can1357/oh-my-pi · error · Error

Unknown security scan: ${beforeScanId}

Error message

Unknown security scan: ${beforeScanId}

What it means

compare() loads both scan bundles via getBundle() (which returns null for unknown scans) and throws this error when the beforeScanId does not resolve. The message names beforeScanId specifically; a companion throw covers afterScanId. Comparison requires both endpoints to exist in this store.

Source

Thrown at packages/coding-agent/src/security/store.ts:422

				if (!evidenceById.has(evidenceId)) {
					throw new Error(`Unknown security validation evidence: ${evidenceId}`);
				}
			}
			bundle.findings[index] = parseSecurityFinding({
				...finding,
				evidence: [...evidenceById.values()],
				validation: canonicalValidation,
			});
			if (bundle.sarif !== undefined) bundle.sarif = exportSecurityBundleToSarif(bundle);
			await this.#putBundleUnlocked(bundle);
			return bundle.findings[index];
		});
	}

	async compare(beforeScanId: string, afterScanId: string): Promise<SecurityComparisonReport> {
		const before = await this.getBundle(beforeScanId);
		const after = await this.getBundle(afterScanId);
		if (!before) throw new Error(`Unknown security scan: ${beforeScanId}`);
		if (!after) throw new Error(`Unknown security scan: ${afterScanId}`);
		return compareSecurityLineage(before, after);
	}

	async storeDigest(): Promise<string> {
		const index = await this.#readIndex();
		return Bun.SHA256.hash(JSON.stringify(index), "hex");
	}
}

View on GitHub (pinned to 9690622007)

Solutions

1. Check both scans first: const before = await store.getBundle(beforeScanId) and handle null with a clear message before calling compare().
2. List available scans with store.listScans() and pick existing ids (typically the two most recent).
3. Open the SecurityStore for the same repositoryRoot/stateRoot that produced the scans.
4. If the baseline was deleted, re-run it via putBundle() before comparing.

Example fix

// before
const report = await store.compare(cfg.baselineScanId, cfg.currentScanId); // baseline pruned
// after
const baseline = await store.getBundle(cfg.baselineScanId) ?? (await store.listScans()).at(-1);
if (!baseline) throw new Error('no baseline scan available; run a scan first');
const report = await store.compare(baseline.scan.id, cfg.currentScanId);

const before = await store.getBundle(beforeScanId);
const after = await store.getBundle(afterScanId);
if (!before || !after) throw new Error(`scans missing: ${!before ? beforeScanId : afterScanId}`);

function bothBundles(b: SecurityScanBundle | null, a: SecurityScanBundle | null): b is SecurityScanBundle {
  return b !== null && a !== null;
}

try {
  const report = await store.compare(beforeScanId, afterScanId);
} catch (err) {
  if (err instanceof Error && err.message.startsWith('Unknown security scan')) {
    const scans = await store.listScans();
    if (scans.length >= 2) return store.compare(scans[1].id, scans[0].id); // fall back to latest pair
  } else throw err;
}

When it happens

Trigger: Calling compare(beforeScanId, afterScanId) — also reached via matchesAt() — where the before scan has no stored bundle: typo'd id, scan from another repo's store, deleted scans directory, or ids passed in swapped/wrong order in caller code.

Common situations: Building lineage/CI gates where the baseline scan was pruned; running comparison from a different checkout whose project directory differs; hardcoding baseline ids in pipeline config that another environment doesn't have; argument order confusion.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Unknown security scan: ${scanId}
• Unknown security finding: ${findingId}
• Unknown security validation evidence: ${evidenceId}
• Plugin ${name} not found in runtime config
• Marketplace "${name}" not found

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/da643b576bab252e. Report an issue: GitHub.