{"record":{"id":"44f7030ed062cf37","repo":"can1357/oh-my-pi","slug":"unsupported-codex-security-scan-manifest","errorCode":null,"errorMessage":"Unsupported Codex Security scan manifest","messagePattern":"Unsupported Codex Security scan manifest","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/security/importers/codex-security.ts","lineNumber":197,"sourceCode":"\t\t\t: [],\n\t\tdeferred: Array.isArray(document.deferred) ? (document.deferred as SecurityCoverage[\"deferred\"]) : [],\n\t};\n\tif (Array.isArray(document.openQuestions)) {\n\t\tcoverage.openQuestions = document.openQuestions as SecurityCoverage[\"openQuestions\"];\n\t}\n\treturn coverage;\n}\n\nexport async function importCodexSecurityBundle(\n\tbundleDirectory: string,\n\toptions: CodexSecurityImportOptions,\n): Promise<SecurityScanBundle> {\n\tconst root = path.resolve(bundleDirectory);\n\tconst manifest = await readJson<CodexManifest>(path.join(root, \"scan-manifest.json\"));\n\tconst findingsDocument = await readJson<CodexFindingsDocument>(path.join(root, \"findings.json\"));\n\tconst coverageDocument = await readJson<CodexCoverageDocument>(path.join(root, \"coverage.json\"));\n\tif (manifest.documentType !== \"codex-security.scan-manifest\" || manifest.schemaVersion !== \"1.0\") {\n\t\tthrow new Error(\"Unsupported Codex Security scan manifest\");\n\t}\n\tif (findingsDocument.documentType !== \"codex-security.findings\" || findingsDocument.schemaVersion !== \"1.0\") {\n\t\tthrow new Error(\"Unsupported Codex Security findings document\");\n\t}\n\tif (coverageDocument.documentType !== \"codex-security.coverage\" || coverageDocument.schemaVersion !== \"1.0\") {\n\t\tthrow new Error(\"Unsupported Codex Security coverage document\");\n\t}\n\tif (\n\t\t!manifest.scan?.id ||\n\t\tfindingsDocument.scanId !== manifest.scan.id ||\n\t\tcoverageDocument.scanId !== manifest.scan.id\n\t) {\n\t\tthrow new Error(\"Codex Security bundle scan IDs do not agree\");\n\t}\n\tconst fixtureProvenance = await readJson<CodexFixtureProvenance>(path.join(root, \"PROVENANCE.json\")).catch(\n\t\t(): CodexFixtureProvenance => ({}),\n\t);\n\tconst scanId = options.createScanId?.() ?? createSecurityScanId();","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/security/importers/codex-security.ts#L179-L215","documentation":"The Codex Security bundle importer validates each document's envelope before use. The scan-manifest.json must declare documentType \"codex-security.scan-manifest\" and schemaVersion \"1.0\"; otherwise the bundle is not in a supported format and the import is aborted.","triggerScenarios":"importCodexSecurityBundle reads scan-manifest.json and its documentType or schemaVersion differs from codex-security.scan-manifest / 1.0 (wrong file in the directory, missing fields, or a newer schema).","commonSituations":"Pointing the importer at a directory from an older/newer Codex Security version; scan-manifest.json replaced or truncated; passing a directory whose manifest belongs to a different tool.","solutions":["Regenerate the bundle with a Codex Security version that emits schemaVersion 1.0 and the codex-security.scan-manifest documentType","Verify scan-manifest.json contains exactly documentType: \"codex-security.scan-manifest\" and schemaVersion: \"1.0\"","Ensure the bundleDirectory passed to the importer is the actual bundle root containing that manifest"],"exampleFix":"// before (scan-manifest.json)\n{ \"documentType\": \"codex-security.scan\", \"schemaVersion\": \"1.1\" }\n// after\n{ \"documentType\": \"codex-security.scan-manifest\", \"schemaVersion\": \"1.0\" }","handlingStrategy":"validation","validationCode":"const manifest = JSON.parse(await Bun.file(path.join(dir, \"scan-manifest.json\")).text());\nif (manifest.documentType !== \"codex-security.scan-manifest\" || manifest.schemaVersion !== \"1.0\") {\n  throw new Error(`Unsupported scan manifest: ${manifest.documentType}/${manifest.schemaVersion}`);\n}","typeGuard":"function isSupportedManifest(m: unknown): m is { documentType: \"codex-security.scan-manifest\"; schemaVersion: \"1.0\" } {\n  return typeof m === \"object\" && m !== null &&\n    (m as any).documentType === \"codex-security.scan-manifest\" && (m as any).schemaVersion === \"1.0\";\n}","tryCatchPattern":"try {\n  const bundle = await importCodexSecurityBundle(dir);\n} catch (err) {\n  if (err instanceof Error && err.message === \"Unsupported Codex Security scan manifest\") {\n    console.error(\"Regenerate the bundle with a compatible Codex Security version (schema 1.0)\");\n  } else throw err;\n}","preventionTips":["Pin the Codex Security generator version that emits schema 1.0 documents","Validate all three envelopes (manifest, findings, coverage) before import","Import bundles as complete units, never mixed from different generator versions","Check documentType/schemaVersion right after bundle generation in CI"],"tags":["codex-security","schema-validation","import","versioning"],"backgroundTag":"unsupported-schema-version","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}