AI Coding Agents Are Breaking Big Codebases — Dan Adler, Sourcegraph

频道: AI Engineer
视频: https://www.youtube.com/watch?v=Bdrs3uAX0_M
原文语言: en
统计: 共 10 轮 · Dan 9

[0:01] Dan

[music] Hey, welcome everybody. I'm Dan Adler, CEO at SourceCraft. It is uh great to see you all here today. Thank you so much for coming out and joining us. Um, this is a talk today about the unglamorous but loadbearing work of owning a large complex codebase and why AI and agentic coding tools today make that job more difficult and more important than ever before. Just to start, the software that runs the world is not pretty. It's not new. It's not clean. It's how everything actually works. 72% of software industry employment is in companies with more than 500 people. These are the large enterprises of the world. These are the companies managing thousands of repositories and decades of codebased history. Few of your peers work at startups at the hot companies you may hear about on social media. And even fewer of them are actually like ex soloreneurs making a living off of their um social feeds. Most of us work in large longived code bases. Those code bases are how your bank account will reject a transaction in real time if you hit your limit. They're how your insurance carrier calculates the reimbursement rate for a policy holder with dual coverage. It's how a chip and a warehouse scanner will actually allow Amazon to tell you when your socks arrive. It's how your Uber estimates an arrival time. It's how an airplane uses radar to uh adjust trajectories. How your paycheck gets issued. It's how your office air conditioner ticks on and on and on and on and on. These are the things that keep the world moving.

嘿，欢迎各位。我是 Dan Adler，Sourcegraph 的 CEO。今天能在这儿见到大家真的很高兴，非常感谢各位过来捧场。今天这场演讲要讲的，是一份不光鲜、却在承重的工作——拥有一个庞大而复杂的代码库；以及为什么今天的 AI 和 agentic 编程工具，让这份工作比以往任何时候都更难、也更重要。先说一句：真正让这个世界运转的软件并不好看。它不新，也不干净，但一切实际上就是靠它在跑。软件行业 72% 的就业岗位，都在员工超过 500 人的公司里。这些是全世界的大型企业，是管着成千上万个仓库、背着几十年代码库历史的公司。你的同行里，很少有人在创业公司、在那些你可能在社交媒体上听说的当红公司上班。而真正在 X 上当 solopreneur（一人创业者）、靠自己的社交信息流吃饭的人，就更少了。我们大多数人，都是在庞大、长寿的代码库里干活。正是靠这些代码库，你一旦刷到额度上限，银行账户就能实时拒掉那笔交易；你的保险公司才能算出一位有双重保障的投保人该按什么比例报销；一块芯片加一把仓库扫码枪，才真能让 Amazon 告诉你袜子什么时候到。你的 Uber 怎么估算到达时间，飞机怎么用雷达调整航线，你的工资怎么发出来，你办公室的空调怎么自己开起来——这样的例子可以一直、一直、一直数下去。就是这些东西，让世界保持运转。

[1:49] Dan

We are all completely utterly dependent on massive decades old super complex code bases that have been built over many many years by thousands of engineers and coding agents are writing more better code today faster than we have ever seen before. A title wave of code is coming for you. It's coming for your code base and for all of your engineers on your team who are trying to just keep their heads above water. Every one of us has felt this pain, this flood of AI generated code that we now have to review and make sure is healthy for our codebase and we're exhausted by it. And look, there are now code review agents. I'm sure there's a lot of them around this room right now. There are tools designed to help you measure your code base's health and so on. And look, the new the major coding agents will start to pull this stuff in. The models will get better over time. We'll keep putting sandbags down to keep this flood held back, right? We're going to keep finding these local maxima to help ourselves sort of avoid this problem. But meanwhile, what's happening is that these code bases, these massive ones that keep the world running are beginning to decay. millions of lines of code, tens of thousands of repositories, way too much to fit into a context window or even just to clone and GP in real time. That's just not possible. And this is causing big problems. We're publishing new features, new patches at record speed. There are different coding standards being applied in different places by different agents across the codebase. There's duplicated code proliferating. You you already have a library that does this, but your agent doesn't know that.

