Kubernetes syncOut refusing tarball with an unparseable entr

Error message

Kubernetes syncOut refusing tarball with an unparseable entry listing: ${line}

What it means

Error "Kubernetes syncOut refusing tarball with an unparseable entry listing: ${line}" thrown in paperclipai/paperclip.

Source

Thrown at packages/plugins/sandbox-providers/kubernetes/src/file-sync.ts:381

/**
 * Reject a sandbox-authored tarball before extraction if any member would land
 * outside the extraction dir. The archive is produced by the (untrusted) sandbox,
 * so host-side `tar -xf` must never be handed an archive whose entries carry
 * absolute paths or `../` traversal, nor a symlink/hardlink member whose target
 * escapes the tree. Legitimate in-tree relative links are preserved. Parses the
 * `-tvf` verbose listing; any unparseable line fails closed.
 */
async function assertTarballEntriesConfined(archivePath: string): Promise<void> {
  const { stdout } = await execFileAsync("tar", ["-tvf", archivePath], {
    env: { ...process.env, COPYFILE_DISABLE: "1" },
    maxBuffer: 64 * 1024 * 1024,
  });
  const lines = stdout.split("\n").filter((line) => line.trim().length > 0);
  for (const line of lines) {
    const parsed = parseTarVerboseListingLine(line);
    if (!parsed) {
      throw new Error(`Kubernetes syncOut refusing tarball with an unparseable entry listing: ${line}`);
    }
    const typeFlag = parsed.typeFlag;
    let name = parsed.rest;
    let linkTarget: string | null = null;
    if (typeFlag === "l") {
      const split = splitLinkEntryOnce(name, " -> ");
      if (!split) throw new Error(`Kubernetes syncOut refusing unparseable or ambiguous symlink entry: ${line}`);
      name = split.name;
      linkTarget = split.target;
    } else if (typeFlag === "h") {
      const split = splitLinkEntryOnce(name, " link to ");
      if (!split) throw new Error(`Kubernetes syncOut refusing unparseable or ambiguous hardlink entry: ${line}`);
      name = split.name;
      linkTarget = split.target;
    }
    const cleanName = name.replace(/\/+$/, "");
    if (cleanName.length > 0 && posixPathEscapes(cleanName)) {
      throw new Error(`Kubernetes syncOut refusing tarball member that escapes the extraction dir: ${name}`);

View on GitHub (pinned to 120ae5428f)

Solutions

Re-create the tarball with a standard tar so entry listings parse; inspect the reported line.

When it happens

Trigger: Thrown at packages/plugins/sandbox-providers/kubernetes/src/file-sync.ts:381 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of paperclipai/paperclip@120ae5428f (2026-08-18). Data as JSON: /api/errors/326cbf1a9994fef5. Report an issue: GitHub.