What causes "Unknown security scan: ${scanId}" in can1357/oh-my-pi?

List available scans (e.g. /security list) and copy an exact valid scan id

Unknown security scan: ${scanId}

Error message

Unknown security scan: ${scanId}

What it means

The scan id given to /security export does not correspond to any stored security scan. exportResults() calls store.getBundle(scanIdFromInput(scanId)) and throws this templated error when the store returns null/undefined. The input is normalized via scanIdFromInput, so both raw ids and scan URIs are accepted, but the resolved id must exist in the SecurityStore for the current repository.

Source

Thrown at packages/coding-agent/src/slash-commands/helpers/security.ts:194

	const scanId = tokens[0];
	if (!scanId) throw new Error("export requires <scan-id> --output <path> [--format bundle|sarif|report]");
	let outputPath: string | undefined;
	let format: "bundle" | "sarif" | "report" = "bundle";
	for (let index = 1; index < tokens.length; index++) {
		const token = tokens[index]!;
		if (token === "--output") outputPath = requireToken(tokens, ++index, token);
		else if (token === "--format") {
			const value = requireToken(tokens, ++index, token);
			if (value !== "bundle" && value !== "sarif" && value !== "report") {
				throw new Error(`Unknown export format: ${value}`);
			}
			format = value;
		} else throw new Error(`Unknown export option: ${token}`);
	}
	if (!outputPath) throw new Error("export requires --output <path>");
	const store = await SecurityStore.openForCwd(runtime.cwd);
	const bundle = await store.getBundle(scanIdFromInput(scanId));
	if (!bundle) throw new Error(`Unknown security scan: ${scanId}`);
	let content: string;
	if (format === "sarif") {
		if (!bundle.sarif) throw new Error(`Security scan ${scanId} has no SARIF result`);
		content = `${JSON.stringify(bundle.sarif, null, 2)}\n`;
	} else if (format === "report") {
		if (bundle.report === undefined) throw new Error(`Security scan ${scanId} has no report`);
		content = bundle.report;
	} else {
		content = `${JSON.stringify(bundle, null, 2)}\n`;
	}
	const absolute = path.resolve(runtime.cwd, outputPath);
	await writeSecurityFileAtomic(absolute, content, { hardenParent: false });
	await runtime.output(`Exported security scan ${scanId} to ${shortenPath(absolute)}.`);
}

interface CloudCliOptions {
	credentialId?: number;
	configurationId?: string;

View on GitHub (pinned to 9690622007)

Solutions

List available scans (e.g. /security list) and copy an exact valid scan id
Run the command from the same repository/cwd where the scan was imported
Verify the id: pass security://scans/<scan-id> or the bare scan id, not a findings URI
Re-import the SARIF/bundle if the scan no longer exists in this store

Example fix

// before
/security export scan-XYZ-doesnotexist --output out.json
// after
/security list
/security export scan-abc --output out.json

Defensive patterns

Strategy: validation

Validate before calling

// resolve the scan id from the same cwd/session before exporting:
async function scanExists(store: { getBundle(id: string): Promise<unknown> }, id: string) {
  return (await store.getBundle(id)) != null;
}
// or list scans first and pick an id from the output

Try / catch

try {
  await runSlashCommand(`/security export ${scanId} --output out.json`);
} catch (err) {
  if (err instanceof Error && err.message.startsWith("Unknown security scan:")) {
    // list scans, fix the id, or re-import the source
  } else throw err;
}

Prevention

Copy scan ids from /security list output rather than retyping them
Run export from the same repository/cwd where the scan was imported (the store is cwd-scoped)
Pass the scan id (or security://scans/<id>), not a findings URI
Re-import the SARIF/bundle if the store was cleared or migrated

When it happens

Trigger: Typo in the scan id; exporting a scan stored in a different repository/cwd (SecurityStore.openForCwd is cwd-scoped); the scan was deleted or the store was reset; passing a finding URI instead of a scan URI so scanIdFromInput extracts the wrong id.

Common situations: Working in a different checkout than where the scan was imported; stale scan id copied from old session output; id from another machine's store.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/557786d2781378e6. Report an issue: GitHub.