[Doomguy-BFG9000]

Description

Restore percent-encoded filenames when extracting MSIX packages through either ZIP extractor, including downloads renamed to dl.zip. Detect MSIX packages by their footprint files and rename only entries belonging to the extracted archive, after applying extract_dir.

Decode each path component once, with children before parents. Preserve literal names in ordinary ZIP archives, reject unsafe decoded components and conflicting archive entries before extraction, and refuse to overwrite an existing decoded destination.

Motivation and Context

Closes #6757

MSIX payloads can contain paths such as node_modules/%40oai/sky/package.json, while applications expect node_modules/@oai/sky/package.json. The manifest workaround in ScoopInstaller/Extras#18828 does not address the underlying extraction behavior in Scoop core.

How Has This Been Tested?

• Pester 6.2.0: 32 focused tests pass on PowerShell 7.5.4 and another 32 on Windows PowerShell 5.1.26100.9711. Both the PowerShell ZIP extractor and actual 7-Zip execution are covered, including the normal Invoke-Extraction dispatcher.
• Cases include nested scoped packages, UTF-8 names, literal percent signs, plus signs, adjacent encoded names, extract_dir, ordinary ZIP files, unrelated destination files, collisions, traversal, encoded separators, alternate data streams, and null characters.
• The initial regression suite on unmodified develop passed 2 tests and failed 24; the missing scoped-package paths reproduced with both extractors.
• Three existing ZIP fixture/extraction checks pass on each PowerShell version. All 44 repository syntax, file-style, dependency-analysis, and analysis-fixture checks pass on PowerShell 7. git diff --check passes.

Tests use isolated temporary Scoop/config/cache directories. The full installation/decompression suite and installation of the affected application were not run.

Checklist:

• I have read the Contributing Guide.
• I have ensured that I am targeting the develop branch.
• I have updated the documentation accordingly.
• I have updated the tests accordingly.
• I have added an entry in the CHANGELOG.

Confidence Score: 5/5

The changes appear safe to merge, with all previous findings addressed.

Summary

Restores percent-encoded MSIX paths through both ZIP extractors while leaving ordinary ZIP names unchanged.

• ZIP extraction restores encoded filenames in MSIX packages.

All three previous findings are addressed. No new actionable issue was found in the changes since the previous review.

_{Reviews (3) · Last reviewed commit: "fix(decompress): preserve skipped MSIX p..." · Reviewed by Greptile}