What causes "Unknown disposition: ${status}" in can1357/oh-my-pi?

Use one of the exact allowed disposition values (lowercase) — check DISPOSITIONS in security.ts or the /security docs.

Unknown disposition: ${status}

Error message

Unknown disposition: ${status}

What it means

Thrown by updateDisposition when the status argument is not a member of the DISPOSITIONS set (SecurityDispositionStatus values such as open/triaged/false-positive/etc.). Validated client-side before persisting, so an invalid disposition never reaches store.updateDisposition.

Source

Thrown at packages/coding-agent/src/slash-commands/helpers/security.ts:339

				configurationId: options.configurationId,
				store,
			});
			await runtime.output(
				`Imported ${bundle.findings.length} Codex Security cloud finding(s) as security scan ${bundle.scan.id}.`,
			);
			return;
		}
		default:
			throw new Error("Usage: /security cloud <scans|start|status|pull>");
	}
}

async function updateDisposition(runtime: SlashCommandRuntime, rest: string): Promise<void> {
	const [scanId, findingId, status, ...rationaleParts] = parseCommandArgs(rest);
	if (!scanId || !findingId || !status) {
		throw new Error("disposition requires <scan-id> <finding-id> <status> [rationale]");
	}
	if (!DISPOSITIONS.has(status as SecurityDispositionStatus)) throw new Error(`Unknown disposition: ${status}`);
	const rationale = rationaleParts.join(" ").trim();
	if (status !== "open" && !rationale) throw new Error(`${status} requires a rationale`);
	const store = await SecurityStore.openForCwd(runtime.cwd);
	const finding = await store.updateDisposition(scanId, findingId, {
		status: status as SecurityDispositionStatus,
		rationale: rationale || undefined,
		updatedAt: new Date().toISOString(),
		actor: "operator",
	});
	await runtime.output(`Finding ${finding.id} disposition is now ${finding.disposition.status}.`);
}

export async function handleSecurityCommand(
	command: ParsedSlashCommand,
	runtime: SlashCommandRuntime,
): Promise<SlashCommandResult> {
	if (!runtime.settings.get("security.enabled")) {
		return usage("Security is disabled. Enable security.enabled before using /security.", runtime);

View on GitHub (pinned to 9690622007)

Solutions

Use one of the exact allowed disposition values (lowercase) — check DISPOSITIONS in security.ts or the /security docs.
Remember `open` is the only status allowed without a rationale.
Check spelling and case of the status token.

Example fix

// before
/security disposition scan_1 finding_2 resolved
// after
/security disposition scan_1 finding_2 triaged

Defensive patterns

Strategy: validation

Validate before calling

const DISPOSITIONS = new Set(["open", "triaged", "false-positive", "accepted-risk", "remediated"]); // match library values
if (!DISPOSITIONS.has(status)) throw new Error(`status must be one of: ${[...DISPOSITIONS].join(", ")}`);

Type guard

function isDisposition(s: string): s is SecurityDispositionStatus {
	return ["open", "triaged", "false-positive", "accepted-risk", "remediated"].includes(s);
}

Prevention

Use only the exact lowercase disposition values the library defines; no synonyms like resolved/fixed.
Validate the status token in any script that constructs disposition commands.
Check DISPOSITIONS in security.ts when the allowed set is uncertain.

When it happens

Trigger: Run `/security disposition scan_1 finding_2 resolved` or `... fixed` or `... Open` (case-sensitive) — any status outside the allowed set.

Common situations: Using synonyms like resolved/fixed/wontfix from other triage tools; capitalizing the status; guessing the vocabulary instead of checking allowed values.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/45ff0043ed360905. Report an issue: GitHub.