refactor: replace Bun APIs with Node.js equivalents (#984)

## Summary

Third step of the Bun → Node.js migration (follows #967, #970). Replaces
all Bun-specific API calls in `src/` with Node.js equivalents.

### Changes

**File I/O** (18 files):
- `Bun.file(path).text()` → `readFile(path, "utf-8")` from
`node:fs/promises`
- `Bun.file(path).json()` → `JSON.parse(await readFile(path, "utf-8"))`
- `Bun.file(path).exists()` → `access(path).then(() => true, () =>
false)`
- `Bun.file(path).stat()` → `stat(path)` from `node:fs/promises`
- `Bun.write(path, content)` → `writeFile(path, content)` from
`node:fs/promises`
- `Bun.write(dest, Bun.file(src))` → `copyFile(src, dest)` from
`node:fs/promises`

**Process/System** (9 files + 1 new):
- `Bun.which()` → new `src/lib/which.ts` helper using `command -v`
(POSIX) / `where` (Windows)
- `Bun.spawn()` → `spawn()` from `node:child_process` with
Promise-wrapped exit code
- `Bun.spawnSync()` → `spawnSync()` from `node:child_process`
- `Bun.sleep()` → `setTimeout()` from `node:timers/promises`

**Utilities** (6 files):
- `Bun.Glob` → `picomatch` (already a devDependency)
- `Bun.randomUUIDv7()` → `uuidv7()` from `uuidv7` package
- `Bun.semver.order()` → `compare()` from `semver` package

### What's NOT in this PR (Group D — separate follow-up)

These Bun APIs in `bspatch.ts` and `upgrade.ts` require more careful
handling:
- `Bun.file().writer()` — streaming file writer (needs
`fs.createWriteStream`)
- `Bun.zstdCompress/DecompressSync` — zstd compression (needs
`node:zlib` 22.15+)
- `Bun.mmap()` — memory-mapped files (has existing fallback)
- `Bun.CryptoHasher` — streaming hash (needs `crypto.createHash`)

### Test results

All 7012 unit tests pass, 0 failures.

Author: BYK

.lore.md

@@ -5,6 +5,7 @@
  * Similar to 'gh api' for GitHub.
  */
 
+import { access, readFile } from "node:fs/promises";
 // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
 import * as Sentry from "@sentry/node-core/light";
 import type { SentryContext } from "../context.js";
@@ -828,11 +829,14 @@ export async function buildBodyFromInput(
   if (inputPath === "-") {
     content = await readStdin(stdin);
   } else {
-    const file = Bun.file(inputPath);
-    if (!(await file.exists())) {
+    const exists = await access(inputPath).then(
+      () => true,
+      () => false
+    );
+    if (!exists) {
       throw new ValidationError(`File not found: ${inputPath}`, "input");
     }
-    content = await file.text();
+    content = await readFile(inputPath, "utf-8");
   }
 
   // Try to parse as JSON for the API client

AGENTS.md

@@ -14,8 +14,10 @@
  * so that subsequent bare `sentry cli upgrade` calls use the same channel.
  */
 
+import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname } from "node:path";
+import { setTimeout } from "node:timers/promises";
 import type { SentryContext } from "../../context.js";
 import {
   determineInstallDir,
@@ -425,12 +427,14 @@ async function spawnWithRetry(
 ): Promise<number> {
   for (let attempt = 1; attempt <= SPAWN_MAX_ATTEMPTS; attempt++) {
     try {
-      const proc = Bun.spawn([binaryPath, ...args], {
-        stdout: "inherit",
-        stderr: "inherit",
+      const proc = spawn(binaryPath, args, {
+        stdio: ["ignore", "inherit", "inherit"],
         env,
       });
-      return await proc.exited;
+      return await new Promise<number>((resolve) => {
+        proc.on("close", (code) => resolve(code ?? 1));
+        proc.on("error", () => resolve(1));
+      });
     } catch (error) {
       // Translate the opaque Bun "Executable not found" error into an
       // actionable UpgradeError. This path triggers when the binary at
@@ -454,7 +458,7 @@ async function spawnWithRetry(
       log.warn(
         `Binary is locked (antivirus scan?), retrying in ${delay}ms... (attempt ${attempt}/${SPAWN_MAX_ATTEMPTS})`
       );
-      await Bun.sleep(delay);
+      await setTimeout(delay);
     }
   }
   // Unreachable — the loop either returns or throws

