What causes "Unknown security scan: ${scanId}" in can1357/oh-my-pi?

List valid ids by resolving security://scans and use one of the returned scan ids.

Unknown security scan: ${scanId}

Error message

Unknown security scan: ${scanId}

What it means

For URLs of the form security://scans/<id>/..., resolve() fetches the scan bundle from the SecurityStore via store.getBundle(scanId); if no stored scan matches the id, it throws "Unknown security scan: <scanId>". This means the scan id is not present in the project's security store.

Source

Thrown at packages/coding-agent/src/internal-urls/security-protocol.ts:149

					"- `security://scans` — list scans",
					"",
				].join("\n"),
				contentType: "text/markdown",
				isDirectory: true,
			});
		}
		if (parts[0] !== "scans") throw new Error(`Unknown security resource: security://${parts.join("/")}`);
		if (parts.length === 1) {
			return createSecurityResource({
				url: "security://scans",
				content: formatScans(await store.listScans()),
				contentType: "text/markdown",
				isDirectory: true,
			});
		}
		const scanId = parts[1];
		const bundle = await store.getBundle(scanId);
		if (!bundle) throw new Error(`Unknown security scan: ${scanId}`);
		if (parts.length === 2) {
			return createSecurityResource({
				url: `security://scans/${scanId}`,
				content: [
					`# Security scan ${scanId}`,
					"",
					`- Status: **${bundle.scan.status}**`,
					`- Producer: **${sanitizeText(bundle.scan.producer.name)}**`,
					`- Findings: **${bundle.findings.length}**`,
					`- Coverage: **${bundle.scan.coverage.completeness}**`,
					`- Target: \`${sanitizeText(bundle.scan.target.displayName)}\``,
					"",
					"Resources: `manifest`, `findings`, `coverage`, `report`, `sarif`, `provenance`.",
					"",
				].join("\n"),
				contentType: "text/markdown",
				isDirectory: true,
			});

View on GitHub (pinned to 9690622007)

Solutions

List valid ids by resolving security://scans and use one of the returned scan ids.
Run a new security scan to generate a bundle if the referenced scan was deleted or belongs to a previous store.
Verify you are resolving from the same project working directory where the scan was stored (the store is resolved per-cwd).
If the id came from a cached note/prompt, refresh it — scan ids are not stable across store resets.

Example fix

// before
await resolve(new URL("security://scans/old-scan-id/report"));
// after — look up a real id first
const scans = await store.listScans();
const id = scans[0]?.id;
if (id) await resolve(new URL(`security://scans/${id}/report`));

Defensive patterns

Strategy: validation

Validate before calling

async function resolveExistingScan(store: SecurityStore, scanId: string): Promise<ScanBundle> {
  const bundle = await store.getBundle(scanId);
  if (!bundle) {
    const scans = await store.listScans();
    const ids = scans.map(s => s.id).join(", ") || "none";
    throw new Error(`Scan "${scanId}" not found in store. Stored scans: ${ids}`);
  }
  return bundle;
}
// call before building any security://scans/<id>/... URL

Type guard

async function scanExists(store: SecurityStore, scanId: string): Promise<boolean> {
  return (await store.listScans()).some(s => s.id === scanId);
}

Try / catch

try {
  return await handler.resolve(url, ctx);
} catch (err) {
  if (err instanceof Error && err.message.startsWith("Unknown security scan:")) {
    const listing = await handler.resolve(new URL("security://scans"), ctx);
    return listing; // show available scans instead of failing
  }
  throw err;
}

Prevention

Resolve security://scans first and pick ids from the listing; never invent or truncate scan ids.
Remember the store is per-cwd — resolve URLs from the same working directory that produced the scan.
Refresh cached scan references after store resets, cleanups, or re-scans.
Verify scan status before deep-linking into sub-resources of a potentially pruned scan.

When it happens

Trigger: Resolving security://scans/<id> or any deeper resource where <id> was deleted, belongs to a different project's store (store resolution is cwd-based), was never created, or is a stale id cached in a prompt/notes from a previous session or store reset.

Common situations: Referencing a scan id after the security store directory was cleared or the scan pruned; switching working directories so a different SecurityStore is opened; hallucinated or truncated scan ids in agent-generated URLs; rerunning against a fresh clone with no stored scans.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/0001f1f46da239fa. Report an issue: GitHub.