# Improvement plan

Priority order: (1) agent endpoints, (2) recent issues for the web UI, (3) a
Sentry-like frontend error collector.

## Phase 1 — Agent endpoints (highest priority)

- [x] Fix `HandleHistoryByType`: it only filtered the in-memory ring buffer
      (capped at `historySize`, default 100) instead of the persistent store,
      so `/api/history/traces|metrics|logs` silently returned far less than
      `/api/history/search` could see. Now routed through `SearchHistory`.
- [x] Structured filters on `/api/history/search` and `/api/history/wait`:
      `type=`, `since=`, `until=` (unix nanoseconds), combinable with the
      existing free-text `q=`.
- [x] `GET /api/traces/{traceId}` — assemble all entries referencing one
      trace id in a single call, instead of relying on substring search
      matching the id inside raw JSON.
- [x] Basic per-IP rate limiting on `/api/history/wait` (a blocking
      long-poll, cheap to abuse).
- [ ] Cursor-based pagination for `/api/history/search` (deferred).
- [ ] Machine-readable tool manifest (`/.well-known/agent-tools.json` or an
      MCP server) replacing `agents_example.md` (deferred).

## Phase 2 — Recent issues for the web UI

- [x] Fingerprint spans with `status=ERROR`/exception events and logs with
      `severity >= ERROR` into deduped Issues (count, firstSeen, lastSeen,
      sample entries, affected services), updated incrementally on ingest.
      `internal/issues` (fingerprinting/dedup) + `internal/collector/issue_extract.go`
      (OTLP field extraction).
- [x] `GET /api/issues`, `GET /api/issues/{id}`.
- [ ] UI "Issues" tab (lives in the separate frontend/`dist` project — this
      repo's API is ready for it).

## Phase 3 — Frontend error collector (Sentry-style)

- [ ] `static/otel-rum.js`: captures `window.onerror`,
      `unhandledrejection`, resource load failures; translates them to OTLP
      log records client-side and POSTs to the existing `/v1/logs` endpoint
      (so Phase 2's issue derivation picks them up for free via a
      `source: frontend` attribute).
- [ ] CORS support on the OTLP HTTP endpoints (currently absent — required
      for any browser-origin POST).
- [ ] Lightweight ingest key for scoping/rate-limiting noisy pages (not
      real auth).
- [ ] Explicitly out of scope for v1: source map resolution, session
      replay, PII scrubbing.