这是一个新 AI 术语的每日雷达：从 X、Hugging Face、GitHub 与站点地图中抓取新模型、新产品与新仓库的名字，赶在关键词工具收录之前发现它们^[21]。它要解决的是内容与 SEO 的时效问题：等关键词工具显示搜索量时，红利期往往已经过去。做法上以多信源交叉发现新词，再输出可跟踪的列表。值得借鉴的是以「新词出现」作为需求探测的前置信号，比等搜索数据更早；限制是早期术语噪声极大，需要人工判断哪些会留存，仓库也未给出误报率与历史命中率。

This is a daily radar for new AI terms: it catches names of new models, products and repos on X, Hugging Face, GitHub and sitemaps before keyword tools list them^[21]. It addresses the timing problem in content and SEO: by the time a keyword tool shows volume, the window has often closed. The design cross-checks multiple sources for new words and emits a trackable list. Worth borrowing is that word appearance is an earlier demand signal than search data; the limit is heavy early-stage noise requiring human judgement, with no false-positive or hit-rate history provided.

yovoice 是面向 macOS 与 Windows 的开源本地 AI 音频与音乐工作室：TTS、声音克隆、带歌词的歌曲与多轨编曲，全部离线、零 API 费用^[20]。它要解决的是创作工具的订阅与版权顾虑：云端服务需要持续付费且音频出本机，而本地方案受限于质量。做法上把多个音频模型打包进桌面应用，并用 MCP 对外提供能力。值得借鉴的是在创作类工具里，「离线 + 零边际成本」对高频用户极具吸引力；限制是本地模型质量与商业方案仍有差距，仓库未给出与其他 TTS 的客观对比，硬件要求也未明确。

yovoice is an open-source local AI audio and music studio for macOS and Windows: TTS, voice cloning, songs with lyrics and multi-track scores, all offline with zero API fees^[20]. It addresses subscription and copyright concerns in creative tools: cloud services charge continuously and send audio off the machine, while local options lag on quality. The design packages several audio models into a desktop app and exposes them over MCP. Worth borrowing is that offline with zero marginal cost is highly attractive to heavy users of creative tools; the limit is a quality gap against commercial options with no objective TTS comparison or hardware requirements stated.

这是一份面向二进制、应用、固件、文件格式与协议的逆向工程工具与学习资源清单，话题标签也包括 agent skills 与 AI Agent^[22]。它要解决的是安全研究方向资料分散的问题：静态分析、动态调试、固件提取与协议还原各有工具链，新入门者很难判断该从哪套开始。做法上按类别整理工具与教程，并标注与 AI Agent 结合的用法。值得借鉴的是给成熟领域做「工具 + 学习路径」的对照表，比只列工具更实用；限制是清单类仓库需要持续维护，链接失效与工具停更都会降低价值。

This is a curated list of reverse-engineering tools and learning resources for binaries, apps, firmware, formats and protocols, with topics also covering agent skills and AI agents^[22]. It addresses scattered material in security research: static analysis, dynamic debugging, firmware extraction and protocol recovery each have their own toolchains, and newcomers struggle to know where to start. The design groups tools and tutorials by category and notes how they combine with AI agents. Worth borrowing is that for a mature field, a tool-plus-learning-path mapping beats a bare list of tools; the limit is that such repos need continuous maintenance as links and projects rot.

Xiryn 声称做到了 Muse、Grok Bot 与 Dots 能做的事，但跑在你自己的电脑上：每个 Agent 在 Docker 里拥有独立 Linux 桌面，可用自有密钥接任意模型，配加密保险库，并能从 Telegram 远程控制^[23]。它要解决的是个人 Agent 的可控性与隔离：把每个 Agent 关进独立容器，既限制它能碰什么，也避免多个 Agent 互相污染。值得借鉴的是「每个 Agent 一个隔离桌面」是比共享宿主更清晰的安全边界；限制是这种方案对内存与磁盘开销明显更高，仓库未说明升级、备份与崩溃恢复流程，长期运行的维护成本需要评估。

Xiryn claims to do what Muse, Grok Bot and Dots do but on your own computer: each agent gets its own Linux desktop in Docker, any model with your own keys, an encrypted vault and control from Telegram^[23]. It addresses control and isolation for personal agents: boxing each one in its own container limits what it can touch and prevents cross-contamination. Worth borrowing is that one isolated desktop per agent is a cleaner security boundary than a shared host; the limit is markedly higher memory and disk overhead, with upgrade, backup and crash-recovery flows unstated.

