can1357/oh-my-pi · error

Security scan preflight requires an active model

Error message

Security scan preflight requires an active model

What it means

preflight() needs an LLM model to plan and drive the security scan: it uses input.model if given, otherwise the host's currently active model. When neither exists it throws, because scan planning cannot proceed without selecting a model and account.

Source

Thrown at packages/coding-agent/src/security/coordinator.ts:428

				operationId,
				planId: bundle.scan.plan?.id ?? "",
				scanId: bundle.scan.id,
				phase: operationPhaseFromStatus(bundle.scan.status),
				createdAt: bundle.scan.createdAt,
				updatedAt: bundle.scan.completedAt ?? bundle.scan.startedAt ?? bundle.scan.createdAt,
				findingCount: bundle.findings.length,
			};
			if (bundle.scan.error !== undefined) snapshot.error = bundle.scan.error;
			this.#operations.set(operationId, { snapshot, promise: Promise.resolve() });
		}
	}

	async preflight(input: SecurityPreflightInput = {}): Promise<SecurityScanPlan> {
		if (!this.#host.settings.get("security.enabled")) {
			throw new Error("Security is disabled; enable security.enabled before planning a scan");
		}
		const model = input.model ?? this.#host.activeModel;
		if (!model) throw new Error("Security scan preflight requires an active model");
		const account = selectSecurityAccount(
			this.#host.authStorage,
			model.provider,
			input.credentialId,
			this.#host.sessionId,
		);
		const store = await this.#openStore(this.#host.cwd);
		const workRoot = path.join(store.projectDirectory, "work");
		await fs.mkdir(workRoot, { recursive: true, mode: 0o700 });
		if (process.platform !== "win32") await fs.chmod(workRoot, 0o700);
		const modelRef: SecurityModelRef = { provider: model.provider, modelId: model.id };
		if (input.thinkingLevel !== undefined) modelRef.thinkingLevel = input.thinkingLevel;
		const plan = await createSecurityScanPlan(
			{
				cwd: this.#host.cwd,
				target: input.target ?? { kind: "repository" },
				knowledgeBasePaths: input.knowledgeBasePaths,
				outputRoot: input.outputRoot ?? path.join(workRoot, Bun.randomUUIDv7()),

View on GitHub (pinned to 9690622007)

Solutions

1. Pass an explicit model in the preflight input: preflight({ model }).
2. Set/activate a model in the session before planning (log in / configure the provider so activeModel is populated).
3. Verify provider credentials exist for the intended provider so the default model can be resolved.
4. Catch the error in automation and prompt the user to select a model before proceeding.

Example fix

// before
await coordinator.preflight({});
// after
await coordinator.preflight({ model: await host.resolveDefaultModel() });

const model = input.model ?? host.activeModel;
if (!model) throw new Error("select or pass a model before planning a security scan");

function hasModel(input: SecurityPreflightInput, activeModel: unknown): boolean {
  return Boolean(input.model ?? activeModel);
}

try {
  await coordinator.preflight(input);
} catch (err) {
  if (err instanceof Error && err.message.includes("requires an active model")) {
    // prompt for model selection or configure provider auth, then retry
  } else throw err;
}

When it happens

Trigger: Calling preflight() with no input.model while no model is active in the host session — e.g. running a security scan before any model is selected, or in a headless/SDK context where activeModel is never set.

Common situations: Scripted/SDK use of SecurityCoordinator outside an interactive TUI session; a session whose model failed to load (missing auth/provider config); invoking the security command in a fresh session before choosing a model.

Related errors

• No tiny/smol model available for AI staging
• No model available for commit generation
• Security is disabled; enable security.enabled before plannin
• Security is disabled; enable security.enabled before startin
• No model configured

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/18a3213bd34c397b. Report an issue: GitHub.