{"record":{"id":"e65ec102d5806fcc","repo":"can1357/oh-my-pi","slug":"security-scan-scanid-has-no-sarif-export","errorCode":null,"errorMessage":"Security scan ${scanId} has no SARIF export","messagePattern":"Security scan (.+?) has no SARIF export","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/internal-urls/security-protocol.ts","lineNumber":219,"sourceCode":"\t\t\t}\n\t\t\tcase \"coverage\":\n\t\t\t\tif (parts.length !== 3) throw new Error(`Unknown security resource: security://${parts.join(\"/\")}`);\n\t\t\t\treturn createSecurityResource({\n\t\t\t\t\turl: `security://scans/${scanId}/coverage`,\n\t\t\t\t\tcontent: `${JSON.stringify(bundle.scan.coverage, null, 2)}\\n`,\n\t\t\t\t\tcontentType: \"application/json\",\n\t\t\t\t});\n\t\t\tcase \"report\":\n\t\t\t\tif (parts.length !== 3) throw new Error(`Unknown security resource: security://${parts.join(\"/\")}`);\n\t\t\t\tif (bundle.report === undefined) throw new Error(`Security scan ${scanId} has no report`);\n\t\t\t\treturn createSecurityResource({\n\t\t\t\t\turl: `security://scans/${scanId}/report`,\n\t\t\t\t\tcontent: bundle.report,\n\t\t\t\t\tcontentType: \"text/markdown\",\n\t\t\t\t});\n\t\t\tcase \"sarif\":\n\t\t\t\tif (parts.length !== 3) throw new Error(`Unknown security resource: security://${parts.join(\"/\")}`);\n\t\t\t\tif (bundle.sarif === undefined) throw new Error(`Security scan ${scanId} has no SARIF export`);\n\t\t\t\treturn createSecurityResource({\n\t\t\t\t\turl: `security://scans/${scanId}/sarif`,\n\t\t\t\t\tcontent: `${JSON.stringify(bundle.sarif, null, 2)}\\n`,\n\t\t\t\t\tcontentType: \"application/json\",\n\t\t\t\t});\n\t\t\tcase \"provenance\":\n\t\t\t\tif (parts.length !== 3) throw new Error(`Unknown security resource: security://${parts.join(\"/\")}`);\n\t\t\t\treturn createSecurityResource({\n\t\t\t\t\turl: `security://scans/${scanId}/provenance`,\n\t\t\t\t\tcontent: `${JSON.stringify(redactPrivateSecurityMetadata(bundle.scan.provenance), null, 2)}\\n`,\n\t\t\t\t\tcontentType: \"application/json\",\n\t\t\t\t});\n\t\t\tdefault:\n\t\t\t\tthrow new Error(`Unknown security resource: security://${parts.join(\"/\")}`);\n\t\t}\n\t}\n\n\tasync complete(query = \"\", context?: ResolveContext): Promise<UrlCompletion[]> {","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/internal-urls/security-protocol.ts#L201-L237","documentation":"The security protocol handler exports a SARIF (OASIS Static Analysis Results Interchange Format) document only if the security scan produced one. When the resolved scan bundle has sarif === undefined, resolve() throws this error because there is no SARIF representation to serve. A scan without SARIF is legitimate — not all scan runs generate SARIF exports.","triggerScenarios":"Resolving security://scans/<scanId>/sarif where the stored scan bundle for <scanId> lacks a SARIF export (bundle.sarif is undefined), typically because the scan run did not produce SARIF output or the export was not persisted.","commonSituations":"Requesting SARIF right after a scan that was configured without SARIF generation; an older scan predating SARIF export support; the scan failed partway and only partial results (report/findings) were saved; pointing at a scan ID belonging to a tool run that skipped the SARIF step.","solutions":["Re-run the security scan with SARIF export enabled so bundle.sarif is produced","Check the scan bundle before requesting the URL (e.g. via the manifest resource) to confirm SARIF exists","Use the available resources instead: security://scans/<scanId>/report or /findings or /manifest","Verify the scanId is correct — a different, complete scan may have the export"],"exampleFix":"// before\nconst res = await resolve('security://scans/old-scan/sarif');\n// after\nconst manifest = JSON.parse((await resolve(`security://scans/${id}/manifest`)).content);\nif (manifest.hasSarif) {\n  const res = await resolve(`security://scans/${id}/sarif`);\n}","handlingStrategy":"validation","validationCode":"const manifest = JSON.parse((await handler.resolve(`security://scans/${scanId}/manifest`, ctx)).content);\nif (manifest.sarif === undefined && manifest.hasSarif !== true) {\n  // SARIF not available for this scan; use report/findings instead\n}","typeGuard":"function hasSarif(bundle: { sarif?: unknown }): bundle is { sarif: object } {\n  return bundle.sarif !== undefined;\n}","tryCatchPattern":"try {\n  return await handler.resolve(`security://scans/${id}/sarif`, ctx);\n} catch (err) {\n  if (err instanceof Error && /has no SARIF export/.test(err.message)) {\n    return await handler.resolve(`security://scans/${id}/report`, ctx); // graceful fallback\n  }\n  throw err;\n}","preventionTips":["Check the scan manifest before requesting derived exports","Ensure the security scan is configured to emit SARIF","Treat SARIF as optional — fall back to the markdown report"],"tags":["security","sarif","missing-data"],"backgroundTag":"resource-not-generated","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}