{"record":{"id":"f926976b130defd9","repo":"can1357/oh-my-pi","slug":"unsupported-codex-security-findings-document","errorCode":null,"errorMessage":"Unsupported Codex Security findings document","messagePattern":"Unsupported Codex Security findings document","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/security/importers/codex-security.ts","lineNumber":200,"sourceCode":"\tif (Array.isArray(document.openQuestions)) {\n\t\tcoverage.openQuestions = document.openQuestions as SecurityCoverage[\"openQuestions\"];\n\t}\n\treturn coverage;\n}\n\nexport async function importCodexSecurityBundle(\n\tbundleDirectory: string,\n\toptions: CodexSecurityImportOptions,\n): Promise<SecurityScanBundle> {\n\tconst root = path.resolve(bundleDirectory);\n\tconst manifest = await readJson<CodexManifest>(path.join(root, \"scan-manifest.json\"));\n\tconst findingsDocument = await readJson<CodexFindingsDocument>(path.join(root, \"findings.json\"));\n\tconst coverageDocument = await readJson<CodexCoverageDocument>(path.join(root, \"coverage.json\"));\n\tif (manifest.documentType !== \"codex-security.scan-manifest\" || manifest.schemaVersion !== \"1.0\") {\n\t\tthrow new Error(\"Unsupported Codex Security scan manifest\");\n\t}\n\tif (findingsDocument.documentType !== \"codex-security.findings\" || findingsDocument.schemaVersion !== \"1.0\") {\n\t\tthrow new Error(\"Unsupported Codex Security findings document\");\n\t}\n\tif (coverageDocument.documentType !== \"codex-security.coverage\" || coverageDocument.schemaVersion !== \"1.0\") {\n\t\tthrow new Error(\"Unsupported Codex Security coverage document\");\n\t}\n\tif (\n\t\t!manifest.scan?.id ||\n\t\tfindingsDocument.scanId !== manifest.scan.id ||\n\t\tcoverageDocument.scanId !== manifest.scan.id\n\t) {\n\t\tthrow new Error(\"Codex Security bundle scan IDs do not agree\");\n\t}\n\tconst fixtureProvenance = await readJson<CodexFixtureProvenance>(path.join(root, \"PROVENANCE.json\")).catch(\n\t\t(): CodexFixtureProvenance => ({}),\n\t);\n\tconst scanId = options.createScanId?.() ?? createSecurityScanId();\n\tconst createdAt = options.createdAt ?? manifest.scan.startedAt ?? new Date().toISOString();\n\tconst canonicalRoot = await fs.realpath(path.resolve(options.repositoryRoot));\n\tconst producer: SecurityProducer = {","sourceCodeStart":182,"sourceCodeEnd":218,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/security/importers/codex-security.ts#L182-L218","documentation":"Alongside the manifest, the importer validates findings.json's envelope: it must declare documentType \"codex-security.findings\" and schemaVersion \"1.0\". Any deviation means the findings document is not in the supported format and the import aborts before findings are mapped.","triggerScenarios":"importCodexSecurityBundle reads findings.json whose documentType or schemaVersion does not match codex-security.findings / 1.0.","commonSituations":"findings.json generated by a different/newer Codex Security release; manifest and findings files mixed from different bundles; file corrupted or hand-edited so the envelope fields were lost.","solutions":["Regenerate findings.json with a compatible Codex Security version (documentType codex-security.findings, schemaVersion 1.0)","Re-export the whole bundle as one unit so manifest, findings, and coverage come from the same scan/run","Fix the envelope fields in findings.json if they were accidentally edited"],"exampleFix":"// before (findings.json)\n{ \"documentType\": \"codex-security.findings\", \"schemaVersion\": \"2.0\" }\n// after\n{ \"documentType\": \"codex-security.findings\", \"schemaVersion\": \"1.0\" }","handlingStrategy":"validation","validationCode":"const findings = JSON.parse(await Bun.file(path.join(dir, \"findings.json\")).text());\nif (findings.documentType !== \"codex-security.findings\" || findings.schemaVersion !== \"1.0\") {\n  throw new Error(`Unsupported findings document: ${findings.documentType}/${findings.schemaVersion}`);\n}","typeGuard":"function isSupportedFindings(d: unknown): d is { documentType: \"codex-security.findings\"; schemaVersion: \"1.0\" } {\n  return typeof d === \"object\" && d !== null &&\n    (d as any).documentType === \"codex-security.findings\" && (d as any).schemaVersion === \"1.0\";\n}","tryCatchPattern":"try {\n  const bundle = await importCodexSecurityBundle(dir);\n} catch (err) {\n  if (err instanceof Error && err.message === \"Unsupported Codex Security findings document\") {\n    console.error(\"findings.json envelope invalid — regenerate the bundle\");\n  } else throw err;\n}","preventionTips":["Verify findings.json envelope fields immediately after generation","Never copy findings.json between bundles from different runs/versions","Validate the envelope in CI before shipping the bundle artifact","Keep the generator and importer schema versions in lockstep"],"tags":["codex-security","schema-validation","import","versioning"],"backgroundTag":"unsupported-schema-version","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}