AutoDev — Self-Healing Codebase Agent

Paste a public GitHub URL → static analysis → LLM refactors → pull request, only after layered validation passes.

Live Dashboard · API Docs · Example PRs · Demo guide

Add docs/screenshots/dashboard.png — see docs/DEMO.md

---

What it does

AutoDev automates the analyze → refactor → validate → PR loop for Python repositories:

1. Clone a public GitHub repo (HTTPS only — SSRF guard)
2. Run 4 static analysis tools (Radon, Ruff, Bandit, AST)
3. Generate surgical refactors via Claude (up to 3 retries/issue)
4. Apply layered validation — no PR unless checks pass
5. AST-splice into the real file, run pytest on the modified repo, then open a GitHub PR

Proven on a live deployment: autodev-sandbox — issues detected, refactor validated, PR opened.

---

Layered validation (honest model)

LLM output is untrusted until proven. Validation runs in two phases:

Phase A — Pre-splice (snippet, in ValidationService)

Check	Purpose
Diff validator	Syntax, signatures, import allowlist, size bounds
Ruff + Bandit	Lint/security on refactored snippet
Baseline pytest	Repo must already pass tests before we accept a refactor
File hash capture	source_file_hash stored for staleness detection

Phase B — Post-splice (full file, in GitService)

Check	Purpose
Staleness guard	Abort if target file changed since validation
AST splice	Replace function by name, not stale line numbers
Full-file AST + Ruff	Syntax + duplicate-def check on entire file
Post-splice pytest	Proves refactor didn't break tests — file restored on failure

Interview-ready answer: "Baseline pytest ensures a healthy repo. Post-splice pytest runs on the actual modified file immediately before commit. If tests fail, we restore the original and block the PR."

---

Architecture

POST /analyze  →  Celery worker  →  clone → analyze → refactor → validate → splice → pytest → PR
                         ↑
                   Redis queue
                   PostgreSQL

Component	Role
FastAPI	REST API, auth, rate limits — returns task_id immediately
Celery worker	Runs the full pipeline (up to 10 min/repo)
PostgreSQL	Repos, issues, refactors, validation notes
Redis	Celery broker + result backend
Next.js	Dashboard, diff viewer, server-side API proxy

Production deploy: Railway (API + worker + Postgres + Redis) · Vercel (dashboard)

---

Screenshots

Refactor diff viewer — add docs/screenshots/diff-viewer.png

See docs/DEMO.md for recording a 60–90s demo video.

---

Tech stack

FastAPI · Celery · Redis · PostgreSQL · Alembic · Claude · Radon · Ruff · Bandit · GitPython · Next.js 14 · TypeScript · Docker · GitHub Actions

---

Quick start

git clone https://github.com/Arlikhozhaev/autodev.git && cd autodev
cp .env.example .env   # ANTHROPIC_API_KEY, GITHUB_TOKEN, API_KEY
docker compose up --build

Service	URL
Dashboard	http://localhost:3000
API	http://localhost:8000/docs
Flower (basic auth)	http://localhost:5555 — admin:changeme default

curl -X POST http://localhost:8000/api/v1/analyze \
  -H "Content-Type: application/json" \
  -H "X-API-Key: your-key" \
  -d '{"repo_url": "https://github.com/Arlikhozhaev/autodev-sandbox", "branch": "main"}'

---

API

Method	Endpoint	Notes
POST	/api/v1/analyze	GitHub HTTPS only · 10 req/min
GET	/api/v1/repos/{id}/report	Issues + metrics
GET	/api/v1/repos/{id}/refactors	Diffs + validation notes
GET	/api/v1/tasks/{id}	Celery status
GET	/ready	Postgres + Redis probe

---

Engineering quality

Area	Detail
Tests	46 pytest cases — diff validator, AST parser, API, auth, splice, post-splice pytest gate, URL validation
CI	Ruff · pytest · ESLint · production build on every merge to main
Security	API-key auth · rate limiting · GitHub-only clone URLs · Flower basic auth (local) · server-side key proxy
Migrations	Alembic with partial-schema recovery for cloud deploys

cd backend && pytest tests/ -v    # 46 tests
cd frontend && npm run lint && npm run build

What tests do not cover (yet)

• Live Claude API calls (mocked in API tests)
• Full end-to-end pipeline against real GitHub in CI
• RefactorService prompt loop integration

---

Configuration

Threshold	Default	Env var
Max cyclomatic complexity	10	MAX_CYCLOMATIC_COMPLEXITY
Max function lines	50	MAX_FUNCTION_LINES
Max nesting depth	3	MAX_NESTING_DEPTH
Max parameters	6	MAX_PARAMETERS

---

Project structure

backend/app/services/   analysis · refactor · validation · git (splice + post-splice pytest)
backend/app/utils/      diff_validator · ast_parser · pytest_runner · repo_url
frontend/components/    dashboard · diff viewer · pipeline stepper
docs/DEMO.md            demo video + screenshot guide

---

Roadmap

• Layered validation + post-splice pytest
• GitHub-only URL guard (SSRF)
• Live deploy (Railway + Vercel)
• 46 automated tests + CI
• Demo video link in README
• SSE live pipeline updates
• Integration test with mocked LLM + real splice
• TypeScript / JavaScript support

---

License

MIT

Live Demo · GitHub · Record a demo