[CI] (4c70a79) javascript-node/koa-notes

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 4c70a79
App: javascript-node/koa-notes
App directory: apps/javascript-node/koa-notes
Workbench branch: wizard-ci-4c70a79-javascript-node-koa-notes
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-09T22:19:49.480Z
Duration: 395.2s

YARA Scanner

✓ 118 tool calls scanned, 0 violations detected

No violations: ✓ 118 clean scans

[wizard-ci-bot]

Now I have the full picture. Let me produce the evaluation.

---

PR Evaluation Report

Summary

This PR integrates PostHog's Node.js SDK (posthog-node) into a Koa-based notes API server. It adds a PostHog initialization module, environment variable configuration, capture calls for all CRUD operations (folder and note create/update/delete), error tracking via captureException, and graceful shutdown handling. However, every capture() call is missing the required distinctId parameter, which will cause all events to fail.

Files changed	Lines added	Lines removed
4	+93	-4

Confidence score: 4/5 👍

• All capture() calls missing required distinctId: The posthog-node SDK requires a distinctId field in every capture() call. All 5 capture calls omit it entirely, which will cause the SDK to throw errors or silently drop events. Every event in this integration is broken. [CRITICAL]
• captureException missing distinctId: The error handler calls posthog?.captureException(err) but the Node SDK's captureException also requires a distinctId to attribute the exception. Without it, error tracking will not function correctly. [CRITICAL]
• enableExceptionAutocapture is not a valid posthog-node config option: This is a posthog-js (browser SDK) option. It will be silently ignored by the Node SDK. [LOW]

---

File changes

Filename	Score	Description
posthog.js	3/5	New PostHog initialization module with env var validation and conditional client creation. Uses invalid enableExceptionAutocapture option.
index.js	2/5	Adds capture calls for all CRUD routes plus error tracking and shutdown, but every capture call is missing the required distinctId.
package.json	4/5	Adds posthog-node and dotenv dependencies. Versions look reasonable.
.env.example	4/5	Documents both required environment variables with placeholder values.

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	No	All capture() calls are missing the required distinctId parameter, which will cause runtime errors when routes are hit
Preserves existing env vars & configs	Yes	Existing app functionality is preserved; only PostHog additions made
No syntax or type errors	Yes	Syntax is valid JavaScript throughout
Correct imports/exports	Yes	posthog-node imported correctly as { PostHog }, exported singleton is correct
Minimal, focused changes	Yes	All changes are PostHog-related
Pre-existing issues	None	Base app appears functional

Issues

• Missing distinctId in all capture() calls: The posthog-node SDK requires distinctId as a mandatory field in the capture call object { distinctId, event, properties }. All 5 capture calls omit it. This will cause runtime errors or silently dropped events. Fix: Add a distinctId to each capture call — in a server-only app without auth, a per-request identifier (e.g., from a session cookie or IP-based hash) or a static server identifier should be used. [CRITICAL]
• Missing distinctId in captureException: The captureException call in the Koa error handler does not provide a distinctId. The Node SDK needs this for attribution. Fix: Pass { distinctId, error } or use the context-based pattern. [CRITICAL]

Other completed criteria

• Environment variables documented in .env.example
• posthog-node correctly added to dependencies
• Graceful shutdown with posthog.shutdown() on SIGINT/SIGTERM
• Optional chaining (posthog?.) used throughout for null safety

---

PostHog implementation ❌

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-node@^5.51.8 added to package.json dependencies
PostHog client initialized	Yes	Initialized via new PostHog(projectToken, { host }) in dedicated posthog.js module with conditional creation
capture()	No	5 capture calls present but ALL are missing the required distinctId parameter — events will fail
identify()	N/A	Server-only app
Error tracking	No	captureException(err) is called on Koa app errors, but missing distinctId. Also, enableExceptionAutocapture is not a valid posthog-node option.
Reverse proxy	N/A	Server-only app

Issues

• All capture() calls missing distinctId: The posthog-node SDK signature is capture({ distinctId, event, properties }). Without distinctId, the Node SDK will throw a validation error or drop the event. None of the 5 capture calls include it. Fix: For a server-only app without authentication, use a request-scoped identifier (session ID, IP hash, or a fixed server identifier like "koa-server") as the distinctId. [CRITICAL]
• captureException missing distinctId: The Node SDK's captureException also requires a distinct ID for event attribution. Fix: Wrap exceptions with posthog.captureException({ distinctId: 'server', error: err }) or equivalent. [CRITICAL]
• Invalid config option enableExceptionAutocapture: This is a posthog-js browser SDK option, not available in posthog-node. It will be silently ignored. Fix: Remove this option from the Node initialization. [LOW]

Other completed criteria

• API key loaded from POSTHOG_PROJECT_TOKEN environment variable (not hardcoded)
• Host correctly configured from POSTHOG_HOST environment variable
• Graceful shutdown calls posthog.shutdown() to flush pending events
• Null-safe client creation when env vars are missing

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
index.js	folder_created, folder_deleted, note_created, note_updated, note_deleted	CRUD lifecycle events for folders and notes with relevant properties (IDs, change flags). All use : false for anonymous tracking.
index.js	captureException	Error handler captures unhandled Koa errors

Issues

• No distinctId means zero events will be attributed: Even though event names and properties are well-designed, none will actually reach PostHog due to the missing required distinctId field. [CRITICAL]

Other completed criteria

• Events represent real user actions (CRUD operations on notes and folders)
• Events enable product insights (can build funnels: create folder → create note → update note)
• Events include relevant properties (folder_id, note_id, moved_note_count, has_content, update flags)
• No PII in event properties
• Event names are descriptive and consistent (snake_case: note_created, folder_deleted, etc.)

---

Reviewed by wizard workbench PR evaluator