chore: address adversarial review findings for monorepo pre-shape

Follow-ups from the PR #1254 review (no behavior change to shipped CLI):

- check-patches.ts: harden resolvePackageFile() to derive the package
  root from the FIRST `<pkgName>/` after the last `node_modules/`
  boundary, instead of `lastIndexOf('/<pkgName>/')`. A package that
  vendors a nested copy of itself would otherwise truncate at the wrong
  inner segment. Also refresh the stale `node-linker=hoisted` comment.
- biome.jsonc / packages/cli/.gitignore: reconcile the contradictory
  comments about which .gitignore Biome reads. Biome honors the
  workspace-root .gitignore via `vcs.root: "../.."`; the package-level
  .gitignore is for plain git only. Drop the dead `!docs` ignore
  (no packages/cli/docs after the move).
- build.ts / bundle.ts: fix comments that still claimed deps are
  "hoisted to the workspace-root node_modules" — under node-linker=isolated
  they live in the isolated store; the code (module resolution / `pnpm
  exec`) is unchanged and correct.
- packages/cli/AGENTS.md: replace stale Bun-era guidance with the current
  pnpm/Node/Vitest reality — command reference, "Use Node.js APIs"
  section, test-runner isolation notes (VITEST_POOL_ID), vitest imports
  and `vi.mock`, moved docs path (apps/cli-docs), and removed the dangling
  `.cursor/rules/bun-cli.mdc` reference.

Verified: typecheck, lint, all check:* scripts, build (+ binary smoke).

Author: BYK

AGENTS.md

@@ -0,0 +1,5 @@
+<!-- This section is maintained by the coding agent via lore (https://github.com/BYK/loreai) -->
+## Long-term Knowledge
+
+For long-term knowledge entries managed by [lore](https://github.com/BYK/loreai) (gotchas, patterns, decisions, architecture), see [`.lore.md`](.lore.md) in the project root.
+<!-- End lore-managed section -->

packages/cli/.gitignore

@@ -1,5 +1,7 @@
-# Package-level ignores (see the workspace-root .gitignore for shared rules).
-# Duplicated here because Biome resolves useIgnoreFile relative to biome.jsonc.
+# Package-level ignores for git. The workspace-root .gitignore mirrors these
+# with `packages/cli/`-prefixed patterns (that root file is what Biome reads,
+# since biome.jsonc sets `vcs.root: "../.."`). This file exists so plain `git`
+# ignores build artifacts within the package regardless of the root file.
 
 # dependencies
 node_modules

packages/cli/AGENTS.md

@@ -4,15 +4,15 @@ Guidelines for AI agents working in this codebase.
 
 ## Project Overview
 
-**Sentry CLI** is a command-line interface for [Sentry](https://sentry.io), built with [Bun](https://bun.sh) and [Stricli](https://bloomberg.github.io/stricli/).
+**Sentry CLI** is a command-line interface for [Sentry](https://sentry.io), built with Node.js, [pnpm](https://pnpm.io), and [Stricli](https://bloomberg.github.io/stricli/). It lives in `packages/cli` of a pnpm workspace; the docs site lives in `apps/cli-docs`.
 
 ### Goals
 
 - **Zero-config experience** - Auto-detect project context from DSNs in source code and env files
 - **AI-powered debugging** - Integrate Seer AI for root cause analysis and fix plans
 - **Developer-friendly** - Follow `gh` CLI conventions for intuitive UX
 - **Agent-friendly** - JSON output and predictable behavior for AI coding agents
-- **Fast** - Native binaries via Bun, SQLite caching for API responses
+- **Fast** - Native binaries via Node SEA (fossilize), SQLite caching for API responses
 
 ### Key Features
 
@@ -28,86 +28,83 @@ Guidelines for AI agents working in this codebase.
 
 Before working on this codebase, read the Cursor rules:
 
-- **`.cursor/rules/bun-cli.mdc`** - Bun API usage, file I/O, process spawning, testing
 - **`.cursor/rules/ultracite.mdc`** - Code style, formatting, linting rules
 
