{"record":{"id":"4c3ebdfc00de9410","repo":"can1357/oh-my-pi","slug":"scoped-path-security-scans-require-at-least-one-in-4c3ebd","errorCode":null,"errorMessage":"scoped_path security scans require at least one include path","messagePattern":"scoped_path security scans require at least one include path","errorType":"validation","errorClass":"ToolError","httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/tools/security-scan.ts","lineNumber":64,"sourceCode":"\nexport interface SecurityScanToolDetails {\n\taction: SecurityScanParams[\"action\"];\n\tplan?: { id: string; fingerprint: string };\n\toperation?: SecurityOperationSnapshot;\n\tcancelled?: boolean;\n\tfinding?: { id: string; validationStatus: SecurityValidationStatus };\n\tcloudConfigurations?: CodexSecurityCloudConfiguration[];\n\tcloudStats?: CodexSecurityCloudStats;\n\tcloudScan?: { id: string; repositoryUrl: string };\n\timportedScan?: { id: string; findingCount: number };\n}\n\nfunction targetFromParams(params: SecurityScanParams): SecurityTargetRequest {\n\tconst common = { includePaths: params.include_paths, excludePaths: params.exclude_paths };\n\tswitch (params.target_kind ?? \"repository\") {\n\t\tcase \"scoped_path\": {\n\t\t\tif (!params.include_paths?.some(value => value.trim().length > 0)) {\n\t\t\t\tthrow new ToolError(\"scoped_path security scans require at least one include path\");\n\t\t\t}\n\t\t\treturn { kind: \"scoped_path\", includePaths: params.include_paths, excludePaths: params.exclude_paths };\n\t\t}\n\t\tcase \"working_tree\":\n\t\t\treturn { kind: \"working_tree\", ...common };\n\t\tcase \"ref_diff\":\n\t\t\tif (!params.base_revision || !params.head_revision) {\n\t\t\t\tthrow new ToolError(\"ref_diff preflight requires base_revision and head_revision\");\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tkind: \"ref_diff\",\n\t\t\t\tbaseRevision: params.base_revision,\n\t\t\t\theadRevision: params.head_revision,\n\t\t\t\t...common,\n\t\t\t};\n\t\tdefault:\n\t\t\treturn { kind: \"repository\", ...common };\n\t}","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/tools/security-scan.ts#L46-L82","documentation":"targetFromParams converts security-scan parameters into a SecurityTargetRequest. For target_kind='scoped_path', at least one non-blank include path is mandatory; if include_paths is missing, empty, or all whitespace, it throws this preflight ToolError.","triggerScenarios":"Calling the security-scan tool with target_kind='scoped_path' and no include_paths, include_paths: [], or include_paths: [\"  \"].","commonSituations":"Model omits include_paths when it intends a repo-wide scan but leaves default scoped_path kind; params serialized with empty arrays; caller confused scoped_path with working_tree/repository kinds.","solutions":["Provide include_paths with at least one real path, e.g. [\"src/\"]","If you want a whole-repo scan, omit target_kind (defaults to 'repository') or use 'working_tree'","Trim/validate the paths array client-side before the call"],"exampleFix":"// before\nscan({ target_kind: \"scoped_path\" });\n// after\nscan({ target_kind: \"scoped_path\", include_paths: [\"src/auth/\"] });","handlingStrategy":"validation","validationCode":"if (params.target_kind === \"scoped_path\" && !(params.include_paths ?? []).some(p => p.trim())) throw new Error(\"include_paths must contain at least one non-blank path\");","typeGuard":"function hasIncludePaths(p: SecurityScanParams): p is SecurityScanParams & { include_paths: string[] } { return (p.include_paths ?? []).some(v => v.trim().length > 0); }","tryCatchPattern":"try { await securityScan(params); } catch (e) { if (e instanceof ToolError && e.message.includes(\"require at least one include path\")) { return securityScan({ ...params, target_kind: \"repository\" }); } throw e; }","preventionTips":["Default to target_kind='repository' or 'working_tree' unless you specifically intend path-scoped scans","Trim and filter include_paths before sending","Never send include_paths: [] with scoped_path"],"tags":["validation","security-scan","parameters"],"backgroundTag":"missing-required-parameter","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}