What causes "Unknown security finding: ${findingId}" in can1357/oh-my-pi?

List the scan's findings (via the appropriate security_scan/store query) and use an exact finding_id from that scan.

can1357/oh-my-pi · error · ToolError

Unknown security finding: ${findingId}

Error message

Unknown security finding: ${findingId}

What it means

In the validate branch, after opening the SecurityStore for the session cwd, the tool looks up the finding by (scanId, findingId). If the store has no such finding, this ToolError is thrown before any validation update is written.

Source

Thrown at packages/coding-agent/src/tools/security-scan.ts:258

					signal,
				});
				return textResult(
					`Imported ${bundle.findings.length} Codex Security cloud finding(s) as security scan ${bundle.scan.id}.`,
					{
						action: params.action,
						importedScan: { id: bundle.scan.id, findingCount: bundle.findings.length },
					},
				);
			}
			case "validate": {
				const scanId = requireValue(params.scan_id, "scan_id");
				const findingId = requireValue(params.finding_id, "finding_id");
				const status = params.validation_status;
				if (!status) throw new ToolError("validation_status is required for this action");
				const summary = requireValue(params.validation_summary, "validation_summary");
				const store = await SecurityStore.openForCwd(this.session.cwd, { signal });
				const finding = await store.getFinding(scanId, findingId);
				if (!finding) throw new ToolError(`Unknown security finding: ${findingId}`);
				const evidence: SecurityEvidence[] = (params.validation_evidence ?? []).map((item, index) => ({
					id: createSecurityEvidenceId(
						finding.fingerprint,
						`validation:${item.label}`,
						finding.evidence.length + index,
					),
					kind: "validation",
					label: item.label,
					explanation: item.explanation,
				}));
				const updated = await store.updateValidation(
					scanId,
					findingId,
					{
						status,
						summary,
						evidenceIds: evidence.map(item => item.id),
						validatedAt: new Date().toISOString(),

View on GitHub (pinned to 9690622007)

Solutions

List the scan's findings (via the appropriate security_scan/store query) and use an exact finding_id from that scan.
Confirm scan_id matches the scan that produced the finding.
Run the tool with the same cwd used when the scan was created — SecurityStore.openForCwd is cwd-scoped.
If the scan was re-run, re-derive the finding id (fingerprints may map across runs).

Example fix

// before
{ action: "validate", scan_id: "scan-42", finding_id: "cloud-finding-9", ... }
// after
{ action: "validate", scan_id: "scan-42", finding_id: "finding-from-scan-42-listing", ... }

Defensive patterns

Strategy: validation

Validate before calling

const store = await SecurityStore.openForCwd(cwd);
if (!(await store.getFinding(scanId, findingId))) throw new Error(`finding ${findingId} not in scan ${scanId}`);

Try / catch

try { await tool.execute(id, validateParams); } catch (e) { if (e instanceof ToolError && e.message.startsWith("Unknown security finding")) { /* refresh finding ids from the scan listing */ } throw e; }

Prevention

Fetch finding ids from the scan's own listing immediately before validating.
Run validate in the same working directory where the scan was created.
Re-derive ids after any re-scan instead of caching them.

When it happens

Trigger: action="validate" with a finding_id that does not exist in the given scan_id — wrong scan id, finding already re-keyed after a re-scan, finding from an imported cloud scan stored under a different scan id, or querying a store from a different cwd than where the scan ran.

Common situations: Referencing findings after the scan was re-run (ids regenerate); validating a cloud-imported finding using the original cloud finding id instead of the imported id; running validate from a different repository directory.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/76c020cbe75e718e. Report an issue: GitHub.