From 6069ac0669831fb7d45ab4d5cde52ef6a7b126a0 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 21 Jun 2026 17:08:09 +0200
Subject: [PATCH] fix(dev): rely on default flux dev capabilities

---
 scripts/dev.sh                       |  5 +----
 tests/Feature/FluxDevCommandTest.php | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/scripts/dev.sh b/scripts/dev.sh
index b9a0816147..cc0e9e1e2b 100755
--- a/scripts/dev.sh
+++ b/scripts/dev.sh
@@ -412,12 +412,9 @@ mint_host_jwt_for_host() {
   local host_id="$1"
   local attempts=60
   local output
-  local caps
-
-  caps="coold"
 
   for attempt in $(seq 1 "$attempts"); do
-    if output="$(spin exec -T coolify php artisan flux:dev "$host_id" --caps="$caps" 2>&1)"; then
+    if output="$(spin exec -T coolify php artisan flux:dev "$host_id" 2>&1)"; then
       printf '%s\n' "$output" | tail -n 1
       return 0
     fi
diff --git a/tests/Feature/FluxDevCommandTest.php b/tests/Feature/FluxDevCommandTest.php
index 58279582c1..ea31e6e66e 100644
--- a/tests/Feature/FluxDevCommandTest.php
+++ b/tests/Feature/FluxDevCommandTest.php
@@ -27,6 +27,24 @@ it('mints a host jwt signed by the configured flux private key', function () {
         ->and($claims->exp)->toBeGreaterThan(time());
 });
 
+it('mints a host jwt with only the coarse coold capability by default', function () {
+    [$privateKeyPath, $publicKeyPath] = createFluxJwtKeypair();
+
+    Config::set('flux.jwt_private_key_path', $privateKeyPath);
+
+    $exitCode = Artisan::call('flux:dev', [
+        'host_id' => 'coold-dev',
+        '--ttl' => '600',
+    ]);
+
+    expect($exitCode)->toBe(0);
+
+    $token = trim(Artisan::output());
+    $claims = JWT::decode($token, new Key(file_get_contents($publicKeyPath), 'ES256'));
+
+    expect($claims->caps)->toBe(['coold']);
+});
+
 it('writes the host jwt to an output path with owner-only permissions', function () {
     [$privateKeyPath] = createFluxJwtKeypair();
     $outputPath = storage_path('framework/testing/host-jwt');