[CI] (dcaf5dc) javascript-node/express-todo

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: dcaf5dc
App: javascript-node/express-todo
App directory: apps/javascript-node/express-todo
Workbench branch: wizard-ci-dcaf5dc-javascript-node-express-todo
Wizard branch: codex/wizard-ci-separate-credentials
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-10T21:57:00.150Z
Duration: 257.2s

YARA Scanner

✓ 94 tool calls scanned, 0 violations detected

No violations: ✓ 94 clean scans

[wizard-ci-bot]

PR Evaluation Report

Summary

This PR integrates PostHog into a server-side Express.js todo API using the posthog-node SDK. It adds event tracking for todo CRUD operations and Express error handling. However, all capture() calls are missing the required distinctId parameter, which will cause every event to fail at runtime.

Files changed	Lines added	Lines removed
3	+56	-3

Confidence score: 4/5 👍

• Missing distinctId in all capture() calls: The posthog-node SDK requires a distinctId field in every capture() call. All three calls omit it, meaning zero events will be successfully captured. This renders the entire integration non-functional. [CRITICAL]
• Invalid config option enableExceptionAutocapture: This is a posthog-js (browser) config option, not a posthog-node option. It will be silently ignored. Error tracking is correctly set up via setupExpressErrorHandler, so the practical impact is low. [LOW]

---

File changes

Filename	Score	Description
apps/basic-integration/javascript-node/express-todo/index.js	2/5	PostHog init, capture calls for CRUD operations, and error handler setup — but all captures missing required distinctId
apps/basic-integration/javascript-node/express-todo/package.json	4/5	Adds posthog-node dependency correctly
apps/basic-integration/javascript-node/express-todo/.env.example	4/5	Documents required env vars

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	App starts without syntax errors; capture failures occur at runtime
Preserves existing env vars & configs	Yes	Existing app logic is preserved
No syntax or type errors	Yes	Valid JavaScript syntax throughout
Correct imports/exports	Yes	PostHog and setupExpressErrorHandler are valid exports from posthog-node
Minimal, focused changes	Yes	Only PostHog-related changes
Pre-existing issues	None	Base app is a clean Express API

Issues

• Invalid enableExceptionAutocapture config: This option belongs to posthog-js (browser SDK), not posthog-node. It will be silently ignored. Remove it to avoid confusion. [LOW]

Other completed criteria

• Environment variables documented in .env.example
• Build configuration valid (package.json is parseable, dependency version is valid)
• Conditional initialization gracefully handles missing env vars in production

---

PostHog implementation ❌

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-node ^5.52.0 added to package.json
PostHog client initialized	Yes	Conditional init using new PostHog() with env vars, guarded by presence check
capture()	No	All three capture calls are missing the required distinctId field — events will fail
identify()	N/A	Server-only app
Error tracking	Yes	setupExpressErrorHandler(posthog, app) correctly wired after all routes
Reverse proxy	N/A	Server-only app

Issues

• Missing distinctId in all capture() calls: The posthog-node SDK requires distinctId as a mandatory field in every capture() call. All three calls (todo_created, todo_updated, todo_deleted) omit it entirely. This means no events will be captured successfully. The fix is to pass a distinctId derived from request context (e.g., session ID, auth user ID, or IP-based identifier). Example: posthog.capture({ distinctId: req.ip || 'anonymous', event: 'todo_created', ... }). [CRITICAL]

Other completed criteria

• API key loaded from POSTHOG_PROJECT_TOKEN environment variable
• Host correctly configured from POSTHOG_HOST environment variable
• SDK correctly added to dependencies

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
index.js	todo_created	Tracks todo creation with completed property — missing distinctId
index.js	todo_updated	Tracks todo updates with title_updated, completion_updated, completed — missing distinctId
index.js	todo_deleted	Tracks todo deletion — missing distinctId, also has no properties at all
index.js	setupExpressErrorHandler	Captures unhandled Express errors via error handler middleware

Issues

• todo_deleted has no properties: Unlike the other events, todo_deleted captures no properties at all. Adding at minimum the todo ID or completed status would make this event useful for analysis. [MEDIUM]
• No user attribution possible: Even if distinctId were added, this Express app has no authentication, so there's no stable user ID available. The integration should document what value to use (e.g., session ID, request IP). [LOW]

Other completed criteria

• Events represent real user actions (CRUD operations on todos)
• Events could enable product insights (todo creation → update → delete funnel)
• todo_created and todo_updated include meaningful contextual properties
• No PII in event properties
• Consistent snake_case naming convention

---

Reviewed by wizard workbench PR evaluator