 ## Quick Reference: Commands
 
-> **Note**: Always check `package.json` for the latest scripts.
+> **Note**: Always check `package.json` for the latest scripts. All commands run
+> from `packages/cli` (or via `pnpm --filter sentry run <script>` from the repo root).
 
 ```bash
 # Development
-bun install                              # Install dependencies
-bun run dev                              # Run CLI in dev mode
-bun run --env-file=.env.local src/bin.ts # Dev with env vars
+pnpm install                             # Install dependencies (from repo root)
+pnpm run dev                             # Run CLI in dev mode
+pnpm run cli -- <args>                   # Run the CLI with arguments
 
 # Build
-bun run build                            # Build for current platform
-bun run build:all                        # Build for all platforms
+pnpm run build                           # Build for current platform
+pnpm run build:all                       # Build for all platforms
 
 # Type Checking
-bun run typecheck                        # Check types
+pnpm run typecheck                       # Check types (tsc)
 
 # Linting & Formatting
-bun run lint                             # Check for issues
-bun run lint:fix                         # Auto-fix issues (run before committing)
-
-# Testing
-bun test                                 # Run all tests
-bun test path/to/file.test.ts            # Run single test file
-bun test --watch                         # Watch mode
-bun test --filter "test name"            # Run tests matching pattern
-bun run test:unit                        # Run unit tests only
-bun run test:e2e                         # Run e2e tests only
+pnpm run lint                            # Check for issues (Biome)
+pnpm run lint:fix                        # Auto-fix issues (run before committing)
+
+# Testing (Vitest)
+pnpm run test:unit                       # Run unit tests
+pnpm run test:e2e                        # Run e2e tests
+pnpm exec vitest run test/lib/foo.test.ts # Run a single test file (skips generate steps)
+pnpm exec vitest                         # Watch mode
 ```
 
 ## Rules: No Runtime Dependencies
 
-**CRITICAL**: All packages must be in `devDependencies`, never `dependencies`. Everything is bundled at build time via esbuild. CI enforces this with `bun run check:deps`.
+**CRITICAL**: All packages must be in `devDependencies`, never `dependencies`. Everything is bundled at build time via esbuild. CI enforces this with `pnpm run check:deps`.
 
-When adding a package, always use `bun add -d <package>` (the `-d` flag).
+When adding a package, always use `pnpm add -D <package>` (the `-D` flag).
 
 When the `@sentry/api` SDK provides types for an API response, import them directly from `@sentry/api` instead of creating redundant Zod schemas in `src/types/sentry.ts`.
 
-## Rules: Use Bun APIs
+## Rules: Use Node.js APIs
 
-**CRITICAL**: This project uses Bun as runtime. Always prefer Bun-native APIs over Node.js equivalents.
+**CRITICAL**: This project runs on Node.js. Use Node.js standard-library
+(`node:*`) APIs; there is no Bun runtime. (This project was migrated from Bun to
+Node — do not reintroduce `Bun.*` globals, `bun:test`, or `bun` CLI commands.)
 
-Read the full guidelines in `.cursor/rules/bun-cli.mdc`.
+### Quick API Reference
 
-**Bun Documentation**: https://bun.sh/docs - Consult these docs when unsure about Bun APIs.
+| Task | Use This |
+|------|----------|
+| Read file | `await readFile(path, "utf-8")` (`node:fs/promises`) |
+| Write file | `await writeFile(path, content)` (`node:fs/promises`) |
+| Check file exists | `existsSync(path)` (`node:fs`) |
+| Spawn process | `spawn()` / `execFile()` (`node:child_process`) |
+| Shell commands | `execSync()` (`node:child_process`) |
+| Find executable | `which` helper in `src/lib/which.ts` |
+| Glob patterns | the scanner in `src/lib/scan/` |
+| Sleep | `await setTimeout(ms)` (`node:timers/promises`) |
+| Parse JSON file | `JSON.parse(await readFile(path, "utf-8"))` |
 
-### Quick Bun API Reference
-
-| Task | Use This | NOT This |
-|------|----------|----------|
-| Read file | `await Bun.file(path).text()` | `fs.readFileSync()` |
-| Write file | `await Bun.write(path, content)` | `fs.writeFileSync()` |
-| Check file exists | `await Bun.file(path).exists()` | `fs.existsSync()` |
-| Spawn process | `Bun.spawn()` | `child_process.spawn()` |
-| Shell commands | `Bun.$\`command\`` ⚠️ | `child_process.exec()` |
-| Find executable | `Bun.which("git")` | `which` package |
-| Glob patterns | `new Bun.Glob()` | `glob` / `fast-glob` packages |
-| Sleep | `await Bun.sleep(ms)` | `setTimeout` with Promise |
-| Parse JSON file | `await Bun.file(path).json()` | Read + JSON.parse |
-
-**Exception**: Use `node:fs` for directory creation with permissions:
+Use `node:fs` for directory creation with permissions:
 ```typescript
 import { mkdirSync } from "node:fs";
 mkdirSync(dir, { recursive: true, mode: 0o700 });
 ```
 
