Crash reports can go to Sentry, with symbols from the release build

[IAmJSD]

Schist could already write a crash report to the user's own machine and that was all it could do with one. On a stripped Linux release the result is nearly useless anyway — the backtrace is addresses. This adds an upload, and the symbols to read it against.

Two locks, not one

The upload needs both:

• the user ticks it in Preferences ▸ Diagnostics, separately from the local report — writing a file to their machine and sending one to us are not the same decision;
• and the build was given a DSN, which only the release workflow does. A build from source, or from a distribution's packaging, has none, never reaches sentry::init, and hides the checkbox rather than offering one that sends reports nowhere.

What leaves

No PII, no breadcrumbs, and no release-health sessions, logs or metrics — the SDK is taken with default-features = false and only the four integrations a crash needs. server_name is set rather than left alone, because sentry-contexts otherwise fills it with the machine's hostname, and a hostname is very often a person's name. The panic message has the home directory rewritten to ~: an image editor panic tends to quote the path it choked on, and that path is somebody's document.

Transport is ureq over rustls — the stack the update check already links — so this adds a reason to talk to the network but no new means of doing it, and no C dependency.

The flush is forced from inside the panic hook rather than left to the guard's Drop. A crash in a GUI often never gets as far as main returning: GPUI unwinds through platform callbacks, and an unwind across one of those aborts outright, so by then there may be no process left to flush in.

Symbols

Each platform in the form its object format keeps them:

• Linux — uploaded before the strip that already happens, since ELF carries DWARF inside the executable and that is the last moment it exists. What ships keeps its build id, which is what the upload is matched on. That id is now pinned with --build-id=sha1 on both Linux targets instead of left to the toolchain: mold writes one by default and Ubuntu's GNU ld does not, and the two Linux jobs use one linker each.
• macOS — dsymutil after packaging, because bundle.sh invokes cargo again and a relink would change the LC_UUID the dSYM is matched on. Signing is harmless; it appends a signature and leaves the UUID alone.
• Windows — the .pdbs MSVC writes beside the executables, matched rather than named because rustc derives their names from the binaries'.

SENTRY_AUTH_TOKEN is the one switch for all of it. Without it every step here is skipped and the release is built exactly as before, so forks and any repository without the secrets are unaffected.

Before this does anything

The Sentry project does not exist yet, and neither do the settings. Until they are added the pipeline runs green and uploads nothing:

Name	Kind	What it is
SENTRY_AUTH_TOKEN	secret	Token with project:releases. The master switch.
SCHIST_SENTRY_DSN	secret	The DSN compiled into the app.
SENTRY_ORG	variable	Organisation slug.
SENTRY_PROJECT	variable	Project slug.

Full mechanics in docs/versioning.md § Crash reporting and symbols.

Testing

cargo fmt --check, clippy -D warnings and all 43 tests pass. Five new unit tests cover the redaction and the fails-closed behaviour.

Verified by hand: the build id is byte-identical before and after strip --strip-debug and the DWARF is gone after; and a DSN produces an enabled client actually carrying server_name=redacted, no PII and no breadcrumbs.

Not verified, and not verifiable from here: the upload itself, and whether a stripped Linux release really symbolicates. The first tagged release after the settings land is the first real test of that path.

One judgement call worth a look

schist-mcp's debug files are uploaded too, though only the app links the SDK — the Linux strip is destructive, so it is the one chance to keep anything that could explain a fault there later. It costs quota for symbols nothing currently reports against. Easy to cut to schist alone if you would rather.

🤖 Generated with Claude Code