refactor: compile privacy policies onto rrweb's own masking primitives (Privacy at Capture v2)

[roggernaut]

Summary

Reworks Privacy at Capture (#1) so it matches field-proven practice from the five major session-replay vendors (PostHog, Highlight, Sentry, Amplitude, Mixpanel), resolving all 24 findings from the post-merge review. Design spec and prior-art appendix: docs/superpowers/specs/2026-08-25-privacy-v2-simplification-design.md.

Architecture

• compilePrivacyPolicy now compiles presets/rules onto rrweb's existing masking primitives (selector lists + inherited needsMask propagation). The parallel getPrivacyAction per-node rule engine is deleted (privacy.ts: 936 → ~400 lines).
• legacy (no policy, no plugin) is inert: the perf smoke test asserts zero privacy selector matching on the default path.
• New unmaskTextSelector (record option + allow/unmask rules), nearest-ancestor-wins, with a presence probe restoring subtree short-circuiting when nothing on the page can unmask.
• Cross-vendor mask/unmask/block classes (.rr-mask, .mp-mask, .fs-mask, .amp-mask, .ph-mask, .sentry-mask, …) recognized under non-legacy presets.

Fail-closed hardening

• Per-selector validation at compile (invalid selectors dropped with a warning — one bad selector can no longer poison the merged block list, which previously failed open).
• Mask decisions catch-to-mask; sanitizeUrl strips username:password@ and fails closed on unparseable URLs; malformed plugin-transformed policies fall back to the user's policy instead of crashing record().
• Protected inputs (password/hidden/cc-*/OTP autocomplete) always masked; maskInputFn/maskAttributeFn outputs are constrained under presets (fn controls length, policy is final authority); one attribute-finalization pass covers snapshot, mutation, and added nodes.
• Canvas masking forces the FPS capture path (the unmasked mutation-mode command stream is unreachable); mask regions use content-box math.
• Detectors: fixed whole-value set (email, phone, Luhn card, SSN, IPv4) — custom regex patterns removed (bypassable ReDoS validator with them); detection covers text nodes, live text mutations, and input values, and works under any preset when the plugin is loaded.
• CSS is never masked, on any path (unanimous vendor precedent).

Breaking changes

See .changeset/privacy-v2-simplification.md: @rrweb/types major (union worker params, removed policy fields), needMaskingText signature, whole-value detector semantics, mask-fn composition rules, protected-inputs default, invalid-selector fail-closed.

Review provenance

11 planned tasks, each implemented and reviewed by independent agents with fix rounds (9 Important + 1 Critical finding fixed pre-merge across rounds), plus a whole-branch final review ("merge with fixes" → fix wave verified). Known post-merge backlog (probe caching, srcset sanitization, attribute-sweep early-out, mutation-path unmask e2e coverage, maskInputValue deprecation) is listed in the final review triage.

Test plan

• rrweb-snapshot: 199 passed / 1 skipped (unit + integration + perf smoke)
• rrweb: full suite green modulo two known Puppeteer load flakes (pass in isolation)
• plugin: 4/4; tsc -b clean across the monorepo
• Empirical regex verification (phone formats, adjacency case, ReDoS shapes)

🤖 Generated with Claude Code

Provenance and production mileage

A source-level audit classified every mechanism on this branch against the five vendor codebases (PostHog, Highlight, Sentry, Amplitude, Mixpanel forks/SDKs). Full classification in the review record; summary:

Vendor-proven (a vendor runs essentially the same mechanism in production): selector-list compilation and union merging (Sentry getPrivacyOptions); per-selector validation with drop+warn (Amplitude, near-verbatim); cross-vendor mask/block class recognition (Mixpanel); the input-masking composition core incl. star-over-fn (Sentry) and always-masked protected inputs (Mixpanel/Amplitude/Sentry); the attribute finalization sweep, late-write guard, generated-attribute exemption, and maskAll-over-fn precedence (PostHog fork, near-verbatim); the title/placeholder/aria-label masked-attribute defaults (Sentry); canvas mask regions, worker fillRect, and snapshot suppression (PostHog fork); whole-node text-detector masking on snapshot AND live characterData mutations (Highlight fork).

Inspired (concept proven, implementation ours): the preset/rules policy translation itself; unmask-in-the-walk with nearest-ancestor semantics; '*'-as-fallback demotion; SSN/card/email/IPv4 patterns (derived with corrections); data-privacy enumerated attribute; unconditional catch-to-mask (stricter than every vendor); untaintedTagName (proven accessor machinery, new target); strict media-source attribute nulling (Highlight does element-level).

Invented here — no production mileage anywhere (review these hardest):

• DOM-attribute URL sanitization in its entirety (no vendor sanitizes URLs in the recorded DOM): strict-masks-all-params, userinfo stripping, synthetic-base relative round-trip, fail-closed ''
• The unmask-selector presence probe (resolveUnmaskTextSelector, shadow-recursive, per snapshot/flush) and the mask-all selector cache
• The phone pattern + digit-count gate; the MAX_SCAN_LENGTH mask-everything cliff
• Detector scanning of input values (incl. per-keystroke) — Highlight scans text nodes only
• maskAttributeFn as a pipeline stage (vendors treat it as terminal), fn try/catch-to-stars, non-string-to-stars
• The versioned policy schema itself; the plugin applyPrivacyPolicy hook and its compile fallback
• resolveCanvasSampling coercion; content-box mask scaling; the tracked-shadow-roots canvas registry
• FORM_VALUE_TAGS gating of mutation value masking; rr_src through URL/media policy; strict forcing recordCanvas off

[roggernaut]

Superseded by #3 (renamed to the standard's name, Privacy at Capture, and carrying the post-audit hardening). The stacked merge set — privacy-at-capture-core plus three experimental layers — will follow from #3.