can1357/oh-my-pi · error · ToolError

Codex Security cloud requires the authentication registry

Error message

Codex Security cloud requires the authentication registry

What it means

The security_scan tool's cloud actions (cloud_scans, cloud_start, cloud_status, cloud_pull) need a CodexSecurityCloudClient, which is built from the session's authentication registry (authStorage). This error is thrown when ToolSession.authStorage is null/undefined, meaning no auth registry was attached to the session at construction time, so cloud credential lookup cannot proceed.

Source

Thrown at packages/coding-agent/src/tools/security-scan.ts:91

			}
			return {
				kind: "ref_diff",
				baseRevision: params.base_revision,
				headRevision: params.head_revision,
				...common,
			};
		default:
			return { kind: "repository", ...common };
	}
}

function requireValue(value: string | undefined, label: string): string {
	if (!value?.trim()) throw new ToolError(`${label} is required for this action`);
	return value.trim();
}

function cloudClientForSession(session: ToolSession, credentialId?: number): CodexSecurityCloudClient {
	if (!session.authStorage) throw new ToolError("Codex Security cloud requires the authentication registry");
	const account = selectSecurityAccount(
		session.authStorage,
		"openai-codex",
		credentialId,
		session.getSessionId?.() ?? undefined,
	);
	return new CodexSecurityCloudClient({ authStorage: session.authStorage, account });
}

function textResult(text: string, details: SecurityScanToolDetails): AgentToolResult<SecurityScanToolDetails> {
	return { content: [{ type: "text", text }], details };
}

export class SecurityScanTool implements AgentTool<typeof securityScanSchema, SecurityScanToolDetails> {
	readonly name = "security_scan";
	readonly approval: ToolTier = "exec";
	readonly label = "Security Scan";
	readonly loadMode = "discoverable";

View on GitHub (pinned to 9690622007)

Solutions

1. Initialize the session's auth storage (the standard omp auth registry path, e.g. via the normal CLI session bootstrap) before invoking security_scan cloud actions.
2. Re-run the auth/login flow so the auth registry file exists, then retry the cloud action.
3. If you only need local scans, use non-cloud actions (preflight/start/status/cancel/validate) which do not require cloudClientForSession.
4. Verify with a code check that session.authStorage is set in your embedding code before dispatching the tool call.

Example fix

// before (session created without auth)
const session = await createSession({ cwd, settings });
await tool.execute(id, { action: "cloud_scans" });
// after
const session = await createSession({ cwd, settings, authStorage: await openAuthStorage() });

if (!session.authStorage) throw new Error("cloud actions require an authenticated session");

function hasAuthStorage(s: ToolSession): s is ToolSession & { authStorage: NonNullable<ToolSession["authStorage"]> } { return !!s.authStorage; }

try { return await tool.execute(id, { action: "cloud_scans" }); } catch (e) { if (e instanceof ToolError && e.message.includes("authentication registry")) { /* fall back to local scans or prompt auth */ } throw e; }

When it happens

Trigger: Calling security_scan with any cloud_* action (or 'bundle'/'stats'/'configuration'-style flows that call cloudClientForSession) when the session was created without an authStorage instance — e.g. SDK/headless embedding that omits the auth registry, or a session constructed in an environment where auth storage failed to initialize.

Common situations: Embedding omp as an SDK without wiring auth storage; running the agent in a container or CI where the auth directory is unavailable; a bug or config change causing the session builder to skip authStorage initialization; using cloud actions in a profile that never authenticated with OpenAI Codex.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid QwenCloud Cookie header. Copy the complete Cookie re
• CoreWeave Serverless Inference requires OpenAI-Project. Set
• Anthropic Files API credential is required
• credentials ${usernameKey} and ${passwordKey} must be config
• No API key for ${model.provider}/${model.id}

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/5977849a57513abc. Report an issue: GitHub.