astrid-runtime/astrid · error

daemon rejected capsule metadata request: {message}

Error message

daemon rejected capsule metadata request: {message}

What it means

The capsule show command connects to the daemon over the workspace socket and requests KernelRequest::GetCapsuleMetadata. If the daemon answers with KernelResponse::Error(message), the CLI bails, surfacing the daemon's rejection reason. This means the request reached the daemon but was refused there (permissions, capability denial, internal error).

Source

Thrown at crates/astrid-cli/src/commands/capsule/show.rs:72

    pub contracts_canonical: Option<String>,
    /// Skew classification: `match`, `mismatch`, `no-canonical`, or
    /// `not-pinned`.
    pub contracts_status: String,
    /// Verbatim `Capsule.toml` body.
    pub manifest: String,
    /// Human-facing permissions derived from the manifest.
    pub permissions: Vec<SemanticCapability>,
}

/// Entry point for `astrid capsule show`.
pub(crate) async fn run(args: &ShowArgs) -> Result<ExitCode> {
    let principal = context::resolve_agent(args.agent.as_deref())?;
    let format = ValueFormat::parse(&args.format);
    let mut client = crate::socket_client::connect_kernel_for_workspace(None).await?;
    let entries = match client.request(KernelRequest::GetCapsuleMetadata).await? {
        KernelResponse::CapsuleMetadata(entries) => entries,
        KernelResponse::Error(message) => {
            anyhow::bail!("daemon rejected capsule metadata request: {message}")
        },
        other => anyhow::bail!("unexpected daemon response: {other:?}"),
    };
    let Some(entry) = entries.into_iter().find(|entry| entry.name == args.name) else {
        eprintln!(
            "{}",
            Theme::error(&format!(
                "capsule '{}' is not installed for agent '{principal}'",
                args.name
            ))
        );
        return Ok(ExitCode::from(1));
    };
    let capabilities: astrid_capsule_types::manifest::CapabilitiesDef =
        serde_json::from_value(entry.capabilities.clone())?;
    let permissions = semantic_capabilities(&capabilities);
    let manifest = serde_json::to_string_pretty(&serde_json::json!({
        "package": {

View on GitHub (pinned to affd8760f4)

Solutions

  1. Read the daemon-provided message in the error and address the stated cause (e.g. authenticate as an agent with metadata access).
  2. Restart the daemon and retry once it has re-registered capsules.
  3. Check daemon policy/permission configuration for the current principal.
Defensive patterns

Strategy: try-catch

Validate before calling

// ensure a daemon is connected for this workspace first
if !daemon_socket_reachable().await {
    anyhow::bail!("no daemon running for this workspace");
}

Type guard

fn is_daemon_metadata_denial(e: &anyhow::Error) -> bool {
    e.to_string().contains("rejected capsule metadata request")
}

Try / catch

match client.request(KernelRequest::GetCapsuleMetadata).await? {
    KernelResponse::CapsuleMetadata(entries) => Ok(entries),
    KernelResponse::Error(m) => Err(anyhow!(m)),
    other => Err(anyhow!("unexpected: {other:?}")),
}

Prevention

When it happens

Trigger: Running astrid capsule show <name> when the daemon replies Error to GetCapsuleMetadata — e.g. the requesting agent lacks permission to read capsule metadata, or the daemon cannot serve metadata in its current state.

Common situations: Daemon policy denying metadata reads for the current agent/principal; daemon busy or in a degraded state; querying after a daemon restart before capsules are re-registered.

Related errors

AI-assisted analysis of astrid-runtime/astrid@affd8760f4 (2026-09-09). Data as JSON: /api/errors/6a0a9ba60b019493. Report an issue: GitHub.