Fails:

$ nix --extra-experimental-features nix-command --extra-experimental-features flakes flake lock --override-input lix git+https://git.lix.systems/lix-project/lix?rev=20f84eb6bfa874a1c4f45b38b949335f580ea0d7
error:
       … while updating the lock file of flake 'path:/Users/weethet/Projects/Trash?lastModified=1755765056&narHash=sha256-gTvZ/vT/V3E8DVb2V%2BH03/0mNxHr7V0RG2FTU1V9B7U%3D'

       … while updating the flake input 'lix'

       … while fetching the input 'git+https://git.lix.systems/lix-project/lix?rev=20f84eb6bfa874a1c4f45b38b949335f580ea0d7'

       error: failed to extract archive (Cannot extract through symlink /tmp/nix-7s5dsxncvd8wyr6wd9wpkv5f4y/.clang-format)

Succeeds:

$ TMPDIR=/private/tmp nix --extra-experimental-features nix-command --extra-experimental-features flakes flake lock --override-input lix git+https://git.lix.systems/lix-project/lix?rev=20f84eb6bfa874a1c4f45b38b949335f580ea0d7

Probably this would be the fix:

Path defaultTempDir()
{
    auto dir = settings.tempDir.get().or_else([] {
        return getEnvNonEmpty("TMPDIR").and_then([](auto val) -> std::optional<Path> {
#if __APPLE__
            /* On macOS, don't use the per-session TMPDIR (as set e.g. by
               sshd). This breaks build users because they don't have access
               to the TMPDIR, in particular in ‘nix-store --serve’. */
            if (val.starts_with("/var/folders/")) {
                return std::nullopt;
            }
#endif
            return val;
        });
    }).value_or("/tmp");
    
    return canonPath(dir, true);
}