我们所有人都完完全全、彻彻底底地依赖着这些庞大的、有几十年历史的、超级复杂的代码库，它们是成千上万名工程师花了很多很多年一点点搭起来的。而今天，coding agent 写出的代码更多、更好，速度之快是我们从没见过的。一场代码的海啸正朝你扑过来。它冲着你的代码库来，也冲着你团队里每一个只求别被淹没的工程师来。我们每个人都尝过这种痛：AI 生成的代码像洪水一样涌来，我们得一份份 review，确保它对我们的代码库是健康的——我们被它搞得筋疲力尽。当然，现在已经有 code review agent 了，我敢说这会场里现在就有不少。也有专门帮你衡量代码库健康度之类的工具。而且，那些主流的 coding agent 会开始把这些能力吸收进去，模型也会随着时间越变越好。我们会不停地垒沙袋，把这场洪水挡在外面，对吧？我们会不断找到一个又一个局部最优，好让自己多少躲开这个问题。可与此同时，真正在发生的是：这些代码库，这些让世界保持运转的庞然大物，正在开始腐坏。几百万行代码，几万个仓库，多到根本塞不进一个上下文窗口，甚至连实时 clone 下来 grep 一遍都做不到。这根本不可能。而这正在引发大问题。我们在以创纪录的速度发布新功能、新补丁。代码库各处，不同的 agent 在不同的地方套用着不同的编码规范。重复代码在不断扩散——你明明已经有一个干这件事的库了，可你的 agent 不知道。

[3:34] Dan

There's cross-ervice dependencies that are becoming more brittle. There are slight deviations in standards that are creating more insidious hidden issues across the codebase. And maybe more important than anything else here, there are new vulnerabilities being uncovered by agents every single day. They require constant constant oversight and upkeep of all of these massive legacy code bases that nobody wants to think about or deal with. The job of owning a codebase is harder today than it has ever been before. And at the end of the day, the problem here is actually the volume of code. The call is coming from inside the house, right? The very tools that are speeding all of us up and letting us write more code faster than ever are also the tools that are creating the conditions that will cause these massive code bases that run our world to begin to fail. Every day I talk to technology executives at these large companies and they are feeling this so viscerally. The same pain that I imagine many of you are feeling too, right? I want to give my devs the best tools possible. But just today, I overheard a dev say, "I don't know what this code does. AI wrote it for me." This is a tech leader and executive at a top 10 car manufacturer.

跨服务的依赖正变得越来越脆弱。规范上一点点细微的偏差，正在整个代码库里埋下更阴险、更隐蔽的问题。而可能比这一切都更要紧的是：agent 每天都在挖出新的漏洞。这就要求有人对这些谁都不愿去想、谁都不愿去碰的庞大遗留代码库，做持续、再持续的看护和维护。拥有一个代码库这份工作，今天比以往任何时候都难。而说到底，问题其实出在代码的量上。这通电话，是从屋子里面打出来的，对吧？正是那些让我们所有人提速、让我们写代码比以往更多更快的工具，同时也在制造出一种条件，会让这些支撑我们世界运转的庞大代码库开始失灵。我每天都在跟这些大公司的技术高管聊，他们对这一点的感受是切肤的。我猜在座很多人也有同样的痛，对吧？「我想给我的开发者尽可能好的工具。可就在今天，我无意间听到一个开发者说：『我不知道这段代码是干什么的，是 AI 帮我写的。』」说这话的，是一家排名前十的汽车制造商的技术负责人、高管。

[4:52] Dan

When you're writing vehicle autopilot code and you have thousands of engineers in your org that you have to manage, you want to enable, this is terrifying. All right, here we go. So what I um deeply believe is that these codebase owners deserve better. Today's agentic dev tools are not meeting the moment for this. The infrastructure to see and understand a 50,000 repo codebase is not being built or sold by OpenAI, by anthropic, by cursor, by the rest of them. This is a hard and unique problem. Their agents are so unbelievably good at smalling at solving the small-cale problems that most developers deal with every day that they are their demand is growing faster than ever before. And this bigger problem of these code bases beginning to fall apart is going unnoticed. So this session this is a call first of all off to celebrate the people the owners of these code bases people around the world who are actually keeping them alive and keeping them running. most of our software engineer peers around the globe. So, thank you all so much for what you're doing. But this session is also a call to dev tools companies out there, to the agent harness builders, to people who are building the infrastructure for these agents to help build the the infrastructure, the the ability to go see and understand these massive scale repositories and give that to their agents.

当你写的是车辆自动驾驶的代码，组织里又有几千名工程师要你去管、要你去赋能的时候，这就太吓人了。好，我们往下走。我深信不疑的一点是：这些代码库的主人值得更好的东西。今天的 agentic 开发工具，在这件事上并没有跟上这个时刻的要求。能让你看见并理解一个 5 万个仓库的代码库的那套基础设施，OpenAI 没在做也没在卖，Anthropic 没有，Cursor 没有，其他那几家也都没有。这是一个又难又特殊的问题。他们的 agent 在解决大多数开发者每天碰到的那些小尺度问题上，好得不可思议，以至于市场对它们的需求增长得比以往任何时候都快。而这些代码库正在开始散架这个更大的问题，却没人留意。所以这场分享，首先是一次致敬：向这些代码库的主人致敬，向全世界真正让它们活着、让它们跑着的人致敬——也就是我们全球大多数的软件工程师同行。所以，非常感谢各位所做的一切。但这场分享同时也是一声呼吁，喊给外面的开发工具公司，喊给做 agent harness 的人，喊给正在为这些 agent 搭基础设施的人：请帮忙把这套基础设施建起来，把去看见并理解这些超大规模仓库的能力做出来，再交到他们的 agent 手里。

