[CI] (8ffef63) angular/angular-saas

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 8ffef63
App: angular/angular-saas
App directory: apps/angular/angular-saas
Workbench branch: wizard-ci-8ffef63-angular-angular-saas
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-07-20T22:59:37.203Z
Duration: 296.7s

YARA Scanner

✓ 70 tool calls scanned, 0 violations detected

No violations: ✓ 70 clean scans

[wizard-ci-bot]

Now I have enough context to complete the evaluation.

---

PR Evaluation Report

Summary

This PR integrates PostHog into an Angular SaaS application by adding posthog-js as a dependency, creating a root singleton PosthogService, initializing it in the root AppComponent, implementing user identification on login and returning sessions, resetting on logout, enabling exception capture, and instrumenting 9 meaningful SaaS events across auth, project management, team, profile, and settings flows.

Files changed	Lines added	Lines removed
15	+157	-1

Confidence score: 4/5 👍

• Missing NgZone.runOutsideAngular: The Angular docs explicitly recommend initializing PostHog outside the Angular zone to avoid performance issues with session recording change detection. The PosthogService does not use NgZone.runOutsideAngular. [MEDIUM]
• Missing defaults configuration option: The posthog.init() call omits the defaults option, which the docs show should be set (e.g., defaults: '2026-05-30') for proper default configuration. [MEDIUM]
• No reverse proxy configured: This is a client-only Angular app. A reverse proxy is recommended to prevent ad blockers from intercepting PostHog requests. [MEDIUM]
• Hardcoded API key in .env file: The .env file contains a real PostHog project token (phc_xxxx...CV6a) that is committed to the repository. While not a secret in the traditional sense, best practice is to use .env.example with placeholder values and keep actual keys out of source control. No .env.example was created or updated. [MEDIUM]

---

File changes

Filename	Score	Description
package.json	5/5	Adds posthog-js dependency
posthog.service.ts	3/5	Singleton service with SSR-safe proxy pattern, but missing NgZone.runOutsideAngular
app.component.ts	4/5	Init + returning-user identify in root component, but missing defaults option
login.component.ts	5/5	Identify + capture on login, captureException on error
logout.component.ts	5/5	Capture logout event + reset() + captureException on error
profile.component.ts	4/5	Profile update capture, no properties enrichment
notification-settings.component.ts	5/5	Well-enriched notification preferences event
preferences-settings.component.ts	5/5	Well-enriched workspace preferences event
security-settings.component.ts	5/5	2FA toggle and session revocation events with good properties
add-member-modal.component.ts	5/5	Team member added event with role property
create-project-modal.component.ts	5/5	Project created event with status and description properties
env.d.ts	5/5	TypeScript declarations for environment variables
environment.ts / environment.prod.ts	5/5	Environment config reads from import.meta.env
posthog-setup-report.md	4/5	Useful documentation but not a substitute for .env.example

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	Report confirms production build completed successfully
Preserves existing env vars & configs	Yes	All existing code preserved, only additive changes
No syntax or type errors	Yes	Clean TypeScript, proper Angular patterns
Correct imports/exports	Yes	All imports use correct Angular path aliases (@core/, @app/)
Minimal, focused changes	Yes	All changes are PostHog-related
Pre-existing issues	None	No pre-existing issues observed

Issues

• Hardcoded API key committed: The .env file contains a real PostHog project token. A .env.example file with placeholder values should be created, and .env should be in .gitignore. [MEDIUM]

Other completed criteria

• Build configuration is valid — posthog-js added correctly to dependencies
• Existing app functionality fully preserved
• TypeScript declarations properly added for environment variables

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js ^1.405.2 added to package.json
PostHog client initialized	No	Initialized in AppComponent.ngOnInit() via PosthogService, but missing NgZone.runOutsideAngular (per Angular docs) and missing defaults option
capture()	Yes	9 distinct capture calls across auth, settings, profile, project, and team flows
identify()	Yes	Called on login with credentials.id (stable ID) and on returning sessions in AppComponent; reset() on logout
Error tracking	Yes	capture_exceptions: true in init config + manual captureException() on login/logout errors
Reverse proxy	No	No reverse proxy configured for this client-only app

Issues

• Missing NgZone.runOutsideAngular: The Angular docs explicitly state PostHog should be initialized outside Angular's zone to prevent performance issues with session recording. The PosthogService.init() method should wrap the posthog.init() call in this.ngZone.runOutsideAngular(). [MEDIUM]
• Missing defaults option: The posthog.init() call should include defaults: '2026-05-30' per current PostHog docs for proper default configuration. [MEDIUM]
• No reverse proxy: Client-side PostHog requests may be blocked by ad blockers. Configure a reverse proxy or use PostHog's managed proxy service. [MEDIUM]

Other completed criteria

• API key loaded from environment variable (NG_APP_POSTHOG_PROJECT_TOKEN)
• Host correctly configured via environment variable (NG_APP_POSTHOG_HOST)
• SSR-safe proxy pattern in PosthogService prevents server-side errors
• posthog.reset() correctly called on logout before clearing credentials
• Identify uses credentials.id (stable auth ID), not email as distinct_id
• Person properties (email, name, role) correctly passed in identify, not in capture

---

PostHog insights and events ✅

Filename	PostHog events	Description
login.component.ts	user_logged_in, captureException	Tracks successful login with role and remember_session; captures login errors
logout.component.ts	user_logged_out, captureException	Tracks logout and resets identity; captures logout errors
profile.component.ts	profile_updated	Tracks profile save (no additional properties)
notification-settings.component.ts	notification_preferences_saved	Tracks notification settings with 5 boolean toggle states
preferences-settings.component.ts	workspace_preferences_saved	Tracks workspace preferences with theme, format, timezone, landing page
security-settings.component.ts	two_factor_authentication_changed, session_revoked	Tracks 2FA toggle state and session revocation (single/all with count)
add-member-modal.component.ts	team_member_added	Tracks team member addition with role
create-project-modal.component.ts	project_created	Tracks project creation with initial status and description presence

Issues

• No critical or medium issues with event quality.

Other completed criteria

• Events represent real user actions across the full SaaS product lifecycle
• Events enable product insights — can build funnels (login → project_created → team_member_added), retention, and engagement metrics
• Events include relevant contextual properties (role, toggle states, session counts)
• No PII in capture properties — email/name only in identify() person properties
• Event names are descriptive, consistent snake_case convention

---

Reviewed by wizard workbench PR evaluator