[CI] (dcaf5dc) javascript-node/fastify-blog

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: dcaf5dc
App: javascript-node/fastify-blog
App directory: apps/javascript-node/fastify-blog
Workbench branch: wizard-ci-dcaf5dc-javascript-node-fastify-blog
Wizard branch: codex/wizard-ci-separate-credentials
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-10T21:57:34.582Z
Duration: 292.0s

YARA Scanner

✓ 114 tool calls scanned, 0 violations detected

No violations: ✓ 114 clean scans

[wizard-ci-bot]

Now I have all the context I need. This is a server-only Node.js Fastify app. The critical issue is immediately apparent — every posthog.capture() call is missing the required distinctId parameter.

---

PR Evaluation Report

Summary

This PR integrates PostHog into a server-side Fastify blog API using posthog-node. It adds a PostHog initialization module, custom event captures for CRUD operations, error tracking via captureException, and graceful shutdown handling. However, every capture() call is missing the required distinctId parameter, which means no events will be associated with any user.

Files changed	Lines added	Lines removed
4	+96	-1

Confidence score: 5/5 🧙

• All posthog.capture() calls are missing the required distinctId parameter. The posthog-node SDK requires distinctId as a mandatory field in every capture() call. Without it, events either fail silently or are completely unattributable. The request object has request.body.author available in most routes — this or a session/auth-derived ID should be used as the distinctId. [CRITICAL]
• captureException is also called without a distinctId. The error handler calls posthog.captureException(error, undefined, {...}) but does not associate the exception with any user, making error tracking data largely useless for per-user debugging. [MEDIUM]

---

File changes

Filename	Score	Description
posthog.js	4/5	New PostHog initialization module with env var validation, conditional init, and exception autocapture enabled. Well-structured.
index.js	2/5	Adds capture calls, error handler, and shutdown logic — but every capture call is missing the required distinctId.
package.json	4/5	Adds posthog-node and dotenv dependencies correctly.
.env.example	4/5	Documents both required environment variables.

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	Syntax is valid; the app will start without errors (assuming env vars are set).
Preserves existing env vars & configs	Yes	No existing configs are modified destructively.
No syntax or type errors	Yes	All JavaScript syntax is valid.
Correct imports/exports	Yes	posthog-node imported correctly; posthog.js module exports correctly.
Minimal, focused changes	Yes	All changes relate to PostHog integration; shutdown handlers are a reasonable addition.
Pre-existing issues	None	Base app appears clean.

Issues

• Missing distinctId causes runtime failures: While the app builds and starts, every posthog.capture() call omits the required distinctId field. Depending on the posthog-node version, this either throws a runtime error or silently drops the event. [CRITICAL]

Other completed criteria

• Environment variables documented in .env.example
• Build configuration valid — package.json dependencies are correct
• posthog.shutdown() called in onClose hook ensures events are flushed
• Graceful shutdown via SIGINT/SIGTERM handlers

---

PostHog implementation ❌

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-node ^5.52.0 added to package.json
PostHog client initialized	Yes	Correctly initialized in posthog.js with env-based token and host, conditional on both being present
capture()	No	All 4 capture calls (post_created, post_updated, post_deleted, comment_created) are missing the required distinctId parameter
identify()	N/A	Server-only app
Error tracking	Yes	captureException in error handler + enableExceptionAutocapture: true in init
Reverse proxy	N/A	Server-only app

Issues

• All capture() calls missing distinctId: The posthog-node SDK requires distinctId as a mandatory field: posthog.capture({ distinctId: '...', event: '...', properties: {...} }). Every capture call in this PR omits it entirely. The author field from the request body, or a session/auth-derived identifier, should be used. Without this, the integration captures zero usable analytics events. [CRITICAL]
• captureException missing user context: The error handler's captureException call doesn't associate exceptions with a distinct user, reducing its diagnostic value. Consider extracting a user identifier from the request to pass along. [MEDIUM]

Other completed criteria

• API key loaded from POSTHOG_PROJECT_TOKEN environment variable (not hardcoded)
• API host loaded from POSTHOG_HOST environment variable
• posthog.shutdown() properly called on server close
• Defensive null checks (if (posthog)) throughout

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
index.js	post_created	Tracks blog post creation with published status — but missing distinctId
index.js	post_updated	Tracks post updates with updated_fields array and published status — but missing distinctId
index.js	post_deleted	Tracks post deletion with deleted_comment_count — but missing distinctId
index.js	comment_created	Tracks comment creation — bare capture with no properties and no distinctId
index.js	captureException	Captures unhandled route errors with route, method, and status code context

Issues

• comment_created has no properties: Unlike the other events, comment_created is a bare capture with zero properties — no post ID, no indication of which post received the comment. This limits its analytical value. [MEDIUM]
• No distinctId on any event: As noted above, none of these events will produce usable analytics data because they cannot be attributed to any user. [CRITICAL]

Other completed criteria

• Events represent real user actions (CRUD operations on blog posts and comments)
• Events could enable product insights (content creation funnel, update patterns) if distinctId were present
• post_updated includes well-designed updated_fields array property
• post_deleted includes deleted_comment_count for cascade awareness
• No PII in event properties
• Event names follow consistent snake_case convention describing the action

---

Reviewed by wizard workbench PR evaluator