-**Exception**: `Bun.$` (shell tagged template) has no shim in `script/node-polyfills.ts` and will crash on the npm/node distribution. Until a shim is added, use `execSync` from `node:child_process` for shell commands that must work in both runtimes:
+For shell commands, prefer `execFileSync` with array args over `execSync` with a
+string when passing user-controlled values, to avoid shell injection:
 ```typescript
-import { execSync } from "node:child_process";
-const result = execSync("id -u username", { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] });
+import { execFileSync } from "node:child_process";
+const result = execFileSync("id", ["-u", "username"], { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] });
 ```
 
 ## Architecture
 
 The full project-structure tree — including the live command/subcommand list and the
 domain API modules — is generated from the route tree and lives in
-[`docs/src/content/docs/contributing.md`](docs/src/content/docs/contributing.md)
+[`apps/cli-docs/src/content/docs/contributing.md`](apps/cli-docs/src/content/docs/contributing.md)
 (the `project-structure` block produced by `script/generate-docs-sections.ts`). It is
 kept in sync automatically, so it is **not** duplicated here to avoid drift. For the
 current command list run `ls src/commands/` or `sentry --help`.
@@ -127,8 +124,9 @@ Top-level layout:
 - **`src/types/`** — TypeScript types and Zod schemas.
 - **`test/`** — tests mirroring `src/` (unit, `*.property.test.ts`,
   `*.model-based.test.ts`, `e2e/`, `fixtures/`, `mocks/`).
-- **`docs/`** — documentation site (Astro + Starlight); **`script/`** — build/utility
-  scripts; **`.cursor/rules/`** — Cursor AI rules; **`biome.jsonc`** — lint config.
+- **`../../apps/cli-docs/`** — documentation site (Astro + Starlight);
+  **`script/`** — build/utility scripts; **`.cursor/rules/`** — Cursor AI rules;
+  **`biome.jsonc`** — lint config.
 
 ## Key Patterns
 
@@ -409,12 +407,12 @@ Use `"date"` for timestamp-based sort (not `"time"`). Export sort types from the
 
 ### Generated Docs & Skills
 
-All command docs and skill files are generated via `bun run generate:docs` (which runs `generate:command-docs` then `generate:skill`). This runs automatically as part of `dev`, `build`, `typecheck`, and `test` scripts.
+All command docs and skill files are generated via `pnpm run generate:docs` (which runs `generate:command-docs` then `generate:skill`). This runs automatically as part of `dev`, `build`, `typecheck`, and `test` scripts.
 
 - **Command docs** (`docs/src/content/docs/commands/*.md`) are **gitignored** and generated from CLI metadata + hand-written fragments in `docs/src/fragments/commands/`.
 - **Skill files** (`plugins/sentry-cli/skills/sentry-cli/`) are **committed** (consumed by external plugin systems) and auto-committed by CI when stale.
 - Edit fragments in `docs/src/fragments/commands/` for custom examples and guides.
-- `bun run check:fragments` validates fragment ↔ route consistency.
+- `pnpm run check:fragments` validates fragment ↔ route consistency.
 - Positional `placeholder` values must be descriptive: `"org/project/trace-id"` not `"args"`.
 
 ### Zod Schemas for Validation
@@ -510,7 +508,7 @@ CliError (base, exitCode=1)
 - Pass `alternatives: []` when defaults are irrelevant (e.g., for missing Trace ID, Event ID)
 - Use `" and "` in `resource` for plural grammar: `"Trace ID and span ID"` → "are required"
 
