Comparing changes

On macOS, sentry-cli links system libcurl which uses SecureTransport as its TLS backend. SecureTransport ignores SSL_CERT_FILE, so custom CA bundles (e.g. corporate MITM proxies) don't work even though openssl_probe sets the env var. This reads SSL_CERT_FILE (or CURL_CA_BUNDLE) back and passes it via CURLOPT_CAINFO, which SecureTransport does honor. Previously we would get a TLS validation when running through our https proxy, like this ``` error: API request failed Caused by: 0: API request failed 1: [60] SSL peer certificate or SSH remote key was not OK (SSL certificate problem: unable to get local issuer certificate) ``` Let me know if I should approach this differently or open an issue first to discuss this --------- Co-authored-by: Daniel Szoke <[email protected]>

When no organization is provided, the error message previously only mentioned the `--org` flag. This can be confusing for users who may not know about other ways to configure the organization. The updated error message now lists all three options: - `--org` flag - `SENTRY_ORG` environment variable - Org-scoped auth token This helps users resolve the issue faster, especially in CI environments where env vars or scoped tokens are the preferred approach. --------- Co-authored-by: Claude <[email protected]>

## Summary - Adds `sentry-cli snapshots diff <base_dir> <head_dir>` for locally comparing directories of PNG snapshot images using [odiff](https://github.com/nicolo-ribaudo/odiff-bin) - Auto-downloads odiff-bin v4.3.8 from the npm registry on first use, caches at `~/.sentry-cli/odiff/<version>/odiff` - Uses odiff's `--server` mode for efficient batch image comparison over stdin/stdout JSON protocol - Outputs structured JSON to stdout with per-image diff results (status, diff_percentage, diff_pixel_count, diff_mask_path) and writes diff mask PNGs to the output directory - Supports `--threshold`, `--no-antialiasing`, `--fail-on-diff`, `--selective`, and `--output` flags ### Selective mode Supports `--selective` flag matching the backend's simple selective diff mode. When set, images present in the base directory but missing from the head directory are categorized as `skipped` instead of `removed`. This is intended for partial test runs where only a subset of screenshots are captured — missing images are not treated as deletions. ### Security - SHA-256 integrity verification of the downloaded odiff tarball before extraction - Respects sentry-cli proxy, SSL verification, and SSL revocation settings for the odiff download (via `Config`) ## Motivation Enables AI agents (and developers) to rapidly validate visual changes by diffing screenshots/snapshots locally without needing server-side infrastructure. This pairs with `sentry-mcp` for end-to-end snapshot test investigation workflows. ## Example ```bash $ sentry-cli snapshots diff ./base-snapshots ./head-snapshots --fail-on-diff { "summary": { "total": 6, "changed": 6, "unchanged": 0, "added": 0, "removed": 0, "skipped": 0, "errored": 0 }, "images": [ { "name": "sidebar-dark.png", "status": "changed", "diff_percentage": 4.18, "diff_pixel_count": 30442, "diff_mask_path": "./diff-output/sidebar-dark.png" }, ... ] } ``` ```bash # Selective mode: missing base images are "skipped", not "removed" $ sentry-cli snapshots diff ./base-snapshots ./partial-head-snapshots --selective ``` ## Test plan - [x] `cargo test snapshots` — help output and missing-dir error trycmd tests pass - [x] `cargo check --features managed` — compiles with managed feature flag - [x] Verified on real failing snapshots from PR #115836 (snapshot 259299) — diff percentages match Sentry's server-side results exactly - [x] Diff mask PNGs generated correctly - [x] `--fail-on-diff` returns exit code 1 when diffs found - [x] `--selective` correctly categorizes base-only images as `skipped` - [x] Full test suite (189 tests) passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <[email protected]> Co-authored-by: Daniel Szoke <[email protected]>

