[CI] (dcaf5dc) javascript-node/native-http-contacts

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: dcaf5dc
App: javascript-node/native-http-contacts
App directory: apps/javascript-node/native-http-contacts
Workbench branch: wizard-ci-dcaf5dc-javascript-node-native-http-contacts
Wizard branch: codex/wizard-ci-separate-credentials
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-10T21:57:47.707Z
Duration: 292.6s

YARA Scanner

✓ 103 tool calls scanned, 0 violations detected

No violations: ✓ 103 clean scans

[wizard-ci-bot]

Now I have all the context I need. This is a server-only Node.js native HTTP app using posthog-node. The critical issue is immediately clear: every capture() call is missing the required distinctId parameter.

---

PR Evaluation Report

Summary

This PR integrates PostHog into a native Node.js HTTP contacts API using the posthog-node SDK. It adds a PostHog initialization module, capture calls for CRUD operations on contacts and groups, exception tracking in the error handler, and graceful shutdown. However, every capture() call is missing the required distinctId parameter, making all event captures non-functional.

Files changed	Lines added	Lines removed
4	+56	-3

Confidence score: 5/5 🧙

• All capture() calls are missing distinctId: The posthog-node SDK requires a distinctId field in every capture() call. Without it, the SDK will throw a validation error or silently drop events. Every capture call in index.js omits this required parameter. [CRITICAL]
• enableExceptionAutocapture is not a documented posthog-node config option: This may be a hallucinated configuration option. The Node SDK uses captureException() explicitly (which is done correctly), but enableExceptionAutocapture is not a recognized initialization option for posthog-node. [MEDIUM]

---

File changes

Filename	Score	Description
posthog.js	3/5	New PostHog client module with env var validation and conditional initialization. Uses undocumented enableExceptionAutocapture option.
index.js	2/5	Adds capture calls for CRUD operations and error tracking, but all capture calls are missing required distinctId. Graceful shutdown is well-implemented.
package.json	4/5	Adds posthog-node dependency and updates scripts to load .env file via --env-file-if-exists.
.env.example	5/5	Documents required PostHog environment variables.

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	Dependencies install and the server starts without build errors
Preserves existing env vars & configs	Yes	Existing app logic is untouched; only PostHog additions made
No syntax or type errors	Yes	All JavaScript syntax is valid
Correct imports/exports	Yes	PostHog imported from posthog-node, posthog exported and imported correctly
Minimal, focused changes	Yes	Only PostHog integration code added
Pre-existing issues	None	Base app is a clean native HTTP server

Issues

• --env-file-if-exists requires Node.js v22+: The updated npm scripts use --env-file-if-exists=.env which is only available in Node.js v22 and later. Older Node.js versions will fail to start. [LOW]

Other completed criteria

• Environment variables documented in .env.example
• Build configuration is valid (package.json is well-formed)
• All changes are relevant to PostHog integration
• Correct files modified for a Node.js server app

---

PostHog implementation ❌

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-node ^5.52.0 added to package.json dependencies
PostHog client initialized	Yes	new PostHog(projectToken, { host }) in posthog.js with conditional null fallback
capture()	No	All 4 capture calls are missing the required distinctId parameter — events will fail at runtime
identify()	N/A	Server-only app
Error tracking	Yes	posthog?.captureException(err) called in the catch handler
Reverse proxy	N/A	Server-only app

Issues

• Missing distinctId in all capture() calls: The posthog-node SDK requires distinctId as a mandatory field in every capture({ distinctId, event, properties }) call. All four capture calls (group_created, contact_created, contact_updated, contact_deleted) omit it entirely. This will cause runtime errors or silently dropped events. The server should extract or generate a user identifier (e.g., from a request header, session, or API key) and pass it as distinctId. [CRITICAL]
• enableExceptionAutocapture is not a documented posthog-node option: The initialization in posthog.js passes enableExceptionAutocapture: true, which does not appear in the posthog-node SDK documentation. This option is likely ignored silently but suggests a hallucinated API. The explicit captureException() call in the catch handler is the correct approach and works independently. [MEDIUM]
• captureException also missing distinctId: The captureException(err) call in the error handler does not include a distinctId either. While the method signature may differ from capture(), server-side exception tracking typically needs a user identifier for attribution. [MEDIUM]

Other completed criteria

• API key loaded from POSTHOG_PROJECT_TOKEN environment variable
• Host loaded from POSTHOG_HOST environment variable
• Graceful shutdown with posthog?.shutdown() on SIGINT/SIGTERM
• Env var validation with helpful error messages in non-production

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
index.js	group_created	Captured when a new contact group is created, includes group_id
index.js	contact_created	Captured when a new contact is added, includes group_id
index.js	contact_updated	Captured when a contact is modified, includes updated_fields array
index.js	contact_deleted	Captured when a contact is removed, no properties
index.js	captureException	Captures unhandled errors in the request handler

Issues

• Events lack distinctId so they cannot be attributed: Without a distinctId, none of these events can be tied to a user in PostHog. This means funnels, retention, and user-level analysis are impossible. The full CRUD lifecycle is covered conceptually, but the events are non-functional in practice. [CRITICAL]
• contact_deleted has no properties: While other events include contextual properties, the delete event captures no information about which contact was deleted (e.g., contact_id). [LOW]

Other completed criteria

• Events represent real user actions (CRUD operations on contacts and groups)
• Event names use consistent snake_case naming convention
• Events could enable product insights (contact lifecycle funnel) if distinctId were present
• contact_updated includes useful updated_fields property showing which fields changed
• No PII placed in event properties

---

Reviewed by wizard workbench PR evaluator