[CI] (6fb03e7) tanstack-router/tanstack-router-file-based-saas

[wizard-ci-bot]

Automated wizard CI run

Source: scheduled
Trigger ID: 6fb03e7
App: tanstack-router/tanstack-router-file-based-saas
App directory: apps/tanstack-router/tanstack-router-file-based-saas
Workbench branch: wizard-ci-6fb03e7-tanstack-router-tanstack-router-file-based-saas
Wizard branch: main
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-05-13T17:51:13.434Z
Duration: 357.0s

[wizard-ci-bot]

---

PR Evaluation Report

Summary

This PR integrates PostHog into a TanStack Router file-based SaaS demo app ("CloudFlow"). It adds posthog-js and @posthog/react, wraps the root component in PostHogProvider, captures five meaningful product events across login, invoicing, and upgrade flows, configures a Vite dev-server reverse proxy, and enables exception autocapture.

Files changed	Lines added	Lines removed
10	+110	-20

Confidence score: 4/5 👍

• PII in event properties: username is sent in user_logged_in capture properties and title (user-generated content) in invoice_created/invoice_updated. These should be person properties or omitted from capture calls. [MEDIUM]
• No .env.example committed: The .env file is gitignored (correct), but no .env.example is committed to document required environment variables for other developers. [MEDIUM]

---

File changes

Filename	Score	Description
src/routes/__root.tsx	5/5	Wraps root component with PostHogProvider, env-var-based API key, reverse proxy host, exception capture enabled
vite.config.js	5/5	Adds reverse proxy for /ingest, /ingest/static, /ingest/array with correct targets
src/routes/login.tsx	3/5	Adds identify, capture on login, reset on logout — but sends username as PII in event properties
src/routes/dashboard.invoices.index.tsx	4/5	Captures invoice_created with title (user-generated content in event props)
src/routes/dashboard.invoices..tsx	4/5	Captures invoice_updated with invoice_id and title
src/routes/_auth.profile.tsx	5/5	Captures upgrade_clicked with current_plan property — clean implementation
package.json	5/5	Adds posthog-js and @posthog/react with appropriate versions
tsconfig.json	5/5	Adds vite/client types for import.meta.env support
.gitignore	5/5	Adds .env to gitignore
posthog-setup-report.md	4/5	Documents all events and next steps, but is not a substitute for .env.example

---

App sanity check ✅

Criteria	Result	Description
App builds and runs	Yes	No syntax errors; valid TS, JSX, and Vite config
Preserves existing env vars & configs	Yes	Existing config preserved; only PostHog additions made
No syntax or type errors	Yes	All files are syntactically valid; vite/client types added for import.meta.env
Correct imports/exports	Yes	@posthog/react imports (PostHogProvider, usePostHog) are correct
Minimal, focused changes	Yes	All changes are PostHog-related; minor refactors in invoice files are to support capture calls
Pre-existing issues	None	—

Issues

• No .env.example file: Environment variables (VITE_PUBLIC_POSTHOG_PROJECT_TOKEN, VITE_PUBLIC_POSTHOG_HOST) are documented only in the setup report, not in a standard .env.example file. Add a committed .env.example with placeholder values. [MEDIUM]

Other completed criteria

• Build configuration is valid — Vite config correctly uses defineConfig callback with loadEnv
• .env properly gitignored to prevent secret leakage
• tsconfig.json updated to include vite/client types for import.meta.env support

---

PostHog implementation ✅

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-js@^1.373.4 and @posthog/react@^1.9.0 added to dependencies
PostHog client initialized	Yes	PostHogProvider in __root.tsx with apiKey from env, api_host: '/ingest', defaults: '2026-01-30', capture_exceptions: true
capture()	Yes	5 events: user_logged_in, user_logged_out, invoice_created, invoice_updated, upgrade_clicked
identify()	Yes	posthog.identify(username, { username }) on login; posthog.reset() on logout
Error tracking	Yes	capture_exceptions: true in PostHogProvider options enables exception autocapture
Reverse proxy	Yes	Vite dev proxy configured for /ingest, /ingest/static, /ingest/array with correct targets (us.i.posthog.com and us-assets.i.posthog.com)

Issues

• username as distinct_id: The app uses a raw username string as the distinct_id in posthog.identify(username). In this demo app with username-only auth this is the most reasonable choice, but in production a database user ID would be preferred to avoid fragmented data if usernames change. [LOW]

Other completed criteria

• API key loaded from import.meta.env.VITE_PUBLIC_POSTHOG_PROJECT_TOKEN environment variable
• ui_host correctly points to PostHog UI (us.posthog.com), separate from API host
• posthog.reset() called on logout before auth.logout() — correct ordering
• Reverse proxy routes both /ingest/static and /ingest/array to us-assets.i.posthog.com as required
• defaults: '2026-01-30' configuration snapshot included

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
src/routes/login.tsx	user_logged_in, user_logged_out	Tracks login with identify and logout with reset; captures auth lifecycle events
src/routes/dashboard.invoices.index.tsx	invoice_created	Fires on new invoice form submission with title property
src/routes/dashboard.invoices..tsx	invoice_updated	Fires on invoice save with invoice_id and title properties
src/routes/_auth.profile.tsx	upgrade_clicked	Tracks upgrade intent with current_plan property
src/routes/__root.tsx	captureException (auto)	Exception autocapture enabled via capture_exceptions: true

Issues

• PII in user_logged_in event properties: { username } is sent as an event property in posthog.capture('user_logged_in', { username }). The username is already set as a person property via identify() — remove it from the capture call to avoid PII in event properties. [MEDIUM]
• User-generated content in invoice events: title is included in invoice_created and invoice_updated event properties. Invoice titles are user-generated content that could contain PII. Consider removing title or replacing it with a non-PII property like title_length. [MEDIUM]

Other completed criteria

• Events represent real user actions (login, logout, invoice CRUD, upgrade intent)
• Events enable product insights — can build login→invoice_created funnel, upgrade conversion tracking
• Event names are descriptive, consistent snake_case convention
• upgrade_clicked includes current_plan: 'free' — good contextual enrichment
• invoice_updated includes invoice_id for entity-level analysis

---

Reviewed by wizard workbench PR evaluator