每次会话都像新员工入职：Sonar Vortex 如何为 AI 编程补充上下文与验证

简要说明Brief Description

Sonar 的 Killian 介绍了 Sonar Vortex 如何为编码智能体提供项目上下文和确定性验证，并演示了智能体修复临时文件权限问题的过程。Killian from Sonar explains how Sonar Vortex gives coding agents project context and deterministic verification, and demonstrates an agent fixing a temporary-file permissions issue.

目录Table of Contents

• 简介
  Intro
• 每个代理会话都从头开始
  Every agent session starts from scratch
• Sonar Vortex 的作用
  What Sonar Vortex does
• 测试无法发现的漏洞
  The bug a test wouldn't catch
• 96% 的人不信任 AI 生成的代码，48% 的人会对其进行验证。
  96% don't trust AI code, 48% verify it
• Vortex 如何引导代理运行
  How Vortex guides the agent
• Token 数量减少 36%
  36% fewer tokens
• 将 SonarQube 引入智能体循环中
  Bringing SonarQube into the agent loop
• 演示：一个真实任务
  Demo: a real task
• 不是 AI 检查 AI
  Not AI checking AI
• 那个并不算修复的修复方案
  The fix that wasn't a fix
• 你将获得的内容
  What you get

简介Intro

我是来自 Sonar 的 Killian。如果你不熟悉 Sonar，我们是一个独立的代码验证平台。今天我要谈的是如何将验证融入智能体式编码循环。I am Killian from Sonar. And if you're unfamiliar with Sonar, we are an independent code verification platform. and what I'm going to be talking about today is how to move verification into the agentic coding loop.

每次代理会话都从头开始Every agent session starts from scratch

我的意思是，大家都知道，过去几年里每个人都一直在这么做。这加快了节奏，而每次你在 IDE 中启动一个新的智能体会话，都像是从头开始。就像项目里新来了一名员工，完全不了解现有的项目规范。I mean as we know everybody has been doing this the past couple years. It's accelerated the pace and every time you start a new agentic session in your IDE, it is like starting from scratch. It is like a new hired employee into your project. It does not know your existing project conventions.

它并不了解你的编码规范，也不知道你预先为它制定的任何架构规则。这可能会带来问题，因为这样一来，当它接到一个功能开发任务时，就必须四处查找相关背景信息，对吧？It does not know your coding guidelines. It does not know any architecture rules that you have predefined for it. And that can be a problem. Because what it has to do then is when it's assigned a feature, it has to go look around for context, right?

如果你说：“嘿，开发一个新的 API 端点。”它就得去弄清楚你代码里现有的 API 端点是怎么工作的。而这个过程嘛，说不准——它可能很快就能获取到相关上下文，也可能会在整个代码库里到处搜索。If you say, "Hey, build out a new API endpoint." It has to go and determine how existing API endpoints work in your code. And that process can, you know, it's it's a bit of a roll of the dice. it can acquire that context quickly or it can search around all over your repository.

而这需要时间，也需要 token。而这是一个非常容易解决的问题。如果你的代码库存在问题，对吧？很抱歉告诉你，每个代码库都有问题。And that takes time and that takes tokens. And this is a very fixable problem. And if you have issues in your codebase, right? As I'm sorry to break it to you, every codebase does.

遗憾的是，你使用的任何代理都很可能会重现这些问题，并重复这些模式。而且，问题不是该代理会不会引入新问题，而是什么时候引入；如果这些问题没有被发现，几乎不可能维持代码质量。That is unfortunately, it's highly likely that these issues will be replicated and these patterns repeated by whichever agent you're using. And not if, but when that agent introduces new issues, if it's not caught the ability to maintain the quality of your code is almost impossible to do.

Sonar Vortex 的作用What Sonar Vortex does

因此，我们的解决方案就是 Sonar Vortex。我稍后会给大家演示。它是一个插件，可以连接到你使用的任何编码代理。这样，代理在开始编写代码之前就能了解你的项目，而且还能通过确定性验证来确保不会给你的代码库引入任何新问题。So our solution to that is Sonar Vortex. I'm going to show you that here in a little bit. what it is it is a plug-in that connects to whatever coding agent you use. And this is so the agent knows about your project before it even begins to code. And it is able to verify itself deterministically to make sure that it's introducing no new issues into your code base.