src/commands/api.ts

@@ -5,6 +5,7 @@
  * and optional client-side glob filtering by title.
  */
 
+import picomatch from "picomatch";
 import type { SentryContext } from "../../context.js";
 import { MAX_PAGINATION_PAGES } from "../../lib/api/infrastructure.js";
 import {
@@ -233,7 +234,7 @@ function processPage(
     limit: number;
     serverCursor: string | undefined;
     afterId: string | undefined;
-    glob: InstanceType<typeof Bun.Glob> | undefined;
+    glob: ((input: string) => boolean) | undefined;
   }
 ): PageResult {
   // When resuming mid-page, find the afterId and skip everything up to and
@@ -249,7 +250,7 @@ function processPage(
 
   for (let i = startIdx; i < data.length; i++) {
     const item = data[i] as DashboardListItem;
-    if (!opts.glob || opts.glob.match(item.title.toLowerCase())) {
+    if (!opts.glob || opts.glob(item.title.toLowerCase())) {
       results.push(item);
       if (results.length >= opts.limit) {
         return {
@@ -283,7 +284,7 @@ async function fetchDashboards(
     perPage: number;
     serverCursor: string | undefined;
     afterId: string | undefined;
-    glob: InstanceType<typeof Bun.Glob> | undefined;
+    glob: ((input: string) => boolean) | undefined;
   }
 ): Promise<FetchResult> {
   let { serverCursor, afterId } = opts;
@@ -434,7 +435,7 @@ export const listCommand = buildListCommand("dashboard", {
     const { serverCursor, afterId } = decodeCursor(rawCursor ?? "");
 
     const glob = titleFilter
-      ? new Bun.Glob(titleFilter.toLowerCase())
+      ? picomatch(titleFilter.toLowerCase(), { dot: true })
       : undefined;
 
     // When filtering, fetch max-size pages to minimize round trips.

src/commands/cli/upgrade.ts

@@ -10,6 +10,7 @@
  */
 
 import { accessSync, constants, existsSync, mkdirSync } from "node:fs";
+import { writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { captureException } from "@sentry/node-core/light";
 import { SKILL_FILES } from "../generated/skill-content.js";
@@ -68,7 +69,7 @@ async function writeSkillFiles(
       if (!existsSync(dir)) {
         mkdirSync(dir, { recursive: true, mode: 0o755 });
       }
-      await Bun.write(fullPath, content);
+      await writeFile(fullPath, content, "utf-8");
       if (relativePath.startsWith("references/")) {
         referenceCount += 1;
       }

src/commands/dashboard/list.ts

@@ -5,15 +5,17 @@
  * Used by both `setup --install` (fresh installs) and `upgrade` (self-updates).
  */
 
+import { spawnSync } from "node:child_process";
 import {
   existsSync,
   readFileSync,
   renameSync,
   unlinkSync,
   writeFileSync,
 } from "node:fs";
-import { chmod, mkdir, unlink } from "node:fs/promises";
+import { chmod, copyFile, mkdir, unlink } from "node:fs/promises";
 import { delimiter, join, resolve } from "node:path";
+import { compare as semverCompare } from "semver";
 import { getUserAgent } from "./constants.js";
 import {
   buildTlsErrorDetail,
@@ -56,9 +58,8 @@ export function isMusl(): boolean {
 
   // Heuristic 2: ldd --version output (musl ldd writes "musl libc" to stderr)
   try {
-    const result = Bun.spawnSync(["ldd", "--version"], {
-      stdout: "pipe",
-      stderr: "pipe",
+    const result = spawnSync("ldd", ["--version"], {
+      stdio: ["ignore", "pipe", "pipe"],
     });
     const output =
       Buffer.from(result.stdout).toString() +
@@ -130,7 +131,7 @@ export function isNightlyVersion(version: string): boolean {
  * @returns 1 if a > b, -1 if a < b, 0 if equal
  */
 export function compareVersions(a: string, b: string): -1 | 0 | 1 {
-  return Bun.semver.order(a, b);
+  return semverCompare(a, b);
 }
 
 /**
@@ -451,7 +452,7 @@ export async function installBinary(
       }
 
       // Copy source binary to temp path next to install location
-      await Bun.write(tempPath, Bun.file(sourcePath));
+      await copyFile(sourcePath, tempPath);
 
       // Set executable permission (Unix only)
       if (process.platform !== "win32") {

src/lib/agent-skills.ts

@@ -2,10 +2,18 @@
  * Browser utilities
  *
  * Cross-platform utilities for interacting with the user's browser.
- * Uses Bun.spawn and Bun.which for process management.
+ * Uses child_process.spawn and whichSync for process management.
  */
 
