Codex Security cloud finding has no usable repository-relati

Error message

Codex Security cloud finding has no usable repository-relative location

What it means

When building a finding report from a Codex Security cloud commit, locationsAndEvidence converts the commit's files_involved into repository-relative locations. If normalization (normalizePath) discards every entry — e.g. paths that are absolute, outside the repo, or empty — no location remains and the finding cannot be anchored to the repository, so the function throws rather than emit a location-less finding.

Source

Thrown at packages/coding-agent/src/security/cloud.ts:455

		locations.push(location);
		const entry: (typeof evidenceInputs)[number] = {
			kind: "code",
			label: `Cloud source evidence ${index + 1}`,
			explanation: text(line.comment) ?? "Source location reported by Codex Security cloud.",
			location,
		};
		const excerpt = text(line.content);
		if (excerpt) entry.excerpt = excerpt;
		evidenceInputs.push(entry);
	}
	if (locations.length === 0 && Array.isArray(commit.files_involved)) {
		for (const value of commit.files_involved) {
			const sourcePath = normalizePath(value);
			if (sourcePath) locations.push({ path: sourcePath, startLine: 1, role: "cloud-file" });
		}
	}
	if (locations.length === 0)
		throw new Error("Codex Security cloud finding has no usable repository-relative location");
	const validationReport = text(commit.validation_report) ?? text(commit.fix_check_report);
	if (validationReport) {
		evidenceInputs.push({
			kind: "validation",
			label: "Cloud validation",
			explanation: validationReport,
		});
	}
	const evidence = evidenceInputs.map((item, index) => ({
		id: createSecurityEvidenceId(fingerprintSeed, item.label, index),
		...item,
	}));
	return { locations, evidence };
}

function normalizeFinding(
	raw: JsonObject,
	scanId: string,

View on GitHub (pinned to 9690622007)

Solutions

Inspect files_involved on the offending cloud finding; check whether paths are absolute or repo-prefixed
Re-run the cloud scan ensuring the cloud project's repository root matches the local checkout
Update/refresh the cloud configuration so the reported file paths are repository-relative
If a specific finding is unfixable, exclude it upstream and re-import the bundle

Defensive patterns

Strategy: try-catch

Validate before calling

const usable = (commit.files_involved ?? []).some(p => normalizePath(p));
if (!usable) throw new Error(`Cloud finding ${commit.id} has no repository-relative files_involved`);

Try / catch

try {
	report = await preliminary(commit);
} catch (err) {
	if (err instanceof Error && err.message.includes("no usable repository-relative location")) {
		logger.warn("Skipping cloud finding without resolvable location", { id: commit.id });
		return null;
	}
	throw err;
}

Prevention

Check files_involved paths on cloud findings before importing (must be repo-relative)
Ensure the cloud project's repository root matches the local checkout layout
Skip/log findings with empty or absolute paths instead of failing the whole import
Keep cloud scan configuration and local repo alignment under test

When it happens

Trigger: A cloud finding whose files_involved list is empty, or whose entries all fail normalizePath (absolute paths, paths escaping the repository root, empty strings). Called via preliminary() while building a report for such a commit.

Common situations: Cloud service scanned a differently-rooted repo or monorepo subdirectory, so returned paths are absolute or prefixed differently; findings generated from container/container-image scans with no file mapping; older cloud tenants emitting legacy path formats.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/ee4d56e082d95e26. Report an issue: GitHub.