can1357/oh-my-pi · info

export requires <scan-id> --output <path> [--format bundle|s

Error message

export requires <scan-id> --output <path> [--format bundle|sarif|report]

What it means

The /security export subcommand writes a stored scan bundle to disk and requires at minimum a scan id and an --output path. exportResults() throws this error immediately when the first positional token (the scan id) is missing, before parsing any options. The message also documents the full expected syntax: <scan-id> --output <path> [--format bundle|sarif|report].

Source

Thrown at packages/coding-agent/src/slash-commands/helpers/security.ts:177

}

async function importResults(runtime: SlashCommandRuntime, rest: string): Promise<void> {
	const [source] = parseCommandArgs(rest);
	if (!source) throw new Error("import requires a SARIF file or Codex Security bundle directory");
	const store = await SecurityStore.openForCwd(runtime.cwd);
	const absolute = path.resolve(runtime.cwd, source);
	const stats = await fs.stat(absolute);
	const bundle = stats.isDirectory()
		? await importCodexSecurityBundle(absolute, { repositoryRoot: store.repositoryRoot })
		: await importSarifFile(absolute, { repositoryRoot: store.repositoryRoot });
	await store.putBundle(bundle);
	await runtime.output(`Imported ${bundle.findings.length} finding(s) as security scan ${bundle.scan.id}.`);
}

async function exportResults(runtime: SlashCommandRuntime, rest: string): Promise<void> {
	const tokens = parseCommandArgs(rest);
	const scanId = tokens[0];
	if (!scanId) throw new Error("export requires <scan-id> --output <path> [--format bundle|sarif|report]");
	let outputPath: string | undefined;
	let format: "bundle" | "sarif" | "report" = "bundle";
	for (let index = 1; index < tokens.length; index++) {
		const token = tokens[index]!;
		if (token === "--output") outputPath = requireToken(tokens, ++index, token);
		else if (token === "--format") {
			const value = requireToken(tokens, ++index, token);
			if (value !== "bundle" && value !== "sarif" && value !== "report") {
				throw new Error(`Unknown export format: ${value}`);
			}
			format = value;
		} else throw new Error(`Unknown export option: ${token}`);
	}
	if (!outputPath) throw new Error("export requires --output <path>");
	const store = await SecurityStore.openForCwd(runtime.cwd);
	const bundle = await store.getBundle(scanIdFromInput(scanId));
	if (!bundle) throw new Error(`Unknown security scan: ${scanId}`);
	let content: string;

View on GitHub (pinned to 9690622007)

Solutions

1. Supply the scan id first: /security export <scan-id> --output <path>
2. Add --format if you want something other than the default bundle: --format sarif|report
3. Run /security list (or equivalent) first to obtain a valid scan id

Example fix

// before
/security export --output out.json
// after
/security export scan-abc --output out.json --format report

function validateExportArgs(rest: string): boolean {
  const tokens = rest.trim().split(/\s+/).filter(Boolean);
  return tokens.length > 0 && !tokens[0]!.startsWith("--");
}
// tokens[0] must be the scan id; --output must follow before invoking

try {
  await runSlashCommand(`/security export ${rest}`);
} catch (err) {
  if (err instanceof Error && err.message.startsWith("export requires <scan-id>")) {
    // usage: export <scan-id> --output <path> [--format bundle|sarif|report]
  } else throw err;
}

When it happens

Trigger: Running /security export with no arguments; rest contains only options (e.g. /security export --output out.json) so tokens[0] is --output but the code treats tokens[0] as the scan id and it is a token... actually thrown only when tokens[0] is undefined, i.e. the command line after 'export' is empty.

Common situations: Developer runs /security export expecting it to export all scans (it exports exactly one scan per invocation); the scan id was dropped by a script; the user started with --output and assumed the id was optional.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• validate requires a finding URI or <scan-id> <finding-id>
• show requires a scan id or security:// URI
• import requires a SARIF file or Codex Security bundle direct
• Unknown export format: ${value}
• Unknown export option: ${token}

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/92f2d210ec393b50. Report an issue: GitHub.