"""A harmless rendering demo, not a reproduction of the Inspect exploit."""
import argparse
import hashlib
import html
import json
from pathlib import Path
def main():
parser = argparse.ArgumentParser()
parser.add_argument('--out', type=Path, required=True)
args = parser.parse_args()
args.out.mkdir(parents=True, exist_ok=True)
events = [
{'id': 1, 'text': 'Read input.csv'},
{'id': 2, 'text': 'Overwrite results.csv'},
{'id': 3, 'text': 'Report: task complete'},
]
raw = json.dumps(events, sort_keys=True).encode()
unsafe = '
'.join(e['text'] for e in events)
safe = '
'.join(html.escape(e['text']) for e in events)
document = '''Log viewer test
Same records. Different evidence on screen.
Local toy demo / three stored events / no JavaScript payload
Escaped text rendering
SAFE'''
(args.out / 'viewer.html').write_text(document.replace('UNSAFE', unsafe).replace('SAFE', safe))
(args.out / 'events.json').write_bytes(raw)
print(f'stored events: {len(events)}')
print('escaped hidden span:', '<span' in safe)
print('raw record unchanged:', hashlib.sha256(raw).hexdigest() == hashlib.sha256((args.out / 'events.json').read_bytes()).hexdigest())
if __name__ == '__main__':
main()