AI Engineer Summit 2023
Move Fast Break Nothing
Read the talk
Move Fast, Break Nothing: Giving Generated Code a Critic
Dedy Kredo’s AutoScraper demonstration follows a separate code critic from behavior mapping and test generation through automated repair, a failed regression check, and PR review.
From a talk by Dedy Kredo
Before you start: Basic familiarity with Python, automated tests, and Git pull requests will help you follow the demonstration.
A critic for generated code
What checks whether generated code actually does what its developer intended? Dedy Kredo opens with generative adversarial networks, or GANs: two networks working together, one generating and the other criticizing its output. In his telling, transformers shifted attention toward generation and became the preferred architecture for many tasks. Code, however, needs more than a plausible next output. It needs scrutiny of the behaviors that output creates.
The proposed architecture is GAN-like at the system level, not an adversarially trained neural network. One component generates code; a separate code integrity component reviews it, analyzes its behavior, and searches for edge cases. The target is not simply code that looks correct, but code that works according to the developer’s intent.
CodiumAI focuses on that critic. Kredo argues that behavior coverage is more useful than code coverage: the organizing question is which behaviors have been identified and tested, rather than only which code has executed. The product connects behavior discovery to test generation, code enhancement, and review. At the time of the demonstration, those capabilities appeared in JetBrains and VS Code extensions and a Git plugin; APIs for embedding them in agents were described as forthcoming.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Starting with an untested scraping class
The live demonstration begins in VS Code with the CodiumAI extension installed. Kredo reports around 200,000 installs across JetBrains and VS Code. The project is AutoScraper, a Python scraper that generates extraction rules from examples of desired information. Kredo describes the demo project as having more than 5,000 GitHub stars but no tests. That absence is the practical obstacle: changing the scraper leaves the developer without a suite to catch unintended behavior. This describes his demo checkout; the current repository contains tests.
Kredo invokes CodiumAI on what he describes as a 600-line class. The extension can also operate on an individual method, but starting at class scope lets it analyze the larger unit first. It maps behaviors and then streams generated tests into the interface. Alongside the tests, it produces an explanation of the class, including example usage, components, and methods. The initial suite spans happy paths and edge cases.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Choose behaviors, then run and repair tests
The behavior map is hierarchical. Happy paths and edge cases can be expanded into sub-behaviors, and the developer can choose which deserve additional tests. This makes the map a place to exercise judgment: generation proposes a set of behaviors, while the developer decides where to investigate more deeply.
For a scraper, a small behavior-focused test can hold the page content fixed and state the expected extraction directly. For example, this Python test uses a local HTML string to express the happy path of learning a rule from a desired value:
python
from autoscraper import AutoScraper
def test_build_finds_requested_product_name():
html = "<html><body><h2>Travel Mug</h2></body></html>"
scraper = AutoScraper()
results = scraper.build(
html=html,
wanted_list=["Travel Mug"],
)
assert "Travel Mug" in results
The useful unit of coverage here is the behavior expressed by the assertion. Kredo’s next action is to select additional edge cases in the map and request tests for them. During that expansion, he reports nine tests in the interface.
Next comes Run & Autofix. The demonstrated sequence is:
- Execute the generated tests; some pass immediately.
- Inspect a failing test’s execution result.
- Have the model analyze the failure and generate a repair.
- Run the repaired test again.
The demonstrated failing test passes on its second attempt. Kredo describes this as a reflection process, using the language of chain of thought. The observable mechanism is the execution feedback loop: a failure supplies information for a revision, which is then checked by another run.
Kredo then opens eight tests as a file and saves them into the project. The recording does not explain the change from nine tests during generation to eight at this point. Saving the suite turns the generated output into a project artifact that can be rerun when the implementation changes.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
An enhancement still has to survive the tests
With a saved suite, Kredo moves to code enhancement. He selects AutoScraper’s build method because it contains much of the class’s central functionality, then opens CodiumAI’s code suggestions. These suggestions aim beyond linting: performance, security, best practices, and readability are all in scope.
He chooses a proposed performance improvement that replaces hashing through Python’s hashlib with BLAKE3. The distinction matters: hashlib is a module exposing multiple hash algorithms, whereas BLAKE3 is an algorithm. The original algorithm is not identified in the narration. Kredo prepares the suggested changes, applies them, saves the code, and returns to the test suite.
The rerun does not produce a clean result. One test fails after the change, and Kredo explicitly sets it aside to continue the demonstration. The cause is not established, so the failure cannot be attributed specifically to BLAKE3. Nor is a speedup measured. At this point, the workflow has produced an applied enhancement and an unresolved regression signal—not a validated refactor. Generating a change and validating it remain separate steps.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
From a local change to PR review
The next stage is preparing the change for review. In the CodiumAI PR Assistant, Kredo invokes /commit to generate a commit message and then commits the changes. Only after committing does he invoke /review. The assistant is expected to summarize the PR, assign a score, and look for issues the developer may have missed. Its initial assessment identifies tests as the main theme and describes the change as well structured. These are the historical IDE assistant commands shown in the recording.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
The review finds an API key
The review then flags a potential security vulnerability. Kredo invokes /improve to request a fix and recognizes the issue: an API key has been left in the code. This extends the critic’s scope beyond functional test results. A change can have useful tests and still contain something that should not be committed.
