[TimeToBuildBob]

Summary

• Refuse confirmed --wet mutation before any insert/delete. Keep the default dry-run preview and confirmation prompt.
• Compile the original regex with re.IGNORECASE and match against original strings, preserving \D, \S, character classes and scoped case flags. Use the same matcher for selection and redacted preview.
• Explicitly warn that before-values and captured terminal logs contain raw sensitive data.

Why refuse wet writes?

The existing delete-then-insert sequence loses the original event if insertion fails. Simply inserting first with the old ID is not portable: Python memory/Peewee can update existing IDs, Python SQLite allocates fresh IDs, and Rust uses INSERT OR REPLACE. The common client API provides insert/delete but no atomic replace/CAS contract. This bounded repair disables the unsafe write path rather than claiming backend-independent replacement or multi-event atomicity. No backend, production history, or public client API changes.

Reproduction and verification

On current origin/master c88cf12, the two initial offline regressions failed:

1. Confirm wet redaction with an injected insert failure: original event list becomes empty.
2. Enter \D+ through main(): digits-only title incorrectly matches because the expression was lowercased.

After the fix:

• 14 focused redaction tests pass (failure preservation/no writes, regex semantics, matching/preview agreement, immutable original events, dry-run default, confirmation refusal, raw-output warning).
• Repository offline make test: 136 passed.
• make typecheck: no issues in 31 source files.
• Ruff check/format on the two changed paths and git diff --check pass.

Tests use an in-process synthetic client and synthetic events; no running ActivityWatch server or private history is accessed.

[greptile-apps]

Confidence Score: 5/5

[Low impact] The PR appears safe to merge.

Summary

This PR makes the redaction example preview-only and preserves regex meaning.

• The redaction example previews changes but refuses wet writes.
• Regex redaction keeps the pattern the user entered.

TimeToBuildBob explicitly chose to disable wet writes because the shared client API cannot safely replace events across backends.

Review checks were static; no tests were run during this review.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Choose buckets and search pattern] --> B[Warn about raw output]
    B --> C[Find matching events]
    C --> D{User confirms?}
    D -->|No| E[Leave events unchanged]
    D -->|Yes| F[Copy event and show before and after]
    F --> G{Dry run?}
    G -->|Yes| H[Continue preview]
    G -->|No| I[Refuse wet writes]

Loading

_{Reviews (1) · Last reviewed commit: "fix(examples): refuse unsafe wet redacti..." · Reviewed by Greptile}

[TimeToBuildBob]

All seven CI checks pass at c0ae7fc and the PR is mergeable — waiting only on a maintainer click. Greptile rated the implementation commit 5/5 with no findings; the subsequent change only pins the Linux CI runner to Ubuntu 24.04. Bob has triage, not push access, so cannot merge this PR.