{"record":{"id":"ab1e58927674aae4","repo":"can1357/oh-my-pi","slug":"status-requires-a-rationale","errorCode":null,"errorMessage":"${status} requires a rationale","messagePattern":"(.+?) requires a rationale","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/slash-commands/helpers/security.ts","lineNumber":341,"sourceCode":"\t\t\t});\n\t\t\tawait runtime.output(\n\t\t\t\t`Imported ${bundle.findings.length} Codex Security cloud finding(s) as security scan ${bundle.scan.id}.`,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t\tdefault:\n\t\t\tthrow new Error(\"Usage: /security cloud <scans|start|status|pull>\");\n\t}\n}\n\nasync function updateDisposition(runtime: SlashCommandRuntime, rest: string): Promise<void> {\n\tconst [scanId, findingId, status, ...rationaleParts] = parseCommandArgs(rest);\n\tif (!scanId || !findingId || !status) {\n\t\tthrow new Error(\"disposition requires <scan-id> <finding-id> <status> [rationale]\");\n\t}\n\tif (!DISPOSITIONS.has(status as SecurityDispositionStatus)) throw new Error(`Unknown disposition: ${status}`);\n\tconst rationale = rationaleParts.join(\" \").trim();\n\tif (status !== \"open\" && !rationale) throw new Error(`${status} requires a rationale`);\n\tconst store = await SecurityStore.openForCwd(runtime.cwd);\n\tconst finding = await store.updateDisposition(scanId, findingId, {\n\t\tstatus: status as SecurityDispositionStatus,\n\t\trationale: rationale || undefined,\n\t\tupdatedAt: new Date().toISOString(),\n\t\tactor: \"operator\",\n\t});\n\tawait runtime.output(`Finding ${finding.id} disposition is now ${finding.disposition.status}.`);\n}\n\nexport async function handleSecurityCommand(\n\tcommand: ParsedSlashCommand,\n\truntime: SlashCommandRuntime,\n): Promise<SlashCommandResult> {\n\tif (!runtime.settings.get(\"security.enabled\")) {\n\t\treturn usage(\"Security is disabled. Enable security.enabled before using /security.\", runtime);\n\t}\n\tconst { verb, rest } = parseSubcommand(command.args);","sourceCodeStart":323,"sourceCodeEnd":359,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/slash-commands/helpers/security.ts#L323-L359","documentation":"Thrown by updateDisposition when the chosen status is anything other than `open` and the joined rationale text is empty. Every non-open disposition (e.g. triaged, false positive) must be justified, so the handler enforces a non-empty rationale before writing the disposition audit record.","triggerScenarios":"Run `/security disposition scan_1 finding_2 false-positive` with no rationale words, or with a rationale consisting only of whitespace/quotes.","commonSituations":"Assuming a bare status suffices for all dispositions; rationale forgotten after the status token; empty quoted string \"\" passed as rationale.","solutions":["Append the rationale text: `/security disposition <scan-id> <finding-id> <status> <why>`.","Use `open` as the status if no justification is intended (reopening a finding).","Quote multi-word rationales so parseCommandArgs keeps them as one token."],"exampleFix":"// before\n/security disposition scan_1 finding_2 false-positive\n// after\n/security disposition scan_1 finding_2 false-positive \"dependency is not reachable at runtime\"","handlingStrategy":"validation","validationCode":"if (status !== \"open\" && rationale.trim() === \"\") {\n\tthrow new Error(`status \"${status}\" needs a non-empty rationale`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Attach a short justification to every non-open disposition.","Use `open` when you just want to reopen without justification.","Quote multi-word rationales and avoid passing empty strings."],"tags":["cli","validation","missing-argument"],"backgroundTag":"missing-required-argument","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}