{"record":{"id":"2137908d0c16d3b0","repo":"can1357/oh-my-pi","slug":"security-is-disabled-enable-security-enabled-befo-213790","errorCode":null,"errorMessage":"Security is disabled. Enable security.enabled before using security_scan.","messagePattern":"Security is disabled\\. Enable security\\.enabled before using security_scan\\.","errorType":"validation","errorClass":"ToolError","httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/tools/security-scan.ts","lineNumber":123,"sourceCode":"export class SecurityScanTool implements AgentTool<typeof securityScanSchema, SecurityScanToolDetails> {\n\treadonly name = \"security_scan\";\n\treadonly approval: ToolTier = \"exec\";\n\treadonly label = \"Security Scan\";\n\treadonly loadMode = \"discoverable\";\n\treadonly summary = \"Run OMP-native scans and explicit Codex Security cloud operations\";\n\treadonly description = securityScanDescription.trim();\n\treadonly parameters = securityScanSchema;\n\treadonly strict = true;\n\n\tconstructor(readonly session: ToolSession) {}\n\n\tasync execute(\n\t\t_toolCallId: string,\n\t\tparams: SecurityScanParams,\n\t\tsignal?: AbortSignal,\n\t): Promise<AgentToolResult<SecurityScanToolDetails>> {\n\t\tif (!this.session.settings.get(\"security.enabled\")) {\n\t\t\tthrow new ToolError(\"Security is disabled. Enable security.enabled before using security_scan.\");\n\t\t}\n\t\tconst coordinatorForSession = () => {\n\t\t\tif (!this.session.modelRegistry || !this.session.authStorage) {\n\t\t\t\tthrow new ToolError(\"Security scan requires the session model and authentication registries\");\n\t\t\t}\n\t\t\treturn getSecurityCoordinator({\n\t\t\t\tcwd: this.session.cwd,\n\t\t\t\tsettings: this.session.settings,\n\t\t\t\tauthStorage: this.session.authStorage,\n\t\t\t\tmodelRegistry: this.session.modelRegistry,\n\t\t\t\tactiveModel: this.session.getActiveModel?.(),\n\t\t\t\tsessionId: this.session.getSessionId?.() ?? undefined,\n\t\t\t\tagentId: this.session.getAgentId?.() ?? undefined,\n\t\t\t\tasyncJobManager: this.session.asyncJobManager,\n\t\t\t});\n\t\t};\n\t\tswitch (params.action) {\n\t\t\tcase \"preflight\": {","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/tools/security-scan.ts#L105-L141","documentation":"security_scan is gated behind the security.enabled setting. At the top of SecurityScanTool.execute, the session settings are checked and this ToolError is thrown if security is disabled. The library deliberately requires an explicit opt-in because security scans can run scan agents and consume resources.","triggerScenarios":"Any call to security_scan (any action: preflight, start, status, cancel, validate, cloud_*) while settings.get(\"security.enabled\") is falsy — i.e. the setting was never set, or was explicitly set to false in settings.json / project config.","commonSituations":"Fresh installs where the user never enabled security; team configs where security.enabled lives in a project-level settings file not present in the working directory; an agent autonomously trying security_scan before the user opted in.","solutions":["Set security.enabled to true in session settings (e.g. `omp config set security.enabled true` or the settings file the session loads).","If the setting is project-scoped, add it to the project settings in the cwd the session runs in.","If security scanning is intentionally off, do not call security_scan; use the appropriate alternative workflow."],"exampleFix":"// before (settings.json)\n{ }\n// after\n{ \"security\": { \"enabled\": true } }","handlingStrategy":"validation","validationCode":"if (!session.settings.get(\"security.enabled\")) { throw new Error(\"enable security.enabled before calling security_scan\"); }","typeGuard":null,"tryCatchPattern":"try { await tool.execute(id, params); } catch (e) { if (e instanceof ToolError && e.message.startsWith(\"Security is disabled\")) { await enableSetting(\"security.enabled\"); return tool.execute(id, params); } throw e; }","preventionTips":["Set security.enabled=true in user or project settings before using security workflows.","Document the flag requirement wherever security_scan is invoked programmatically.","Check the setting once at workflow start instead of per-call."],"tags":["configuration","tooling","settings"],"backgroundTag":"feature-flag-disabled","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}