Deploy code agent from GitHub Actions

app.py

@@ -1,9 +1,11 @@
 from fastapi import FastAPI
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from transformers import AutoTokenizer, AutoModelForCausalLM, AutoConfig
+import ast
 import os
 import torch
 import re
+from collections import Counter
 
 HF_MODEL = os.getenv("HF_MODEL", "Qwen/Qwen2.5-Coder-1.5B-Instruct")
 
@@ -26,6 +28,56 @@ class CodeRepairRequest(BaseModel):
     exit_code: int | None = None
 
 
+class SourceFileInput(BaseModel):
+    path: str
+    content: str
+    truncated: bool = False
+    original_chars: int = 0
+
+
+class SourceReviewRequest(BaseModel):
+    project_type: str
+    has_tests: bool = False
+    files: list[SourceFileInput] = Field(default_factory=list)
+    discovered_files_count: int = 0
+    submitted_files_count: int = 0
+    submitted_chars: int = 0
+    truncated_files_count: int = 0
+    omitted_files_count: int = 0
+    read_error_files_count: int = 0
+
+
+class SourceFinding(BaseModel):
+    id: str
+    file_path: str | None = None
+    line: int | None = None
+    category: str
+    severity: str
+    confidence: str
+    title: str
+    evidence: str
+    impact: str
+    recommendation: str
+
+
+class SourceReviewResponse(BaseModel):
+    agent: str
+    mode: str
+    status: str
+    summary: str
+    risk_level: str
+    release_recommendation: str
+    reviewed_files_count: int
+    findings_count: int
+    severity_summary: dict[str, int]
+    category_summary: dict[str, int]
+    findings: list[SourceFinding] = Field(default_factory=list)
+    warnings: list[str] = Field(default_factory=list)
+    limitations: list[str] = Field(default_factory=list)
+    verification: str
+    llm_error: str | None = None
+
+
 @app.get("/")
 def health_check():
     return {
@@ -33,7 +85,9 @@ def health_check():
         "status": "running",
         "llm_enabled": True,
         "llm_mode": "local-transformers",
-        "model": HF_MODEL
+        "model": HF_MODEL,
+        "capabilities": ["source-review", "code-repair"],
+        "endpoints": ["/review-source", "/suggest-code-fix"],
     }
 
 
@@ -383,25 +437,30 @@ Keep the answer concise.
 """
 
 
-def call_llm(prompt: str):
+def call_llm(
+    prompt: str,
+    system_prompt: str = "You are a careful code repair assistant. Return only the final repair guidance.",
+    max_input_tokens: int = 1024,
+    max_new_tokens: int = 256,
+):
     active_tokenizer, active_model = load_model()
 
     messages = [
         {
             "role": "system",
-            "content": "You are a careful code repair assistant. Return only the final repair guidance."
+            "content": system_prompt,
         },
         {
             "role": "user",
-            "content": prompt
-        }
+            "content": prompt,
+        },
     ]
 
     if hasattr(active_tokenizer, "apply_chat_template"):
         formatted_prompt = active_tokenizer.apply_chat_template(
             messages,
             tokenize=False,
-            add_generation_prompt=True
+            add_generation_prompt=True,
         )
     else:
         formatted_prompt = prompt
@@ -410,14 +469,14 @@ def call_llm(prompt: str):
         formatted_prompt,
         return_tensors="pt",
         truncation=True,
-        max_length=1024
+        max_length=max_input_tokens,
     )
 
     outputs = active_model.generate(
         **inputs,
-        max_new_tokens=256,
+        max_new_tokens=max_new_tokens,
         do_sample=False,
-        pad_token_id=active_tokenizer.eos_token_id
+        pad_token_id=active_tokenizer.eos_token_id,
     )
 
     generated_text = active_tokenizer.decode(outputs[0], skip_special_tokens=True)
@@ -542,6 +601,809 @@ def clean_output(text: str, request: CodeRepairRequest):
 
