The Problem

Engineers building AI-agent workflows need repeatable patterns that include feedback loops, clear stopping conditions, and auditability. This repository provides a Loop Library website and a companion "Loopy" skill, but the codebase has structural issues that increase cognitive load when modifying or extending workflows. Key files are oversized (684+ lines), test suites are not invoked by CI, and dependency management lacks automation.

What This Does

The repository has two distinct parts. The Loop Library website under loop-library/site/ is a public catalog for browsing and copying published loops; it runs as a static site with rendering handled by loop-library/worker/. The Loopy skill lives in skills/loopy/ and provides an installable guide for AI agents to discover, audit, adapt, and publish loops through guided workflows. The worker at loop-library/worker/src/index.js is the central HTTP handler — it defines handleRequest, fetch, and bindIdempotency, and reaches 116 functions through its call graph. Downstream effects propagate widely: jsonResponse is called from 17 places, fetch from 13, and escapeHtml from 8. The most connected hub is loop-library/worker/src/index.js (instability 0.67), and loop-library/worker/src/loop-schema has the highest fan-out at 4 importers with zero importers of its own, making it a safe entry point for changes. Network effects exit the process via fetch calls (8 functions) and one database read/write through catalog-store.js.

How It Is Wired

Execution starts at the worker's HTTP handler handleRequest (loop-library/worker/src/index.js:65), which routes to jsonResponse (17 callers), handleLoopRoute (loop-library/worker/src/loop-routes.js), or handleAdminRequest. handleLoopRoute in turn calls jsonResponse (6 callers) and catalogFetch. Authentication flows through startOAuth, finishOAuth, and authBridge in auth-votes.js, which makes outbound network calls. The site's script.js runs an external command via readStoredTheme and applyTheme. Test files auth-votes.test.js and loop-routes.test.js contain 6-line duplicated blocks. The call graph has 331 resolved edges between internal functions; paths from bindIdempotency reach 116 functions, meaning a change to idempotency binding ripples broadly. The loop-schema module is the least connected hub (Ca 4, Ce 0, instability 0), suggesting it is a stable injection point for new loop definitions.

How To Use It

Setup: The worker runs on npm. Install dependencies with npm install from loop-library/worker/. The website is a static site served from loop-library/site/. The Loopy skill is a separate installable package under skills/loopy/.

Configuration: Environment variables are expected in loop-library/worker/.dev.vars.example. No secrets are committed, but the CI workflow (ci.yml) keeps the checkout token, so persist-credentials: false should be set and explicit tokens passed only to pushing steps.

Running it: Start the worker with npm run dev (or whatever start script is defined in loop-library/worker/package.json). The live website is at https://signals.forwardfuture.com/loop-library/. The JSON catalog is available at https://signals.forwardfuture.com/loop-library/catalog.json. The Loopy skill can be installed into an AI agent framework using the manifest in skills/loopy/SKILL.md.

Real-World Use

An agent tasked with improving documentation coverage can use the Loopy skill to discover published loops from the catalog, adapt a loop that matches the project's tech stack, and run it in bounded passes. The agent calls the website's catalog API (GET /catalog.json) to find loops, then uses the skill's guided conversation to craft a new loop through plain-language prompts about the goal, success criteria, next steps, and stopping conditions. If the loop requires API calls or database changes, the worker's fetch and catalog-store functions handle the outbound network and persistence. The agent can audit an existing loop by running the skill's audit reference (skills/loopy/references/audit.md), which checks for weak checks, unsafe actions, and unclear stopping behavior.

Code Health & Issues

  • [HIGH] Make CI invoke the test suite it has — .github/workflows have 3 test files but no test command in any workflow. A green check that never executed an assertion is worse than no check because reviewers trust it.
  • [MEDIUM] Enable Dependabot or Renovate — 1 manifest exists with no update bot configured. Without a bot, a published advisory sits unpatched until someone audits by hand.
  • [MEDIUM] Gate pull requests on a dependency vulnerability scan — no dependency scan is in CI. This is the one gate that would catch a known-vulnerable package before it reaches a build.
  • [MEDIUM] Set persist-credentials: false on checkout — .github/workflows/ci.yml keeps the token, then installs dependencies. The token stays in .git/config for every later step, so a malicious postinstall script could read pushable credentials without one ever being passed to it.

The Bottom Line

The repository delivers a functional Loop Library website and a Loopy skill that gives AI agents guided access to repeatable workflow patterns. The codebase is structurally sound with tests, CI, a license, and a lockfile, but two issues demand attention before production use: the CI workflow does not run the 3 available test files, and dependency update/security scanning automation is absent. Teams that can tolerate manual test execution and periodic dependency audits can adopt the library immediately; others should address the CI and dependency hygiene findings first.