can1357/oh-my-pi · error

Unsupported Codex Security scan manifest

Error message

Unsupported Codex Security scan manifest

What it means

The Codex Security bundle importer validates each document's envelope before use. The scan-manifest.json must declare documentType "codex-security.scan-manifest" and schemaVersion "1.0"; otherwise the bundle is not in a supported format and the import is aborted.

Source

Thrown at packages/coding-agent/src/security/importers/codex-security.ts:197

			: [],
		deferred: Array.isArray(document.deferred) ? (document.deferred as SecurityCoverage["deferred"]) : [],
	};
	if (Array.isArray(document.openQuestions)) {
		coverage.openQuestions = document.openQuestions as SecurityCoverage["openQuestions"];
	}
	return coverage;
}

export async function importCodexSecurityBundle(
	bundleDirectory: string,
	options: CodexSecurityImportOptions,
): Promise<SecurityScanBundle> {
	const root = path.resolve(bundleDirectory);
	const manifest = await readJson<CodexManifest>(path.join(root, "scan-manifest.json"));
	const findingsDocument = await readJson<CodexFindingsDocument>(path.join(root, "findings.json"));
	const coverageDocument = await readJson<CodexCoverageDocument>(path.join(root, "coverage.json"));
	if (manifest.documentType !== "codex-security.scan-manifest" || manifest.schemaVersion !== "1.0") {
		throw new Error("Unsupported Codex Security scan manifest");
	}
	if (findingsDocument.documentType !== "codex-security.findings" || findingsDocument.schemaVersion !== "1.0") {
		throw new Error("Unsupported Codex Security findings document");
	}
	if (coverageDocument.documentType !== "codex-security.coverage" || coverageDocument.schemaVersion !== "1.0") {
		throw new Error("Unsupported Codex Security coverage document");
	}
	if (
		!manifest.scan?.id ||
		findingsDocument.scanId !== manifest.scan.id ||
		coverageDocument.scanId !== manifest.scan.id
	) {
		throw new Error("Codex Security bundle scan IDs do not agree");
	}
	const fixtureProvenance = await readJson<CodexFixtureProvenance>(path.join(root, "PROVENANCE.json")).catch(
		(): CodexFixtureProvenance => ({}),
	);
	const scanId = options.createScanId?.() ?? createSecurityScanId();

View on GitHub (pinned to 9690622007)

Solutions

1. Regenerate the bundle with a Codex Security version that emits schemaVersion 1.0 and the codex-security.scan-manifest documentType
2. Verify scan-manifest.json contains exactly documentType: "codex-security.scan-manifest" and schemaVersion: "1.0"
3. Ensure the bundleDirectory passed to the importer is the actual bundle root containing that manifest

Example fix

// before (scan-manifest.json)
{ "documentType": "codex-security.scan", "schemaVersion": "1.1" }
// after
{ "documentType": "codex-security.scan-manifest", "schemaVersion": "1.0" }

const manifest = JSON.parse(await Bun.file(path.join(dir, "scan-manifest.json")).text());
if (manifest.documentType !== "codex-security.scan-manifest" || manifest.schemaVersion !== "1.0") {
  throw new Error(`Unsupported scan manifest: ${manifest.documentType}/${manifest.schemaVersion}`);
}

function isSupportedManifest(m: unknown): m is { documentType: "codex-security.scan-manifest"; schemaVersion: "1.0" } {
  return typeof m === "object" && m !== null &&
    (m as any).documentType === "codex-security.scan-manifest" && (m as any).schemaVersion === "1.0";
}

try {
  const bundle = await importCodexSecurityBundle(dir);
} catch (err) {
  if (err instanceof Error && err.message === "Unsupported Codex Security scan manifest") {
    console.error("Regenerate the bundle with a compatible Codex Security version (schema 1.0)");
  } else throw err;
}

When it happens

Trigger: importCodexSecurityBundle reads scan-manifest.json and its documentType or schemaVersion differs from codex-security.scan-manifest / 1.0 (wrong file in the directory, missing fields, or a newer schema).

Common situations: Pointing the importer at a directory from an older/newer Codex Security version; scan-manifest.json replaced or truncated; passing a directory whose manifest belongs to a different tool.

Related errors

• Unsupported Codex Security findings document
• Unsupported Codex Security coverage document
• Codex Security bundle locations must be repository-relative:
• Codex Security bundle scan IDs do not agree
• invalid glob `{pattern}`: {error}

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/44f7030ed062cf37. Report an issue: GitHub.