     return cleaned
 
+SEVERITY_ORDER = {
+    "CRITICAL": 0,
+    "HIGH": 1,
+    "MEDIUM": 2,
+    "LOW": 3,
+    "INFO": 4,
+}
+
+SECRET_NAME_PATTERN = re.compile(
+    r"(?:password|passwd|secret|token|api[_-]?key|private[_-]?key|access[_-]?key)",
+    re.IGNORECASE,
+)
+
+PLACEHOLDER_SECRET_VALUES = {
+    "",
+    "change-me",
+    "changeme",
+    "example",
+    "placeholder",
+    "secret",
+    "password",
+    "token",
+    "your-secret",
+    "your-token",
+}
+
+
+def dotted_name(node):
+    if isinstance(node, ast.Name):
+        return node.id
+
+    if isinstance(node, ast.Attribute):
+        parent = dotted_name(node.value)
+        return f"{parent}.{node.attr}" if parent else node.attr
+
+    return ""
+
+
+def line_evidence(content, line_number, fallback):
+    lines = content.splitlines()
+
+    if line_number and 0 < line_number <= len(lines):
+        value = lines[line_number - 1].strip()
+        if value:
+            return value[:240]
+
+    return fallback
+
+
+def is_placeholder_secret(value):
+    normalized = str(value).strip().lower()
+
+    if normalized in PLACEHOLDER_SECRET_VALUES:
+        return True
+
+    return any(
+        marker in normalized
+        for marker in ("${", "{{", "env.", "process.env", "os.getenv", "system.getenv")
+    )
+
+
+def assignment_target_names(node):
+    names = []
+
+    if isinstance(node, ast.Name):
+        names.append(node.id)
+    elif isinstance(node, (ast.Tuple, ast.List)):
+        for item in node.elts:
+            names.extend(assignment_target_names(item))
+    elif isinstance(node, ast.Attribute):
+        names.append(node.attr)
+
+    return names
+
+
+def keyword_value(call, keyword_name):
+    for keyword in call.keywords:
+        if keyword.arg == keyword_name:
+            return keyword.value
+
+    return None
+
+
+def is_true_literal(node):
+    return isinstance(node, ast.Constant) and node.value is True
+
+
+def is_false_literal(node):
+    return isinstance(node, ast.Constant) and node.value is False
+
+
+def add_finding(
+    findings,
+    file_path,
+    line,
+    category,
+    severity,
+    confidence,
+    title,
+    evidence,
+    impact,
+    recommendation,
+):
+    findings.append(
+        {
+            "file_path": file_path,
+            "line": line,
+            "category": category,
+            "severity": severity,
+            "confidence": confidence,
+            "title": title,
+            "evidence": evidence,
+            "impact": impact,
+            "recommendation": recommendation,
+        }
+    )
+
+
+def analyze_python_source(source_file, findings, warnings):
+    path = source_file.path
+    content = source_file.content
+
+    try:
+        tree = ast.parse(content, filename=path)
+    except SyntaxError as error:
+        if source_file.truncated:
+            warnings.append(
+                f"{path} could not be fully parsed because the submitted content was truncated."
+            )
+            return
+
+        add_finding(
+            findings,
+            path,
+            error.lineno,
+            "correctness",
+            "HIGH",
+            "HIGH",
+            "Python syntax error",
+            error.msg,
+            "The module cannot be imported or executed successfully.",
+            "Correct the syntax error and rerun Stitch QA before deployment.",
+        )
+        return
+
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.Assign, ast.AnnAssign)):
+            value = node.value
+            targets = node.targets if isinstance(node, ast.Assign) else [node.target]
+            names = []
+
+            for target in targets:
+                names.extend(assignment_target_names(target))
+
+            if (
+                isinstance(value, ast.Constant)
+                and isinstance(value.value, str)
+                and len(value.value.strip()) >= 6
+                and any(SECRET_NAME_PATTERN.search(name) for name in names)
+                and not is_placeholder_secret(value.value)
+            ):
+                add_finding(
+                    findings,
+                    path,
+                    getattr(node, "lineno", None),
+                    "security",
+                    "HIGH",
+                    "HIGH",
+                    "Possible hardcoded credential",
+                    "A credential-like variable is assigned a literal string value.",
+                    "Hardcoded credentials can be exposed through source control, logs, or package distribution.",
+                    "Move the value to a secret manager or environment variable and rotate any exposed credential.",
+                )
+
