Add lighthouse kit

[kristiyan-velkov]

Summary

• Add a lighthouse mixin that installs Google Lighthouse CLI v12.6.1 (pinned; last 12.x that runs on Node ≥ 18.20, which standard agent templates guarantee) and a container-safe wrapper.
• Install Chromium via the same Playwright browser channel as the playwright kit (/opt/ms-playwright + CHROME_PATH=/usr/local/bin/chromium) so Ubuntu's snap Chromium stub is avoided and composing both kits shares one browser tree.
• Document usage (OCI / git / local), the deny-all allowlist, and why error reporting is disabled.

Spec choices worth flagging for review

• Lighthouse 12.6.1, not 13.x. 13.x requires Node ≥ 22.19; templates only guarantee Node ≥ 18. Easy to bump once templates catch up.
• Chromium via npx playwright@1.61.1 install --with-deps chromium, not apt. Same hosts and path as playwright/. The second hook skips the download if Chromium is already present.
• Wrapper at /usr/local/bin/lighthouse always passes --no-enable-error-reporting (Sentry is not allowlisted) and default Chrome flags (--no-sandbox --disable-dev-shm-usage --disable-gpu) unless the caller set --chrome-flags.
• Allowlist matches the playwright kit's browser/apt hosts plus registry.npmjs.org. Runtime audits of external sites are intentionally not allowlisted — localhost works; anything else needs a per-sandbox rule.

Origin

New frontend-tool mixin, patterned on playwright/ (npm pin + Chromium) and vale/ (one-concern CLI).

Test plan

CI runs kit validate and the TCK on every PR.

• sbx kit validate ./lighthouse/ passes (needs sbx that understands schemaVersion 2)
• ./scripts/test-kit.sh lighthouse passes (the TCK)
• ./scripts/test-kit-e2e.sh lighthouse passes under deny-all on a scoped daemon
• Manual smoke: sbx run --kit ./lighthouse/ claude then lighthouse --version and chromium --version

Made with Cursor