can1357/oh-my-pi · error · ToolError

Security scan requires the session model and authentication

Error message

Security scan requires the session model and authentication registries

What it means

Beyond the security.enabled gate, the coordinator needs two session registries: modelRegistry (to run scan planning against a model) and authStorage. coordinatorForSession throws this ToolError when either is missing on the ToolSession. It is raised for all coordinator-backed actions (preflight, start, status, cancel) as well as execute.

Source

Thrown at packages/coding-agent/src/tools/security-scan.ts:127

	readonly loadMode = "discoverable";
	readonly summary = "Run OMP-native scans and explicit Codex Security cloud operations";
	readonly description = securityScanDescription.trim();
	readonly parameters = securityScanSchema;
	readonly strict = true;

	constructor(readonly session: ToolSession) {}

	async execute(
		_toolCallId: string,
		params: SecurityScanParams,
		signal?: AbortSignal,
	): Promise<AgentToolResult<SecurityScanToolDetails>> {
		if (!this.session.settings.get("security.enabled")) {
			throw new ToolError("Security is disabled. Enable security.enabled before using security_scan.");
		}
		const coordinatorForSession = () => {
			if (!this.session.modelRegistry || !this.session.authStorage) {
				throw new ToolError("Security scan requires the session model and authentication registries");
			}
			return getSecurityCoordinator({
				cwd: this.session.cwd,
				settings: this.session.settings,
				authStorage: this.session.authStorage,
				modelRegistry: this.session.modelRegistry,
				activeModel: this.session.getActiveModel?.(),
				sessionId: this.session.getSessionId?.() ?? undefined,
				agentId: this.session.getAgentId?.() ?? undefined,
				asyncJobManager: this.session.asyncJobManager,
			});
		};
		switch (params.action) {
			case "preflight": {
				const model = this.session.getActiveModel?.();
				const plan = await coordinatorForSession().preflight({
					target: targetFromParams(params),
					knowledgeBasePaths: params.knowledge_base_paths,

View on GitHub (pinned to 9690622007)

Solutions

1. Construct the session through the standard bootstrap so both modelRegistry and authStorage are populated.
2. If embedding, pass an initialized model registry and auth storage into the session factory.
3. For tests, provide stub registries that satisfy the session interface before invoking the tool.

Example fix

// before
const session = { cwd, settings } as ToolSession;
// after
const session = { cwd, settings, modelRegistry, authStorage } satisfies ToolSession;

if (!session.modelRegistry || !session.authStorage) throw new Error("security_scan needs modelRegistry and authStorage on the session");

function securityReady(s: ToolSession): boolean { return Boolean(s.modelRegistry && s.authStorage); }

try { return await tool.execute(id, params); } catch (e) { if (e instanceof ToolError && e.message.includes("model and authentication registries")) { /* re-bootstrap session registries */ } throw e; }

When it happens

Trigger: Calling any security_scan action that builds a coordinator while session.modelRegistry or session.authStorage is null/undefined — typically a session constructed by an SDK embedder or test harness that did not attach both registries.

Common situations: Custom integrations constructing ToolSession manually; test fixtures with stub sessions lacking registries; running in environments where model registry bootstrap failed or auth storage is unavailable.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No model configured
• No session - local:// unavailable
• Model registry is unavailable for inspect_image.
• Mnemopi backend is not initialised for this session.
• Hindsight backend is not initialised for this session.

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/4d4089dd49b6a7b1. Report an issue: GitHub.