v0.4.0

Added

• ?format=json on /, /sessions, /search, /traces/{id} and /spans/{trace}/{span} for agents and scripts. Lists take limit (default 20, max 50) and return a keyset next_cursor; /search is now pageable. Span input, output and attributes are windowed by character with field, offset, len (default 2000, max 20000) and next_offset, and flag invalid UTF-8 with invalid_utf8. These requests accept Authorization: Bearer <AUTH_TOKEN> and return JSON errors.
• Agent skill in skills/spanbox/ that reads traces coarse to fine, with e2e.sh running every skill command against a fresh binary.
• NDJSON export and import for spans.
• ChatGPT-authenticated Codex proxy vendor, including compressed requests.
• Named OpenAI-compatible upstreams (OPENAI_COMPAT_UPSTREAMS).
• Herdr pane trace tags via X-Spanbox-Session.
• AUR spanbox-bin package published on release.
• CA certificates in the container image; staticcheck in CI.

Changed

• Proxy spans are captured asynchronously with capped response buffering.
• Parsed templates and static vendor assets are cached.
• Dashboard total and daily trace queries merged into one scan.
• Trace model filter matches spans instead of a denormalized string.
• Ad-hoc SQL runs on an isolated reader pool.

Fixed

• OTLP/JSON accepts spec hex-encoded trace and span IDs, not only base64.
• Shutdown drain, an Anthropic delta panic and an unbounded retention purge.
• Large SSE lines in proxy capture; zstd decoder reuse.