can1357/oh-my-pi · error · Error

SARIF artifact location is missing its URI

Error message

SARIF artifact location is missing its URI

What it means

SARIF result locations reference artifacts via a location object that must carry a uri. resolveSarifArtifactPath throws when artifact.uri is missing/empty, since a path cannot be resolved against the repository root or any uriBaseId without it.

Source

Thrown at packages/coding-agent/src/security/importers/sarif.ts:105

			return "medium";
		case "note":
			return "low";
		default:
			return "informational";
	}
}

function pathIsWithin(candidate: string, root: string): boolean {
	return candidate === root || candidate.startsWith(`${root}${path.sep}`);
}

async function resolveSarifArtifactPath(
	artifact: SarifArtifactLocation,
	run: SarifRun,
	repositoryRoot: string,
): Promise<string> {
	const uri = artifact.uri;
	if (!uri) throw new Error("SARIF artifact location is missing its URI");
	const rootUrl = pathToFileURL(`${repositoryRoot}${path.sep}`);
	let baseUrl = rootUrl;
	if (artifact.uriBaseId) {
		const declaredBase = run.originalUriBaseIds?.[artifact.uriBaseId]?.uri;
		if (!declaredBase && artifact.uriBaseId !== "%SRCROOT%") {
			throw new Error(`SARIF artifact uses an unknown URI base: ${artifact.uriBaseId}`);
		}
		baseUrl = declaredBase ? new URL(declaredBase, rootUrl) : rootUrl;
	}
	const resolvedUrl = new URL(uri.replaceAll("\\", "/"), baseUrl);
	if (resolvedUrl.protocol !== "file:") {
		throw new Error(`SARIF artifact URI must resolve to a repository file: ${uri}`);
	}
	const absolute = path.resolve(fileURLToPath(resolvedUrl));
	if (!pathIsWithin(absolute, repositoryRoot)) {
		throw new Error(`SARIF artifact resolves outside the repository: ${uri}`);
	}
	const canonical = await fs.realpath(absolute).catch(error => {

View on GitHub (pinned to 9690622007)

Solutions

1. Fix the SARIF producer so every artifactLocation includes a uri (even "" is rejected — use a relative path like "src/x.ts")
2. Post-process the SARIF to fill in the missing uri from physicalLocation or related fields before importing
3. Drop results lacking artifact URIs if they are not meaningful for the import

Example fix

// before
"artifactLocation": { "uriBaseId": "%SRCROOT%" }
// after
"artifactLocation": { "uri": "src/auth.ts", "uriBaseId": "%SRCROOT%" }

for (const run of sarif.runs) {
  for (const result of run.results ?? []) {
    for (const loc of result.locations ?? []) {
      const al = loc.physicalLocation?.artifactLocation;
      if (!al?.uri) throw new Error(`SARIF result ${result.ruleId} has artifactLocation without uri`);
    }
  }
}

function hasArtifactUri(loc: unknown): loc is { uri: string; uriBaseId?: string } {
  return typeof loc === "object" && loc !== null && typeof (loc as any).uri === "string" && (loc as any).uri.length > 0;
}

try {
  const bundle = await importSarif(sarifDir, repoRoot);
} catch (err) {
  if (err instanceof Error && err.message === "SARIF artifact location is missing its URI") {
    console.error("A result lacks artifactLocation.uri — fix the scanner output or drop that result");
  } else throw err;
}

When it happens

Trigger: A SARIF run contains a result whose artifactLocation has no uri field (or an empty string) — e.g. physicalLocation.artifactLocation = { uriBaseId: "%SRCROOT%" } with no uri.

Common situations: Scanners emitting relative locations only via uriBaseId conventions without a uri; malformed or minimized SARIF output; hand-written SARIF missing the uri key.

Related errors

• SARIF artifact uses an unknown URI base: ${artifact.uriBaseI
• SARIF artifact URI must resolve to a repository file: ${uri}
• SARIF artifact resolves outside the repository: ${uri}
• Security scan ${scanId} has no SARIF export
• Selected ${sourceName} session is no longer available

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/895dfaa59db52c5c. Report an issue: GitHub.