chore: address adversarial review findings for monorepo pre-shape

Follow-ups from the PR #1254 review (no behavior change to shipped CLI):

- check-patches.ts: harden resolvePackageFile() to derive the package
  root from the FIRST `<pkgName>/` after the last `node_modules/`
  boundary, instead of `lastIndexOf('/<pkgName>/')`. A package that
  vendors a nested copy of itself would otherwise truncate at the wrong
  inner segment. Also refresh the stale `node-linker=hoisted` comment.
- biome.jsonc / packages/cli/.gitignore: reconcile the contradictory
  comments about which .gitignore Biome reads. Biome honors the
  workspace-root .gitignore via `vcs.root: "../.."`; the package-level
  .gitignore is for plain git only. Drop the dead `!docs` ignore
  (no packages/cli/docs after the move).
- build.ts / bundle.ts: fix comments that still claimed deps are
  "hoisted to the workspace-root node_modules" — under node-linker=isolated
  they live in the isolated store; the code (module resolution / `pnpm
  exec`) is unchanged and correct.
- packages/cli/AGENTS.md: replace stale Bun-era guidance with the current
  pnpm/Node/Vitest reality — command reference, "Use Node.js APIs"
  section, test-runner isolation notes (VITEST_POOL_ID), vitest imports
  and `vi.mock`, moved docs path (apps/cli-docs), and removed the dangling
  `.cursor/rules/bun-cli.mdc` reference.

Verified: typecheck, lint, all check:* scripts, build (+ binary smoke).

Author: BYK

.lore.md

@@ -435,6 +435,9 @@
 <!-- lore:019f6507-7efb-70c8-b243-5f87f6234fbc -->
 * **Always follow a standard workflow for PR creation and merging**: The user consistently enforces a standard workflow for creating and merging Pull Requests (PRs). This workflow includes creating a branch with a specific naming convention (e.g., \`fix/\<scope>-\<issue>\`), committing changes with a \`.lore.md\` file, creating a PR, and waiting for CI checks and bot reviews to complete before merging. The user also emphasizes the importance of proper issue tracking, cross-linking tasks, and regenerating patches when necessary.
 
+<!-- lore:019f668c-39f6-72c9-b8b7-43a1f61ecb8d -->
+* **Always inject debug IDs and sourcemaps for local builds**: The user consistently requires debug IDs to be injected into JavaScript bundles during local builds, even when no authentication token is present. This ensures local development always has debug information available. The user also mandates that sourcemaps are never shipped to end users in server-side deployments, maintaining security while preserving debuggability during development.
+
 <!-- lore:019f6660-35d8-77f5-a523-b722e9b32c98 -->
 * **Always investigate build configurations and dependencies when researching Node version compatibility**: The user consistently researches build configurations (esbuild, bundle scripts) and dependency management when evaluating Node version compatibility. They specifically examine how external dependencies like SQLite modules are handled, including import patterns, externalization in bundlers, and fallback mechanisms. The user wants to understand the complete dependency chain and build pipeline implications when supporting different Node versions.
 
@@ -445,7 +448,7 @@
 * **Always migrate Bun-specific APIs and tooling to Node.js equivalents**: 🔴 Directive (repeated 25+ sessions): ALWAYS prefer editing existing files in the codebase. NEVER write new files unless explicitly required. NEVER proactively create documentation files (\*.md) or README files — only create documentation files if explicitly requested by the user.
 
 <!-- lore:019f6648-b59d-70e9-b626-40db33aae377 -->
-* **Always Monitor CI Status**: The user consistently checks and monitors the status of CI (Continuous Integration) runs for their pull requests. This includes tracking the progress of various checks, such as linting, testing, and code analysis, across multiple repositories like \`getsentry/cli\` and \`getsentry/symbolic\`. The user seems to be interested in ensuring that all checks pass before proceeding with the merge or further actions.
+* **Always Monitor CI Status**: The user consistently checks and verifies the status of CI checks, including Validate generated files, CodeQL, and other workflows. They also investigate and address failures, often by identifying root causes and applying fixes. Additionally, the user monitors and confirms the resolution of transient issues and ensures that all required checks pass before proceeding with the PR.
 
