can1357/oh-my-pi · error

${status} requires a rationale

Error message

${status} requires a rationale

What it means

Thrown by updateDisposition when the chosen status is anything other than `open` and the joined rationale text is empty. Every non-open disposition (e.g. triaged, false positive) must be justified, so the handler enforces a non-empty rationale before writing the disposition audit record.

Source

Thrown at packages/coding-agent/src/slash-commands/helpers/security.ts:341

			});
			await runtime.output(
				`Imported ${bundle.findings.length} Codex Security cloud finding(s) as security scan ${bundle.scan.id}.`,
			);
			return;
		}
		default:
			throw new Error("Usage: /security cloud <scans|start|status|pull>");
	}
}

async function updateDisposition(runtime: SlashCommandRuntime, rest: string): Promise<void> {
	const [scanId, findingId, status, ...rationaleParts] = parseCommandArgs(rest);
	if (!scanId || !findingId || !status) {
		throw new Error("disposition requires <scan-id> <finding-id> <status> [rationale]");
	}
	if (!DISPOSITIONS.has(status as SecurityDispositionStatus)) throw new Error(`Unknown disposition: ${status}`);
	const rationale = rationaleParts.join(" ").trim();
	if (status !== "open" && !rationale) throw new Error(`${status} requires a rationale`);
	const store = await SecurityStore.openForCwd(runtime.cwd);
	const finding = await store.updateDisposition(scanId, findingId, {
		status: status as SecurityDispositionStatus,
		rationale: rationale || undefined,
		updatedAt: new Date().toISOString(),
		actor: "operator",
	});
	await runtime.output(`Finding ${finding.id} disposition is now ${finding.disposition.status}.`);
}

export async function handleSecurityCommand(
	command: ParsedSlashCommand,
	runtime: SlashCommandRuntime,
): Promise<SlashCommandResult> {
	if (!runtime.settings.get("security.enabled")) {
		return usage("Security is disabled. Enable security.enabled before using /security.", runtime);
	}
	const { verb, rest } = parseSubcommand(command.args);

View on GitHub (pinned to 9690622007)

Solutions

1. Append the rationale text: `/security disposition <scan-id> <finding-id> <status> <why>`.
2. Use `open` as the status if no justification is intended (reopening a finding).
3. Quote multi-word rationales so parseCommandArgs keeps them as one token.

Example fix

// before
/security disposition scan_1 finding_2 false-positive
// after
/security disposition scan_1 finding_2 false-positive "dependency is not reachable at runtime"

if (status !== "open" && rationale.trim() === "") {
	throw new Error(`status "${status}" needs a non-empty rationale`);
}

When it happens

Trigger: Run `/security disposition scan_1 finding_2 false-positive` with no rationale words, or with a rationale consisting only of whitespace/quotes.

Common situations: Assuming a bare status suffices for all dispositions; rationale forgotten after the status token; empty quoted string "" passed as rationale.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Pass at least one model selector, e.g. `omp bench opus gpt-5
• No snippet provided. Pass inline text, --file <path>, or pip
• cloud start requires --repo-id, --repo-url, and --environmen
• invalid {} argument: {}
• invalid Zero increment value: {}

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/ab1e58927674aae4. Report an issue: GitHub.