[CI] (4c70a79) javascript-node/fastify-blog

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 4c70a79
App: javascript-node/fastify-blog
App directory: apps/javascript-node/fastify-blog
Workbench branch: wizard-ci-4c70a79-javascript-node-fastify-blog
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-09T22:18:06.062Z
Duration: 318.8s

YARA Scanner

✓ 104 tool calls scanned, 0 violations detected

No violations: ✓ 104 clean scans

[wizard-ci-bot]

Now I have all the context I need. This is a server-only Fastify (Node.js) blog app using posthog-node. Let me produce the evaluation.

---

PR Evaluation Report

Summary

This PR integrates PostHog into a server-side Fastify blog API using the posthog-node SDK. It adds a PostHog client module (posthog.js), captures events for CRUD operations on posts and comments, sets up error handling via captureException, and properly shuts down the client on server close. However, all capture() calls are missing the required distinctId parameter.

Files changed	Lines added	Lines removed
4	+60	-2

Confidence score: 5/5 🧙

• All capture() calls are missing the required distinctId parameter. The posthog-node SDK requires distinctId as a field in the capture object. Without it, events will either be silently dropped or throw runtime errors. The author field is available in both post and comment creation and should be used (or a request-scoped identifier). [CRITICAL]
• enableExceptionAutocapture is not a documented posthog-node config option. This appears to be conflated with the posthog-js browser SDK's capture_exceptions option. It will likely be silently ignored, meaning no automatic server-side exception capture occurs beyond the manual captureException call. [MEDIUM]

---

File changes

Filename	Score	Description
posthog.js	4/5	New PostHog client module with env var validation, graceful undefined export when unconfigured
index.js	2/5	Adds capture calls for all CRUD actions + error handler + shutdown hook, but all capture calls missing distinctId
package.json	5/5	Adds posthog-node and dotenv dependencies
.env.example	5/5	Documents both required env vars

---

App sanity check ✅

Criteria	Result	Description
App builds and runs	Yes	No syntax/build errors; missing distinctId is a runtime logic issue, not a build failure
Preserves existing env vars & configs	Yes	No existing configs modified beyond adding PostHog dependencies
No syntax or type errors	Yes	Valid JavaScript throughout
Correct imports/exports	Yes	posthog-node and dotenv/config imports are correct
Minimal, focused changes	Yes	All changes relate to PostHog integration; the deleted_comment_count variable enriches an event property
Pre-existing issues	None	—

Issues

No app sanity issues.

Other completed criteria

• Environment variables documented in .env.example with POSTHOG_API_KEY and POSTHOG_HOST
• package.json is valid with correct dependency additions
• Graceful shutdown hook via fastify.addHook('onClose', ...)
• PostHog client conditionally created (undefined when env vars missing)

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-node ^5.51.8 added to dependencies
PostHog client initialized	Yes	new PostHog(apiKey, { host }) in posthog.js with env var validation
capture()	No	All 4 capture calls are missing the required distinctId field
identify()	N/A	Server-only app
Error tracking	Yes	captureException(error) called in the global error handler
Reverse proxy	N/A	Server-only app

Issues

• Missing distinctId in all capture() calls: The posthog-node SDK requires distinctId as a parameter in every capture() call (e.g., posthog.capture({ distinctId: 'user-id', event: '...', properties: {...} })). All four capture calls (post_created, post_updated, post_deleted, comment_created) omit this field. The author field from the request body is available in most handlers and could serve as a distinctId. Without this, events will fail at runtime. [CRITICAL]
• enableExceptionAutocapture is not a documented posthog-node option: This config key appears to be from the browser SDK (posthog-js). It will likely be silently ignored by posthog-node, meaning there is no automatic uncaught exception capture — only the manual captureException in the error handler works. [MEDIUM]

Other completed criteria

• API key loaded from POSTHOG_API_KEY environment variable (not hardcoded)
• Host correctly loaded from POSTHOG_HOST environment variable
• Proper shutdown with await posthog?.shutdown() on server close
• Defensive optional chaining (posthog?.) throughout in case client is undefined
• Env var validation throws in non-production to catch misconfiguration early

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
index.js	post_created	Tracks blog post creation with post_id and is_published
index.js	post_updated	Tracks post edits with granular change flags (title_changed, body_changed, published_changed)
index.js	post_deleted	Tracks post deletion with deleted_comment_count for cascade awareness
index.js	comment_created	Tracks comment creation with comment_id and post_id
index.js	captureException	Captures unhandled errors in the global Fastify error handler

Issues

• Events lack user attribution: Because distinctId is missing, even if the events were sent, they would not be attributable to any user. This eliminates the ability to build per-user funnels, retention charts, or any user-level product insight. [CRITICAL]

Other completed criteria

• Event names are descriptive and use consistent snake_case convention
• Events represent real user actions in a blog application (create, update, delete posts/comments)
• Events include rich contextual properties (e.g., is_published, title_changed, deleted_comment_count)
• No PII in event properties — only IDs and boolean flags
• Events could enable funnel analysis (create → update → publish → delete) once distinctId is added

---

Reviewed by wizard workbench PR evaluator