make capability requirements detect target OS implicitly

Author: marcofortina

docs/plugins/linux-operations.md

@@ -239,10 +239,10 @@ and `group.member_absent`. Removing a group member requires `confirm: true`.
 
 ## OS-aware job-scoped capability preflight
 
-Automax can derive remote command dependencies from the selected job plan and render per-target checks. With `--detect-os`, Automax first reads `/etc/os-release` on each target, classifies it as DEBIAN-like or RHEL-like, filters backend-specific plugins for that OS family, and reports OS-mismatched plugins as skipped requirements instead of requiring irrelevant tools.
+Automax can derive remote command dependencies from the selected job plan and render per-target checks. Automax first reads `/etc/os-release` on each target, classifies it as DEBIAN-like or RHEL-like, filters backend-specific plugins for that OS family, and reports OS-mismatched plugins as skipped requirements instead of requiring irrelevant tools.
 
 ```bash
-automax capabilities requirements --job jobs/site.yaml --inventory inventory/prod.yaml --detect-os
+automax capabilities requirements --job jobs/site.yaml --inventory inventory/prod.yaml
 ```
 
 Normal `automax run` performs this OS detection and capability preflight implicitly before executing selected substeps. The older `--preflight-capabilities` flag remains accepted for compatibility, but the preflight is now the default for normal runs that require remote tools.

docs/plugins/security.md

@@ -103,7 +103,7 @@ paths.
 
 ## Capability preflight and redaction policy
 
-Use `capabilities requirements --detect-os` to derive remote tool requirements from the selected job plan after detecting each target OS family. Normal `automax run` performs the same OS-aware capability preflight implicitly before executing remote tools. Use `capabilities install --sudo-password-env ENV_NAME` to install only missing dependency packages for the selected job and target OS.
+Use `capabilities requirements` to derive remote tool requirements from the selected job plan after detecting each target OS family. Normal `automax run` performs the same OS-aware capability preflight implicitly before executing remote tools. Use `capabilities install --sudo-password-env ENV_NAME` to install only missing dependency packages for the selected job and target OS.
 
 The explicit capability plugins are:
 

src/automax/cli/cli.py

@@ -977,7 +977,6 @@ def capabilities() -> None:
 @click.option("--tags", multiple=True, help="Show requirements for substeps matching one of these tags.")
 @click.option("--skip-tags", multiple=True, help="Hide requirements for substeps matching one of these tags.")
 @click.option("--plugin-path", multiple=True, help="External plugin file or directory.")
-@click.option("--detect-os", is_flag=True, help="Detect target OS and filter requirements for each OS family.")
 @click.option(
     "--format",
     "output_format",
@@ -997,7 +996,6 @@ def capability_requirements(
     tags: tuple[str, ...],
     skip_tags: tuple[str, ...],
     plugin_path: tuple[str, ...],
-    detect_os: bool,
     output_format: str,
 ) -> None:
     """Render tool requirements derived from the selected job plan."""
@@ -1012,7 +1010,6 @@ def capability_requirements(
             tags=_split_selectors(tags),
             skip_tags=_split_selectors(skip_tags),
             cli_vars=_parse_vars(cli_vars),
-            detect_os=detect_os,
         )
     except (AutomaxError, ValueError, RuntimeError) as exc:
         raise click.ClickException(str(exc)) from exc

src/automax/core/engine.py

@@ -799,7 +799,6 @@ def capability_requirements_job(
         tags: Iterable[str] = (),
         skip_tags: Iterable[str] = (),
         cli_vars: Optional[Dict[str, Any]] = None,
-        detect_os: bool = False,
     ) -> Dict[str, Any]:
         """Return job-scoped remote capability requirements from the selected plan."""
         resolved = self.resolve_job_context(
@@ -813,12 +812,11 @@ def capability_requirements_job(
             skip_tags=skip_tags,
             cli_vars=cli_vars,
         )
-        os_by_target = self._detect_os_for_plan(resolved.plan, resolved.secrets) if detect_os else {}
+        os_by_target = self._detect_os_for_plan(resolved.plan, resolved.secrets)
         requirements = collect_requirements(self.iter_rendered_plan_items(resolved, dry_run=True), os_by_target)
         return {
             "job": self._job_name(resolved.job),
             "mode": "capability-requirements",
-            "detect_os": detect_os,
             "targets": [requirements[name] for name in sorted(requirements)],
             "target_count": len(requirements),
             "tool_count": len({tool for item in requirements.values() for tool in item["tools"]}),

