{"record":{"id":"ce7ad1e35331d01b","repo":"can1357/oh-my-pi","slug":"security-is-disabled-enable-security-enabled-befo-ce7ad1","errorCode":null,"errorMessage":"Security is disabled; enable security.enabled before starting a scan","messagePattern":"Security is disabled; enable security\\.enabled before starting a scan","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/security/coordinator.ts","lineNumber":462,"sourceCode":"\t\t\t\ttarget: input.target ?? { kind: \"repository\" },\n\t\t\t\tknowledgeBasePaths: input.knowledgeBasePaths,\n\t\t\t\toutputRoot: input.outputRoot ?? path.join(workRoot, Bun.randomUUIDv7()),\n\t\t\t\tarchiveExisting: input.archiveExisting,\n\t\t\t\tmodel: modelRef,\n\t\t\t\taccount,\n\t\t\t\tconfig: securityConfigSnapshot(this.#host.settings),\n\t\t\t\tworkflowFingerprint: SECURITY_WORKFLOW_FINGERPRINT,\n\t\t\t\tsignal: input.signal,\n\t\t\t},\n\t\t\tthis.#gitAdapter,\n\t\t);\n\t\tawait store.putPlan(plan);\n\t\treturn plan;\n\t}\n\n\tasync start(input: SecurityStartInput): Promise<SecurityOperationSnapshot> {\n\t\tif (!this.#host.settings.get(\"security.enabled\")) {\n\t\t\tthrow new Error(\"Security is disabled; enable security.enabled before starting a scan\");\n\t\t}\n\t\tawait this.#ensureRecovered();\n\t\tconst store = await this.#openStore(this.#host.cwd);\n\t\tconst plan = await store.getPlan(input.planId);\n\t\tif (!plan) throw new Error(`Unknown security scan plan: ${input.planId}`);\n\t\tawait assertSecurityScanPlanFresh(\n\t\t\tplan,\n\t\t\t{\n\t\t\t\tconfig: securityConfigSnapshot(this.#host.settings),\n\t\t\t\tworkflowFingerprint: SECURITY_WORKFLOW_FINGERPRINT,\n\t\t\t},\n\t\t\tthis.#gitAdapter,\n\t\t);\n\t\tconst operationId = this.#createOperationId();\n\t\tconst scanId = createSecurityScanId();\n\t\tconst createdAt = toIsoTimestamp(this.#now);\n\t\tconst snapshot: SecurityOperationSnapshot = {\n\t\t\toperationId,","sourceCodeStart":444,"sourceCodeEnd":480,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/security/coordinator.ts#L444-L480","documentation":"start() re-checks security.enabled before executing a scan (independent of the preflight check). Even with a valid plan id, launching a scan is refused while the feature flag is off, because execution spawns sessions, worktrees, and model calls.","triggerScenarios":"Calling start() with any SecurityStartInput while settings.get(\"security.enabled\") is false — e.g. the flag was disabled after preflight produced a plan, or start() is invoked in a process/session with different (disabled) settings than the one that planned the scan.","commonSituations":"Config reloaded between planning and start; scanning from a different project directory where security.enabled is not enabled; automation that reuses a persisted plan id across environments.","solutions":["Enable security.enabled in the settings visible to the process calling start(), then retry.","Re-plan (preflight) in the same environment where you intend to start, so flag state and plan are consistent.","If the flag is toggled at runtime, verify with settings.get(\"security.enabled\") before invoking start()."],"exampleFix":"// before\nif (!settings.get(\"security.enabled\")) settings.set(\"security.enabled\", true);\nawait coordinator.start({ planId });\n// after\nawait coordinator.start({ planId }); // with security.enabled: true in config","handlingStrategy":"validation","validationCode":"if (!settings.get(\"security.enabled\")) throw new Error(\"enable security.enabled before starting a scan\");","typeGuard":null,"tryCatchPattern":"try {\n  await coordinator.start(input);\n} catch (err) {\n  if (err instanceof Error && err.message.startsWith(\"Security is disabled\")) {\n    // enable the flag or abort the workflow; plan state remains valid\n  } else throw err;\n}","preventionTips":["Re-check the flag in the same process/config scope that will run start(), not just at preflight.","Avoid toggling security.enabled between planning and execution.","Run plan+start within one environment so settings snapshots agree."],"tags":["configuration","feature-flag","security-scan"],"backgroundTag":"feature-disabled-by-config","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}