Platform-orchestrated agentic workflows have become a popular paradigm for developing LLM-based applications. However, their reliability remains a major challenge due to the uncertainty of LLM outputs, complex inter-node dependencies, and heterogeneous tool interactions. Existing agentic workflow optimization and agent enhancement methods primarily rely on trajectory-level feedback. Without explicitly identifying the underlying failure root causes, their resulting repair plans are often insufficiently targeted. We propose FlowFixer, a diagnosis-driven automated repair framework for agentic workflows. FlowFixer first transforms workflow executions into unified symbolic traces and performs symbolic inference to derive executable behavioral specifications that capture node correctness, temporal dependencies, and causal relationships. Based on specification verification, it conducts failure attribution and root cause analysis, and then generates targeted repair patches. To reduce verification costs, FlowFixer further employs a multi-dimensional pre-execution assessment to filter infeasible repairs before dynamic verification. We evaluate FlowFixer on workflow failures collected from three popular development platforms: Dify, Coze and n8n. Results show that FlowFixer achieves a repair success rate of 71.3

Tool-calling has changed Large Language Model (LLM) applications by integrating external tools, significantly enhancing their functionality across diverse tasks. However, this integration also introduces new security vulnerabilities, particularly in the tool scheduling mechanisms of LLM, which have not been extensively studied. To fill this gap, we present ToolCommander, a novel framework designed to exploit vulnerabilities in LLM tool-calling systems through adversarial tool injection. Our framework employs a well-designed two-stage attack strategy. Firstly, it injects malicious tools to collect user queries, then dynamically updates the injected tools based on the stolen information to enhance subsequent attacks. These stages enable ToolCommander to execute privacy theft, launch denial-of-service attacks, and even manipulate business competition by triggering unscheduled tool-calling. Notably, the ASR reaches 91.67% for privacy theft and hits 100% for denial-of-service and unscheduled tool calling in certain cases. Our work demonstrates that these vulnerabilities can lead to severe consequences beyond simple misuse of tool-calling systems, underscoring the urgent need for robust defensive strategies to secure LLM Tool-calling systems.

The competitive game between agents exists in many critical applications, such as military unmanned aerial vehicles. It is urgent to test these agents to reduce the significant losses caused by their failures. Existing studies mainly are to construct a testing agent that competes with the target agent to induce its failures. These approaches usually focus on a single task, requiring much more time for multi-task testing. However, if the previously tested tasks (source tasks) and the task to be tested (target task) share similar agents or task objectives, the transferable knowledge in source tasks can potentially increase the effectiveness of testing in the target task. We propose Demo2Test for conducting transfer testing of agents in the competitive environment, i.e., leveraging the demonstrations of failure scenarios from the source task to boost the testing effectiveness in the target task. It trains a testing agent with demonstrations and incorporates the action perturbation at key states to balance the number of revealed failures and their diversity. We conduct experiments in the simulated robotics competitive environments of MuJoCo. The results indicate that Demo2Test outperforms the best-performing baseline with improvements ranging from 22.38% to 87.98%, and 12.69% to 60.98%, in terms of the number and diversity of discovered failure scenarios, respectively.

Based on the current characteristics of aerospace equipment software development, this paper studies the quality improvement technology of aerospace equipment software based on the “quality chain”. Starting from two different dimensions of project management and software development, based on process and product quality data, and oriented towards the entire software lifecycle, a quality chain is constructed to carry out quality assessment of aerospace equipment software based on the quality chain. Weak links are identified and improvement suggestions are given to drive quality control and verification, thereby improving the quality of aerospace equipment software.

Mobile applications have become a ubiquitous part of our daily life, providing users with access to various services and utilities. Text input, as an important interaction channel between users and applications, plays an important role in core functionality such as search queries, authentication, messaging, etc. However, certain special text (e.g., -18 for Font Size) can cause the app to crash, and generating diversified unusual inputs for fully testing the app is highly demanded. Nevertheless, this is also challenging due to the combination of explosion dilemma, high context sensitivity, and complex constraint relations. This paper proposes InputBlaster which leverages the LLM to automatically generate unusual text inputs for mobile app crash detection. It formulates the unusual inputs generation problem as a task of producing a set of test generators, each of which can yield a batch of unusual text inputs under the same mutation rule. In detail, InputBlaster leverages LLM to produce the test generators together with the mutation rules serving as the reasoning chain, and utilizes the in-context learning schema to demonstrate the LLM with examples for boosting the performance. InputBlaster is evaluated on 36 text input widgets with cash bugs involving 31 popular Android apps, and results show that it achieves 78% bug detection rate, with 136% higher than the best baseline. Besides, we integrate it with the automated GUI testing tool and detect 37 unseen crashes in real-world apps from Google Play.

