#!/usr/bin/env python3 """Serve exact official frontends to a local Chromium audit, with all actions denied. Open the printed loopback URL with T3's collaborative browser. Run `runAudit()` in the page, then inspect `results` or download its JSON. This is initialization evidence only. No official Python/native backend is imported or executed. """ import argparse import hashlib import io from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer import json from pathlib import Path import sys from unittest.mock import patch import zipfile ROOT = Path(__file__).resolve().parents[1] sys.path.insert(0, str(ROOT/'ui')) import framey_panel PRELUDE = '''''' PAGE = '''Framey catalog frontend audit

Framey catalog frontend audit

Exact archived frontend code runs in an opaque iframe. All backend calls and network requests are denied. Ready means initializer completion, not useful plugin behavior. No plugin backend executes.

''' def main(): parser = argparse.ArgumentParser(description=__doc__) parser.add_argument('--cache', type=Path, required=True) parser.add_argument('--catalog', type=Path, default=ROOT/'ui/framey-compatibility.json') parser.add_argument('--port', type=int, default=18765) parser.add_argument('--library-snapshot', type=Path, help='Optional detached Steam library JSON; replay only, not live Steam/backend evidence') parser.add_argument('--running-snapshot', type=Path, help='Optional detached running-app JSON; replay only, not live Steam/backend evidence') args = parser.parse_args() plugins = json.loads(args.catalog.read_text())['plugins'] records = {p['id']: p for p in plugins} library = None if args.library_snapshot: raw = args.library_snapshot.read_bytes() if len(raw) > 2*1024*1024: parser.error('library snapshot exceeds 2 MiB') library = json.loads(raw) running = None if args.running_snapshot: raw = args.running_snapshot.read_bytes() if len(raw) > 256*1024: parser.error('running snapshot exceeds 256 KiB') running = json.loads(raw) class Handler(BaseHTTPRequestHandler): def log_message(self, *_): pass def do_GET(self): path = self.path.split('?')[0] content_type = 'text/html; charset=utf-8' module_asset = False if path == '/': # Only names/IDs are needed by the UI; never embed raw executable source. catalog = json.dumps([{'id': p['id'], 'name': p['name']} for p in plugins]).replace('<', '\\u003c') body = PAGE.replace('CATALOG_DATA', catalog).replace( 'LIBRARY_DATA', json.dumps(library).replace('<', '\\u003c')).replace( 'RUNNING_DATA', json.dumps(running).replace('<', '\\u003c')).encode() elif path.startswith('/panel/'): try: record = records[int(path.split('/')[-1])] data = (args.cache/(record['sha256']+'.zip')).read_bytes() if hashlib.sha256(data).hexdigest() != record['sha256']: raise ValueError('Archive hash mismatch') with zipfile.ZipFile(io.BytesIO(data)) as archive: bundle = archive.read(record['folder']+'/dist/index.js') with patch.object(framey_panel, 'local_bundle', return_value=bundle): body = framey_panel.panel(record['id']).replace( b'