security: harden prompt injection defense with XML delimiters and injection pattern stripping

fix: complete Redis cache integration and clean up test layer

fix

fix: deduplicate Celery config fields, fix mypy return-type on task result

feat: add Redis/Celery async job queue for repository analysis

fix

fix

fix

fix

fix: feat: fault-tolerant parallel agents, AST security scanner, and shared source reader

fixed lint

style(llm): fix import order, split long tenacity import, add blank lines, hoist inline import

feat(report): include specialist security/perf/arch findings in final report

fix(llm): remove duplicate return statement in call_llm

feat(metrics): add per-agent token tracking and cost estimation

feat(agents): add auto-fix suggestion generation to code_review_agent

feat(agents): add specialist multi-agent review with judge synthesis

fix(types): add missing type annotations in llm.py for mypy compliance

refactor(llm): hoist json import to module level — remove function-scoped import anti-pattern

fix(llm): move 429 check before raise_for_status — rate-limit handler was unreachable dead code

fix(llm): respect Retry-After header on HTTP 429 rate-limit responses

fix(config): expose cache_clear helper to allow reliable test isolation of Settings

fix(types): annotate _try_parse return as dict[str, Any] to satisfy mypy no-any-return

fix(core): empty __init__.py to prevent eager imports causing circular import crash on startup

fix(logger): always set propagate=False regardless of handler state

feat(llm): add call_llm_for_json with corrective retry on invalid JSON response

fix(prompts): add score rubric so LLM calibrates above 5 for decent code

fix(prompts): constrain LLM list fields to plain strings to fix Pydantic validation

fix: attach @retry decorator directly to call_llm (remove orphaning blank line)

fix: extract retry logger to named function to safely guard None outcome

fix

fix(logging): structured JSON logger + bind exception context in routes

fix: resolve all ruff lint errors (E402, F401, F811)

fix: reject requests when API_KEY env var is not configured

feat: add /metrics endpoint for observability

feat: add retry logic with exponential backoff to call_llm

refactor: replace print() with structured logging across all agents and tools

fix(llm): replace blocking httpx.post with async AsyncClient

fix(config): remove hardcoded path and unused fields, make HF-ready

feat: add API key authentication to POST endpoints

feat: convert to async/await with parallel agent execution via asyncio.gather

fix: replace hardcoded Windows path with cross-platform tempdir

feat: switch LLM back to llama-3.3-70b-instruct

feat: switch LLM to openai/gpt-oss-120b

fix: use Windows-compatible temp path for repository cloning

fix: update pydantic config to V2 style and fix httpx warning

fix: suppress remaining bandit warnings with nosec comments

fix: resolve all ruff linting errors in __init__ files and CI

feat: add FastAPI routes and main app entrypoint

feat: add llm client and agent prompts