can1357/oh-my-pi · error

Usage: /security cloud <scans|start|status|pull>

Error message

Usage: /security cloud <scans|start|status|pull>

What it means

Thrown by the default case of handleCloudCommand when the /security cloud subcommand is not one of scans, start, status, or pull. parseSubcommand splits the first word of the arguments and any unrecognized verb reaches this catch-all, which surfaces the accepted usage.

Source

Thrown at packages/coding-agent/src/slash-commands/helpers/security.ts:330

			if (!options.configurationId) throw new Error("cloud status requires a configuration id");
			await runtime.output(JSON.stringify(await client.getStats(options.configurationId), null, 2));
			return;
		}
		case "pull": {
			if (!options.configurationId) throw new Error("cloud pull requires a configuration id");
			const store = await SecurityStore.openForCwd(runtime.cwd);
			const bundle = await pullCodexSecurityCloudResults({
				client,
				configurationId: options.configurationId,
				store,
			});
			await runtime.output(
				`Imported ${bundle.findings.length} Codex Security cloud finding(s) as security scan ${bundle.scan.id}.`,
			);
			return;
		}
		default:
			throw new Error("Usage: /security cloud <scans|start|status|pull>");
	}
}

async function updateDisposition(runtime: SlashCommandRuntime, rest: string): Promise<void> {
	const [scanId, findingId, status, ...rationaleParts] = parseCommandArgs(rest);
	if (!scanId || !findingId || !status) {
		throw new Error("disposition requires <scan-id> <finding-id> <status> [rationale]");
	}
	if (!DISPOSITIONS.has(status as SecurityDispositionStatus)) throw new Error(`Unknown disposition: ${status}`);
	const rationale = rationaleParts.join(" ").trim();
	if (status !== "open" && !rationale) throw new Error(`${status} requires a rationale`);
	const store = await SecurityStore.openForCwd(runtime.cwd);
	const finding = await store.updateDisposition(scanId, findingId, {
		status: status as SecurityDispositionStatus,
		rationale: rationale || undefined,
		updatedAt: new Date().toISOString(),
		actor: "operator",
	});

View on GitHub (pinned to 9690622007)

Solutions

1. Use one of: scans, start, status, pull — all lowercase.
2. Bare `/security cloud` defaults to `scans` and lists configurations.
3. Check `/security` top-level help for commands outside the cloud group.

Example fix

// before
/security cloud list
// after
/security cloud scans

const CLOUD_VERBS = new Set(["scans", "start", "status", "pull"]);
const verb = args.trim().split(/\s+/)[0] || "scans";
if (!CLOUD_VERBS.has(verb)) throw new Error(`Usage: /security cloud <scans|start|status|pull>, got: ${verb}`);

When it happens

Trigger: Run `/security cloud list`, `/security cloud create`, `/security cloud STATUS` (case-sensitive), or `/security cloud start-scan ...`.

Common situations: Guessing synonyms (`list` instead of `scans`, `run` instead of `start`); capitalizing the verb; using subcommands from other tools' CLIs.

Related errors

• Usage: /export [--themes] [path]
• ${flag} requires a value
• Unknown security plan option: ${token}
• Unknown security cloud option: ${token}
• ${message}

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/1482de4bac8e47c3. Report an issue: GitHub.