[CI] (963eeb8) tanstack-router/tanstack-router-file-based-saas

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 963eeb8
App: tanstack-router/tanstack-router-file-based-saas
App directory: apps/tanstack-router/tanstack-router-file-based-saas
Workbench branch: wizard-ci-963eeb8-tanstack-router-tanstack-router-file-based-saas
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-03T18:43:42.013Z
Duration: 436.8s

YARA Scanner

✓ 151 tool calls scanned, 0 violations detected

No violations: ✓ 151 clean scans

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR integrates PostHog into a TanStack Router file-based SaaS app using posthog-js and PostHogProvider from posthog-js/react. It adds custom event captures for login, logout, invoice CRUD, and upgrade actions, plus error tracking via captureException and capture_exceptions: true. However, it is missing identify() on login and reset() on logout, likely produces duplicate pageviews, and includes a massive unnecessary regeneration of routeTree.gen.ts.

Files changed	Lines added	Lines removed
10	+296	-343

Confidence score: 4/5 👍

• Missing posthog.identify() on login: The login handler calls auth.login(username) and posthog?.capture('user_logged_in') but never calls posthog.identify(). All events remain anonymous, making user-level analysis impossible. [CRITICAL]
• Missing posthog.reset() on logout: The logout handler captures user_logged_out but never calls posthog.reset(), so subsequent users on the same browser inherit the previous identity. [CRITICAL]
• Duplicate pageview events: PostHogPageviewTracker manually captures `` on every route resolution, but with defaults: '2026-01-30' PostHog's built-in pageview auto-capture is likely also active. Either disable auto-capture with `capture_pageview: false` or remove the manual tracker. [MEDIUM]
• No reverse proxy configured: Client-only app sends events directly to PostHog, making them susceptible to ad blockers. [MEDIUM]

---

File changes

Filename	Score	Description
src/routes/__root.tsx	3/5	Adds PostHogProvider initialization with env vars, dev-mode guard, and PostHogPageviewTracker. Missing capture_pageview: false causing likely duplicate pageviews. Sets ui_host: apiHost incorrectly.
src/main.tsx	4/5	Adds PostHogErrorComponent wrapping default error component with captureException. Reasonable approach.
src/routes/login.tsx	2/5	Captures login/logout events but critically missing identify() and reset(). Also has unnecessary structural refactor (moved component from .update() to inline).
src/routes/_auth.profile.tsx	5/5	Clean upgrade_clicked event capture with current_plan property in event handler.
src/routes/dashboard.invoices..tsx	5/5	Captures invoice_updated with invoice_id property in onSuccess callback.
src/routes/dashboard.invoices.index.tsx	5/5	Captures invoice_created with invoice_id property in onSuccess callback.
.env.example	4/5	Documents required env vars. Uses VITE_PUBLIC_ prefix which works but is non-standard (Vite convention is VITE_).
package.json	5/5	Adds posthog-js dependency correctly.
tsconfig.json	5/5	Adds "types": ["vite/client"] for import.meta.env type support.
src/routeTree.gen.ts	2/5	Auto-generated file was fully regenerated, creating a massive diff (+205/-338) that obscures the actual PostHog changes.

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	No syntax errors or missing dependencies introduced
Preserves existing env vars & configs	Yes	Existing functionality preserved; PostHog wraps around existing content
No syntax or type errors	Yes	All TypeScript and JSX is valid
Correct imports/exports	Yes	posthog-js and posthog-js/react imports are correct
Minimal, focused changes	No	routeTree.gen.ts regeneration adds ~540 lines of churn; login.tsx has unnecessary .update() refactor
Pre-existing issues	None	—

Issues

• routeTree.gen.ts regeneration: The auto-generated route tree file was fully regenerated, producing a +205/-338 diff that has nothing to do with PostHog. This obscures the actual integration changes. [LOW]
• login.tsx structural change: The component property was moved from .update({...}) to inline in createFileRoute() — a functionally equivalent but unnecessary refactor. [LOW]

Other completed criteria

• Environment variables documented in .env.example
• Build configuration valid with tsconfig.json addition
• posthog-js added to package.json dependencies

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js ^1.425.1 added to package.json
PostHog client initialized	Yes	PostHogProvider in __root.tsx with apiKey and api_host from env vars
capture()	Yes	5 meaningful capture calls across login, logout, invoices, and profile
identify()	No	No identify() call on login; no reset() on logout
Error tracking	Yes	capture_exceptions: true in init + manual captureException in PostHogErrorComponent
Reverse proxy	No	No reverse proxy configured; events sent directly to PostHog

Issues

• Missing identify() on login: login.tsx calls auth.login(username) and captures user_logged_in but never calls posthog.identify(username). The username is available right there. Without identify, all events remain tied to anonymous IDs, making person-level analytics impossible. Fix: add posthog?.identify(username) after auth.login(username). [CRITICAL]
• Missing reset() on logout: The logout handler captures user_logged_out but never calls posthog?.reset(). If another user logs in on the same browser, their events are attributed to the previous user. Fix: add posthog?.reset() after auth.logout(). [CRITICAL]
• Duplicate pageview tracking: PostHogPageviewTracker manually captures on every `onResolved` event, but `defaults: '2026-01-30'` likely enables automatic pageview capture. This would send two events per navigation. Fix: add capture_pageview: false to init options, or remove the manual tracker. [MEDIUM]
• No reverse proxy: Client-only app has no proxy configuration. Events and session recordings may be blocked by ad blockers. [MEDIUM]
• ui_host set to API host: ui_host: apiHost should point to the PostHog UI (e.g., https://us.posthog.com), not the ingestion API host. This may cause toolbar and other UI feature issues. [LOW]

Other completed criteria

• API key loaded from VITE_PUBLIC_POSTHOG_PROJECT_TOKEN environment variable
• API host correctly configured from environment variable
• Dev-mode guards throw helpful errors when env vars are missing
• Error tracking covers both auto-capture and router error boundaries

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
src/routes/__root.tsx	``	Manual pageview tracking on route resolution via PostHogPageviewTracker
src/routes/login.tsx	user_logged_in, user_logged_out	Login/logout actions captured in event handlers (but missing identify/reset)
src/routes/_auth.profile.tsx	upgrade_clicked	Upgrade button click with current_plan property
src/routes/dashboard.invoices.index.tsx	invoice_created	New invoice creation with invoice_id property
src/routes/dashboard.invoices..tsx	invoice_updated	Invoice update with invoice_id property
src/main.tsx	captureException	Router-level error boundary capturing exceptions

Issues

• No identify limits event usefulness: Without identify(), events like user_logged_in, invoice_created, and upgrade_clicked cannot be tied to specific users, severely limiting funnel and retention analysis. [CRITICAL]

Other completed criteria

• Events represent real user actions (login, logout, invoice CRUD, upgrade)
• Events enable product insights (login → dashboard → invoice creation funnel possible if identify were present)
• Events include relevant properties (invoice_id, current_plan)
• No PII in event properties
• Event names are descriptive and use consistent snake_case convention

---

Reviewed by wizard workbench PR evaluator