{"record":{"id":"4a0b3d3fbc84f78a","repo":"can1357/oh-my-pi","slug":"security-is-disabled-enable-security-enabled-befo","errorCode":null,"errorMessage":"Security is disabled; enable security.enabled before planning a scan","messagePattern":"Security is disabled; enable security\\.enabled before planning a scan","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/security/coordinator.ts","lineNumber":425,"sourceCode":"\t\t\t\t}\n\t\t\t}\n\t\t\tconst snapshot: SecurityOperationSnapshot = {\n\t\t\t\toperationId,\n\t\t\t\tplanId: bundle.scan.plan?.id ?? \"\",\n\t\t\t\tscanId: bundle.scan.id,\n\t\t\t\tphase: operationPhaseFromStatus(bundle.scan.status),\n\t\t\t\tcreatedAt: bundle.scan.createdAt,\n\t\t\t\tupdatedAt: bundle.scan.completedAt ?? bundle.scan.startedAt ?? bundle.scan.createdAt,\n\t\t\t\tfindingCount: bundle.findings.length,\n\t\t\t};\n\t\t\tif (bundle.scan.error !== undefined) snapshot.error = bundle.scan.error;\n\t\t\tthis.#operations.set(operationId, { snapshot, promise: Promise.resolve() });\n\t\t}\n\t}\n\n\tasync preflight(input: SecurityPreflightInput = {}): Promise<SecurityScanPlan> {\n\t\tif (!this.#host.settings.get(\"security.enabled\")) {\n\t\t\tthrow new Error(\"Security is disabled; enable security.enabled before planning a scan\");\n\t\t}\n\t\tconst model = input.model ?? this.#host.activeModel;\n\t\tif (!model) throw new Error(\"Security scan preflight requires an active model\");\n\t\tconst account = selectSecurityAccount(\n\t\t\tthis.#host.authStorage,\n\t\t\tmodel.provider,\n\t\t\tinput.credentialId,\n\t\t\tthis.#host.sessionId,\n\t\t);\n\t\tconst store = await this.#openStore(this.#host.cwd);\n\t\tconst workRoot = path.join(store.projectDirectory, \"work\");\n\t\tawait fs.mkdir(workRoot, { recursive: true, mode: 0o700 });\n\t\tif (process.platform !== \"win32\") await fs.chmod(workRoot, 0o700);\n\t\tconst modelRef: SecurityModelRef = { provider: model.provider, modelId: model.id };\n\t\tif (input.thinkingLevel !== undefined) modelRef.thinkingLevel = input.thinkingLevel;\n\t\tconst plan = await createSecurityScanPlan(\n\t\t\t{\n\t\t\t\tcwd: this.#host.cwd,","sourceCodeStart":407,"sourceCodeEnd":443,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/security/coordinator.ts#L407-L443","documentation":"SecurityCoordinator.preflight() refuses to plan a security scan when the security.enabled setting is false. Security scanning is opt-in; planning consumes model/auth resources, so the coordinator gates it behind the feature flag and tells you exactly which setting to flip.","triggerScenarios":"Calling preflight() (directly or via a security-scan command/tool) while settings.get(\"security.enabled\") returns false — i.e. the setting is absent from config and defaults to disabled, or is explicitly false.","commonSituations":"Fresh install where security.enabled was never configured; config file that defines other security keys but not security.enabled; running the scan from a project whose local settings override a globally enabled default.","solutions":["Set security.enabled to true in your opencode/omp settings (project or global config) and retry preflight.","Confirm the correct settings scope is being read — the value may be disabled at a higher-precedence scope than the one you edited.","If security scanning is intentionally off in this environment, route the work to an environment where it is enabled."],"exampleFix":"// before: opencode.json\n{ }\n// after\n{ \"security\": { \"enabled\": true } }","handlingStrategy":"validation","validationCode":"if (!settings.get(\"security.enabled\")) {\n  throw new Error(\"enable security.enabled before planning a scan\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  await coordinator.preflight(input);\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith(\"Security is disabled\")) {\n    // surface a config hint to the user: set security.enabled: true\n  } else throw err;\n}","preventionTips":["Check settings.get(\"security.enabled\") once at automation startup before any security calls.","Document the required config in your project setup so fresh clones include it.","Beware scope precedence: project settings can override global security.enabled."],"tags":["configuration","feature-flag","security-scan"],"backgroundTag":"feature-disabled-by-config","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}