[CI] (4c70a79) javascript-node/express-todo

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 4c70a79
App: javascript-node/express-todo
App directory: apps/javascript-node/express-todo
Workbench branch: wizard-ci-4c70a79-javascript-node-express-todo
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-09T22:18:19.283Z
Duration: 339.8s

YARA Scanner

✓ 106 tool calls scanned, 0 violations detected

No violations: ✓ 106 clean scans

[wizard-ci-bot]

PR Evaluation Report

Summary

This PR integrates PostHog into a server-only Express.js todo API using the posthog-node SDK. It adds event tracking for CRUD operations (create, update, delete todos), Express error handling, graceful shutdown, and environment variable configuration. The integration is clean and well-structured but has a critical issue: all capture() calls are missing the required distinctId parameter.

Files changed	Lines added	Lines removed
4	+88	-5

Confidence score: 5/5 🧙

• Missing distinctId in all capture() calls: The posthog-node SDK requires a distinctId field in every capture() call. All three capture calls (todo_created, todo_updated, todo_deleted) omit it, which means events will either fail silently or be unattributable. The app needs to derive a distinct ID from request context (e.g., session, auth header, IP-based fallback, or a request header like X-POSTHOG-DISTINCT-ID). [CRITICAL]

---

File changes

Filename	Score	Description
posthog.js	4/5	New file that initializes the PostHog Node client with env vars and exception autocapture. Clean pattern with null guard and conditional require.
index.js	2/5	Adds capture calls and error handler setup, but all capture calls are missing the required distinctId parameter.
package.json	5/5	Adds posthog-node and dotenv dependencies correctly.
.env.example	5/5	Documents required POSTHOG_PROJECT_TOKEN and POSTHOG_HOST env vars.

---

App sanity check ✅

Criteria	Result	Description
App builds and runs	Yes	No syntax errors; the app will start and serve requests
Preserves existing env vars & configs	Yes	Existing Express routes and logic preserved; only PostHog additions
No syntax or type errors	Yes	Valid JavaScript throughout
Correct imports/exports	Yes	posthog-node, dotenv, and setupExpressErrorHandler imports are correct
Minimal, focused changes	Yes	Only PostHog integration changes, no scope creep
Pre-existing issues	None	Base app is straightforward and functional

Issues

No app sanity issues.

Other completed criteria

• Graceful shutdown handler properly calls posthog.shutdown() before exiting
• dotenv loaded at the top of index.js to ensure env vars are available
• Null guards (if (posthog)) prevent crashes when PostHog is not configured
• posthog.js throws in non-production when env vars are missing, providing clear error messages

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-node@^5.51.8 added to package.json dependencies
PostHog client initialized	Yes	Initialized in posthog.js with new PostHog(projectToken, { host, enableExceptionAutocapture: true })
capture()	No	Three capture calls exist but all are missing the required distinctId field
identify()	N/A	Server-only app
Error tracking	Yes	setupExpressErrorHandler(posthog, app) correctly wired up, plus enableExceptionAutocapture: true
Reverse proxy	N/A	Server-only app

Issues

• Missing distinctId in all capture calls: Every posthog.capture() call in index.js omits the required distinctId field. The posthog-node SDK's capture() method requires distinctId to associate events with a user. Without it, events will either fail or be unattributable. Each route handler needs to derive a distinct ID from the request context (e.g., authenticated user ID, session ID, or req.headers['x-posthog-distinct-id']). [CRITICAL]

Other completed criteria

• API key loaded from POSTHOG_PROJECT_TOKEN environment variable, not hardcoded
• Host loaded from POSTHOG_HOST environment variable
• posthog.shutdown() called during graceful shutdown ensuring event flush
• setupExpressErrorHandler correctly placed after all route definitions

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
index.js	todo_created	Captures when a new todo is created with todo_id and completed status
index.js	todo_updated	Captures todo updates with todo_id, title_updated, completion_updated, and completed flags
index.js	todo_deleted	Captures todo deletion with todo_id and completed status
index.js	setupExpressErrorHandler	Captures Express errors/exceptions automatically

Issues

• Events lack user attribution: Because distinctId is missing from all capture calls, none of the events can be used to build user-level funnels, retention charts, or cohorts. While the event names and properties are well-designed, they are effectively unusable without user identification. [CRITICAL]

Other completed criteria

• Events represent real user actions (CRUD operations on todos)
• Events could enable product insights (create→update→delete funnel) if distinctId were provided
• Events include relevant contextual properties (todo_id, completion status, what changed)
• No PII in event properties
• Event names follow consistent snake_case convention and clearly describe the action

---

Reviewed by wizard workbench PR evaluator