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            defaults = list(node.args.defaults) + [
+                item for item in node.args.kw_defaults if item is not None
+            ]
+
+            if any(isinstance(default, (ast.List, ast.Dict, ast.Set)) for default in defaults):
+                add_finding(
+                    findings,
+                    path,
+                    getattr(node, "lineno", None),
+                    "reliability",
+                    "MEDIUM",
+                    "HIGH",
+                    "Mutable function default",
+                    f"Function `{node.name}` uses a mutable default argument.",
+                    "State can leak between calls and create difficult-to-reproduce defects.",
+                    "Use None as the default and create the mutable object inside the function.",
+                )
+
+        if isinstance(node, ast.ExceptHandler):
+            if node.type is None:
+                add_finding(
+                    findings,
+                    path,
+                    getattr(node, "lineno", None),
+                    "reliability",
+                    "MEDIUM",
+                    "HIGH",
+                    "Bare exception handler",
+                    line_evidence(content, getattr(node, "lineno", None), "A bare except handler was detected."),
+                    "SystemExit, KeyboardInterrupt, and unexpected defects can be swallowed.",
+                    "Catch only the expected exception types and preserve actionable error context.",
+                )
+
+            if node.body and all(isinstance(item, ast.Pass) for item in node.body):
+                add_finding(
+                    findings,
+                    path,
+                    getattr(node, "lineno", None),
+                    "error-handling",
+                    "MEDIUM",
+                    "HIGH",
+                    "Exception silently ignored",
+                    line_evidence(content, getattr(node, "lineno", None), "An exception handler contains only pass."),
+                    "Failures can be hidden and leave the application in an unknown state.",
+                    "Handle the exception explicitly or log and re-raise it with safe context.",
+                )
+
+        if not isinstance(node, ast.Call):
+            continue
+
+        function_name = dotted_name(node.func)
+        line = getattr(node, "lineno", None)
+        evidence = line_evidence(content, line, function_name)
+
+        if function_name in {"eval", "exec", "builtins.eval", "builtins.exec"}:
+            add_finding(
+                findings,
+                path,
+                line,
+                "security",
+                "HIGH",
+                "HIGH",
+                "Dynamic code execution",
+                evidence,
+                "Untrusted input can lead to arbitrary code execution.",
+                "Remove dynamic execution or replace it with a strict parser and an allowlisted operation set.",
+            )
+
+        if function_name == "os.system":
+            add_finding(
+                findings,
+                path,
+                line,
+                "security",
+                "HIGH",
+                "HIGH",
+                "Shell command execution through os.system",
+                evidence,
+                "User-controlled values can create operating-system command injection.",
+                "Use subprocess with an argument list, shell disabled, validated inputs, and least privilege.",
+            )
+
+        if function_name.startswith("subprocess.") and is_true_literal(
+            keyword_value(node, "shell")
+        ):
+            add_finding(
+                findings,
+                path,
+                line,
+                "security",
+                "HIGH",
+                "HIGH",
+                "Subprocess executed with shell enabled",
+                evidence,
+                "Shell interpretation increases command-injection risk.",
+                "Disable shell execution and pass validated command arguments as a list.",
+            )
+
+        if function_name in {"pickle.load", "pickle.loads"}:
+            add_finding(
+                findings,
+                path,
+                line,
+                "security",
+                "HIGH",
+                "HIGH",
+                "Unsafe pickle deserialization",
+                evidence,
+                "Loading attacker-controlled pickle data can execute arbitrary code.",
+                "Use a non-executable serialization format and validate data before processing it.",
+            )
+
+        if function_name == "yaml.load":
