[wizard-ci-bot]

Automated wizard CI run

Source: scheduled
Trigger ID: cc5471b
App: tanstack-router/tanstack-router-file-based-saas
App directory: apps/tanstack-router/tanstack-router-file-based-saas
Workbench branch: wizard-ci-cc5471b-tanstack-router-tanstack-router-file-based-saas
Wizard branch: main
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-10-28T17:04:51.583Z
Duration: 355.0s

YARA Scanner

✓ 176 tool calls scanned, 0 violations detected

No violations: ✓ 176 clean scans

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR adds PostHog integration to a TanStack Router (file-based routing) React SaaS app. It installs @posthog/react, initializes PostHog via PostHogProvider in the root component, wraps the app with PostHogErrorBoundary, and adds custom event captures for login, logout, invoice creation, and invoice update flows.

Files changed	Lines added	Lines removed
8	+75	-4

Confidence score: 5/5 🧙

• Missing posthog.identify() on login: The login handler calls posthog?.capture('login_completed') but never calls posthog.identify() with the username. Events are not associated with the authenticated user, breaking user-level analytics, session replay linking, and error attribution. [CRITICAL]
• Missing posthog.reset() on logout: The logout handler captures a logout_completed event but never calls posthog.reset(), so the next user on the same browser inherits the previous user's identity. [MEDIUM]
• No reverse proxy configured: No Vite proxy rewrites or other reverse proxy setup to avoid ad-blocker interception of PostHog requests. [MEDIUM]

---

File changes

Filename	Score	Description
.env.example	5/5	Adds PostHog env var placeholders
.gitignore	5/5	Adds .env to gitignore
package.json	5/5	Adds @posthog/react dependency
src/routes/__root.tsx	4/5	Initializes PostHogProvider with error boundary; env var validation; minor issue with ui_host pointing to ingestion host
src/routes/dashboard.invoices..tsx	4/5	Captures invoice_updated event with properties; uses posthog?.logger.info() which is not a documented public API
src/routes/dashboard.invoices.index.tsx	4/5	Captures invoice_created event with properties; same logger.info concern
src/routes/login.tsx	2/5	Captures login/logout events but missing identify() and reset() calls
tsconfig.json	5/5	Adds vite/client types for import.meta.env support

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	Valid TypeScript/JSX, dependencies resolve
Preserves existing env vars & configs	Yes	All existing code preserved; PostHog wraps existing render output
No syntax or type errors	Yes	All syntax is valid; optional chaining used consistently
Correct imports/exports	Yes	@posthog/react imports are correct (PostHogProvider, PostHogErrorBoundary, usePostHog)
Minimal, focused changes	Yes	Only PostHog-related additions
Pre-existing issues	None	Base app appears functional

Issues

• ui_host misconfigured: ui_host is set to the same value as api_host (the ingestion endpoint). ui_host should point to the PostHog app UI (e.g., https://us.posthog.com), not the ingestion host. This will break toolbar functionality. [LOW]
• posthog?.logger.info() usage: The logger property is not a documented public API on the PostHog JS SDK. The documented method for sending logs is posthog.captureLog(). These calls may silently fail or throw at runtime. [LOW]

Other completed criteria

• All changes are relevant to PostHog integration
• Correct files modified for React/TanStack Router framework
• Code follows existing codebase patterns (hooks in components, optional chaining)
• .env.example and .gitignore properly updated
• tsconfig.json updated with vite/client types for env var support

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	@posthog/react ^1.11.3 added to dependencies (includes posthog-js transitively)
PostHog client initialized	Yes	PostHogProvider with apiKey and options wrapping the root component
capture()	Yes	4 custom events: login_completed, logout_completed, invoice_created, invoice_updated
identify()	No	Not called anywhere — login captures an event but never identifies the user
Error tracking	Yes	PostHogErrorBoundary wraps the app + capture_exceptions: true in init options
Reverse proxy	No	No Vite proxy rewrites or middleware configured

Issues

• Missing posthog.identify() on login: The onSubmit handler in login.tsx calls auth.login(username) and posthog?.capture('login_completed') but never calls posthog?.identify(username, { ... }). All events remain anonymous, defeating user-level analytics. Should call posthog?.identify(username) after auth.login(username). [CRITICAL]
• Missing posthog.reset() on logout: The logout button calls auth.logout() and captures logout_completed but never calls posthog?.reset(). Shared devices will attribute events from the next user to the previous one. Should call posthog?.reset() after auth.logout(). [MEDIUM]
• No reverse proxy: Client-side PostHog requests go directly to us.i.posthog.com and are susceptible to ad blockers. A Vite proxy rewrite or similar should be configured. [MEDIUM]

Other completed criteria

• API key loaded from VITE_PUBLIC_POSTHOG_PROJECT_TOKEN environment variable
• Host loaded from VITE_PUBLIC_POSTHOG_HOST environment variable
• Dev-mode validation throws errors if env vars are missing
• Graceful fallback renders app without PostHog if env vars are absent in production

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
__root.tsx	captureException (via ErrorBoundary)	Wraps entire app with PostHogErrorBoundary for automatic exception capture
login.tsx	login_completed, logout_completed	Captures auth flow events in event handlers
dashboard.invoices.index.tsx	invoice_created	Captures invoice creation with invoice_id property
dashboard.invoices..tsx	invoice_updated	Captures invoice update with invoice_id property

Issues

• Events not linked to users: Without identify(), all captured events (login_completed, invoice_created, etc.) are anonymous. Funnels, retention, and user-level insights will not work correctly. [CRITICAL]

Other completed criteria

• Events represent real user actions (login, logout, invoice CRUD)
• Events enable product insights (login → invoice creation funnel possible)
• Events include relevant properties (invoice_id on invoice events)
• No PII in capture() event properties
• Event names are descriptive and use consistent snake_case convention

---

Reviewed by wizard workbench PR evaluator