The Problem

Enterprises that want a “hands‑off” software shop need a reproducible, locally‑hosted automation layer. Building that from scratch means wiring together LLM‑driven agents, a persistent memory store, and deployment tooling – all of which are scattered across scripts, containers, and a small web front‑end. Maintaining such glue code quickly becomes a hidden cost.

What This Does

Auto‑Company ships a self‑contained AI “company” that runs 24/7 on a workstation (macOS, Windows WSL, or Linux). The core loop lives in scripts/core/auto-loop.sh (referenced in the README) and repeatedly invokes the Claude/Codex CLI, feeding it the shared memory files (PROMPT.md, memories/consensus.md). Four agents are instantiated per cycle, each represented by a markdown “skill” under .claude/skills/… and backed by Python helpers (e.g., deep‑research/scripts/*).

The web dashboard (dashboard/app.js + dashboard/index.html) serves a tiny UI that proxies HTTP requests to dashboard/server.py. That server reads static assets, launches shell commands (run_powershell_script, run_shell_script), and writes logs back to the consensus file, giving the operator visibility into each loop iteration.

How It Is Wired

  • Entry point – dashboard/server.py:main (line 520) is the only function that starts the system when the dashboard is launched. It creates an HTTP server, then calls a chain of 66 internal functions before returning.
  • Primary call hub – DockerfileAnalyzer (called from 25 places) and its helpers write_dockerfile (23) / load_dockerfile (20) sit at the centre of the DevOps skill set (.claude/skills/devops/scripts/*). Any change to these functions ripples through most deployment workflows.
  • Network / FS side‑effects –
  • main → verify reads self.html_path.read_text (filesystem).
  • do_GET → _serve_file reads static files via path.read_text.
  • cloudflare_deploy.py runs external commands (run_command) to invoke the Cloudflare CLI.
  • verify_citations.py performs outbound HTTP calls to DOI/URL endpoints.
  • Agent‑specific modules – The most imported internal module is projects/snapog/src/types (imported by 4 others). Its stability (instability 0) makes it a safe abstraction point, whereas projects/snapog/src/index has instability 1, indicating it is a leaf that forwards calls to three other modules.
  • Control flow depth – Several scripts (e.g., security-scan.py, templates.ts) reach eight levels of nesting, making the execution path hard to follow.

No circular import cycles were detected, and the static call graph resolves 273 intra‑repo edges, giving a clear picture of where the majority of runtime impact originates.

How To Use It

# 1. Clone the repo
git clone https://github.com/moses-y/Auto-Company
cd Auto-Company

# 2. Install Node dependencies (npm) and Python requirements
npm ci               # creates a lockfile (currently missing)
pip install -r .claude/skills/devops/scripts/requirements.txt
pip install -r .claude/skills/deep-research/requirements.txt

# 3. (Optional) Build the Docker environment
docker compose -f .claude/skills/devops/references/docker-compose.md up -d

# 4. Start the dashboard (the documented entry point)
npm run dev          # runs Vite dev server per vite.config.ts
python dashboard/server.py   # launches the HTTP API on localhost

# 5. Kick off the autonomous loop
bash scripts/core/auto-loop.sh   # runs continuously, reading PROMPT.md & consensus.md

Configuration – No explicit .env is required for core operation; the DevOps skill ships an example at .claude/skills/devops/.env.example. Secrets for Cloudflare, Docker, or external APIs must be added to that file before invoking the respective skill scripts.

Real‑World Use

A product team could point a dedicated laptop at this repo, run the steps above, and let the AI agents prototype a micro‑SaaS: research a market, generate code (snapog project), spin up a Docker container, and publish a static site via Cloudflare Workers—all without manual commits. The dashboard offers a quick status view and a manual “reset” button if the loop stalls.

Code Health & Issues

  • High – License missing – No LICENSE file; undefined redistribution rights.
  • High – Lockfile missing – package.json exists without package-lock.json; version drift risk.
  • Medium – Dependabot not configured – No .github/dependabot.yml for automated updates.
  • Medium – No dependency‑vulnerability scan – CI workflow lacks a step to reject vulnerable packages.
  • Medium – Checkout token persists – .github/workflows/ar-collections-finance-gate.yml runs actions/checkout with default credentials, exposing the token to later steps.
  • High – Duplicated code blocks – 67 identical six‑line snippets across 11 Python files (validate_report.py, verify_citations.py, etc.).
  • High – Deep nesting – Up to 8 indentation levels in security-scan.py and template generators, raising cognitive load.

No critical findings were reported; tests and CI are present, Dockerfile exists, and no secrets were detected in the history.

The Bottom Line

Auto‑Company provides a fully wired, locally runnable AI‑agent stack with a usable dashboard, but the codebase suffers from maintainability hotspots (duplication, deep nesting) and basic release‑process gaps (missing license, lockfile, automated security checks). It is suitable for experimentation or proof‑of‑concepts where rapid iteration outweighs production‑grade hardening; teams planning to adopt it long‑term should address the highlighted health items first.