[CI] (3f39e0e) vue/movies

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 3f39e0e
App: vue/movies
App directory: apps/vue/movies
Workbench branch: wizard-ci-3f39e0e-vue-movies
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-23T22:27:36.645Z
Duration: 368.2s

YARA Scanner

✓ 176 tool calls scanned, 0 violations detected

No violations: ✓ 176 clean scans

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR integrates PostHog into a Vue.js movies app using posthog-js. It adds SDK initialization in main.js, custom event captures across several components (login, logout, media selection, search, trailer playback), error tracking via app.config.errorHandler, and a logging composable. However, user identification is completely missing despite the app having login/logout flows, and the logging composable uses a non-existent posthog.logger API.

Files changed	Lines added	Lines removed
11	+111	-3

Confidence score: 4/5 👍

• No posthog.identify() call: The app has a full login/logout flow (useAuth.ts composable), but PostHog identify() is never called after login. All events remain anonymous and cannot be linked to users. [CRITICAL]
• No posthog.reset() on logout: The handleLogout in NavBar.vue captures a logout_requested event but never calls posthog.reset(), so the next user on the same browser inherits the previous identity. [CRITICAL]
• posthog.logger API does not exist: The posthogLogger.ts composable calls posthog.logger.info() and posthog.logger.error(), which are not real PostHog SDK methods. The correct method is posthog.captureLog({ body, level, attributes }). These calls will throw runtime errors. [CRITICAL]
• No reverse proxy configured: No reverse proxy is set up in vite.config.js or elsewhere to route PostHog requests through the app's domain, leaving client-side tracking vulnerable to ad blockers. [MEDIUM]

---

File changes

Filename	Score	Description
.env.example	4/5	Correctly documents both required env vars
.gitignore	5/5	Properly excludes .env from version control
package.json	5/5	Adds posthog-js dependency
src/main.js	3/5	Good initialization pattern with error handler, but uses older defaults date and throws in dev when env vars are missing (unusual pattern)
src/composables/posthogLogger.ts	1/5	Uses non-existent posthog.logger.info/error API — will crash at runtime
src/components/NavBar.vue	2/5	Captures logout_requested but misses posthog.reset()
src/views/LoginView.vue	2/5	Captures login_completed but never calls posthog.identify()
src/components/media/MediaCard.vue	4/5	Good media_selected event with relevant properties
src/components/media/MediaHero.vue	4/5	Good trailer_started event
src/views/MediaDetailView.vue	2/5	Uses broken posthogLogger API; trailer_started event is fine
src/views/SearchView.vue	3/5	Good search_performed event but also uses broken posthogLogger

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	No	posthog.logger.info() / posthog.logger.error() will throw at runtime when the code path is hit
Preserves existing env vars & configs	Yes	Existing configs untouched; new env vars added separately
No syntax or type errors	No	posthog.logger is not a valid property — runtime TypeError
Correct imports/exports	Yes	All posthog-js imports are correct
Minimal, focused changes	Yes	All changes relate to PostHog integration
Pre-existing issues	None	—

Issues

• posthog.logger does not exist: The posthogLogger.ts composable calls posthog.logger.info() and posthog.logger.error(), which are not part of the posthog-js SDK. The correct API is posthog.captureLog({ body: message, level: 'info', attributes }). This will cause TypeError: Cannot read properties of undefined at runtime. [CRITICAL]
• Dev-only throw on missing env vars: main.js throws an Error in dev mode if env vars are missing. While the intent is helpful, this prevents the app from loading at all during development if PostHog isn't configured, which is unnecessarily aggressive. A console.warn would be more appropriate. [LOW]

Other completed criteria

• Environment variables documented in .env.example
• .env added to .gitignore
• package.json dependency is valid and parseable
• Build configuration is otherwise valid

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js ^1.434.12 added to package.json
PostHog client initialized	Yes	posthog.init() called in main.js with token, host, defaults, and logs config
capture()	Yes	Multiple meaningful capture calls: login_completed, logout_requested, media_selected, search_performed, trailer_started
identify()	No	Never called despite the app having a full login flow in useAuth.ts. No posthog.reset() on logout either.
Error tracking	Yes	app.config.errorHandler calls posthog.captureException(error) — correct Vue pattern
Reverse proxy	No	No reverse proxy configured in vite.config.js or elsewhere

Issues

• Missing posthog.identify(): The app has useAuth.ts with login() and logout() functions, and LoginView.vue already captures login_completed. But posthog.identify(username) is never called, so all events remain anonymous. Should call posthog.identify(user.value, { name: user.value }) after successful login. [CRITICAL]
• Missing posthog.reset() on logout: NavBar.vue handles logout but only captures an event. Should call posthog.reset() before or after logout() to unlink the user session. [CRITICAL]
• No reverse proxy: The app uses Vite which supports server.proxy configuration. A reverse proxy should be configured to prevent ad blockers from intercepting PostHog requests. [MEDIUM]
• Outdated defaults date: Uses '2026-01-30' but the latest documented default is '2026-05-30'. [LOW]

Other completed criteria

• API key loaded from VITE_POSTHOG_PROJECT_TOKEN environment variable
• Host correctly configured from VITE_POSTHOG_HOST environment variable
• .env.example documents both required variables

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
LoginView.vue	login_completed	Captures login completion, but without identify this event is anonymous
NavBar.vue	logout_requested	Captures logout intent, but without reset the session isn't unlinked
MediaCard.vue	media_selected	Captures when a user clicks a media card with media_id, media_type, collection
MediaHero.vue	trailer_started	Captures trailer play with media_id, media_type
MediaDetailView.vue	trailer_started	Duplicate trailer event, plus broken posthogLogger calls
SearchView.vue	search_performed	Captures search with results_count, plus broken posthogLogger calls
main.js	captureException	Global error boundary captures unhandled Vue errors

Issues

• posthogLogger calls will crash: MediaDetailView.vue and SearchView.vue use posthogLogger.info() and posthogLogger.error() which call the non-existent posthog.logger API. These will throw runtime errors when triggered. [CRITICAL]
• login_completed lacks user context: Without identify(), the login_completed event can't be tied to the user who logged in. The event itself is good but useless for user-level analytics. [MEDIUM]
• Redundant env check guards: Every capture call is wrapped in if (import.meta.env.VITE_POSTHOG_PROJECT_TOKEN && import.meta.env.VITE_POSTHOG_HOST). This is unnecessary since posthog.capture() safely no-ops when not initialized. It adds clutter to every call site. [LOW]

Other completed criteria

• Events represent real user actions (login, search, media selection, trailer playback)
• Events could enable product insights (search → media_selected → trailer_started funnel)
• Events include relevant properties (media_id, media_type, results_count)
• No PII in event properties
• Event names use consistent snake_case convention

---

Reviewed by wizard workbench PR evaluator