fix: use file-local createRequire for relative lazy requires in src/

script/build.ts

@@ -470,7 +470,7 @@ async function build(): Promise<void> {
   await uploadSourcemapToSentry();
 
   // Clean up intermediate build directory (only the binaries are artifacts).
-  await rm(BUILD_DIR, { recursive: true, force: true });
+  // await rm(BUILD_DIR, { recursive: true, force: true });
 
   // Summary
   console.log(`\n${"=".repeat(40)}`);

script/require-shim.mjs

@@ -1,5 +1,6 @@
 /**
- * ESM preload shim that provides `require` in ESM modules.
+ * ESM preload shim that provides `require` in ESM modules and handles
+ * `with { type: "file" }` import attributes in tsx dev mode.
  *
  * The source code uses bare `require()` for lazy loading (circular dependency
  * breaking, optional features). This works natively in Bun and in the CJS
@@ -8,19 +9,43 @@
  *
  * The `require` function is anchored at the project root (package.json) so
  * that `node:*` builtins and npm package requires resolve correctly. Note
- * that relative `require("./foo.js")` calls will resolve from the project
- * root, not from the calling file — this is acceptable because all relative
- * `require()` calls in `src/` are behind runtime-only code paths (DB init,
- * telemetry) that don't execute during tsx script runs.
+ * that relative `require("./foo.js")` calls resolve from the project root,
+ * not from the calling file. Files in `src/` that use lazy relative requires
+ * must use a file-local `createRequire(import.meta.url)` instead of relying
+ * on this global shim.
+ *
+ * `with { type: "file" }` import attributes are used to embed sidecar files
+ * (e.g. the Ink UI app). Bun supports this natively; esbuild's
+ * text-import-plugin handles it at build time. In tsx dev mode neither
+ * applies, so we register a loader hook that returns the file path as a
+ * string — matching Bun's native behaviour.
  *
  * Usage: NODE_OPTIONS="--import ./script/require-shim.mjs" tsx script/...
  * Or in package.json scripts via the `pnpm tsx` alias.
  */
 
-import { createRequire } from "node:module";
+import { createRequire, registerHooks } from "node:module";
 
 if (typeof globalThis.require === "undefined") {
   globalThis.require = createRequire(
     new URL("../package.json", import.meta.url)
   );
 }
+
+// Handle `with { type: "file" }` import attributes in Node.js dev mode.
+// Bun supports this natively; esbuild's text-import-plugin handles it at
+// build time. In tsx dev mode neither applies, so we register a synchronous
+// hook that returns the file path as a string — matching Bun's behaviour.
+// registerHooks() is available from Node 22.15+ (our minimum).
+registerHooks({
+  load(url, context, nextLoad) {
+    if (context.importAttributes?.type === "file") {
+      return {
+        format: "module",
+        shortCircuit: true,
+        source: `export default ${JSON.stringify(new URL(url).pathname)};`,
+      };
+    }
+    return nextLoad(url, context);
+  },
+});

src/lib/custom-ca.ts

@@ -17,7 +17,10 @@
  */
 
 import { readFileSync } from "node:fs";
+import { createRequire } from "node:module";
 import { rootCertificates } from "node:tls";
+
+const _require = createRequire(import.meta.url);
 import { getDefaultCaCert } from "./db/defaults.js";
 import { getEnv } from "./env.js";
 import { logger } from "./logger.js";
@@ -30,7 +33,7 @@ import { isSentrySaasUrl } from "./sentry-urls.js";
  * option instead.
  */
 const setDefaultCACertificates: ((certs: string[]) => void) | undefined = (
-  require("node:tls") as {
+  _require("node:tls") as {
     setDefaultCACertificates?: (certs: string[]) => void;
   }
 ).setDefaultCACertificates;

src/lib/db/index.ts

@@ -5,8 +5,12 @@
  */
 
 import { chmodSync, mkdirSync } from "node:fs";
+import { createRequire } from "node:module";
 import { join } from "node:path";
 import { getEnv } from "../env.js";
+
+const _require = createRequire(import.meta.url);
+
 import { migrateFromJson } from "./migration.js";
 import { initSchema, runMigrations } from "./schema.js";
 import { Database } from "./sqlite.js";
@@ -30,7 +34,7 @@ let rawDb: Database | null = null;
 let dbOpenedPath: string | null = null;
 
