{"record":{"id":"2255ab4ba3fd9dd6","repo":"paperclipai/paperclip","slug":"snoozeduntil-must-be-a-future-iso-datetime","errorCode":null,"errorMessage":"snoozedUntil must be a future ISO datetime","messagePattern":"snoozedUntil must be a future ISO datetime","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"server/src/routes/agents.ts","lineNumber":5584,"sourceCode":"\n    res.json(result);\n  });\n\n  // --- Setup-token login session routes --------------------------------------\n  //\n  // The routes give the UI operations against one live login session. Every\n  // operation verifies the company and owner user through the session scope. A\n  // missing session and a cross-scope session both return the same 404. The\n  // confidential responses pass through the transport assessment and set\n  // `Cache-Control: no-store`. The routes write no prompt, code, token, or raw\n  // process chunk to a log or an activity detail, and they return fixed error\n  // text only.\n  //\n  // Operator requirement (SR-7): to serve the confidential responses behind a\n  // TLS-terminating reverse proxy, set `CLAUDE_LOGIN_TRUSTED_PROXIES` to the\n  // explicit proxy IP or CIDR allowlist — or, on a managed platform whose edge\n  // always terminates TLS and whose proxy peer addresses cannot be allowlisted,\n  // declare `CLAUDE_LOGIN_EDGE_TLS_TERMINATED=true`. The global `TRUST_PROXY`\n  // setting, including `TRUST_PROXY=true` and a hop-count value, does not\n  // satisfy the guard. A direct TLS request is always valid; a non-TLS request\n  // is valid only on a loopback peer in the `local_trusted` deployment mode.\n  //\n  // Each route below writes its full path as a plain string literal. The static\n  // OpenAPI coverage test reads the route paths from the source text; it does\n  // not evaluate a template variable. A shared base constant would leave the\n  // test with an unresolved path, so the routes repeat the base path instead.\n\n  /**\n   * Derives the immutable owner of a setup-token login session from the actor.\n   * Only a board user owns a login session. It returns the owner id, or it\n   * throws a forbidden error. The owner is never a client field; it comes only\n   * from the authenticated actor.\n   */\n  const deriveSetupTokenOwnerUserId = (req: Request): string => {\n    const actor = getActorInfo(req);\n    if (actor.actorType !== \"user\") {","sourceCodeStart":5566,"sourceCodeEnd":5602,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/routes/agents.ts#L5566-L5602","documentation":"Temporal guard on the watchdog snooze decision: 'snoozedUntil' must be an ISO datetime strictly in the future for a snooze to be meaningful, but the supplied value is missing, unparseable, or already past, so the route returns 400.","triggerScenarios":"Thrown at server/src/routes/agents.ts:5003 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide snoozedUntil as an ISO datetime in the future."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}