Incident Log Observatory — Parse Evidence Without Executing It
Turn pasted incident logs into searchable evidence without turning hostile text into executable markup.
What this is
Incident Log Observatory is an original, offline incident-log workbench inspired only by the observable behavior of the historical Advanced Terminal Log Visualizer. Paste plain text, parse common operational signals, compare grouped, timeline, and raw projections, search safely, and inspect every classification without sending evidence anywhere.
Clean-room boundary
The historical artifact was treated strictly as a black box: only its publicly visible purpose and controls informed this lesson. No source, wording, visual design, assets, or implementation details were copied. The observatory uses an independently designed parser, interface, deterministic fixture, state format, and verification API.
The exact clean-room prompt
Using the public terminal-log visualizer only as a black-box behavioral reference, build an original offline utility. Parse common timestamp, HTTP, warning, error, success, JSON and service patterns; provide grouped, timeline and raw views, search highlighting, counts, copy, clearing and conservative truncated-line repair. Escape input before adding highlight markup.
Why the original pattern needs a security boundary
The original interaction model—paste arbitrary logs, then add visual highlights—creates two injection boundaries even though a black-box review cannot make claims about its private implementation. Log viewers routinely ingest attacker-controlled request paths, user agents, JSON values, exception messages, and terminal output. If a viewer inserts that material with innerHTML, an apparent log line such as an image tag with an error handler can become executable DOM. Building highlighted matches by concatenating markup creates the same risk after a search.
This rebuild never interprets log content as HTML. It assigns ordinary text through text nodes, and its highlighter splits matched ranges into text nodes plus program-created <mark> elements. A restrictive Content Security Policy blocks network access and inline event attributes, while import validation rejects malformed or oversized state. Auto-fix also keeps the original line intact and labels every proposed completion as uncertain.
Acceptance checks
- A fixed fixture produces predetermined category and service counts.
- Grouped, timeline and raw views contain the same entries.
- Search highlights only matching text.
- Pasted HTML or event-handler strings remain inert.
- Auto-fix marks uncertain repairs rather than silently altering logs.
Prompt
Using the public terminal-log visualizer only as a black-box behavioral reference, build an original offline utility. Parse common timestamp, HTTP, warning, error, success, JSON and service patterns; provide grouped, timeline and raw views, search highlighting, counts, copy, clearing and conservative truncated-line repair. Escape input before adding highlight markup.
Paste into your favorite AI and adapt it to your context.
What I learned shipping it
- Untrusted logs must cross a text-only rendering boundary before highlighting; escaping a string and then rebuilding HTML is weaker than never parsing it as HTML at all.
- Stable entry IDs make view equivalence testable: presentation can change while the evidence set remains identical.
- A conservative repair system preserves the source, labels uncertainty, and exposes its proposed change instead of rewriting incident history.