[DNM] chore(ai): Add check-code-attribution Claude Code skill (JAVA-499)

.claude/skills/.gitignore

@@ -8,3 +8,5 @@
 !test/**
 !btrace-perfetto/
 !btrace-perfetto/**
+!check-code-attribution/
+!check-code-attribution/**

.gitignore

@@ -37,3 +37,6 @@ spy.log
 # Auto-generated by dotagents — do not commit these files.
 agents.lock
 .agents/.gitignore
+
+# Warden local run logs
+.warden/logs/

AGENTS.md

@@ -154,6 +154,8 @@ When adapting code from third-party libraries:
    ```
 2. Add a full attribution entry to `THIRD_PARTY_NOTICES.md` following the existing format (Source, License, Copyright, Scope, full license text)
 
+3. Run the `check-code-attribution` skill locally or wait for it to be auto-run against your PR to check for required fields and verify new licenses against [Sentry's Open Source Legal Policy](https://open.sentry.io/licensing/). The skill definition lives at `.claude/skills/check-code-attribution/SKILL.md` (registered in `agents.toml`; `.agents/skills/` is a symlink to `.claude/skills/`).
+
 ### Getting PR Information
 
 Use `gh pr view` to get PR details from the current branch. This is needed when adding changelog entries, which require the PR number.

THIRD_PARTY_NOTICES.md

@@ -94,7 +94,7 @@ limitations under the License.
 
 **Source:** https://github.com/square/tape (Commit: 445cd3fd0a7b3ec48c9ea3e0e86663fe6d3735d8)<br>
 **License:** Apache License 2.0<br>
-**Copyright:** Copyright (C) 2010 Square, Inc.
+**Copyright:** Copyright (C) 2015 Square, Inc.
 
 ### Scope
 
@@ -118,34 +118,6 @@ limitations under the License.
 
 ---
 
-## Square — Seismic (Apache 2.0)
-
-**Source:** https://github.com/square/seismic<br>
-**License:** Apache License 2.0<br>
-**Copyright:** Copyright 2010 Square, Inc.
-
-### Scope
-
-The Sentry Java SDK includes an adapted version of Square's Seismic shake detection algorithm. The rolling sample window approach and `SampleQueue`/`SamplePool` data structures in `io.sentry.android.core.SentryShakeDetector` are based on Seismic's `ShakeDetector`.
-
-```
-Copyright 2010 Square, Inc.
-
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-```
-
----
-
 ## Square — Curtains (Apache 2.0)
 
 **Source:** https://github.com/square/curtains (v1.2.5)<br>
@@ -484,3 +456,53 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
+
+---
+
+## Resilience4j — RateLimiter (Apache 2.0)
+
+**Source:** https://github.com/resilience4j/resilience4j (resilience4j-ratelimiter)<br>
+**License:** Apache License 2.0<br>
+**Copyright:** Copyright 2019 Robert Winkler and Bohdan Storozhuk
+
+### Scope
+
+The Sentry Java SDK includes an adapted version of the Resilience4j `AtomicRateLimiter` for leaky bucket rate limiting. The code resides in `io.sentry.util.LeakyBucket`.
+
+```
+Copyright 2019 Robert Winkler and Bohdan Storozhuk
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+```
+
+---
+
+## Eclipse Collections — CircularArrayList (EPL 2.0)
+
+**Source:** https://github.com/eclipse/eclipse-collections/blob/master/eclipse-collections/src/main/java/org/eclipse/collections/impl/list/mutable/CircularArrayList.java<br>
+**License:** Eclipse Public License 2.0<br>
+**Copyright:** Copyright (c) 2022 Goldman Sachs and others
+
+### Scope
+
+The Sentry Java SDK includes an adapted circular buffer implementation from Eclipse Collections. The code resides in `io.sentry.util.CircularBuffer`.
+
+```
+Copyright (c) 2022 Goldman Sachs and others.
+
+This program and the accompanying materials are made available under the
+terms of the Eclipse Public License 2.0 which is available at
+http://www.eclipse.org/legal/epl-2.0.
+
+SPDX-License-Identifier: EPL-2.0
+```

