From a4f436c1167df594039deb3736c7a9e5b1e399aa Mon Sep 17 00:00:00 2001
From: YeonGyu-Kim <code.yeon.gyu@gmail.com>
Date: Fri, 3 Apr 2026 17:25:48 +0900
Subject: [PATCH] fix(tar): classify traversal tar listing errors as blocked
 entries

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
---
 src/shared/binary-downloader.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/shared/binary-downloader.ts b/src/shared/binary-downloader.ts
index 9b0ce7f04..d47d79062 100644
--- a/src/shared/binary-downloader.ts
+++ b/src/shared/binary-downloader.ts
@@ -116,6 +116,10 @@ async function listTarEntries(archivePath: string, cwd?: string): Promise<Archiv
   }
 
   if (exitCode !== 0) {
+    if (/Member name contains '\.\.'/i.test(stderr) || /Removing leading [`']\.\.\//i.test(stderr)) {
+      throw new Error(`tar archive contains path traversal entries: ${stderr}`)
+    }
+
     throw new Error(`tar entry listing failed (exit ${exitCode}): ${stderr}`)
   }