can1357/oh-my-pi · error · Error

SARIF artifact uses an unknown URI base: ${artifact.uriBaseI

Error message

SARIF artifact uses an unknown URI base: ${artifact.uriBaseId}

What it means

SARIF artifacts can qualify their uri with a uriBaseId that must map to an entry in run.originalUriBaseIds (the built-in "%SRCROOT%" is always accepted, resolving to the repository root). When the id is not declared and is not "%SRCROOT%", the importer cannot know the base URL and throws.

Source

Thrown at packages/coding-agent/src/security/importers/sarif.ts:111

}

function pathIsWithin(candidate: string, root: string): boolean {
	return candidate === root || candidate.startsWith(`${root}${path.sep}`);
}

async function resolveSarifArtifactPath(
	artifact: SarifArtifactLocation,
	run: SarifRun,
	repositoryRoot: string,
): Promise<string> {
	const uri = artifact.uri;
	if (!uri) throw new Error("SARIF artifact location is missing its URI");
	const rootUrl = pathToFileURL(`${repositoryRoot}${path.sep}`);
	let baseUrl = rootUrl;
	if (artifact.uriBaseId) {
		const declaredBase = run.originalUriBaseIds?.[artifact.uriBaseId]?.uri;
		if (!declaredBase && artifact.uriBaseId !== "%SRCROOT%") {
			throw new Error(`SARIF artifact uses an unknown URI base: ${artifact.uriBaseId}`);
		}
		baseUrl = declaredBase ? new URL(declaredBase, rootUrl) : rootUrl;
	}
	const resolvedUrl = new URL(uri.replaceAll("\\", "/"), baseUrl);
	if (resolvedUrl.protocol !== "file:") {
		throw new Error(`SARIF artifact URI must resolve to a repository file: ${uri}`);
	}
	const absolute = path.resolve(fileURLToPath(resolvedUrl));
	if (!pathIsWithin(absolute, repositoryRoot)) {
		throw new Error(`SARIF artifact resolves outside the repository: ${uri}`);
	}
	const canonical = await fs.realpath(absolute).catch(error => {
		if (error instanceof Error && "code" in error && error.code === "ENOENT") return absolute;
		throw error;
	});
	if (!pathIsWithin(canonical, repositoryRoot)) {
		throw new Error(`SARIF artifact resolves outside the repository through a symbolic link: ${uri}`);
	}

View on GitHub (pinned to 9690622007)

Solutions

1. Add the missing key to run.originalUriBaseIds in the SARIF (e.g. { "PROJECT_ROOT": { "uri": "file:///repo/root/" } })
2. Use the standard "%SRCROOT%" uriBaseId for repository-root-relative URIs
3. Fix the typo so uriBaseId matches an existing originalUriBaseIds entry

Example fix

// before
"originalUriBaseIds": { "%SRCROOT%": { "uri": "file:///repo/" } }, "uriBaseId": "SRCROOT"
// after
"originalUriBaseIds": { "%SRCROOT%": { "uri": "file:///repo/" }, "SRCROOT": { "uri": "file:///repo/" } }

for (const run of sarif.runs) {
  for (const result of run.results ?? []) {
    for (const loc of result.locations ?? []) {
      const id = loc.physicalLocation?.artifactLocation?.uriBaseId;
      if (id && id !== "%SRCROOT%" && !run.originalUriBaseIds?.[id]?.uri) {
        throw new Error(`uriBaseId "${id}" has no originalUriBaseIds entry`);
      }
    }
  }
}

function uriBaseIdIsDeclared(run: { originalUriBaseIds?: Record<string, { uri?: string }> }, id?: string): boolean {
  return !id || id === "%SRCROOT%" || Boolean(run.originalUriBaseIds?.[id]?.uri);
}

try {
  const bundle = await importSarif(sarifDir, repoRoot);
} catch (err) {
  if (err instanceof Error && err.message.startsWith("SARIF artifact uses an unknown URI base")) {
    console.error(err.message + " — add the base to run.originalUriBaseIds or use %SRCROOT%");
  } else throw err;
}

When it happens

Trigger: resolveSarifArtifactPath sees artifact.uriBaseId set, run.originalUriBaseIds has no entry for that id, and the id is not the literal "%SRCROOT%".

Common situations: Scanner invents custom uriBaseIds (e.g. "PROJECT_ROOT") without declaring them; SARIF files concatenated from runs with different base declarations; typo in the uriBaseId vs the originalUriBaseIds key.

Related errors

• SARIF artifact location is missing its URI
• SARIF artifact URI must resolve to a repository file: ${uri}
• SARIF artifact resolves outside the repository: ${uri}
• Security scan ${scanId} has no SARIF export
• Selected ${sourceName} session is no longer available

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/3841fa0176e55ab8. Report an issue: GitHub.