Crowdsourced software testing (short for crowdtesting) is a special type of crowdsourcing. It requires that crowdworkers master appropriate skill-sets and commit significant effort for completing a task. Abundant uncertainty may arise during a crowdtesting process due to imperfect information between the task requester and crowdworkers. For example, a worker frequently chooses tasks in an ad hoc manner in crowdtesting context, and an inappropriate task selection may lead to the worker's failing to detect any bugs, and significant testing effort unpaid and wasted. Recent studies have explored methods for supporting task requesters to make informed decisions on task pricing, worker recommendation, and so on. Unfortunately, very few study offers decision making support from the crowdworkers’ perspectives. We motivate this study through a pilot study, revealing the large portion (74 percent) of unpaid crowdworkers’ effort due to the inappropriate task choice. Drawn from our previous work on context-aware crowdworker recommendations, we advocate a more effective alternative to manual task selection would be to provide contextualized and personalized task recommendation considering the diverse distribution of worker preference and expertise, with objectives to increase their winning chances and to potentially reduce the frequency of unpaid crowd work. This paper proposes a context-aware personalized task recommendation approach PTRec, consisting of a testing context model and a learning-based task recommendation model to aid dynamic worker decision in selecting crowdtesting tasks. The testing context model is constructed in two perspectives, i.e., process context and resource context, to capture the in-process progress-oriented information and crowdworkers’ characteristics respectively. Built on top of this context model, the learning-based task recommendation model extracts 60 features automatically, and employs random forest learner to generate dynamic and personalized task recommendation which matches workers’ expertise and interest. The evaluation is conducted on 636 crowdtesting tasks involving 2,404 crowdworkers from one of the largest crowdtesting platforms, and results show our approach can achieve an average precision of 82 percent, average recall of 84 percent, and save an estimated average of 81 percent effort originally spent on exploring, significantly outperforming four commonly-used and state-of-the-art baselines. This indicates its potential in recommending proper tasks to workers so as to improve bug detection efficiency and increase their monetary earnings.

As the bridge between users and software, Graphical User Interface (GUI) is critical to the app accessibility. Scaling up the font or display size of GUI can help improve the visual impact, readability, and usability of an app, and is frequently used by the elderly and people with vision impairment. Yet this can easily lead to scaling issues such as text truncation, component overlap, which negatively influence the acquirement of the right information and the fluent usage of the app. Previous techniques for UI display issue detection and cross-platform inconsistency detection cannot work well for these scaling issues. In this paper, we propose an automated method, dVermin, for scaling issue detection, through detecting the inconsistency of a view under the default and a larger display scale. The evaluation result shows that dVermin achieves 97% precision and 97% recall in issue page detection, and 84% precision and 91% recall for issue view detection, outperforming two state-of-the-art baselines by a large margin. We also evaluate dVermin with popular Android apps on F-droid, and successfully uncover 21 previouslyundetected scaling issues with 20 of them being confirmed/fixed.

Background: When submitting patches for code review, a patch is expected as the patch that is accepted in the fewest reworks (rounds of revisions) possibly. However, in practice, not all submitted patches can be accepted and integrated into the codebase the first time, since their quality is unsatisfactory or even poor, which might not pass patch review or need multiple revisions. Aims: In order to improve the effectiveness and efficiency of modern code review, this paper aims to identify the factors that impact the the patch acceptance and the rounds of revisions. Method: We first extract 29 factors from four categories: author, patch, static code quality and review. Then, we apply statistical approach to examine which of and how these factors impact the patch acceptance and the rounds of revisions, respectively. Results: Through case studies of 16,950 patches of 18 projects from Android and Eclipse systems, the result shows that: 1) the number of accepted/reviewed patches by an author has a statistically significant effect on the patch acceptance; 2) the kinds of languages and the number of invited reviewers have a statistically significant effect on the rounds of the revisions; 3) static code quality of patches has little impact on both patch acceptance and the rounds of revisions, although complexity has impact on the number of invited reviewers. Besides, there are other factors that have impact on the patch acceptance and rounds of revisions for different systems. Conclusions: Based on the analysis result, this study offers some suggestions for researchers and practitioners to improve the quality of submitted patches and the process of code review.

在软件开发全生命周期中,需求跟踪在管理需求及其相关制品方面扮演着重要的角色.由于手工跟踪费时且易出错,一些基于信息检索(information retrieval,IR)和基于机器学习(machine learning,ML)的解决方案被提出.其中,不需要大量标签数据的无监督的机器学习方法越来越受到关注.在已提出的解决方案中,大多数都是针对词法和语义信息进行建模,而忽略了文本制品间的词共现分布和词序信息.因此,提出利用基于图挖掘扩展学习的增强需求跟踪链接恢复方法GeT2Trace.其核心思想是利用图网络中的词共现信息和词序信息来增强制品中隐含的语义信息,进而更全面、更准确地对制品中所包含的语义进行表示.在5个公共数据集上进行了评估,结果表明提出的方法优于已有基线.使用图形信息扩展需求为无监督的需求跟踪解决方案提供了新的见解,改进的跟踪链接性能验证了GeT2Trace的有用性和有效性.

