[CI] (6b2dc8b) tanstack-start/tanstack-start-saas

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 6b2dc8b
App: tanstack-start/tanstack-start-saas
App directory: apps/tanstack-start/tanstack-start-saas
Workbench branch: wizard-ci-6b2dc8b-tanstack-start-tanstack-start-saas
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-01T16:05:32.601Z
Duration: 379.4s

YARA Scanner

✓ 139 tool calls scanned, 0 violations detected

No violations: ✓ 139 clean scans

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR adds PostHog integration to a TanStack Start SaaS invoice management app ("CloudFlow"). It installs posthog-js, @posthog/react, and posthog-node, wraps the app in PostHogProvider, adds two custom event captures for invoice actions, and implements error tracking via captureException in the error boundary and capture_exceptions: true in init options. Environment variables are documented in .env.example.

Files changed	Lines added	Lines removed
6	+59	-5

Confidence score: 4/5 👍

• No user identification implemented: There is no posthog.identify() call anywhere in the app — users will remain anonymous, preventing linking of events across sessions or devices. [CRITICAL]
• No reverse proxy configured: No proxy setup to protect client-side event delivery from ad blockers. [MEDIUM]
• posthog-node installed but unused: The server-side SDK is added to package.json but no server-side code uses it — this is dead weight. [MEDIUM]

---

File changes

Filename	Score	Description
.env.example	4/5	Adds PostHog env vars with placeholder values
package.json	3/5	Adds PostHog SDKs but posthog-node is unused
DefaultCatchBoundary.tsx	4/5	Adds posthog.captureException(error) in a useEffect
__root.tsx	4/5	Wraps app in PostHogProvider with proper config; nice env-var validation
posts..tsx	4/5	Captures invoice_marked_paid with enriched properties
posts.index.tsx	4/5	Captures invoice_created with enriched properties

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	No syntax or import errors; all packages resolve correctly
Preserves existing env vars & configs	Yes	Original configs untouched; PostHog additions are additive
No syntax or type errors	Yes	All JSX/TSX is valid; imports are correct
Correct imports/exports	Yes	posthog-js, @posthog/react imports are valid for client-side use
Minimal, focused changes	No	posthog-node added to dependencies but never used in any changed file
Pre-existing issues	None	Base app appears clean

Issues

• Unused posthog-node dependency: The server-side Node SDK is added to package.json but no server-side code in the PR uses it. This adds unnecessary bundle/install weight. Remove it or add server-side event capture. [MEDIUM]

Other completed criteria

• Environment variables documented in .env.example
• Build configuration valid — package.json dependencies are well-formed

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js, @posthog/react, and posthog-node added to package.json
PostHog client initialized	Yes	PostHogProvider in __root.tsx with apiKey and options including api_host, defaults, capture_exceptions, and debug
capture()	Yes	invoice_created and invoice_marked_paid events with enriched properties
identify()	No	No posthog.identify() call anywhere — users remain permanently anonymous
Error tracking	Yes	captureException(error) in DefaultCatchBoundary + capture_exceptions: true in init for automatic exception capture
Reverse proxy	No	No proxy configuration for client-side event delivery

Issues

• Missing user identification: No posthog.identify() is called on login or app load. All events are anonymous, which prevents building user-level funnels, linking sessions across devices, and connecting frontend events to backend. The app should call identify() when a user is authenticated, and reset() on logout. [CRITICAL]
• No reverse proxy: No reverse proxy is configured for the client-side SDK. Ad blockers may intercept PostHog requests, leading to data loss. Configure a reverse proxy or use PostHog's managed proxy. [MEDIUM]
• Outdated defaults date: The defaults option is set to '2025-05-24' but the current recommended value in PostHog docs is '2026-05-30'. This means the app may not pick up the latest default configuration improvements. [LOW]

Other completed criteria

• API key loaded from environment variable (VITE_PUBLIC_POSTHOG_PROJECT_TOKEN)
• API host loaded from environment variable (VITE_PUBLIC_POSTHOG_HOST)
• Helpful dev-mode error thrown when env vars are missing
• Graceful degradation when PostHog config is absent (renders without provider)

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
posts..tsx	invoice_marked_paid	Captures when a user marks an invoice as paid, with invoice_id and amount properties
posts.index.tsx	invoice_created	Captures when a user creates a new invoice, with invoice_id and amount properties
DefaultCatchBoundary.tsx	captureException	Captures unhandled route errors as exceptions for error tracking
__root.tsx	autocapture + capture_exceptions	PostHogProvider enables autocapture (clicks, pageviews) and automatic exception capture

Issues

• No identify means limited product insights: Without user identification, the invoice_created and invoice_marked_paid events can build basic volume trends but cannot power per-user funnels (e.g., "users who created an invoice and then marked it paid") or retention analysis. [CRITICAL]

Other completed criteria

• Events represent real user actions (creating invoices, marking as paid)
• Events could enable product insights (invoice creation funnel, payment conversion) if identification were added
• Events include relevant enriched properties (invoice_id, amount)
• No PII in event properties
• Event names are descriptive and use consistent snake_case naming

---

Reviewed by wizard workbench PR evaluator