{"record":{"id":"5febcc3e11a142af","repo":"can1357/oh-my-pi","slug":"security-oauth-credential-requestedcredentialid","errorCode":null,"errorMessage":"Security OAuth credential ${requestedCredentialId} is not available for ${provider}","messagePattern":"Security OAuth credential (.+?) is not available for (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/security/auth.ts","lineNumber":47,"sourceCode":"\t\tthrow new Error(\"Security scan authentication identity mismatch\");\n\t}\n}\n\nexport function selectSecurityAccount(\n\tauthStorage: AuthStorage,\n\tprovider: string,\n\trequestedCredentialId?: number,\n\tsessionId?: string,\n): SecurityAccountRef {\n\tconst accounts = authStorage.listOAuthAccounts(provider, sessionId);\n\tconst selected =\n\t\trequestedCredentialId !== undefined\n\t\t\t? accounts.find(account => account.credentialId === requestedCredentialId)\n\t\t\t: (accounts.find(account => account.active) ?? (accounts.length === 1 ? accounts[0] : undefined));\n\tif (!selected) {\n\t\tif (accounts.length === 0) throw new Error(`Security scans require a stored OAuth account for ${provider}`);\n\t\tif (requestedCredentialId !== undefined) {\n\t\t\tthrow new Error(`Security OAuth credential ${requestedCredentialId} is not available for ${provider}`);\n\t\t}\n\t\tthrow new Error(\n\t\t\t`Multiple OAuth accounts are available for ${provider}; supply credentialId to pin one exact account`,\n\t\t);\n\t}\n\tconst account: SecurityAccountRef = { provider, credentialId: selected.credentialId };\n\tif (selected.accountId !== undefined) account.accountId = selected.accountId;\n\tif (selected.email !== undefined) account.email = selected.email;\n\tif (selected.orgId !== undefined) account.organizationId = selected.orgId;\n\tif (selected.orgName !== undefined) account.organizationName = selected.orgName;\n\treturn account;\n}\n\nexport async function resolveExactSecurityOAuthAccess(\n\tauthStorage: AuthStorage,\n\taccount: SecurityAccountRef,\n\toptions: { forceRefresh: boolean; signal?: AbortSignal },\n): Promise<Extract<OAuthAccessResolution, { ok: true }>> {","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/security/auth.ts#L29-L65","documentation":"When a specific credentialId is requested, selectSecurityAccount must find an account with exactly that credential id among the provider's stored OAuth accounts. If the id exists in the request but matches no stored account, this error is thrown (distinct from the zero-accounts and multiple-accounts cases).","triggerScenarios":"Passing a requestedCredentialId that is not present in authStorage.listOAuthAccounts(provider, sessionId) — e.g. a credential that was removed, rotated, or belongs to a different provider/session scope.","commonSituations":"Referencing a credential id after re-authentication rotated it; hardcoding a credentialId from another machine or config; typo'd id; session-scoped lookup hiding the credential.","solutions":["List available accounts (authStorage.listOAuthAccounts(provider)) and use a valid credentialId","Omit requestedCredentialId to let the active (or sole) account be selected automatically","Re-authenticate if the credential was removed or rotated"],"exampleFix":"// before\nselectSecurityAccount(authStorage, \"github\", \"cred-123\", sessionId); // no longer exists\n// after\nselectSecurityAccount(authStorage, \"github\", undefined, sessionId); // use active account","handlingStrategy":"validation","validationCode":"const accounts = authStorage.listOAuthAccounts(provider, sessionId);\nif (requestedCredentialId && !accounts.some(a => a.credentialId === requestedCredentialId)) {\n  throw new Error(`credentialId ${requestedCredentialId} not found for ${provider}`);\n}","typeGuard":"null","tryCatchPattern":"try {\n  const account = selectSecurityAccount(authStorage, provider, requestedCredentialId, sessionId);\n} catch (err) {\n  if (err instanceof Error && err.message.includes(\"is not available for\")) {\n    const account = selectSecurityAccount(authStorage, provider, undefined, sessionId); // fall back to active\n  } else throw err;\n}","preventionTips":["Fetch credential ids dynamically from listOAuthAccounts instead of hardcoding them","Re-resolve credential ids after any re-authentication or rotation","Confirm the credential belongs to the same provider and session scope you query"],"tags":["auth","oauth","configuration"],"backgroundTag":"credential-not-found","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}