{"record":{"id":"c51d360f74d2ccd7","repo":"paperclipai/paperclip","slug":"action-scope-mismatch","errorCode":"action_scope_mismatch","errorMessage":"Approved action request is not scoped to this gateway session","messagePattern":"Approved action request is not scoped to this gateway session","errorType":"http","errorClass":"ToolGatewayHttpError","httpStatus":403,"severity":"error","filePath":"server/src/services/tool-gateway.ts","lineNumber":5738,"sourceCode":"        invocationId: invocation.id,\n        claimUpdatedAt: claimed.updatedAt,\n        expectedInvocationStatus: \"awaiting_approval\",\n        error,\n      });\n      throw error;\n    }\n    let managedArgumentsRemainCurrent: boolean;\n    try {\n      managedArgumentsRemainCurrent = await approvedManagedArgumentsRemainCurrent(session, tool, parameters);\n    } catch (error) {\n      await markApprovedActionFailed({\n        actionRequestId: claimed.id,\n        invocationId: invocation.id,\n        claimUpdatedAt: claimed.updatedAt,\n        expectedInvocationStatus: \"awaiting_approval\",\n        error,\n      });\n      throw error;\n    }\n    if (!managedArgumentsRemainCurrent) {\n      throw await expireApprovedActionForManagedArgumentDrift({\n        actionRequestId: claimed.id,\n        invocationId: invocation.id,\n        toolName: invocation.toolName,\n        ownsExecutingClaim: true,\n      });\n    }\n\n    const argumentsSummary = validateToolContent({\n      value: parameters,\n      direction: \"arguments\",\n      sensitiveMode: \"redact\",\n      promptInjectionMode: \"ignore\",\n    }).summary;\n    // Final recheck at the last DB write before dispatch: tool and snapshot\n    // resolution above involve network calls, so re-verify the issue is still","sourceCodeStart":5720,"sourceCodeEnd":5756,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/tool-gateway.ts#L5720-L5756","documentation":"Session-scoping guard when an agent replays an approved action over the gateway: the action request's run/session context (runId, issueId, agent linkage) does not match the presenting session. The mismatch means the approval was granted in a different context and cannot be executed through this session.","triggerScenarios":"Thrown at server/src/services/tool-gateway.ts:5553 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use the approved action within the gateway session it was approved for; session scoping is enforced."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}