[CI] (6390616) javascript-node/express-todo

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 6390616
App: javascript-node/express-todo
App directory: apps/javascript-node/express-todo
Workbench branch: wizard-ci-6390616-javascript-node-express-todo
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-07-28T18:17:30.100Z
Duration: 393.8s

YARA Scanner

✓ 131 tool calls scanned, 0 violations detected

No violations: ✓ 131 clean scans

[wizard-ci-bot]

Now I have everything I need. Let me produce the evaluation.

---

PR Evaluation Report

Summary

This PR integrates posthog-node into a server-only Express.js todo API. It adds a centralized PostHog client module (posthog.js), instruments three CRUD event captures (todo_created, todo_updated, todo_deleted), sets up Express error handling via setupExpressErrorHandler, and adds graceful shutdown logic. However, every capture() call is missing the required distinctId parameter, which means events will fail at runtime.

Files changed	Lines added	Lines removed
5	+128	-5

Confidence score: 4/5 👍

• Missing distinctId in all capture() calls: The posthog-node SDK requires distinctId as a mandatory field in every capture() call. All three capture call sites omit it entirely, which will cause runtime errors or silently dropped events. The app has no auth, but even anonymous server-side events need a distinctId — a per-request or per-session identifier should be used, or at minimum a static application-level ID. [CRITICAL]
• posthog-setup-report.md is unnecessary: This markdown report is not part of the app code and adds noise to the PR. It should not be committed. [LOW]

---

File changes

Filename	Score	Description
posthog.js	4/5	New PostHog client singleton with env-var config and null-safe fallback. Well structured.
index.js	2/5	Adds capture calls, error handler, and shutdown — but all captures are missing distinctId.
package.json	5/5	Adds posthog-node dependency correctly.
.env.example	5/5	Documents required environment variables.
posthog-setup-report.md	2/5	Unnecessary report file committed to the repo.

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	No	The missing distinctId in capture() calls will cause runtime errors when CRUD endpoints are hit
Preserves existing env vars & configs	Yes	All existing app logic and structure preserved; only PostHog additions
No syntax or type errors	Yes	All JavaScript syntax is valid
Correct imports/exports	Yes	posthog-node correctly required, setupExpressErrorHandler correctly destructured
Minimal, focused changes	No	posthog-setup-report.md is an unnecessary file addition
Pre-existing issues	None	No pre-existing issues detected

Issues

• Missing distinctId causes runtime failures: Every posthog.capture() call in index.js omits the required distinctId field. The posthog-node SDK mandates this parameter — without it, events will either throw an error or be silently dropped. Even for an anonymous API, a synthetic per-request identifier (e.g., a request UUID or IP hash) is needed. [CRITICAL]
• Unnecessary report file: posthog-setup-report.md is a wizard-generated report that should not be committed to the repository. [LOW]

Other completed criteria

• Environment variables documented in .env.example
• Build configuration valid — posthog-node correctly added to dependencies
• Graceful shutdown correctly implemented with posthog.shutdown()
• Existing route logic and response behavior preserved

---

PostHog implementation ❌

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-node ^5.46.1 added to package.json
PostHog client initialized	Yes	Singleton client in posthog.js using new PostHog(token, { host, enableExceptionAutocapture: true })
capture()	No	Three capture calls present but all missing required distinctId — they will fail at runtime
identify()	N/A	Server-only app with no authentication
Error tracking	Yes	setupExpressErrorHandler(posthog, app) registered after routes; enableExceptionAutocapture enabled
Reverse proxy	N/A	Server-only app — reverse proxy not applicable

Issues

• All capture() calls missing distinctId: The posthog-node SDK requires { distinctId, event, properties } in every capture() call. All three call sites (todo_created, todo_updated, todo_deleted) omit distinctId. Since this API has no auth, the wizard should have used a request-level identifier (e.g., IP-based hash, request ID) or a static app-level ID. Without this, the integration is non-functional. [CRITICAL]

Other completed criteria

• API key correctly loaded from POSTHOG_PROJECT_TOKEN environment variable
• Host correctly loaded from POSTHOG_HOST environment variable
• Client null-checked before every usage with if (posthog) guards
• Graceful shutdown calls posthog.shutdown() on SIGINT/SIGTERM
• Error handler placed correctly after all routes

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
index.js	todo_created	Captured on POST /api/todos — tracks new todo creation with completed property
index.js	todo_updated	Captured on PATCH /api/todos/:id — tracks updates with title_updated, completion_updated, completed properties
index.js	todo_deleted	Captured on DELETE /api/todos/:id — tracks deletion with completed property
index.js	capturedException	setupExpressErrorHandler captures unhandled Express errors automatically

Issues

• Events will not arrive due to missing distinctId: While the event names and properties are well-designed, none of them will actually reach PostHog because every capture call is missing the required distinctId parameter. [CRITICAL]

Other completed criteria

• Events represent real user actions (CRUD operations on todos)
• Events enable product insights — could build a todo lifecycle funnel (created → updated → deleted)
• Events include relevant contextual properties (completion state, update flags)
• No PII in event properties — todo titles are intentionally excluded
• Event names follow consistent snake_case convention and describe the action clearly

---

Reviewed by wizard workbench PR evaluator