 <!-- lore:019f666a-ac76-7581-82f8-8d2af3f3e428 -->
 * **Always perform rigorous, read-only code reviews with specific focus areas**: The user consistently conducts critical, adversarial code reviews in a read-only manner, focusing on specific technical areas. They provide detailed context about the repository, branch, and changes under review, and specify exact focus areas like path correctness, dependency management, build configurations, and security implications. The user maintains strict read-only discipline, prohibiting any modifications to source files, and often works within isolated worktrees. They expect thorough verification of technical changes against documented requirements and prior decisions.

AGENTS.md

@@ -0,0 +1,5 @@
+<!-- This section is maintained by the coding agent via lore (https://github.com/BYK/loreai) -->
+## Long-term Knowledge
+
+For long-term knowledge entries managed by [lore](https://github.com/BYK/loreai) (gotchas, patterns, decisions, architecture), see [`.lore.md`](.lore.md) in the project root.
+<!-- End lore-managed section -->

packages/cli/.gitignore

@@ -1,5 +1,7 @@
-# Package-level ignores (see the workspace-root .gitignore for shared rules).
-# Duplicated here because Biome resolves useIgnoreFile relative to biome.jsonc.
+# Package-level ignores for git. The workspace-root .gitignore mirrors these
+# with `packages/cli/`-prefixed patterns (that root file is what Biome reads,
+# since biome.jsonc sets `vcs.root: "../.."`). This file exists so plain `git`
+# ignores build artifacts within the package regardless of the root file.
 
 # dependencies
 node_modules

packages/cli/AGENTS.md

@@ -4,15 +4,15 @@ Guidelines for AI agents working in this codebase.
 
 ## Project Overview
 
-**Sentry CLI** is a command-line interface for [Sentry](https://sentry.io), built with [Bun](https://bun.sh) and [Stricli](https://bloomberg.github.io/stricli/).
+**Sentry CLI** is a command-line interface for [Sentry](https://sentry.io), built with Node.js, [pnpm](https://pnpm.io), and [Stricli](https://bloomberg.github.io/stricli/). It lives in `packages/cli` of a pnpm workspace; the docs site lives in `apps/cli-docs`.
 
 ### Goals
 
 - **Zero-config experience** - Auto-detect project context from DSNs in source code and env files
 - **AI-powered debugging** - Integrate Seer AI for root cause analysis and fix plans
 - **Developer-friendly** - Follow `gh` CLI conventions for intuitive UX
 - **Agent-friendly** - JSON output and predictable behavior for AI coding agents
-- **Fast** - Native binaries via Bun, SQLite caching for API responses
+- **Fast** - Native binaries via Node SEA (fossilize), SQLite caching for API responses
 
 ### Key Features
 
@@ -28,86 +28,83 @@ Guidelines for AI agents working in this codebase.
 
 Before working on this codebase, read the Cursor rules:
 
-- **`.cursor/rules/bun-cli.mdc`** - Bun API usage, file I/O, process spawning, testing
 - **`.cursor/rules/ultracite.mdc`** - Code style, formatting, linting rules
 
 ## Quick Reference: Commands
 
-> **Note**: Always check `package.json` for the latest scripts.
+> **Note**: Always check `package.json` for the latest scripts. All commands run
+> from `packages/cli` (or via `pnpm --filter sentry run <script>` from the repo root).
 
 ```bash
 # Development
-bun install                              # Install dependencies
-bun run dev                              # Run CLI in dev mode
-bun run --env-file=.env.local src/bin.ts # Dev with env vars
+pnpm install                             # Install dependencies (from repo root)
+pnpm run dev                             # Run CLI in dev mode
+pnpm run cli -- <args>                   # Run the CLI with arguments
 
 # Build
-bun run build                            # Build for current platform
-bun run build:all                        # Build for all platforms
+pnpm run build                           # Build for current platform
+pnpm run build:all                       # Build for all platforms
 
 # Type Checking
-bun run typecheck                        # Check types
+pnpm run typecheck                       # Check types (tsc)
 
 # Linting & Formatting
-bun run lint                             # Check for issues
-bun run lint:fix                         # Auto-fix issues (run before committing)
-
-# Testing
-bun test                                 # Run all tests
-bun test path/to/file.test.ts            # Run single test file
-bun test --watch                         # Watch mode
-bun test --filter "test name"            # Run tests matching pattern
-bun run test:unit                        # Run unit tests only
-bun run test:e2e                         # Run e2e tests only
+pnpm run lint                            # Check for issues (Biome)
+pnpm run lint:fix                        # Auto-fix issues (run before committing)
+
+# Testing (Vitest)
+pnpm run test:unit                       # Run unit tests
+pnpm run test:e2e                        # Run e2e tests
+pnpm exec vitest run test/lib/foo.test.ts # Run a single test file (skips generate steps)
+pnpm exec vitest                         # Watch mode
 ```
 
