can1357/oh-my-pi · info

Unknown export format: ${value}

Error message

Unknown export format: ${value}

What it means

The --format option of /security export accepts only three values: bundle (default), sarif, or report. exportResults() throws this templated error when the token following --format is anything else. It validates the enum before any I/O so an invalid format never reaches the store or file writer.

Source

Thrown at packages/coding-agent/src/slash-commands/helpers/security.ts:186

		? await importCodexSecurityBundle(absolute, { repositoryRoot: store.repositoryRoot })
		: await importSarifFile(absolute, { repositoryRoot: store.repositoryRoot });
	await store.putBundle(bundle);
	await runtime.output(`Imported ${bundle.findings.length} finding(s) as security scan ${bundle.scan.id}.`);
}

async function exportResults(runtime: SlashCommandRuntime, rest: string): Promise<void> {
	const tokens = parseCommandArgs(rest);
	const scanId = tokens[0];
	if (!scanId) throw new Error("export requires <scan-id> --output <path> [--format bundle|sarif|report]");
	let outputPath: string | undefined;
	let format: "bundle" | "sarif" | "report" = "bundle";
	for (let index = 1; index < tokens.length; index++) {
		const token = tokens[index]!;
		if (token === "--output") outputPath = requireToken(tokens, ++index, token);
		else if (token === "--format") {
			const value = requireToken(tokens, ++index, token);
			if (value !== "bundle" && value !== "sarif" && value !== "report") {
				throw new Error(`Unknown export format: ${value}`);
			}
			format = value;
		} else throw new Error(`Unknown export option: ${token}`);
	}
	if (!outputPath) throw new Error("export requires --output <path>");
	const store = await SecurityStore.openForCwd(runtime.cwd);
	const bundle = await store.getBundle(scanIdFromInput(scanId));
	if (!bundle) throw new Error(`Unknown security scan: ${scanId}`);
	let content: string;
	if (format === "sarif") {
		if (!bundle.sarif) throw new Error(`Security scan ${scanId} has no SARIF result`);
		content = `${JSON.stringify(bundle.sarif, null, 2)}\n`;
	} else if (format === "report") {
		if (bundle.report === undefined) throw new Error(`Security scan ${scanId} has no report`);
		content = bundle.report;
	} else {
		content = `${JSON.stringify(bundle, null, 2)}\n`;
	}

View on GitHub (pinned to 9690622007)

Solutions

1. Use one of the exact lowercase values: --format bundle, --format sarif, or --format report
2. Fix typos (e.g. sariff -> sarif) and casing (SARIF -> sarif)
3. Drop the --format flag entirely to get the default bundle format

Example fix

// before
/security export scan-abc --output out.json --format json
// after
/security export scan-abc --output out.json --format bundle

const EXPORT_FORMATS = ["bundle", "sarif", "report"] as const;
type ExportFormat = (typeof EXPORT_FORMATS)[number];
function isExportFormat(v: string): v is ExportFormat {
  return (EXPORT_FORMATS as readonly string[]).includes(v);
}
// before invoking: if (format && !isExportFormat(format)) fix format;

function isExportFormat(value: string): value is "bundle" | "sarif" | "report" {
  return value === "bundle" || value === "sarif" || value === "report";
}

try {
  await runSlashCommand(`/security export ${scanId} --output ${out} --format ${format}`);
} catch (err) {
  if (err instanceof Error && err.message.startsWith("Unknown export format:")) {
    // retry with default bundle format or a corrected value
  } else throw err;
}

When it happens

Trigger: Running /security export <scan-id> --output <path> --format json (or pdf, xml, text, any value other than bundle/sarif/report); a script parameterizes the format with an unsupported value; typo variants like sariff or bundles.

Common situations: Developer assumes generic format names like json (the bundle is JSON but must be requested as bundle); automation config carries a stale format value from a different tool; case sensitivity mistakes such as --format SARIF (matching is exact lowercase).

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• validate requires a finding URI or <scan-id> <finding-id>
• show requires a scan id or security:// URI
• import requires a SARIF file or Codex Security bundle direct
• export requires <scan-id> --output <path> [--format bundle|s
• Unknown export option: ${token}

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/9db68583aa9c0431. Report an issue: GitHub.