can1357/oh-my-pi · error · ToolError

Security is disabled. Enable security.enabled before using s

Error message

Security is disabled. Enable security.enabled before using security_scan.

What it means

security_scan is gated behind the security.enabled setting. At the top of SecurityScanTool.execute, the session settings are checked and this ToolError is thrown if security is disabled. The library deliberately requires an explicit opt-in because security scans can run scan agents and consume resources.

Source

Thrown at packages/coding-agent/src/tools/security-scan.ts:123

export class SecurityScanTool implements AgentTool<typeof securityScanSchema, SecurityScanToolDetails> {
	readonly name = "security_scan";
	readonly approval: ToolTier = "exec";
	readonly label = "Security Scan";
	readonly loadMode = "discoverable";
	readonly summary = "Run OMP-native scans and explicit Codex Security cloud operations";
	readonly description = securityScanDescription.trim();
	readonly parameters = securityScanSchema;
	readonly strict = true;

	constructor(readonly session: ToolSession) {}

	async execute(
		_toolCallId: string,
		params: SecurityScanParams,
		signal?: AbortSignal,
	): Promise<AgentToolResult<SecurityScanToolDetails>> {
		if (!this.session.settings.get("security.enabled")) {
			throw new ToolError("Security is disabled. Enable security.enabled before using security_scan.");
		}
		const coordinatorForSession = () => {
			if (!this.session.modelRegistry || !this.session.authStorage) {
				throw new ToolError("Security scan requires the session model and authentication registries");
			}
			return getSecurityCoordinator({
				cwd: this.session.cwd,
				settings: this.session.settings,
				authStorage: this.session.authStorage,
				modelRegistry: this.session.modelRegistry,
				activeModel: this.session.getActiveModel?.(),
				sessionId: this.session.getSessionId?.() ?? undefined,
				agentId: this.session.getAgentId?.() ?? undefined,
				asyncJobManager: this.session.asyncJobManager,
			});
		};
		switch (params.action) {
			case "preflight": {

View on GitHub (pinned to 9690622007)

Solutions

Set security.enabled to true in session settings (e.g. `omp config set security.enabled true` or the settings file the session loads).
If the setting is project-scoped, add it to the project settings in the cwd the session runs in.
If security scanning is intentionally off, do not call security_scan; use the appropriate alternative workflow.

Example fix

// before (settings.json)
{ }
// after
{ "security": { "enabled": true } }

Defensive patterns

Strategy: validation

Validate before calling

if (!session.settings.get("security.enabled")) { throw new Error("enable security.enabled before calling security_scan"); }

Try / catch

try { await tool.execute(id, params); } catch (e) { if (e instanceof ToolError && e.message.startsWith("Security is disabled")) { await enableSetting("security.enabled"); return tool.execute(id, params); } throw e; }

Prevention

Set security.enabled=true in user or project settings before using security workflows.
Document the flag requirement wherever security_scan is invoked programmatically.
Check the setting once at workflow start instead of per-call.

When it happens

Trigger: Any call to security_scan (any action: preflight, start, status, cancel, validate, cloud_*) while settings.get("security.enabled") is falsy — i.e. the setting was never set, or was explicitly set to false in settings.json / project config.

Common situations: Fresh installs where the user never enabled security; team configs where security.enabled lives in a project-level settings file not present in the working directory; an agent autonomously trying security_scan before the user opted in.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/2137908d0c16d3b0. Report an issue: GitHub.