{"record":{"id":"ee4d56e082d95e26","repo":"can1357/oh-my-pi","slug":"codex-security-cloud-finding-has-no-usable-reposit","errorCode":null,"errorMessage":"Codex Security cloud finding has no usable repository-relative location","messagePattern":"Codex Security cloud finding has no usable repository-relative location","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/coding-agent/src/security/cloud.ts","lineNumber":455,"sourceCode":"\t\tlocations.push(location);\n\t\tconst entry: (typeof evidenceInputs)[number] = {\n\t\t\tkind: \"code\",\n\t\t\tlabel: `Cloud source evidence ${index + 1}`,\n\t\t\texplanation: text(line.comment) ?? \"Source location reported by Codex Security cloud.\",\n\t\t\tlocation,\n\t\t};\n\t\tconst excerpt = text(line.content);\n\t\tif (excerpt) entry.excerpt = excerpt;\n\t\tevidenceInputs.push(entry);\n\t}\n\tif (locations.length === 0 && Array.isArray(commit.files_involved)) {\n\t\tfor (const value of commit.files_involved) {\n\t\t\tconst sourcePath = normalizePath(value);\n\t\t\tif (sourcePath) locations.push({ path: sourcePath, startLine: 1, role: \"cloud-file\" });\n\t\t}\n\t}\n\tif (locations.length === 0)\n\t\tthrow new Error(\"Codex Security cloud finding has no usable repository-relative location\");\n\tconst validationReport = text(commit.validation_report) ?? text(commit.fix_check_report);\n\tif (validationReport) {\n\t\tevidenceInputs.push({\n\t\t\tkind: \"validation\",\n\t\t\tlabel: \"Cloud validation\",\n\t\t\texplanation: validationReport,\n\t\t});\n\t}\n\tconst evidence = evidenceInputs.map((item, index) => ({\n\t\tid: createSecurityEvidenceId(fingerprintSeed, item.label, index),\n\t\t...item,\n\t}));\n\treturn { locations, evidence };\n}\n\nfunction normalizeFinding(\n\traw: JsonObject,\n\tscanId: string,","sourceCodeStart":437,"sourceCodeEnd":473,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/coding-agent/src/security/cloud.ts#L437-L473","documentation":"When building a finding report from a Codex Security cloud commit, locationsAndEvidence converts the commit's files_involved into repository-relative locations. If normalization (normalizePath) discards every entry — e.g. paths that are absolute, outside the repo, or empty — no location remains and the finding cannot be anchored to the repository, so the function throws rather than emit a location-less finding.","triggerScenarios":"A cloud finding whose files_involved list is empty, or whose entries all fail normalizePath (absolute paths, paths escaping the repository root, empty strings). Called via preliminary() while building a report for such a commit.","commonSituations":"Cloud service scanned a differently-rooted repo or monorepo subdirectory, so returned paths are absolute or prefixed differently; findings generated from container/container-image scans with no file mapping; older cloud tenants emitting legacy path formats.","solutions":["Inspect files_involved on the offending cloud finding; check whether paths are absolute or repo-prefixed","Re-run the cloud scan ensuring the cloud project's repository root matches the local checkout","Update/refresh the cloud configuration so the reported file paths are repository-relative","If a specific finding is unfixable, exclude it upstream and re-import the bundle"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const usable = (commit.files_involved ?? []).some(p => normalizePath(p));\nif (!usable) throw new Error(`Cloud finding ${commit.id} has no repository-relative files_involved`);","typeGuard":null,"tryCatchPattern":"try {\n\treport = await preliminary(commit);\n} catch (err) {\n\tif (err instanceof Error && err.message.includes(\"no usable repository-relative location\")) {\n\t\tlogger.warn(\"Skipping cloud finding without resolvable location\", { id: commit.id });\n\t\treturn null;\n\t}\n\tthrow err;\n}","preventionTips":["Check files_involved paths on cloud findings before importing (must be repo-relative)","Ensure the cloud project's repository root matches the local checkout layout","Skip/log findings with empty or absolute paths instead of failing the whole import","Keep cloud scan configuration and local repo alignment under test"],"tags":["security","data-mapping","path-normalization"],"backgroundTag":"finding-location-missing","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}