fix(telemetry): prevent anonymousId from leaking via npm package

The root layout called getOrCreateAnonymousId() in a Server Component
without marking the route as dynamic. Next.js treated it as static,
pre-rendering the developer's UUID into the standalone build shipped
via npm — so every `npx denchclaw` user shared the same PostHog identity.

- Add `export const dynamic = "force-dynamic"` to root layout
- Replace `process.env.HOME || "~"` fallback with `homedir()` in web
  telemetry and posthog-analytics plugin (Node.js path.join doesn't
  expand "~", creating a relative path under cwd instead)

apps/web/app/layout.tsx

@@ -16,6 +16,8 @@ export const viewport: Viewport = {
   maximumScale: 1,
 };
 
+export const dynamic = "force-dynamic";
+
 export default function RootLayout({
   children,
 }: {

apps/web/lib/telemetry.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 import { PostHog } from "posthog-node";
 
@@ -30,7 +31,7 @@ export function getOrCreateAnonymousId(): string {
   if (_cachedAnonymousId) return _cachedAnonymousId;
 
   try {
-    const stateDir = join(process.env.HOME || "~", ".openclaw-dench");
+    const stateDir = join(process.env.HOME || homedir(), ".openclaw-dench");
     const configPath = join(stateDir, "telemetry.json");
 
     let raw: Record<string, unknown> = {};

extensions/posthog-analytics/lib/privacy.ts

@@ -1,5 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
 import { join, dirname } from "node:path";
 
 const SECRETS_PATTERN =
@@ -10,7 +11,7 @@ const REDACTED = "[REDACTED]";
 function resolveConfigPath(openclawConfig?: any): string {
   const stateDir =
     openclawConfig?.stateDir ??
-    join(process.env.HOME || "~", ".openclaw-dench");
+    join(process.env.HOME || homedir(), ".openclaw-dench");
   return join(stateDir, "telemetry.json");
 }