fix(query): support select_keys in regex rules

[TimeToBuildBob]

Summary

• parse optional select_keys on regex classification rules
• restrict regex matching to the selected event fields when provided
• cover parser validation plus legacy and selected-key behavior in tests

Closes #604

Testing

• cargo test -p aw-transform -p aw-query

[greptile-apps]

Greptile Summary

This PR adds a select_keys option to regex classification rules, allowing the regex to be matched only against specific event data fields rather than all string values. The parser in datatype.rs validates the field, RegexRule stores it, and matches() dispatches to a new value_matches() helper that safely handles non-string fields with unwrap_or(false).

• aw-transform/src/classify.rs: RegexRule gains a select_keys: Option<Vec<String>> field; matches() now iterates only the named keys (or all values when None); an empty-list guard in new() prevents silent no-match rules.
• aw-query/src/datatype.rs: Parses the optional select_keys list from the rule object, validating that each element is a string.
• aw-query/tests/query.rs + classify.rs tests: New tests cover per-key matching, missing/non-string key handling, and invalid-type parser errors.

Confidence Score: 5/5

Safe to merge; the feature logic is correct and the existing test suite covers all new code paths.

The select_keys parsing, dispatch, and empty-list guard all work correctly. The one notable rough edge is that an empty list provided at the query layer produces a misleading "Failed to compile regex string" error instead of InvalidFunctionParameters, but this does not affect normal usage or data correctness.

aw-query/src/datatype.rs — the empty select_keys path leaks a regex-compile error type/message rather than an InvalidFunctionParameters one.

Important Files Changed

Filename	Overview
aw-transform/src/classify.rs	Adds select_keys support to RegexRule: new field, helper value_matches(), updated matches() dispatch, and empty-list validation. Logic is correct; minor concern about using fancy_regex::Error to signal a non-regex validation failure.
aw-query/src/datatype.rs	Parses optional select_keys from the rule DataType map; validates it is a list of strings. Empty list is not checked here, so it falls through to RegexRule::new() where it produces a fancy_regex::Error that gets wrapped as QueryError::RegexCompileError with a misleading "Failed to compile regex string" message.
aw-query/tests/query.rs	Good integration tests added: valid select_keys behavior, non-list type error, mixed-type list error. No integration test for the empty-list case.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["TryFrom for Rule"] --> B{select_keys present?}
    B -- None --> E[select_keys = None]
    B -- "Some, not a List" --> F["Err: InvalidFunctionParameters 'not a list'"]
    B -- "Some(List)" --> C{all items strings?}
    C -- No --> G["Err: InvalidFunctionParameters 'must contain only strings'"]
    C -- Yes --> D{list empty?}
    D -- "Yes (current)" --> H["fancy_regex::Error wrapped as RegexCompileError"]
    D -- "Yes (suggested)" --> I["Err: InvalidFunctionParameters 'must not be empty'"]
    D -- No --> E
    E --> J["RegexRule::new()"]
    J --> K["matches(): Some keys or all values"]

Loading

_{Reviews (3): Last reviewed commit: "fix(classify): validate empty select_key..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.71%. Comparing base (656f3c9) to head (a21e9ee).
⚠️ Report is 52 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #605      +/-   ##
==========================================
+ Coverage   70.81%   76.71%   +5.90%     
==========================================
  Files          51       61      +10     
  Lines        2916     4858    +1942     
==========================================
+ Hits         2065     3727    +1662     
- Misses        851     1131     +280     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[TimeToBuildBob]

Addressed the two Greptile findings:

1. unwrap() on is_match() (value_matches): Changed to unwrap_or(false) — regex match errors (e.g. malformed regex at runtime) now return false instead of panicking.

2. Empty select_keys list: Added validation in RegexRule::new() that rejects empty select_keys with a ParseError instead of silently producing a never-matching rule. Added a regression test test_rule_select_keys_empty_list.

Verification: cargo test -p aw-transform --lib — 39 passed, 0 failed.

[TimeToBuildBob]

CI is green and the two Greptile review threads are resolved.

I tried to merge this with a squash commit from this session, but the current GitHub token does not have permission to merge PRs in ActivityWatch/aw-server-rust, so a maintainer needs to press merge.