{"record":{"id":"e8a8c01b78a86bc2","repo":"paperclipai/paperclip","slug":"session-scope-mismatch","errorCode":"session_scope_mismatch","errorMessage":"Tool gateway session is outside the authenticated agent scope","messagePattern":"Tool gateway session is outside the authenticated agent scope","errorType":"http","errorClass":"ToolGatewayHttpError","httpStatus":403,"severity":"error","filePath":"server/src/services/tool-gateway.ts","lineNumber":6472,"sourceCode":"          tool,\n        }));\n        const testDecision =\n          decision.decision === \"require_approval\"\n            ? \"ask_first\"\n            : decision.allowed\n              ? \"allowed\"\n              : \"off\";\n        return {\n          toolName: tool.upstreamToolName ?? tool.name,\n          gatewayToolName: tool.name,\n          displayName: tool.displayName,\n          risk: tool.risk,\n          decision: testDecision,\n          reasonCode: decision.reasonCode,\n          matchedPolicyIds: decision.matchedPolicyIds,\n          effectiveProfileIds: decision.effectiveProfileIds,\n        };\n      }));\n      const lastChange = await summarizeAccessLastChange({\n        companyId: input.companyId,\n        connectionId: input.connectionId,\n        agentId: input.agentId,\n        policyIds: [...new Set(decisions.flatMap((decision) => decision.matchedPolicyIds))],\n        profileIds: [...new Set(decisions.flatMap((decision) => decision.effectiveProfileIds))],\n      });\n      return {\n        connectionId: input.connectionId,\n        toolCount: decisions.length,\n        allowedCount: decisions.filter((decision) => decision.decision === \"allowed\").length,\n        askFirstCount: decisions.filter((decision) => decision.decision === \"ask_first\").length,\n        offCount: decisions.filter((decision) => decision.decision === \"off\").length,\n        lastChangedAt: lastChange.lastChangedAt,\n        lastChangedByAgentId: lastChange.lastChangedByAgentId,\n        lastChangedByName: lastChange.lastChangedByName,\n        tools: decisions.map(({ effectiveProfileIds: _effectiveProfileIds, ...tool }) => tool),\n      };","sourceCodeStart":6454,"sourceCodeEnd":6490,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/tool-gateway.ts#L6454-L6490","documentation":"Agent-scope check on session management: the session exists in the company, but an agent-scoped caller's agentId (and optional runId) do not cover the session being modified. The 403 ensures an agent key can only revoke/inspect sessions belonging to its own scope, not other agents' sessions.","triggerScenarios":"Thrown at server/src/services/tool-gateway.ts:6285 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a gateway session that belongs to the authenticated agent; sessions of other agents are out of scope."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}