Codex Security cloud import requires a verifiable repository

Error message

Codex Security cloud import requires a verifiable repository identity; this project has no 'origin' remote

What it means

Importing a Codex Security cloud configuration requires proving the local project is the same repository the cloud configuration was created for. The importer reads the git 'origin' remote of the repository root; if the repo has no origin remote (or the git wrapper fails), identity cannot be verified and the import is refused.

Source

Thrown at packages/coding-agent/src/security/cloud.ts:587

	const scpStyle = trimmed.match(/^[^@]+@([^:]+):(.+)$/);
	if (scpStyle) return `${scpStyle[1]!.toLowerCase()}/${scpStyle[2]!.replace(/^\/+/, "").toLowerCase()}`;
	try {
		const parsed = new URL(trimmed);
		return `${parsed.hostname.toLowerCase()}/${parsed.pathname.replace(/^\/+/, "").toLowerCase()}`;
	} catch {
		return trimmed.toLowerCase();
	}
}

async function assertCloudRepositoryMatchesStore(
	configuration: CodexSecurityCloudConfiguration,
	store: SecurityStore,
	signal?: AbortSignal,
): Promise<void> {
	const repo = vcs.git(store.repositoryRoot);
	const origin = repo ? await repo.remoteUrl("origin", signal).catch(() => null) : null;
	if (!origin) {
		throw new Error(
			"Codex Security cloud import requires a verifiable repository identity; this project has no 'origin' remote",
		);
	}
	if (repositoryIdentity(origin) !== repositoryIdentity(configuration.repositoryUrl)) {
		throw new Error("Codex Security cloud configuration does not match this project's origin remote");
	}
}

function reportForCloudBundle(
	configuration: CodexSecurityCloudConfiguration,
	stats: CodexSecurityCloudStats,
	findings: SecurityFinding[],
): string {
	const lines = [
		"# Codex Security cloud results",
		"",
		`- Configuration: ${configuration.id}`,
		`- Repository: ${configuration.repositoryUrl}`,

View on GitHub (pinned to 9690622007)

Solutions

Add an origin remote: git remote add origin git@host:org/repo.git
Ensure the import is pointed at the actual git repository root (store.repositoryRoot)
If origin exists but auth fails, verify the remote URL is fetchable (git ls-remote origin)
Use an already-imported/local configuration flow instead of cloud import for non-git projects

Example fix

// before (repo has no origin)
await importCloudConfiguration(store, configuration);
// after
$`git remote add origin https://github.com/org/repo.git`;
await importCloudConfiguration(store, configuration);

Defensive patterns

Strategy: validation

Validate before calling

import { $ } from "bun";
const remotes = await $`git remote -v`.cwd(root).quiet().nothrow();
if (remotes.exitCode !== 0 || !remotes.text().includes("origin")) {
	throw new Error("Project has no 'origin' remote; cloud import unavailable");
}

Try / catch

try {
	await importCloudConfiguration(store, configuration);
} catch (err) {
	if (err instanceof Error && err.message.includes("no 'origin' remote")) {
		// prompt user to add origin or fall back to local configuration
	} else throw err;
}

Prevention

Always clone via a remote (git clone) rather than copying directories
Run git remote add origin before setting up cloud security integrations
Verify CI checkouts preserve the origin remote (avoid shallow/detached exotic setups)
Confirm store.repositoryRoot points at the git root, not a subdirectory

When it happens

Trigger: Calling the cloud import flow (importCodexSecurityBundle / cloud import with a SecurityStore) in a repository with no 'origin' remote, or where store.repositoryRoot is not a git repository at all (vcs.git returns null).

Common situations: Cloned via a non-remote workflow (bundle, local copy); fresh git init before adding origin; CI checkouts that use a token-rewritten or detached setup without origin; passing the wrong directory as repositoryRoot.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/bb50dcd76fcbd3bb. Report an issue: GitHub.