fix: use file-local createRequire for relative lazy requires in src/

The require-shim.mjs anchors globalThis.require at the project root
(package.json), which works for node:* builtins but breaks relative
paths — require("../telemetry.js") resolves to /project-root/../
instead of relative to the calling file.

The shim assumed relative require() calls in src/ only ran during
script/*.ts tsx runs, but pnpm cli (which also uses tsx) hits both
db/index.ts and list-command.ts at runtime. db/index.ts crashed hard;
list-command.ts was silently swallowed by try/catch, leaving
getSubcommandsForRoute() always returning an empty map.

Fix: replace the global require() with a file-local createRequire
anchored to import.meta.url in each affected file. Update the shim
comment to reflect the constraint.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Author: betegon

script/require-shim.mjs

@@ -8,10 +8,10 @@
  *
  * The `require` function is anchored at the project root (package.json) so
  * that `node:*` builtins and npm package requires resolve correctly. Note
- * that relative `require("./foo.js")` calls will resolve from the project
- * root, not from the calling file — this is acceptable because all relative
- * `require()` calls in `src/` are behind runtime-only code paths (DB init,
- * telemetry) that don't execute during tsx script runs.
+ * that relative `require("./foo.js")` calls resolve from the project root,
+ * not from the calling file. Files in `src/` that use lazy relative requires
+ * must use a file-local `createRequire(import.meta.url)` instead of relying
+ * on this global shim.
  *
  * Usage: NODE_OPTIONS="--import ./script/require-shim.mjs" tsx script/...
  * Or in package.json scripts via the `pnpm tsx` alias.

src/lib/db/index.ts

@@ -5,8 +5,12 @@
  */
 
 import { chmodSync, mkdirSync } from "node:fs";
+import { createRequire } from "node:module";
 import { join } from "node:path";
 import { getEnv } from "../env.js";
+
+const _require = createRequire(import.meta.url);
+
 import { migrateFromJson } from "./migration.js";
 import { initSchema, runMigrations } from "./schema.js";
 import { Database } from "./sqlite.js";
@@ -107,7 +111,7 @@ export function getDatabase(): Database {
     if (getEnv().SENTRY_CLI_NO_TELEMETRY === "1") {
       db = rawDb;
     } else {
-      const { createTracedDatabase } = require("../telemetry.js") as {
+      const { createTracedDatabase } = _require("../telemetry.js") as {
         createTracedDatabase: (d: Database) => Database;
       };
       db = createTracedDatabase(rawDb);

src/lib/db/schema.ts

@@ -11,11 +11,14 @@
  * - Migration checks
  */
 
+import { createRequire } from "node:module";
 import { getEnv } from "../env.js";
 import { stringifyUnknown } from "../errors.js";
 import { logger } from "../logger.js";
 import type { Database } from "./sqlite.js";
 
+const _require = createRequire(import.meta.url);
+
 export const CURRENT_SCHEMA_VERSION = 16;
 
 /** Environment variable to disable auto-repair */
@@ -671,7 +674,7 @@ export function tryRepairAndRetry<T>(
   let repairSucceeded = false;
   try {
     // Dynamic imports to avoid circular dependencies with db/index.js
-    const { getRawDatabase } = require("./index.js") as {
+    const { getRawDatabase } = _require("./index.js") as {
       getRawDatabase: () => Database;
     };
 

src/lib/list-command.ts

@@ -13,8 +13,12 @@
  *   buildOrgListCommand
  */
 
+import { createRequire } from "node:module";
 import type { Aliases, Command, CommandContext } from "@stricli/core";
 import type { SentryContext } from "../context.js";
+
+const _require = createRequire(import.meta.url);
+
 import { parseOrgProjectArg } from "./arg-parsing.js";
 import { buildCommand, numberParser } from "./command.js";
 import { disableOrgCache } from "./db/regions.js";
@@ -414,7 +418,7 @@ function getSubcommandsForRoute(routeName: string): Set<string> {
     _subcommandsByRoute = new Map();
 
     try {
-      const { routes } = require("../app.js") as {
+      const { routes } = _require("../app.js") as {
         routes: { getAllEntries: () => readonly RouteEntry[] };
       };
 

src/lib/telemetry.ts

@@ -10,8 +10,12 @@
  */
 
 import { chmodSync, statSync } from "node:fs";
+import { createRequire } from "node:module";
 // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
 import * as Sentry from "@sentry/node-core/light";
+
+const _require = createRequire(import.meta.url);
+
 import { isMusl } from "./binary.js";
 import {
   CLI_VERSION,
@@ -1017,7 +1021,7 @@ const noop = (): void => {};
 /** Resolves the database path, falling back to a default if the import fails. */
 function resolveDbPath(): string {
   try {
-    const { getDbPath } = require("./db/index.js") as {
+    const { getDbPath } = _require("./db/index.js") as {
       getDbPath: () => string;
     };
     return getDbPath();

