[CI] (963eeb8) vue/movies

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 963eeb8
App: vue/movies
App directory: apps/vue/movies
Workbench branch: wizard-ci-963eeb8-vue-movies
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-03T18:43:42.351Z
Duration: 311.5s

YARA Scanner

✓ 135 tool calls scanned, 0 violations detected

No violations: ✓ 135 clean scans

[wizard-ci-bot]

Now I have enough context to produce the full evaluation.

---

PR Evaluation Report

Summary

This PR integrates PostHog into a Vue.js movies app by installing posthog-js, initializing it in main.js, adding custom event captures across several views (login, logout, search, media selection, trailer playback), and setting up error tracking via app.config.errorHandler and capture_exceptions. Environment variables are documented in .env.example.

Files changed	Lines added	Lines removed
8	+74	-4

Confidence score: 5/5 🧙

• Missing posthog.identify() call: The app has a login flow (useAuth) that returns a username, but posthog.identify() is never called after login. Events are captured anonymously even when the user is known. [CRITICAL]
• Missing posthog.reset() on logout: NavBar.vue captures a logout_completed event but never calls posthog.reset(). If users share a device, subsequent sessions inherit the previous user's identity. [CRITICAL]
• No reverse proxy configured: The app sends events directly to the PostHog host, making them susceptible to ad blockers. [MEDIUM]

---

File changes

Filename	Score	Description
.env.example	4/5	Adds PostHog env vars with placeholder values
package.json	5/5	Adds posthog-js dependency
src/main.js	4/5	Initializes PostHog with error tracking; throws in dev if env vars missing
src/components/NavBar.vue	2/5	Captures logout event but missing posthog.reset()
src/views/LoginView.vue	2/5	Captures login events but missing posthog.identify()
src/components/media/MediaCard.vue	4/5	Tracks media selection with relevant properties
src/views/MediaDetailView.vue	4/5	Tracks trailer opens with media context
src/views/SearchView.vue	4/5	Tracks search submissions with result count; cleanly differentiates form vs route-triggered searches

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	No syntax errors; posthog-js added to dependencies
Preserves existing env vars & configs	Yes	Only additive changes to .env.example and package.json
No syntax or type errors	Yes	All files are syntactically valid
Correct imports/exports	Yes	posthog-js correctly imported in browser-only contexts
Minimal, focused changes	Yes	All changes relate to PostHog integration
Pre-existing issues	None

Issues

• Dev-mode throw on missing env vars: In main.js, when import.meta.env.DEV is true and env vars are missing, a throw new Error(...) will crash the app entirely. A console.warn would be less disruptive during development. [LOW]

Other completed criteria

• Environment variables documented in .env.example with VITE_ prefix for Vite compatibility
• Build configuration valid — posthog-js added to dependencies (not devDependencies)
• No unrelated code changes

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js@^1.425.1 added to package.json
PostHog client initialized	Yes	posthog.init() in main.js with env vars and defaults: '2026-01-30'
capture()	Yes	Multiple meaningful capture calls across login, logout, search, media selection, and trailer views
identify()	No	Never called despite the app having user authentication via useAuth
Error tracking	Yes	capture_exceptions config with unhandled errors/rejections + app.config.errorHandler with captureException()
Reverse proxy	No	No reverse proxy configured; events sent directly to posthogHost

Issues

• Missing posthog.identify(): The useAuth composable returns a username on login, but posthog.identify() is never called. All events remain anonymous even for logged-in users, making it impossible to build user-level funnels or retention charts. Should call posthog.identify(user.id, { name: username }) after successful login in LoginView.vue. [CRITICAL]
• Missing posthog.reset() on logout: NavBar.vue handles logout but only captures a logout_completed event without calling posthog.reset(). This means subsequent anonymous or different-user sessions on the same browser will be associated with the previous user. Add posthog.reset() after the capture call in handleLogout. [CRITICAL]
• No reverse proxy: Events are sent directly to the PostHog host URL, making them susceptible to ad blocker interception. Consider setting up a reverse proxy via Vite config rewrites or a managed proxy. [MEDIUM]
• Redundant env var checks scattered across components: Every capture call is guarded by if (import.meta.env.VITE_POSTHOG_PROJECT_TOKEN && import.meta.env.VITE_POSTHOG_HOST). Since posthog.init() is already guarded in main.js, these checks are redundant — if PostHog isn't initialized, capture calls are no-ops. This adds unnecessary boilerplate. [LOW]

Other completed criteria

• API key loaded from environment variable (VITE_POSTHOG_PROJECT_TOKEN), not hardcoded
• API host correctly configured from VITE_POSTHOG_HOST environment variable
• Error tracking properly configured with both capture_exceptions init option and app.config.errorHandler

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
src/main.js	captureException	Global error handler captures uncaught Vue errors
src/views/LoginView.vue	login_succeeded, login_failed	Tracks login outcomes (but without user identification)
src/components/NavBar.vue	logout_completed	Tracks logout action
src/views/SearchView.vue	media_search_submitted	Tracks user-initiated searches with result_count property
src/components/media/MediaCard.vue	media_selected	Tracks media card clicks with media_id, media_type, source properties
src/views/MediaDetailView.vue	trailer_opened	Tracks trailer playback with media_id, media_type properties

Issues

• login_succeeded and login_failed lack properties: Neither event includes any contextual properties. login_failed should include an error reason, and both could benefit from indicating the login method or source. [MEDIUM]
• media_search_submitted omits search query: The event only includes result_count but not the search term itself. Including the query text would enable much richer search analytics (popular terms, zero-result queries). [LOW]

Other completed criteria

• Events represent real user actions (login, logout, search, media browsing, trailer playback)
• Events enable product insights — could build a search-to-selection funnel, login success rate trend
• Event naming is descriptive and uses consistent snake_case convention
• No PII placed in event properties — media_id and media_type are non-PII
• media_selected event includes enriched properties (media_id, media_type, source)

---

Reviewed by wizard workbench PR evaluator