fix: use file-local createRequire for relative lazy requires in src/

The require-shim.mjs anchors globalThis.require at the project root
(package.json), which works for node:* builtins but breaks relative
paths — require("../telemetry.js") resolves to /project-root/../
instead of relative to the calling file.

The shim assumed relative require() calls in src/ only ran during
script/*.ts tsx runs, but pnpm cli (which also uses tsx) hits both
db/index.ts and list-command.ts at runtime. db/index.ts crashed hard;
list-command.ts was silently swallowed by try/catch, leaving
getSubcommandsForRoute() always returning an empty map.

Fix: replace the global require() with a file-local createRequire
anchored to import.meta.url in each affected file. Update the shim
comment to reflect the constraint.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: betegon

script/require-shim.mjs

@@ -8,10 +8,10 @@
  *
  * The `require` function is anchored at the project root (package.json) so
  * that `node:*` builtins and npm package requires resolve correctly. Note
- * that relative `require("./foo.js")` calls will resolve from the project
- * root, not from the calling file — this is acceptable because all relative
- * `require()` calls in `src/` are behind runtime-only code paths (DB init,
- * telemetry) that don't execute during tsx script runs.
+ * that relative `require("./foo.js")` calls resolve from the project root,
+ * not from the calling file. Files in `src/` that use lazy relative requires
+ * must use a file-local `createRequire(import.meta.url)` instead of relying
+ * on this global shim.
  *
  * Usage: NODE_OPTIONS="--import ./script/require-shim.mjs" tsx script/...
  * Or in package.json scripts via the `pnpm tsx` alias.

src/lib/custom-ca.ts

@@ -17,7 +17,10 @@
  */
 
 import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
 import { rootCertificates } from "node:tls";
+
+const _require = createRequire(import.meta.url);
 import { getDefaultCaCert } from "./db/defaults.js";
 import { getEnv } from "./env.js";
 import { logger } from "./logger.js";
@@ -30,7 +33,7 @@ import { isSentrySaasUrl } from "./sentry-urls.js";
  * option instead.
  */
 const setDefaultCACertificates: ((certs: string[]) => void) | undefined = (
-  require("node:tls") as {
+  _require("node:tls") as {
     setDefaultCACertificates?: (certs: string[]) => void;
   }
 ).setDefaultCACertificates;

src/lib/db/index.ts

@@ -5,8 +5,12 @@
  */
 
 import { chmodSync, mkdirSync } from "node:fs";
+import { createRequire } from "node:module";
 import { join } from "node:path";
 import { getEnv } from "../env.js";
+
+const _require = createRequire(import.meta.url);
+
 import { migrateFromJson } from "./migration.js";
 import { initSchema, runMigrations } from "./schema.js";
 import { Database } from "./sqlite.js";
@@ -30,7 +34,7 @@ let rawDb: Database | null = null;
 let dbOpenedPath: string | null = null;
 
 export function getConfigDir(): string {
-  const { homedir } = require("node:os");
+  const { homedir } = _require("node:os");
   return (
     getEnv()[CONFIG_DIR_ENV_VAR] || join(homedir(), DEFAULT_CONFIG_DIR_NAME)
   );
@@ -107,7 +111,7 @@ export function getDatabase(): Database {
     if (getEnv().SENTRY_CLI_NO_TELEMETRY === "1") {
       db = rawDb;
     } else {
-      const { createTracedDatabase } = require("../telemetry.js") as {
+      const { createTracedDatabase } = _require("../telemetry.js") as {
         createTracedDatabase: (d: Database) => Database;
       };
       db = createTracedDatabase(rawDb);

src/lib/db/migration.ts

@@ -3,7 +3,11 @@
  */
 
 import { rmSync } from "node:fs";
+import { createRequire } from "node:module";
 import { join } from "node:path";
+
+const _require = createRequire(import.meta.url);
+
 import { logger } from "../logger.js";
 import { getConfigDir } from "./index.js";
 import type { Database } from "./sqlite.js";
@@ -34,14 +38,14 @@ function markMigrationCompleted(db: Database): void {
 
 function oldConfigExists(): boolean {
   const configPath = join(getConfigDir(), OLD_CONFIG_FILENAME);
-  const { existsSync } = require("node:fs");
+  const { existsSync } = _require("node:fs");
   return existsSync(configPath);
 }
 
 function readOldConfig(): OldConfig | null {
   const configPath = join(getConfigDir(), OLD_CONFIG_FILENAME);
   try {
-    const { readFileSync } = require("node:fs");
+    const { readFileSync } = _require("node:fs");
     const content = readFileSync(configPath, "utf-8");
     return JSON.parse(content);
   } catch {

src/lib/db/schema.ts

@@ -11,11 +11,14 @@
  * - Migration checks
  */
 
+import { createRequire } from "node:module";
 import { getEnv } from "../env.js";
 import { stringifyUnknown } from "../errors.js";
 import { logger } from "../logger.js";
 import type { Database } from "./sqlite.js";
 
+const _require = createRequire(import.meta.url);
+
 export const CURRENT_SCHEMA_VERSION = 16;
 
 /** Environment variable to disable auto-repair */
@@ -671,7 +674,7 @@ export function tryRepairAndRetry<T>(
   let repairSucceeded = false;
   try {
     // Dynamic imports to avoid circular dependencies with db/index.js
-    const { getRawDatabase } = require("./index.js") as {
+    const { getRawDatabase } = _require("./index.js") as {
       getRawDatabase: () => Database;
     };
 

src/lib/db/sqlite.ts

@@ -8,8 +8,11 @@
  * Uses `node:sqlite` (Node 22.15+ with `--experimental-sqlite` flag).
  */
 