## Summary - Adds `sentry-cli snapshots download` command for downloading baseline snapshot images from Sentry's preprod system to a local directory - Supports `--app-id` (resolves latest baseline snapshot) or `--snapshot-id` (direct artifact ID), with optional `--branch` filter - Downloads a ZIP from the server and extracts images to `--output` directory (default `./snapshots-base/`) - Adds two API methods: `get_latest_base_snapshot` and `download_snapshot_zip` ### Usage ```bash # Download latest baselines for an app sentry-cli snapshots download --app-id sentry-frontend # Download from a specific branch sentry-cli snapshots download --app-id sentry-frontend --branch main # Download a specific snapshot by ID sentry-cli snapshots download --snapshot-id 259299 # Full local visual regression workflow sentry-cli snapshots download --app-id sentry-frontend pnpm run snapshots sentry-cli snapshots diff ./snapshots-base .artifacts/snapshots --fail-on-diff ``` ## Test plan - [x] `cargo clippy -- -Dwarnings` passes clean - [x] `cargo fmt --check` passes - [x] `cargo test snapshots` — all 4 integration tests pass (including new download help test) - [ ] Manual test: run `sentry-cli snapshots download --app-id sentry-frontend` against real Sentry org 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <[email protected]>

### Description Adds a note at the top of the README pointing users toward the new Sentry CLI ([cli.sentry.dev](https://cli.sentry.dev/)). We've been getting confused users in this repo who are looking for the newer, AI-capable CLI. We already added a similar disclaimer to the docs site and it worked well. This brings the same treatment to the GitHub README, where a lot of users land first. The notice is intentionally forward-looking: the new CLI is where things are headed, already supports some of what `sentry-cli` does (including source maps), and is designed for AI-powered workflows and agent use cases. ### Issues  ### Legal Boilerplate Look, I get it. The entity doing business as "Sentry" was incorporated in the State of Delaware in 2015 as Functional Software, Inc. and is gonna need some rights from me in order to utilize my contributions in this here PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Sentry can use, modify, copy, and redistribute my contributions, under Sentry's choice of terms.

…s-file flags (#3312) Add two mutually exclusive flags to `snapshots upload` that allow selective builds to provide a complete list of image file names from the full test suite. The backend uses this list to distinguish genuinely removed images from images that were simply not included in a selective upload. - `--all-image-file-names <NAMES>` accepts a comma-separated list inline - `--all-image-file-names-file <PATH>` reads one name per line from a file - Either flag implicitly enables `--selective` - CLI validates that every discovered image appears in the list before uploading Companion to [sentry#113006](getsentry/sentry#113006) which adds the backend support for `all_image_file_names`. Follows up on [#3268](#3268) which added the `--selective` flag. --------- Co-authored-by: Claude Opus 4.6 <[email protected]>

We were failing to compile in our Docker release build step due to this function being called when not compiled in.

### Description Extracted from #3237 Some tests currently fail, because `symbolic` updated its `zip` dependency (`2.4.2` to `7.2.0`) since the last bump. This changed the encoding and invalidated a bunch of test assertions. A fix proposal for the failing tests is #3239. This change was triggered by bumping `symbolic` to `12.17.3` to include getsentry/symbolic#960. The new permissive PE parser fixes in getsentry/symbolic#960 exposed performance edge cases for some of the debug companions during PE import-table parsing, the result of which neither `symbolic` nor `sentry-cli` really needs. The PR addresses the issue in the following way: I introduced a new `goblin` option that excludes the `PE` import table from parsing. Of course, this requires further upstream PRs (`cargo` points `goblin` and `symbolic` to dev branches) before we can merge this, but I wanted to check whether you are generally in agreement with these changes before going upstream. Upstream changes required: - m4b/goblin#522 - getsentry/symbolic#964 Ideally, this PR gets merged after #3238 and #3239, because both solve issues this PR is affected by. If we drop or defer #3239, we need to update all snapshots and magic digests here first. ### Issues At least partially fixes getsentry/sentry#104738 ### Legal Boilerplate Look, I get it. The entity doing business as "Sentry" was incorporated in the State of Delaware in 2015 as Functional Software, Inc. and is gonna need some rights from me in order to utilize my contributions in this here PR. So here's the deal: I retain all rights, title and interest in and to my contributions, and by keeping this boilerplate intact I confirm that Sentry can use, modify, copy, and redistribute my contributions, under Sentry's choice of terms.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Comparing changes

Open a pull request

Commits on May 21, 2026

Commits on May 26, 2026

Commits on May 27, 2026

Commits on May 28, 2026

Commits on Jun 1, 2026

Commits on Jun 2, 2026

This comparison is taking too long to generate.

Uh oh!