[CI] (6b2dc8b) vue/movies

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 6b2dc8b
App: vue/movies
App directory: apps/vue/movies
Workbench branch: wizard-ci-6b2dc8b-vue-movies
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-01T16:07:44.157Z
Duration: 415.4s

YARA Scanner

✓ 172 tool calls scanned, 0 violations detected

No violations: ✓ 172 clean scans

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR integrates PostHog into a Vue 3 movies app (Vite-based SPA) by adding posthog-js, initializing it in main.js, capturing custom events across several components (sign-in, sign-out, media selection, trailer play, search), and setting up error tracking via app.config.errorHandler. However, it is missing posthog.identify() and posthog.reset() calls, meaning events are never linked to authenticated users.

Files changed	Lines added	Lines removed
9	+80	-3

Confidence score: 5/5 🧙

• Missing posthog.identify() call: The app has authentication (via useAuth composable with a username-based user ID), but identify() is never called after login or on app load when the user is already authenticated. All events remain anonymous. [CRITICAL]
• Missing posthog.reset() on logout: The handleLogout in NavBar.vue captures a user_signed_out event but never calls posthog.reset(), so the next user on the same browser inherits the previous identity. [MEDIUM]
• No reverse proxy configured: The app sends PostHog requests directly to the PostHog host, making them susceptible to ad blockers. [MEDIUM]

---

File changes

Filename	Score	Description
.env.example	4/5	Adds PostHog env var placeholders — correct for Vite (VITE_ prefix)
package.json	5/5	Adds posthog-js dependency
src/main.js	3/5	Initializes PostHog and sets up error handler; missing identify on load
src/views/LoginView.vue	2/5	Captures sign-in event but never calls identify()
src/components/NavBar.vue	2/5	Captures sign-out event but never calls reset()
src/components/media/MediaCard.vue	4/5	Captures media_selected with relevant properties
src/components/media/MediaHero.vue	4/5	Captures trailer_played with media properties
src/views/MediaDetailView.vue	4/5	Captures trailer_played with media properties
src/views/SearchView.vue	4/5	Captures media_search_submitted with result count

---

App sanity check ✅

Criteria	Result	Description
App builds and runs	Yes	Valid JS/Vue syntax, correct Vite env var access pattern
Preserves existing env vars & configs	Yes	No existing configs modified, only PostHog additions
No syntax or type errors	Yes	All changes are syntactically valid
Correct imports/exports	Yes	posthog-js imported correctly as default import in all files
Minimal, focused changes	Yes	All changes relate to PostHog integration
Pre-existing issues	None	—

Issues

No app sanity issues.

Other completed criteria

• Environment variables documented in .env.example with VITE_ prefix
• Build configuration unchanged and valid
• Existing app functionality preserved (search form handler wraps existing search() call)

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js ^1.424.0 added to package.json
PostHog client initialized	Yes	posthog.init() in main.js with env vars and defaults: '2026-01-30'
capture()	Yes	5 meaningful capture calls across login, logout, media selection, trailer play, and search
identify()	No	Never called — the app has auth (useAuth composable with username as user ID) but no identify() after login or on app load
Error tracking	Yes	app.config.errorHandler calls posthog.captureException(error)
Reverse proxy	No	No proxy configured; PostHog requests go directly to PostHog host

Issues

• No posthog.identify() call: The app authenticates users via useAuth() which stores a username. After login, the code should call posthog.identify(user.value, { username: user.value }) to link events to the authenticated user. Without this, all events are anonymous and cannot be tied to specific users. [CRITICAL]
• No posthog.reset() on logout: NavBar.vue handles logout but never calls posthog.reset(). Per PostHog docs, reset() must be called on logout to prevent the next user from inheriting the previous user's identity. [MEDIUM]
• No reverse proxy: Client-side PostHog requests are sent directly to VITE_POSTHOG_HOST, making them vulnerable to ad blockers. A Vite proxy or reverse proxy configuration is recommended. [MEDIUM]

Other completed criteria

• API key loaded from VITE_POSTHOG_PROJECT_TOKEN env var, not hardcoded
• Host loaded from VITE_POSTHOG_HOST env var
• Defensive env var checks prevent initialization without config
• Dev-mode error throws help developers catch misconfiguration early

---

PostHog insights and events ✅

Filename	PostHog events	Description
src/main.js	captureException	Global error handler captures unhandled Vue errors
src/views/LoginView.vue	user_signed_in	Captured on successful login
src/components/NavBar.vue	user_signed_out	Captured before logout
src/components/media/MediaCard.vue	media_selected	Captured with media_id and media_type on card click
src/components/media/MediaHero.vue	trailer_played	Captured with media_id and media_type on hero trailer play
src/views/MediaDetailView.vue	trailer_played	Captured with media_id and media_type on detail page trailer play
src/views/SearchView.vue	media_search_submitted	Captured with result_count after search completes

Issues

• user_signed_in event lacks properties: The sign-in event captures no properties about the user or login method. Even basic context (e.g., login source) would be useful for funnel analysis. [LOW]
• media_search_submitted missing search query: The event includes result_count but not the search query text, which limits search analytics insights. [LOW]

Other completed criteria

• Events represent real user actions (sign in/out, browse, search, play trailer)
• Events enable product insights: can build sign-in → browse → play funnel
• Media events enriched with media_id and media_type properties
• No PII in event properties
• Consistent snake_case naming convention across all events

---

Reviewed by wizard workbench PR evaluator