[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 963eeb8
App: javascript-node/express-todo
App directory: apps/javascript-node/express-todo
Workbench branch: wizard-ci-963eeb8-javascript-node-express-todo
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-03T18:18:28.748Z
Duration: 269.0s

YARA Scanner

✓ 95 tool calls scanned, 0 violations detected

No violations: ✓ 95 clean scans

[wizard-ci-bot]

PR Evaluation Report

Summary

This PR integrates PostHog into a server-side Express.js todo API app using the posthog-node SDK. It adds three custom event captures (todo_created, todo_updated, todo_deleted), error tracking via setupExpressErrorHandler, and environment variable configuration via .env.example. However, every capture() call is missing the required distinctId parameter, rendering them broken.

Files changed	Lines added	Lines removed
3	+56	-3

Confidence score: 5/5 🧙

• Missing distinctId in all capture() calls: The posthog-node SDK requires a distinctId field in every capture() call. All three capture calls omit it, meaning events will either fail silently or produce data associated with no user. The app should extract a user identifier from the request (e.g., session, auth header, or IP) and pass it as distinctId. [CRITICAL]
• No shutdown() on process exit: While less critical for a long-running Express server than for serverless, posthog.shutdown() should be called on SIGTERM/SIGINT to flush any queued events before the process exits. [MEDIUM]

---

File changes

Filename	Score	Description
apps/basic-integration/javascript-node/express-todo/index.js	3/5	Adds PostHog initialization, three capture events (all missing distinctId), and error handler setup
apps/basic-integration/javascript-node/express-todo/package.json	4/5	Adds posthog-node and dotenv dependencies
apps/basic-integration/javascript-node/express-todo/.env.example	4/5	Documents required PostHog environment variables

---

App sanity check ✅

Criteria	Result	Description
App builds and runs	Yes	No syntax errors; dependencies are correctly declared
Preserves existing env vars & configs	Yes	Existing Express app logic is preserved; only PostHog additions
No syntax or type errors	Yes	All JavaScript is syntactically valid
Correct imports/exports	Yes	PostHog and setupExpressErrorHandler correctly imported from posthog-node
Minimal, focused changes	Yes	Changes are focused on PostHog integration; minor refactor of title/completion variables is reasonable
Pre-existing issues	None	Base app is a simple, functional Express todo API

Other completed criteria

• Environment variables documented in .env.example
• Build configuration valid with correct package.json entries
• Graceful null check pattern for PostHog client (posthog ? ... : null)

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-node@^5.51.6 added to package.json
PostHog client initialized	Yes	new PostHog(posthogToken, { host: posthogHost, enableExceptionAutocapture: true }) with null-safety guard
capture()	No	Three capture calls exist but all are missing the required distinctId field
identify()	N/A	Server-only app
Error tracking	Yes	setupExpressErrorHandler(posthog, app) correctly wired up
Reverse proxy	N/A	Server-only app

Issues

• Missing distinctId in all capture() calls: The posthog-node SDK's capture() method requires a distinctId property. All three calls (todo_created, todo_updated, todo_deleted) omit it entirely. Without a distinctId, events cannot be attributed to any user and may fail silently. The app should derive a user identifier from the request context (e.g., session ID, authenticated user ID, or req.ip as a last resort) and pass it in each capture call. Example: posthog.capture({ distinctId: req.sessionID, event: 'todo_created', ... }). [CRITICAL]
• No graceful shutdown: The app never calls posthog.shutdown(). When the Express server is stopped (e.g., via SIGTERM in production), queued events may be lost. Add a process signal handler: process.on('SIGTERM', async () => { await posthog.shutdown(); process.exit(0); }). [MEDIUM]

Other completed criteria

• API key loaded from environment variable (POSTHOG_PROJECT_TOKEN)
• Host correctly configured from environment variable (POSTHOG_HOST)
• Helpful error messages when env vars are missing (in non-production)

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
index.js	todo_created	Captures when a todo is created, with completed property
index.js	todo_updated	Captures when a todo is updated, with title_updated, completion_updated, completed properties
index.js	todo_deleted	Captures when a todo is deleted (no properties)
index.js	setupExpressErrorHandler	Captures unhandled Express errors via PostHog error tracking

Issues

• All events lack distinctId: Without user attribution, these events cannot power funnels, retention, or any per-user analysis. The events represent real actions but are unusable in their current form. [CRITICAL]
• todo_deleted has no properties: The delete event captures no contextual information (e.g., whether the deleted todo was completed). This limits insight potential. [LOW]

Other completed criteria

• Event names are descriptive and use consistent snake_case convention
• Events represent real user actions (create, update, delete todos)
• Events could enable product insights (todo lifecycle funnel) if distinctId were present
• todo_updated includes useful properties (title_updated, completion_updated, completed)
• No PII in event properties

---

Reviewed by wizard workbench PR evaluator