can1357/oh-my-pi · error

Security scan ${scanId} has no SARIF export

Error message

Security scan ${scanId} has no SARIF export

What it means

The security protocol handler exports a SARIF (OASIS Static Analysis Results Interchange Format) document only if the security scan produced one. When the resolved scan bundle has sarif === undefined, resolve() throws this error because there is no SARIF representation to serve. A scan without SARIF is legitimate — not all scan runs generate SARIF exports.

Source

Thrown at packages/coding-agent/src/internal-urls/security-protocol.ts:219

			}
			case "coverage":
				if (parts.length !== 3) throw new Error(`Unknown security resource: security://${parts.join("/")}`);
				return createSecurityResource({
					url: `security://scans/${scanId}/coverage`,
					content: `${JSON.stringify(bundle.scan.coverage, null, 2)}\n`,
					contentType: "application/json",
				});
			case "report":
				if (parts.length !== 3) throw new Error(`Unknown security resource: security://${parts.join("/")}`);
				if (bundle.report === undefined) throw new Error(`Security scan ${scanId} has no report`);
				return createSecurityResource({
					url: `security://scans/${scanId}/report`,
					content: bundle.report,
					contentType: "text/markdown",
				});
			case "sarif":
				if (parts.length !== 3) throw new Error(`Unknown security resource: security://${parts.join("/")}`);
				if (bundle.sarif === undefined) throw new Error(`Security scan ${scanId} has no SARIF export`);
				return createSecurityResource({
					url: `security://scans/${scanId}/sarif`,
					content: `${JSON.stringify(bundle.sarif, null, 2)}\n`,
					contentType: "application/json",
				});
			case "provenance":
				if (parts.length !== 3) throw new Error(`Unknown security resource: security://${parts.join("/")}`);
				return createSecurityResource({
					url: `security://scans/${scanId}/provenance`,
					content: `${JSON.stringify(redactPrivateSecurityMetadata(bundle.scan.provenance), null, 2)}\n`,
					contentType: "application/json",
				});
			default:
				throw new Error(`Unknown security resource: security://${parts.join("/")}`);
		}
	}

	async complete(query = "", context?: ResolveContext): Promise<UrlCompletion[]> {

View on GitHub (pinned to 9690622007)

Solutions

1. Re-run the security scan with SARIF export enabled so bundle.sarif is produced
2. Check the scan bundle before requesting the URL (e.g. via the manifest resource) to confirm SARIF exists
3. Use the available resources instead: security://scans/<scanId>/report or /findings or /manifest
4. Verify the scanId is correct — a different, complete scan may have the export

Example fix

// before
const res = await resolve('security://scans/old-scan/sarif');
// after
const manifest = JSON.parse((await resolve(`security://scans/${id}/manifest`)).content);
if (manifest.hasSarif) {
  const res = await resolve(`security://scans/${id}/sarif`);
}

const manifest = JSON.parse((await handler.resolve(`security://scans/${scanId}/manifest`, ctx)).content);
if (manifest.sarif === undefined && manifest.hasSarif !== true) {
  // SARIF not available for this scan; use report/findings instead
}

function hasSarif(bundle: { sarif?: unknown }): bundle is { sarif: object } {
  return bundle.sarif !== undefined;
}

try {
  return await handler.resolve(`security://scans/${id}/sarif`, ctx);
} catch (err) {
  if (err instanceof Error && /has no SARIF export/.test(err.message)) {
    return await handler.resolve(`security://scans/${id}/report`, ctx); // graceful fallback
  }
  throw err;
}

When it happens

Trigger: Resolving security://scans/<scanId>/sarif where the stored scan bundle for <scanId> lacks a SARIF export (bundle.sarif is undefined), typically because the scan run did not produce SARIF output or the export was not persisted.

Common situations: Requesting SARIF right after a scan that was configured without SARIF generation; an older scan predating SARIF export support; the scan failed partway and only partial results (report/findings) were saved; pointing at a scan ID belonging to a tool run that skipped the SARIF step.

Related errors

• SARIF artifact resolves outside the repository: ${uri}
• Security scan ${scanId} has no SARIF result
• The managed-skills root is a symlink; refusing to operate ou
• Managed skill "${name}" SKILL.md is a symlink; refusing to o
• Managed skill "${name}" resolves through a symlink; refusing

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/e65ec102d5806fcc. Report an issue: GitHub.