: once a machine has reported, flip a
+    # pixie-inventory binding to ipxe-exit so a PXE-first machine does
+    # not re-inventory and boot-loop. Mirrors pixie-flash-once's
+    # self-terminating flip (see pxe_status). Preserve the row's other
+    # fields; the collected inventory stays. Rebinding to
+    # pixie-inventory buys exactly one more pass.
+    row = machines.get(canon)
+    if row is not None and row.boot_mode == "pixie-inventory":
+        with contextlib.suppress(ValueError):
+            machines.upsert_binding(
+                canon,
+                boot_mode="ipxe-exit",
+                image_content_sha256=row.image_content_sha256,
+                labels=list(row.labels),
+                target_disk_serial=row.target_disk_serial,
+                extra_cmdline=row.extra_cmdline,
+                overlay_alias=row.overlay_alias,
+            )
+        if log is not None:
+            log.emit(
+                MACHINE_BINDING_CHANGED,
+                subject_kind="machine",
+                subject_id=canon,
+                summary=f"{canon}: inventory collected, auto-exit (pixie-inventory is one-shot)",
+                details={"boot_mode": "ipxe-exit", "reason": "inventory-once"},
+            )
     return PlainTextResponse("", status_code=204)
 
 
@@ -168,7 +196,8 @@ def pxe_plan(request: Request, mac: str) -> PlainTextResponse:
     # event fires exactly once (touch_seen itself can't emit -- stores
     # hold no EventsLog by design).
     is_new = machines.get(canon) is None
-    row = machines.touch_seen(canon, ip=_client_ip(request))
+    default_mode = getattr(request.app.state, "default_boot_mode", DEFAULT_BOOT_MODE)
+    row = machines.touch_seen(canon, ip=_client_ip(request), default_boot_mode=default_mode)
 
     ctx = _render_context(request)
     body = _get_renderer(request).render(row, ctx)

{pixie_lab-0.4.0 → pixie_lab-0.4.1}/src/pixie/web/_settings_store.py

@@ -18,6 +18,7 @@ from __future__ import annotations
 
 import contextlib
 import os
+import re
 import sqlite3
 from collections.abc import Generator
 from datetime import UTC, datetime
@@ -66,6 +67,13 @@ DEFAULT_DATETIME_FORMAT = "%Y-%m-%d %H:%M:%S"
 KEY_LIVE_ENV_EXTRA_CMDLINE = "live_env.extra_cmdline"
 ENV_LIVE_ENV_EXTRA_CMDLINE = "PIXIE_LIVE_ENV_EXTRA_CMDLINE"
 
+# A value that is nothing but an unexpanded shell placeholder --
+# ``${VAR}`` / ``${VAR:-default}`` / ``${VAR:+x}`` -- which is what a
+# compose runner that doesn't expand ``${VAR:-}`` (podman-compose)
+# leaks into the container env. Such a value is treated as "unset" so
+# it never reaches a kernel cmdline.
+_UNEXPANDED_ENV_PLACEHOLDER = re.compile(r"^\$\{[A-Za-z_][A-Za-z0-9_]*(:[-+?=]?[^}]*)?\}$")
+
 # Where the operator "Fetch live-env" action pulls the netboot-pc bake
 # from: a single tarball ``src`` (``https://`` or ``oras://``, the same
 # schemes the catalog fetch speaks) that unpacks to vmlinuz + initrd +
@@ -175,12 +183,21 @@ class SettingsStore:
           silently.
 
         Empty when both DB override + env are unset -- the template
-        expects a string and skips the append when it's empty."""
-        return (
-            self.get(KEY_LIVE_ENV_EXTRA_CMDLINE)
-            or (os.environ.get(ENV_LIVE_ENV_EXTRA_CMDLINE) or "").strip()
-            or ""
-        )
+        expects a string and skips the append when it's empty.
+
+        Defends against a compose runner that fails to expand
+        ``${VAR:-}``: podman-compose passes the unset default through
+        LITERALLY, so the container env holds the string
+        ``${PIXIE_LIVE_ENV_EXTRA_CMDLINE:-}``. A value that is nothing
+        but an unexpanded ``${...}`` placeholder is treated as empty so
+        it can't leak onto every live-env / nbdboot kernel cmdline."""
+        override = self.get(KEY_LIVE_ENV_EXTRA_CMDLINE)
+        if override:
+            return override
+        env = (os.environ.get(ENV_LIVE_ENV_EXTRA_CMDLINE) or "").strip()
+        if env and not _UNEXPANDED_ENV_PLACEHOLDER.match(env):
+            return env
+        return ""
 
     def resolve_live_env_src(self) -> str:
         """Effective live-env fetch src: DB override -> env -> default

