{"record":{"id":"e8a8c01b78a86bc2","repo":"paperclipai/paperclip","slug":"session-scope-mismatch","errorCode":"session_scope_mismatch","errorMessage":"Tool gateway session is outside the authenticated agent scope","messagePattern":"Tool gateway session is outside the authenticated agent scope","errorType":"http","errorClass":"ToolGatewayHttpError","httpStatus":403,"severity":"error","filePath":"server/src/services/tool-gateway.ts","lineNumber":10826,"sourceCode":"          and(\n            eq(toolGatewaySessions.companyId, input.companyId),\n            eq(toolGatewaySessions.id, input.sessionId),\n          ),\n        )\n        .limit(1);\n      if (!existing) {\n        throw new ToolGatewayHttpError(\n          404,\n          \"Tool gateway session not found\",\n          \"session_not_found\",\n        );\n      }\n      if (input.agentScope) {\n        const runMatches = input.agentScope.runId\n          ? existing.runId === input.agentScope.runId\n          : true;\n        if (existing.agentId !== input.agentScope.agentId || !runMatches) {\n          throw new ToolGatewayHttpError(\n            403,\n            \"Tool gateway session is outside the authenticated agent scope\",\n            \"session_scope_mismatch\",\n          );\n        }\n      }\n      const [session] = await db\n        .update(toolGatewaySessions)\n        .set({ revokedAt: now, updatedAt: now })\n        .where(\n          and(\n            eq(toolGatewaySessions.companyId, input.companyId),\n            eq(toolGatewaySessions.id, input.sessionId),\n          ),\n        )\n        .returning();\n      const sessionView = gatewaySessionFromRow(session!);\n      await writeAudit({","sourceCodeStart":10808,"sourceCodeEnd":10844,"githubUrl":"https://github.com/paperclipai/paperclip/blob/3f1d897a7c018d76563a21c6e39c3c9b03933622/server/src/services/tool-gateway.ts#L10808-L10844","documentation":"Agent-scope check on session management: the session exists in the company, but an agent-scoped caller's agentId (and optional runId) do not cover the session being modified. The 403 ensures an agent key can only revoke/inspect sessions belonging to its own scope, not other agents' sessions.","triggerScenarios":"Thrown at server/src/services/tool-gateway.ts:6285 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use a gateway session that belongs to the authenticated agent; sessions of other agents are out of scope."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3f1d897a7c018d76563a21c6e39c3c9b03933622","analyzedAt":"2026-09-18T08:03:59.046Z","contentChangedAt":"2026-09-18T08:03:59.046Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}