Traceability links between requirements and source code are beneficial to the maintenance and evolution activities. Compared with the proposed unsupervised solutions, supervised solutions are more effective to generate trace links automatically and gaining more attention. However, supervised solutions often need to spend a lot of effort on labeling data. To overcome this limitation, we propose a self-enhanced automatic traceability link recovery approach based on structure knowledge mining for small-scale labeled data, named K2Trace, which not only enhances the semantic representations of artifacts by mining context information but also self-enhances the size of training set by exploring transitive relationships. Evaluation results show that K2Trace can outperform the state-of-the-art baseline approach. K2Trace proves the usefulness of mining knowledge from the structure information of software artifacts, as well as provides a new way to substantially reduce the amount of training data needed for training efficient classification models, which may pave the way for generating accurate trace links.

Background. Where to start contributing to a project is a critical challenge for newcomers of open source projects. To support newcomers, GitHub utilizes the Good First Issue (GFI) label, with which project members can manually tag issues in an open source project that are suitable for the newcomers. However, manually labeling GFIs is time- and effort-consuming given the large number of candidate issues. In addition, project members need to have a close understanding of the project to label GFIs accurately. Aims. This paper aims at providing a thorough understanding of the characteristics of GFIs and an automatic approach in GFIs prediction, to reduce the burden of project members and help newcomers easily onboard. Method. We first define 79 features to characterize the GFIs and further analyze the correlation between each feature and GFIs. We then build machine learning models to predict GFIs with the proposed features. Results. Experiments are conducted with 74,780 issues from 10 open source projects from GitHub. Results show that features related to the semantics, readability, and text richness of issues can be used to effectively characterize GFIs. Our prediction model achieves a median AUC of 0.88. Results from our user study further prove its potential practical value. Conclusions. This paper provides new insights and practical guidelines to facilitate the understanding of GFIs and the automation of GFIs labeling.

Identifying and optimizing open participation is essential to the success of open software development. Existing studies highlighted the importance of worker recommendation for crowdtesting tasks in order to detect more bugs with fewer workers. However, these studies mainly focus on one-time recommendations with respect to the initial context at the beginning of a new task. This paper argues the need for in-process crowdtesting worker recommendation. We motivate this study through a pilot study, revealing the prevalence of long-sized non-yielding windows, i.e., no new bugs are revealed in consecutive test reports during the process of a crowdtesting task. This indicates the potential opportunity for accelerating crowdtesting by recommending appropriate workers in a dynamic manner, so that the non-yielding windows could be shortened. To that end, this paper proposes a context-aware in-process crowdworker recommendation approach, iRec, to detect more bugs earlier and potentially shorten the non-yielding windows. It consists of three main components: 1) the modeling of dynamic testing context, 2) the learning-based ranking component, and 3) the diversity-based re-ranking component. The evaluation is conducted on 636 crowdtesting tasks from one of the largest crowdtesting platforms, and results show the potential of iRec in improving the cost-effectiveness of crowdtesting by saving the cost and shortening the testing process.

Requirements traceability provides important support throughout all software life cycle; however, creating such links manually is time-consuming and error-prone. Supervised automated solutions use machine learning or deep learning techniques to generate trace links, but require large labeled dataset to train an effective model. Unsupervised solutions as word embedding approaches can generate links by capturing the semantic meaning of artifacts and are gaining more attention. Despite that, our observation revealed that, besides the semantic information, the sequential information of terms in the artifacts would provide additional assistance for building the accurate links. This paper proposes an unsupervised requirements traceability approach (named S2Trace) which learns the Sequential Semantics of software artifacts to generate the trace links. Its core idea is to mine the sequential patterns and use them to learn the document embedding representation. Evaluation is conducted on five public datasets, and results show that our approach outperforms three typical baselines. The modeling of sequential information in this paper provides new insights into the unsupervised traceability solutions, and the improvement in the traceability accuracy further proves the usefulness of the sequential information.

Defect is an important quality attribute of software. Defect is injected in development process and depended on the maturity level of the processes. How many defects were detected is enough? In any software organization, effort estimation and defect prediction are big challenges. Predicting the number of defects in the early stage of software development life cycle will be more helpful for the organizations to estimate the quality of developed product and optimize the resources schedule. Especially in outsourcing organization, the early precise defect prediction can help them to monitor the supplier's process and establish the criteria to verify the outsourcing products. Chinese development bank (CDB) is such an outsourcing organization, who applied SAM process area of CMMI to manage their outsourcing projects. In this paper, we proposed a prediction mode, which incorporated the qualitative factors from COQUALMO and the quantitative data collected from 21 historic financial projects of CDB. Principal Component Analysis (PCA) method was adopted to analyze the inter-correlated factors, and the key factors were determined to simplify the proposed model. We also evaluated its performance and compared with the software defect introduction (DI) model of COQUALMO. The results show that 66.67% predicted results are better than DI model and 80.5% predicted results have AE which are less than 50 while 95.24% predicted results have AE which are less than 100.