[CI] (4c70a79) nuxt/movies-nuxt-4

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 4c70a79
App: nuxt/movies-nuxt-4
App directory: apps/nuxt/movies-nuxt-4
Workbench branch: wizard-ci-4c70a79-nuxt-movies-nuxt-4
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-09T22:28:47.698Z
Duration: 456.8s

YARA Scanner

✓ 167 tool calls scanned, 0 violations detected

No violations: ✓ 167 clean scans

[wizard-ci-bot]

PR Evaluation Report

Summary

This PR integrates PostHog into a Nuxt 4 movies app using a manual client-side plugin (posthog.client.ts). It adds posthog-js to dependencies, initializes it via runtime config environment variables, captures five custom events across login/logout/search/media interactions, and sets up error tracking via the vue:error hook. However, it omits user identification (identify/reset) and does not configure a reverse proxy.

Files changed	Lines added	Lines removed
10	+68	-2

Confidence score: 5/5 🧙

• No identify() call on login: The login page captures login_completed but never calls posthog.identify() with the user's ID. All events remain anonymous, making user-level analysis impossible. [CRITICAL]
• No posthog.reset() on logout: The NavBar captures logout_completed but never calls posthog.reset(), so the next user on the same browser inherits the previous session's identity. [CRITICAL]
• No reverse proxy configured: Events sent directly to PostHog's ingestion endpoint are susceptible to ad blockers. [MEDIUM]

---

File changes

Filename	Score	Description
plugins/posthog.client.ts	4/5	New client plugin — initializes PostHog, captures exceptions via vue:error hook, good dev-mode error for missing env vars
nuxt.config.ts	4/5	Adds posthog runtime config under runtimeConfig.public.posthog
.env.example	5/5	Documents NUXT_PUBLIC_POSTHOG_PROJECT_TOKEN and NUXT_PUBLIC_POSTHOG_HOST
package.json	5/5	Adds posthog-js dependency
components/NavBar.vue	2/5	Captures logout_completed but missing posthog.reset() call
pages/login.vue	2/5	Captures login_completed but missing posthog.identify() call
components/media/Card.vue	5/5	Captures media_selected with media_id and media_type properties
components/media/Hero.vue	5/5	Captures trailer_started with media_id
pages/search.vue	3/5	Captures search_submitted but with no search term property
types/nuxt-app.d.ts	5/5	Proper TypeScript augmentation for `` on NuxtApp

---

App sanity check ✅

Criteria	Result	Description
App builds and runs	Yes	No syntax errors, valid TypeScript, proper Nuxt plugin conventions
Preserves existing env vars & configs	Yes	Existing BASE_URL and all other config preserved; logout button properly rewired
No syntax or type errors	Yes	All Vue SFC and TypeScript files are syntactically valid
Correct imports/exports	Yes	posthog-js imports correct, useNuxtApp() and useRuntimeConfig() used properly
Minimal, focused changes	Yes	All changes are PostHog-related, no scope creep
Pre-existing issues	None	—

Issues

No issues.

Other completed criteria

• Environment variables documented in .env.example
• Build configuration valid — posthog-js correctly added to dependencies
• TypeScript declaration file properly augments #app module

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js@^1.429.0 added to package.json dependencies
PostHog client initialized	Yes	posthog.init() called in posthog.client.ts plugin with api_host and defaults: '2026-01-30'
capture()	Yes	5 custom events: login_completed, logout_completed, media_selected, trailer_started, search_submitted
identify()	No	No posthog.identify() call anywhere — login captures an event but never identifies the user
Error tracking	Yes	nuxtApp.hook('vue:error', ...) calls posthogClient.captureException(error)
Reverse proxy	No	No reverse proxy configured; events go directly to PostHog host

Issues

• Missing identify() on login: The login page (login.vue) captures login_completed but never calls .identify(user.id, { ... }). All events remain attributed to anonymous IDs, making it impossible to build user-level analytics or link sessions across devices. The username value is available in scope and should be used for identification after successful login. [CRITICAL]
• Missing reset() on logout: NavBar.vue captures logout_completed but never calls .reset(). Per PostHog docs, reset() should be called on logout to prevent the next user from inheriting the previous user's identity. [CRITICAL]
• No reverse proxy: PostHog events are sent directly to the NUXT_PUBLIC_POSTHOG_HOST endpoint. For client-side apps, a reverse proxy is recommended to prevent ad blockers from intercepting tracking requests. [MEDIUM]

Other completed criteria

• API key loaded from environment variable via runtimeConfig.public.posthog.publicKey
• Host correctly loaded from environment variable via runtimeConfig.public.posthog.host
• Good dev-mode guard: throws descriptive error when env vars are missing
• Error tracking properly wired via Vue's vue:error lifecycle hook

---

PostHog insights and events ✅

Filename	PostHog events	Description
pages/login.vue	login_completed	Captured after successful login — enables tracking auth conversion
components/NavBar.vue	logout_completed	Captured on logout button click — tracks session endings
components/media/Card.vue	media_selected	Captured with media_id and media_type properties — tracks content engagement
components/media/Hero.vue	trailer_started	Captured with media_id — tracks trailer engagement
pages/search.vue	search_submitted	Captured on search — tracks search usage
plugins/posthog.client.ts	captureException	Vue error hook captures unhandled exceptions

Issues

• search_submitted lacks search term property: The input.value is available in scope but not included as a property. Adding { search_query: input.value } would enable search term analysis and failed-search insights. [MEDIUM]
• login_completed and logout_completed have no properties: While these events are valid, they lack any contextual properties. [LOW]

Other completed criteria

• Events represent real user actions (login, logout, content selection, search)
• Events enable product insights — can build funnels (search → select → trailer)
• No PII in event properties
• Event names use consistent snake_case convention with descriptive action names

---

Reviewed by wizard workbench PR evaluator