[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpzJmn7hZz8wh3mqekKVeIZ-3JrjQg52kU4lCtpMkf74":3},{"item":4,"related":51},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":39,"sourceName":40,"sourceUrl":41,"status":42,"seoTitle":43,"seoDescription":44,"canonicalUrl":45,"isFeatured":46,"sno":47,"sortOrder":48,"publishedAt":49,"updatedAt":50,"createdAt":50},"9fba5da0-f476-4388-baca-0ccac55ae74a","article","CPG：把代码变成一张可以查询的关系图","code-property-graph-ai-code-analysis","代码属性图 CPG 把语法、控制流、数据流和调用关系放在同一张图中，帮助 AI Agent 理解大型代码库。","## CPG：把代码变成一张可以查询的关系图\n\n代码属性图，Code Property Graph，简称 CPG，是一种把程序表示成图的数据结构。它不只记录语法树，还可以把控制流、数据流、类型、函数调用和其他分析结果放到同一张图里。对大型项目来说，这相当于把“代码长什么样”和“代码之间怎样发生关系”放进一个可查询的地图。\n\n## 为什么一棵树还不够\n\nAST 很适合表达嵌套结构：一个函数包含哪些语句，一个调用包含哪些参数。但安全问题和大型重构往往跨越多个维度。我们可能需要同时知道：某个 HTTP 参数来自哪里，经过哪些函数，在哪个条件分支中被处理，最后传给哪个文件操作。\n\nCPG 用节点表示方法、变量、调用和控制结构，用带标签的边表示包含、调用、流向和其他关系。分析工具可以在图上做查询，例如寻找“外部输入经过若干函数后到达危险调用”的模式。\n\n## 它和 AI 编程有什么关系\n\nAI Agent 需要在大仓库中选择上下文。全文搜索很快，但容易把同名符号、无关示例和旧实现混在一起；CPG 这类结构化表示可以帮助工具沿着调用关系、类型关系或数据流关系扩展上下文。模型看到的不是一堆文件，而是一组与当前问题相连的代码片段。\n\nCPG 也可以用于审查 AI 生成的代码。模型说“我没有改变安全边界”时，图查询可以比较改动前后的输入到危险点路径。模型说“这个函数没有调用者”时，工具可以用图中的调用关系核对。\n\n## 代价和边界\n\n建立图需要解析代码、处理语言差异，并维护索引。动态语言、反射和运行时生成代码会让图不完整。图查询也只能根据已经建模的关系工作，不能代替人工理解业务目的。\n\n## 普通人如何理解\n\n可以把 CPG 想成“代码的交通地图”：AST 是街道形状，控制流是行车路线，数据流是货物运输，类型和调用关系是道路标签。AI 可以看地图更快找到路，但地图不等于城市里的真实生活。\n\nCPG 的结构定义和查询思路可参考 [Code Property Graph Specification](https:\u002F\u002Fcpg.joern.io\u002F)。","\u002Fuploads\u002F2026-09-14\u002F09363783-5faa-4365-9bde-fb995d9bbf80.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31,35],{"id":24,"name":25,"slug":26},"0848beb4-db26-4fb8-b391-f852a11be192","AI编程","ai-coding",{"id":28,"name":29,"slug":30},"144abe77-0dc6-4f66-a176-20bddb1c0bfa","编程","coding",{"id":32,"name":33,"slug":34},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":36,"name":37,"slug":38},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse","官方资料","Code Property Graph","https:\u002F\u002Fcpg.joern.io\u002F","published","CPG 代码属性图是什么？AI 如何理解代码关系","从 AST、控制流和数据流出发，理解代码属性图为什么适合大型项目分析和 AI 编程。",null,false,44,0,"2026-09-14T00:00:00.000Z","2026-09-14T15:01:36.014Z",[52,61,69],{"id":53,"type":6,"title":54,"slug":55,"summary":56,"coverUrl":57,"authorName":14,"sno":58,"publishedAt":59,"createdAt":60},"7cc644a5-e0de-4d7b-802e-9e8b69677e12","AI 生成的代码会不会复制开源项目","ai-code-open-source-reference-license","AI 生成代码不等于天然没有来源。本文区分常见写法与高相似片段，解释代码引用、许可证、依赖供应链和轻量来源检查，帮助团队把合规当成代码质量的一部分。","\u002Fuploads\u002F2026-09-13\u002F920327ad-de7f-4caa-a2f4-816d467c9f9c.jpg",40,"2026-09-13T00:00:00.000Z","2026-09-13T11:55:49.911Z",{"id":62,"type":6,"title":63,"slug":64,"summary":65,"coverUrl":66,"authorName":14,"sno":67,"publishedAt":59,"createdAt":68},"1ff2b0c1-c125-4469-a09c-b8ddbc5bf705","AI 写 SQL 和数据库迁移，为什么必须人工确认","ai-generated-sql-database-migrations","数据库迁移会改变持久数据、锁和应用契约，语法正确不代表上线安全。本文解释 AI 生成 SQL 的风险，介绍扩展、迁移、收缩的兼容策略，以及生产执行前应检查的门槛。","\u002Fuploads\u002F2026-09-13\u002F6e5177d7-f51a-4722-951b-0108e9b7ecae.jpg",41,"2026-09-13T11:55:59.196Z",{"id":70,"type":6,"title":71,"slug":72,"summary":73,"coverUrl":74,"authorName":14,"sno":75,"publishedAt":49,"createdAt":76},"2d59f625-ead9-4cfd-b944-3d56bd9ea19a","AST：AI 为什么不只是在“读代码文本”？","ast-ai-code-understanding","AST 把源代码从一串文本变成一棵结构树，帮助编辑器、静态分析器和 AI 编程工具理解函数、变量、调用与分支之间的关系。","\u002Fuploads\u002F2026-09-14\u002F529ce69d-c781-4f61-9864-0294ae857718.jpg",42,"2026-09-14T15:01:25.949Z"]