{"record":{"id":"523fef06bf190253","repo":"can1357/oh-my-pi","slug":"security-scan-scanid-has-no-sarif-result","errorCode":null,"errorMessage":"Security scan ${scanId} has no SARIF result","messagePattern":"Security scan (.+?) has no SARIF result","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/slash-commands/helpers/security.ts","lineNumber":197,"sourceCode":"\tlet format: \"bundle\" | \"sarif\" | \"report\" = \"bundle\";\n\tfor (let index = 1; index < tokens.length; index++) {\n\t\tconst token = tokens[index]!;\n\t\tif (token === \"--output\") outputPath = requireToken(tokens, ++index, token);\n\t\telse if (token === \"--format\") {\n\t\t\tconst value = requireToken(tokens, ++index, token);\n\t\t\tif (value !== \"bundle\" && value !== \"sarif\" && value !== \"report\") {\n\t\t\t\tthrow new Error(`Unknown export format: ${value}`);\n\t\t\t}\n\t\t\tformat = value;\n\t\t} else throw new Error(`Unknown export option: ${token}`);\n\t}\n\tif (!outputPath) throw new Error(\"export requires --output <path>\");\n\tconst store = await SecurityStore.openForCwd(runtime.cwd);\n\tconst bundle = await store.getBundle(scanIdFromInput(scanId));\n\tif (!bundle) throw new Error(`Unknown security scan: ${scanId}`);\n\tlet content: string;\n\tif (format === \"sarif\") {\n\t\tif (!bundle.sarif) throw new Error(`Security scan ${scanId} has no SARIF result`);\n\t\tcontent = `${JSON.stringify(bundle.sarif, null, 2)}\\n`;\n\t} else if (format === \"report\") {\n\t\tif (bundle.report === undefined) throw new Error(`Security scan ${scanId} has no report`);\n\t\tcontent = bundle.report;\n\t} else {\n\t\tcontent = `${JSON.stringify(bundle, null, 2)}\\n`;\n\t}\n\tconst absolute = path.resolve(runtime.cwd, outputPath);\n\tawait writeSecurityFileAtomic(absolute, content, { hardenParent: false });\n\tawait runtime.output(`Exported security scan ${scanId} to ${shortenPath(absolute)}.`);\n}\n\ninterface CloudCliOptions {\n\tcredentialId?: number;\n\tconfigurationId?: string;\n\trepositoryId?: string;\n\trepositoryUrl?: string;\n\tenvironmentId?: string;","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/slash-commands/helpers/security.ts#L179-L215","documentation":"The requested export format is sarif, but the stored scan bundle has no SARIF payload (bundle.sarif is falsy). Not every imported scan carries original SARIF data (e.g. imports from a Codex Security bundle directory may store findings without raw SARIF), so the store cannot synthesize the requested format. The error surfaces the scan id so the developer knows which scan is affected.","triggerScenarios":"Running /security export <scan-id> --output <path> --format sarif on a scan whose bundle lacks the sarif field; the scan was imported from a Codex bundle directory rather than a SARIF file; an older store entry predates SARIF retention.","commonSituations":"Exporting a directory-bundle import as SARIF; assuming all scans retain their original SARIF after re-import or migration; exporting a scan created from a report-only source.","solutions":["Export as bundle instead (--format bundle) — it always works for any stored scan","Re-import the original SARIF file: /security import results.sarif, then export the new scan as sarif","Choose --format report if you want the human-readable report rather than raw SARIF"],"exampleFix":"// before\n/security export scan-abc --output out.sarif --format sarif\n// after (scan has no SARIF stored)\n/security export scan-abc --output out.json --format bundle\n// or re-import SARIF then export\n/security import ./results.sarif","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await runSlashCommand(`/security export ${scanId} --output out.sarif --format sarif`);\n} catch (err) {\n  if (err instanceof Error && err.message.endsWith(\"has no SARIF result\")) {\n    // fall back to: --format bundle (always available)\n    await runSlashCommand(`/security export ${scanId} --output out.json --format bundle`);\n  } else throw err;\n}","preventionTips":["Export --format sarif only for scans imported from a SARIF file","For scans imported from a Codex Security bundle directory, use --format bundle","Prefer bundle format when you need a format guaranteed to exist for any scan","Re-import the original SARIF if SARIF output is required"],"tags":["cli","missing-data","sarif","slash-command"],"backgroundTag":"resource-not-found","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}