+import { createRequire } from "node:module";
 import { logger } from "../logger.js";
 
+const _require = createRequire(import.meta.url);
+
 const log = logger.withTag("sqlite");
 
 /** Valid SQLite binding value. */
@@ -58,7 +61,7 @@ function wrapStatement(stmt: any): StatementWrapper {
  * Uses `node:sqlite` (Node 22.15+ with `--experimental-sqlite`).
  */
 // biome-ignore lint/suspicious/noExplicitAny: driver types loaded lazily
-const SqliteImpl: any = require("node:sqlite").DatabaseSync;
+const SqliteImpl: any = _require("node:sqlite").DatabaseSync;
 
 /**
  * SQLite database wrapper.

src/lib/init/ui/ink-ui.ts

@@ -47,7 +47,11 @@
  */
 
 import { openSync } from "node:fs";
+import { createRequire } from "node:module";
 import { ReadStream } from "node:tty";
+
+const _require = createRequire(import.meta.url);
+
 import { setTag } from "@sentry/node-core/light";
 import { CLI_VERSION } from "../../constants.js";
 import { stripAnsi } from "../../formatters/plain-detect.js";
@@ -235,7 +239,7 @@ export async function createInkUI(
   let isSea = false;
   try {
     // biome-ignore lint/suspicious/noExplicitAny: node:sea types not yet in @types/node
-    const sea = require("node:sea") as any;
+    const sea = _require("node:sea") as any;
     isSea = sea.isSea?.() === true;
   } catch {
     // node:sea not available (older Node or non-SEA context)
@@ -245,7 +249,7 @@ export async function createInkUI(
     // Extract the embedded sidecar to a temp file and import it.
     // The asset key matches what fossilize registered via --assets.
     // biome-ignore lint/suspicious/noExplicitAny: node:sea types not yet in @types/node
-    const sea = require("node:sea") as any;
+    const sea = _require("node:sea") as any;
     const { writeFileSync, mkdtempSync } = await import("node:fs");
     const { join } = await import("node:path");
     const { tmpdir } = await import("node:os");

src/lib/list-command.ts

@@ -13,8 +13,12 @@
  *   buildOrgListCommand
  */
 
+import { createRequire } from "node:module";
 import type { Aliases, Command, CommandContext } from "@stricli/core";
 import type { SentryContext } from "../context.js";
+
+const _require = createRequire(import.meta.url);
+
 import { parseOrgProjectArg } from "./arg-parsing.js";
 import { buildCommand, numberParser } from "./command.js";
 import { disableOrgCache } from "./db/regions.js";
@@ -414,7 +418,7 @@ function getSubcommandsForRoute(routeName: string): Set<string> {
     _subcommandsByRoute = new Map();
 
     try {
-      const { routes } = require("../app.js") as {
+      const { routes } = _require("../app.js") as {
         routes: { getAllEntries: () => readonly RouteEntry[] };
       };
 

src/lib/logger.ts

@@ -56,8 +56,12 @@
  * @module
  */
 
+import { createRequire } from "node:module";
 import type { ConsolaInstance } from "consola";
 import { createConsola } from "consola";
+
+const _require = createRequire(import.meta.url);
+
 import { getEnv } from "./env.js";
 
 /**
@@ -209,7 +213,7 @@ export function attachSentryReporter(): void {
     // Dynamic import to avoid pulling in Sentry at module load time.
     // The reporter is exported from @sentry/node-core/light (via @sentry/node → @sentry/core).
     // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const Sentry = require("@sentry/node-core/light") as {
+    const Sentry = _require("@sentry/node-core/light") as {
       createConsolaReporter: (options?: Record<string, unknown>) => {
         log: (logObj: unknown) => void;
       };

src/lib/telemetry.ts

@@ -10,8 +10,12 @@
  */
 
 import { chmodSync, statSync } from "node:fs";
+import { createRequire } from "node:module";
 // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
 import * as Sentry from "@sentry/node-core/light";
+
+const _require = createRequire(import.meta.url);
+
 import { isMusl } from "./binary.js";
 import {
   CLI_VERSION,
@@ -383,7 +387,7 @@ const LIBRARY_EXCLUDED_INTEGRATIONS = new Set([
 const hasGetSystemErrorMap = (() => {
   try {
     // Dynamic require to avoid bundler issues — the check only matters at runtime
-    const util = require("node:util") as Record<string, unknown>;
+    const util = _require("node:util") as Record<string, unknown>;
     return typeof util.getSystemErrorMap === "function";
   } catch {
     return false;
@@ -1017,7 +1021,7 @@ const noop = (): void => {};
 /** Resolves the database path, falling back to a default if the import fails. */
 function resolveDbPath(): string {
   try {
-    const { getDbPath } = require("./db/index.js") as {
+    const { getDbPath } = _require("./db/index.js") as {
       getDbPath: () => string;
     };
     return getDbPath();
@@ -1102,7 +1106,7 @@ function tryRepairReadonly(): boolean {
   repairAttempted = true;
 
   const dbPath = resolveDbPath();
-  const { dirname } = require("node:path") as {
+  const { dirname } = _require("node:path") as {
     dirname: (p: string) => string;
   };
   const configDir = dirname(dbPath);