tests/test_next_engine.py

@@ -4408,7 +4408,9 @@ def test_fs_write_template_metadata_exposes_atomic_option():
         assert "atomic" in params
 
 
-def test_capability_requirements_are_derived_from_selected_job(tmp_path: Path):
+def test_capability_requirements_are_derived_from_selected_job(tmp_path: Path, monkeypatch):
+    from automax.core.os_detect import TargetOS
+
     job = write(
         tmp_path / "job.yaml",
         """
@@ -4436,6 +4438,11 @@ def test_capability_requirements_are_derived_from_selected_job(tmp_path: Path):
 """,
     )
     inventory = write(tmp_path / "inventory.yaml", "servers:\n  controller:\n    host: 127.0.0.1\n")
+    monkeypatch.setattr(
+        AutomaxEngine,
+        "_detect_os_for_plan",
+        lambda self, plan, secrets: {"controller": TargetOS(id="ubuntu", id_like=("debian",), family="debian", package_manager="apt")},
+    )
 
     payload = AutomaxEngine().capability_requirements_job(job_path=str(job), inventory_path=str(inventory))
 
@@ -4493,6 +4500,58 @@ def test_capability_and_redaction_plugins_render_safe_previews():
     assert not leaked.ok
 
 
+
+def test_capability_requirements_cli_detects_os_without_flag(tmp_path: Path, monkeypatch):
+    from automax.core.os_detect import TargetOS
+
+    job = write(
+        tmp_path / "job.yaml",
+        """
+apiVersion: automax.io/v1
+kind: Job
+metadata:
+  name: cli-caps
+tasks:
+  - id: ops
+    targets: all
+    steps:
+      - id: packages
+        substeps:
+          - id: install
+            use: pkg.install
+            with:
+              packages: [curl]
+              manager: auto
+""",
+    )
+    inventory = write(tmp_path / "inventory.yaml", "servers:\n  node:\n    host: 127.0.0.1\n")
+
+    monkeypatch.setattr(
+        AutomaxEngine,
+        "_detect_os_for_plan",
+        lambda self, plan, secrets: {"node": TargetOS(id="ubuntu", id_like=("debian",), family="debian", package_manager="apt")},
+    )
+
+    result = CliRunner().invoke(
+        cli,
+        [
+            "capabilities",
+            "requirements",
+            "--job",
+            str(job),
+            "--inventory",
+            str(inventory),
+            "--format",
+            "json",
+        ],
+    )
+
+    assert result.exit_code == 0, result.output
+    payload = json.loads(result.output)
+    assert payload["targets"][0]["os"]["family"] == "debian"
+    assert "apt-get" in payload["targets"][0]["tools"]
+
+
 def test_capability_requirements_filter_tools_by_detected_os(tmp_path: Path, monkeypatch):
     from automax.core.os_detect import TargetOS
 
@@ -4534,7 +4593,7 @@ def test_capability_requirements_filter_tools_by_detected_os(tmp_path: Path, mon
         lambda plan, secrets: {"node": TargetOS(id="ubuntu", id_like=("debian",), family="debian", package_manager="apt")},
     )
 
-    payload = engine.capability_requirements_job(job_path=str(job), inventory_path=str(inventory), detect_os=True)
+    payload = engine.capability_requirements_job(job_path=str(job), inventory_path=str(inventory))
 
     target = payload["targets"][0]
     assert target["os"]["family"] == "debian"