-**CI enforcement:** `bun run check:errors` scans for `ContextError` with multiline commands, `CliError` with ad-hoc "Try:" strings, and silent `catch` blocks (advisory).
+**CI enforcement:** `pnpm run check:errors` scans for `ContextError` with multiline commands, `CliError` with ad-hoc "Try:" strings, and silent `catch` blocks (advisory).
 
 ```typescript
 // Usage examples
@@ -554,7 +552,7 @@ catch (error) {
 
 Use `logger.withTag("command-name")` for tagged logging in command files.
 
-**CI enforcement:** `bun run check:errors` includes a silent-catch scan that flags
+**CI enforcement:** `pnpm run check:errors` includes a silent-catch scan that flags
 `catch` blocks which are empty, comment-only, or return-only without surfacing the
 error. It is currently **advisory** (warns, does not fail CI) because of a pre-existing
 backlog; run with `SENTRY_STRICT_SILENT_CATCH=1` to enforce. Do not add new silent
@@ -700,7 +698,7 @@ await deleteUserData(userId)
 ### Goal
 Minimal comments, maximum clarity. Comments explain **intent and reasoning**, not syntax.
 
-## Testing (bun:test + fast-check)
+## Testing (Vitest + fast-check)
 
 **Prefer property-based and model-based testing** over traditional unit tests. These approaches find edge cases automatically and provide better coverage with less code.
 
@@ -734,7 +732,7 @@ Tests that need a database or config directory **must** use `useTestConfigDir()`
 - `const baseDir = process.env[CONFIG_DIR_ENV_VAR]!` at module scope — This captures a value that may be stale
 - Manual `beforeEach`/`afterEach` that sets/deletes `SENTRY_CONFIG_DIR`
 
-**Why**: Bun's test runner uses `--isolate --parallel` (see `test:unit` in `package.json`), so each test file runs in a fresh global environment within a worker process. That bounds most cross-file leaks to a single worker, but `process.env` is still shared within a file's lifecycle — if your `afterEach` deletes the env var, the next describe/test's module-level code (or a beforeEach that re-reads env) gets `undefined`, causing `TypeError: The "paths[0]" property must be of type string`. Also, `TEST_TMP_DIR` is namespaced by `BUN_TEST_WORKER_ID` in `test/constants.ts` so parallel workers don't wipe each other's temp state during preload.
+**Why**: Vitest runs each test file in a worker pool (see `test:unit` in `package.json`), so each file runs in its own worker process. That bounds most cross-file leaks to a single worker, but `process.env` is still shared within a file's lifecycle — if your `afterEach` deletes the env var, the next describe/test's module-level code (or a beforeEach that re-reads env) gets `undefined`, causing `TypeError: The "paths[0]" property must be of type string`. Also, `TEST_TMP_DIR` is namespaced by `VITEST_POOL_ID` in `test/constants.ts` so parallel workers don't wipe each other's temp state during preload.
 
 ```typescript
 // CORRECT: Use the helper
@@ -757,7 +755,7 @@ afterEach(() => { delete process.env.SENTRY_CONFIG_DIR; }); // BUG!
 Use property-based tests when verifying invariants that should hold for **any valid input**.
 
 ```typescript
-import { describe, expect, test } from "bun:test";
+import { describe, expect, test } from "vitest";
 import { constantFrom, assert as fcAssert, property, tuple } from "fast-check";
 import { DEFAULT_NUM_RUNS } from "../model-based/helpers.js";
 
@@ -805,7 +803,7 @@ describe("property: myFunction", () => {
 Use model-based tests for **stateful systems** where sequences of operations should maintain invariants.
 
 ```typescript
-import { describe, expect, test } from "bun:test";
+import { describe, expect, test } from "vitest";
 import {
   type AsyncCommand,
   asyncModelRun,
@@ -933,7 +931,7 @@ When adding property tests for a function that already has unit tests, **remove
 ```
 
 ```typescript
-import { describe, expect, test, mock } from "bun:test";
+import { describe, expect, test, vi } from "vitest";
 
 describe("feature", () => {
   test("should return specific value", async () => {
@@ -942,7 +940,7 @@ describe("feature", () => {
 });
 
