loom-react

A development guide for client-side React 19 or newer single-page applications. It covers React components and Hooks with React Router, Jotai, Vite, Bun, and the Oxc linting and formatting tools; it does not cover server-rendered frameworks such as Next.js or Remix.

In plain words
What is it for?
It helps build browser-based React applications, handle routes and forms, manage application state, load data asynchronously, and check code quality and behavior.
Why use it?
It gives developers consistent patterns for routing, shared state, asynchronous data loading, accessibility, performance, and testing. The scope makes clear when the guidance does not apply.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/cosmix/loom/loom-react
Any agent
npx skills add cosmix/loom --skill loom-react
Clone the repo
git clone --depth 1 https://github.com/cosmix/loom

Made for: Claude Code, Codex.

Per session 79 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 16,137 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00079 $0.16137
Opus 5 $0.00039 $0.08068
Sonnet 5 $0.00016 $0.03227
Haiku 4.5 $0.00008 $0.01614

Measured 2d ago against content hash 6f83a5495674, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

loom-react scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

const response = await fetch(url, { signal: controller.signal });
skills/loom-react/SKILL.md · 1,620 lines

How it starts

The opening of the file, as written. The whole thing — 1,620 lines — stays where its author put it; the contents beside it link to each section on GitHub.

React SPA Development

Overview

Client-side React 19+ SPAs. Stack: React Router v7 (routing/loaders), Jotai (atomic global state), Vite (build — Rolldown bundler, Oxc transforms and minifier, Lightning CSS), oxlint + oxfmt (lint/format — the Oxc replacements for ESLint and Prettier), Bun (package manager/runtime). NOT for SSR frameworks (Next.js/Remix) — those are out of scope.

The single densest section is Expert Practices at the end — read it first if you know React basics. The middle sections are reference implementations.

React 19 Features

Actions and useActionState

React 19 introduces Actions for handling async state transitions:

import { useActionState } from 'react'

interface FormState {
  message: string
  error?: string
}

async function updateProfile(previousState: FormState, formData: FormData) {
  const name = formData.get('name') as string

  try {
    await fetch('/api/profile', {
      method: 'POST',
      body: JSON.stringify({ name }),
    })
    return { message: 'Profile updated successfully' }
  } catch (error) {
    return { message: '', error: 'Update failed' }
  }
}

export function ProfileForm() {
  const [state, formAction, isPending] = useActionState(updateProfile, { message: '' })

  return (
    <form action={formAction}>
      <input type="text" name="name" disabled={isPending} />
      <button type="submit" disabled={isPending}>
        {isPending ? 'Updating...' : 'Update Profile'}
      </button>
      {state.error && <p className="error">{state.error}</p>}
      {state.message && <p className="success">{state.message}</p>}
    </form>
  )
}

useOptimistic for Instant UI Updates

import { useOptimistic, useState } from 'react'

interface Todo {
  id: string
  title: string
  completed: boolean
}

export function TodoList({ todos }: { todos: Todo[] }) {
  const [optimisticTodos, addOptimisticTodo] = useOptimistic(
    todos,
    (state, newTodo: Todo) => [...state, newTodo]
  )

  async function addTodo(formData: FormData) {
    const title = formData.get('title') as string
    const tempTodo = { id: crypto.randomUUID(), title, completed: false }

    addOptimisticTodo(tempTodo)

    await fetch('/api/todos', {
      method: 'POST',
      body: JSON.stringify({ title }),
    })
  }

  return (
    <div>
      <ul>
        {optimisticTodos.map((todo) => (
          <li key={todo.id}>{todo.title}</li>
        ))}
      </ul>
      <form action={addTodo}>
        <input type="text" name="title" />
        <button type="submit">Add Todo</button>
      </form>
    </div>
  )
}

Read the full file on GitHub · 1,620 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 1,620 lines · 79 tokens per session scan A 6f83a5495674

Subscribe to this mod's changes

loom-react is a skill published in the GitHub repository cosmix/loom (54 stars, last pushed 3d ago), licensed MIT. It adds 79 tokens to every session and 16,137 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

aksel-builder

Expert builder for Aksel, the Nav / @navikt design system — React components, design tokens, layout primitives, theming (light/dark), icons, CSS, the Tailwind preset, version migrations, Figma-to-code. Triggers — Aksel, "using/with aksel", Nav/Navikt, "designsystemet", "design system", @navikt/ds- (e.g.…

navikt/copilot · 181 tokens

aksel-spacing

Lag responsive layouts med Aksel Design System (v8+) - spacing tokens, layout primitives (Box, HStack, VStack, HGrid, Page, Bleed) og ResponsiveProp.

navikt/copilot · 41 tokens

Agent Design Principles

A checklist for designing agent personas, skills, and multi-agent pipelines that stay reliable as they grow — grounded in the 12-factor-agents principles.

niels-emmer/myace · 34 tokens

copilotkit-upgrade

Use when migrating a CopilotKit v1 application to v2 -- updating package imports, replacing deprecated hooks and components, switching from GraphQL runtime to AG-UI protocol runtime, and resolving breaking API changes.

CopilotKit/CopilotKit · 48 tokens

workers-best-practices

Reviews and authors Cloudflare Workers code against production best practices. Load when writing new Workers, reviewing Worker code, configuring wrangler.jsonc, or checking for common Workers anti-patterns (streaming, floating promises, global state, secrets, bindings, observability). Biases towards retrieval from…

cloudflare/skills · 72 tokens

decocms-ui

Build or style React UI with the decocms product design system (@decocms/ui). Use when creating interfaces, pages, or components in a project that should look like decocms products, when the user mentions "design system", "@decocms/ui", "decocms style", or asks to make UI consistent with Studio. Covers installation…

decocms/studio · 91 tokens