{"record":{"id":"883c146b3e24d624","repo":"can1357/oh-my-pi","slug":"unknown-export-option-token","errorCode":null,"errorMessage":"Unknown export option: ${token}","messagePattern":"Unknown export option: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"info","filePath":"packages/coding-agent/src/slash-commands/helpers/security.ts","lineNumber":189,"sourceCode":"\tawait runtime.output(`Imported ${bundle.findings.length} finding(s) as security scan ${bundle.scan.id}.`);\n}\n\nasync function exportResults(runtime: SlashCommandRuntime, rest: string): Promise<void> {\n\tconst tokens = parseCommandArgs(rest);\n\tconst scanId = tokens[0];\n\tif (!scanId) throw new Error(\"export requires <scan-id> --output <path> [--format bundle|sarif|report]\");\n\tlet outputPath: string | undefined;\n\tlet format: \"bundle\" | \"sarif\" | \"report\" = \"bundle\";\n\tfor (let index = 1; index < tokens.length; index++) {\n\t\tconst token = tokens[index]!;\n\t\tif (token === \"--output\") outputPath = requireToken(tokens, ++index, token);\n\t\telse if (token === \"--format\") {\n\t\t\tconst value = requireToken(tokens, ++index, token);\n\t\t\tif (value !== \"bundle\" && value !== \"sarif\" && value !== \"report\") {\n\t\t\t\tthrow new Error(`Unknown export format: ${value}`);\n\t\t\t}\n\t\t\tformat = value;\n\t\t} else throw new Error(`Unknown export option: ${token}`);\n\t}\n\tif (!outputPath) throw new Error(\"export requires --output <path>\");\n\tconst store = await SecurityStore.openForCwd(runtime.cwd);\n\tconst bundle = await store.getBundle(scanIdFromInput(scanId));\n\tif (!bundle) throw new Error(`Unknown security scan: ${scanId}`);\n\tlet content: string;\n\tif (format === \"sarif\") {\n\t\tif (!bundle.sarif) throw new Error(`Security scan ${scanId} has no SARIF result`);\n\t\tcontent = `${JSON.stringify(bundle.sarif, null, 2)}\\n`;\n\t} else if (format === \"report\") {\n\t\tif (bundle.report === undefined) throw new Error(`Security scan ${scanId} has no report`);\n\t\tcontent = bundle.report;\n\t} else {\n\t\tcontent = `${JSON.stringify(bundle, null, 2)}\\n`;\n\t}\n\tconst absolute = path.resolve(runtime.cwd, outputPath);\n\tawait writeSecurityFileAtomic(absolute, content, { hardenParent: false });\n\tawait runtime.output(`Exported security scan ${scanId} to ${shortenPath(absolute)}.`);","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/slash-commands/helpers/security.ts#L171-L207","documentation":"/export accepts only the flags --output and --format. Any other positional or flag token encountered after the scan id makes exportResults() throw 'Unknown export option: <token>'. The loop validates every token from index 1 onward and fails fast on the first unrecognized one, before any store access.","triggerScenarios":"Running /security export <scan-id> --file out.json (wrong flag name); passing extra positional arguments (e.g. a second id); using --out or -o shorthand; passing --output without a value is handled by requireToken but a stray value like --verbose triggers this error.","commonSituations":"Muscle-memory from other CLIs (-o, --out); pasting an export command with extra trailing tokens from notes; confusing /security export syntax with a different tool's export flags.","solutions":["Use exactly --output <path> for the destination file","Use exactly --format bundle|sarif|report for the format","Remove any extra/unknown tokens after the scan id"],"exampleFix":"// before\n/security export scan-abc -o out.json\n// after\n/security export scan-abc --output out.json","handlingStrategy":"validation","validationCode":"const ALLOWED_EXPORT_FLAGS = new Set([\"--output\", \"--format\"]);\nfunction validateExportTokens(rest: string): string[] {\n  return rest.trim().split(/\\s+/).filter(t => t.startsWith(\"--\"))\n    .filter(t => !ALLOWED_EXPORT_FLAGS.has(t));\n}\n// if validateExportTokens(rest).length > 0, fix flags before invoking","typeGuard":null,"tryCatchPattern":"try {\n  await runSlashCommand(`/security export ${rest}`);\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith(\"Unknown export option:\")) {\n    // strip or correct the offending token reported in err.message\n  } else throw err;\n}","preventionTips":["Only --output and --format are accepted after the scan id — no shorthand like -o","Remove extra positional tokens; export takes exactly one scan id","Do not copy flag syntax from other CLIs"],"tags":["cli","argument-validation","slash-command","usage-error"],"backgroundTag":"unknown-option","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}