can1357/oh-my-pi · error

Unknown security plan option: ${token}

Error message

Unknown security plan option: ${token}

What it means

parsePlanOptions walks slash-command tokens against a fixed switch of known plan flags (`--include`, `--exclude`, `--credential`, etc.). Any token not matched by a case reaches the default branch and throws this error, naming the offending token.

Source

Thrown at packages/coding-agent/src/slash-commands/helpers/security.ts:104

			case "--diff":
				kind = "ref_diff";
				baseRevision = requireToken(tokens, ++index, token);
				headRevision = requireToken(tokens, ++index, token);
				break;
			case "--knowledge-base":
				knowledgeBasePaths.push(requireToken(tokens, ++index, token));
				break;
			case "--output":
				outputRoot = requireToken(tokens, ++index, token);
				break;
			case "--archive-existing":
				archiveExisting = true;
				break;
			case "--credential":
				credentialId = parsePositiveCredential(requireToken(tokens, ++index, token));
				break;
			default:
				throw new Error(`Unknown security plan option: ${token}`);
		}
	}
	const common = { includePaths, excludePaths };
	const target: SecurityTargetRequest =
		kind === "ref_diff"
			? {
					kind,
					baseRevision: baseRevision ?? "",
					headRevision: headRevision ?? "",
					...common,
				}
			: kind === "working_tree"
				? { kind, ...common }
				: kind === "scoped_path"
					? { kind, ...common }
					: { kind: "repository", ...common };
	return { target, knowledgeBasePaths, outputRoot, archiveExisting, credentialId };
}

View on GitHub (pinned to 9690622007)

Solutions

1. Use only supported plan flags (see the switch: --include, --exclude, --credential, etc.).
2. Check the spelling of the flagged token in the error message.
3. Move flags that belong to export/results to the export subcommand instead of plan.
4. Run the command's help to list valid options.

Example fix

// before
/security plan --paths src/
// after
/security plan --include src/

const KNOWN = ["--include", "--exclude", "--credential"];
const bad = tokens.filter(t => t.startsWith("--") && !KNOWN.includes(t));
if (bad.length) throw new Error(`Unknown security plan option: ${bad[0]}`);

null

try {
  options = parsePlanOptions(rest);
} catch (err) {
  if (err instanceof Error && err.message.startsWith("Unknown security plan option")) {
    printPlanUsage(err.message);
    return;
  }
  throw err;
}

When it happens

Trigger: Typing an unsupported flag such as `--path`, `--out`, a misspelling like `--credntial`, or a subcommand word in the wrong position of `/security plan ...`.

Common situations: Typos in flag names; copying flags from another subcommand (e.g. export-only flags); shell aliasing inserting extra words.

Related errors

• Usage: /export [--themes] [path]
• ${flag} requires a value
• Unknown security cloud option: ${token}
• Usage: /security cloud <scans|start|status|pull>
• ${message}

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/ec1f40d911fccc15. Report an issue: GitHub.