What this is

Incident Log Observatory is an original, offline incident-log workbench inspired only by the observable behavior of the historical Advanced Terminal Log Visualizer. Paste plain text, parse common operational signals, compare grouped, timeline, and raw projections, search safely, and inspect every classification without sending evidence anywhere.

Clean-room boundary

The historical artifact was treated strictly as a black box: only its publicly visible purpose and controls informed this lesson. No source, wording, visual design, assets, or implementation details were copied. The observatory uses an independently designed parser, interface, deterministic fixture, state format, and verification API.

The exact clean-room prompt

Using the public terminal-log visualizer only as a black-box behavioral reference, build an original offline utility. Parse common timestamp, HTTP, warning, error, success, JSON and service patterns; provide grouped, timeline and raw views, search highlighting, counts, copy, clearing and conservative truncated-line repair. Escape input before adding highlight markup.

Why the original pattern needs a security boundary

The original interaction model—paste arbitrary logs, then add visual highlights—creates two injection boundaries even though a black-box review cannot make claims about its private implementation. Log viewers routinely ingest attacker-controlled request paths, user agents, JSON values, exception messages, and terminal output. If a viewer inserts that material with innerHTML, an apparent log line such as an image tag with an error handler can become executable DOM. Building highlighted matches by concatenating markup creates the same risk after a search.

This rebuild never interprets log content as HTML. It assigns ordinary text through text nodes, and its highlighter splits matched ranges into text nodes plus program-created <mark> elements. A restrictive Content Security Policy blocks network access and inline event attributes, while import validation rejects malformed or oversized state. Auto-fix also keeps the original line intact and labels every proposed completion as uncertain.

Acceptance checks

  • A fixed fixture produces predetermined category and service counts.
  • Grouped, timeline and raw views contain the same entries.
  • Search highlights only matching text.
  • Pasted HTML or event-handler strings remain inert.
  • Auto-fix marks uncertain repairs rather than silently altering logs.