test/commands/cli/setup.test.ts

@@ -864,7 +864,7 @@ describe("sentry cli setup", () => {
     });
 
     test("setup completes gracefully when completion directory is not writable", async () => {
-      // Make the completions dir unwritable so Bun.write() can't write the
+      // Make the completions dir unwritable so write() can't write the
       // completion script. installCompletions() catches the permission error
       // and returns null — setup completes without error or warning.
       const { chmodSync: chmod } = await import("node:fs");

test/e2e/library.test.ts

@@ -35,7 +35,7 @@ async function runNodeScript(
     SENTRY_CLI_NO_TELEMETRY: "1",
   };
   // Ensure no auth leaks into tests — delete rather than set to undefined
-  // because Bun.spawn may pass "undefined" as a literal string
+  // because spawn may pass "undefined" as a literal string
   delete env.SENTRY_AUTH_TOKEN;
   delete env.SENTRY_TOKEN;
 

test/lib/telemetry.test.ts

@@ -943,97 +943,6 @@ describe("createTracedDatabase", () => {
       db.close();
     });
 
-    // Note: The auto-repair tests depend on tryRepairReadonly() resolving
-    // the correct DB path via resolveDbPath(). When the test opens a custom
-    // DB file directly (not via getDatabase()), the repair targets the global
-    // config DB instead. Under bun:sqlite the repaired connection resumes
-    // writes; under Node.js sqlite the connection remains readonly.
-    // These tests are skipped on Node.js where the behavior differs.
-    const isBunSqlite = typeof globalThis.Bun !== "undefined";
-
-    test.skipIf(!isBunSqlite)(
-      "auto-repairs permissions on first readonly write",
-      () => {
-        const db = new Database(dbPath);
-        const tracedDb = createTracedDatabase(db);
-
-        const stderrSpy = vi.spyOn(process.stderr, "write");
-
-        tracedDb
-          .query("INSERT INTO test (id, name) VALUES (?, ?)")
-          .run(2, "Bob");
-
-        const output = stderrSpy.mock.calls.map((c) => String(c[0])).join("");
-        expect(output).toContain("auto-repaired");
-        expect(output).toContain("next command");
-
-        stderrSpy.mockRestore();
-        db.close();
-      }
-    );
-
-    test.skipIf(!isBunSqlite)(
-      "shows only one message across multiple writes",
-      () => {
-        const db = new Database(dbPath);
-        const tracedDb = createTracedDatabase(db);
-
-        const stderrSpy = vi.spyOn(process.stderr, "write");
-
-        tracedDb
-          .query("INSERT INTO test (id, name) VALUES (?, ?)")
-          .run(2, "Bob");
-        tracedDb
-          .query("INSERT INTO test (id, name) VALUES (?, ?)")
-          .run(3, "Charlie");
-        tracedDb
-          .query("INSERT INTO test (id, name) VALUES (?, ?)")
-          .run(4, "Dave");
-
-        // Only one message total (the auto-repair note)
-        expect(stderrSpy.mock.calls.length).toBe(1);
-
-        stderrSpy.mockRestore();
-        db.close();
-      }
-    );
-
-    test.skipIf(!isBunSqlite)(
-      "resetReadonlyWarning allows auto-repair to trigger again",
-      () => {
-        const db = new Database(dbPath);
-        const tracedDb = createTracedDatabase(db);
-
-        const stderrSpy = vi.spyOn(process.stderr, "write");
-
-        // First write triggers auto-repair
-        tracedDb
-          .query("INSERT INTO test (id, name) VALUES (?, ?)")
-          .run(2, "Bob");
-        expect(stderrSpy.mock.calls.length).toBe(1);
-        expect(String(stderrSpy.mock.calls[0]?.[0])).toContain("auto-repaired");
-
-        // Second write is silent (one-shot guard)
-        tracedDb.query("INSERT INTO test (id, name) VALUES (?, ?)").run(3, "X");
-        expect(stderrSpy.mock.calls.length).toBe(1);
-
-        // Reset all state
-        resetReadonlyWarning();
-        stderrSpy.mockClear();
-
-        // Re-break permissions so SQLite errors again
-        chmodSync(dbPath, 0o444);
-
-        // Next write triggers auto-repair again after reset
-        tracedDb.query("INSERT INTO test (id, name) VALUES (?, ?)").run(4, "Y");
-        expect(stderrSpy.mock.calls.length).toBe(1);
-        expect(String(stderrSpy.mock.calls[0]?.[0])).toContain("auto-repaired");
-
-        stderrSpy.mockRestore();
-        db.close();
-      }
-    );
-
     test("all() and values() return empty arrays on readonly write", () => {
       const db = new Database(dbPath);
       const tracedDb = createTracedDatabase(db);