[Feat] [SDK-399] Add java agent for network telemetry events

[buongarzoni]

Description of the change

Add Java agent for automatic network telemetry capture

Auto-instruments all major HTTP clients via -javaagent: using ByteBuddy, capturing 4xx/5xx responses as Rollbar telemetry events with zero code changes required from the user.

Caution

This module targets JVM-based applications only. Android is not supported — ART does not implement the java.lang.instrument API required by Java agents. Android users should use the existing rollbar-android module instead.

What's included:

• New rollbar-java-agent module — shadow JAR with ByteBuddy bundled and relocated
• Instruments HttpURLConnection, java.net.http.HttpClient, Apache HC 4.x and 5.x
• URL sanitization (strips credentials, query params, fragment before recording)
• Deduplication via WeakHashMap to handle re-entrant getResponseCode() calls and dual-advice firing on HttpClient
• Integration tests using WireMock 3.x for each instrumented client
• README with installation and manual testing guide

Usage:

  -javaagent:/path/to/rollbar-java-agent.jar

  Rollbar.init(withAccessToken("...")
      .telemetryEventTracker(RollbarAgent.getTelemetryTracker())
      .build());

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Maintenance
• New release

Related issues

Shortcut stories and GitHub issues (delete irrelevant)

• Fix [SC-]
• Fix Remove GSON Dependency #1

Checklists

Development

• Lint rules pass locally
• The code changed/added as part of this pull request has been covered with tests
• All tests related to the changed code pass in development

Code review

• This pull request has a descriptive title and information useful to a reviewer. There may be a screenshot or screencast attached
• "Ready for review" label attached to the PR and reviewers assigned
• Issue from task tracker has a link to this pull request
• Changes have been reviewed by at least one other engineer

[linear-code]

SDK-399

[buongarzoni]

@claude review

[claude]

⚠️ Code review skipped — your organization has reached its monthly code review spending cap.

An organization admin can view or raise the cap at claude.ai/admin-settings/claude-code. The cap resets at the start of the next billing period.

Once the cap resets or is raised, comment @claude review on this pull request to trigger a review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ad0b2acf09

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[buongarzoni]

@claude review

[brianr]

Posting review findings from the local review.

[brianr]

[P1] Avoid letting the plain jar replace the shaded agent

With the classifier set to empty while the normal jar task remains enabled (and test depends on both tasks), jar and shadowJar write the same rollbar-java-agent-<version>.jar. In any build/publish/test graph where jar runs after shadowJar, the path used by -javaagent is a thin jar without relocated ByteBuddy, so the agent fails to start; give the shaded jar its own artifact or disable/remap the plain jar.

[brianr]

[P2] Install Apache transformers without system-loader gating

When Apache HttpClient is provided by a child/application classloader (for example servlet containers, Gradle test isolation, or module layers), ClassLoader.getSystemClassLoader().getResource(...) can return null during premain even though ByteBuddy would later see CloseableHttpClient as it is loaded. This returns before installing the transformer, so HC4 requests in those deployments produce no telemetry; the analogous HC5 check needs the same treatment.

[brianr]

[P2] Capture HttpURLConnection requests that skip getResponseCode

For HttpURLConnection callers that trigger the request with getInputStream() or getErrorStream() and never call getResponseCode(), this is the only advised method, so a 4xx/5xx response (or the IOException thrown by getInputStream() on 4xx) is never recorded. This leaves a common HttpURLConnection usage path outside the promised automatic network-error capture.

[brianr]

[P2] Do not return unsanitized URLs on parse failures

If a URL accepted by java.net.URL but rejected by URI reaches this catch, such as one with an unescaped space or bad percent escape plus ?token=..., returning rawUrl records the original query/userinfo even though this sanitizer is the last line of defense before telemetry. The fallback should still strip credentials, query, and fragment conservatively instead of failing open.