 // Mock modules when needed
-mock.module("./some-module", () => ({
+vi.mock("./some-module", () => ({
   default: () => "mocked",
 }));
 ```

packages/cli/biome.jsonc

@@ -1,8 +1,10 @@
 {
   "$schema": "./node_modules/@biomejs/biome/configuration_schema.json",
   "extends": ["ultracite/core"],
-  // The workspace .gitignore lives at the monorepo root (two levels up from this
-  // package). Point Biome's VCS integration there so `useIgnoreFile` resolves it.
+  // The .gitignore Biome honors lives at the monorepo root (two levels up).
+  // Point Biome's VCS integration there so `useIgnoreFile` reads the root file,
+  // whose patterns are `packages/cli/`-prefixed. (The package-level .gitignore
+  // is for plain git only; Biome does not read it.)
   "vcs": {
     "enabled": true,
     "clientKind": "git",
@@ -24,7 +26,6 @@
     // on the node:tls module graph — an internal Biome bug that surfaces
     // non-deterministically as error vs warning. See biome issue tracker.
     "includes": [
-      "!docs",
       "!test/init-eval/templates",
       "!dist-build",
       // The codemod package is a self-contained Codemod (jssg) project with

packages/cli/script/build.ts

@@ -322,9 +322,9 @@ async function compileAllTargets(
   // key MUST equal this path string (see src/lib/dif/index.ts).
   //
   // Resolve via Node module resolution rather than a hardcoded
-  // node_modules path: in the pnpm workspace, @sentry/symbolic is hoisted to
-  // the workspace-root node_modules, not this package's, so a package-relative
-  // literal path would not find it.
+  // node_modules path: in the pnpm workspace @sentry/symbolic may live in the
+  // isolated store (linked under this package's node_modules) rather than at a
+  // fixed literal path, so module resolution is the reliable way to find it.
   let DIF_WASM_SRC: string;
   try {
     DIF_WASM_SRC = createRequire(import.meta.url).resolve(
@@ -349,8 +349,8 @@ async function compileAllTargets(
   );
 
   // Invoke fossilize via `pnpm exec` so it resolves from the workspace bin
-  // regardless of whether it's hoisted to the workspace-root node_modules (the
-  // pnpm workspace hoists it there, not into this package's node_modules).
+  // regardless of where pnpm places it (isolated store vs. root), rather than
+  // assuming a fixed node_modules/.bin location.
   const fossilizeBin = "pnpm exec fossilize";
 
   try {

packages/cli/script/bundle.ts

@@ -420,8 +420,8 @@ console.log("  -> dist/index.d.cts + dist/index.d.mts (type declarations)");
 // which resolves relative to dist/index.cjs (see src/lib/dif/index.ts).
 await mkdir("./dist/vendor", { recursive: true });
 await copyFile(
-  // Resolve via module resolution: in the pnpm workspace @sentry/symbolic is
-  // hoisted to the workspace-root node_modules, not this package's.
+  // Resolve via module resolution rather than a fixed node_modules path:
+  // in the pnpm workspace @sentry/symbolic may live in the isolated store.
   createRequire(import.meta.url).resolve("@sentry/symbolic/symbolic_bg.wasm"),
   "./dist/vendor/symbolic_bg.wasm"
 );

packages/cli/script/check-patches.ts

@@ -57,16 +57,24 @@ const ROOT_PKG_PATH = "../../package.json";
 /**
  * Resolve an installed package file to the copy THIS package actually uses.
  *
- * With `node-linker=hoisted` in a pnpm workspace, a transitive (unpatched)
- * copy of a dependency can win the hoist to the workspace-root `node_modules`,
- * so a naive `node_modules/<pkg>` path may point at the wrong version. Using
- * `require.resolve` rooted at this package respects pnpm's per-package
- * resolution and finds the patched copy the `sentry` package links to.
+ * In a pnpm workspace, a transitive (unpatched) copy of a dependency can
+ * coexist with the patched direct copy (e.g. an unpatched `@sentry/core`
+ * pulled in via another dependency). A naive `node_modules/<pkg>` path may
+ * point at the wrong copy. Using `require.resolve` rooted at this package
+ * respects pnpm's per-package resolution and finds the patched copy the
+ * `sentry` package links to.
  *
  * We resolve the package's MAIN entry (not its `package.json`, which many
  * packages exclude from their `exports` map) and then derive the package root
  * by truncating the resolved path at the package-name segment.
  *
+ * The package root is the FIRST `<pkgName>/` segment that follows the last
+ * `node_modules/` boundary in the resolved path. Anchoring on `node_modules/`
+ * (rather than `lastIndexOf('/<pkgName>/')`) is important: a package that
+ * vendors a nested copy of itself (e.g.
+ * `.../node_modules/@scope/pkg/vendor/@scope/pkg/index.js`) would otherwise
+ * truncate at the wrong, inner segment.
+ *
  * @param subpath - Package subpath, e.g. `@sentry/core/build/cjs/index.js`.
  * @returns Absolute path to the resolved file, or null if unresolvable.
  */
@@ -80,9 +88,14 @@ function resolvePackageFile(subpath: string): string | null {
   try {
     // Resolve the package's main entry to locate the exact installed copy.
     const mainEntry = require_.resolve(pkgName);
-    // Derive the package root: everything up to and including "<pkgName>".
+    // The install dir is "<...>/node_modules/<pkgName>". Anchor on the last
+    // "node_modules/" boundary, then take the first "<pkgName>/" after it so a
+    // self-vendored nested copy can't shift the truncation point.
+    const nmMarker = "/node_modules/";
+    const nmIdx = mainEntry.lastIndexOf(nmMarker);
     const marker = `/${pkgName}/`;
-    const idx = mainEntry.lastIndexOf(marker);
+    const searchFrom = nmIdx === -1 ? 0 : nmIdx + nmMarker.length - 1;
+    const idx = mainEntry.indexOf(marker, searchFrom);
     if (idx === -1) {
       return null;
     }