[CI] (963eeb8) tanstack-start/tanstack-start-saas

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 963eeb8
App: tanstack-start/tanstack-start-saas
App directory: apps/tanstack-start/tanstack-start-saas
Workbench branch: wizard-ci-963eeb8-tanstack-start-tanstack-start-saas
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-03T18:43:37.697Z
Duration: 309.9s

YARA Scanner

✓ 134 tool calls scanned, 0 violations detected

No violations: ✓ 134 clean scans

[wizard-ci-bot]

PR Evaluation Report

Summary

This PR integrates PostHog into a TanStack Start SaaS invoice app using posthog-js via PostHogProvider in the root route. It adds custom event captures for invoice actions (invoice_created, invoice_marked_paid), error tracking via captureException in the catch boundary plus automatic exception capture, and documents environment variables in .env.example. User identification is not implemented.

Files changed	Lines added	Lines removed
7	+65	-0

Confidence score: 4/5 👍

• No identify() call: The app has no user identification anywhere. For a SaaS invoicing app with user actions, this is a significant gap — all events will remain anonymous and cannot be tied to specific users. [CRITICAL]
• No reverse proxy configured: No reverse proxy is set up, making client-side events susceptible to ad blockers. [MEDIUM]
• Unused posthog-node dependency: posthog-node is added to package.json but never imported or used in any changed file, adding unnecessary bundle weight to the server. [MEDIUM]

---

File changes

Filename	Score	Description
.env.example	5/5	Documents PostHog env vars correctly
package.json	3/5	Adds posthog-js (needed) and posthog-node (unused)
DefaultCatchBoundary.tsx	4/5	Adds captureException via useEffect — functional but missing optional chaining on posthog
__root.tsx	4/5	PostHogProvider setup with env var validation and fallback. Uses older defaults date
posts..tsx	5/5	Captures invoice_marked_paid with enriched properties in event handler
posts.index.tsx	5/5	Captures invoice_created with enriched properties in event handler
posts_..deep.tsx	5/5	Captures invoice_marked_paid with enriched properties in event handler

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	No syntax errors or missing imports that would prevent build
Preserves existing env vars & configs	Yes	Existing code preserved; RootDocument refactored cleanly into RootDocument + RootDocumentContent
No syntax or type errors	Yes	All code is syntactically valid
Correct imports/exports	Yes	posthog-js/react exports PostHogProvider and usePostHog correctly
Minimal, focused changes	No	posthog-node added to dependencies but never used
Pre-existing issues	None

Issues

• Unused posthog-node dependency: Added to package.json but not imported or used anywhere in the changed files. Should be removed unless server-side capture is planned. [MEDIUM]
• Missing optional chaining in catch boundary: posthog.captureException(error) in DefaultCatchBoundary doesn't use optional chaining. When env vars are missing, PostHogProvider is absent and usePostHog() returns undefined, causing a runtime error. Use posthog?.captureException(error). [LOW]

Other completed criteria

• All changes are relevant to PostHog integration
• Correct files modified for TanStack Start framework (root route, route components, catch boundary)
• Code follows existing codebase patterns (naming, structure, indentation)
• Environment variables documented in .env.example
• Build configuration is valid

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js ^1.425.1 added to package.json
PostHog client initialized	Yes	PostHogProvider with apiKey and options in __root.tsx, with env var validation and graceful fallback
capture()	Yes	invoice_created and invoice_marked_paid events in route event handlers
identify()	No	No identify() call anywhere in the codebase — all events remain anonymous
Error tracking	Yes	capture_exceptions: true in init config for automatic capture + manual captureException in DefaultCatchBoundary
Reverse proxy	No	No reverse proxy configured

Issues

• No user identification: The app is a SaaS invoicing tool where users create and manage invoices — a clear authenticated context. Yet there is no posthog.identify() call after login or on app load. All captured events are anonymous and cannot be associated with specific users, making analytics significantly less useful. Add identify() with the user's stable ID when authentication state is available. [CRITICAL]
• No reverse proxy: No reverse proxy is configured for client-side event delivery. Events from posthog-js are sent directly to us.i.posthog.com (or the configured host), making them susceptible to ad blockers. [MEDIUM]
• Older defaults date: defaults: '2025-05-24' is used instead of the current recommended '2026-05-30', meaning older default configuration values apply. [LOW]

Other completed criteria

• API key loaded from environment variable (VITE_PUBLIC_POSTHOG_PROJECT_TOKEN)
• API host correctly configured from environment variable (VITE_PUBLIC_POSTHOG_HOST)
• Env var validation with helpful error message in dev mode

---

PostHog insights and events ✅

Filename	PostHog events	Description
posts.index.tsx	invoice_created	Captures when a new invoice is created, with amount and has_description properties
posts..tsx	invoice_marked_paid	Captures when an invoice is marked as paid from detail view, with amount and source: 'invoice_detail'
posts_..deep.tsx	invoice_marked_paid	Captures when an invoice is marked as paid from deep view, with amount and source: 'invoice_full_detail'
DefaultCatchBoundary.tsx	captureException	Captures unhandled errors via catch boundary
__root.tsx	capture_exceptions: true	Enables automatic exception autocapture globally

Issues

No event quality issues.

Other completed criteria

• Events represent real user actions (creating invoices, marking as paid)
• Events enable product insights (create → paid funnel, conversion analysis)
• Events include relevant properties (amount, source, has_description)
• No PII in event properties
• Event names are descriptive and use consistent snake_case convention

---

Reviewed by wizard workbench PR evaluator