can1357/oh-my-pi · error

Unknown security operation: ${operationId}

Error message

Unknown security operation: ${operationId}

What it means

Thrown by handleSecurityCommand's `status` case when coordinator.status(operationId) returns undefined, meaning no security scan operation with that id is known to the coordinator (no running or completed operation matches). The id here refers to an operation id from a local /security scan run, not a cloud configuration.

Source

Thrown at packages/coding-agent/src/slash-commands/helpers/security.ts:379

		switch (verb || "scans") {
			case "plan": {
				const plan = await preflight(runtime, rest);
				await runtime.output(`Security plan ${plan.id} is ready. Fingerprint: ${plan.fingerprint}.`);
				return commandConsumed();
			}
			case "scan": {
				const coordinator = coordinatorFor(runtime);
				const planId = rest.trim().startsWith("secplan_") ? rest.trim() : (await preflight(runtime, rest)).id;
				const operation = await coordinator.start({ planId });
				await runtime.output(`Security scan ${operation.scanId} started as ${operation.operationId}.`);
				return commandConsumed();
			}
			case "status": {
				const coordinator = coordinatorFor(runtime);
				const operationId = rest.trim();
				if (operationId) {
					const operation = await coordinator.status(operationId);
					if (!operation) throw new Error(`Unknown security operation: ${operationId}`);
					await runtime.output(JSON.stringify(operation, null, 2));
				} else {
					await runtime.output(JSON.stringify(await coordinator.listOperations(), null, 2));
				}
				return commandConsumed();
			}
			case "cancel": {
				const operationId = rest.trim();
				if (!operationId) throw new Error("cancel requires an operation id");
				await runtime.output(
					(await coordinatorFor(runtime).cancel(operationId))
						? `Cancellation requested for ${operationId}.`
						: `No cancellable security operation ${operationId}.`,
				);
				return commandConsumed();
			}
			case "scans": {
				const scans = await (await SecurityStore.openForCwd(runtime.cwd)).listScans();

View on GitHub (pinned to 9690622007)

Solutions

  1. Run `/security status` with no id to list all known operations and copy the exact id.
  2. Verify the id came from `/security scan` output (operationId), not a cloud configuration id.
  3. Re-run the scan if the session restarted and the operation no longer exists.
  4. Check for typos/truncation in the pasted id.

Example fix

// before
/security status secconf_abc
// after
/security status   # list operations, then:
/security status secop_1234
Defensive patterns

Strategy: try-catch

Validate before calling

const known = JSON.parse(outputOf(`/security status`)); // list operations
if (!known.some(op => op.operationId === id)) throw new Error(`unknown operation id: ${id}`);

Try / catch

try {
	await handleSecurityCommand(cmd, runtime);
} catch (err) {
	if (err instanceof Error && err.message.startsWith("Unknown security operation:")) {
		await runtime.output(JSON.stringify(await coordinatorFor(runtime).listOperations(), null, 2));
	} else throw err;
}

Prevention

When it happens

Trigger: Run `/security status secop_does_not_exist`; use an id from a different workspace/session; typographical error in the operation id; the operation record was pruned after session restart.

Common situations: Confusing cloud configuration ids (secconf_*) with local operation ids (from `/security scan` output); querying after restarting the CLI so in-memory operations are gone; paste errors with truncated ids.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/8f800597a0b1f182. Report an issue: GitHub.