[CI] (6b2dc8b) tanstack-router/tanstack-router-code-based-saas

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 6b2dc8b
App: tanstack-router/tanstack-router-code-based-saas
App directory: apps/tanstack-router/tanstack-router-code-based-saas
Workbench branch: wizard-ci-6b2dc8b-tanstack-router-tanstack-router-code-based-saas
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-01T16:02:52.553Z
Duration: 361.3s

YARA Scanner

✓ 129 tool calls scanned, 0 violations detected

No violations: ✓ 129 clean scans

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR adds PostHog integration to a TanStack Router code-based SaaS app (client-only React SPA). It installs posthog-js and @posthog/react, initializes PostHog via PostHogProvider, adds error tracking with PostHogErrorBoundary and capture_exceptions, and captures five custom events across invoice and auth flows. However, it omits user identification despite the app having a login system, and does not configure a reverse proxy.

Files changed	Lines added	Lines removed
4	+79	-10

Confidence score: 5/5 🧙

• Missing posthog.identify() on login: The app has a working auth system (auth.login(username)) and the username is available in route context, yet posthog.identify() is never called. This means all events are anonymous and cannot be tied to specific users, severely limiting analytics value. Add posthog.identify(username, { username }) after auth.login() and posthog.reset() before auth.logout(). [CRITICAL]
• No reverse proxy configured: This is a client-only SPA using posthog-js in the browser. Without a reverse proxy, ad blockers will intercept PostHog requests, causing silent data loss. Configure Vite's proxy or a hosting-level rewrite to route /ingest/* through a first-party endpoint. [MEDIUM]
• Several events lack properties: user_logged_in, user_logged_out, and subscription_upgrade_started are bare captures with no contextual properties, reducing their analytical value. [MEDIUM]

---

File changes

Filename	Score	Description
.env.example	5/5	Adds PostHog env vars with placeholder values
package.json	5/5	Adds posthog-js and @posthog/react dependencies
src/main.tsx	3/5	PostHog initialization, error boundary, 5 custom events — but missing identify/reset
tsconfig.json	5/5	Adds vite/client types for import.meta.env support

---

App sanity check ✅

Criteria	Result	Description
App builds and runs	Yes	No syntax errors, valid JSX, correct imports
Preserves existing env vars & configs	Yes	Existing code is wrapped, not removed or altered
No syntax or type errors	Yes	All changes are syntactically valid TypeScript/JSX
Correct imports/exports	Yes	PostHogProvider, PostHogErrorBoundary, usePostHog correctly imported from @posthog/react
Minimal, focused changes	Yes	All changes are PostHog-related
Pre-existing issues	None	—

Issues

No issues.

Other completed criteria

• Environment variables documented in .env.example
• tsconfig.json updated for vite/client types to support import.meta.env
• Build configuration valid — package.json deps are well-formed
• Dev-only guard throws helpful error if env vars are missing

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js ^1.424.0 and @posthog/react ^1.10.5 added to package.json
PostHog client initialized	Yes	PostHogProvider wraps the root component with apiKey and api_host from env vars; capture_exceptions and debug mode configured
capture()	Yes	5 custom events: invoice_created, invoice_updated, subscription_upgrade_started, user_logged_in, user_logged_out
identify()	No	App has auth system with auth.login(username) but never calls posthog.identify() or posthog.reset()
Error tracking	Yes	PostHogErrorBoundary wraps app content + capture_exceptions with capture_unhandled_errors and capture_unhandled_rejections enabled
Reverse proxy	No	No proxy configured; browser requests go directly to PostHog host

Issues

• Missing user identification: The app has a login flow (auth.login(username)) and exposes username in route context, but never calls posthog.identify(). All events remain anonymous, making it impossible to build user-level funnels or retention charts. Call posthog.identify(username, { username }) immediately after login, and posthog.reset() before logout. [CRITICAL]
• No reverse proxy: Client-side PostHog requests will be blocked by ad blockers. Configure a reverse proxy (e.g., via Vite dev server proxy + hosting rewrites) to route through a first-party domain. Both /static/* and /array/* must route to the assets origin. [MEDIUM]
• Outdated defaults value: The defaults option is set to '2026-01-30' but the latest documented value is '2026-05-30'. This means the SDK uses older default settings. [LOW]

Other completed criteria

• API key loaded from VITE_PUBLIC_POSTHOG_PROJECT_TOKEN env var (not hardcoded)
• API host loaded from VITE_PUBLIC_POSTHOG_HOST env var
• Graceful fallback: if env vars are missing, PostHogRoot renders children without PostHog (no crash in production)
• Dev-mode throws helpful errors when env vars are missing

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
src/main.tsx	invoice_created	Captured on successful invoice creation with invoice_id property
src/main.tsx	invoice_updated	Captured on successful invoice update with invoice_id property
src/main.tsx	subscription_upgrade_started	Captured on upgrade button click — no properties
src/main.tsx	user_logged_in	Captured after login — no properties
src/main.tsx	user_logged_out	Captured before logout (2 locations) — no properties
src/main.tsx	captureException	Via PostHogErrorBoundary and capture_exceptions config for unhandled errors/rejections

Issues

• Bare event captures: user_logged_in, user_logged_out, and subscription_upgrade_started have no properties. Adding context (e.g., { username } for login/logout, { current_plan: 'free' } for upgrade) would significantly improve analytical value. [MEDIUM]

Other completed criteria

• Events represent real user actions (login, logout, invoice CRUD, upgrade intent)
• Events enable product insights — can build login → create invoice → upgrade funnel
• No PII in event properties (only invoice_id)
• Event naming is descriptive and consistently uses snake_case

---

Reviewed by wizard workbench PR evaluator