测试无法发现的 bugThe bug a test wouldn't catch

所以，前不久我录下了一个编程代理编写一项小功能的过程，它不到两分钟就完成了。但遗憾的是，尽管我指示它为自己构建一套测试，它还是引入了一个安全问题，而 Sonar Vortex 检测到了这个问题，并迫使代理不断迭代，直到修复为止。稍后我们会看到，问题在于它编写的代码会将一个日志文件解压到临时文件中，但遗憾的是，它没有明确设置该临时文件的权限。这类问题很难编写测试来覆盖，也很难发现，通常只有资深审查人员在特意留意时才可能发现——如果他们能发现的话。就算他们真的发现了，也得把代码退回去，让开发人员或代理重新修改、再次推送、再次审查和分析。这会耗费时间和金钱，也会让所有相关人员都感到非常沮丧。So, I had I recorded a coding agent writing a small feature a little bit ago and it was able to do so in under 2 minutes, but unfortunately, even though I had instructed it to build out a test suite for itself, it introduced a security issue that Sonar Vortex was able to catch and forced the agent to continue iterating upon itself until it was fixed. So, the issue ended up being, and we'll see this here momentarily, is that it wrote it was to unzip a log file into a temp file, but unfortunately, the permissions that it set for that temp file were not explicit. And that type of issue is hard to write tests for, it's hard to catch, and it's usually the type of thing that a senior reviewer would only catch if they're explicitly looking for it, if at all. And then let's say that they do catch it, now it has to be sent back for a developer or an agent to rework again and re-push and re-review and re-analyze and that burns time and money and it causes a lot of frustration for everyone involved.

96%的人不信任 AI 生成的代码，48%的人会对其进行验证96% don't trust AI code, 48% verify it

这个过程中的挫败感并不只是我的看法，这一结论来自我们收集的数据。Sonar 调查了 1,100 多名开发者，发现其中 96% 并不完全信任 AI 生成的代码。但你觉得他们当中有多少人在推送代码前真正全面验证了代码？不到一半。The frustration in that process is not just my opinion, that is from data that we've pulled. Sonar surveyed over 1,100 developers and found that 96% percent of them do not fully trust AI-generated code. But how many how many of those do you think actually fully verified the code before pushing it? It was less than half.

其中有48%是这样的。所以，这对我个人来说简直不可思议。想到我们竟然在没有验证的情况下，就盲目地把代码部署到生产环境，我就感到害怕。但就像我说的，智能体写代码很快。返工会拖慢进度，而如果你到 PR 阶段才发现问题，那你已经落后于进度要求了。It was 48% of those. So, that boggles my mind, personally. That terrifies me that we are just blindly setting off code into production without verifying it. but like I said, the agents write quickly. Rework slows you down, and if you catch it at the PR, you're already behind where you need to be.

Vortex 如何引导智能体How Vortex guides the agent

不过，正如我提到的，Sonar Vortex 的一个快速动画可以大致展示我这里所说的内容。我们正在努力实现的目标之一，是提高你的编码代理的效率，同时为它们提供安全护栏。这里这个小球就是你的编码代理。正如我所说，它能以极快的速度编写大量代码，快到人类跟不上，也快到我们无法手动审查。But, a quick animation to kind of demonstrate what I'm talking about here is as I mentioned, Sonar Vortex. One of the goals that we are doing is we are making your coding agents more efficient. In addition to providing guardrails for them. But, this little ball here is your coding agent, which as I said, it writes a lot of code really fast, faster than humans can keep up with, faster than we are able to review manually.

遗憾的是，正如我所说，它一开始面对的就是你的代码库。网格中的每个方格都是一个文件。它必须四处搜索。每移动一次，它都会检查一个新文件。Unfortunately, as I said, when it starts out, this grid is your code base. Every square is a file. It has to go searching around. Every time it moves, it's checking a new file.

底部那条是 token，代表你仅仅是在浏览时花掉的钱和时间。而一旦它出了错，你要等到拉取请求时才会发现。审核没通过，工作就会退回给代理，再来一轮；它会继续反复迭代，而你还得不停地去找高级工程师，最后他对你很不满，谁都不愉快。And that bar at the bottom is tokens, which is your money and time spent on just looking around. And when it gets something wrong, you get to find out at the pull request. The review fails, and the work goes back to the agent for another round, and it continues to iterate itself, and you got to keep pinging your senior engineer, and then he's mad at you, and then nobody has a good time.

