fix(dev): rely on default flux dev capabilities

scripts/dev.sh

@@ -412,12 +412,9 @@ mint_host_jwt_for_host() {
   local host_id="$1"
   local attempts=60
   local output
-  local caps
-
-  caps="coold"
 
   for attempt in $(seq 1 "$attempts"); do
-    if output="$(spin exec -T coolify php artisan flux:dev "$host_id" --caps="$caps" 2>&1)"; then
+    if output="$(spin exec -T coolify php artisan flux:dev "$host_id" 2>&1)"; then
       printf '%s\n' "$output" | tail -n 1
       return 0
     fi

tests/Feature/FluxDevCommandTest.php

@@ -27,6 +27,24 @@ it('mints a host jwt signed by the configured flux private key', function () {
         ->and($claims->exp)->toBeGreaterThan(time());
 });
 
+it('mints a host jwt with only the coarse coold capability by default', function () {
+    [$privateKeyPath, $publicKeyPath] = createFluxJwtKeypair();
+
+    Config::set('flux.jwt_private_key_path', $privateKeyPath);
+
+    $exitCode = Artisan::call('flux:dev', [
+        'host_id' => 'coold-dev',
+        '--ttl' => '600',
+    ]);
+
+    expect($exitCode)->toBe(0);
+
+    $token = trim(Artisan::output());
+    $claims = JWT::decode($token, new Key(file_get_contents($publicKeyPath), 'ES256'));
+
+    expect($claims->caps)->toBe(['coold']);
+});
+
 it('writes the host jwt to an output path with owner-only permissions', function () {
     [$privateKeyPath] = createFluxJwtKeypair();
     $outputPath = storage_path('framework/testing/host-jwt');