What causes "Security scan ${scanId} has no SARIF result" in can1357/oh-my-pi?

Export as bundle instead (--format bundle) — it always works for any stored scan

Security scan ${scanId} has no SARIF result

Error message

Security scan ${scanId} has no SARIF result

What it means

The requested export format is sarif, but the stored scan bundle has no SARIF payload (bundle.sarif is falsy). Not every imported scan carries original SARIF data (e.g. imports from a Codex Security bundle directory may store findings without raw SARIF), so the store cannot synthesize the requested format. The error surfaces the scan id so the developer knows which scan is affected.

Source

Thrown at packages/coding-agent/src/slash-commands/helpers/security.ts:197

	let format: "bundle" | "sarif" | "report" = "bundle";
	for (let index = 1; index < tokens.length; index++) {
		const token = tokens[index]!;
		if (token === "--output") outputPath = requireToken(tokens, ++index, token);
		else if (token === "--format") {
			const value = requireToken(tokens, ++index, token);
			if (value !== "bundle" && value !== "sarif" && value !== "report") {
				throw new Error(`Unknown export format: ${value}`);
			}
			format = value;
		} else throw new Error(`Unknown export option: ${token}`);
	}
	if (!outputPath) throw new Error("export requires --output <path>");
	const store = await SecurityStore.openForCwd(runtime.cwd);
	const bundle = await store.getBundle(scanIdFromInput(scanId));
	if (!bundle) throw new Error(`Unknown security scan: ${scanId}`);
	let content: string;
	if (format === "sarif") {
		if (!bundle.sarif) throw new Error(`Security scan ${scanId} has no SARIF result`);
		content = `${JSON.stringify(bundle.sarif, null, 2)}\n`;
	} else if (format === "report") {
		if (bundle.report === undefined) throw new Error(`Security scan ${scanId} has no report`);
		content = bundle.report;
	} else {
		content = `${JSON.stringify(bundle, null, 2)}\n`;
	}
	const absolute = path.resolve(runtime.cwd, outputPath);
	await writeSecurityFileAtomic(absolute, content, { hardenParent: false });
	await runtime.output(`Exported security scan ${scanId} to ${shortenPath(absolute)}.`);
}

interface CloudCliOptions {
	credentialId?: number;
	configurationId?: string;
	repositoryId?: string;
	repositoryUrl?: string;
	environmentId?: string;

View on GitHub (pinned to 9690622007)

Solutions

Export as bundle instead (--format bundle) — it always works for any stored scan
Re-import the original SARIF file: /security import results.sarif, then export the new scan as sarif
Choose --format report if you want the human-readable report rather than raw SARIF

Example fix

// before
/security export scan-abc --output out.sarif --format sarif
// after (scan has no SARIF stored)
/security export scan-abc --output out.json --format bundle
// or re-import SARIF then export
/security import ./results.sarif

Defensive patterns

Strategy: fallback

Try / catch

try {
  await runSlashCommand(`/security export ${scanId} --output out.sarif --format sarif`);
} catch (err) {
  if (err instanceof Error && err.message.endsWith("has no SARIF result")) {
    // fall back to: --format bundle (always available)
    await runSlashCommand(`/security export ${scanId} --output out.json --format bundle`);
  } else throw err;
}

Prevention

Export --format sarif only for scans imported from a SARIF file
For scans imported from a Codex Security bundle directory, use --format bundle
Prefer bundle format when you need a format guaranteed to exist for any scan
Re-import the original SARIF if SARIF output is required

When it happens

Trigger: Running /security export <scan-id> --output <path> --format sarif on a scan whose bundle lacks the sarif field; the scan was imported from a Codex bundle directory rather than a SARIF file; an older store entry predates SARIF retention.

Common situations: Exporting a directory-bundle import as SARIF; assuming all scans retain their original SARIF after re-import or migration; exporting a scan created from a report-only source.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/523fef06bf190253. Report an issue: GitHub.