What causes "Remote session deletion requires explicit confirmation." in paperclipai/paperclip?

Send the literal boolean: {"confirm": true} in the request body.

paperclipai/paperclip · warning · RouteError

confirmation_required

confirmation_required

Error message

Remote session deletion requires explicit confirmation.

What it means

The 'managed-session-delete' route performs an irreversible deletion of the remote managed session (entry.session.deleteManagedRemoteSession()). To prevent accidental destructive calls, the middleware requires body.confirm to be strictly true; anything else (missing, false, "yes", 1) throws a 400 RouteError with code confirmation_required.

Source

Thrown at packages/paperclip-runner/scripts/capability-issue-thread-server.mjs:1037

          body.maxEstimatedSessionCostUsd;
        const nextCap = Number(requestedCap);
        if (!Number.isFinite(nextCap) || nextCap <= 0) {
          throw new RouteError(
            400,
            "invalid_spend_cap",
            "The new managed-session spend ceiling must be positive.",
          );
        }
        await entry.session.increaseManagedSessionBudget(nextCap);
        if (entry.configuration?.provider === "claude_managed") {
          entry.configuration.maxSessionListCostUsd = nextCap;
        }
        if (entry.configuration?.provider === "aws_agentcore") {
          entry.configuration.maxEstimatedSessionCostUsd = nextCap;
        }
      } else if (route === "managed-session-delete") {
        if (body.confirm !== true) {
          throw new RouteError(
            400,
            "confirmation_required",
            "Remote session deletion requires explicit confirmation.",
          );
        }
        await entry.session.deleteManagedRemoteSession();
        await retire(
          service,
          entry.session.id,
          "remote managed session explicitly deleted",
        );
        send(response, 200, { deleted: true, sessionId: entry.session.id });
        return;
      } else if (route === "reconnect") {
        entry.connection = { state: "reconnecting", attempt: entry.connection.attempt + 1 };
        await entry.session.reconnect();
        entry.connection = { state: "connected", attempt: 0 };
      } else if (route === "reset") {

View on GitHub (pinned to 5716fe907e)

Solutions

Send the literal boolean: {"confirm": true} in the request body.
Ensure the request has a JSON content-type and a parsed body; an empty body yields confirm === undefined.
If your client sends strings, coerce first: confirm: req.confirm === true || req.confirm === "true" — but prefer fixing the client to send a real boolean.
Wrap the deletion in an explicit user-facing confirmation step in the UI/CLI before issuing the request.

Example fix

// before
await fetch(url, { method: "POST", body: JSON.stringify({ confirm: "true" }) }); // 400 confirmation_required
// after
await fetch(url, {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ confirm: true }),
});

Defensive patterns

Strategy: validation

Validate before calling

function assertDeleteConfirmed(body) {
  if (body?.confirm !== true) {
    throw new Error("managed-session-delete requires { confirm: true } (literal boolean)");
  }
}

Type guard

function isExplicitConfirm(v) {
  return v === true; // strict: "true", 1, and truthy values do NOT count
}

Try / catch

try {
  await post("managed-session-delete", { confirm: true });
} catch (err) {
  if (err.code === "confirmation_required") {
    console.error("Remote session deletion was not confirmed; resend with body { confirm: true }.");
    return;
  }
  throw err;
}

Prevention

Send the literal boolean true — not "true", 1, or a truthy value; the check is strict (confirm !== true).
Ensure the request includes a JSON body with application/json content-type; an empty body yields undefined confirm.
Gate the API call behind an explicit user confirmation step (dialog/CLI prompt) in your client.
Remember deletion is irreversible — confirm the session id as well before calling.
Centralize the delete call in a helper that always injects confirm: true after its own validation.

When it happens

Trigger: POST to the managed-session-delete route where body.confirm is absent, false, a string like "true", or the number 1 — the check is `body.confirm !== true` (strict identity), so non-boolean truthy values still fail.

Common situations: A curl call with no JSON body at all; a client sending {"confirm": "true"} instead of a boolean; an operator script forgetting the confirmation flag; automated cleanup jobs that assumed deletion needed no confirmation.

Related errors

AI-assisted analysis of paperclipai/paperclip@5716fe907e (2026-09-02). Data as JSON: /api/errors/c4f7962bd6b1e1fe. Report an issue: GitHub.