[CI] (3f39e0e) tanstack-router/tanstack-router-code-based-saas

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 3f39e0e
App: tanstack-router/tanstack-router-code-based-saas
App directory: apps/tanstack-router/tanstack-router-code-based-saas
Workbench branch: wizard-ci-3f39e0e-tanstack-router-tanstack-router-code-based-saas
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-23T22:20:29.468Z
Duration: 409.2s

YARA Scanner

✓ 139 tool calls scanned, 0 violations detected

No violations: ✓ 139 clean scans

[wizard-ci-bot]

PR Evaluation Report

Summary

This PR integrates PostHog into a TanStack Router code-based SaaS app using @posthog/react and posthog-js. It wraps the root component in a PostHogProvider, captures two custom events (invoice_created, invoice_updated), enables automatic exception capture, and documents environment variables.

Files changed	Lines added	Lines removed
5	+65	-2

Confidence score: 5/5 🧙

• No user identification: The app has no posthog.identify() call anywhere. Users will remain anonymous, breaking the link between events and known users. [CRITICAL]
• No reverse proxy configured: Client-side PostHog requests are susceptible to ad blockers without a reverse proxy. [MEDIUM]
• Capture calls lack event properties: invoice_created and invoice_updated are bare captures with no contextual properties (e.g., invoice ID, amount), limiting analytical value. [MEDIUM]
• posthog.logger.info() may not be a valid API: The documented method is posthog.captureLog(). posthog.logger.info() does not appear in the SDK reference and may fail at runtime. [MEDIUM]

---

File changes

Filename	Score	Description
.env.example	5/5	Adds VITE_PUBLIC_POSTHOG_PROJECT_TOKEN and VITE_PUBLIC_POSTHOG_HOST placeholders
.gitignore	5/5	Adds .env to prevent committing secrets
package.json	5/5	Adds posthog-js and @posthog/react dependencies
src/main.tsx	3/5	PostHogProvider integration with capture calls but no identify, no enriched properties, and questionable posthog.logger.info usage
tsconfig.json	5/5	Adds vite/client types for import.meta.env type safety

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	No syntax errors; dependencies and imports are correct
Preserves existing env vars & configs	Yes	Original RootComponent logic refactored into RootContent but functionally preserved
No syntax or type errors	Yes	Valid TypeScript/JSX throughout changed files
Correct imports/exports	Yes	PostHogProvider and usePostHog correctly imported from @posthog/react
Minimal, focused changes	Yes	All changes relate to PostHog integration; tsconfig change supports env var types
Pre-existing issues	None	—

Issues

• posthog.logger.info() possibly invalid: The SDK reference documents posthog.captureLog() but not posthog.logger.info(). If this API doesn't exist, these calls will throw at runtime. Use posthog.captureLog({ body: 'invoice creation completed', level: 'info', attributes: { operation: 'invoice_create', outcome: 'success' } }) instead. [MEDIUM]

Other completed criteria

• Environment variables documented in .env.example
• .env added to .gitignore
• Build configuration valid with vite/client types added

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js ^1.434.12 and @posthog/react ^1.11.1 added to package.json
PostHog client initialized	Yes	PostHogProvider wraps RootContent with apiKey and api_host from env vars
capture()	Yes	invoice_created and invoice_updated captured in mutation onSuccess handlers
identify()	No	No posthog.identify() call anywhere; users remain anonymous
Error tracking	Yes	capture_exceptions: true set in PostHogProvider options
Reverse proxy	No	No reverse proxy configured; client-side requests may be blocked by ad blockers

Issues

• Missing user identification: No posthog.identify() call exists. For a SaaS app, this is critical — events cannot be linked to known users. Add posthog.identify(userId, { email, name }) after login and posthog.reset() on logout. [CRITICAL]
• No reverse proxy: Without a reverse proxy, ad blockers may silently drop all PostHog requests. Configure Vite rewrites or a managed proxy to route requests through a first-party domain. [MEDIUM]

Other completed criteria

• API key loaded from VITE_PUBLIC_POSTHOG_PROJECT_TOKEN environment variable
• API host correctly configured from VITE_PUBLIC_POSTHOG_HOST environment variable
• Dev-mode guard throws helpful error when env vars are missing
• Debug mode enabled in development via import.meta.env.DEV
• Logs configuration set with serviceName and environment

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
src/main.tsx	invoice_created	Captured on successful invoice creation via mutation onSuccess
src/main.tsx	invoice_updated	Captured on successful invoice update via mutation onSuccess
src/main.tsx	capturedException (automatic)	Automatic exception capture via capture_exceptions: true

Issues

• Bare capture calls with no properties: Both invoice_created and invoice_updated are captured without any contextual properties. Adding properties like invoice_id, amount, or status would enable meaningful breakdowns, funnels, and retention analysis. [MEDIUM]

Other completed criteria

• Events represent real user actions (creating and updating invoices)
• Events could support basic funnel analysis (create → update flow)
• No PII in event properties
• Event names use consistent snake_case convention and are descriptive

---

Reviewed by wizard workbench PR evaluator