{"record":{"id":"db0ea9a59b1c459e","repo":"can1357/oh-my-pi","slug":"finding-finding-id-contains-duplicate-occurrenc","errorCode":null,"errorMessage":"Finding ${finding.id} contains duplicate occurrence ids","messagePattern":"Finding (.+?) contains duplicate occurrence ids","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/security/contracts/validation.ts","lineNumber":58,"sourceCode":"\t}\n\tfor (const findingId of referencedFindingIds) {\n\t\tif (!findingIds.has(findingId)) throw new Error(`Security scan references missing finding: ${findingId}`);\n\t}\n\tfor (const findingId of findingIds) {\n\t\tif (!referencedFindingIds.has(findingId))\n\t\t\tthrow new Error(`Security scan omits finding from manifest: ${findingId}`);\n\t}\n\tfor (const finding of bundle.findings) {\n\t\tif (finding.scanId !== bundle.scan.id) {\n\t\t\tthrow new Error(`Finding ${finding.id} belongs to ${finding.scanId}, expected ${bundle.scan.id}`);\n\t\t}\n\t\tconst evidenceIds = new Set(finding.evidence.map(evidence => evidence.id));\n\t\tif (evidenceIds.size !== finding.evidence.length) {\n\t\t\tthrow new Error(`Finding ${finding.id} contains duplicate evidence ids`);\n\t\t}\n\t\tconst occurrenceIds = new Set(finding.occurrences.map(occurrence => occurrence.id));\n\t\tif (occurrenceIds.size !== finding.occurrences.length) {\n\t\t\tthrow new Error(`Finding ${finding.id} contains duplicate occurrence ids`);\n\t\t}\n\t\tfor (const occurrence of finding.occurrences) {\n\t\t\tfor (const evidenceId of occurrence.evidenceIds) {\n\t\t\t\tif (!evidenceIds.has(evidenceId)) {\n\t\t\t\t\tthrow new Error(`Occurrence ${occurrence.id} references missing evidence: ${evidenceId}`);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn bundle;\n}\n","sourceCodeStart":40,"sourceCodeEnd":70,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/security/contracts/validation.ts#L40-L70","documentation":"parseSecurityScanBundle enforces unique occurrence ids within each finding (Set size vs array length). Occurrences represent concrete code locations; duplicated ids break downstream lookup and deduplication, so the library rejects the bundle at parse time.","triggerScenarios":"Loading or importing a bundle where finding.occurrences has two entries sharing an id — usually caused by the scan session emitting the same occurrence twice or an importer mapping multiple SARIF results to one occurrence id.","commonSituations":"SARIF conversions where several results collapse onto the same location id; resumable scan runs that re-emit occurrences after a retry without clearing prior state.","solutions":["Deduplicate occurrences by id in the offending finding before loading.","Fix the producing code so occurrence ids are unique per finding (include location/result index in the id).","Regenerate the bundle by re-running the security scan."],"exampleFix":"// before\nfinding.occurrences.push(occurrenceFrom(result)); // same id as an existing occurrence\n// after\nif (!finding.occurrences.some(o => o.id === occ.id)) finding.occurrences.push(occ);","handlingStrategy":"validation","validationCode":"for (const f of bundle.findings) {\n  const ids = f.occurrences.map(o => o.id);\n  if (new Set(ids).size !== ids.length) throw new Error(`duplicate occurrence ids in finding ${f.id}`);\n}","typeGuard":"function hasUniqueOccurrenceIds(finding: SecurityFinding): boolean {\n  const ids = finding.occurrences.map(o => o.id);\n  return new Set(ids).size === ids.length;\n}","tryCatchPattern":"try {\n  const bundle = readBundle(scanId);\n} catch (err) {\n  if (err instanceof Error && err.message.includes(\"duplicate occurrence ids\")) {\n    // deduplicate or regenerate the bundle\n  } else throw err;\n}","preventionTips":["Include a per-finding sequence number or location hash in occurrence ids to guarantee uniqueness.","Guard occurrence emission with an id-set check before push.","On resumable scan runs, clear or merge prior occurrence state instead of appending."],"tags":["validation","duplicate-ids","security-scan"],"backgroundTag":"duplicate-identifier","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}