{pixie_lab-0.4.0 → pixie_lab-0.4.1}/src/pixie/web/main.py

@@ -66,7 +66,12 @@ from pixie.exports._routes import router as exports_router
 from pixie.exports._store import ExportsStore, OverlaysStore
 from pixie.exports._supervisor import DEFAULT_PORT_BASE, NbdServer
 from pixie.machines._routes import router as machines_router
-from pixie.machines._store import IMAGE_BOOT_MODES, MachinesStore
+from pixie.machines._store import (
+    BOOT_MODES,
+    DEFAULT_BOOT_MODE,
+    IMAGE_BOOT_MODES,
+    MachinesStore,
+)
 from pixie.pxe._renderer import PlanRenderer
 from pixie.pxe._routes import router as pxe_router
 from pixie.tftp import DEFAULT_TFTP_ROOT, TftpServer
@@ -183,6 +188,18 @@ def _resolve_live_env_dir() -> Path | None:
     return default
 
 
+def _resolve_default_boot_mode() -> str:
+    """Boot mode a freshly-discovered MAC auto-registers with.
+
+    ``PIXIE_DEFAULT_BOOT_MODE`` override -> :data:`DEFAULT_BOOT_MODE`
+    (``pixie-inventory``). An unknown value falls back to the default
+    rather than seeding an unrenderable mode on every new machine."""
+    override = (os.environ.get("PIXIE_DEFAULT_BOOT_MODE") or "").strip()
+    if override in BOOT_MODES:
+        return override
+    return DEFAULT_BOOT_MODE
+
+
 def _resolve_state_dir() -> Path:
     """Where pixie writes state.db + blobs/ + artifacts/.
 
@@ -405,6 +422,18 @@ def _deployment_envvar_docs() -> list[dict[str, str]]:
                 " the Live env page for the live-editable override."
             ),
         },
+        {
+            "name": "PIXIE_DEFAULT_BOOT_MODE",
+            "default": "pixie-inventory",
+            "purpose": (
+                "Boot mode a freshly-discovered MAC auto-registers with."
+                " Default 'pixie-inventory' is non-destructive (collects"
+                " lshw + disks, posts them, exits) and one-shot: the first"
+                " inventory POST flips it to 'ipxe-exit' so a PXE-first"
+                " box does not re-inventory. Set 'ipxe-exit' for the old"
+                " exit-by-default behaviour."
+            ),
+        },
         {
             "name": "PIXIE_LIVE_ENV_SRC",
             "default": (
@@ -726,6 +755,7 @@ def create_app() -> FastAPI:
         nbdkit_bin=_resolve_nbdkit_bin(),
     )
     app.state.live_env_dir = _resolve_live_env_dir()
+    app.state.default_boot_mode = _resolve_default_boot_mode()
     # Root for per-machine qcow2 overlay files. Sub-directory under
     # the state dir so a single ``PIXIE_DATA_DIR`` override still
     # relocates everything (catalog blobs + overlays + state.db)

{pixie_lab-0.4.0 → pixie_lab-0.4.1}/tests/test_machines_unit.py

@@ -550,3 +550,61 @@ def test_ui_machines_live_requires_auth(client: TestClient) -> None:
     r = client.get("/ui/machines-live.json", follow_redirects=False)
     assert r.status_code == 303
     assert r.headers["location"] == "/ui/login"
+
+
+def test_touch_seen_defaults_to_pixie_inventory(tmp_path: Path) -> None:
+    """A freshly-discovered MAC auto-registers with the default boot
+    mode -- now pixie-inventory (non-destructive + useful), not the old
+    ipxe-exit no-op."""
+    store = MachinesStore(tmp_path / "state.db")
+    m = store.touch_seen("aa:bb:cc:dd:ee:01")
+    assert m.boot_mode == "pixie-inventory"
+
+
+def test_touch_seen_honours_default_and_rejects_unknown(tmp_path: Path) -> None:
+    store = MachinesStore(tmp_path / "state.db")
+    assert store.touch_seen("aa:bb:cc:dd:ee:02", default_boot_mode="ipxe-exit").boot_mode == (
+        "ipxe-exit"
+    )
+    # An unknown value can't seed an unrenderable mode on every new MAC.
+    assert store.touch_seen("aa:bb:cc:dd:ee:03", default_boot_mode="bogus").boot_mode == (
+        "pixie-inventory"
+    )
+
+
+def test_resolve_default_boot_mode_env_override(monkeypatch: pytest.MonkeyPatch) -> None:
+    from pixie.web.main import _resolve_default_boot_mode
+
+    monkeypatch.delenv("PIXIE_DEFAULT_BOOT_MODE", raising=False)
+    assert _resolve_default_boot_mode() == "pixie-inventory"
+    monkeypatch.setenv("PIXIE_DEFAULT_BOOT_MODE", "ipxe-exit")
+    assert _resolve_default_boot_mode() == "ipxe-exit"
+    monkeypatch.setenv("PIXIE_DEFAULT_BOOT_MODE", "bogus")
+    assert _resolve_default_boot_mode() == "pixie-inventory"
+
+
+def test_inventory_post_flips_pixie_inventory_to_ipxe_exit(client: TestClient) -> None:
+    """Inventory is one-shot: a machine sitting in pixie-inventory flips
+    to ipxe-exit on the first inventory POST (so a PXE-first box doesn't
+    re-inventory + boot-loop), and the collected inventory is kept."""
+    mac = "aa:bb:cc:dd:ee:f0"
+    client.get(f"/pxe/{mac}")  # discovery -> pixie-inventory default
+    assert client.get(f"/machines/{mac}").json()["boot_mode"] == "pixie-inventory"
+
+    r = client.post(
+        f"/pxe/{mac}/inventory", json={"lshw": {"x": 1}, "disks": [{"path": "/dev/sda"}]}
+    )
+    assert r.status_code == 204
+    assert client.get(f"/machines/{mac}").json()["boot_mode"] == "ipxe-exit"
+    # the inventory itself survives the flip
+    assert client.get(f"/machines/{mac}/inventory").json()["inventory"]["disks"]
+
+
+def test_inventory_post_does_not_flip_a_non_inventory_mode(client: TestClient) -> None:
+    """A machine an operator put on, say, nbdboot is left alone -- only
+    pixie-inventory is one-shot."""
+    c = _authed(client)
+    mac = "aa:bb:cc:dd:ee:f1"
+    c.put(f"/machines/{mac}", json={"boot_mode": "nbdboot"})
+    client.post(f"/pxe/{mac}/inventory", json={"lshw": {}, "disks": []})
+    assert client.get(f"/machines/{mac}").json()["boot_mode"] == "nbdboot"

