feat(privacy-filter): capture-group replacement in redact

[TimeToBuildBob]

Summary

Follow-up to #659: redact currently replaces the whole field with a static string. Awatcher filters let you extract capturing groups and put them in the replacement ($1, $name). This adds the same, opt-in via the replacement template.

Capture substitution runs only when the pattern has capturing groups and replacement contains a real capture template ($1, $name, ${name}) whose every $ ref names a group that exists and participates in every match. $0 / ${0} (whole-match identity), dangling refs, empty ${}, unmatched alternation/optional groups, and mixed malformed templates ($1$, $1$&) stay whole-field. Static replacements keep whole-field redaction even if the pattern has groups — so existing stored rules like (token) + REDACTED do not switch to replace_all and leak unmatched text.

Example (same as the awatcher README):

• pattern: ● (.*)
• replacement: $1
• "● file.rs - Visual Studio Code" → "file.rs - Visual Studio Code"

Also works for URL path stripping: https://([^/]+)/.* + https://$1/ keeps the host.

Test plan

• cargo test -p aw-datastore --lib privacy_filter (30 passed)
• Save a redact rule with a capturing group and $1 / $name replacement in the webui
• Confirm a no-capture / static-replacement rule still replaces the whole field

[greptile-apps]

Greptile Summary

The PR adds opt-in capture-group substitution for privacy-filter redaction while retaining whole-field replacement for static or invalid templates.

• Parses numeric and named capture references in replacement templates.
• Requires referenced captures to participate in every match before using partial replacement.
• Adds regression coverage for static replacements, invalid references, group zero, and unmatched captures.

Confidence Score: 3/5

The PR is not yet safe to merge because malformed mixed capture templates can leave sensitive event-field content unredacted.

The replacement parser can accept an earlier valid capture after encountering a dangling or unsupported dollar form, causing replace_all to preserve unmatched sensitive content at the datastore privacy boundary.

Files Needing Attention: aw-datastore/src/privacy_filter.rs

Security Review

A mixed template containing a valid capture plus a dangling or unsupported dollar reference can still enable partial replacement, leaving unmatched sensitive field content in events persisted through the privacy boundary.

Important Files Changed

Filename	Overview
aw-datastore/src/privacy_filter.rs	Adds capture-aware redaction and extensive tests, but mixed malformed templates can bypass the intended fail-closed behavior.

_{Reviews (4): Last reviewed commit: "fix(privacy-filter): reject $0 and unmat..." | Re-trigger Greptile}

[codecov]

Codecov Report

❌ Patch coverage is 97.18310% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.81%. Comparing base (656f3c9) to head (0de5164).
⚠️ Report is 93 commits behind head on master.

Files with missing lines	Patch %	Lines
aw-datastore/src/privacy_filter.rs	97.18%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #665      +/-   ##
==========================================
+ Coverage   70.81%   78.81%   +8.00%     
==========================================
  Files          51       66      +15     
  Lines        2916     5524    +2608     
==========================================
+ Hits         2065     4354    +2289     
- Misses        851     1170     +319     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[TimeToBuildBob]

@greptileai review

[TimeToBuildBob]

@greptileai review

[TimeToBuildBob]

@greptileai review

[TimeToBuildBob]

Greptile convergence adjudication

Hit the re-review cap. Not triggering another Greptile review.

Fixed this session

• P1 Malformed templates enable partial redaction ($1$, $1$&): the parser skipped a dangling/unsupported $ after accepting $1, which still enabled replace_all and leaked unmatched field text (token=abc → token=). 0de5164 fail-closes any unparsed $. $1$$ (group + literal dollar) still substitutes.
• Local verification: cargo test -p aw-datastore --lib privacy_filter — 30 passed.

Earlier rounds (already on the branch)

• Capture substitution is opt-in via $1/$name, not “pattern has groups”
• Empty ${}, $0/${0}, dangling $N, unmatched alternation groups, and Perl $&/$``/$'` all stay whole-field

Remaining

• None blocking that I can reproduce. The 3/5 score is stale (last review was 621008b). Not chasing a 5/5 — four rounds each produced a new P1 at the same fail-closed boundary.

CI

• 621008b: all green
• 0de5164: format green; build/clippy/coverage still in flight (not watching)

Domain risk

Privacy-filter is a datastore boundary. Maintainer should sanity-check: (1) static REDACTED on a capturing pattern stays whole-field, (2) $1=REDACTED still replace_all, (3) malformed $1$ / $1$& stay whole-field. Existing stored rules without $N in the replacement are unchanged.

Convergence

round_convergence.status=new_blocking, stable_rounds=0 (required 2). Four rounds, four distinct P1 keys, each a new blocking finding. Cap hit. Stopping re-triggers.

Merge-ready does not mean auto-merge — maintainer judgment.