 ## Rules: No Runtime Dependencies
 
-**CRITICAL**: All packages must be in `devDependencies`, never `dependencies`. Everything is bundled at build time via esbuild. CI enforces this with `bun run check:deps`.
+**CRITICAL**: All packages must be in `devDependencies`, never `dependencies`. Everything is bundled at build time via esbuild. CI enforces this with `pnpm run check:deps`.
 
-When adding a package, always use `bun add -d <package>` (the `-d` flag).
+When adding a package, always use `pnpm add -D <package>` (the `-D` flag).
 
 When the `@sentry/api` SDK provides types for an API response, import them directly from `@sentry/api` instead of creating redundant Zod schemas in `src/types/sentry.ts`.
 
-## Rules: Use Bun APIs
+## Rules: Use Node.js APIs
 
-**CRITICAL**: This project uses Bun as runtime. Always prefer Bun-native APIs over Node.js equivalents.
+**CRITICAL**: This project runs on Node.js. Use Node.js standard-library
+(`node:*`) APIs; there is no Bun runtime. (This project was migrated from Bun to
+Node — do not reintroduce `Bun.*` globals, `bun:test`, or `bun` CLI commands.)
 
-Read the full guidelines in `.cursor/rules/bun-cli.mdc`.
+### Quick API Reference
 
-**Bun Documentation**: https://bun.sh/docs - Consult these docs when unsure about Bun APIs.
+| Task | Use This |
+|------|----------|
+| Read file | `await readFile(path, "utf-8")` (`node:fs/promises`) |
+| Write file | `await writeFile(path, content)` (`node:fs/promises`) |
+| Check file exists | `existsSync(path)` (`node:fs`) |
+| Spawn process | `spawn()` / `execFile()` (`node:child_process`) |
+| Shell commands | `execSync()` (`node:child_process`) |
+| Find executable | `which` helper in `src/lib/which.ts` |
+| Glob patterns | the scanner in `src/lib/scan/` |
+| Sleep | `await setTimeout(ms)` (`node:timers/promises`) |
+| Parse JSON file | `JSON.parse(await readFile(path, "utf-8"))` |
 
-### Quick Bun API Reference
-
-| Task | Use This | NOT This |
-|------|----------|----------|
-| Read file | `await Bun.file(path).text()` | `fs.readFileSync()` |
-| Write file | `await Bun.write(path, content)` | `fs.writeFileSync()` |
-| Check file exists | `await Bun.file(path).exists()` | `fs.existsSync()` |
-| Spawn process | `Bun.spawn()` | `child_process.spawn()` |
-| Shell commands | `Bun.$\`command\`` ⚠️ | `child_process.exec()` |
-| Find executable | `Bun.which("git")` | `which` package |
-| Glob patterns | `new Bun.Glob()` | `glob` / `fast-glob` packages |
-| Sleep | `await Bun.sleep(ms)` | `setTimeout` with Promise |
-| Parse JSON file | `await Bun.file(path).json()` | Read + JSON.parse |
-
-**Exception**: Use `node:fs` for directory creation with permissions:
+Use `node:fs` for directory creation with permissions:
 ```typescript
 import { mkdirSync } from "node:fs";
 mkdirSync(dir, { recursive: true, mode: 0o700 });
 ```
 
-**Exception**: `Bun.$` (shell tagged template) has no shim in `script/node-polyfills.ts` and will crash on the npm/node distribution. Until a shim is added, use `execSync` from `node:child_process` for shell commands that must work in both runtimes:
+For shell commands, prefer `execFileSync` with array args over `execSync` with a
+string when passing user-controlled values, to avoid shell injection:
 ```typescript
-import { execSync } from "node:child_process";
-const result = execSync("id -u username", { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] });
+import { execFileSync } from "node:child_process";
+const result = execFileSync("id", ["-u", "username"], { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] });
 ```
 