[6:36] Dan

This is a great quote that I heard from um a tech leader at uh one of the top 10 US banks. Tens of trillions of dollars in assets uh in custody or administration. Sure, Claude Code can uh make this change, but I have 90,000 repositories to make it in. This is actually a specific quote about a specific supply chain vulnerability, an npm thing. won't get into it, but if you're a bank and you're seeing agents uncover and create these new vulnerabilities at an unprecedented pace and you're being told to go use cloud code to solve this, that's a problem. Good luck doing that in 90,000 repositories, mapping out how these code bases all come to together, what's actually living in production across your company, across your product offerings. Because at the end of the day, right, what's really funny about all this is that, if we know anything about LLMs, is that they just love to search. It's like a new hire getting up to speed on the codebase. It's how agents build models of the world. The repo architecture that you're plugging into your agents.md files, like, let's be real, that's barely moving the needle here. This agent is going to grap gp gp gp gp its way to codebase understanding. That's simply how it works.

这是我从美国前十大银行之一的一位技术负责人那儿听来的一句话，说得特别好。这家银行托管或管理的资产有数十万亿美元。他说：「没错，Claude Code 是能做这个改动，可我有 9 万个仓库要改。」这其实是针对一个具体的供应链漏洞说的一句具体的话，是 npm 上的一件事，这里就不展开了。但如果你是一家银行，眼看着 agent 以前所未有的速度挖出、又制造出这些新漏洞，而别人告诉你去用 Claude Code 解决——那就是个问题了。在 9 万个仓库里干这件事，祝你好运：你得摸清这些代码库到底是怎么拼到一起的，摸清在你整个公司、你所有的产品线里，生产环境中实际跑着的到底是什么。因为说到底，对吧，这整件事真正好笑的地方在于：如果说我们对 LLM 有什么了解的话，那就是它们就是爱搜索。这就像一个新员工在熟悉代码库。agent 就是这样建立起对世界的模型的。你塞进 AGENTS.md 文件里的那些仓库架构说明，说实话，在这儿基本起不了多大作用。这个 agent 就是要 grep、grep、grep、grep，一路 grep 出对代码库的理解。它就是这么工作的。

[7:52] Dan

But understanding is a context problem. You can't gp what you literally cannot see. This is tools and infrastructure that's needed. And the infrastructure to go see and search and really deeply understand a 500 or 5,000 or 50,000 or half a million repo codebase is not being built by the agent builders today. And so that's where what we're solving, what we're working on as a company. This is what source graph is built around, right? Give this a second. If you'll let me sort of take a moment and predict the future of our industry. These massive code bases are not going away. In fact, there will be more code. There will be much much much more code out there in the future. And we believe very deeply that building tools to give agents the ability to actually see and understand and evolve those large code bases is essential for the future. And where this comes from at the end of the day is having a graph that code graph in mind. The foundational graph of your codebase including search and then the actual compiler accurate output. Um, if you go and and do that analysis that is essential to give your agents the ability to go and understand how to make changes effectively. Visibility is infrastructure.

但理解是一个上下文问题。你压根看不见的东西，你是 grep 不到的。这里需要的是工具和基础设施。而能让你去看见、去搜索、去真正深入理解一个 500 个、5000 个、5 万个乃至 50 万个仓库的代码库的那套基础设施，今天做 agent 的那些人并没有在建。所以这就是我们在解决的问题，是我们这家公司在做的事。Sourcegraph 就是围绕这个建起来的，对吧？稍等它一下。请允许我花一点时间，预测一下我们这个行业的未来。这些庞大的代码库不会消失。事实上，代码只会更多，未来外面会有多得多得多的代码。我们非常坚定地相信：打造工具，让 agent 有能力真正看见、理解并演进这些大型代码库，对未来至关重要。而这一切归根结底，来自于心里要有一张图，也就是 code graph（代码图）。它是你代码库最底层的那张图，里面包括搜索，还有你真去做那种分析时得到的、达到编译器级精确的输出。要让你的 agent 有能力搞明白该怎么有效地做改动，这是必不可少的。可见性就是基础设施。

[9:21] Dan

And we've actually built a lot on top of this, right? We're not stopping here. Actually, just today we launched our new um our new agentic batch changes product into beta. This is a frontier agent uh and its job is to let the owner of a massive codebase actually execute code changes across hundreds or thousands of repositories at once starting with a single prompt. This is a product that will iteratively roll out changes across that that codebase. Self-heal respond to CI status PR comments. Use coding agents where it makes sense, where judgment is needed. Use deterministic scripts where it's not. and provide tracking and auditability to be sure that you've covered 100% of the places where that patch is needed, where that change is needed. Because like I keep saying here, at the end of the day, this is an infrastructure problem. When you're putting code out there into the world, you need to make sure that it's actually going to keep your codebase healthy, that it's actually going to make be able to um adapt to the places where your codebase is beginning to fall apart. Here's a great quote from an early access user um uh actually at Merkari, a global um shopping tool out of Japan. Incredible company, massive codebase, hundreds and hundreds of independent microservices running in production.

