can1357/oh-my-pi · error · Error

Security scan ${options.scanId} has already been published

Error message

Security scan ${options.scanId} has already been published

What it means

The security publish tool is strictly one-shot: its execute() sets a `published` flag and throws if invoked a second time for the same scanId. This guarantees a scan is published exactly once, preventing duplicate publication records and conflicting finding sets for one scan id.

Source

Thrown at packages/coding-agent/src/security/publication.ts:265

			return question;
		});
	}
	return coverage;
}

export function createSecurityPublicationTool(
	options: SecurityPublicationOptions,
): ToolDefinition<typeof securityPublishSchema, SecurityPublishDetails> {
	let published = false;
	return {
		name: "security_publish",
		label: "Publish Security Scan",
		description: securityPublishDescription.trim(),
		parameters: securityPublishSchema,
		approval: "write",
		strict: true,
		async execute(_toolCallId, params) {
			if (published) throw new Error(`Security scan ${options.scanId} has already been published`);
			published = true;
			let persisted = false;
			try {
				const completedAt = new Date().toISOString();
				const findingsByFingerprint = new Map<string, SecurityFinding>();
				for (const input of params.findings) {
					const finding = buildFinding(input, options, completedAt);
					if (!findingsByFingerprint.has(finding.fingerprint)) {
						findingsByFingerprint.set(finding.fingerprint, finding);
					}
				}
				const findings = [...findingsByFingerprint.values()];
				const producer = createNativeSecurityProducer();
				const provenance = createNativeSecurityProvenance({
					createdAt: options.startedAt,
					account: options.plan.account,
					planFingerprint: options.plan.fingerprint,
					workflowFingerprint: options.plan.workflowFingerprint,

View on GitHub (pinned to 9690622007)

Solutions

1. Do not call publish again; retrieve the existing publication via the store instead
2. Create a new scan (new scanId) and publish that if findings need re-submission
3. Restart the session/plan to get a fresh publish tool bound to a new scan
4. Check publication status before invoking publish

Example fix

// before
await publishTool.execute(id, params); // second call
// after
if (!published) await publishTool.execute(id, params); else readExistingPublication(scanId);

if (publishedScans.has(scanId)) return existingPublication;

null

try { await publish(params); } catch (e) { if (String(e.message).includes("already been published")) { /* fetch existing */ } else throw e; }

When it happens

Trigger: Calling the publish security scan tool a second time within the same session/plan after a successful (or flagged-in-progress) publication of the same scanId.

Common situations: An agent retries the publish tool because it did not parse the first result, a workflow script re-invokes the tool, or the user manually re-runs publish after already publishing findings.

Related errors

• goal is already complete
• Already compacted
• directory stack is empty
• No messages to continue from
• Cannot continue from message role: assistant

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/8eb09fba5adefe57. Report an issue: GitHub.