现在，在使用 Sonar Vortex 编写任何内容之前，它都会先获取项目的编码指南，以及代码之间如何关联的地图。它会读取架构指南、应用程序获准使用的库，以及特定项目的编码标准等内容。这些都可以由你自行设定。Before it writes anything with Sonar Vortex now, it is going to get the coding guidelines for your project and a map of how the code connects. So, it will pull in things like your architecture guidelines. It will pull in things like what the approved libraries for your applications are, what your coding standards are for a given project. And these are all things you get to set for yourself.

所以，现在你可以看到，它会直接处理文件，不会浪费多余的 token，也不会占用多余的上下文。在它运行的同时，SonarQube 会检查代码。因此，你的智能体使用自己的工具进行编辑时，每次使用这些工具都会触发一次快速检查。So, now you can see here, it goes straight to files. It does not burn excess tokens, it does not burn excess context. And as it works SonarQube checks its code. So, your agent, the edits that it makes with its own tools, every time it uses them it triggers a quick check.

而且在结束本轮之前，它会被要求针对跨文件数据流进行更深入的检查，以发现更深层的安全问题。你可以看到，这个问题会反馈给智能体，由智能体修复自己的代码，然后 Vortex 会再次检查。And before it ends its turn, it's told to run a deeper check for even deeper security issues for cross-file data flow. And you see here that issue goes back to the agent and the agent fixes its own code and then Vortex checks it again.

而且这一切都适用于人们目前正在使用的所有智能体，无论是 Cloud Code、Codex、Antigravity，还是你想用的任何其他智能体。如果你设计了自定义智能体，或者在使用开源智能体或任何非主流产品，我们也提供高度可配置的 MCP 客户端，供你按需使用。And this all works with all of the agents that people are currently using right now, be that Cloud Code, Codex, Antigravity, whatever you want to use. And if you have any custom agents designed or using any open-source ones or any of the non-major players, we have MCP clients that are very configurable for you to use at your own desire for that.

token 数量减少 36%36% fewer tokens

总的来说，我希望你从中了解到的是，Vortex 可以轻松接入你的智能体。它并不是构建在我们提供的 CLI 和 MCP 工具之上的，而是将 SonarQube 集成到智能体中，让智能体在编写代码之前就了解你的项目。我先暂停一下，或者往回退一下，免得错过。我们发现，它平均可以少消耗 36% 的 token，尤其是在重构现有代码库这类任务中。Essentially what I want you to take away from this is that Vortex is something that you can just plug in easily to your agent. It isn't built on top of the CLI and MCP tools that we provide it and it brings SonarQube into the agent so that the agent knows your project before it writes. I'm going to pause it or I'm going to move back before I miss it. And what we found is that it spends 36% fewer tokens on average, especially on tasks like refactoring existing codebases.

使用它的人，生产环境故障减少了 44%，而且我们的误报率也非常低，所以不会干扰你的编码过程。这非常重要，真的非常重要。它加快编码周期、软件开发周期的速度……我们正处于能够验证编程的全新前沿。People who use it have a 44% reduction in production outages and we have a very low false positive rate as well so that we don't clutter up your coding sessions. So, this is huge. This is huge. This the speed that this accelerates the coding cycle to the software development cycle to is it's we're on the new frontier being able to verify programming.

总而言之，我们希望引导智能体并验证这项更改。So, to sum it all up we want to guide the agent and verify the change.

将 SonarQube 纳入智能体循环Bringing SonarQube into the agent loop

我们将 SonarQube 现有的智能能力融入其中。我相信你们当中至少有一些人熟悉 SonarQube。我们已经发展了近二十年，传统上，我们是许多人会在流水线中运行的一个步骤，用于确定性地分析各种安全问题、可维护性问题和数据流问题；我们会构建图谱，并深入分析代码。现在，我们的服务器已经维护着这些知识，因此能够将相关上下文提供给智能体，让它从一开始就掌握这些信息。你的智能体在编写代码之前就了解你的项目，并会在编写过程中检查自己的代码。We bring SonarQube's existing intelligence into the mix. So, I'm sure at least some of you are familiar with SonarQube. We've been around for almost two decades, and we are traditionally a pipeline step that a lot of people run that deterministically analyzes for any security issues, maintainability issues, any data flow issues, and we build out graphs, and we dive deep into the code. Now, with this knowledge already maintained within our servers, we're able to provide that context to an agent, so now it exists from the get-go. your agent knows your project before it writes, and it checks its own code as it goes.

