{"record":{"id":"5977849a57513abc","repo":"can1357/oh-my-pi","slug":"codex-security-cloud-requires-the-authentication-r","errorCode":null,"errorMessage":"Codex Security cloud requires the authentication registry","messagePattern":"Codex Security cloud requires the authentication registry","errorType":"validation","errorClass":"ToolError","httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/tools/security-scan.ts","lineNumber":91,"sourceCode":"\t\t\t}\n\t\t\treturn {\n\t\t\t\tkind: \"ref_diff\",\n\t\t\t\tbaseRevision: params.base_revision,\n\t\t\t\theadRevision: params.head_revision,\n\t\t\t\t...common,\n\t\t\t};\n\t\tdefault:\n\t\t\treturn { kind: \"repository\", ...common };\n\t}\n}\n\nfunction requireValue(value: string | undefined, label: string): string {\n\tif (!value?.trim()) throw new ToolError(`${label} is required for this action`);\n\treturn value.trim();\n}\n\nfunction cloudClientForSession(session: ToolSession, credentialId?: number): CodexSecurityCloudClient {\n\tif (!session.authStorage) throw new ToolError(\"Codex Security cloud requires the authentication registry\");\n\tconst account = selectSecurityAccount(\n\t\tsession.authStorage,\n\t\t\"openai-codex\",\n\t\tcredentialId,\n\t\tsession.getSessionId?.() ?? undefined,\n\t);\n\treturn new CodexSecurityCloudClient({ authStorage: session.authStorage, account });\n}\n\nfunction textResult(text: string, details: SecurityScanToolDetails): AgentToolResult<SecurityScanToolDetails> {\n\treturn { content: [{ type: \"text\", text }], details };\n}\n\nexport class SecurityScanTool implements AgentTool<typeof securityScanSchema, SecurityScanToolDetails> {\n\treadonly name = \"security_scan\";\n\treadonly approval: ToolTier = \"exec\";\n\treadonly label = \"Security Scan\";\n\treadonly loadMode = \"discoverable\";","sourceCodeStart":73,"sourceCodeEnd":109,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/tools/security-scan.ts#L73-L109","documentation":"The security_scan tool's cloud actions (cloud_scans, cloud_start, cloud_status, cloud_pull) need a CodexSecurityCloudClient, which is built from the session's authentication registry (authStorage). This error is thrown when ToolSession.authStorage is null/undefined, meaning no auth registry was attached to the session at construction time, so cloud credential lookup cannot proceed.","triggerScenarios":"Calling security_scan with any cloud_* action (or 'bundle'/'stats'/'configuration'-style flows that call cloudClientForSession) when the session was created without an authStorage instance — e.g. SDK/headless embedding that omits the auth registry, or a session constructed in an environment where auth storage failed to initialize.","commonSituations":"Embedding omp as an SDK without wiring auth storage; running the agent in a container or CI where the auth directory is unavailable; a bug or config change causing the session builder to skip authStorage initialization; using cloud actions in a profile that never authenticated with OpenAI Codex.","solutions":["Initialize the session's auth storage (the standard omp auth registry path, e.g. via the normal CLI session bootstrap) before invoking security_scan cloud actions.","Re-run the auth/login flow so the auth registry file exists, then retry the cloud action.","If you only need local scans, use non-cloud actions (preflight/start/status/cancel/validate) which do not require cloudClientForSession.","Verify with a code check that session.authStorage is set in your embedding code before dispatching the tool call."],"exampleFix":"// before (session created without auth)\nconst session = await createSession({ cwd, settings });\nawait tool.execute(id, { action: \"cloud_scans\" });\n// after\nconst session = await createSession({ cwd, settings, authStorage: await openAuthStorage() });","handlingStrategy":"validation","validationCode":"if (!session.authStorage) throw new Error(\"cloud actions require an authenticated session\");","typeGuard":"function hasAuthStorage(s: ToolSession): s is ToolSession & { authStorage: NonNullable<ToolSession[\"authStorage\"]> } { return !!s.authStorage; }","tryCatchPattern":"try { return await tool.execute(id, { action: \"cloud_scans\" }); } catch (e) { if (e instanceof ToolError && e.message.includes(\"authentication registry\")) { /* fall back to local scans or prompt auth */ } throw e; }","preventionTips":["Always bootstrap sessions through the standard factory that attaches authStorage.","Check session.authStorage before issuing any cloud_* security_scan action.","In embeddings/tests, provide a stub or real auth registry in the session fixture."],"tags":["tooling","authentication","configuration"],"backgroundTag":"missing-auth-registry","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}