FML. That is fixed on 2.32. Basically it doesn't do pct-decoding as it should:

commit 196c21c5a0e2f9b3149689ea36789cf0478d893a
Author: Farid Zakaria <farid.m.zakaria@gmail.com>
Date:   Wed Jul 16 21:09:59 2025 -0700

    Add helpful messages when file:// used as tarball
    
    When `file://` is used accidentally in a flake as the source it is
    expected to be a tarball by default.
    
    Add some friendlier error messages to either inform the user this is not
    in fact a tarball or if it's a git directory, let them know they can use
    `git+file`.
    
    fixes #12935

diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index b0822cc33..59316eabd 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -111,6 +111,25 @@ static DownloadTarballResult downloadTarball_(
     const Headers & headers,
     const std::string & displayPrefix)
 {
+
+    // Some friendly error messages for common mistakes.
+    // Namely lets catch when the url is a local file path, but
+    // it is not in fact a tarball.
+    if (url.rfind("file://", 0) == 0) {
+        // Remove "file://" prefix to get the local file path
+        std::string localPath = url.substr(7);
+        if (!std::filesystem::exists(localPath)) {
+            throw Error("tarball '%s' does not exist.", localPath);
+        }
+        if (std::filesystem::is_directory(localPath)) {
+            if (std::filesystem::exists(localPath + "/.git")) {
+                throw Error(
+                    "tarball '%s' is a git repository, not a tarball. Please use `git+file` as the scheme.", localPath);
+            }
+            throw Error("tarball '%s' is a directory, not a file.", localPath);
+        }
+    }
+
     Cache::Key cacheKey{"tarball", {{"url", url}}};
 
     auto cached = settings.getCache()->lookupExpired(cacheKey);

Specifically this:

std::string localPath = url.substr(7);
+        if (!std::filesystem::exists(localPath)) {
+            throw Error("tarball '%s' does not exist.", localPath);
+        }