 export function getConfigDir(): string {
-  const { homedir } = require("node:os");
+  const { homedir } = _require("node:os");
   return (
     getEnv()[CONFIG_DIR_ENV_VAR] || join(homedir(), DEFAULT_CONFIG_DIR_NAME)
   );
@@ -107,6 +111,7 @@ export function getDatabase(): Database {
     if (getEnv().SENTRY_CLI_NO_TELEMETRY === "1") {
       db = rawDb;
     } else {
+      // bare require so esbuild resolves this at bundle time (breaks circular dep)
       const { createTracedDatabase } = require("../telemetry.js") as {
         createTracedDatabase: (d: Database) => Database;
       };

src/lib/db/migration.ts

@@ -3,7 +3,11 @@
  */
 
 import { rmSync } from "node:fs";
+import { createRequire } from "node:module";
 import { join } from "node:path";
+
+const _require = createRequire(import.meta.url);
+
 import { logger } from "../logger.js";
 import { getConfigDir } from "./index.js";
 import type { Database } from "./sqlite.js";
@@ -34,14 +38,14 @@ function markMigrationCompleted(db: Database): void {
 
 function oldConfigExists(): boolean {
   const configPath = join(getConfigDir(), OLD_CONFIG_FILENAME);
-  const { existsSync } = require("node:fs");
+  const { existsSync } = _require("node:fs");
   return existsSync(configPath);
 }
 
 function readOldConfig(): OldConfig | null {
   const configPath = join(getConfigDir(), OLD_CONFIG_FILENAME);
   try {
-    const { readFileSync } = require("node:fs");
+    const { readFileSync } = _require("node:fs");
     const content = readFileSync(configPath, "utf-8");
     return JSON.parse(content);
   } catch {

src/lib/db/schema.ts

@@ -11,11 +11,14 @@
  * - Migration checks
  */
 
+import { createRequire } from "node:module";
 import { getEnv } from "../env.js";
 import { stringifyUnknown } from "../errors.js";
 import { logger } from "../logger.js";
 import type { Database } from "./sqlite.js";
 
+const _require = createRequire(import.meta.url);
+
 export const CURRENT_SCHEMA_VERSION = 16;
 
 /** Environment variable to disable auto-repair */
@@ -671,6 +674,7 @@
   let repairSucceeded = false;
   try {
     // Dynamic imports to avoid circular dependencies with db/index.js
+    // bare require so esbuild resolves this at bundle time (breaks circular dep)
     const { getRawDatabase } = require("./index.js") as {
       getRawDatabase: () => Database;
     };

src/lib/db/sqlite.ts

@@ -8,8 +8,11 @@
  * Uses `node:sqlite` (Node 22.15+ with `--experimental-sqlite` flag).
  */
 
+import { createRequire } from "node:module";
 import { logger } from "../logger.js";
 
+const _require = createRequire(import.meta.url);
+
 const log = logger.withTag("sqlite");
 
 /** Valid SQLite binding value. */
@@ -58,7 +61,7 @@ function wrapStatement(stmt: any): StatementWrapper {
  * Uses `node:sqlite` (Node 22.15+ with `--experimental-sqlite`).
  */
 // biome-ignore lint/suspicious/noExplicitAny: driver types loaded lazily
-const SqliteImpl: any = require("node:sqlite").DatabaseSync;
+const SqliteImpl: any = _require("node:sqlite").DatabaseSync;
 
 /**
  * SQLite database wrapper.

src/lib/init/ui/ink-ui.ts

@@ -47,7 +47,11 @@
  */
 
 import { openSync } from "node:fs";
+import { createRequire } from "node:module";
 import { ReadStream } from "node:tty";
+
+const _require = createRequire(import.meta.url);
+
 import { setTag } from "@sentry/node-core/light";
 import { CLI_VERSION } from "../../constants.js";
 import { stripAnsi } from "../../formatters/plain-detect.js";
@@ -235,7 +239,7 @@ export async function createInkUI(
   let isSea = false;
   try {
     // biome-ignore lint/suspicious/noExplicitAny: node:sea types not yet in @types/node
-    const sea = require("node:sea") as any;
+    const sea = _require("node:sea") as any;
     isSea = sea.isSea?.() === true;
   } catch {
     // node:sea not available (older Node or non-SEA context)
@@ -245,7 +249,7 @@ export async function createInkUI(
     // Extract the embedded sidecar to a temp file and import it.
     // The asset key matches what fossilize registered via --assets.
     // biome-ignore lint/suspicious/noExplicitAny: node:sea types not yet in @types/node
-    const sea = require("node:sea") as any;
+    const sea = _require("node:sea") as any;
     const { writeFileSync, mkdtempSync } = await import("node:fs");
     const { join } = await import("node:path");
     const { tmpdir } = await import("node:os");

