{"record":{"id":"6a0a9ba60b019493","repo":"astrid-runtime/astrid","slug":"daemon-rejected-capsule-metadata-request-message-6a0a9b","errorCode":null,"errorMessage":"daemon rejected capsule metadata request: {message}","messagePattern":"daemon rejected capsule metadata request: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-cli/src/commands/capsule/show.rs","lineNumber":72,"sourceCode":"    pub contracts_canonical: Option<String>,\n    /// Skew classification: `match`, `mismatch`, `no-canonical`, or\n    /// `not-pinned`.\n    pub contracts_status: String,\n    /// Verbatim `Capsule.toml` body.\n    pub manifest: String,\n    /// Human-facing permissions derived from the manifest.\n    pub permissions: Vec<SemanticCapability>,\n}\n\n/// Entry point for `astrid capsule show`.\npub(crate) async fn run(args: &ShowArgs) -> Result<ExitCode> {\n    let principal = context::resolve_agent(args.agent.as_deref())?;\n    let format = ValueFormat::parse(&args.format);\n    let mut client = crate::socket_client::connect_kernel_for_workspace(None).await?;\n    let entries = match client.request(KernelRequest::GetCapsuleMetadata).await? {\n        KernelResponse::CapsuleMetadata(entries) => entries,\n        KernelResponse::Error(message) => {\n            anyhow::bail!(\"daemon rejected capsule metadata request: {message}\")\n        },\n        other => anyhow::bail!(\"unexpected daemon response: {other:?}\"),\n    };\n    let Some(entry) = entries.into_iter().find(|entry| entry.name == args.name) else {\n        eprintln!(\n            \"{}\",\n            Theme::error(&format!(\n                \"capsule '{}' is not installed for agent '{principal}'\",\n                args.name\n            ))\n        );\n        return Ok(ExitCode::from(1));\n    };\n    let capabilities: astrid_capsule_types::manifest::CapabilitiesDef =\n        serde_json::from_value(entry.capabilities.clone())?;\n    let permissions = semantic_capabilities(&capabilities);\n    let manifest = serde_json::to_string_pretty(&serde_json::json!({\n        \"package\": {","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-cli/src/commands/capsule/show.rs#L54-L90","documentation":"The capsule show command connects to the daemon over the workspace socket and requests KernelRequest::GetCapsuleMetadata. If the daemon answers with KernelResponse::Error(message), the CLI bails, surfacing the daemon's rejection reason. This means the request reached the daemon but was refused there (permissions, capability denial, internal error).","triggerScenarios":"Running astrid capsule show <name> when the daemon replies Error to GetCapsuleMetadata — e.g. the requesting agent lacks permission to read capsule metadata, or the daemon cannot serve metadata in its current state.","commonSituations":"Daemon policy denying metadata reads for the current agent/principal; daemon busy or in a degraded state; querying after a daemon restart before capsules are re-registered.","solutions":["Read the daemon-provided message in the error and address the stated cause (e.g. authenticate as an agent with metadata access).","Restart the daemon and retry once it has re-registered capsules.","Check daemon policy/permission configuration for the current principal."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// ensure a daemon is connected for this workspace first\nif !daemon_socket_reachable().await {\n    anyhow::bail!(\"no daemon running for this workspace\");\n}","typeGuard":"fn is_daemon_metadata_denial(e: &anyhow::Error) -> bool {\n    e.to_string().contains(\"rejected capsule metadata request\")\n}","tryCatchPattern":"match client.request(KernelRequest::GetCapsuleMetadata).await? {\n    KernelResponse::CapsuleMetadata(entries) => Ok(entries),\n    KernelResponse::Error(m) => Err(anyhow!(m)),\n    other => Err(anyhow!(\"unexpected: {other:?}\")),\n}","preventionTips":["Grant the agent permission to read capsule metadata in daemon policy.","Reconnect/restart the daemon after upgrades before querying metadata.","Log the daemon's reason verbatim for support tickets."],"tags":["ipc","daemon","permissions"],"backgroundTag":"api-error-response","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}