capsules are installed, but connecting to the selected works

Error message

capsules are installed, but connecting to the selected workspace daemon to grant access failed: {e}
  Grant them once the daemon is running:
  {}

What it means

After capsules are installed, grant_installed_capsules tries to connect to the selected workspace daemon (as the operator) to create the access grants. If the daemon is unreachable or connection fails, the CLI bails with a remediation hint containing the exact agent modify-grant command to run once the daemon is up.

Source

Thrown at crates/astrid-cli/src/commands/init_grant.rs:500

/// principal reports "no change" instead of erroring or duplicating.
async fn grant_installed_capsules(
    operator: &PrincipalId,
    target: &PrincipalId,
    installed: &[String],
) -> anyhow::Result<()> {
    eprintln!();
    eprintln!(
        "{}",
        Theme::info(&format!(
            "Granting {} capsule(s) to '{target}'...",
            installed.len()
        ))
    );

    let mut client = match crate::admin_client::connect_for_workspace_as(operator.clone()).await {
        Ok(c) => c,
        Err(e) => {
            bail!(
                "capsules are installed, but connecting to the selected workspace daemon to grant access failed: {e}\n  \
                 Grant them once the daemon is running:\n  {}",
                agent_modify_grant_command(operator, target, installed)
            );
        },
    };

    match crate::commands::agent::apply_agent_modify(&mut client, target, &[], &[], installed, &[])
        .await
    {
        Ok(outcome) if outcome.changed => {
            eprintln!(
                "{}",
                Theme::success(&format!(
                    "Granted capsule access to '{target}': [{}]",
                    outcome.capsules.join(", ")
                ))
            );

View on GitHub (pinned to affd8760f4)

Solutions

Start the workspace daemon, then re-run the grant (or run the printed modify-grant command).
Run the exact command from the error message (agent_modify_grant_command output) once the daemon is reachable.
Verify the workspace selection and daemon address/port in your config match where the daemon listens.
Check operator authentication/credentials for connect_for_workspace_as if the daemon is up but rejects the connection.
Check firewall/proxy rules blocking the daemon socket.

Example fix

// before: init fails with connection error
$ astrid init
// after: start daemon first, then grant
$ astrid daemon start
$ astrid agent modify-grant --operator alice --target workspace ...

Defensive patterns

Strategy: retry

Validate before calling

// before granting, check the daemon is reachable
match tokio::net::TcpStream::connect(&daemon_addr).await {
    Ok(_) => (),
    Err(e) => eprintln!("daemon not reachable at {daemon_addr}: {e}; start it first"),
}

Try / catch

let client = loop {
    match admin_client::connect_for_workspace_as(op.clone()).await {
        Ok(c) => break Ok(c),
        Err(e) if attempts < 5 => { sleep(backoff).await; attempts += 1; }
        Err(e) => break Err(e),
    }
};

Prevention

Start the workspace daemon before running init/grant workflows.
Script health-check probes of the daemon socket prior to granting.
Persist the printed modify-grant command so it can be replayed later.
Verify workspace selection and daemon address/port in config after environment changes.

When it happens

Trigger: grant_installed_capsules calls crate::admin_client::connect_for_workspace_as(operator) and the returned future resolves to Err — daemon not running, wrong workspace selected, or connection refused/timed out.

Common situations: Daemon not started yet after machine boot or deploy, daemon listening on a different address/port than the workspace config points to, network/firewall blocking the socket, operator credentials not accepted for the workspace.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/3d8115f3fb29cdc8. Report an issue: GitHub.