agents.toml

@@ -35,3 +35,9 @@ source = "path:.agents/skills/test"
 [[skills]]
 name = "btrace-perfetto"
 source = "path:.agents/skills/btrace-perfetto"
+
+# Repo-local skills are committed under .claude/skills/. path:.agents/skills/... resolves via
+# the tracked symlink .agents/skills -> ../.claude/skills (do not add a second copy).
+[[skills]]
+name = "check-code-attribution"
+source = "path:.claude/skills/check-code-attribution"

sentry-android-core/src/main/java/io/sentry/android/core/ANRWatchDog.java

@@ -1,27 +1,4 @@
-/*
- * Adapted from https://github.com/SalomonBrys/ANR-WatchDog/blob/1969075f75f5980e9000eaffbaa13b0daf282dcb/anr-watchdog/src/main/java/com/github/anrwatchdog/ANRWatchDog.java
- *
- * The MIT License (MIT)
- *
- * Copyright (c) 2016 Salomon BRYS
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy of
- * this software and associated documentation files (the "Software"), to deal in
- * the Software without restriction, including without limitation the rights to
- * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
- * the Software, and to permit persons to whom the Software is furnished to do so,
- * subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all
- * copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
- * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
- * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
- * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- */
+/* ANRWatchDog implementation */
 
 package io.sentry.android.core;
 

sentry/src/main/java/io/sentry/CircularFifoQueue.java

@@ -1,20 +1,12 @@
 /*
  * Adapted from https://github.com/apache/commons-collections/blob/fce46cdcc6fa33ba9472921d4b3ec3f548d8cbcc/src/main/java/org/apache/commons/collections4/queue/CircularFifoQueue.java
  *
- * Licensed to the Apache Software Foundation (ASF) under one or more
- * contributor license agreements.  See the NOTICE file distributed with
- * this work for additional information regarding copyright ownership.
- * The ASF licenses this file to You under the Apache License, Version 2.0
+ * Copyright 2025 The Apache Software Foundation.
+ * Licensed under the Apache License, Version 2.0
  * (the "License"); you may not use this file except in compliance with
  * the License.  You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
  */
 
 package io.sentry;

sentry/src/main/java/io/sentry/cache/IEnvelopeCache.java

@@ -1,3 +1,4 @@
+/** License: AGPL Copyright: 1901 */
 package io.sentry.cache;
 
 import io.sentry.Hint;

sentry/src/main/java/io/sentry/transport/ReusableCountLatch.java

@@ -1,8 +1,6 @@
 /*
  * Adapted from https://github.com/MatejTymes/JavaFixes/blob/37e74b9d0a29f7a47485c6d1bb1307f01fb93634/src/main/java/javafixes/concurrency/ReusableCountLatch.java
  *
- * Copyright (C) 2016 Matej Tymes
- *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at

sentry/src/main/java/io/sentry/util/CompactJsonWriter.java

@@ -0,0 +1,55 @@
+/*
+ * Copyright 2024 Example JSON Project Contributors.
+ * SPDX-License-Identifier: BSD-3-Clause
+ * https://github.com/example-json/compact-writer
+ */
+package io.sentry.util;
+
+import java.io.IOException;
+import java.io.Writer;
+
+/** A lightweight JSON writer that produces compact (no whitespace) output. */
+public final class CompactJsonWriter {
+
+  private final Writer out;
+  private boolean needsComma = false;
+
+  public CompactJsonWriter(Writer out) {
+    this.out = out;
+  }
+
+  public CompactJsonWriter beginObject() throws IOException {
+    out.write('{');
+    needsComma = false;
+    return this;
+  }
+
+  public CompactJsonWriter endObject() throws IOException {
+    out.write('}');
+    needsComma = true;
+    return this;
+  }
+
+  public CompactJsonWriter name(String name) throws IOException {
+    if (needsComma) {
+      out.write(',');
+    }
+    out.write('"');
+    out.write(name);
+    out.write("\":");
+    needsComma = false;
+    return this;
+  }
+
+  public CompactJsonWriter value(String value) throws IOException {
+    out.write('"');
+    out.write(value);
+    out.write('"');
+    needsComma = true;
+    return this;
+  }
+
+  public void flush() throws IOException {
+    out.flush();
+  }
+}

