{"record":{"id":"92f2d210ec393b50","repo":"can1357/oh-my-pi","slug":"export-requires-scan-id-output-path-forma","errorCode":null,"errorMessage":"export requires <scan-id> --output <path> [--format bundle|sarif|report]","messagePattern":"export requires <scan-id> --output <path> \\[--format bundle\\|sarif\\|report\\]","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"packages/coding-agent/src/slash-commands/helpers/security.ts","lineNumber":177,"sourceCode":"}\n\nasync function importResults(runtime: SlashCommandRuntime, rest: string): Promise<void> {\n\tconst [source] = parseCommandArgs(rest);\n\tif (!source) throw new Error(\"import requires a SARIF file or Codex Security bundle directory\");\n\tconst store = await SecurityStore.openForCwd(runtime.cwd);\n\tconst absolute = path.resolve(runtime.cwd, source);\n\tconst stats = await fs.stat(absolute);\n\tconst bundle = stats.isDirectory()\n\t\t? await importCodexSecurityBundle(absolute, { repositoryRoot: store.repositoryRoot })\n\t\t: await importSarifFile(absolute, { repositoryRoot: store.repositoryRoot });\n\tawait store.putBundle(bundle);\n\tawait runtime.output(`Imported ${bundle.findings.length} finding(s) as security scan ${bundle.scan.id}.`);\n}\n\nasync function exportResults(runtime: SlashCommandRuntime, rest: string): Promise<void> {\n\tconst tokens = parseCommandArgs(rest);\n\tconst scanId = tokens[0];\n\tif (!scanId) throw new Error(\"export requires <scan-id> --output <path> [--format bundle|sarif|report]\");\n\tlet outputPath: string | undefined;\n\tlet format: \"bundle\" | \"sarif\" | \"report\" = \"bundle\";\n\tfor (let index = 1; index < tokens.length; index++) {\n\t\tconst token = tokens[index]!;\n\t\tif (token === \"--output\") outputPath = requireToken(tokens, ++index, token);\n\t\telse if (token === \"--format\") {\n\t\t\tconst value = requireToken(tokens, ++index, token);\n\t\t\tif (value !== \"bundle\" && value !== \"sarif\" && value !== \"report\") {\n\t\t\t\tthrow new Error(`Unknown export format: ${value}`);\n\t\t\t}\n\t\t\tformat = value;\n\t\t} else throw new Error(`Unknown export option: ${token}`);\n\t}\n\tif (!outputPath) throw new Error(\"export requires --output <path>\");\n\tconst store = await SecurityStore.openForCwd(runtime.cwd);\n\tconst bundle = await store.getBundle(scanIdFromInput(scanId));\n\tif (!bundle) throw new Error(`Unknown security scan: ${scanId}`);\n\tlet content: string;","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/slash-commands/helpers/security.ts#L159-L195","documentation":"The /security export subcommand writes a stored scan bundle to disk and requires at minimum a scan id and an --output path. exportResults() throws this error immediately when the first positional token (the scan id) is missing, before parsing any options. The message also documents the full expected syntax: <scan-id> --output <path> [--format bundle|sarif|report].","triggerScenarios":"Running /security export with no arguments; rest contains only options (e.g. /security export --output out.json) so tokens[0] is --output but the code treats tokens[0] as the scan id and it is a token... actually thrown only when tokens[0] is undefined, i.e. the command line after 'export' is empty.","commonSituations":"Developer runs /security export expecting it to export all scans (it exports exactly one scan per invocation); the scan id was dropped by a script; the user started with --output and assumed the id was optional.","solutions":["Supply the scan id first: /security export <scan-id> --output <path>","Add --format if you want something other than the default bundle: --format sarif|report","Run /security list (or equivalent) first to obtain a valid scan id"],"exampleFix":"// before\n/security export --output out.json\n// after\n/security export scan-abc --output out.json --format report","handlingStrategy":"validation","validationCode":"function validateExportArgs(rest: string): boolean {\n  const tokens = rest.trim().split(/\\s+/).filter(Boolean);\n  return tokens.length > 0 && !tokens[0]!.startsWith(\"--\");\n}\n// tokens[0] must be the scan id; --output must follow before invoking","typeGuard":null,"tryCatchPattern":"try {\n  await runSlashCommand(`/security export ${rest}`);\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith(\"export requires <scan-id>\")) {\n    // usage: export <scan-id> --output <path> [--format bundle|sarif|report]\n  } else throw err;\n}","preventionTips":["Always put the scan id as the first token after 'export'","Never start the export argument list with a flag","Keep the documented syntax handy: <scan-id> --output <path> [--format bundle|sarif|report]"],"tags":["cli","argument-validation","slash-command","usage-error"],"backgroundTag":"missing-required-argument","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}