[CI] (3f39e0e) tanstack-router/tanstack-router-file-based-saas

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 3f39e0e
App: tanstack-router/tanstack-router-file-based-saas
App directory: apps/tanstack-router/tanstack-router-file-based-saas
Workbench branch: wizard-ci-3f39e0e-tanstack-router-tanstack-router-file-based-saas
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-23T22:20:32.060Z
Duration: 356.5s

YARA Scanner

✓ 154 tool calls scanned, 0 violations detected

No violations: ✓ 154 clean scans

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR integrates PostHog into a TanStack Router file-based SaaS demo app. It adds @posthog/react as a dependency, wraps the app root with PostHogProvider, captures custom events for login/logout and invoice CRUD actions, enables exception autocapture, and adds structured logging via posthog.logger. However, the integration is missing identify() on login and reset() on logout, lacks a reverse proxy, and several event captures omit contextual properties.

Files changed	Lines added	Lines removed
8	+60	-1

Confidence score: 5/5 🧙

• Missing posthog.identify() on login: The app has a clear login flow (auth.login(username)) but never calls posthog.identify(), so all events remain anonymous and cannot be tied to a known user. [CRITICAL]
• Missing posthog.reset() on logout: The logout handler captures a user_logged_out event but never calls posthog.reset(), so the next user on the same browser inherits the previous session. [CRITICAL]
• No reverse proxy configured: Client-side posthog-js events are susceptible to ad blocker interception without a reverse proxy. [MEDIUM]
• Unsafe posthog.logger access without optional chaining: const posthogLogger = posthog.logger at component body level will throw if usePostHog() returns undefined (e.g., when env vars are missing in production). [MEDIUM]

---

File changes

Filename	Score	Description
src/routes/__root.tsx	4/5	Adds PostHogProvider with env var validation, exception autocapture, and logging config. Clean refactor of RootComponent → RootLayout.
src/routes/login.tsx	2/5	Captures login/logout events but critically missing identify() and reset() calls. Unsafe posthog.logger access.
src/routes/dashboard.invoices..tsx	3/5	Captures invoice update with properties. Unsafe logger access.
src/routes/dashboard.invoices.index.tsx	3/5	Captures invoice creation but without properties. Unsafe logger access.
package.json	5/5	Adds @posthog/react dependency correctly.
.env.example	5/5	Documents required PostHog env vars.
.gitignore	5/5	Excludes .env from version control.
src/vite-env.d.ts	5/5	Adds Vite client type reference for import.meta.env.

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	Valid TypeScript, dependencies resolve, @posthog/react brings in posthog-js transitively
Preserves existing env vars & configs	Yes	Existing code preserved; RootComponent cleanly renamed to RootLayout with PostHog wrapper added around it
No syntax or type errors	Yes	Code is syntactically valid; posthog.logger is a valid API per posthog-js types
Correct imports/exports	Yes	PostHogProvider and usePostHog correctly imported from @posthog/react
Minimal, focused changes	Yes	All changes relate to PostHog integration
Pre-existing issues	None	—

Issues

• Unsafe posthog.logger access: const posthogLogger = posthog.logger is called at component body level without optional chaining. If PostHogProvider is absent (production with missing env vars), usePostHog() returns undefined and this line throws a runtime error. Use posthog?.logger or guard the access. [MEDIUM]

Other completed criteria

• All changes are relevant to PostHog integration
• Correct files modified for TanStack Router + React pattern
• .env.example created with placeholder values
• .gitignore updated to exclude .env
• vite-env.d.ts added for Vite type support
• Code follows existing codebase patterns (hooks in components, event handling in form submit handlers)

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	@posthog/react ^1.11.1 added to package.json (transitively includes posthog-js)
PostHog client initialized	Yes	PostHogProvider with apiKey and api_host at root level with env var validation
capture()	Yes	4 meaningful capture calls: user_logged_in, user_logged_out, invoice_creation_submitted, invoice_update_submitted
identify()	No	No posthog.identify() call despite having a login flow with username available
Error tracking	Yes	capture_exceptions: true in PostHogProvider options enables automatic exception capture
Reverse proxy	No	No reverse proxy configured; client-side events may be blocked by ad blockers

Issues

• Missing posthog.identify() on login: The app captures user_logged_in in the login handler but never calls posthog.identify(username, { ... }). The username is available from the auth system. Without identify, all events remain anonymous and cannot be attributed to specific users. Add posthog.identify(username) after auth.login(username) in the login handler. [CRITICAL]
• Missing posthog.reset() on logout: The logout handler captures user_logged_out but never calls posthog.reset(). This means if another user logs in on the same browser, their events are attributed to the previous user. Add posthog.reset() alongside auth.logout(). [CRITICAL]
• No reverse proxy: No proxy configuration to prevent ad blockers from intercepting PostHog requests. Consider setting up a reverse proxy through Vercel rewrites or a managed proxy. [MEDIUM]
• Outdated defaults date: Uses defaults: '2026-01-30' while the latest documented snapshot is '2026-05-30'. Consider updating. [LOW]

Other completed criteria

• API key loaded from VITE_PUBLIC_POSTHOG_PROJECT_TOKEN environment variable
• API host loaded from VITE_PUBLIC_POSTHOG_HOST environment variable
• Graceful fallback when env vars are missing (throws in dev, renders without PostHog in prod)
• Logging configured with serviceName and environment
• Debug mode enabled in development via import.meta.env.DEV

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
login.tsx	user_logged_in, user_logged_out	Tracks login and logout actions; no properties attached; missing identify/reset
dashboard.invoices..tsx	invoice_update_submitted	Tracks invoice updates with invoice_id property for drill-down
dashboard.invoices.index.tsx	invoice_creation_submitted	Tracks new invoice creation; no properties attached
__root.tsx	captureException (auto)	Exception autocapture enabled via capture_exceptions: true

Issues

• Sparse event properties: invoice_creation_submitted and user_logged_in / user_logged_out have no properties attached. Adding context (e.g., username on login as a person property via identify, invoice title on creation) would enable richer analysis. [MEDIUM]

Other completed criteria

• Events represent real user actions (login, logout, create invoice, update invoice)
• Events enable product insights (login → create → update funnel is possible)
• No PII in event properties
• Event names are descriptive and use consistent snake_case convention
• posthog.logger.info() calls provide operational logging alongside analytics events

---

Reviewed by wizard workbench PR evaluator