What causes "disposition requires [rationale]" in can1357/oh-my-pi?

Provide all three: `/security disposition `.

disposition requires <scan-id> <finding-id> <status> [ration

Error message

disposition requires <scan-id> <finding-id> <status> [rationale]

What it means

Thrown by updateDisposition when fewer than three positional arguments are present. The /security disposition command requires scan-id, finding-id, and status; an optional rationale follows. parseCommandArgs splits the argument string and the handler checks all three required slots before touching the store.

Source

Thrown at packages/coding-agent/src/slash-commands/helpers/security.ts:337

			const bundle = await pullCodexSecurityCloudResults({
				client,
				configurationId: options.configurationId,
				store,
			});
			await runtime.output(
				`Imported ${bundle.findings.length} Codex Security cloud finding(s) as security scan ${bundle.scan.id}.`,
			);
			return;
		}
		default:
			throw new Error("Usage: /security cloud <scans|start|status|pull>");
	}
}

async function updateDisposition(runtime: SlashCommandRuntime, rest: string): Promise<void> {
	const [scanId, findingId, status, ...rationaleParts] = parseCommandArgs(rest);
	if (!scanId || !findingId || !status) {
		throw new Error("disposition requires <scan-id> <finding-id> <status> [rationale]");
	}
	if (!DISPOSITIONS.has(status as SecurityDispositionStatus)) throw new Error(`Unknown disposition: ${status}`);
	const rationale = rationaleParts.join(" ").trim();
	if (status !== "open" && !rationale) throw new Error(`${status} requires a rationale`);
	const store = await SecurityStore.openForCwd(runtime.cwd);
	const finding = await store.updateDisposition(scanId, findingId, {
		status: status as SecurityDispositionStatus,
		rationale: rationale || undefined,
		updatedAt: new Date().toISOString(),
		actor: "operator",
	});
	await runtime.output(`Finding ${finding.id} disposition is now ${finding.disposition.status}.`);
}

export async function handleSecurityCommand(
	command: ParsedSlashCommand,
	runtime: SlashCommandRuntime,
): Promise<SlashCommandResult> {

View on GitHub (pinned to 9690622007)

Solutions

Provide all three: `/security disposition <scan-id> <finding-id> <status>`.
Append a rationale when the status is not `open` (see the related rationale error).
Quote the rationale if it contains spaces: `"false positive: dependency"`.
Find valid scan/finding ids via `/security scans` and the scan's findings output.

Example fix

// before
/security disposition secscan_1 finding_7
// after
/security disposition secscan_1 finding_7 triaged "dup of finding_3"

Defensive patterns

Strategy: validation

Validate before calling

const tokens = rest.match(/(?:[^\s"]+|"[^"]*")+|[^\s]+/g) ?? [];
if (tokens.length < 3) throw new Error("usage: /security disposition <scan-id> <finding-id> <status> [rationale]");

Prevention

Always include scan-id, finding-id, and status in that order.
Quote rationales containing spaces so they don't shift token positions.
Keep ids handy from `/security scans` output before running disposition.

When it happens

Trigger: Run `/security disposition scan_1` or `/security disposition scan_1 finding_2` — missing the status or more. Quoted rationale strings that swallow following tokens can also leave slots empty.

Common situations: Forgetting the status word; ids containing spaces without quotes confusing token order; copying an example truncated at three words.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/c35993c0369d6580. Report an issue: GitHub.