feat(cli): forward vsce's --follow-symlinks, and document the pnpm story

[netomi]

Closes #368.

Context

#368 (from 2021) asked how ovsx publish should handle pnpm. The answer it was waiting on has since arrived from upstream: microsoft/vscode-vsce#421 "Support pnpm" was closed as out of scope in December 2023 — "we've decided to limit the amount of supported package managers to npm and yarn v1 only." The condition set in the original discussion ("if vsce adds a dedicated flag for pnpm, we should adapt ovsx as well") therefore resolves in the negative, and @vscode/vsce@3.7.1 — what we depend on today — contains no occurrence of pnpm anywhere in its compiled output.

That leaves two things worth doing on our side.

--follow-symlinks

vsce collects the files to pack by walking production dependencies, and collectFiles treats a symlinked directory as a file unless followSymlinks says otherwise. A node_modules assembled out of symlinks — pnpm's — therefore packs the links rather than what they point at. vsce exposes --follow-symlinks on ls, package and publish; ovsx never passed it, so there was no way to ask for it from here.

Now forwarded, with the same "ignored for a prepackaged extension" warning --yarn already carries.

Unset stays unset. vsce's collectFiles defaults the parameter to false, and a JS default applies to an explicit undefined, so an invocation that doesn't pass the flag packs exactly what it packed before. This is strictly additive.

Documentation

The substance of #368 was really "what is a pnpm user supposed to do?" — and the answer existed but was written down nowhere. The CLI README's 121 lines mentioned neither --yarn, --no-dependencies nor pnpm. It now has a short Package managers subsection saying:

• vsce supports npm and yarn v1 only, and won't be adding more (linked to the upstream decision);
• --no-dependencies skips the dependency walk entirely — the right answer for a bundled extension built with esbuild/webpack, which is most of them now, whatever installed the sources. It maps to vsce's getDependenciesOption → 'none', and is what upstream recommends;
• --follow-symlinks for the case where the walk really is wanted against a symlinked node_modules.

Testing

publish.spec.ts gains a test that mocks createVSIX and asserts the packaging options arrive intact (cwd, useYarn, followSymlinks, dependencies). I checked it actually bites: reverting the one-line pass-through in publish.ts makes it fail.

Full CLI suite green (100 tests, 10 files), tsc --noEmit and yarn lint clean.

Not done

The --yarn flag keeps its name. #368 floated renaming it to something generic, but it maps 1:1 onto vsce's useYarn, which selects yarn list --json over npm list --production --parseable; a generic name would describe less accurately what it does, not more.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

The change is small and additive, includes a targeted unit test for the new forwarding behavior, and documentation updates align with the described upstream constraints.

Pull request overview

This PR enhances the ovsx CLI publish workflow by exposing and forwarding vsce’s --follow-symlinks packaging behavior (important for symlink-heavy node_modules layouts like pnpm’s), and documents recommended approaches for non-npm/yarn setups.

Changes:

• Add --follow-symlinks to ovsx publish and forward it into @vscode/vsce packaging options.
• Extend CLI docs with a “Package managers” section explaining npm/yarn-only support upstream and recommending --no-dependencies / --follow-symlinks as appropriate.
• Add a unit test asserting ovsx forwards packaging options (cwd, useYarn, followSymlinks, dependencies) to createVSIX.

File summaries

File	Description
cli/test/unit/publish.spec.ts	Adds a unit test that mocks createVSIX and verifies packaging options are forwarded intact.
cli/src/publish.ts	Passes followSymlinks through to createVSIX package options.
cli/src/publish-options.ts	Adds followSymlinks?: boolean to publish option types with documentation.
cli/src/main.ts	Exposes --follow-symlinks flag in the CLI, forwards it to publish, and warns when ignored for prepackaged VSIX.
cli/README.md	Documents the package-manager story and recommended flags (--no-dependencies, --follow-symlinks).
cli/CHANGELOG.md	Notes the addition of --follow-symlinks in the CLI changelog.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.