can1357/oh-my-pi · error · ToolError

scoped_path security scans require at least one include path

Error message

scoped_path security scans require at least one include path

What it means

targetFromParams converts security-scan parameters into a SecurityTargetRequest. For target_kind='scoped_path', at least one non-blank include path is mandatory; if include_paths is missing, empty, or all whitespace, it throws this preflight ToolError.

Source

Thrown at packages/coding-agent/src/tools/security-scan.ts:64

export interface SecurityScanToolDetails {
	action: SecurityScanParams["action"];
	plan?: { id: string; fingerprint: string };
	operation?: SecurityOperationSnapshot;
	cancelled?: boolean;
	finding?: { id: string; validationStatus: SecurityValidationStatus };
	cloudConfigurations?: CodexSecurityCloudConfiguration[];
	cloudStats?: CodexSecurityCloudStats;
	cloudScan?: { id: string; repositoryUrl: string };
	importedScan?: { id: string; findingCount: number };
}

function targetFromParams(params: SecurityScanParams): SecurityTargetRequest {
	const common = { includePaths: params.include_paths, excludePaths: params.exclude_paths };
	switch (params.target_kind ?? "repository") {
		case "scoped_path": {
			if (!params.include_paths?.some(value => value.trim().length > 0)) {
				throw new ToolError("scoped_path security scans require at least one include path");
			}
			return { kind: "scoped_path", includePaths: params.include_paths, excludePaths: params.exclude_paths };
		}
		case "working_tree":
			return { kind: "working_tree", ...common };
		case "ref_diff":
			if (!params.base_revision || !params.head_revision) {
				throw new ToolError("ref_diff preflight requires base_revision and head_revision");
			}
			return {
				kind: "ref_diff",
				baseRevision: params.base_revision,
				headRevision: params.head_revision,
				...common,
			};
		default:
			return { kind: "repository", ...common };
	}

View on GitHub (pinned to 9690622007)

Solutions

1. Provide include_paths with at least one real path, e.g. ["src/"]
2. If you want a whole-repo scan, omit target_kind (defaults to 'repository') or use 'working_tree'
3. Trim/validate the paths array client-side before the call

Example fix

// before
scan({ target_kind: "scoped_path" });
// after
scan({ target_kind: "scoped_path", include_paths: ["src/auth/"] });

if (params.target_kind === "scoped_path" && !(params.include_paths ?? []).some(p => p.trim())) throw new Error("include_paths must contain at least one non-blank path");

function hasIncludePaths(p: SecurityScanParams): p is SecurityScanParams & { include_paths: string[] } { return (p.include_paths ?? []).some(v => v.trim().length > 0); }

try { await securityScan(params); } catch (e) { if (e instanceof ToolError && e.message.includes("require at least one include path")) { return securityScan({ ...params, target_kind: "repository" }); } throw e; }

When it happens

Trigger: Calling the security-scan tool with target_kind='scoped_path' and no include_paths, include_paths: [], or include_paths: [" "].

Common situations: Model omits include_paths when it intends a repo-wide scan but leaves default scoped_path kind; params serialized with empty arrays; caller confused scoped_path with working_tree/repository kinds.

Understand the failure class

Background: Missing required parameter errors: what 'X is required' and 'the required X param is missing' mean, and how to fix them — this error's family across 27 libraries.

Related errors

• ${label} is required for this action
• symbol is required for project-aware ${action}; pass symbol=
• Symbol "${symbol}" occurrence ${occurrence} is out of bounds
• lookbackDays must be a positive integer or 'all'
• Security scan contains duplicate finding ids

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/4c3ebdfc00de9410. Report an issue: GitHub.