+            loader = keyword_value(node, "Loader")
+            loader_name = dotted_name(loader) if loader is not None else ""
+
+            if loader_name not in {"yaml.SafeLoader", "yaml.CSafeLoader", "SafeLoader", "CSafeLoader"}:
+                add_finding(
+                    findings,
+                    path,
+                    line,
+                    "security",
+                    "HIGH",
+                    "HIGH",
+                    "Unsafe YAML loading",
+                    evidence,
+                    "Unsafe YAML constructors can instantiate arbitrary Python objects.",
+                    "Use yaml.safe_load or explicitly select SafeLoader.",
+                )
+
+        if function_name.startswith("requests.") and is_false_literal(
+            keyword_value(node, "verify")
+        ):
+            add_finding(
+                findings,
+                path,
+                line,
+                "security",
+                "HIGH",
+                "HIGH",
+                "TLS certificate verification disabled",
+                evidence,
+                "Network traffic can be intercepted by an attacker presenting an untrusted certificate.",
+                "Enable certificate verification and configure a trusted CA bundle when required.",
+            )
+
+        if function_name in {"hashlib.md5", "hashlib.sha1"}:
+            add_finding(
+                findings,
+                path,
+                line,
+                "security",
+                "MEDIUM",
+                "MEDIUM",
+                "Weak cryptographic hash",
+                evidence,
+                "MD5 and SHA-1 are unsuitable for security-sensitive integrity or credential protection.",
+                "Use a modern hash such as SHA-256, or a password-specific algorithm such as Argon2 or bcrypt.",
+            )
+
+        if function_name.endswith(".run") and is_true_literal(keyword_value(node, "debug")):
+            add_finding(
+                findings,
+                path,
+                line,
+                "security",
+                "MEDIUM",
+                "MEDIUM",
+                "Debug mode explicitly enabled",
+                evidence,
+                "Production debug mode can expose sensitive stack traces or interactive debugging features.",
+                "Disable debug mode in deployment and control it through environment-specific configuration.",
+            )
+
+    if len(content.splitlines()) > 800:
+        add_finding(
+            findings,
+            path,
+            1,
+            "maintainability",
+            "LOW",
+            "MEDIUM",
+            "Large source file",
+            f"The submitted file contains {len(content.splitlines())} lines.",
+            "Very large modules are harder to review, test, and maintain safely.",
+            "Split unrelated responsibilities into smaller cohesive modules while preserving behavior.",
+        )
+
+
+def analyze_java_source(source_file, findings):
+    path = source_file.path
+    content = source_file.content
+    lines = content.splitlines()
+
+    for index, raw_line in enumerate(lines, start=1):
+        line = raw_line.strip()
+        secret_match = re.search(
+            r'(?i)\b(?:String\s+)?([A-Za-z0-9_]*(?:password|passwd|secret|token|apiKey|api_key|privateKey|accessKey)[A-Za-z0-9_]*)\s*=\s*"([^"]{6,})"',
+            line,
+        )
+
+        if secret_match and not is_placeholder_secret(secret_match.group(2)):
+            add_finding(
+                findings,
+                path,
+                index,
+                "security",
+                "HIGH",
+                "HIGH",
+                "Possible hardcoded credential",
+                "A credential-like Java variable is assigned a literal string value.",
+                "The credential can be exposed through source control, build artifacts, or logs.",
+                "Load the value from a protected secret store or environment variable and rotate exposed credentials.",
+            )
+
+        if "Runtime.getRuntime().exec" in line:
+            add_finding(
+                findings,
+                path,
+                index,
+                "security",
+                "HIGH",
+                "HIGH",
+                "Runtime command execution",
+                line[:240],
+                "Unvalidated command content can lead to operating-system command injection.",
+                "Use a fixed command with validated arguments and avoid passing user-controlled shell content.",
+            )
+
+        if "new ProcessBuilder" in line:
+            add_finding(
