{"record":{"id":"3d8115f3fb29cdc8","repo":"astrid-runtime/astrid","slug":"capsules-are-installed-but-connecting-to-the-sele","errorCode":null,"errorMessage":"capsules are installed, but connecting to the selected workspace daemon to grant access failed: {e}\n  Grant them once the daemon is running:\n  {}","messagePattern":"capsules are installed, but connecting to the selected workspace daemon to grant access failed: (.+?)\n  Grant them once the daemon is running:\n  (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/init_grant.rs","lineNumber":500,"sourceCode":"/// principal reports \"no change\" instead of erroring or duplicating.\nasync fn grant_installed_capsules(\n    operator: &PrincipalId,\n    target: &PrincipalId,\n    installed: &[String],\n) -> anyhow::Result<()> {\n    eprintln!();\n    eprintln!(\n        \"{}\",\n        Theme::info(&format!(\n            \"Granting {} capsule(s) to '{target}'...\",\n            installed.len()\n        ))\n    );\n\n    let mut client = match crate::admin_client::connect_for_workspace_as(operator.clone()).await {\n        Ok(c) => c,\n        Err(e) => {\n            bail!(\n                \"capsules are installed, but connecting to the selected workspace daemon to grant access failed: {e}\\n  \\\n                 Grant them once the daemon is running:\\n  {}\",\n                agent_modify_grant_command(operator, target, installed)\n            );\n        },\n    };\n\n    match crate::commands::agent::apply_agent_modify(&mut client, target, &[], &[], installed, &[])\n        .await\n    {\n        Ok(outcome) if outcome.changed => {\n            eprintln!(\n                \"{}\",\n                Theme::success(&format!(\n                    \"Granted capsule access to '{target}': [{}]\",\n                    outcome.capsules.join(\", \")\n                ))\n            );","sourceCodeStart":482,"sourceCodeEnd":518,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/init_grant.rs#L482-L518","documentation":"After capsules are installed, grant_installed_capsules tries to connect to the selected workspace daemon (as the operator) to create the access grants. If the daemon is unreachable or connection fails, the CLI bails with a remediation hint containing the exact agent modify-grant command to run once the daemon is up.","triggerScenarios":"grant_installed_capsules calls crate::admin_client::connect_for_workspace_as(operator) and the returned future resolves to Err — daemon not running, wrong workspace selected, or connection refused/timed out.","commonSituations":"Daemon not started yet after machine boot or deploy, daemon listening on a different address/port than the workspace config points to, network/firewall blocking the socket, operator credentials not accepted for the workspace.","solutions":["Start the workspace daemon, then re-run the grant (or run the printed modify-grant command).","Run the exact command from the error message (agent_modify_grant_command output) once the daemon is reachable.","Verify the workspace selection and daemon address/port in your config match where the daemon listens.","Check operator authentication/credentials for connect_for_workspace_as if the daemon is up but rejects the connection.","Check firewall/proxy rules blocking the daemon socket."],"exampleFix":"// before: init fails with connection error\n$ astrid init\n// after: start daemon first, then grant\n$ astrid daemon start\n$ astrid agent modify-grant --operator alice --target workspace ...","handlingStrategy":"retry","validationCode":"// before granting, check the daemon is reachable\nmatch tokio::net::TcpStream::connect(&daemon_addr).await {\n    Ok(_) => (),\n    Err(e) => eprintln!(\"daemon not reachable at {daemon_addr}: {e}; start it first\"),\n}","typeGuard":null,"tryCatchPattern":"let client = loop {\n    match admin_client::connect_for_workspace_as(op.clone()).await {\n        Ok(c) => break Ok(c),\n        Err(e) if attempts < 5 => { sleep(backoff).await; attempts += 1; }\n        Err(e) => break Err(e),\n    }\n};","preventionTips":["Start the workspace daemon before running init/grant workflows.","Script health-check probes of the daemon socket prior to granting.","Persist the printed modify-grant command so it can be replayed later.","Verify workspace selection and daemon address/port in config after environment changes."],"tags":["network","daemon","connection","cli","grant"],"backgroundTag":"connection-refused","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}