Personal Money Dashboard

Help me build a personal money dashboard. I'm doing this in four phases —
build them in order, commit after each, and ask me to verify before moving on.

Phase 0 — Secret bootstrap (SAFETY-CRITICAL, READ CAREFULLY).

There is a SimpleFIN setup token at ~/simplefin-setup-token.txt. DO NOT
READ THAT FILE. Do not cat it, do not include its contents in any tool
call, do not print it.

Write bootstrap_secret.py that:
- Reads the token from that file path.
- POSTs to the URL contained in the token (SimpleFIN claim flow:
  base64-decode the token to get a URL, POST to that URL with no body,
  the response body is the access URL).
- Writes SIMPLEFIN_ACCESS_URL=<url> to ~/.config/finance-sync/.env with
  permissions 0600 (create the parent dir if needed).
- Shreds the original token file: `shred -u` on Linux, `rm -P` on macOS;
  fall back to overwriting with random bytes + unlink if neither exists.
- Prints "Bootstrapped." and exits 0 on success. Prints a clear error and
  exits nonzero on any failure, WITHOUT leaking the token to stdout/stderr.

Stop after Phase 0 and let me run the script and verify. Don't proceed
until I confirm.

Phase 1 — Sync.

Build a `finance` CLI that pulls transactions from SimpleFIN and stores
them in SQLite at ~/.local/share/finance/finance.db.

SimpleFIN access URL is read from ~/.config/finance-sync/.env. Use HTTP
basic auth (the URL itself is of the form https://USER:PASS@host/path —
split it).

Schema (keep it minimal, no ORM):
  accounts(id TEXT PRIMARY KEY, name, currency, institution)
  transactions(
    id TEXT PRIMARY KEY,         -- SimpleFIN transaction id
    account_id TEXT,
    posted INTEGER,              -- unix seconds
    pending INTEGER,             -- 0 or 1
    amount REAL,                 -- signed; negative is debit
    description TEXT,            -- raw
    category TEXT,               -- assigned by rules.yaml later
    hash TEXT                    -- sha256 for safety dedup
  )
  sync_runs(started_at INTEGER, finished_at INTEGER, ok INTEGER, error TEXT)

CLI:
  finance sync              Pull last 90 days, insert new transactions
                            (idempotent on transactions.id; also de-dupe by hash).
  finance sync --dry-run    Print counts of would-insert / would-skip.
  finance accounts          List accounts and balances.
  finance recent [-n 50]    Print most recent transactions.

Hard requirements:
- Idempotent: running sync twice in a row never duplicates rows.
- Pending -> posted transitions update the existing row, don't insert.
- Never print the access URL or its credentials to logs.
- All HTTP timeouts default to 30s.
- Use only: httpx, click, python-dotenv. Stdlib for sqlite3.

Stop after Phase 1 and let me run `finance sync` against real data.

Phase 2 — Categorization.

Add `rules.yaml` in the project folder, gitignored (it may contain merchant
names). Format:

  rules:
    - match: "STARBUCKS|BLUE BOTTLE"
      category: "Coffee"
    - match: "WHOLE FOODS|TRADER JOE'S"
      category: "Groceries"
    - match: "^UBER\\b"
      category: "Transport"
  default: "Uncategorized"

Each rule's `match` is a case-insensitive regex against the description.
First match wins. Add:

  finance categorize         Apply rules; update `category` column. Idempotent.
  finance categorize --dry-run

Also write a starter rules.yaml.example seeded with ~15 common US merchant
patterns.

Phase 3 — MCP server for Claude Desktop.

Build an MCP server (`finance-mcp`) using the official MCP Python SDK,
stdio transport. Read-only access to the same SQLite DB.

Tools to expose:
  summarize_spending(start_date, end_date, group_by)
      group_by in ("category", "month", "merchant"). Returns a list of
      {key, total, count}.
  search_transactions(query, limit=50)
      Description regex match, optional date range.
  list_categories()
      Distinct categories with counts.
  recent_transactions(n=20)
      Most recent N transactions.

The MCP server must NEVER expose write tools. Queries are read-only and
parameterized.

In the README, include the exact JSON snippet to drop into
claude_desktop_config.json for both macOS and Linux paths, plus the
"restart Claude Desktop" step.

Project layout:
  money/
    pyproject.toml
    .env.example                (SIMPLEFIN_ACCESS_URL=)
    .gitignore                  (.venv, .env, rules.yaml, *.db)
    bootstrap_secret.py
    rules.yaml.example          (committed; the real rules.yaml is gitignored)
    src/finance/
      __init__.py
      cli.py
      sync.py
      db.py
      categorize.py
      mcp_server.py
    scripts/
      com.user.finance-sync.plist     (macOS, generated only when I ask)
      finance-sync.service             (Linux)
      finance-sync.timer
    README.md

README sections, in order:
  1. What this is (1 paragraph)
  2. The safety hack (one paragraph)
  3. Phase-by-phase setup
  4. Scheduling background sync (launchd / systemd, with the exact `launchctl
     load` / `systemctl --user enable --now` commands)
  5. Connecting Claude Desktop (the JSON snippet, the restart step,
     example questions to try)
  6. Troubleshooting

Code quality bar: small, readable, no unnecessary abstractions. No Pydantic.
No "models" layer. Dict-based rows are fine. Tests only for categorize()
and the dedup logic.

When you're ready, start with Phase 0 and STOP for my confirmation.