import requires a SARIF file or Codex Security bundle direct

Error message

import requires a SARIF file or Codex Security bundle directory

What it means

The /security import subcommand loads results from an external source: a SARIF file or a Codex Security bundle directory. importResults() throws this error when parseCommandArgs(rest) yields no source path at all, before any filesystem access happens. It ensures the import has a concrete file or directory to read.

Source

Thrown at packages/coding-agent/src/slash-commands/helpers/security.ts:163

	const uriMatch = trimmed.match(/^security:\/\/scans\/([^/]+)\/findings\/([^/]+)$/);
	if (uriMatch) return { uri: trimmed, scanId: uriMatch[1]!, findingId: uriMatch[2]! };
	const [scanId, findingId] = parseCommandArgs(trimmed);
	if (!scanId || !findingId) throw new Error("validate requires a finding URI or <scan-id> <finding-id>");
	return { uri: `security://scans/${scanId}/findings/${findingId}`, scanId, findingId };
}

async function showResource(runtime: SlashCommandRuntime, rest: string): Promise<void> {
	const raw = rest.trim();
	if (!raw) throw new Error("show requires a scan id or security:// URI");
	const uri = raw.startsWith("security://") ? raw : `security://scans/${scanIdFromInput(raw)}`;
	const handler = new SecurityProtocolHandler(undefined, () => true);
	const resource = await handler.resolve(parseInternalUrl(uri), { cwd: runtime.cwd });
	await runtime.output(resource.content);
}

async function importResults(runtime: SlashCommandRuntime, rest: string): Promise<void> {
	const [source] = parseCommandArgs(rest);
	if (!source) throw new Error("import requires a SARIF file or Codex Security bundle directory");
	const store = await SecurityStore.openForCwd(runtime.cwd);
	const absolute = path.resolve(runtime.cwd, source);
	const stats = await fs.stat(absolute);
	const bundle = stats.isDirectory()
		? await importCodexSecurityBundle(absolute, { repositoryRoot: store.repositoryRoot })
		: await importSarifFile(absolute, { repositoryRoot: store.repositoryRoot });
	await store.putBundle(bundle);
	await runtime.output(`Imported ${bundle.findings.length} finding(s) as security scan ${bundle.scan.id}.`);
}

async function exportResults(runtime: SlashCommandRuntime, rest: string): Promise<void> {
	const tokens = parseCommandArgs(rest);
	const scanId = tokens[0];
	if (!scanId) throw new Error("export requires <scan-id> --output <path> [--format bundle|sarif|report]");
	let outputPath: string | undefined;
	let format: "bundle" | "sarif" | "report" = "bundle";
	for (let index = 1; index < tokens.length; index++) {
		const token = tokens[index]!;

View on GitHub (pinned to 9690622007)

Solutions

Provide the SARIF file path: /security import results.sarif
Or provide a Codex Security bundle directory: /security import ./codex-security-bundle/
Use a path relative to the session cwd or an absolute path; the code resolves it with path.resolve(runtime.cwd, source)

Example fix

// before
/security import
// after
/security import ./security-report.sarif

Defensive patterns

Strategy: validation

Validate before calling

import * as fs from "node:fs";
function validateImportSource(rest: string): boolean {
  const [source] = rest.trim().split(/\s+/).filter(Boolean);
  return typeof source === "string" && source.length > 0;
}
// also verify the path exists before invoking:
// try { fs.statSync(source); } catch { /* resolve path first */ }

Try / catch

try {
  await runSlashCommand(`/security import ${source}`);
} catch (err) {
  if (err instanceof Error && err.message.startsWith("import requires")) {
    // no source given: prompt for SARIF file or Codex bundle directory
  } else throw err;
}

Prevention

Always pass the SARIF file path or Codex Security bundle directory as the first argument
Check that path variables expand to non-empty strings before invoking
Pass a directory (bundle import) or a .sarif file — the command branches on fs.stat().isDirectory()

When it happens

Trigger: Running /security import with no arguments; rest is empty or whitespace so parseCommandArgs returns an empty token list and the destructured source is undefined.

Common situations: Developer forgets the path entirely; an automation interpolates an empty path variable; a UI drops the argument when forwarding the command.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/0efa842d59d7e776. Report an issue: GitHub.