而且我们其实已经在这上面建了很多东西，对吧？我们不会止步于此。事实上，就在今天，我们把全新的 Agentic Batch Changes 产品推出了 beta 版。这是一个前沿 agent，它的任务是让一个庞大代码库的主人，从一条 prompt 开始，就能真的一次性在几百个、几千个仓库里执行代码改动。这个产品会在整个代码库里迭代式地把改动一步步铺开；能自愈，能响应 CI 状态和 PR 评论；在说得通、需要判断力的地方用 coding agent，不需要的地方就用确定性脚本；并且提供追踪和可审计性，确保凡是需要打这个补丁、需要做这个改动的地方，你 100% 都覆盖到了。因为就像我在这儿反复说的，归根结底这是个基础设施问题。当你把代码放到外面的世界里去，你得确保它真的能让你的代码库保持健康，真的能够，嗯，适应你代码库里那些正在开始散架的地方。这里有一句很棒的话，来自一位抢先体验用户，嗯，他其实就在 Mercari，一个来自日本的全球性购物工具。了不起的公司，代码库非常庞大，生产环境里跑着好几百个独立的微服务。

[10:35] Dan

This user was using um this product to go actually patch a GitHub uh code injection issue where you have to set environment variables correctly. Um he ran this on two repos where he knew this issue existed and then said yeah go explore the rest of our codebase and found 80 other potential vulnerabilities across their codebase in other places. This is like bas this is like config files. This is basically just going and doing that scan patching them all in one go with a sort of deterministic script that can go make sure it's making that change consistently effectively across 100 of the places where that risk exists. That is what confidence is all about in the agent coding era. So yeah, I'll stop here. If you're wondering right now about like how many repos in your codebase, how many forks are there out there, how many um copies of repos are there out there, how many repos have your in your developers brought into your um company and are now being plugged in as a library or an API somewhere in your codebase that's live in production that you're not aware of. That's the sort of thing that we're here to help. Right? If you're wondering what code is deployed right now and how you can go scan it all and see it all and make sure it's all updated, come talk to me.

这位用户当时是在用这个产品，去实打实地修一个 GitHub 的代码注入问题，就是那种必须把环境变量设置正确的问题。嗯，他先在两个他明知存在这个问题的仓库上跑了一遍，然后说：行，去把我们代码库剩下的部分也探一遍——结果在他们代码库的其他地方又找出了 80 个潜在漏洞。这基本上，这就是些配置文件之类的东西。这基本上就是去做一次那样的扫描，再用一种确定性的脚本一口气把它们全部修掉，这个脚本能确保在 100% 存在这个风险的地方，改动都做得一致、有效。在 agent 编程的时代，所谓的信心，说的就是这个。好，我就讲到这儿。如果你此刻正在琢磨：你的代码库里到底有多少个仓库，外面有多少个 fork，有多少份仓库的拷贝，你的开发者往公司里带进来了多少个仓库，如今它们正被当成一个库或一个 API，接在你代码库里某个已经上了生产、而你并不知情的地方——这类事情，正是我们来帮忙解决的。对吧？如果你想知道此刻到底部署着哪些代码，想知道怎么才能把它们全扫一遍、全看一遍、确保全都更新到位，来找我聊。

[11:42] Dan

And uh tonight we're actually hosting a event here in SF called Code Cocktails and Cuttovers. Come on out, join us. Um come find us. Bring your gnarliest codebased stories. This is where we want to uh talk and hear from all of you about what you're trying to deal with and how you're dealing with the title wave of code that's coming for you. Cool. Thank you. I'll stop there. Any questions? Thank you.

还有，嗯，今晚我们其实就在旧金山这边办一场活动，叫 Code, Cocktails and Cutovers。欢迎过来，加入我们。嗯，来找我们，带上你最棘手的代码库故事。我们就是想在那儿跟大家聊聊、听听各位：你们正在努力应付的是什么，又是怎么应付这场朝你扑来的代码海啸的。好，谢谢。我就讲到这儿。有什么问题吗？谢谢。

[12:20]

[music]

（音乐）