[CI] (dcaf5dc) javascript-node/koa-notes

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: dcaf5dc
App: javascript-node/koa-notes
App directory: apps/javascript-node/koa-notes
Workbench branch: wizard-ci-dcaf5dc-javascript-node-koa-notes
Wizard branch: codex/wizard-ci-separate-credentials
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-10T21:58:31.001Z
Duration: 350.3s

YARA Scanner

✓ 103 tool calls scanned, 0 violations detected

No violations: ✓ 103 clean scans

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR integrates PostHog into a server-only Koa.js notes API application using the posthog-node SDK. It adds event captures for CRUD operations on folders and notes, an error handler with captureException, and a dedicated posthog.js initialization module. However, every single capture() call is missing the required distinctId parameter, which means no events will be properly attributed to users.

Files changed	Lines added	Lines removed
4	+55	-1

Confidence score: 4/5 👍

• All capture() calls missing required distinctId: The posthog-node SDK requires a distinctId field in every capture() call. All five event captures (folder_created, folder_deleted, note_created, note_updated, note_deleted) omit it entirely. These calls will either throw at runtime or produce unattributable events. Fix: extract a user identifier from the request context (e.g., session, auth header, or IP) and pass it as distinctId. [CRITICAL]
• captureException(err) missing distinctId: The error handler calls posthog?.captureException(err) without a distinctId, which is required by posthog-node. Without it, exceptions cannot be attributed to any user. [CRITICAL]
• enableExceptionAutocapture is not a valid posthog-node config option: This is a posthog-js (browser SDK) configuration. The Node SDK silently ignores it, meaning error autocapture is not actually enabled. [MEDIUM]

---

File changes

Filename	Score	Description
posthog.js	3/5	PostHog client initialization with env vars and conditional creation; uses invalid enableExceptionAutocapture option
index.js	2/5	Adds 5 capture calls and error handler, but all missing required distinctId
package.json	5/5	Adds posthog-node dependency correctly
.env.example	5/5	Documents both required env vars

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	No syntax errors; the app will start, though capture calls may fail at runtime due to missing distinctId
Preserves existing env vars & configs	Yes	Existing code and structure preserved
No syntax or type errors	Yes	Valid JavaScript throughout
Correct imports/exports	Yes	PostHog imported from posthog-node, posthog exported and imported correctly
Minimal, focused changes	Yes	Only PostHog-related additions
Pre-existing issues	None

Issues

• enableExceptionAutocapture is a browser SDK option: This config key is from posthog-js, not posthog-node. It is silently ignored and has no effect. Remove it. [MEDIUM]

Other completed criteria

• Environment variables documented in .env.example
• Build configuration valid with posthog-node added to dependencies
• Package.json alphabetical reordering of koa-bodyparser is harmless

---

PostHog implementation ❌

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-node@^5.52.0 added to package.json
PostHog client initialized	Yes	new PostHog(projectToken, { host }) with env-based config in posthog.js
capture()	No	All 5 capture calls missing required distinctId parameter
identify()	N/A	Server-only app
Error tracking	No	captureException(err) missing distinctId; enableExceptionAutocapture is not a valid posthog-node option
Reverse proxy	N/A	Server-only app

Issues

• All capture() calls missing distinctId: The posthog-node SDK requires distinctId in every capture({ distinctId, event, properties }) call. None of the five capture calls include it. Events will either throw or be unattributable. Fix: derive a distinctId from request context (session ID, auth user ID, or fallback to IP/anonymous ID) and include it in every capture call. [CRITICAL]
• captureException missing distinctId: posthog?.captureException(err) in the Koa error handler has no way to attribute the exception to a user. The captureException method in posthog-node requires a distinctId. Fix: pass a distinct ID, potentially from the error context if available. [CRITICAL]
• Invalid enableExceptionAutocapture config: This option belongs to the browser SDK (posthog-js), not posthog-node. It is silently ignored and provides no server-side exception autocapture. Remove this option. [MEDIUM]

Other completed criteria

• API key loaded from POSTHOG_PROJECT_TOKEN environment variable
• Host loaded from POSTHOG_HOST environment variable
• Conditional initialization (projectToken && host ? new PostHog(...) : null) prevents crashes when env vars are missing
• Optional chaining (posthog?.capture) safely handles null client

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
index.js	folder_created	Captured when a new folder is created (no properties, no distinctId)
index.js	folder_deleted	Captured on folder deletion with notes_reassigned count (no distinctId)
index.js	note_created	Captured on note creation with has_content, is_default_folder (no distinctId)
index.js	note_updated	Captured on note update with title_updated, content_updated, folder_changed (no distinctId)
index.js	note_deleted	Captured on note deletion (no properties, no distinctId)
index.js	captureException	Captures unhandled Koa errors (no distinctId)

Issues

• No distinctId means no user attribution: Without distinctId, even if events are sent, they cannot be tied to any user. This makes funnels, retention, and user-level insights impossible. All events are effectively orphaned. [CRITICAL]

Other completed criteria

• Events represent real user actions (CRUD operations on notes and folders)
• Events could enable product insights (create → update → delete funnels) if distinctId were present
• Several events include enriched properties (notes_reassigned, has_content, is_default_folder, title_updated, etc.)
• No PII in event properties
• Event names are descriptive and use consistent snake_case convention

---

Reviewed by wizard workbench PR evaluator