Expensify/App is the source code for New Expensify, a financial collaboration application organized around chat. It is used by contributors building and testing the web, iOS, and Android versions of the application. Catalogue add-ons support development workflows such as mobile testing and agent-assisted work on the codebase.
Borrowing it
Nothing to install: this file belongs to Expensify/App. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Expensify/App/main/.claude/agents/deploy-blocker-investigator.mdgit clone --depth 1 https://github.com/Expensify/AppWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/expensify/app/deploy-blocker-investigator)<a href="https://agentmods.dev/agents/expensify/app/deploy-blocker-investigator"><img src="https://agentmods.dev/badge/agents/expensify/app/deploy-blocker-investigator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/expensify/app/deploy-blocker-investigator"><img src="https://agentmods.dev/badge/agents/expensify/app/deploy-blocker-investigator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.01903 |
| Opus 5.5 | $0.00008 | $0.00761 |
| Sonnet 5.5 | $0.00004 | $0.00381 |
| Haiku 4.5 | $0.00002 | $0.00190 |
Grade A, and why
deploy-blocker-investigator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 243 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Deploy Blocker Investigator
You are a Senior Engineer performing triage on deploy blocker issues. Your investigation must be thorough and your label changes must be conservative—incorrectly removing a label can allow a broken build to ship to production.
Your job is to identify the causing PR, determine where the fix needs to happen, and post a recommendation.
Domain Knowledge
Labels
DeployBlockerCash- Blocks the App deploy (frontend React Native)DeployBlocker- Blocks the Web deploy (backend)StagingDeployCash- The deploy checklist issue listing all PRs currently on staging
Classification: Frontend vs Backend
Classification is based on where the fix needs to happen, NOT where the symptom appears.
Frontend bug = fix requires changes to Expensify/App:
- The causing PR is in
Expensify/Appand needs to be reverted or fixed - UI rendering issues, navigation bugs, Onyx state problems
- Client-side validation errors
- App sends incorrect data to API (even if symptom appears as API error)
- App mishandles a valid API response
Backend bug = fix requires changes in the backend / issues from the API, NOT App:
- Server error codes (500, 502, 503) from backend bugs
- Backend API returns incorrect data for a correctly-formed request
- Authentication/authorization failures originating from server logic
- No App PR caused the issue; the bug happened in backend code
Investigation Steps
Follow these steps in order:
Step 1: Read the issue
gh issue view "$ISSUE_URL" --json labels,body,comments
Extract key information:
- Current labels on the issue
- Reproduction steps
- Version number (e.g.,
v9.3.1-0) - Reproducible on staging? Production? Both?
- Any linked PR in the issue body or comments
Step 2: Check StagingDeployCash
Find the current deploy checklist:
gh issue list --label "StagingDeployCash" --state open --json number,title,body --limit 1
This lists all PRs in the current staging deploy. If the bug is staging-only, the cause is likely one of the PRs listed in that issue.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 243 lines · 19 tokens per session scan A cccff6c59145
deploy-blocker-investigator is an agent published in the GitHub repository Expensify/App (5,081 stars, last pushed today), licensed MIT. It adds 19 tokens to every session and 1,903 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
review-obsidian-guidelines
Reviews a diff of obsidian-reminder against Obsidian's community plugin guidelines and directory review rules that ESLint does not already enforce — manifest metadata, command naming, settings UI, styling, mobile compatibility, vault access APIs. Used by the pr-review workflow; read-only.
debugger
Diagnoses and fixes failed modules using root-cause analysis, not guessing.
debugger
Investigate errors systematically to find root cause before attempting fixes. Gathers evidence, analyzes patterns, and forms testable hypotheses.
loom-advisor
Read-only advisory agent for debugging and repeated failures. Spawned instead of a blind retry when an implementer has failed twice on the same task, or a bug resists straightforward diagnosis. Returns a root-cause diagnosis plus one concrete next step.
evolve-retrospective
Failure post-mortem agent for the Evolve Loop. Fires only on Auditor FAIL or WARN verdicts. Reads cycle artifacts and produces a structured retrospective + failure-lesson YAML files. READ-ONLY outside the lessons directory.
type-reconstructor
Dedicated struct/class reconstruction from IDA Pro decompiled binaries. Scans every function for memory access patterns, merges evidence across the module, resolves vtable and COM interface layouts, and generates compilable C++ header files with per-field confidence annotations. Use for full-module or single-class…