你的 CI 已经运行了 SonarQube 扫描，之后 Vortex 会复用该扫描获取的信息，因此只需快速检查你的文件，它就能了解代码库中的其他部分。Your CI already has a SonarQube scan, and then Vortex reuses what that scan has learned, so it's just a quick check on your file, and it knows about the rest of your code.

演示：一个真实任务Demo: a real task

这里我会在一个实际任务中向你演示。这段内容是我昨晚录制的。你一开始就能看到，我会时不时暂停再重新播放。首先我想让你看到的是，我们什么都不用做，就能看到 SonarQube 已经在会话中启动了。对吧？Here I'm going to show it to you in a real task. This I actually recorded last night. And what you can see from the get-go, and I'll be pausing and restarting it here and there. the first thing that I want you to see is that without having to do anything, we can see SonarQube has started up in the session. Right?

我们的 CLI 已被检测到，钩子系统也已被检测到，而且密钥检测已开启。今天我不会对此深入展开，但泄露密钥是最容易预防的问题之一，对组织造成的代价却可能最高。我们的插件可以防止密钥泄露到 GitHub 和智能体上下文记忆中。我希望你注意到的是，我不需要把任何 Sonar 指令粘贴到提示词里。Our CLI is detected, and the hook system is detected as well, and secrets detection is on. I'm not going to dive too much into that today, but secrets leakage is one of the easiest things to prevent, and one of the most costly for your organization. Our plugin prevents secrets leaks into GitHub and into agent context memories. And what I want you to notice is I didn't have to paste any Sonar instructions into the prompt.

它完全是自动加载的。因此，我之前提到的那个请求，就是把一个日志文件解压到临时文件中。It's just all automatically loaded. And so, the request that I alluded to earlier, right here, is it's just basically unzipping a log file into a temp file.

它会说：“继续重复使用同一个文件，然后编写一个测试来证明它确实被重复使用了。”在写下任何一行代码之前，它会向 Sonar 问两个问题：这个类在哪里？这个项目的 Java 编码规范是什么？答案就在这里。It says, "Keep reusing that same file, and then write a test that proves it's reused." And before it writes a single line, it's going to ask Sonar two things. It's going to say, where does this class live? And what are the Java coding guidelines for this project? And it's right here.

这是 Sonar 上下文导航，我们会得到这样的模式，也就是我让它处理的这个单独的 GC 日志文件。这样，它就能获取父级和子级架构，以及现有模式和相关指南。此外，Sonar 上下文指南会注明所用语言是 Java。因此，我们有一些基本指南，要求代理在构建 Java 项目时遵循；如果你有希望团队遵循的客户要求，也可以从一开始就注入这些要求。It's Sonar context navigation, and we get this pattern, this single GC log file that I told it to work on. So, it gets parent and child architecture, as well as existing patterns, and guidelines around that. As well, it says Sonar context guidelines get language is Java. So, we have basic guidelines that we enforce agents use when building out Java projects, but if you have any customer requirements that you want your team to follow, that gets injected from the get-go.

还有各位，我再怎么强调也不为过：除了模型选择之外，从一开始就提供给智能体的上下文和引导，是你能操控的、对智能体表现影响最大的杠杆。And guys, I cannot emphasize enough that outside of model choice, the context and steering from the get-go that agents receive is the single greatest lever that you can manipulate for agentic performance.

你在前期做得越多，之后为自己开发时需要返工、引导、纠正和干预的工作就越少。比如，它不会像动画里那样逐个搜索文件，而是直接获取那张地图。这就是 Vortex 的引导阶段。它能够检查现有测试，了解其运行方式，然后很快进入实现阶段。and the more you do on the front end, the less rework and steering and correcting and intervention that you have to do when you're developing for yourself. So, like instead of searching through the files one by one like in the animation, it just gets that map. This is the guide phase that Vortex does. And so, it's able to inspect the existing test, see how that operates, and very quickly move on into implementation.

