{"record":{"id":"056fd89c7fab3269","repo":"ruvnet/ruflo","slug":"extracted-binary-path-failed-validation-validat","errorCode":null,"errorMessage":"extracted binary path failed validation: ${validation.errors.join('; ') || 'unknown'}","messagePattern":"extracted binary path failed validation: (.+?)","errorType":"exception","errorClass":"ExtractionError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/cli/src/proxy/install.ts","lineNumber":165,"sourceCode":"\n    const extractDir = path.join(workDir, 'extracted');\n    await extractArchive(archivePath, extractDir, releaseArchiveExtension(triple));\n\n    const extractedBinaryPath = path.join(extractDir, binaryNameInArchive());\n    if (!fs.existsSync(extractedBinaryPath)) {\n      throw new ExtractionError(`archive did not contain the expected binary at its root: ${binaryNameInArchive()}`);\n    }\n\n    // Defense in depth: confirm the extracted binary genuinely resolves\n    // inside extractDir (catches a symlink swap or similar), even though\n    // we only ever read one specific expected relative path, never an\n    // archive-listed one (so \"zip slip\" via arbitrary archive paths isn't\n    // reachable here in the first place).\n    const { PathValidator } = await import('@claude-flow/security');\n    const validator = new PathValidator({ allowedPrefixes: [extractDir] });\n    const validation = await validator.validate(extractedBinaryPath);\n    if (!validation.isValid) {\n      throw new ExtractionError(`extracted binary path failed validation: ${validation.errors.join('; ') || 'unknown'}`);\n    }\n\n    const finalPath = proxyBinaryPath();\n    fs.mkdirSync(path.dirname(finalPath), { recursive: true, mode: 0o700 });\n    const tmp = `${finalPath}.tmp`;\n    fs.copyFileSync(extractedBinaryPath, tmp);\n    fs.chmodSync(tmp, 0o755);\n    fs.renameSync(tmp, finalPath);\n\n    const liveSha = sha256Hex(fs.readFileSync(finalPath));\n    const manifest: InstallManifest = {\n      version: opts.version,\n      sha256: liveSha,\n      verifiedAt: new Date().toISOString(),\n      pubkeyFingerprint: sha256Hex(Buffer.from(PROXY_RELEASE_PUBKEY_PEM)).slice(0, 16),\n    };\n    fs.mkdirSync(path.dirname(proxyInstallManifestPath()), { recursive: true });\n    fs.writeFileSync(proxyInstallManifestPath(), JSON.stringify(manifest, null, 2), { mode: 0o600 });","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/ruvnet/ruflo/blob/6b01dc5a687b26b3e218f796de45ec51f8fa9e8c/v3/@claude-flow/cli/src/proxy/install.ts#L147-L183","documentation":"Error \"extracted binary path failed validation: ${validation.errors.join('; ') || 'unknown'}\" thrown in ruvnet/ruflo.","triggerScenarios":"Thrown at v3/@claude-flow/cli/src/proxy/install.ts:165 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6b01dc5a687b26b3e218f796de45ec51f8fa9e8c","analyzedAt":"2026-08-12T13:20:50.148Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}