paperclipai/paperclip · error

Only the comment author can cancel queued comments

Error message

Only the comment author can cancel queued comments

What it means

403 on comment delete/cancel. Fires in cancel mode (or when the comment is a queued comment for an active run) and the acting actor is not the comment's original author: only the author agent or user may cancel their queued comment.

Source

Thrown at server/src/routes/issues.ts:12578

  );

  router.get("/issues/:id/interactions", async (req, res) => {
    const id = req.params.id as string;
    const issue = await getAccessibleResource(req, res, getIssueById(req, id), "Issue not found");
    if (!issue) return;
    if (!(await assertIssueReadAllowed(req, res, issue))) return;
    const interactions = await issueThreadInteractionService(db).listForIssue(id);
    res.json(interactions);
  });

  router.post("/issues/:id/interactions", validate(createIssueThreadInteractionSchema), async (req, res) => {
    const id = req.params.id as string;
    const issue = await getAccessibleResource(req, res, svc.getById(id), "Issue not found");
    if (!issue) return;
    if (req.actor.type === "agent") {
      if (!(await assertAgentIssueMutationAllowed(req, res, issue, { allowVisibleIssueWrite: true }))) return;
      if (await assertLowTrustControlPlaneDenied(req, res, issue.companyId, issue)) return;
    } else {
      assertBoard(req);
    }

    const actor = getActorInfo(req);
    const agentSourceRunId = req.actor.type === "agent" ? requireAgentRunId(req, res) : null;
    if (req.actor.type === "agent" && !agentSourceRunId) return;
    if (
      req.body.kind === "request_confirmation"
      && req.body.addresseeAgentId
      && req.body.payload?.toolAction !== undefined
    ) {
      throw badRequest("Tool-action confirmations cannot be addressed to agents");
    }
    if (req.body.kind === "request_confirmation" && req.body.payload?.toolAction !== undefined) {
      throw unprocessable("payload.toolAction is server-owned metadata and cannot be supplied when creating an interaction");
    }
    if (req.body.kind === "request_confirmation" && req.body.payload?.secretProposal !== undefined) {
      throw unprocessable("payload.secretProposal is server-owned metadata and cannot be supplied when creating an interaction");

View on GitHub (pinned to 01ad858492)

Solutions

1. This is an authorization rule, not a bug: perform the action with an actor that satisfies the stated constraint (board user, the owning agent, or an in-scope resource).
2. If access should be allowed, verify the actor's credentials/company scope and the resource's ownership before retrying.

When it happens

Trigger: Thrown at server/src/routes/issues.ts:11574 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/a7367864079726cd. Report an issue: GitHub.