现在，这只花了几秒钟。显然，具体耗时会因功能而异；但如果不使用 Vortex 来处理这个功能，耗时会更长，因为它得四处 grep，弄清楚到底发生了什么。现在它正在运行实现，我马上指出它实际创建临时文件的位置。它还会加入自己的测试套件。看，这就是测试套件。Now, that just took a few seconds, and obviously this changes from feature to feature, but running against this feature without Vortex takes longer as this has to grep around and figure out what's going on. So, it's running the implementation, and I will very quickly point out where it actually makes that temp file. it adds in its own test suite. So, here's the test suite.

在录像中，我向上滚动。这里这一小块是一个临时文件。我希望大家能看清。对观众来说，它可能很小。不过它就在这里创建了那个临时文件。in the recording, I scroll up. This a little bit right here is a temp file. And I hope you guys can see. It's probably really small for you in the audience. but it creates that temp file right there.

然后，它会自行检查测试结果，接着对它修改过的两个文件运行 Sonar 检查。这里显示正在确认测试结果，并且正在运行 Vortex 分析。每次编辑或添加文件时，都会运行 Vortex 分析。你不需要强制执行这一点。And, it's going to go ahead and check its own test result, and then it will run the sonar check on both of the files that it changed. Right here it says confirming the test result, and it says running Vortex analysis. Every time a file is edited or added, Vortex analysis runs. You do not have to enforce it.

你甚至不必真的去考虑这件事。它会自动启动，你可以相信你的代码会得到验证。如果你已经设置了自动化工作流，采用了复杂的工厂设计，或者正在构建这类系统，那么你就需要添加这一层信任，以确保不会引入任何问题。You do not even really have to think about it. It just automatically kicks in, and you can trust your code gets verified. If you have automated workflows set up, if you run a sophisticated, you know, factory design, or you're building these out, this is a layer of trust you need to add in order to make sure that no issues are being introduced.

不是由 AI 检查 AINot AI checking AI

还有一点：这不又是让 AI 检查 AI，对吧？当然也不是让它检查自己。遗憾的是，我们发现这恰恰是确保问题不会被引入的最不可靠方式之一。智能体在创建和审查自身时，思路并不相同；而其他 AI 智能体在审查现有代码时，也很可能会漏掉问题，甚至产生幻觉。拥有一个确定性层——也就是说，每次对代码运行分析，得到的结果都相同——才能提供可靠、可治理的指导与验证，并确保合规且结果可预测。One point as well: this is not another AI checking AI, right? and it's certainly not it checking itself. That is, unfortunately, we found one of the least reliable ways to ensure that issues are not being introduced. Not only do agents think orthogonally on the creation and review of themselves, other Asian agents are likely to miss and hallucinate when reviewing existing code. When you have a deterministic layer, and by that I mean, every time you run the analysis on the code, you get the same result back, that is how you are able to provide reliable, governable, guidance and verification that is compliant and predictable.

别误会，我很喜欢 AI 审查。我们也有一个 AI 审查工具，今天就不谈它了。它叫 Guitar。Don't get me wrong. I love AI review. We also have a, AI reviewing tool that I'm not going to talk about today. It's called Guitar.

本周早些时候，我举办了一场关于这个主题的研讨会。如果你想了解更多信息，欢迎稍后到我们的展位来。I ran a workshop earlier this week on that. And please come by our booth later if you'd love to hear more information.

不过，Sonar Vortex 是一个确定性层，叠加在你的 AI 编码之上，同时也夹在另一轮 AI 审查之间。But, Sonar Vortex is a deterministic layer that stacks on top of your AI coding, and sandwiched between another AI review as well.