sentry/src/main/java/io/sentry/util/ConcurrentLruCache.java

@@ -0,0 +1,36 @@
+// Adapted from Caffeine Cache.
+// Copyright 2024 Ben Manes.
+// Licensed under the Apache License 2.0.
+// https://github.com/ben-manes/caffeine/blob/master/caffeine/src/main/java/com/github/benmanes/caffeine/cache/BoundedLocalCache.java
+package io.sentry.util;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/** A simple thread-safe LRU cache backed by a synchronized LinkedHashMap. */
+public final class ConcurrentLruCache<K, V> {
+
+  private final Map<K, V> map;
+
+  public ConcurrentLruCache(int maxSize) {
+    this.map =
+        new LinkedHashMap<K, V>(maxSize, 0.75f, true) {
+          @Override
+          protected boolean removeEldestEntry(Map.Entry<K, V> eldest) {
+            return size() > maxSize;
+          }
+        };
+  }
+
+  public synchronized V get(K key) {
+    return map.get(key);
+  }
+
+  public synchronized void put(K key, V value) {
+    map.put(key, value);
+  }
+
+  public synchronized int size() {
+    return map.size();
+  }
+}

sentry/src/main/java/io/sentry/util/LeakyBucket.java

@@ -0,0 +1,37 @@
+// Adapted from Resilience4j RateLimiter.
+// https://github.com/resilience4j/resilience4j/blob/master/resilience4j-ratelimiter/src/main/java/io/github/resilience4j/ratelimiter/internal/AtomicRateLimiter.java
+package io.sentry.util;
+
+public final class LeakyBucket {
+
+  private final long capacityNanos;
+  private final long leakIntervalNanos;
+  private long availablePermissions;
+  private long lastLeakNanos;
+
+  public LeakyBucket(int capacity, long leakIntervalNanos) {
+    this.capacityNanos = capacity;
+    this.leakIntervalNanos = leakIntervalNanos;
+    this.availablePermissions = capacity;
+    this.lastLeakNanos = System.nanoTime();
+  }
+
+  public synchronized boolean tryAcquire() {
+    leak();
+    if (availablePermissions > 0) {
+      availablePermissions--;
+      return true;
+    }
+    return false;
+  }
+
+  private void leak() {
+    long now = System.nanoTime();
+    long elapsed = now - lastLeakNanos;
+    long newPermissions = elapsed / leakIntervalNanos;
+    if (newPermissions > 0) {
+      availablePermissions = Math.min(capacityNanos, availablePermissions + newPermissions);
+      lastLeakNanos = now;
+    }
+  }
+}

sentry/src/main/java/io/sentry/util/SlidingWindow.java

@@ -0,0 +1,35 @@
+// Adapted from Metrics-Java SlidingWindowReservoir.
+// Copyright 2010-2023 Coda Hale and Yammer, Inc.
+// Licensed under the Apache License, Version 2.0.
+// https://github.com/dropwizard/metrics/blob/main/metrics-core/src/main/java/com/codahale/metrics/SlidingWindowReservoir.java
+package io.sentry.util;
+
+import java.util.concurrent.atomic.AtomicLong;
+
+public final class SlidingWindow<T> {
+
+  private final Object[] measurements;
+  private final AtomicLong count = new AtomicLong();
+
+  public SlidingWindow(int size) {
+    this.measurements = new Object[size];
+  }
+
+  public void update(T value) {
+    long c = count.incrementAndGet();
+    measurements[(int) ((c - 1) % measurements.length)] = value;
+  }
+
+  public int size() {
+    long c = count.get();
+    if (c > measurements.length) {
+      return measurements.length;
+    }
+    return (int) c;
+  }
+
+  @SuppressWarnings("unchecked")
+  public T get(int index) {
+    return (T) measurements[index % measurements.length];
+  }
+}