{"record":{"id":"c4f7962bd6b1e1fe","repo":"paperclipai/paperclip","slug":"confirmation-required","errorCode":"confirmation_required","errorMessage":"Remote session deletion requires explicit confirmation.","messagePattern":"Remote session deletion requires explicit confirmation\\.","errorType":"http","errorClass":"RouteError","httpStatus":400,"severity":"warning","filePath":"packages/paperclip-runner/scripts/capability-issue-thread-server.mjs","lineNumber":1037,"sourceCode":"          body.maxEstimatedSessionCostUsd;\n        const nextCap = Number(requestedCap);\n        if (!Number.isFinite(nextCap) || nextCap <= 0) {\n          throw new RouteError(\n            400,\n            \"invalid_spend_cap\",\n            \"The new managed-session spend ceiling must be positive.\",\n          );\n        }\n        await entry.session.increaseManagedSessionBudget(nextCap);\n        if (entry.configuration?.provider === \"claude_managed\") {\n          entry.configuration.maxSessionListCostUsd = nextCap;\n        }\n        if (entry.configuration?.provider === \"aws_agentcore\") {\n          entry.configuration.maxEstimatedSessionCostUsd = nextCap;\n        }\n      } else if (route === \"managed-session-delete\") {\n        if (body.confirm !== true) {\n          throw new RouteError(\n            400,\n            \"confirmation_required\",\n            \"Remote session deletion requires explicit confirmation.\",\n          );\n        }\n        await entry.session.deleteManagedRemoteSession();\n        await retire(\n          service,\n          entry.session.id,\n          \"remote managed session explicitly deleted\",\n        );\n        send(response, 200, { deleted: true, sessionId: entry.session.id });\n        return;\n      } else if (route === \"reconnect\") {\n        entry.connection = { state: \"reconnecting\", attempt: entry.connection.attempt + 1 };\n        await entry.session.reconnect();\n        entry.connection = { state: \"connected\", attempt: 0 };\n      } else if (route === \"reset\") {","sourceCodeStart":1019,"sourceCodeEnd":1055,"githubUrl":"https://github.com/paperclipai/paperclip/blob/5716fe907e596ce73501408fc6efdb19fb61edf2/packages/paperclip-runner/scripts/capability-issue-thread-server.mjs#L1019-L1055","documentation":"The 'managed-session-delete' route performs an irreversible deletion of the remote managed session (entry.session.deleteManagedRemoteSession()). To prevent accidental destructive calls, the middleware requires body.confirm to be strictly true; anything else (missing, false, \"yes\", 1) throws a 400 RouteError with code confirmation_required.","triggerScenarios":"POST to the managed-session-delete route where body.confirm is absent, false, a string like \"true\", or the number 1 — the check is `body.confirm !== true` (strict identity), so non-boolean truthy values still fail.","commonSituations":"A curl call with no JSON body at all; a client sending {\"confirm\": \"true\"} instead of a boolean; an operator script forgetting the confirmation flag; automated cleanup jobs that assumed deletion needed no confirmation.","solutions":["Send the literal boolean: {\"confirm\": true} in the request body.","Ensure the request has a JSON content-type and a parsed body; an empty body yields confirm === undefined.","If your client sends strings, coerce first: confirm: req.confirm === true || req.confirm === \"true\" — but prefer fixing the client to send a real boolean.","Wrap the deletion in an explicit user-facing confirmation step in the UI/CLI before issuing the request."],"exampleFix":"// before\nawait fetch(url, { method: \"POST\", body: JSON.stringify({ confirm: \"true\" }) }); // 400 confirmation_required\n// after\nawait fetch(url, {\n  method: \"POST\",\n  headers: { \"content-type\": \"application/json\" },\n  body: JSON.stringify({ confirm: true }),\n});","handlingStrategy":"validation","validationCode":"function assertDeleteConfirmed(body) {\n  if (body?.confirm !== true) {\n    throw new Error(\"managed-session-delete requires { confirm: true } (literal boolean)\");\n  }\n}","typeGuard":"function isExplicitConfirm(v) {\n  return v === true; // strict: \"true\", 1, and truthy values do NOT count\n}","tryCatchPattern":"try {\n  await post(\"managed-session-delete\", { confirm: true });\n} catch (err) {\n  if (err.code === \"confirmation_required\") {\n    console.error(\"Remote session deletion was not confirmed; resend with body { confirm: true }.\");\n    return;\n  }\n  throw err;\n}","preventionTips":["Send the literal boolean true — not \"true\", 1, or a truthy value; the check is strict (confirm !== true).","Ensure the request includes a JSON body with application/json content-type; an empty body yields undefined confirm.","Gate the API call behind an explicit user confirmation step (dialog/CLI prompt) in your client.","Remember deletion is irreversible — confirm the session id as well before calling.","Centralize the delete call in a helper that always injects confirm: true after its own validation."],"tags":["confirmation","destructive-operation","http-400","safety-gate"],"backgroundTag":"confirmation-required","analyzedSha":"5716fe907e596ce73501408fc6efdb19fb61edf2","analyzedAt":"2026-09-02T18:44:00.616Z","contentChangedAt":"2026-09-02T18:44:00.616Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}