[CI] (f475df7) tanstack-router/tanstack-router-code-based-saas

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: f475df7
App: tanstack-router/tanstack-router-code-based-saas
App directory: apps/tanstack-router/tanstack-router-code-based-saas
Workbench branch: wizard-ci-f475df7-tanstack-router-tanstack-router-code-based-saas
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-06-22T18:55:21.192Z
Duration: 2559.5s

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR integrates PostHog into a TanStack Router (code-based) React SPA ("CloudFlow") by adding posthog-js and @posthog/react, wrapping the root component with PostHogProvider, configuring a Vite dev-server reverse proxy, and instrumenting 12 custom events across invoices, team members, authentication, and plan upgrade flows.

Files changed	Lines added	Lines removed
6	+151	-14

Confidence score: 4/5 👍

• PII in event properties: team_member_viewed sends user_name (a person's name) as an event property — names should be set via person properties, not in capture() calls. [MEDIUM]
• No .env.example committed: Environment variables (VITE_PUBLIC_POSTHOG_PROJECT_TOKEN, VITE_PUBLIC_POSTHOG_HOST, VITE_PUBLIC_POSTHOG_ASSET_HOST) are only documented in the setup report, not in a committed .env.example file. The report itself lists this as a TODO. [MEDIUM]
• Reverse proxy is dev-only: The Vite server.proxy configuration only applies during vite dev. In production, /ingest requests will have no proxy target, meaning PostHog events will fail unless hosting-layer proxy is separately configured. [MEDIUM]

---

File changes

Filename	Score	Description
src/main.tsx	4/5	Added PostHogProvider wrapper, identify/reset on login/logout, 12 capture() calls across all major user flows. One PII issue with user_name in event properties.
vite.config.js	4/5	Converted to factory function, added reverse proxy for /ingest/static, /ingest/array, /ingest — correct routing pattern but dev-only.
package.json	5/5	Added posthog-js and @posthog/react as dependencies.
tsconfig.json	5/5	Added "types": ["vite/client"] for import.meta.env type support.
.gitignore	5/5	Added .env to prevent committing secrets.
posthog-setup-report.md	4/5	Comprehensive report documenting events, dashboards, and next steps.

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	Syntax is valid, types should resolve with vite/client types added
Preserves existing env vars & configs	Yes	No existing env vars or configs were modified destructively
No syntax or type errors	Yes	All changes use valid TypeScript/JSX syntax
Correct imports/exports	Yes	PostHogProvider, usePostHog correctly imported from @posthog/react
Minimal, focused changes	Yes	All changes are PostHog-related, no scope creep
Pre-existing issues	None	—

Issues

• No .env.example committed: The required environment variables (VITE_PUBLIC_POSTHOG_PROJECT_TOKEN, VITE_PUBLIC_POSTHOG_HOST, VITE_PUBLIC_POSTHOG_ASSET_HOST) are documented only in the setup report. A .env.example file should be committed so collaborators know what to set. [MEDIUM]

Other completed criteria

• .gitignore updated to exclude .env
• tsconfig.json correctly updated with vite/client types
• package.json has correct dependency entries
• Build script (vite build && tsc --noEmit) should still work

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js@^1.392.0 and @posthog/react@^1.10.3 added to dependencies
PostHog client initialized	Yes	PostHogProvider wraps root component with apiKey, api_host, defaults, capture_exceptions, and debug options
capture()	Yes	12 meaningful capture calls across all major user flows
identify()	Yes	posthog.identify(username, { username }) on login, posthog.reset() on both logout paths
Error tracking	Yes	capture_exceptions: true enabled in PostHogProvider options
Reverse proxy	Yes	Vite dev-server proxy configured with correct /ingest/static, /ingest/array, /ingest routing pattern

Issues

• Reverse proxy is dev-only: The server.proxy in vite.config.js only runs during vite dev. Production builds serve static files with no proxy, so api_host: '/ingest' will fail in production unless hosting-layer proxy (nginx, Cloudflare, Vercel rewrites) is separately configured. This is not documented in the report. [MEDIUM]

Other completed criteria

• API key loaded from import.meta.env.VITE_PUBLIC_POSTHOG_PROJECT_TOKEN (not hardcoded)
• Host configured via /ingest reverse proxy with ui_host fallback
• Proxy correctly routes /ingest/static and /ingest/array to asset host, /ingest to ingest host
• posthog.reset() called on both logout paths (profile page and login page)
• defaults: '2026-01-30' set per current SDK best practices

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
src/main.tsx	user_signed_in, user_signed_out	Authentication flow tracking with identify/reset
src/main.tsx	invoice_created, invoice_creation_failed	Invoice creation success/failure funnel
src/main.tsx	invoice_updated, invoice_update_failed	Invoice update success/failure tracking
src/main.tsx	invoice_viewed, invoice_notes_toggled	Invoice detail engagement tracking
src/main.tsx	plan_upgrade_clicked	Revenue signal — upgrade button click
src/main.tsx	team_member_viewed, team_members_filtered, team_members_sorted	Team browsing behavior tracking
src/main.tsx	captureException (via capture_exceptions: true)	Automatic exception autocapture

Issues

• PII in team_member_viewed event: The event sends user_name (a person's name) as an event property. Per PostHog best practices, names are PII and should be set via person properties (identify() or ``), not in capture() event properties. Remove `user_name` from the capture call or move it to person properties. [MEDIUM]

Other completed criteria

• Events represent real user actions (login, invoice CRUD, team browsing, plan upgrade)
• Events enable product insights — can build invoice creation funnel, auth trends, upgrade conversion
• Events include relevant properties (invoice_id, invoice_title, sort_by, filter_by, action)
• Event names are descriptive, consistent snake_case naming convention
• Success/failure event pairs enable error rate monitoring

---

Reviewed by wizard workbench PR evaluator