fix(cli): reject unsafe plugin archive links

plugins/cli/src/agentteams_cli/plugin_manager.py

@@ -67,6 +67,8 @@ def _safe_extract_tar(package: Path, target: Path) -> None:
                     raise ValueError(f"unsafe tar member: {member.name}")
                 if member.name.startswith("/") or ".." in Path(member.name).parts:
                     raise ValueError(f"unsafe tar member: {member.name}")
+                if not (member.isfile() or member.isdir()):
+                    raise ValueError(f"unsafe tar member type: {member.name}")
             archive.extractall(target)
     except tarfile.TarError as exc:
         raise ValueError(f"invalid tar package: {exc}") from exc

plugins/tests/cli/test_agentteams_plugin_cli.py

@@ -3,6 +3,7 @@
 
 from __future__ import annotations
 
+import io
 import json
 import os
 import subprocess
@@ -197,6 +198,30 @@ def test_cli_reports_invalid_package_without_traceback(self) -> None:
         self.assertIn("ERROR:", result.stdout + result.stderr)
         self.assertNotIn("Traceback", result.stdout + result.stderr)
 
+    def test_cli_rejects_tar_symlink_escape(self) -> None:
+        package = self.project / "symlink-escape.tar.gz"
+        outside = self.project / "outside"
+        outside.mkdir()
+        payload = b"escaped\n"
+
+        with tarfile.open(package, "w:gz") as archive:
+            link = tarfile.TarInfo("teamharness/escape")
+            link.type = tarfile.SYMTYPE
+            link.linkname = str(outside)
+            archive.addfile(link)
+
+            member = tarfile.TarInfo("teamharness/escape/pwned.txt")
+            member.size = len(payload)
+            archive.addfile(member, io.BytesIO(payload))
+
+        result = self.run_agentteams(
+            "plugin", "install", "teamharness", "--package", str(package)
+        )
+
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("unsafe tar member", result.stdout + result.stderr)
+        self.assertFalse((outside / "pwned.txt").exists())
+
 
 if __name__ == "__main__":
     unittest.main(verbosity=2)