{"record":{"id":"62360ccd239f8e4d","repo":"astrid-runtime/astrid","slug":"capsules-are-installed-but-granting-capsule-acces","errorCode":null,"errorMessage":"capsules are installed, but granting capsule access failed: {e}\n  Finish manually:\n  {}","messagePattern":"capsules are installed, but granting capsule access failed: (.+?)\n  Finish manually:\n  (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/init_grant.rs","lineNumber":531,"sourceCode":"                \"{}\",\n                Theme::success(&format!(\n                    \"Granted capsule access to '{target}': [{}]\",\n                    outcome.capsules.join(\", \")\n                ))\n            );\n            Ok(())\n        },\n        Ok(_) => {\n            eprintln!(\n                \"{}\",\n                Theme::info(&format!(\n                    \"'{target}' already had access to every installed capsule (no change).\"\n                ))\n            );\n            Ok(())\n        },\n        Err(e) => {\n            bail!(\n                \"capsules are installed, but granting capsule access failed: {e}\\n  \\\n                 Finish manually:\\n  {}\",\n                agent_modify_grant_command(operator, target, installed)\n            );\n        },\n    }\n}\n\n#[cfg(test)]\nmod tests {\n    use super::*;\n    use crate::commands::capsule::{install, meta};\n    use crate::commands::init::LockedCapsule;\n\n    #[test]\n    fn explicit_grants_include_completed_batches_and_idempotent_resume() {\n        let completed: Vec<_> = (0..22)\n            .map(|i| LockedCapsule {","sourceCodeStart":513,"sourceCodeEnd":549,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/init_grant.rs#L513-L549","documentation":"This error is raised in grant_installed_capsules (via apply_or_hint_grants) when capsules were successfully installed for an agent, but the follow-up step of granting that agent modify access to them failed. Because the automated grant failed (e.g. the OS ACL/chmod operation returned an error), the CLI aborts and prints the exact manual command (agent_modify_grant_command) the user can run to finish the setup by hand.","triggerScenarios":"apply_or_hint_grants -> grant_installed_capsules runs after capsule installation; the internal grant operation returns Err(e) for the target agent, so the function bails with the underlying error plus the manual grant command.","commonSituations":"Running `astrid init` on a system where permission changes fail: read-only filesystem, lack of ownership of the capsule directory, restricted ACL tooling (missing setfacl/chmod rights), sandboxed CI environments, or the target agent user not existing.","solutions":["Run the manual command printed in the error message (agent_modify_grant_command output) to grant access yourself.","Check ownership/permissions of the capsule install directory and re-run init as a user with rights to modify ACLs.","Fix the underlying cause shown in `{e}` (e.g. missing ACL tool, read-only mount) and re-run `astrid init`."],"exampleFix":"// before (automated grant fails, init aborts)\nastrid init --agent codex\n// error: granting capsule access failed ...\n\n// after: run the suggested manual grant\nchmod -R u+rwX,g+rx ~/.astrid/capsules  # or the agent_modify_grant_command printed","handlingStrategy":"try-catch","validationCode":"// before init\ntest -w ~/.astrid/capsules && echo writable || echo \"fix ownership/permissions first\"\ncommand -v setfacl >/dev/null && echo \"acl tools present\" || echo \"install acl tools\"","typeGuard":null,"tryCatchPattern":"// shell\nif ! astrid init --agent codex; then\n  echo \"automated grant failed; applying manual grant\"\n  eval \"$(astrid agent grant-command codex installed-capsules)\" # command printed in the error\nfi","preventionTips":["Run init as a user that owns the capsule install directory.","Verify the target agent user exists and ACL tooling (setfacl) is installed.","Avoid read-only mounts for the capsule directory."],"tags":["permissions","filesystem","cli","capsules"],"backgroundTag":"permission-denied","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}