[CI] (4c70a79) next-js/15-app-router-todo

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 4c70a79
App: next-js/15-app-router-todo
App directory: apps/next-js/15-app-router-todo
Workbench branch: wizard-ci-4c70a79-next-js-15-app-router-todo
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-09T22:22:21.292Z
Duration: 284.0s

YARA Scanner

✓ 116 tool calls scanned, 0 violations detected

No violations: ✓ 116 clean scans

[wizard-ci-bot]

Now I have everything I need to produce the full evaluation.

---

PR Evaluation Report

Summary

This PR adds a client-side PostHog integration to a Next.js 15 App Router todo application. It installs posthog-js, initializes it via instrumentation-client.ts, adds custom event captures for todo CRUD operations, and documents environment variables in .env.example. The integration is clean and minimal but lacks identify, reverse proxy, and uses a slightly outdated defaults date.

Files changed	Lines added	Lines removed
4	+40	-0

Confidence score: 5/5 🧙

• No reverse proxy configured: Next.js supports rewrites in next.config.ts which can serve as a reverse proxy for PostHog, reducing the chance of ad blockers intercepting events. This is missing entirely. [MEDIUM]
• No user identification: While this app has no auth system, there is no posthog.identify() call or placeholder pattern for when auth is added. The docs recommend calling identify as soon as possible. [MEDIUM]
• Outdated defaults date: The defaults option is set to '2026-01-30' but the current recommended value in PostHog docs is '2026-05-30'. This means the app may miss newer default configuration improvements. [LOW]

---

File changes

Filename	Score	Description
instrumentation-client.ts	4/5	New file correctly initializes PostHog with env vars, error tracking, and dev-mode guards. Uses slightly outdated defaults date.
components/todos/todo-list.tsx	4/5	Adds three meaningful capture() calls in event handlers for todo CRUD operations. Correctly placed in handlers, not useEffect.
.env.example	4/5	Documents PostHog env vars with clear comments. Uses NEXT_PUBLIC_POSTHOG_KEY instead of the conventional NEXT_PUBLIC_POSTHOG_PROJECT_TOKEN from docs.
package.json	5/5	Adds posthog-js dependency correctly.

---

App sanity check ✅

Criteria	Result	Description
App builds and runs	Yes	All additions are syntactically correct; no missing dependencies
Preserves existing env vars & configs	Yes	Only additions, no modifications to existing code beyond inserting capture calls
No syntax or type errors	Yes	TypeScript and JSX are valid throughout
Correct imports/exports	Yes	posthog-js imported correctly in client-side files
Minimal, focused changes	Yes	Only PostHog-related additions, no unrelated changes
Pre-existing issues	None	Base app is clean

Issues

• No issues found.

Other completed criteria

• Environment variables documented in .env.example with descriptive comments
• Build configuration valid — posthog-js added to package.json dependencies
• All changes are relevant to PostHog integration
• Correct files modified for Next.js App Router pattern (instrumentation-client.ts)

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js ^1.429.0 added to package.json
PostHog client initialized	Yes	Initialized in instrumentation-client.ts using posthog.init() with env vars — correct Next.js pattern
capture()	Yes	Three custom events: todo_created, todo_completion_changed, todo_deleted
identify()	No	No posthog.identify() call present. App has no auth, but no placeholder pattern exists either
Error tracking	Yes	capture_exceptions: true enabled in init config
Reverse proxy	No	No Next.js rewrites or middleware proxy configured for PostHog

Issues

• No reverse proxy: The Next.js app has no rewrites configured in next.config.ts to proxy PostHog requests. This means ad blockers can intercept analytics calls. Add a rewrites() configuration pointing /ingest/* to the PostHog host, or use PostHog's managed reverse proxy. [MEDIUM]
• No user identification: No posthog.identify() call is present. While the todo app has no auth system currently, best practice would be to add identify at the point where user context becomes available. [MEDIUM]
• Outdated defaults date: defaults: '2026-01-30' should be updated to '2026-05-30' to use the latest recommended configuration defaults. [LOW]

Other completed criteria

• API key loaded from NEXT_PUBLIC_POSTHOG_KEY environment variable, not hardcoded
• API host loaded from NEXT_PUBLIC_POSTHOG_HOST environment variable
• Defensive guards in development mode throw errors when env vars are missing
• Debug mode enabled only in development

---

PostHog insights and events ✅

Filename	PostHog events	Description
instrumentation-client.ts	captureException (auto)	Automatic exception tracking via capture_exceptions: true
components/todos/todo-list.tsx	todo_created	Captured when a new todo is added, with has_description and initial_completion_status properties
components/todos/todo-list.tsx	todo_completion_changed	Captured when a todo's completion status is toggled, with completed boolean property
components/todos/todo-list.tsx	todo_deleted	Captured when a todo is deleted (no additional properties)

Issues

• todo_deleted lacks properties: The todo_deleted event has no properties. Adding context like the todo's completion status at time of deletion would enable richer analysis (e.g., "do users delete incomplete or completed todos more?"). [LOW]

Other completed criteria

• Events represent real user actions in the todo CRUD flow
• Events enable product insights — can build a funnel from create → complete → delete
• todo_created and todo_completion_changed include enriched properties
• No PII in any event properties
• Event names use consistent snake_case convention and are descriptive

---

Reviewed by wizard workbench PR evaluator