[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 963eeb8
App: javascript-node/koa-notes
App directory: apps/javascript-node/koa-notes
Workbench branch: wizard-ci-963eeb8-javascript-node-koa-notes
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-03T18:19:53.269Z
Duration: 259.4s

YARA Scanner

✓ 94 tool calls scanned, 0 violations detected

No violations: ✓ 94 clean scans

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR integrates PostHog into a server-only Koa/Node.js notes API application using the posthog-node SDK. It adds event capture for CRUD operations on notes and folders, error tracking via captureException, and graceful shutdown. However, every capture() call is missing the required distinctId parameter, rendering all event captures non-functional.

Files changed	Lines added	Lines removed
4	+83	-3

Confidence score: 5/5 🧙

• All capture() calls missing required distinctId: The posthog-node SDK requires distinctId as a mandatory field in capture(). All five capture calls omit it, meaning events will either throw at runtime or produce orphaned events with no user association. The app has no authentication, so a session-based or request-scoped ID approach is needed. [CRITICAL]
• captureException in error handler lacks user context: The app.on('error') handler calls posthog.captureException(error) without any context or distinct ID, making it difficult to associate errors with specific users or requests. [MEDIUM]

---

File changes

Filename	Score	Description
posthog.js	4/5	New file: initializes PostHog Node client with env vars, good null-safety pattern, enables exception autocapture
index.js	2/5	Adds capture calls and error tracking, but all captures missing required distinctId
package.json	5/5	Adds posthog-node dependency, minor reorder of existing dep
.env.example	5/5	Documents required environment variables

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	Code parses and starts without errors; missing distinctId is a runtime logic issue
Preserves existing env vars & configs	Yes	Existing app logic and routes unchanged
No syntax or type errors	Yes	All JavaScript is syntactically valid
Correct imports/exports	Yes	PostHog imported from posthog-node, posthog exported from posthog.js
Minimal, focused changes	Yes	Only PostHog-related additions
Pre-existing issues	None	—

Issues

• No critical app sanity issues.

Other completed criteria

• Environment variables documented in .env.example
• Build configuration valid with posthog-node added to dependencies
• Graceful shutdown with posthog.shutdown() on SIGINT/SIGTERM

---

PostHog implementation ❌

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-node ^5.51.6 added to package.json
PostHog client initialized	Yes	new PostHog(projectToken, { host, enableExceptionAutocapture: true }) with null fallback
capture()	No	All 5 capture calls missing required distinctId — events will be broken
identify()	N/A	Server-only app
Error tracking	Yes	captureException in app.on('error') handler, enableExceptionAutocapture enabled
Reverse proxy	N/A	Server-only app

Issues

• Missing distinctId in all capture calls: The posthog-node SDK requires distinctId as a mandatory parameter in capture({ distinctId, event, properties }). All five capture calls (folder_created, folder_deleted, note_created, note_updated, note_deleted) omit it entirely. This means events either fail silently or produce data that cannot be attributed to any user. Since this is a server-side app without authentication, a reasonable approach would be to use a request-scoped identifier (e.g., from a cookie, header, or IP-based hash) or a generic server identity. [CRITICAL]
• Error handler lacks user context: posthog.captureException(error) in the app.on('error') handler has no context binding (no withContext or distinctId), making error events unattributable to specific users or requests. [MEDIUM]

Other completed criteria

• API key loaded from POSTHOG_PROJECT_TOKEN environment variable
• Host correctly configured from POSTHOG_HOST environment variable
• Proper null-checking pattern with conditional PostHog client creation
• Graceful shutdown ensures event queue is flushed

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
index.js	folder_created, folder_deleted	Tracks folder CRUD operations with folder_id
index.js	note_created, note_updated, note_deleted	Tracks note lifecycle with note_id, folder_id, and update flags
index.js	captureException	Captures unhandled Koa application errors

Issues

• Events are non-functional without distinctId: While the events are well-designed with good names and relevant properties, they will not work correctly due to the missing distinctId parameter. [CRITICAL]

Other completed criteria

• Events represent real user actions (CRUD on notes and folders)
• Events enable product insights (could build funnels: create → update → delete)
• Events include enriched properties (IDs, update flags for note_updated)
• No PII in event properties
• Meaningful, consistent snake_case naming convention

---

Reviewed by wizard workbench PR evaluator