那个并非修复的修复The fix that wasn't a fix

那么，我们正在运行 Vortex 分析，它会发现一些问题。它会反馈六项发现，Claude 会说其中两项位于它刚刚编写的代码行上，另外四项则出现在既有代码中。我们并没有把 Vortex 设计得特别吵闹。我们没有让 Vortex 说：“哦，你发现了一个问题，但还得再修三个。”对于新编写的代码，它会强制进行修正，并将这些问题呈现给你，让你知晓；如果将来你想修复它们，也可以这样做。So, we're running the Vortex analysis and it is going to catch something. It'll catch six findings that come back and Claude will say two of those findings are on lines that it just wrote and four on pre-existing code. Now, we did not engineer Vortex to be super noisy. We did not engineer Vortex to say, "Oh, you found one issue, but you got to fix three more." On new code that is created, it enforces correction and that just surfaces it to you so that you have it for your awareness and if in the future you'd like to fix it, you are able to.

它发现的问题之一是一个安全问题，也就是我一开始提到的那个：Claude 把日志放在默认临时文件夹里，却没有说明谁可以读取它。而在许多服务器上，这个文件夹是共享的。所以，Claude 随即在这里修复了这个问题。One of the findings that it has is a security problem, the one that I mentioned at the start of this, which is that Claude put the log in the default temp folder without saying who can read it. And on a lot of servers, that folder is shared. So, Claude goes ahead and it fixes the issue here.

但遗憾的是，稍后我们会看到，Sonar Vortex 再次运行后得出结论：“嘿，你其实并没有修复这个问题。”它指出：“该问题仍然存在，因为临时文件仍位于共享目录中。”第一次修复依赖了 Java 的默认设置；在 Mac 和 Linux 上，默认权限本来就仅对所有者开放。但我们设定的规则——这是我们定下的高标准——要求必须显式设置这些权限。涉及安全，我们绝不妥协；涉及质量，我们也绝不妥协。最终，Claude 成功实现了这些修复，而且每次运行时，都会启动 Vortex 分析。But, unfortunately, and we'll see this in a second, Sonar Vortex runs again and determines, "Hey, you actually did not fix the issue." Says, "The finding persists because the temp file is still in a shared directory." The first fix leaned on a Java default and on Mac and Linux, the default is already owner only, but the rule that we set in, which is a high bar that we set, is that this is the permissions must be set explicitly. We do not compromise when it comes to security. We do not compromise when it comes to quality. So, finally, Claude is able to implement these fixes and again, every time it runs, Vortex analysis is initiated.

你不希望任何问题进入你的 PR，因为越早发现问题，不仅能缩小问题的影响范围，还能减少修复所需的时间、金钱和精力。You do not want to let any issues into your PR because the quicker you can catch these, not only does the surface area of the issues get reduced, but the time and money and energy for remediation decreases.

你将获得的内容What you get

终端会话就到这里。我不想让大家盯着一个很小的预录终端会话看，但我希望大家从中了解到的是，它首先询问了 Sonar。Sonar 标记问题已修复后，它继续深入并自行修复。最终它会把结果交还回来，并对数据流进行深入分析。Now, that's it for the terminal session. I'm not going to make everyone stare into a tiny pre-recorded terminal session, but essentially, what I want everyone to take away from this is that it asked Sonar first. When Sonar flagged it's fixed, it went further and continued to remediate itself. And it will eventually hand it back at the end, and a deep analysis for data flow will be performed.

你能得到什么？从中能得到什么？你可以减少来回审核的次数，而且我看时间还剩一分钟。我马上就讲完。What do you get? What do you get out of this? You get less back and forth review, and I see I have a minute left. I'll finish up here in a bit.

你会减少来回评审的次数，及时修复问题，获得更安全的代码，减少修复工作所耗费的时间和资金；同时，由于你能够信任自动化的智能体工作流，开发人员也能腾出更多时间。You get less back and forth review, you get it fixed in the moment, you get more secure code, you get less time and money spent on remediation, and you have more time freed up for your developers because of your ability to trust automating agentic workflows.

我们在楼下设有展位。我很想和大家聊聊。我会在后面那间房间后面待着，回答大家的问题。我很期待和大家交流。We have a booth downstairs. I would love to talk to you guys. I'll be hanging out behind the room in the back to answer any questions. I would love to talk with you.

如果你刚开始使用 Sonar，或者已经是 Sonar 的客户，我都很希望听到你的意见和见解。今天我就分享到这里，非常感谢。If you're brand new to Sonar, if you're an existing Sonar customer, you know, I'd still love to hear your input and insights. And that's all I have for you today. Thank you very much.