What causes "Security scan ${scanId} has no report" in can1357/oh-my-pi?

Export as bundle (--format bundle) to get the full stored scan data instead

Security scan ${scanId} has no report

Error message

Security scan ${scanId} has no report

What it means

The requested export format is report, but the stored scan bundle has no report (bundle.report === undefined). Reports are generated only for scans that produced one (e.g. SARIF imports with report generation); other scans store findings without a rendered report, so the requested format is unavailable for that scan id.

Source

Thrown at packages/coding-agent/src/slash-commands/helpers/security.ts:200

		if (token === "--output") outputPath = requireToken(tokens, ++index, token);
		else if (token === "--format") {
			const value = requireToken(tokens, ++index, token);
			if (value !== "bundle" && value !== "sarif" && value !== "report") {
				throw new Error(`Unknown export format: ${value}`);
			}
			format = value;
		} else throw new Error(`Unknown export option: ${token}`);
	}
	if (!outputPath) throw new Error("export requires --output <path>");
	const store = await SecurityStore.openForCwd(runtime.cwd);
	const bundle = await store.getBundle(scanIdFromInput(scanId));
	if (!bundle) throw new Error(`Unknown security scan: ${scanId}`);
	let content: string;
	if (format === "sarif") {
		if (!bundle.sarif) throw new Error(`Security scan ${scanId} has no SARIF result`);
		content = `${JSON.stringify(bundle.sarif, null, 2)}\n`;
	} else if (format === "report") {
		if (bundle.report === undefined) throw new Error(`Security scan ${scanId} has no report`);
		content = bundle.report;
	} else {
		content = `${JSON.stringify(bundle, null, 2)}\n`;
	}
	const absolute = path.resolve(runtime.cwd, outputPath);
	await writeSecurityFileAtomic(absolute, content, { hardenParent: false });
	await runtime.output(`Exported security scan ${scanId} to ${shortenPath(absolute)}.`);
}

interface CloudCliOptions {
	credentialId?: number;
	configurationId?: string;
	repositoryId?: string;
	repositoryUrl?: string;
	environmentId?: string;
	lookbackDays?: number | "all";
}

View on GitHub (pinned to 9690622007)

Solutions

Export as bundle (--format bundle) to get the full stored scan data instead
Re-import the source (e.g. /security import results.sarif) so a report is generated, then export the new scan as report
Use --format sarif if the scan retains SARIF and you need machine-readable output

Example fix

// before
/security export scan-abc --output report.md --format report
// after (scan has no stored report)
/security export scan-abc --output bundle.json --format bundle

Defensive patterns

Strategy: fallback

Try / catch

try {
  await runSlashCommand(`/security export ${scanId} --output report.md --format report`);
} catch (err) {
  if (err instanceof Error && err.message.endsWith("has no report")) {
    // fall back to the raw bundle instead
    await runSlashCommand(`/security export ${scanId} --output bundle.json --format bundle`);
  } else throw err;
}

Prevention

Export --format report only for scans known to have generated a report (typically SARIF imports)
Use --format bundle when report availability is uncertain
Re-import the source to regenerate a report before exporting as report
Treat report as an optional view, not a guaranteed artifact of every scan

When it happens

Trigger: Running /security export <scan-id> --output <path> --format report on a scan whose bundle has report === undefined; exporting a scan imported from a source that does not generate reports; a scan imported before report generation was part of the pipeline.

Common situations: Assuming every scan has an accompanying markdown/HTML report; exporting older scans after upgrading; mixing up report availability between SARIF-file imports and Codex bundle imports.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/9f20210348ece981. Report an issue: GitHub.