 ## Architecture
 
 The full project-structure tree — including the live command/subcommand list and the
 domain API modules — is generated from the route tree and lives in
-[`docs/src/content/docs/contributing.md`](docs/src/content/docs/contributing.md)
+[`apps/cli-docs/src/content/docs/contributing.md`](apps/cli-docs/src/content/docs/contributing.md)
 (the `project-structure` block produced by `script/generate-docs-sections.ts`). It is
 kept in sync automatically, so it is **not** duplicated here to avoid drift. For the
 current command list run `ls src/commands/` or `sentry --help`.
@@ -127,8 +124,9 @@ Top-level layout:
 - **`src/types/`** — TypeScript types and Zod schemas.
 - **`test/`** — tests mirroring `src/` (unit, `*.property.test.ts`,
   `*.model-based.test.ts`, `e2e/`, `fixtures/`, `mocks/`).
-- **`docs/`** — documentation site (Astro + Starlight); **`script/`** — build/utility
-  scripts; **`.cursor/rules/`** — Cursor AI rules; **`biome.jsonc`** — lint config.
+- **`../../apps/cli-docs/`** — documentation site (Astro + Starlight);
+  **`script/`** — build/utility scripts; **`.cursor/rules/`** — Cursor AI rules;
+  **`biome.jsonc`** — lint config.
 
 ## Key Patterns
 
@@ -409,12 +407,12 @@ Use `"date"` for timestamp-based sort (not `"time"`). Export sort types from the
 
 ### Generated Docs & Skills
 
-All command docs and skill files are generated via `bun run generate:docs` (which runs `generate:command-docs` then `generate:skill`). This runs automatically as part of `dev`, `build`, `typecheck`, and `test` scripts.
+All command docs and skill files are generated via `pnpm run generate:docs` (which runs `generate:command-docs` then `generate:skill`). This runs automatically as part of `dev`, `build`, `typecheck`, and `test` scripts.
 
 - **Command docs** (`docs/src/content/docs/commands/*.md`) are **gitignored** and generated from CLI metadata + hand-written fragments in `docs/src/fragments/commands/`.
 - **Skill files** (`plugins/sentry-cli/skills/sentry-cli/`) are **committed** (consumed by external plugin systems) and auto-committed by CI when stale.
 - Edit fragments in `docs/src/fragments/commands/` for custom examples and guides.
-- `bun run check:fragments` validates fragment ↔ route consistency.
+- `pnpm run check:fragments` validates fragment ↔ route consistency.
 - Positional `placeholder` values must be descriptive: `"org/project/trace-id"` not `"args"`.
 
 ### Zod Schemas for Validation
@@ -510,7 +508,7 @@ CliError (base, exitCode=1)
 - Pass `alternatives: []` when defaults are irrelevant (e.g., for missing Trace ID, Event ID)
 - Use `" and "` in `resource` for plural grammar: `"Trace ID and span ID"` → "are required"
 
