[CI] (b9f99de) javascript-web/saas-dashboard

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: b9f99de
App: javascript-web/saas-dashboard
App directory: apps/javascript-web/saas-dashboard
Workbench branch: wizard-ci-b9f99de-javascript-web-saas-dashboard
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-10T16:14:31.134Z
Duration: 436.6s

YARA Scanner

✓ 157 tool calls scanned, 1 violation detected

  [WARNED] prompt_injection_posthog_feature_attack (MEDIUM) — skill-install:installSkillById

No violations: ✓ 156 clean scans

⚠️ YARA violations detected — see report above

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR integrates PostHog into a vanilla JavaScript (Vite) SaaS dashboard app. It adds posthog-js as a dependency, creates a posthog.js helper module for initialization/identify/capture/reset, instruments meaningful user actions (login, logout, project and task CRUD, settings updates) in api.js, adds manual `` tracking in the SPA router, and identifies users on login and app load.

Files changed	Lines added	Lines removed
5	+102	-4

Confidence score: 4/5 👍

• No reverse proxy configured: The app uses posthog-js in the browser and sends events directly to us.i.posthog.com. A reverse proxy (e.g., via Vite dev server proxy + production rewrites) should be set up to avoid ad-blocker interference. [MEDIUM]
• .env.example not committed: The wizard created/updated .env.example with VITE_POSTHOG_KEY and VITE_POSTHOG_HOST locally but did not include it in the committed changeset. Developers cloning the repo won't know which env vars to set without reading the source. [MEDIUM]

---

File changes

Filename	Score	Description
src/posthog.js	5/5	New module: initializes posthog-js from env vars with error tracking config, exports identifyUser, resetPostHog, capturePostHog helpers
src/api.js	5/5	Instruments login, logout, project CRUD, task CRUD, task assignment, and settings updates with PostHog capture calls
src/main.js	4/5	Calls identifyUser on app start to re-identify returning users from localStorage-persisted session
src/router.js	5/5	Adds manual `` capture on each SPA route resolution
package.json	5/5	Adds posthog-js ^1.429.3 dependency

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	No syntax errors; posthog-js is properly added to dependencies
Preserves existing env vars & configs	Yes	Existing dependencies and code preserved; PostHog additions are additive
No syntax or type errors	Yes	All JS syntax is valid; optional chaining used correctly
Correct imports/exports	Yes	All imports from ./posthog.js resolve; posthog-js import is correct
Minimal, focused changes	Yes	All changes relate strictly to PostHog integration
Pre-existing issues	None	Base app is functional

Issues

• .env.example not committed: The wizard created .env.example with VITE_POSTHOG_KEY and VITE_POSTHOG_HOST but did not include it in the committed files. Developers won't have documentation of required env vars. Commit the .env.example file. [MEDIUM]

Other completed criteria

• All changes are relevant to PostHog integration
• Code follows existing codebase patterns (helper module pattern, consistent naming)
• Build configuration (package.json) is valid
• Dev-mode error throwing for missing env vars is a nice touch for discoverability

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js ^1.429.3 added to package.json dependencies
PostHog client initialized	Yes	posthog.init() called with env-var key, host, defaults: '2026-05-30', and exception capture config
capture()	Yes	9 meaningful capture calls across api.js and router.js
identify()	Yes	posthog.identify(user.id, { email, name, role }) on login and app load; posthog.reset() on logout and account switch
Error tracking	Yes	capture_exceptions configured with capture_unhandled_errors: true and capture_unhandled_rejections: true
Reverse proxy	No	No reverse proxy configured; events go directly to PostHog cloud

Issues

• No reverse proxy: Browser requests to us.i.posthog.com will be blocked by ad blockers. Configure a reverse proxy via Vite config or a production proxy (e.g., Cloudflare, managed reverse proxy). Both /static/* and /array/* routes must proxy to us-assets.i.posthog.com. [MEDIUM]

Other completed criteria

• API key loaded from import.meta.env.VITE_POSTHOG_KEY (not hardcoded)
• Host loaded from import.meta.env.VITE_POSTHOG_HOST
• Correct use of posthog.reset() on logout and before identify when switching accounts
• identifyUser uses user.id (a stable store ID) as distinct_id — not email
• Person properties (email, name, role) correctly placed in identify(), not in capture()
• Manual `` capture in SPA router is the correct pattern for vanilla JS without a framework router

---

PostHog insights and events ✅

Filename	PostHog events	Description
src/posthog.js	captureException (auto)	Unhandled errors and promise rejections automatically captured
src/api.js	user_logged_in, user_logged_out, project_created, project_deleted, task_created, task_status_changed, task_deleted, task_assignee_changed, settings_updated	Full coverage of core user actions with enriched properties (IDs, roles, statuses)
src/router.js	``	Manual pageview tracking on each SPA route change
src/main.js	(identify on load)	Re-identifies returning users from persisted session state

Issues

None — events are well-structured and cover the key product flows.

Other completed criteria

• Events represent real user actions (login, CRUD operations, navigation)
• Events enable product insights: login → create project → add task funnel; task status change tracking for workflow analysis
• Events include relevant properties (project_id, task_id, priority, status, is_account_switch)
• No PII in capture properties — email/name only in identify() person properties
• Consistent snake_case naming convention across all events

---

Reviewed by wizard workbench PR evaluator