{"record":{"id":"326cbf1a9994fef5","repo":"paperclipai/paperclip","slug":"kubernetes-syncout-refusing-tarball-with-an-unpars","errorCode":null,"errorMessage":"Kubernetes syncOut refusing tarball with an unparseable entry listing: ${line}","messagePattern":"Kubernetes syncOut refusing tarball with an unparseable entry listing: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/plugins/sandbox-providers/kubernetes/src/file-sync.ts","lineNumber":381,"sourceCode":"\n/**\n * Reject a sandbox-authored tarball before extraction if any member would land\n * outside the extraction dir. The archive is produced by the (untrusted) sandbox,\n * so host-side `tar -xf` must never be handed an archive whose entries carry\n * absolute paths or `../` traversal, nor a symlink/hardlink member whose target\n * escapes the tree. Legitimate in-tree relative links are preserved. Parses the\n * `-tvf` verbose listing; any unparseable line fails closed.\n */\nasync function assertTarballEntriesConfined(archivePath: string): Promise<void> {\n  const { stdout } = await execFileAsync(\"tar\", [\"-tvf\", archivePath], {\n    env: { ...process.env, COPYFILE_DISABLE: \"1\" },\n    maxBuffer: 64 * 1024 * 1024,\n  });\n  const lines = stdout.split(\"\\n\").filter((line) => line.trim().length > 0);\n  for (const line of lines) {\n    const parsed = parseTarVerboseListingLine(line);\n    if (!parsed) {\n      throw new Error(`Kubernetes syncOut refusing tarball with an unparseable entry listing: ${line}`);\n    }\n    const typeFlag = parsed.typeFlag;\n    let name = parsed.rest;\n    let linkTarget: string | null = null;\n    if (typeFlag === \"l\") {\n      const split = splitLinkEntryOnce(name, \" -> \");\n      if (!split) throw new Error(`Kubernetes syncOut refusing unparseable or ambiguous symlink entry: ${line}`);\n      name = split.name;\n      linkTarget = split.target;\n    } else if (typeFlag === \"h\") {\n      const split = splitLinkEntryOnce(name, \" link to \");\n      if (!split) throw new Error(`Kubernetes syncOut refusing unparseable or ambiguous hardlink entry: ${line}`);\n      name = split.name;\n      linkTarget = split.target;\n    }\n    const cleanName = name.replace(/\\/+$/, \"\");\n    if (cleanName.length > 0 && posixPathEscapes(cleanName)) {\n      throw new Error(`Kubernetes syncOut refusing tarball member that escapes the extraction dir: ${name}`);","sourceCodeStart":363,"sourceCodeEnd":399,"githubUrl":"https://github.com/paperclipai/paperclip/blob/120ae5428fa29bee300bcf806491cd4d965fbb7c/packages/plugins/sandbox-providers/kubernetes/src/file-sync.ts#L363-L399","documentation":"Error \"Kubernetes syncOut refusing tarball with an unparseable entry listing: ${line}\" thrown in paperclipai/paperclip.","triggerScenarios":"Thrown at packages/plugins/sandbox-providers/kubernetes/src/file-sync.ts:381 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-create the tarball with a standard tar so entry listings parse; inspect the reported line."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"120ae5428fa29bee300bcf806491cd4d965fbb7c","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}