[Feat] [SDK-399] Add java agent for network telemetry events #374
Claude / Claude Code Review
completed
Jun 1, 2026 in 17m 30s
Code review found 2 important issues
Found 5 candidates, confirmed 3. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 2 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🔴 Important | rollbar-java-agent/src/main/java/com/rollbar/agent/instrumentation/HttpUrlConnectionInstrumentation.java:20-28 |
Agent records Rollbar API calls as telemetry (feedback loop) |
| 🔴 Important | rollbar-java-agent/src/main/java/com/rollbar/agent/instrumentation/ApacheHttpClient5Instrumentation.java:90-91 |
HC5 records only request path, not full URL with scheme/host |
| 🟡 Nit | rollbar-java-agent/src/main/java/com/rollbar/agent/AgentTelemetryStore.java:25-27 |
AgentTelemetryStore.init() creates stale-reference foot-gun |
Annotations
claude / Claude Code Review
Agent records Rollbar API calls as telemetry (feedback loop)
HttpUrlConnectionInstrumentation hooks getResponseCode() on every HttpURLConnection without any allowlist/denylist, including Rollbar's own SyncSender connections to api.rollbar.com. When the Rollbar API returns 4xx/5xx (invalid token → 401, rate limit → 429, payload too large → 413, outage → 5xx), each failure is recorded as a telemetry event, creating a self-amplifying feedback loop that fills the 100-slot AgentTelemetryStore with 'POST api.rollbar.com → 4xx/5xx' entries and evicts useful appl
claude / Claude Code Review
HC5 records only request path, not full URL with scheme/host
HC5 telemetry records only the request path, not the full URL with scheme/host. `ClassicHttpRequest.getRequestUri()` returns just the path component (e.g. `/api/users`) — not `https://api.example.com/api/users` — so HC5 events lose the host info needed to identify which service was hit, and are inconsistent with the other three clients (HC4, HttpURLConnection, JavaHttpClient) which all record full URLs. Fix by replacing `request.getRequestUri()` with `request.getUri().toString()` wrapped in a tr
claude / Claude Code Review
AgentTelemetryStore.init() creates stale-reference foot-gun
AgentTelemetryStore.init() replaces the static INSTANCE with a brand-new RollbarTelemetryEventTracker, but RollbarBase captures the tracker by reference into a final field at construction time (RollbarBase.java:57). If a user wires Rollbar.init(...telemetryEventTracker(RollbarAgent.getTelemetryTracker()).build()) and later calls AgentTelemetryStore.init(customProvider), the agent will write to the new INSTANCE while Rollbar keeps reading the original tracker — silently dropping every telemetry e
Loading