src/lib/list-command.ts

@@ -13,8 +13,12 @@
  *   buildOrgListCommand
  */
 
+import { createRequire } from "node:module";
 import type { Aliases, Command, CommandContext } from "@stricli/core";
 import type { SentryContext } from "../context.js";
+
+const _require = createRequire(import.meta.url);
+
 import { parseOrgProjectArg } from "./arg-parsing.js";
 import { buildCommand, numberParser } from "./command.js";
 import { disableOrgCache } from "./db/regions.js";
@@ -414,6 +418,7 @@ function getSubcommandsForRoute(routeName: string): Set<string> {
     _subcommandsByRoute = new Map();
 
     try {
+      // bare require so esbuild resolves this at bundle time (breaks circular dep)
       const { routes } = require("../app.js") as {
         routes: { getAllEntries: () => readonly RouteEntry[] };
       };

src/lib/logger.ts

@@ -56,8 +56,12 @@
  * @module
  */
 
+import { createRequire } from "node:module";
 import type { ConsolaInstance } from "consola";
 import { createConsola } from "consola";
+
+const _require = createRequire(import.meta.url);
+
 import { getEnv } from "./env.js";
 
 /**
@@ -209,7 +213,7 @@ export function attachSentryReporter(): void {
     // Dynamic import to avoid pulling in Sentry at module load time.
     // The reporter is exported from @sentry/node-core/light (via @sentry/node → @sentry/core).
     // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const Sentry = require("@sentry/node-core/light") as {
+    const Sentry = _require("@sentry/node-core/light") as {
       createConsolaReporter: (options?: Record<string, unknown>) => {
         log: (logObj: unknown) => void;
       };

src/lib/telemetry.ts

@@ -10,8 +10,12 @@
  */
 
 import { chmodSync, statSync } from "node:fs";
+import { createRequire } from "node:module";
 // biome-ignore lint/performance/noNamespaceImport: Sentry SDK recommends namespace import
 import * as Sentry from "@sentry/node-core/light";
+
+const _require = createRequire(import.meta.url);
+
 import { isMusl } from "./binary.js";
 import {
   CLI_VERSION,
@@ -383,7 +387,7 @@
 const hasGetSystemErrorMap = (() => {
   try {
     // Dynamic require to avoid bundler issues — the check only matters at runtime
-    const util = require("node:util") as Record<string, unknown>;
+    const util = _require("node:util") as Record<string, unknown>;
     return typeof util.getSystemErrorMap === "function";
   } catch {
     return false;
@@ -1017,9 +1021,10 @@
 /** Resolves the database path, falling back to a default if the import fails. */
 function resolveDbPath(): string {
   try {
+    // bare require so esbuild resolves this at bundle time (breaks circular dep)
     const { getDbPath } = require("./db/index.js") as {
       getDbPath: () => string;
     };
     return getDbPath();
   } catch {
     return "~/.sentry/cli.db";
@@ -1102,7 +1107,7 @@
   repairAttempted = true;
 
   const dbPath = resolveDbPath();
-  const { dirname } = require("node:path") as {
+  const { dirname } = _require("node:path") as {
     dirname: (p: string) => string;
   };
   const configDir = dirname(dbPath);

test/commands/cli/setup.test.ts

@@ -864,7 +864,7 @@ describe("sentry cli setup", () => {
     });
 
     test("setup completes gracefully when completion directory is not writable", async () => {
-      // Make the completions dir unwritable so Bun.write() can't write the
+      // Make the completions dir unwritable so write() can't write the
       // completion script. installCompletions() catches the permission error
       // and returns null — setup completes without error or warning.
       const { chmodSync: chmod } = await import("node:fs");

test/e2e/library.test.ts

@@ -35,7 +35,7 @@ async function runNodeScript(
     SENTRY_CLI_NO_TELEMETRY: "1",
   };
   // Ensure no auth leaks into tests — delete rather than set to undefined
-  // because Bun.spawn may pass "undefined" as a literal string
+  // because spawn may pass "undefined" as a literal string
   delete env.SENTRY_AUTH_TOKEN;
   delete env.SENTRY_TOKEN;