+                findings,
+                path,
+                index,
+                "security",
+                "MEDIUM",
+                "MEDIUM",
+                "External process creation requires validation",
+                line[:240],
+                "Untrusted process arguments can create command execution or privilege risks.",
+                "Use allowlisted commands, validated argument arrays, controlled working directories, and least privilege.",
+            )
+
+        if re.search(r"\bexecute(?:Query|Update)?\s*\([^)]*\+", line):
+            add_finding(
+                findings,
+                path,
+                index,
+                "security",
+                "HIGH",
+                "MEDIUM",
+                "Possible SQL query concatenation",
+                line[:240],
+                "Concatenated untrusted values can allow SQL injection.",
+                "Use PreparedStatement parameters or an ORM parameter-binding API.",
+            )
+
+        if re.search(r'MessageDigest\.getInstance\(\s*"(?:MD5|SHA-1)"', line, re.IGNORECASE):
+            add_finding(
+                findings,
+                path,
+                index,
+                "security",
+                "MEDIUM",
+                "HIGH",
+                "Weak cryptographic hash",
+                line[:240],
+                "MD5 and SHA-1 are unsuitable for security-sensitive integrity or credential protection.",
+                "Use SHA-256 or stronger, and use a password-specific algorithm for password storage.",
+            )
+
+        if ".printStackTrace()" in line:
+            add_finding(
+                findings,
+                path,
+                index,
+                "error-handling",
+                "LOW",
+                "HIGH",
+                "Stack trace written directly",
+                line[:240],
+                "Raw stack traces can expose implementation details and bypass structured logging.",
+                "Use the project logger with controlled context and avoid exposing sensitive details to clients.",
+            )
+
+        if "System.out.print" in line or "System.err.print" in line:
+            add_finding(
+                findings,
+                path,
+                index,
+                "maintainability",
+                "LOW",
+                "HIGH",
+                "Direct console output in application code",
+                line[:240],
+                "Console output is difficult to classify, filter, and correlate in production.",
+                "Use structured application logging with an appropriate log level.",
+            )
+
+        if re.search(r"@CrossOrigin\s*\([^)]*\*", line) or re.search(
+            r"allowedOrigins?\s*\([^)]*\*", line, re.IGNORECASE
+        ):
+            add_finding(
+                findings,
+                path,
+                index,
+                "security",
+                "MEDIUM",
+                "HIGH",
+                "Wildcard cross-origin access",
+                line[:240],
+                "Unrestricted origins can expose APIs to untrusted web applications.",
+                "Allow only explicitly trusted origins and review credential-sharing settings.",
+            )
+
+        if re.search(r"HostnameVerifier.*->\s*true", line) or "ALLOW_ALL_HOSTNAME_VERIFIER" in line:
+            add_finding(
+                findings,
+                path,
+                index,
+                "security",
+                "CRITICAL",
+                "HIGH",
+                "TLS hostname verification bypass",
+                line[:240],
+                "An attacker can impersonate a remote service even when TLS is used.",
+                "Remove the permissive verifier and use the platform default hostname and certificate validation.",
+            )
+
+    for match in re.finditer(r"catch\s*\([^)]*\)\s*\{\s*\}", content, re.DOTALL):
+        line = content.count("\n", 0, match.start()) + 1
+        add_finding(
+            findings,
+            path,
+            line,
+            "error-handling",
+            "MEDIUM",
+            "HIGH",
+            "Empty Java catch block",
+            "A catch block contains no handling logic.",
+            "The application can hide failures and continue with invalid state.",
+            "Handle the expected exception, preserve safe diagnostic context, or rethrow it appropriately.",
+        )
+
+    if len(lines) > 800:
+        add_finding(
+            findings,
+            path,
+            1,
+            "maintainability",
+            "LOW",
+            "MEDIUM",
+            "Large source file",
