{"record":{"id":"4c188ae0876c011e","repo":"paperclipai/paperclip","slug":"paperclip-tool-action-signing-secret-is-not-config","errorCode":null,"errorMessage":"PAPERCLIP_TOOL_ACTION_SIGNING_SECRET is not configured; signed tool action approvals cannot be issued. Set PAPERCLIP_TOOL_ACTION_SIGNING_SECRET in this instance's environment (worktrees inherit it from .paperclip/.env).","messagePattern":"PAPERCLIP_TOOL_ACTION_SIGNING_SECRET is not configured; signed tool action approvals cannot be issued\\. Set PAPERCLIP_TOOL_ACTION_SIGNING_SECRET in this instance's environment \\(worktrees inherit it from \\.paperclip/\\.env\\)\\.","errorType":"exception","errorClass":"ToolActionSigningSecretMissingError","httpStatus":500,"severity":"error","filePath":"server/src/services/tool-content-guards.ts","lineNumber":60,"sourceCode":"  return PROMPT_INJECTION_PATTERNS\n    .filter((pattern) => pattern.re.test(text))\n    .map((pattern) => pattern.code);\n}\n\nexport class ToolActionSigningSecretMissingError extends Error {\n  constructor() {\n    super(\n      \"PAPERCLIP_TOOL_ACTION_SIGNING_SECRET is not configured; signed tool action approvals cannot be issued. \" +\n        \"Set PAPERCLIP_TOOL_ACTION_SIGNING_SECRET in this instance's environment (worktrees inherit it from .paperclip/.env).\",\n    );\n    this.name = \"ToolActionSigningSecretMissingError\";\n  }\n}\n\n// Creating an approval is a two-step insert/sign operation. Readers must allow\n// a short window for the creator to attach the signature before treating a null\n// signature as an abandoned, unapprovable request.\nexport const TOOL_ACTION_REQUEST_SIGNING_GRACE_MS = 2 * 60 * 1000;\n\nexport function resolveToolActionSigningSecret(env: ToolActionSigningSecretEnv = process.env as ToolActionSigningSecretEnv) {\n  const secret = env.PAPERCLIP_TOOL_ACTION_SIGNING_SECRET?.trim();\n  if (!secret) {\n    throw new ToolActionSigningSecretMissingError();\n  }\n  return secret;\n}\n\nfunction signingSecret(explicitSecret?: string) {\n  const secret = explicitSecret?.trim();\n  return secret || resolveToolActionSigningSecret();\n}\n\nexport function canonicalToolArguments(value: unknown) {\n  return stableSerialize(value ?? {});\n}\n","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/tool-content-guards.ts#L42-L78","documentation":"Error \"PAPERCLIP_TOOL_ACTION_SIGNING_SECRET is not configured; signed tool action approvals cannot be issued. Set PAPERCLIP_TOOL_ACTION_SIGNING_SECRET in this instance's environment (worktrees inherit it from .paperclip/.env).\" thrown in paperclipai/paperclip.","triggerScenarios":"Thrown at server/src/services/tool-content-guards.ts:60 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set PAPERCLIP_TOOL_ACTION_SIGNING_SECRET in the server environment (worktrees inherit from .paperclip/.env) and restart the instance."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}