can1357/oh-my-pi · error

Unsupported Codex Security findings document

Error message

Unsupported Codex Security findings document

What it means

Alongside the manifest, the importer validates findings.json's envelope: it must declare documentType "codex-security.findings" and schemaVersion "1.0". Any deviation means the findings document is not in the supported format and the import aborts before findings are mapped.

Source

Thrown at packages/coding-agent/src/security/importers/codex-security.ts:200

	if (Array.isArray(document.openQuestions)) {
		coverage.openQuestions = document.openQuestions as SecurityCoverage["openQuestions"];
	}
	return coverage;
}

export async function importCodexSecurityBundle(
	bundleDirectory: string,
	options: CodexSecurityImportOptions,
): Promise<SecurityScanBundle> {
	const root = path.resolve(bundleDirectory);
	const manifest = await readJson<CodexManifest>(path.join(root, "scan-manifest.json"));
	const findingsDocument = await readJson<CodexFindingsDocument>(path.join(root, "findings.json"));
	const coverageDocument = await readJson<CodexCoverageDocument>(path.join(root, "coverage.json"));
	if (manifest.documentType !== "codex-security.scan-manifest" || manifest.schemaVersion !== "1.0") {
		throw new Error("Unsupported Codex Security scan manifest");
	}
	if (findingsDocument.documentType !== "codex-security.findings" || findingsDocument.schemaVersion !== "1.0") {
		throw new Error("Unsupported Codex Security findings document");
	}
	if (coverageDocument.documentType !== "codex-security.coverage" || coverageDocument.schemaVersion !== "1.0") {
		throw new Error("Unsupported Codex Security coverage document");
	}
	if (
		!manifest.scan?.id ||
		findingsDocument.scanId !== manifest.scan.id ||
		coverageDocument.scanId !== manifest.scan.id
	) {
		throw new Error("Codex Security bundle scan IDs do not agree");
	}
	const fixtureProvenance = await readJson<CodexFixtureProvenance>(path.join(root, "PROVENANCE.json")).catch(
		(): CodexFixtureProvenance => ({}),
	);
	const scanId = options.createScanId?.() ?? createSecurityScanId();
	const createdAt = options.createdAt ?? manifest.scan.startedAt ?? new Date().toISOString();
	const canonicalRoot = await fs.realpath(path.resolve(options.repositoryRoot));
	const producer: SecurityProducer = {

View on GitHub (pinned to 9690622007)

Solutions

1. Regenerate findings.json with a compatible Codex Security version (documentType codex-security.findings, schemaVersion 1.0)
2. Re-export the whole bundle as one unit so manifest, findings, and coverage come from the same scan/run
3. Fix the envelope fields in findings.json if they were accidentally edited

Example fix

// before (findings.json)
{ "documentType": "codex-security.findings", "schemaVersion": "2.0" }
// after
{ "documentType": "codex-security.findings", "schemaVersion": "1.0" }

const findings = JSON.parse(await Bun.file(path.join(dir, "findings.json")).text());
if (findings.documentType !== "codex-security.findings" || findings.schemaVersion !== "1.0") {
  throw new Error(`Unsupported findings document: ${findings.documentType}/${findings.schemaVersion}`);
}

function isSupportedFindings(d: unknown): d is { documentType: "codex-security.findings"; schemaVersion: "1.0" } {
  return typeof d === "object" && d !== null &&
    (d as any).documentType === "codex-security.findings" && (d as any).schemaVersion === "1.0";
}

try {
  const bundle = await importCodexSecurityBundle(dir);
} catch (err) {
  if (err instanceof Error && err.message === "Unsupported Codex Security findings document") {
    console.error("findings.json envelope invalid — regenerate the bundle");
  } else throw err;
}

When it happens

Trigger: importCodexSecurityBundle reads findings.json whose documentType or schemaVersion does not match codex-security.findings / 1.0.

Common situations: findings.json generated by a different/newer Codex Security release; manifest and findings files mixed from different bundles; file corrupted or hand-edited so the envelope fields were lost.

Related errors

• Unsupported Codex Security scan manifest
• Unsupported Codex Security coverage document
• Codex Security bundle locations must be repository-relative:
• Codex Security bundle scan IDs do not agree
• invalid glob `{pattern}`: {error}

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/f926976b130defd9. Report an issue: GitHub.