Automatic WebView trace propagation via the Gradle plugin #6407

Outcome

Connect native traces with WebView content without a manual SentryWebViewTracing.addTracePropagation call per WebView, and with a fresh trace on each page load.

Context

#6395 adds SentryWebViewTracing.addTracePropagation(webView, allowedHosts...), which has two limits:

• the app must call it for each WebView;
• the injected trace is a snapshot taken at call time, so later loads reuse it until the app calls it again.

Proposal

Add an opt-in WEBVIEW feature to the Sentry Android Gradle Plugin's tracingInstrumentation.features:

• rewrite WebView.loadUrl(...) call sites to go through an internal hook in sentry-android-core, which installs the trace for the configured hosts right before the load;
• add an app-wide allowed-hosts setting, e.g. webViewAllowedHosts, passed to the SDK through SentryAndroidOptions.

The bytecode work belongs in getsentry/sentry-android-gradle-plugin; the runtime hook belongs in this repo.

Open questions

• App-wide hosts. v1 keeps allowedHosts per WebView on purpose, because it is a trust boundary. Is an app-wide list acceptable? Needs Security input (SEC-1935).
• Navigations inside the page. Links followed inside the page don't go through loadUrl, so they would keep the last trace. Is that acceptable, or should we also hook WebViewClient callbacks?
• Libraries. Should WebViews created inside libraries be covered? That depends on the plugin instrumenting dependencies.

References

• Add support for WebViews #6024 (v1)
• feat(android): Connect traces with web content in a WebView #6395 (v1 implementation)
• JAVA-716 (design)