{pixie_lab-0.4.0 → pixie_lab-0.4.1}/tests/test_pxe_plan_json.py

@@ -360,7 +360,9 @@ def test_pxe_first_contact_emits_machine_discovered_once(client: TestClient) ->
     discovered = [e for e in log.list(limit=500) if e.kind == "machine.discovered"]
     assert len(discovered) == 1
     assert discovered[0].subject_id == mac
-    assert discovered[0].details.get("boot_mode") == "ipxe-exit"
+    # A fresh MAC auto-registers with the default boot mode, now
+    # pixie-inventory (non-destructive + useful).
+    assert discovered[0].details.get("boot_mode") == "pixie-inventory"
 
     client.get(f"/pxe/{mac}")  # second contact for the now-known MAC
     still = [e for e in log.list(limit=500) if e.kind == "machine.discovered"]

{pixie_lab-0.4.0 → pixie_lab-0.4.1}/tests/test_settings.py

@@ -258,3 +258,23 @@ def test_ui_settings_live_env_blank_clears(client: TestClient) -> None:
     store.set_value(KEY_LIVE_ENV_EXTRA_CMDLINE, "pci=realloc=on,nocrs")
     c.post("/ui/live-env/cmdline/edit", data={"extra_cmdline": ""})
     assert store.get(KEY_LIVE_ENV_EXTRA_CMDLINE) is None
+
+
+def test_resolve_extra_cmdline_ignores_unexpanded_placeholder(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """A compose runner that doesn't expand ``${VAR:-}`` (podman-compose)
+    leaks the literal placeholder into the container env. It must not
+    reach the kernel cmdline; a real value still passes through."""
+    from pixie.web._settings_store import ENV_LIVE_ENV_EXTRA_CMDLINE, SettingsStore
+
+    store = SettingsStore(tmp_path / "state.db")
+    for leaked in ("${PIXIE_LIVE_ENV_EXTRA_CMDLINE:-}", "${FOO}", "${BAR:-x}"):
+        monkeypatch.setenv(ENV_LIVE_ENV_EXTRA_CMDLINE, leaked)
+        assert store.resolve_live_env_extra_cmdline() == ""
+    # A real value passes through untouched, including one that merely
+    # contains (but is not wholly) a ${...} token.
+    monkeypatch.setenv(ENV_LIVE_ENV_EXTRA_CMDLINE, "pci=nommconf amd_iommu=off")
+    assert store.resolve_live_env_extra_cmdline() == "pci=nommconf amd_iommu=off"
+    monkeypatch.setenv(ENV_LIVE_ENV_EXTRA_CMDLINE, "foo=${bar} baz")
+    assert store.resolve_live_env_extra_cmdline() == "foo=${bar} baz"

{pixie_lab-0.4.0 → pixie_lab-0.4.1}/uv.lock

@@ -494,7 +494,7 @@ wheels = [
 
 [[package]]
 name = "pixie-lab"
-version = "0.4.0"
+version = "0.4.1"
 source = { editable = "." }
 dependencies = [
     { name = "fastapi" },