can1357/oh-my-pi · error · ToolError

Codex Security cloud requires the authentication registry

Error message

Codex Security cloud requires the authentication registry

What it means

The security_scan tool's cloud actions (cloud_scans, cloud_start, cloud_status, cloud_pull) need a CodexSecurityCloudClient, which is built from the session's authentication registry (authStorage). This error is thrown when ToolSession.authStorage is null/undefined, meaning no auth registry was attached to the session at construction time, so cloud credential lookup cannot proceed.

Solutions

Initialize the session's auth storage (the standard omp auth registry path, e.g. via the normal CLI session bootstrap) before invoking security_scan cloud actions.
Re-run the auth/login flow so the auth registry file exists, then retry the cloud action.
If you only need local scans, use non-cloud actions (preflight/start/status/cancel/validate) which do not require cloudClientForSession.
Verify with a code check that session.authStorage is set in your embedding code before dispatching the tool call.

Example fix

// before (session created without auth)
const session = await createSession({ cwd, settings });
await tool.execute(id, { action: "cloud_scans" });
// after
const session = await createSession({ cwd, settings, authStorage: await openAuthStorage() });

Defensive patterns

Strategy: validation

Validate before calling

if (!session.authStorage) throw new Error("cloud actions require an authenticated session");

Type guard

function hasAuthStorage(s: ToolSession): s is ToolSession & { authStorage: NonNullable<ToolSession["authStorage"]> } { return !!s.authStorage; }

Try / catch

try { return await tool.execute(id, { action: "cloud_scans" }); } catch (e) { if (e instanceof ToolError && e.message.includes("authentication registry")) { /* fall back to local scans or prompt auth */ } throw e; }

Prevention

Always bootstrap sessions through the standard factory that attaches authStorage.
Check session.authStorage before issuing any cloud_* security_scan action.
In embeddings/tests, provide a stub or real auth registry in the session fixture.

When it happens

Trigger: Calling security_scan with any cloud_* action (or 'bundle'/'stats'/'configuration'-style flows that call cloudClientForSession) when the session was created without an authStorage instance — e.g. SDK/headless embedding that omits the auth registry, or a session constructed in an environment where auth storage failed to initialize.

Common situations: Embedding omp as an SDK without wiring auth storage; running the agent in a container or CI where the auth directory is unavailable; a bug or config change causing the session builder to skip authStorage initialization; using cloud actions in a profile that never authenticated with OpenAI Codex.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/5977849a57513abc. Report an issue: GitHub.

Appendix: source

Thrown at packages/coding-agent/src/tools/security-scan.ts:91

			}
			return {
				kind: "ref_diff",
				baseRevision: params.base_revision,
				headRevision: params.head_revision,
				...common,
			};
		default:
			return { kind: "repository", ...common };
	}
}

function requireValue(value: string | undefined, label: string): string {
	if (!value?.trim()) throw new ToolError(`${label} is required for this action`);
	return value.trim();
}

function cloudClientForSession(session: ToolSession, credentialId?: number): CodexSecurityCloudClient {
	if (!session.authStorage) throw new ToolError("Codex Security cloud requires the authentication registry");
	const account = selectSecurityAccount(
		session.authStorage,
		"openai-codex",
		credentialId,
		session.getSessionId?.() ?? undefined,
	);
	return new CodexSecurityCloudClient({ authStorage: session.authStorage, account });
}

function textResult(text: string, details: SecurityScanToolDetails): AgentToolResult<SecurityScanToolDetails> {
	return { content: [{ type: "text", text }], details };
}

export class SecurityScanTool implements AgentTool<typeof securityScanSchema, SecurityScanToolDetails> {
	readonly name = "security_scan";
	readonly approval: ToolTier = "exec";
	readonly label = "Security Scan";
	readonly loadMode = "discoverable";

View on GitHub (pinned to 9690622007)