[e-nord]

Fixes #1767

Extracting the Node tarball now passes -snld6 to 7-Zip, so the relative bin/ → ../lib/ links (npm, npx, corepack) are no longer rejected as "Dangerous link path". This fixes new Node installs on Linux, which AI-Toolkit needs, and likely on macOS.

Extract7Z / Extract7ZTar take an optional symlinkSecurityLevel (0–20). Only the Node install uses it; every other extraction keeps 7-Zip's default checks. In testing, the default and levels 0–5 rejected the links, and 6 was the lowest level that accepted them. The previously bundled 7Zip 23.01 extracted them without the switch.

The ExtractAsync changes in ArchiveHelper.cs are CSharpier formatting from the pre-commit hook.

[SRStwo]

"Unsafe archives" sounds concerning. Is it a significant risk to bypass 7zip's safety check?

[e-nord]

To be clear, the proposed patch only relaxes the 7zip symlink security posture to the highest but still functionally acceptable level to let the relative symlinks pass and it only applies to the NodeJS zip extraction as part of the pre-install dependencies that AI Toolkit's UI requires (https://github.com/ostris/ai-toolkit#running-the-ui).

This approach keeps using 7zip as opposed to falling back to a tar command that fragments the extraction logic across OSes and distros and tar tends to be a bit more permissive with symlinks and in others security aspects if we're comparing against the bar 7zip is already setting.

This is just a pinned NodeJS version we're talking about so there's a level of implicit trust with that dependency and it's not just downloading upstream packages freely. One improvement could also be to pull down the SHA256 checksum to assert the download integrity from the nodejs.org source.

[SRStwo]

Okay. Thank you for the clarification.

I'm was wary about AI-Toolkit because it has always given me errors no matter what I have tried ever since I started using Stability Matrix. It made me think that it's buggy.