-**CI enforcement:** `bun run check:errors` scans for `ContextError` with multiline commands, `CliError` with ad-hoc "Try:" strings, and silent `catch` blocks (advisory).
+**CI enforcement:** `pnpm run check:errors` scans for `ContextError` with multiline commands, `CliError` with ad-hoc "Try:" strings, and silent `catch` blocks (advisory).
 
 ```typescript
 // Usage examples
@@ -554,7 +552,7 @@ catch (error) {
 
 Use `logger.withTag("command-name")` for tagged logging in command files.
 
-**CI enforcement:** `bun run check:errors` includes a silent-catch scan that flags
+**CI enforcement:** `pnpm run check:errors` includes a silent-catch scan that flags
 `catch` blocks which are empty, comment-only, or return-only without surfacing the
 error. It is currently **advisory** (warns, does not fail CI) because of a pre-existing
 backlog; run with `SENTRY_STRICT_SILENT_CATCH=1` to enforce. Do not add new silent
@@ -700,7 +698,7 @@ await deleteUserData(userId)
 ### Goal
 Minimal comments, maximum clarity. Comments explain **intent and reasoning**, not syntax.
 
-## Testing (bun:test + fast-check)
+## Testing (Vitest + fast-check)
 
 **Prefer property-based and model-based testing** over traditional unit tests. These approaches find edge cases automatically and provide better coverage with less code.
 
@@ -734,7 +732,7 @@ Tests that need a database or config directory **must** use `useTestConfigDir()`
 - `const baseDir = process.env[CONFIG_DIR_ENV_VAR]!` at module scope — This captures a value that may be stale
 - Manual `beforeEach`/`afterEach` that sets/deletes `SENTRY_CONFIG_DIR`
 
-**Why**: Bun's test runner uses `--isolate --parallel` (see `test:unit` in `package.json`), so each test file runs in a fresh global environment within a worker process. That bounds most cross-file leaks to a single worker, but `process.env` is still shared within a file's lifecycle — if your `afterEach` deletes the env var, the next describe/test's module-level code (or a beforeEach that re-reads env) gets `undefined`, causing `TypeError: The "paths[0]" property must be of type string`. Also, `TEST_TMP_DIR` is namespaced by `BUN_TEST_WORKER_ID` in `test/constants.ts` so parallel workers don't wipe each other's temp state during preload.
+**Why**: Vitest runs each test file in a worker pool (see `test:unit` in `package.json`), so each file runs in its own worker process. That bounds most cross-file leaks to a single worker, but `process.env` is still shared within a file's lifecycle — if your `afterEach` deletes the env var, the next describe/test's module-level code (or a beforeEach that re-reads env) gets `undefined`, causing `TypeError: The "paths[0]" property must be of type string`. Also, `TEST_TMP_DIR` is namespaced by `VITEST_POOL_ID` in `test/constants.ts` so parallel workers don't wipe each other's temp state during preload.
 
 ```typescript
 // CORRECT: Use the helper
@@ -757,7 +755,7 @@ afterEach(() => { delete process.env.SENTRY_CONFIG_DIR; }); // BUG!
 Use property-based tests when verifying invariants that should hold for **any valid input**.
 
 ```typescript
-import { describe, expect, test } from "bun:test";
+import { describe, expect, test } from "vitest";
 import { constantFrom, assert as fcAssert, property, tuple } from "fast-check";
 import { DEFAULT_NUM_RUNS } from "../model-based/helpers.js";
 
@@ -805,7 +803,7 @@ describe("property: myFunction", () => {
 Use model-based tests for **stateful systems** where sequences of operations should maintain invariants.
 
 ```typescript
-import { describe, expect, test } from "bun:test";
+import { describe, expect, test } from "vitest";
 import {
   type AsyncCommand,
   asyncModelRun,
@@ -933,7 +931,7 @@ When adding property tests for a function that already has unit tests, **remove
 ```
 
 ```typescript
-import { describe, expect, test, mock } from "bun:test";
+import { describe, expect, test, vi } from "vitest";
 
 describe("feature", () => {
   test("should return specific value", async () => {
@@ -942,7 +940,7 @@ describe("feature", () => {
 });
 
 // Mock modules when needed
-mock.module("./some-module", () => ({
+vi.mock("./some-module", () => ({
   default: () => "mocked",
 }));
 ```

packages/cli/biome.jsonc

@@ -1,8 +1,10 @@
 {
   "$schema": "./node_modules/@biomejs/biome/configuration_schema.json",
   "extends": ["ultracite/core"],
-  // The workspace .gitignore lives at the monorepo root (two levels up from this
-  // package). Point Biome's VCS integration there so `useIgnoreFile` resolves it.
+  // The .gitignore Biome honors lives at the monorepo root (two levels up).
+  // Point Biome's VCS integration there so `useIgnoreFile` reads the root file,
+  // whose patterns are `packages/cli/`-prefixed. (The package-level .gitignore
+  // is for plain git only; Biome does not read it.)
   "vcs": {
     "enabled": true,
     "clientKind": "git",
@@ -23,7 +25,6 @@
     // on the node:tls module graph — an internal Biome bug that surfaces
     // non-deterministically as error vs warning. See biome issue tracker.
     "includes": [
-      "!docs",
       "!test/init-eval/templates",
       "!dist-build",
       // The codemod package is a self-contained Codemod (jssg) project with