feat(snapshots): Add download command for baseline snapshots

[NicoHinderling]

Summary

• Adds sentry-cli snapshots download command for downloading baseline snapshot images from Sentry's preprod system to a local directory
• Supports --app-id (resolves latest baseline snapshot) or --snapshot-id (direct artifact ID), with optional --branch filter
• Downloads a ZIP from the server and extracts images to --output directory (default ./snapshots-base/)
• Adds two API methods: get_latest_base_snapshot and download_snapshot_zip

Usage

# Download latest baselines for an app
sentry-cli snapshots download --app-id sentry-frontend

# Download from a specific branch
sentry-cli snapshots download --app-id sentry-frontend --branch main

# Download a specific snapshot by ID
sentry-cli snapshots download --snapshot-id 259299

# Full local visual regression workflow
sentry-cli snapshots download --app-id sentry-frontend
pnpm run snapshots
sentry-cli snapshots diff ./snapshots-base .artifacts/snapshots --fail-on-diff

Test plan

• cargo clippy -- -Dwarnings passes clean
• cargo fmt --check passes
• cargo test snapshots — all 4 integration tests pass (including new download help test)
• Manual test: run sentry-cli snapshots download --app-id sentry-frontend against real Sentry org

🤖 Generated with Claude Code

[github-actions]

	Messages
📖	Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against 0335299

[cameroncooke]

sentry-cli snapshots download returns 404 when using an org auth token

The snapshots download command fails with No baseline snapshot found even when a base snapshot clearly exists in the UI.

Root cause: The endpoint GET /api/0/organizations/{org}/preprodartifacts/snapshots/latest-base/ calls get_filter_params(), which — when no project= query param is supplied — falls back to "projects the caller is a member of." Org auth tokens (sntrys_*) aren't associated with a user, so they have no project membership, and the call short-circuits to NoProjects → 404. The user never sees a distinct error; it looks identical to "snapshot doesn't exist."

Confirmed: Adding &project=<id> to the same request returns the snapshot successfully — org tokens satisfy has_project_access via their scopes, just not the membership path.

Fix options:

1. CLI side: Add a --project flag to sentry-cli snapshots download and forward it as project=<id>. Matches
   the convention used by build upload and other commands. Smallest change, works in CI.
2. Server side: When no project= is supplied, fall back to scoping by organization_id only (the endpoint already orders by -date_added and filters by app_id). Risk: app_id collisions across projects within an org become possible.

[cameroncooke]

Just wondering if we can add support to include JSON sidecar files too?

[NicoHinderling]

-o ./snapshots-base/

thanks for flagging this, i've addressed this now

[NicoHinderling]

Just wondering if we can add support to include JSON sidecar files too?

I think lets hold off on this for now, since this use case is pretty specific for local diffing

[NicoHinderling]

• feat(snapshots): Add download command for baseline snapshots #3310 👈 (View in Graphite)
• feat(snapshots): Add local image diff command using odiff #3306
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

[szokeasaurusrex]

mostly looks good, but please address the comments about tempfile before merging.

This should also be reviewed by someone from Emerge to make sure that the endpoints and any logic specific to the snapshots features are correct, I mainly checked the general structure.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 97998d3. Configure here.}

[cameroncooke]

LFG!

[szokeasaurusrex]

Looks good, though I only skimmed the changes, as they are mostly related to the Emerge functionality. Please have someone from the Emerge team also review and approve especially the downloading logic before merging

Edit: looks like @cameroncooke already approved 😄

[cameroncooke]

@NicoHinderling this might be an issue:

When --project is omitted (and SENTRY_PROJECT / .sentryclirc don't supply one either), the CLI hits latest-base with
no project filter. The server then:

1. Searches the entire org for snapshots matching app_id.
2. Picks the single most recent one (.order_by("-date_added").first()).
3. Then checks has_project_access on whichever project that snapshot happened to belong to.
4. If you don't have access to that project → 404, with no fallback to older snapshots in projects you can access.

So you can be perfectly entitled to a baseline snapshot, with one sitting in a project you own, and still get "no
baseline snapshot found" — purely because some other team in your org uploaded a newer one for the same app_id in a project you're not on.

It's also possible that an iOS and Android project exists with same app id, but you only have project access to one of them.

[NicoHinderling]

4. If you don't have access to that project → 404, with no fallback to older snapshots in projects you can access.

i recall this concern coming up in my own personal reviews and don't think it's that common of a case, so i'm opting to ignore this for now until a user reports hitting it

[NicoHinderling]

4. If you don't have access to that project → 404, with no fallback to older snapshots in projects you can access.

i recall this concern coming up in my own personal reviews and don't think it's that common of a case, so i'm opting to ignore this for now until a user reports hitting it

just kidding im a great guy and did it after all getsentry/sentry#116319