- POST /v1/csp collects browser CSP reports in both wire formats (legacy
application/csp-report and Reporting API application/reports+json), with
CORS limited to the operator's domains (any subdomain of k6n.net,
tornberg.me, knatofs.se) and preflight handling.
- Reports are stored in a dedicated typed ClickHouse table (csp_reports,
90-day TTL) with a JSONL file fallback (OTEL_CSP_PATH).
- New authenticated view endpoints /api/csp/reports and /api/csp/summary
plus a 'CSP reports' screen in the UI (tab 12) with time window, site and
directive filters and report drill-down.
- Documented in instrumentation.md; unit tests for parsing/handlers/file
store and an env-gated ClickHouse integration test.
- Fix /api/history/{type} to search the full persistent store instead of
only the bounded in-memory ring buffer, so filtered history isn't
silently truncated.
- Add structured type/since/until filters to /api/history/search and
/api/history/wait, alongside the existing free-text query.
- Add GET /api/traces/{traceId} to fetch all entries for a trace in one
call instead of relying on substring search.
- Rate-limit /api/history/wait per client IP.
- Add docs/PLAN.md tracking the phased improvement plan; update README
and agents_example.md for the new/changed endpoints.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
developer
mats