paperclipai/paperclip · error

snoozedUntil must be a future ISO datetime

Error message

snoozedUntil must be a future ISO datetime

What it means

Temporal guard on the watchdog snooze decision: 'snoozedUntil' must be an ISO datetime strictly in the future for a snooze to be meaningful, but the supplied value is missing, unparseable, or already past, so the route returns 400.

Solutions

1. Provide snoozedUntil as an ISO datetime in the future.

When it happens

Trigger: Thrown at server/src/routes/agents.ts:5003 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@3f1d897a7c (2026-08-18). Data as JSON: /api/errors/2255ab4ba3fd9dd6. Report an issue: GitHub.

Appendix: source

Thrown at server/src/routes/agents.ts:6067

    res.json(result);
  });

  // --- Setup-token login session routes --------------------------------------
  //
  // The routes give the UI operations against one live login session. Every
  // operation verifies the company and owner user through the session scope. A
  // missing session and a cross-scope session both return the same 404. The
  // confidential responses pass through the transport assessment and set
  // `Cache-Control: no-store`. The routes write no prompt, code, token, or raw
  // process chunk to a log or an activity detail, and they return fixed error
  // text only.
  //
  // Operator requirement (SR-7): to serve the confidential responses behind a
  // TLS-terminating reverse proxy, set `CLAUDE_LOGIN_TRUSTED_PROXIES` to the
  // explicit proxy IP or CIDR allowlist — or, on a managed platform whose edge
  // always terminates TLS and whose proxy peer addresses cannot be allowlisted,
  // declare `CLAUDE_LOGIN_EDGE_TLS_TERMINATED=true`. The global `TRUST_PROXY`
  // setting, including `TRUST_PROXY=true` and a hop-count value, does not
  // satisfy the guard. A direct TLS request is always valid; a non-TLS request
  // is valid only on a loopback peer in the `local_trusted` deployment mode.
  //
  // Each route below writes its full path as a plain string literal. The static
  // OpenAPI coverage test reads the route paths from the source text; it does
  // not evaluate a template variable. A shared base constant would leave the
  // test with an unresolved path, so the routes repeat the base path instead.

  /**
   * Derives the immutable owner of a setup-token login session from the actor.
   * Only a board user owns a login session. It returns the owner id, or it
   * throws a forbidden error. The owner is never a client field; it comes only
   * from the authenticated actor.
   */
  const deriveSetupTokenOwnerUserId = (req: Request): string => {
    const actor = getActorInfo(req);
    if (actor.actorType !== "user") {

View on GitHub (pinned to 3f1d897a7c)