feat: add first-party Tinybird analytics

[richiemcilroy]

Summary

• Add a strict, bounded first-party product analytics path for web, desktop, and mobile checkout attribution.
• Replace PostHog completely with Tinybird-backed ingestion for signup, checkout, paid purchase, trial, organization expansion, and core recording events.
• Remove PostHog clients, dependencies, bootstrap and feature-flag plumbing, environment variables, and CI/release secrets.
• Add Tinybird Docker infrastructure, safe CI deployment, retry-safe aggregates, and read-only agent queries.

Validation

• pnpm analytics:test — 152 tests passed
• pnpm --filter @cap/web test --run __tests__/unit/mobile-checkout.test.ts — 7 tests passed
• pnpm typecheck
• cargo fmt --all
• cargo check -p cap-desktop with the repository FFmpeg 7 toolchain
• cargo test -p cap-desktop product_analytics --lib — 9 tests passed
• Scoped Biome checks, diff checks, and a repository-wide PostHog residue scan passed

Greptile Summary

This PR replaces PostHog with first-party Tinybird product analytics. The main changes are:

• Tinybird-backed web event ingestion and server-side analytics helpers.
• Desktop and mobile checkout attribution updates.
• Analytics CI, local Docker tooling, deploy checks, and Tinybird datafiles.
• Removal of PostHog clients, dependencies, and environment wiring.

Confidence Score: 4/5

This is close, but the remaining replay path should be fixed before merging.

• Anonymous web analytics can still be written with a copied browser token and spoofed request metadata.
• The latest checks limit the accepted event names, but they do not bind the token to a server-verifiable browser or session.
• The deploy workspace check now compares the token workspace id with the configured workspace id.

Files Needing Attention: apps/web/app/api/events/route.ts

Security Review

The anonymous analytics endpoint still accepts replayed browser tokens for allowlisted web events, which can let raw clients append fabricated anonymous product events.

Important Files Changed

Filename	Overview
apps/web/app/api/events/route.ts	Adds the product analytics ingestion route with browser-token, actor, rate-limit, normalization, and append logic.
apps/web/lib/analytics/request.ts	Adds request metadata checks, anonymous event allowlisting, payload normalization, geo normalization, and fallback rate-limit keying.
apps/web/lib/analytics/browser-token.ts	Adds signed, expiring browser analytics tokens for anonymous web ingestion.
scripts/analytics/tooling.js	Adds Tinybird analytics validation, local tooling, cloud deploy planning, and workspace-id checks.

Prompt To Fix All With AI

### Issue 1
apps/web/app/api/events/route.ts:134-143
**Browser Token Replay**
This anonymous branch still accepts replayed browser tokens from raw HTTP clients. A visitor can receive a valid `cap_analytics_browser_token`, copy that cookie value, then post to `/api/events` for the next hour with `Origin: https://cap.so`, `Sec-Fetch-Site: same-origin`, and a payload whose `anonymousId` matches the token. The request has no authenticated actor, but this check still allows the batch as long as the event names are in the anonymous allowlist. Those rows are appended with attacker-controlled path, referrer, session, and properties, so anonymous funnel metrics can be polluted without a server-verifiable browser or session check.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (13): Last reviewed commit: "fix: normalize Tinybird health query tim..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

Context used:

• Context used - CLAUDE.md (source)
• Context used - AGENTS.md (source)

[superagent-security]

Superagent found 1 security concern(s).

[richiemcilroy]

hey @greptileai, please re-review the PR

[richiemcilroy]

hey @greptileai, please re-review the PR

[richiemcilroy]

hey @greptileai, please re-review the PR

[richiemcilroy]

hey @greptileai, please re-review the PR

[superagent-security]

Superagent found 4 supply chain issue(s)

[superagent-security]

P1: actions/upload-artifact@ea165f8 has 5 supply-chain risks

Superagent correlated 5 risks for this dependency. Top signal: Detects suspicious autostart persistence mechanisms. Location: upload-artifact-ea165f8d65b6e75b540449e92b4886f43607f…

Review actions/upload-artifact@ea165f8 before merging. Remove or replace it if this behavior is unexpected.

AI prompt

Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.

<file name=".github/workflows/analytics-recovery-30731913704.yml">
<violation number="1" location=".github/workflows/analytics-recovery-30731913704.yml:141">
<priority>P1</priority>
<title>actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 has 5 supply-chain risks</title>
<evidence>Superagent correlated 5 risks for this dependency. Top signal: Detects suspicious autostart persistence mechanisms. Location: upload-artifact-ea165f8d65b6e75b540449e92b4886f43607fa02/dist/merge/index.js. Rules: threat-filesystem-autostart. Rules: threat-filesystem-autostart, threat-runtime-obfuscation-base64exec, threat-runtime-obfuscation-steganography

Dependency path: .github/workflows/analytics-recovery-30731913704.yml → jobs → recover → steps → 9 → actions/upload-artifact</evidence>
<recommendation>Review actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 before merging. Remove or replace it if this behavior is unexpected.</recommendation>
</violation>
</file>