[wizard-ci-bot]

Automated wizard CI run

Source: scheduled
Trigger ID: cc5471b
App: tanstack-start/tanstack-start-saas
App directory: apps/tanstack-start/tanstack-start-saas
Workbench branch: wizard-ci-cc5471b-tanstack-start-tanstack-start-saas
Wizard branch: main
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-10-28T17:06:33.994Z
Duration: 335.7s

YARA Scanner

✓ 149 tool calls scanned, 0 violations detected

No violations: ✓ 149 clean scans

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR adds PostHog integration to a TanStack Start SaaS invoice management app. It installs posthog-js, @posthog/react, and posthog-node, wraps the app in a PostHogProvider, adds custom event captures for invoice actions, and sets up error tracking via captureException in the catch boundary. Additionally, it introduces a server-side OpenTelemetry log exporter with 5 extra OTel dependencies — an unnecessary and overly complex approach given that posthog-node is already installed but never used for event capture.

Files changed	Lines added	Lines removed
9	+139	-3

Confidence score: 3/5 🤔

• Invalid OpenTelemetry dependency versions: The OTel packages use version numbers like ^0.223.0, ^0.300.0, and ^3.0.0 that are almost certainly hallucinated, which would cause npm install to fail and prevent the app from building. [CRITICAL]
• No user identification: There is no posthog.identify() call anywhere in the app. Without identify, all events remain anonymous and cannot be linked to real users. [CRITICAL]
• No reverse proxy configured: The TanStack Start docs recommend configuring a reverse proxy for client-side PostHog to avoid ad blockers, but none is set up. [MEDIUM]
• posthog-node installed but unused: The Node SDK is added to dependencies but never imported or used. Server-side "integration" is done through a raw OTel log exporter, which is a non-standard approach that adds 5 unnecessary dependencies and 72 lines of complex code. [MEDIUM]
• Events lack properties: All capture() calls are bare with no contextual properties (e.g., invoice ID, amount), limiting their analytical value. [MEDIUM]

---

File changes

Filename	Score	Description
.env.example	4/5	Adds PostHog env vars with placeholder values
package.json	2/5	Adds PostHog SDKs correctly but includes 5 OTel packages with likely invalid versions; posthog-node installed but unused
src/routes/__root.tsx	3/5	PostHogProvider setup is functional but uses outdated defaults: '2025-05-24' instead of '2026-08-30'
src/components/DefaultCatchBoundary.tsx	3/5	Error tracking via captureException works but uses useEffect instead of direct call
src/routes/posts..tsx	3/5	Captures invoice_marked_paid in event handler (good), but no properties
src/routes/posts.index.tsx	3/5	Captures invoice_created in event handler (good), but no properties
src/routes/posts_..deep.tsx	3/5	Captures invoice_marked_paid in event handler, no properties
src/utils/invoices.ts	2/5	Dynamically imports OTel logger for server-side logging — overly complex
src/utils/posthog-logs.server.ts	2/5	Custom OTel log exporter; non-standard approach, likely broken due to invalid dependency versions

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	No	OTel dependency versions (^0.223.0, ^0.300.0) are almost certainly invalid and would cause npm install to fail
Preserves existing env vars & configs	Yes	No existing configs are modified or removed
No syntax or type errors	Yes	All TypeScript/JSX syntax is valid
Correct imports/exports	Yes	PostHog imports from posthog-js, @posthog/react are correct
Minimal, focused changes	No	5 OTel dependencies and 72-line log exporter are unnecessary when posthog-node is already installed
Pre-existing issues	None	Base app appears functional

Issues

• Invalid OTel dependency versions: @opentelemetry/api-logs: ^0.223.0, @opentelemetry/exporter-logs-otlp-http: ^0.300.0, @opentelemetry/sdk-node: ^0.300.0 — these version numbers are inconsistent with OpenTelemetry's release cadence and are almost certainly hallucinated. npm install would fail. [CRITICAL]
• Unnecessary complexity: posthog-node is installed as a dependency but never imported. Instead, 5 OTel packages and a custom log exporter are added. The standard approach is to use posthog-node directly for server-side event capture. [MEDIUM]
• Outdated defaults: defaults: '2025-05-24' is used instead of the latest '2026-08-30' from the docs. [LOW]

Other completed criteria

• Environment variables documented in .env.example
• Build configuration structure is valid (aside from OTel versions)

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js, @posthog/react, and posthog-node added to package.json
PostHog client initialized	Yes	PostHogProvider with apiKey and options in __root.tsx shellComponent
capture()	Yes	invoice_created and invoice_marked_paid captured in event handlers
identify()	No	No posthog.identify() call anywhere — all events remain anonymous
Error tracking	Yes	captureException in DefaultCatchBoundary + capture_exceptions: true in config
Reverse proxy	No	No reverse proxy configured for client-side tracking

Issues

• Missing user identification: No posthog.identify() is called anywhere in the app. The TanStack Start docs explicitly show identify being called on login. Without it, events cannot be linked to specific users, breaking funnels, retention, and person profiles. [CRITICAL]
• No reverse proxy: No rewrites or proxy configuration for PostHog requests. Client-side events may be blocked by ad blockers. [MEDIUM]
• posthog-node unused: The Node SDK is installed but never used for server-side event capture. Server functions like createInvoiceFn and markInvoicePaid would benefit from server-side posthog.capture() calls with proper distinctId. [MEDIUM]

Other completed criteria

• API key loaded from VITE_PUBLIC_POSTHOG_PROJECT_TOKEN environment variable
• API host loaded from VITE_PUBLIC_POSTHOG_HOST environment variable
• PostHog initialized before any capture calls via PostHogProvider in root
• Error tracking configured with both capture_exceptions: true and explicit captureException in error boundary

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
posts.index.tsx	invoice_created	Captured when user creates a new invoice — no properties attached
posts..tsx	invoice_marked_paid	Captured when user marks an invoice as paid — no properties
posts_..deep.tsx	invoice_marked_paid	Same event on the deep route variant — no properties
DefaultCatchBoundary.tsx	captureException	Captures rendering errors via error boundary
posthog-logs.server.ts	OTel logs: invoice_creation_completed, invoice_payment_completed	Server-side OTel log emissions (not PostHog events)

Issues

• Events lack properties: All posthog.capture() calls are bare — invoice_created doesn't include invoice title, amount, or ID; invoice_marked_paid doesn't include invoice ID or amount. This severely limits analytical value (can't break down by amount range, can't correlate specific invoices). [MEDIUM]

Other completed criteria

• Events represent real user actions (creating invoices, marking as paid)
• Events enable basic product insights (creation → payment funnel possible)
• No PII in event properties
• Event names are descriptive and use consistent snake_case convention

---

Reviewed by wizard workbench PR evaluator