can1357/oh-my-pi · error

Unknown security cloud option: ${token}

Error message

Unknown security cloud option: ${token}

What it means

Thrown by parseCloudOptions when a token passed to /security cloud is not a recognized flag and is not an allowed positional argument. Positionals (the configuration id) are only accepted for the `status` and `pull` subcommands, and only one per invocation. Everything else is rejected so typos fail fast instead of being silently ignored.

Source

Thrown at packages/coding-agent/src/slash-commands/helpers/security.ts:255

				break;
			case "--lookback": {
				const value = requireToken(tokens, ++index, token);
				if (value === "all") {
					options.lookbackDays = value;
					break;
				}
				const days = Number(value);
				if (!Number.isSafeInteger(days) || days < 1) throw new Error(`Invalid lookback: ${value}`);
				options.lookbackDays = days;
				break;
			}
			default:
				if (!token.startsWith("--") && !positionalConsumed && (subcommand === "status" || subcommand === "pull")) {
					options.configurationId = token;
					positionalConsumed = true;
					break;
				}
				throw new Error(`Unknown security cloud option: ${token}`);
		}
	}
	return options;
}

function cloudClientFor(runtime: SlashCommandRuntime, credentialId?: number): CodexSecurityCloudClient {
	const authStorage = runtime.session.modelRegistry.authStorage;
	const account = selectSecurityAccount(authStorage, "openai-codex", credentialId, runtime.session.sessionId);
	return new CodexSecurityCloudClient({ authStorage, account });
}

async function handleCloudCommand(runtime: SlashCommandRuntime, rest: string): Promise<void> {
	const { verb, rest: optionsText } = parseSubcommand(rest);
	const subcommand = verb || "scans";
	const options = parseCloudOptions(optionsText, subcommand);
	const client = cloudClientFor(runtime, options.credentialId);
	switch (subcommand) {
		case "scans": {

View on GitHub (pinned to 9690622007)

Solutions

1. For status/pull, pass the configuration id as a bare positional: `/security cloud status secconf_123`.
2. Use only the supported flags: --credential, --repo-id, --repo-url, --environment, --lookback.
3. Run `/security cloud` with no arguments to list scans and confirm valid syntax.
4. Check flag spelling (hyphenated: --repo-id, --repo-url).

Example fix

// before
/security cloud status --config secconf_abc
// after
/security cloud status secconf_abc

const ALLOWED_FLAGS = new Set(["--credential", "--repo-id", "--repo-url", "--environment", "--lookback"]);
const bad = args.filter(a => a.startsWith("--") && !ALLOWED_FLAGS.has(a));
if (bad.length) throw new Error(`Unsupported cloud flags: ${bad.join(", ")}`);

When it happens

Trigger: Run `/security cloud status --config secconf_123` (no --config flag exists), `/security cloud scans secconf_123` (positional not allowed for `scans`), `/security cloud start extra-arg ...` (second positional), or any misspelled flag like `--repoid`.

Common situations: Guessing flag names (--config vs bare positional, --repo instead of --repo-id); supplying a configuration id to `scans` which takes no arguments; copy-pasting options from other subcommands.

Related errors

• Usage: /export [--themes] [path]
• ${flag} requires a value
• Unknown security plan option: ${token}
• Usage: /security cloud <scans|start|status|pull>
• ${message}

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/80f4a10057e7c460. Report an issue: GitHub.