+            f"The submitted file contains {len(lines)} lines.",
+            "Very large classes are harder to review, test, and maintain safely.",
+            "Separate unrelated responsibilities into smaller cohesive classes while preserving behavior.",
+        )
+
+
+def deduplicate_findings(findings):
+    unique = {}
+
+    for finding in findings:
+        key = (
+            finding.get("file_path"),
+            finding.get("line"),
+            finding.get("title"),
+        )
+        unique[key] = finding
+
+    ordered = sorted(
+        unique.values(),
+        key=lambda item: (
+            SEVERITY_ORDER.get(item.get("severity"), 99),
+            str(item.get("file_path") or ""),
+            item.get("line") or 0,
+            item.get("title") or "",
+        ),
+    )
+
+    for index, finding in enumerate(ordered, start=1):
+        finding["id"] = f"SQ-SRC-{index:03d}"
+
+    return ordered
+
+
+def build_severity_summary(findings):
+    summary = {
+        "CRITICAL": 0,
+        "HIGH": 0,
+        "MEDIUM": 0,
+        "LOW": 0,
+        "INFO": 0,
+    }
+
+    for finding in findings:
+        severity = finding.get("severity", "INFO")
+        summary[severity] = summary.get(severity, 0) + 1
+
+    return summary
+
+
+def build_category_summary(findings):
+    return dict(sorted(Counter(finding.get("category", "other") for finding in findings).items()))
+
+
+def build_risk_level(severity_summary):
+    for severity in ("CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"):
+        if severity_summary.get(severity, 0):
+            return severity
+
+    return "LOW"
+
+
+def build_release_recommendation(risk_level, partial):
+    if risk_level in {"CRITICAL", "HIGH"}:
+        return "BLOCK_RELEASE"
+
+    if risk_level == "MEDIUM":
+        return "REVIEW_REQUIRED"
+
+    if partial:
+        return "MANUAL_REVIEW_REQUIRED"
+
+    return "READY_WITH_CAUTION"
+
+
+def fallback_source_summary(request, findings, risk_level, release_recommendation):
+    if not findings:
+        return (
+            f"Agent 3 reviewed {len(request.files)} application source files and did not identify "
+            "a blocking issue with the implemented checks. This result does not replace manual, "
+            "dependency, architecture, or runtime security review."
+        )
+
+    severity_summary = build_severity_summary(findings)
+    return (
+        f"Agent 3 reviewed {len(request.files)} application source files and reported "
+        f"{len(findings)} findings. Highest risk is {risk_level}. "
+        f"Critical: {severity_summary.get('CRITICAL', 0)}, High: {severity_summary.get('HIGH', 0)}, "
+        f"Medium: {severity_summary.get('MEDIUM', 0)}, Low: {severity_summary.get('LOW', 0)}. "
+        f"Release recommendation: {release_recommendation}."
+    )
+
+
+def build_source_summary_prompt(request, findings, risk_level, release_recommendation):
+    finding_lines = []
+
+    for finding in findings[:20]:
+        location = finding.get("file_path") or "Project-level"
+        if finding.get("line"):
+            location = f"{location}:{finding.get('line')}"
+        finding_lines.append(
+            f"- [{finding.get('severity')}] {finding.get('title')} at {location}: "
+            f"{finding.get('impact')}"
+        )
+
+    findings_text = "\n".join(finding_lines) or "- No findings from the implemented checks."
+
+    return f"""
+Create a concise professional pre-release source-code QA summary using only the supplied facts.
+
+Project type: {request.project_type}
+Reviewed files: {len(request.files)}
+Has detected tests: {request.has_tests}
+Highest risk: {risk_level}
+Release recommendation: {release_recommendation}
+
+Confirmed findings:
+{findings_text}
+
+State what was reviewed, the most important confirmed risks, and the required next action.
+Do not invent findings, files, runtime results, or successful deployment claims.
+Return one short paragraph only.
+"""
+
+
+def clean_source_summary(text):
+    cleaned = remove_prompt_leak(text)
+
+    if not cleaned:
+        return None
+
+    cleaned = re.sub(r"\n{2,}", " ", cleaned).strip()
+
+    if len(cleaned) < 40:
+        return None
+
+    blocked_phrases = [
+        "create a concise professional",
+        "confirmed findings:",
+        "do not invent findings",
+        "return one short paragraph",
+        "system you are",
+        "user you are",
+    ]
+
+    if any(phrase in cleaned.lower() for phrase in blocked_phrases):
+        return None
+
+    return cleaned[:1600]
+
+
+def review_source_request(request: SourceReviewRequest):
+    findings = []
+    warnings = []
+    limitations = [
