nickorefice/expensetracking-kit:v3

schemaVersion: "2"
kind: mixin
name: expensetracking
displayName: Expense Tracker Dev Kit
description: 'Project glue for the expensetracking sandbox: network allowlist, Vercel project linkage, and startup environment pull. Agent-agnostic; stacks on the expensetracking-sbx-* templates for either claude or codex.'
agentInstructions:
    content: |
        ## Sandbox environment notes
        - Secrets are runtime-injected, never in the repo: VERCEL_TOKEN is swapped in by
          the sbx proxy only on api.vercel.com calls; all app env vars come from
          `.env.local`, pulled by `vercel env pull` at startup. Never hardcode, print,
          or commit secrets or `.env.local`.
        - Network egress is open for docs/research/tooling, except cloud-metadata/IMDS
          endpoints (blocked). Do not attempt to reach metadata IPs.
        - Before opening a PR, run the same gates CI enforces (all baked into this image):
          `npm test`, `gitleaks detect`, and
          `semgrep --config p/javascript --config p/nodejs --config p/react --config p/secrets`.
          Fix findings at the source; do not add `# nosemgrep` to silence them.
        - Keep PRs in draft; never merge. See the repo CLAUDE.md for full rules.
permissions:
    network:
        allow:
            - '**'
        deny:
            - 169.254.169.254
            - 169.254.170.2
            - 100.100.100.200
            - metadata.google.internal
            - fd00:ec2::254
setup:
    install:
        - command: '{ [ -f .vercel/project.json ] || { mkdir -p .vercel && cp /home/agent/.sbx/vercel-project.json .vercel/project.json; }; } || true'
          user: "1000"
          description: Drop Vercel linkage if missing (matters in --clone mode)
        - command: vercel env pull .env.local --yes >/dev/null 2>&1 || true
          user: "1000"
          description: Pull Vercel env vars into .env.local (needs VERCEL_TOKEN)
        - command: '{ [ -d node_modules ] || npm ci; } || true'
          user: "1000"
          description: Install dependencies only if node_modules is absent