This paper presents the experience and lessons learned in adapting the AutoCodeRover program improvement agent to automatically propose patches for issues reported by SonarQube, and names this new agent SonarQube Remediation Agent, specialized for fixing SonarQube issues.
Abstract
Agentic systems have been gaining traction in solving software engineering tasks. These tasks span from writing documentation, fixing faults in the codebase, and developing new features. A promising application of LLM agents is addressing software "issues", with an issue capturing a unit of improvement needed in a software project. Issues can be detected and constructed by static analysis tools, such as SonarQube. Static analysis tools frequently generate a substantial number of reports related to security vulnerabilities and code quality, imposing a significant manual workload on developers. With the advances in agentic AI, there is potential to automatically remediate these issues, thereby reducing developer effort. In this paper, we present our experience and lessons learned in adapting the AutoCodeRover program improvement agent to automatically propose patches for issues reported by SonarQube. We name this new agent SonarQube Remediation Agent, specialized for fixing SonarQube issues. SonarQube Remediation Agent is designed to be capable of interacting with mission-critical codebases in a secure and trustworthy manner. We discuss our approach in tackling practical challenges such as handling large volumes of issues and designing seamless user interactions. SonarQube Remediation Agent is integrated into the software development lifecycle by suggesting patches during the pull request review workflow, enabling developers to efficiently improve software quality and security with SonarQube.
Migration of legacy COBOL programs to Java requires extensive testing to ensure correct functionality. This effort is often complicated by the lack of test data and the difficulty of validating all corner cases. In this paper we propose a novel agentic test-synthesis method, the"Locksmith Loop,"which is initiated by preparing two runtime environments: the COBOL source and the generated Java target are each instrumented with mocks and executed off-mainframe on commodity hardware, then an iterative agentic loop performs Witness Search over input mocks to penetrate program branches, followed by parity-preserving mutations. When routing boundaries are reached, an analyzer identifies a Locked Paragraph: a condition preventing deeper exploration. Across three COBOL-Java case studies, spanning two open-source programs and one internal production-like COBOL program and ranging from 430 to 4,114 source lines, Locksmith consistently improved coverage beyond input-search plateaus, reaching nearly complete coverage on the two open-source programs and 91.90% branch coverage on the internal production-like COBOL program. The generated Java matched the COBOL reference under deterministic parity checks in all accepted test cases. Through these findings we demonstrate, to the best of our knowledge, a novel approach for validating agentic coding output using a deterministic oracle.
Andras Ferenczi, Jordan Docherty, M.D. Bessonov et al.· 0 citations
ADATracer is presented, a software traceability tool designed to recover links between natural language requirements, Ada source files, version-control commits, and issue-tracking artifacts, and an Ada-aware parser that accounts for language features such as package specifications, bodies, and strong typing.
Automated vulnerability repair aims to reduce the time and effort required to patch security flaws from a vulnerability triage report. Recent agentic AI approaches have shown promising results in automated program repair. However, vulnerability repair demands richer program context than general bug repair - context that security engineers routinely assemble in practice but that existing agentic approaches do not engineer. We identify three critical gaps: code-structure context capturing cross-file data flows and memory operation patterns, runtime-execution context revealing crash semantics and memory origins, and commit-history context recovering how fragile code patterns were introduced. We present AgenticRepair, an agentic vulnerability repair framework that addresses the gaps through multi-faceted program context engineering. AgenticRepair orchestrates three specialized LLM subagents to engineer the contexts, which are then embedded into the memory of a dedicated repair subagent for context-conditioned patch synthesis. Evaluated on SEC-Bench comprising 300 real-world instances with sanitizer-based patch verification, AgenticRepair achieves a 73% success rate, substantially outperforming the strongest baseline by 29%. Our ablation study confirms that the three context facets are mutually complementary, and that multi-agent scaffolding and base-model capacity each play an essential role. Collectively, these findings establish multi-faceted program context engineering as a promising design direction for agentic vulnerability repair.
Michael Fu, Qiyue Mei, Patanamon Thongtanunam et al.· 0 citations
The AgentCodeReview system is presented, a multi-agent system that is able to conduct explainable code review and automated bug repair by leveraging software engineering agents with different code review tasks and its utility and extensibility to the field of explainable AI in software quality assurance are demonstrated.
B. N, T. L. Manasa· International journal of com...· 0 citations
Developing a GenAI agent that autonomously formulates, prioritizes, and completes a limited set of code improvement tasks enterprise-wide is reported, and a Difference-in-Differences analysis found that automated improvements had an effect on the reduction of future maintenance effort that was as strong as or stronger than manual improvements confirming the feasibility of autonomous maintenance.
Automated program repair (APR) agents are transitioning from research benchmarks to developer workflows, yet they still begin with bug reports written for human developers. While decades of research have established what makes a good bug report for humans (e.g., steps to reproduce, stack traces), it remains unclear whether these features transfer to LLM-based agents. We study this question in two analyses. First, we use statistical modeling to examine associations between 27 bug-report features and repair success across 433 SWE-bench Verified issues attempted by 87 repair agents. We find that fix suggestions, reproduction scripts, repository source code, and localization info are associated with higher resolution likelihood, while longer reports are associated with lower odds. Second, we conduct controlled ablations across 2 models and 17 problem-statement mutations on SWE-bench Pro, varying the information available to an agent while holding the underlying task fixed. We remove or isolate selected bug-report content, delete fault-localization cues, and test structural changes that flatten lists or remove section headers. We find that both models depend on localization cues and expected behavior, and that structural changes alone can reduce solve rates, even without removing any content. The two models diverge in how they handle missing information: Qwen searches more widely and can exhaust its turn budget, while Gemma commits to a plausible interpretation early and patches on it. Our findings indicate that a good bug report for an agent overlaps with, but is not identical to, a good report for a human: agents benefit most from concrete, executable, and well-localized information, whereas some qualities long emphasized for human readers, such as natural language steps to reproduce and readable descriptions, contribute little or even correlate with lower success.
Lara Khatib, N. Mathews, M. Nagappan et al.· 2 citations· ⚡1