paperclipai/paperclip · error · ToolGatewayHttpError

signed_arguments_mismatch

signed_arguments_mismatch

Error message

Approved tool action arguments do not match reviewed hash

What it means

Post-approval arguments integrity check: the canonical hash of the stored parameters does not match actionRequest.canonicalArgumentsHash, or the signature over the canonical arguments fails verification. The 409 blocks execution because the arguments drifted from what was actually reviewed and signed.

Source

Thrown at server/src/services/tool-gateway.ts:5893

    // so it can never be approved. Do not replay it as a live approval. Expire
    // the row and let the retry create a fresh, signable request. A null expiry
    // alone (without this guard) also makes the getTime() check below unsafe.
    const pendingRequest = match.actionRequest;
    const pendingUnsigned =
      pendingRequest.status === "pending"
      && pendingRequest.signedArguments === null
      && Date.now() - pendingRequest.createdAt.getTime() >= TOOL_ACTION_REQUEST_SIGNING_GRACE_MS;
    const pendingExpired =
      pendingRequest.status === "pending"
      && pendingRequest.expiresAt !== null
      && pendingRequest.expiresAt.getTime() <= Date.now();
    if (pendingUnsigned || pendingExpired) {
      const now = new Date();
      await db.update(toolActionRequests).set({ status: "expired", resolvedAt: now, updatedAt: now }).where(and(
        eq(toolActionRequests.id, match.actionRequest.id),
        eq(toolActionRequests.status, "pending"),
      ));
      await db.update(toolInvocations).set({
        approvalState: "expired",
        idempotencyKey: null,
        updatedAt: now,
      }).where(eq(toolInvocations.id, match.invocation.id));
      await reflectToolActionInteractionLifecycle({ actionRequestId: match.actionRequest.id, status: "expired" });
      return null;
    }
    return match;
  }

  async function replayMatchingAgentAction(input: {
    session: ToolGatewaySession;
    toolName: string;
    argumentsHash: string;
  }) {
    const match = await matchingAgentActionRequest(input);
    if (!match) return null;
    const { actionRequest, invocation } = match;

View on GitHub (pinned to 01ad858492)

Solutions

1. Arguments differ from the reviewed hash. Execute with exactly the approved arguments or request a new approval.

When it happens

Trigger: Thrown at server/src/services/tool-gateway.ts:5706 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-08-18). Data as JSON: /api/errors/cb02a49e200b5303. Report an issue: GitHub.