The response is delayed, so Kredo retries; an interjection points to the room’s poor network connection. Once the result arrives, clicking the finding navigates to the key’s location. Kredo identifies a displayed fix, but the demonstration does not establish its implementation or show it being applied and validated. The security result is therefore a located issue and a proposed repair, not a completed remediation.
The demo ends with a connected workflow: map behaviors, generate and execute tests, assess changes, and review the resulting contribution. Kredo also points to the Git plugin as a way to bring this work into GitHub. The critic is intended to operate throughout development, including the transition from an individual developer’s editor to a shared review process.
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
A personal closing
Kredo closes by turning from the software to the people building it. CodiumAI is based in Israel, and he says Hamas attacked while the team was on the plane to the event. He condemns the attackers in dehumanizing terms and describes civilians being killed in their homes and abducted into Gaza.
He then introduces a photograph sent by his co-founder and CEO, Itamar. According to Kredo, Itamar had left his eight-month-pregnant wife at home to enter military reserve duty. The photograph shows a laptop and a rifle behind it; Kredo identifies the chart on the screen as increasing CodiumAI usage. The juxtaposition closes the talk on the circumstances in which his colleagues were continuing their work. His final declaration is: “We will prevail.”
Suggest correction
This note stays in this page until you copy or download it. Nothing is submitted; reloading clears the draft.
Resources
From the talk
Python scraper that learns extraction rules from examples, with installation instructions and build, reuse, and persistence examples.
Official BLAKE3 implementations, usage examples, test vectors, and benchmark context.
Further reading
The original paper introducing adversarial training between a generator and a discriminator.
Updates since the talk
Community-maintained open-source PR review agent with CLI and GitHub Actions setup, distinct from Qodo's primary offering.
Read the complete timestamped transcript
- 0:00
[upbeat music] Hey, good morning, everyone.
- 0:18
Let's take a step... Let's start by taking a step back. Uh, remember GANs, generative adversarial networks. They represented a very compelling architecture, in my opinion. Two neural networks working hand-in-hand, one generating and one is the critic, in order to generate high-quality outcomes.
- 0:41
Then came transformers that changed everything. We dropped the adversarial and the focus became solely on the generative,
- 0:51
and they became the state-of-the-art for a variety of use cases.
- 0:57
But code is very, very nuanced. We believe that in order to generate code that actually works as intended, the right architecture is actually GAN-like architecture.
- 1:11
And what I mean by is that... by that is not the actual neural network, it's the system. It's the concept of having two different components, one focused on the code generation piece and one that serves as the critic.
- 1:26
We call it the code integrity component. It actually analyzes the, the outcomes, the generation of the code gen, uh, component, and it reviews it, it analyzes it. It tries to figure out all the different edge cases in order to generate high-quality code that works as intended based on the developer's actual intent.
- 1:50
This is our focus at CodiumAI, on the critic piece. We help developers understand the behaviors of their code.
- 2:00
We believe that behavior coverage is a more useful metric than actual code coverage. We help them generate tests for these behaviors, enhance their code, and review their code,
- 2:13
and we do that throughout the developer life cycle, leveraging our IDE extensions for both JetBrains and VS Code
- 2:21
and our Git plugin. And then soon in the future, in the near future, we will also offer APIs for this to be able to be embedded in various agents.
- 2:36
So we're gonna focus the majority of the time in a live demo,
- 2:41
which is a risky thing to do in this, uh, situation here, but, uh, let's go for it.
- 3:00
Okay, I'm here in my VS Code. I have the CodiumAI extension installed. Uh, we now have, uh, around two hundred thousand, uh, installs across both JetBrains and VS Code.
- 3:10
I have here an open source project that's called AutoScraper. Um, it's basically a scraping class that automates the process of generating the rules for scraping information from websites. It's a very cool project.
- 3:25
It has more than five thousand, uh, GitHub stars. But the problem is that it doesn't have any tests, so it's very hard to make changes to a project where it doesn't have any, any tests because there's nothing that protects you from making changes.
- 3:42
So I'm gonna go ahead here and trigger CodiumAI on this class. This is a six hundred-line class, complex code, and you can see that I can trigger CodiumAI either on the class level or at the method level.
- 3:56
So I'm starting on the class. I'm actually gonna re-trigger it.
- 4:00
Um, the first thing that happens is that Codium analyzes the class.
- 4:06
It basically maps out different behaviors, and it starts generating tests. You can see it starts, uh, streaming the test. I already have one, one, two. I'm getting more tests.
- 4:16
You can see some of them are quite complex.
- 4:20
It also generate the code explanation, detailed code explanation that shows me how this class actually works, the example usage, the different components, the methods. Uh, very detailed.
- 4:33
And then I have all the... all my tests.
- 4:40
As you can see, we look at different, uh, examples, both happy path, edge cases, variety of cases.