+        "This review uses targeted static checks and an AI summary; it does not prove the absence of defects or vulnerabilities.",
+        "Dependency vulnerabilities, infrastructure configuration, business-rule correctness, and runtime behavior require separate evidence.",
+    ]
+
+    for source_file in request.files:
+        suffix = os.path.splitext(source_file.path.lower())[1]
+
+        if suffix == ".py":
+            analyze_python_source(source_file, findings, warnings)
+        elif suffix == ".java":
+            analyze_java_source(source_file, findings)
+        else:
+            warnings.append(f"Unsupported source extension skipped by Agent 3: {source_file.path}")
+
+        if source_file.truncated:
+            warnings.append(
+                f"{source_file.path} was truncated before review; findings may not cover the entire file."
+            )
+
+    if not request.has_tests:
+        add_finding(
+            findings,
+            None,
+            None,
+            "testing",
+            "MEDIUM",
+            "HIGH",
+            "No automated tests detected",
+            "The project scan did not detect a compatible automated test suite.",
+            "Source review alone cannot verify runtime behavior, integrations, regressions, or business rules.",
+            "Add focused automated tests for critical flows, validation, error paths, and security-sensitive behavior.",
+        )
+
+    findings = deduplicate_findings(findings)
+    severity_summary = build_severity_summary(findings)
+    category_summary = build_category_summary(findings)
+    risk_level = build_risk_level(severity_summary)
+    partial = any(
+        (
+            request.truncated_files_count,
+            request.omitted_files_count,
+            request.read_error_files_count,
+        )
+    )
+    release_recommendation = build_release_recommendation(risk_level, partial)
+
+    if request.omitted_files_count:
+        limitations.append(
+            f"{request.omitted_files_count} discovered source files were omitted by client-side review limits."
+        )
+
+    if request.read_error_files_count:
+        limitations.append(
+            f"{request.read_error_files_count} source files could not be read by the CLI."
+        )
+
+    if request.truncated_files_count:
+        limitations.append(
+            f"{request.truncated_files_count} source files were partially reviewed because of size limits."
+        )
+
+    status = "PARTIAL" if partial else "COMPLETED"
+    mode = "rule-based"
+    llm_error = None
+    summary = fallback_source_summary(
+        request,
+        findings,
+        risk_level,
+        release_recommendation,
+    )
+
+    try:
+        prompt = build_source_summary_prompt(
+            request,
+            findings,
+            risk_level,
+            release_recommendation,
+        )
+        llm_text = call_llm(
+            prompt,
+            system_prompt=(
+                "You are Agent 3 of Stitch QA, a careful pre-release source-code QA reviewer. "
+                "Summarize only confirmed supplied findings and never claim complete safety."
+            ),
+            max_input_tokens=1536,
+            max_new_tokens=220,
+        )
+        cleaned_summary = clean_source_summary(llm_text)
+
+        if cleaned_summary:
+            summary = cleaned_summary
+            mode = "hybrid"
+    except Exception as error:
+        llm_error = repr(error)
+
+    return {
+        "agent": "code-agent",
+        "mode": mode,
+        "status": status,
+        "summary": summary,
+        "risk_level": risk_level,
+        "release_recommendation": release_recommendation,
+        "reviewed_files_count": len(request.files),
+        "findings_count": len(findings),
+        "severity_summary": severity_summary,
+        "category_summary": category_summary,
+        "findings": findings,
+        "warnings": list(dict.fromkeys(warnings)),
+        "limitations": limitations,
+        "verification": (
+            "Manually validate confirmed findings, apply the smallest safe fixes, add or run tests, "
+            "and rerun Stitch QA before deployment."
+        ),
+        "llm_error": llm_error,
+    }
+
+
+@app.post("/review-source", response_model=SourceReviewResponse)
+def review_source(request: SourceReviewRequest):
+    return review_source_request(request)
+
 
 @app.post("/suggest-code-fix")
 def suggest_code_fix(request: CodeRepairRequest):
@@ -582,4 +1444,4 @@ def suggest_code_fix(request: CodeRepairRequest):
 
     except Exception as error:
         fallback_result["llm_error"] = repr(error)
-        return fallback_result
+        return fallback_result