fix(cli): redact two-segment app ids and use a stable install id for telemetry

[posthog-eu]

Summary

Two contained telemetry-correctness fixes in cli/src/posthog.ts, both independent.

Why

• distinct_id was cli:<version>:<command>, not a person — so "users affected" on every CLI error-tracking issue counted version-by-command pairs, and each release minted a fresh synthetic person. Triage read that number as users when it never meant that.
• The <app_id> scrubber matched only ids with three or more dot-separated segments, so two-segment ids reached the error title raw — App com.phantom already exists. cli/src/analytics/error-category.ts promises telemetry "never leaks error text, paths, or user input"; the exception path must hold to that too.

Changes

Fix	Before	After
App-id scrubber	(?:\.[\w-]+){2,} — needs 3+ segments	(?:\.[\w-]+){1,} — redacts two-segment ids too
distinct_id	cli:${version}:${command}	Anonymous per-install id (UUID), generated once and persisted in the CLI config dir

• The install id holds no personal data and is stable across releases and commands, so one install equals one person. Version and command name still ship as the cli_version and function_name properties.
• A read-only or unwritable HOME (CI, sandbox) falls back to an ephemeral id, so telemetry never breaks.

Scope note: the CLI's usage-analytics events (cli/src/analytics/track.ts) are actor-scoped through the Capgo backend by API key and org id — they carry no PostHog distinct_id. capturePosthogException is the only direct PostHog sender in the CLI, so the install id applies there.

Test plan

• bun run test:posthog-exception — updated to assert the anonymous UUID distinct_id (no version, no command), its persistence, and two-segment app-id redaction (App com.phantom already exists → App <app_id> already exists).
• bun run cli:lint
• bun run cli:typecheck
• bun run cli:build

Screenshots

Not applicable — telemetry payload change only, no user-facing output.

Checklist

• My code follows the code style of this project and passes
  bun run lint:backend && bun run lint.
• My change requires a change to the documentation.
• I have updated the documentation
  accordingly.
• My change has adequate E2E test coverage.
• I have tested my code manually, and I have provided steps how to reproduce
  my tests

Agent context

• Checked for concurrent work: no open PR, issue, or branch targets these two lines. PRs feat(cli): track CLI version headers and admin usage analytics #2906/fix(cli): make CLI usage analytics PR pass CI #2945 ("CLI usage analytics") are a separate server-side feature — they touch cli/src/analytics/, not the PostHog exception path.
• Kept the prescribed {1,} widening rather than a narrower reverse-DNS match: over-redaction is the safe direction (it never leaks), and the message text is not part of the exception fingerprint, so it does not split issues.

---

Created with PostHog Desktop from this inbox report.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing posthog-self-driving/fixcli-redact-2-segment-app-ids-and-fix-a3e2b5 (670fc91) with main (09ad7af)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud