CLI bin silently no-ops under pnpm's default symlinked layout

[altaywtf]

The published vref bin can exit 0 having done nothing, depending on how pnpm generated the shim.

src/cli.ts guards its entry point with:

if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href) {
  main(process.argv.slice(2), process.cwd());
}

Node canonicalises import.meta.url through symlinks but leaves process.argv[1] as given. pnpm
places the real package under node_modules/.pnpm/… and symlinks node_modules/@putdotio/vref to
it, so whether the guard holds depends on which path the generated shim uses:

• …/.bin/../.pnpm/@putdotio+vref@1.1.0/node_modules/@putdotio/vref/dist/cli.mjs — real path, guard passes, CLI runs
• …/.bin/../@putdotio/vref/dist/cli.mjs — symlink, guard fails, CLI exits 0 with no output and no work done

Both shims occur in practice. putio-roku got the first and works; a fresh pnpm add -D @putdotio/vref in putio-ios got the second, where vref describe, vref build, and
vref validate all silently do nothing. Same pnpm 11.2.2, same Node 24.18.0, same package
checksum — only the shim differs.

Silent success is the bad part: a CI step running vref build --check would pass while validating
nothing.

Suggested fix — canonicalise both sides before comparing:

import { realpathSync } from "node:fs";

const entry = process.argv[1];
if (entry !== undefined && import.meta.url === pathToFileURL(realpathSync(entry)).href) {
  main(process.argv.slice(2), process.cwd());
}

Worth a regression test that invokes the built dist/cli.mjs through a symlink and asserts it
produces output.

Workaround for consumers: call the library API (buildGallery, validateGallery) from a thin
script, as putio-roku does in scripts/vref.ts. putdotio/putio-ios#48 will do the same.

[putio-releaser]

🎉 This issue has been resolved in version 1.1.1 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