[CI] (3f39e0e) sveltekit/CMSaasStarter

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 3f39e0e
App: sveltekit/CMSaasStarter
App directory: apps/sveltekit/CMSaasStarter
Workbench branch: wizard-ci-3f39e0e-sveltekit-CMSaasStarter
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-23T22:23:44.227Z
Duration: 610.3s

YARA Scanner

✓ 223 tool calls scanned, 0 violations detected

No violations: ✓ 223 clean scans

[wizard-ci-bot]

Now I have enough context. The hooks.server.ts was NOT modified by this PR — no server-side error handling was added. Let me produce the evaluation.

---

PR Evaluation Report

Summary

This PR integrates PostHog into a SvelteKit SaaS starter app (CMSaasStarter) with client-side analytics via posthog-js initialized in hooks.client.ts, user identification tied to Supabase auth, custom event captures across multiple components, and server-side logging via OpenTelemetry OTLP (instead of posthog-node). The svelte.config.js is updated with paths.relative: false for session replay compatibility.

Files changed	Lines added	Lines removed
13	+178	-3

Confidence score: 4/5 👍

• No reverse proxy configured: Client-side posthog-js sends events directly to PostHog without a reverse proxy, meaning ad blockers can silently drop all events. [MEDIUM]
• posthog.logger.info() is not a documented API: The call posthog.logger.info("contact form submission completed", ...) in contact_us/+page.svelte does not appear in the posthog-js SDK reference. The documented method is posthog.captureLog(). This will likely fail at runtime. [MEDIUM]
• No server-side error tracking: The existing hooks.server.ts was not modified to add a handleError export. Server-side exceptions will not be captured by PostHog. [MEDIUM]
• Over-engineered server-side approach: Four OpenTelemetry packages are added for server-side log capture instead of using the standard posthog-node SDK, adding unnecessary complexity and diverging from the documented SvelteKit pattern. [MEDIUM]

---

File changes

Filename	Score	Description
hooks.client.ts	4/5	Client-side PostHog init with env var validation, error tracking via handleError, and logs config. Uses older defaults: "2026-01-30" instead of current "2026-05-30".
src/lib/server/posthog-logs.ts	3/5	Server-side OTLP log exporter. Functional but non-standard — uses 4 OpenTelemetry deps instead of posthog-node.
+layout.svelte (account)	5/5	Well-implemented identify/reset flow tied to Supabase auth state changes. Uses user.id as distinct_id, handles account switching with reset().
svelte.config.js	5/5	Correctly adds paths.relative: false per SvelteKit session replay requirements.
.env.example	5/5	Documents both PUBLIC_POSTHOG_PROJECT_TOKEN and PUBLIC_POSTHOG_HOST.
package.json	4/5	Adds posthog-js but also 4 OTel packages. Missing posthog-node.
Component files (6 files)	4/5	Good event captures across user flows. posthog.logger.info call is potentially invalid.

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	All syntax is valid; posthog.logger.info would only fail at runtime if the property doesn't exist
Preserves existing env vars & configs	Yes	Existing Supabase and Stripe configs untouched; auth state change handler preserves invalidate behavior
No syntax or type errors	Yes	TypeScript and Svelte syntax is correct
Correct imports/exports	Yes	SvelteKit-idiomatic imports (/static/public, /environment)
Minimal, focused changes	No	4 OpenTelemetry packages for server-side logging is over-engineered vs. posthog-node
Pre-existing issues	None	Base app has no relevant pre-existing issues

Issues

• posthog.logger.info() may not exist: The posthog-js SDK reference documents posthog.captureLog({ body, level, attributes }) but not posthog.logger.info(). This could be a hallucinated API that fails silently or throws at runtime. Use posthog.captureLog({ body: "contact form submission completed", level: "info", attributes: { workflow: "contact_form" } }) instead. [MEDIUM]
• Older defaults date: defaults: "2026-01-30" is used instead of the current "2026-05-30". This means some newer default behaviors may not be applied. [LOW]

Other completed criteria

• All changes are PostHog-related
• .env.example properly updated with placeholder values
• svelte.config.js correctly sets paths.relative: false
• Build configuration is valid (package.json parseable)

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js ^1.433.7 added to dependencies
PostHog client initialized	Yes	Initialized in hooks.client.ts via init() export with env var guards
capture()	Yes	7 meaningful capture calls across client components
identify()	Yes	posthog.identify(user.id, { email }) tied to Supabase auth with proper reset on sign-out
Error tracking	Yes	capture_exceptions: true in init + handleError client hook with captureException()
Reverse proxy	No	No reverse proxy configured; events sent directly to PostHog host

Issues

• No reverse proxy: Client-side posthog-js sends directly to the PostHog host. Ad blockers can silently drop all events and session recordings. Configure SvelteKit rewrites or use PostHog's managed reverse proxy. [MEDIUM]
• No server-side error tracking: hooks.server.ts exists but was not modified to export a handleError function for server-side exception capture. Server errors will go untracked. [MEDIUM]
• No posthog-node installed: Server-side uses OpenTelemetry OTLP log export instead of the standard posthog-node SDK. This means no server-side capture() calls, no feature flags, and diverges from the documented SvelteKit integration pattern. [MEDIUM]

Other completed criteria

• API key loaded from PUBLIC_POSTHOG_PROJECT_TOKEN environment variable (not hardcoded)
• Host correctly loaded from PUBLIC_POSTHOG_HOST environment variable
• posthog.reset() called on sign-out
• Account switching handled correctly (reset before re-identify)
• paths.relative: false set in svelte.config.js for session replay

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
+layout.svelte	user_signed_out, identify	User identity management tied to Supabase auth state changes
change_password/+page.svelte	password_reset_email_requested	Tracks successful password reset email sends
settings_module.svelte	account_deleted, account_settings_updated	Tracks account management actions with operation property
create_profile/+page.svelte	profile_created	Tracks successful profile creation
pricing_module.svelte	subscription_checkout_started	Tracks plan selection with plan_id and billing_interval
contact_us/+page.svelte	contact_form_submitted	Tracks contact form submissions; also uses questionable posthog.logger.info
subscribe/[slug]/+page.server.ts	Server-side OTLP log	Logs checkout session creation (not a PostHog event)
contact_us/+page.server.ts	Server-side OTLP log	Logs contact request persistence (not a PostHog event)

Issues

• Server-side logs are not PostHog events: The OTLP log entries in +page.server.ts files go to PostHog's logs endpoint, not as analytics events. They won't appear in funnels, trends, or retention charts. If server-side event tracking is desired, use posthog-node with capture(). [MEDIUM]

Other completed criteria

• Events represent real user actions (signup, checkout, settings changes, contact form)
• Events enable product insights (subscription funnel: pricing view → checkout started → checkout completed)
• Events include relevant properties (plan_id, billing_interval, operation)
• No PII in capture() properties — email only passed via identify() person properties
• Consistent snake_case naming convention across all events

---

Reviewed by wizard workbench PR evaluator