- 4:56
Okay, so here I have the different behaviors
- 4:59
that were generated. Now, this is crucial. We're basically mapping the different behaviors of this class, doing both happy path, edge cases, and for each one of them, we can drill deeper down and see the sub-behaviors below them.
- 5:13
And we can generate tests for any one that is important for us. So let's pick a few and add additional tests.
- 5:19
Let's pick some, uh, uh, edge cases as well. Let's generate test here. Maybe here we'll generate another one for an edge case.
- 5:30
And you can see it's very simple. A few clicks and I'm having a... and I have a test suite that is built out. I already have nine tests here.
- 5:38
The next step will be to run these tests, so let's go ahead and do that.
- 5:47
So I'm hitting Run & Autofix. You can see some of these very complex tests are actually passing.
- 5:54
And here I have a test that actually failed. What happens in a failure is that the model actually analyzes, reflects on the failure, and then it tries to generate a fix in an automated manner.
- 6:07
So we have a fix, uh, generated. And now it's gonna be run.
- 6:15
And it passed on the second try. So this is a, this, this chain of thought, this reflection process in order to get to a high-quality test suite.
- 6:26
Okay. So I'm gonna start with these eight tests. Let's open them as a file.
- 6:34
I'm gonna save them in my project. And done.
- 6:51
I have a test suite that now protects me.
- 6:54
So now I'm gonna go ahead and take the next step. Let's use CodiumAI to actually enhance this code
- 7:02
now that I have a test suite that protects me. So I'm gonna choose a method here, the build method, that has a lot of the main functionality of the class.
- 7:13
I'm gonna trigger CodiumAI on that. And now let's focus on the code suggestions component of CodiumAI.
- 7:24
So Codium analyzes this code, and it basically recommends different improvements, enhancements. And these are deep enhancements. We're not talking about linting or, or things like that. We're talking about things related to performance, security, best practices, readability.
- 7:45
So I'm gonna look at these. Let's, uh, choose one that, uh, makes sense. Maybe the first one that looks quite important for performance. Basically, it recommends to replace, um, the hash leave with, uh, BLAKE3.
- 8:01
I'm gonna prepare the code changes and apply it to my code.
- 8:09
And now I can save this. But remember, now I have a test suite. So now actually, I can actually go to my test suite
- 8:19
and run it. And of course, it broke on me for some reason, as things happen in a demo. But,
- 8:31
uh, let's see this again. Okay. I have one test that failed.
- 8:42
I'm gonna ignore that for now. [laughs] Okay. So let's continue.
- 8:54
I created my test suite. I, I enhanced my code. The next step would be to prepare for my PR. So I'm gonna go ahead here and commit these changes.
- 9:09
And I'm gonna go to the CodiumAI PR Assistant, and I'm gonna do a /commit to get a commit message.
- 9:19
And now I have a commit message, so I can commit.
- 9:27
And now that I committed my changes, I can then go ahead to the last step
- 9:32
and prepare for the PR. So I'm gonna do a /review.
- 9:37
Um, and that's basically a review process that CodiumAI would do, and it will try to see if there's any issues, anything I may have missed. It will summarize the PR.
- 9:47
It will give it a score. And then we can see, um, if there's anything that I maybe I have missed here. Let's take a look.
- 9:55
So this is the main theme of the PR. We can see that it's tests. You can see that it's, it's basically telling me that it's pretty well-structured.
- 10:06
Let's let it continue. But it says that it does introduce a, a potential security vulnerability. So I'm gonna do /improve to try to fix that.
- 10:20
And it looks like I forgot an API key in my code.
- 10:27
So CodiumAI will then, uh, suggest a fix for this, and I can actually see the API in my code.
- 10:39
Let's give it a second. Looks like... I'm gonna do it again.
- 10:54
And this is where I actually have the API in my code.
- 10:59
The network is bad in this room.
- 11:01
Yeah. No, here we go. So basically, it's saying, uh, here's the API key. I'm gonna click on this, and it will launch me to where I actually forgot the API key.
- 11:11
Forgot the API key. Um, and this is the actual fix.
- 11:16
So, uh, with that, uh, I'm gonna conclude the demo so we can go back to the slides.
- 11:23
So we're able to see how we were able to, uh, use CodiumAI to map our behaviors, to generate tests, to review our code, and to do it throughout the entire life cycle.
- 11:32
We also have, as I mentioned, a Git plugin that enables us to do that inside of GitHub as well. I'm going to end, um, with a personal note.
- 11:45
So we're a company that is based in Israel. While we were on the plane on the way here, the Hamas terrorist organization launched a vicious attack on Israel.
- 11:57
The Hamas terrorists are not humans. They, they are animals.
- 12:04
Maybe not even animals. They entered into towns. They slaughtered men, women, and children. Innocent people in their home. And abducted many
- 12:20
into the Gaza Strip. This is a picture that my co-founder and CEO, Itamar, sent me.
- 12:29
He left his eight-month-pregnant wife at home and is now in military reserve duty. In the screen,
- 12:37
you can see a chart that shows the CodiumAI usage constantly increasing.
- 12:43
Behind it is his rifle. We will prevail.
- 12:49
Thank you. [audience applauding] [upbeat music]