+import { spawn } from "node:child_process";
+import { setTimeout } from "node:timers/promises";
 import { generateQRCode } from "./qrcode.js";
+import { whichSync } from "./which.js";
+
+/** No-op error handler to prevent unhandled error crashes from spawn. */
+function noop(): void {
+  // Intentionally empty — absorbs async spawn errors (e.g., ENOENT)
+}
 
 /**
  * Open a URL in the user's default browser.
@@ -20,10 +28,10 @@ export async function openBrowser(url: string): Promise<boolean> {
   let args: string[];
 
   if (platform === "darwin") {
-    command = Bun.which("open");
+    command = whichSync("open");
     args = [url];
   } else if (platform === "win32") {
-    command = Bun.which("cmd");
+    command = whichSync("cmd");
     args = ["/c", "start", "", url];
   } else {
     // Linux and other Unix-like systems - try multiple openers
@@ -35,7 +43,7 @@ export async function openBrowser(url: string): Promise<boolean> {
       "kde-open",
     ];
     for (const opener of linuxOpeners) {
-      command = Bun.which(opener);
+      command = whichSync(opener);
       if (command) {
         break;
       }
@@ -48,13 +56,15 @@ export async function openBrowser(url: string): Promise<boolean> {
   }
 
   try {
-    const proc = Bun.spawn([command, ...args], {
-      stdout: "ignore",
-      stderr: "ignore",
+    const proc = spawn(command, args, {
+      stdio: ["ignore", "ignore", "ignore"],
     });
+    // Prevent unhandled error crash if the binary disappears between
+    // whichSync() and spawn() (TOCTOU window).
+    proc.on("error", noop);
 
     // Give browser time to open, then detach
-    await Bun.sleep(500);
+    await setTimeout(500);
     proc.unref();
     return true;
   } catch {

src/lib/binary.ts

@@ -31,7 +31,7 @@
  */
 
 import { constants, copyFileSync } from "node:fs";
-import { unlink } from "node:fs/promises";
+import { readFile, unlink } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
@@ -269,7 +269,7 @@ async function loadOldBinary(oldPath: string): Promise<OldFileHandle> {
       /* May not exist if copyFileSync failed */
     });
     return {
-      data: new Uint8Array(await Bun.file(oldPath).arrayBuffer()),
+      data: new Uint8Array(await readFile(oldPath)),
       cleanup: () => {
         // Data is in JS heap — no temp file to clean up
       },

src/lib/browser.ts

@@ -5,7 +5,9 @@
  * Includes both low-level copy function and interactive keyboard-triggered copy.
  */
 
+import { spawn } from "node:child_process";
 import { logger } from "./logger.js";
+import { whichSync } from "./which.js";
 
 const log = logger.withTag("clipboard");
 
@@ -29,18 +31,18 @@ export async function copyToClipboard(text: string): Promise<boolean> {
   let args: string[] = [];
 
   if (platform === "darwin") {
-    command = Bun.which("pbcopy");
+    command = whichSync("pbcopy");
     args = [];
   } else if (platform === "win32") {
-    command = Bun.which("clip");
+    command = whichSync("clip");
     args = [];
   } else {
     // Linux - try xclip first, then xsel
-    command = Bun.which("xclip");
+    command = whichSync("xclip");
     if (command) {
       args = ["-selection", "clipboard"];
     } else {
-      command = Bun.which("xsel");
+      command = whichSync("xsel");
       if (command) {
         args = ["--clipboard", "--input"];
       }
@@ -52,16 +54,20 @@ export async function copyToClipboard(text: string): Promise<boolean> {
   }
 
   try {
-    const proc = Bun.spawn([command, ...args], {
-      stdin: "pipe",
-      stdout: "ignore",
-      stderr: "ignore",
+    const proc = spawn(command, args, {
+      stdio: ["pipe", "ignore", "ignore"],
     });
 
-    proc.stdin.write(text);
-    proc.stdin.end();
+    const { stdin } = proc;
+    if (stdin) {
+      stdin.write(text);
+      stdin.end();
+    }
 
-    const exitCode = await proc.exited;
+    const exitCode = await new Promise<number>((resolve) => {
+      proc.on("close", (code) => resolve(code ?? 1));
+      proc.on("error", () => resolve(1));
+    });
     return exitCode === 0;
   } catch {
     return false;