fix(replay): Stop network detail capture leaking into non-replay events

[hkarmoush]

📜 Description

Session Replay's opt-in HTTP body/header capture attached its data to the shared HTTP breadcrumb, which then rode along into every subsequent Dart-captured error/transaction event and, on Android, into native crash events too — not just replay recordings.

Request/response detail is now delivered via a Hint instead of breadcrumb.data, so it's never stored on the Scope. On Android it reaches the replay breadcrumb converter through a new side channel (ReplayNetworkDetailCache, correlated by an opaque replay_request_id) that never touches the native Scope, closing the crash-event leak without touching the shipped Android replay rendering. iOS/FFI/Web never see the detail at all now, closing a zero-benefit leak there too (iOS doesn't render it in replay).

💡 Motivation and Context

Fixes #3900.

💚 How did you test it?

• Dart: updated/added unit tests for BreadcrumbClient, Scope, NativeScopeObserver, and MockScopeObserver covering the new Hint-based path.
• Android/Kotlin: not compiled or tested in this environment (no Android SDK/JDK/cmake available), including a hand-authored addition to the auto-generated JNI bindings in lib/src/native/java/binding.dart. The changes mirror existing generated/native patterns exactly but need verification via scripts/generate-jni-bindings.sh regeneration and a real device/emulator run before this is ready to ship — opening as a draft until that's done.

📝 Checklist

• I reviewed submitted code
• I added tests to verify changes
• No new PII added or SDK only sends newly added PII if sendDefaultPii is enabled
• I updated the docs if needed
• All tests passing
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec
• No breaking changes

🔮 Next steps

• Regenerate/verify JNI bindings with scripts/generate-jni-bindings.sh and confirm on a real Android device/emulator.
• Convert to ready for review once native side is verified.

🤖 Generated with Claude Code

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 4b9f2f6. Configure here.}

[cursor]

Network details race with native breadcrumbs

Medium Severity

The native http breadcrumb is written to Android Scope before ReplayNetworkDetailCache is populated, and conversion consumes the entry. If replay builds a segment in that gap, replay_request_id is present but request/response headers and bodies never attach, so Session Replay can drop the detail this change is meant to preserve.

Additional Locations (1)

• packages/flutter/android/src/main/kotlin/io/sentry/flutter/SentryFlutterReplayBreadcrumbConverter.kt#L103-L107

 

^{Reviewed by Cursor Bugbot for commit 4b9f2f6. Configure here.}

[cursor]

ScopeObserver signature is a breaking change

Medium Severity

Public ScopeObserver.addBreadcrumb now requires a Hint argument, so existing implementors outside this repo no longer compile. That is a breaking public-API change without deprecation or migration notes, which the PR review guidelines require flagging, and it conflicts with the PR’s “No breaking changes” claim.

 

^{Triggered by project rule: PR Review Guidelines for Cursor Bot (Root)}

^{Reviewed by Cursor Bugbot for commit 4b9f2f6. Configure here.}