mcavage/marsh-tools:stable

schemaVersion: "3"
displayName: marsh-tools
description: Work tools for agents in one Kit VM — gog (Google Workspace; never send, share or delete) and bamboohr (read-only directory)
sourceUrl: https://github.com/mcavage/marsh/tree/main/kits/marsh-tools
version: 0.47.1-2026.10.29-c350a2e
licenses:
    - MIT
kind: workload
provides:
    - [email protected]
    - [email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/ca-certificates@20250419
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/[email protected]
    - deb/tzdata@2026
    - deb/[email protected]
capabilities:
    - type: com.docker.sandbox/sbx@1
    - type: org.marsh/home@1
      optional: true
      config:
        mount: none
    - type: com.docker.sandbox/network-policy@1
      config:
        runtime:
            allow:
                - gmail.googleapis.com:443
                - www.googleapis.com:443
                - docs.googleapis.com:443
                - sheets.googleapis.com:443
                - slides.googleapis.com:443
                - api.bamboohr.com:443
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: gmail.googleapis.com
                  format: Bearer %s
                  header: Authorization
                - domain: www.googleapis.com
                  format: Bearer %s
                  header: Authorization
                - domain: docs.googleapis.com
                  format: Bearer %s
                  header: Authorization
                - domain: sheets.googleapis.com
                  format: Bearer %s
                  header: Authorization
                - domain: slides.googleapis.com
                  format: Bearer %s
                  header: Authorization
            name: GOG_ACCESS_TOKEN
        phase: runtime
        service: gog
      description: Google access token, minted on the Mac (sbx secret set gog --command ...)
    - type: com.docker.sandbox/credential@1
      optional: true
      config:
        apiKey:
            inject:
                - domain: api.bamboohr.com
                  format: Basic %s
                  header: Authorization
            name: BAMBOOHR_API_KEY
        phase: runtime
        service: bamboohr
      description: BambooHR API key, stored as base64("KEY:x") (sbx secret set bamboohr)
dockerfile: ./Dockerfile