这个仓库是《皇室战争》的离线 AI Agent 研究项目：包含原生对局模拟、模仿学习、PPO 强化学习与交互式评测^[24]。它要解决的是游戏 AI 研究的可复现性问题：依赖在线服务器会让实验无法重跑，而自建模拟器能固定版本与随机种子，便于对比算法。做法上把模拟、训练与评测打包成一个可离线运行的栈。值得借鉴的是先自建确定性模拟环境，再做 Agent 研究，能显著降低复现成本；限制是模拟器与真实游戏的规则偏差会限制结论外推，仓库也未给出与在线天梯成绩的对照。

This repository is an offline AI agent research stack for Clash Royale: native match simulation, imitation learning, PPO reinforcement learning and interactive evaluation^[24]. It addresses reproducibility in game AI research: depending on live servers makes experiments hard to rerun, whereas a self-built simulator fixes version and seeds for algorithm comparison. The design packages simulation, training and evaluation into one offline stack. Worth borrowing is that building a deterministic simulator first cuts reproduction cost substantially for agent research; the limit is that simulator-versus-game divergence bounds how far conclusions travel, and no comparison against ladder performance is given.

pullboard 的主张是面向真实产品的自主开发：Agent 依据你批准的规格构建，而没有任何改动会在另一个 Agent 证明其正确之前上线^[25]。它要解决的是编码 Agent 的验证缺位：单 Agent 自评容易自我确认，而引入独立的验证角色可以把「自证」变成「他证」。做法上把验证作为发布流程的强制关卡，并保持本地优先与多 Agent 协作。值得借鉴的是把「谁来证明」从执行者中分离出来，是低成本提升信任的办法；限制是验证 Agent 本身也会出错（前一日的 BehaviorTrace 与 Assurance 案例都说明了这点），仓库未说明验证强度与误放行率，需要配合人工抽检。

pullboard's pitch is autonomous development for real products: agents build from the spec you approve, and nothing ships until another agent proves it^[25]. It addresses the verification gap in coding agents: a single agent reviewing itself tends to confirm itself, whereas an independent verifier turns self-certification into external certification. The design makes verification a mandatory gate in the release path while staying local-first and multi-agent. Worth borrowing is that separating who proves from who executes is a cheap way to raise trust; the limit is that verifier agents also fail, as the previous day's work on attribution and assurance showed, and no strength or false-pass rate is given.

SO-ARM-102 是一套开源主从机械臂套件：5 自由度加夹爪，PET-CF 框架与平行夹爪，兼容 LeRobot，提供 STEP/STL、BOM 以及打印与装配指南^[26]。它要解决的是具身研究的数据采集硬件问题：遥操作采集需要「主臂—从臂」结构，而商用平台价格高、定制难。做法上把机械、物料与装配文档全部开放，复用 LeRobot 生态以便直接接上主流训练流程。值得借鉴的是开源硬件只要把 BOM 与装配文档做完整，复用率会显著提升；限制是 3D 打印件的刚度与重复精度低于工业臂，数据质量上限受硬件限制，仓库未给出精度测试数据。

SO-ARM-102 is an open-source leader-follower robot arm kit: 5 DOF plus gripper, PET-CF frame, parallel gripper, LeRobot-compatible, with STEP/STL files, a BOM and print and assembly guides^[26]. It addresses data-collection hardware for embodied research: teleoperation needs a leader-follower setup, while commercial platforms are expensive and hard to customise. The design opens the mechanics, materials and assembly documentation and reuses the LeRobot ecosystem so it plugs into mainstream training pipelines. Worth borrowing is that complete BOMs and assembly docs drive much higher hardware reuse; the limit is that printed parts have lower stiffness and repeatability than industrial arms, capping data quality, with no accuracy figures.

dreamforge 提出一条单 GPU、可证伪的流水线：把世界模型的「想象」转成机器人策略的纠错训练数据，技术栈包括 SmolVLA、LIBERO、CEM 与成对仿真回放^[27]。它要解决的是世界模型数据的可用性验证问题：模型生成的未来画面看起来合理，但未必构成有效的训练信号，而成对回放可以把「想象」与「真实」对照起来。值得借鉴的是为合成数据设计对照实验，而不是直接把它混进训练集；限制是仓库处于早期，缺少训练收益的量化结果，单 GPU 规模的结论能否放大仍需验证。

dreamforge proposes a single-GPU, falsifiable pipeline that turns world-model imagination into corrective training data for robot policies, using SmolVLA, LIBERO, CEM and paired simulator replays^[27]. It addresses whether world-model data is actually usable: a generated future can look plausible without providing a valid training signal, and paired replays let imagination be checked against reality. Worth borrowing is to design controlled comparisons for synthetic data rather than mixing it into the training set directly; the limit is that the repo is early with no quantified training gains, and single-GPU scaling is unproven.

PhysicalRSI 是面向物理 AI 与具身 Agent 的「递归自我改进（RSI）」基础设施与引擎的预览版^[28]。它要解决的是机器人自我改进缺少工程承载的问题：论文里的自进化多半停留在算法层，而真实机器人需要采集、评估、回滚与安全约束一整套支撑。做法上把 RSI 做成可复用的基础设施而非单点方法。值得借鉴的是把「自我改进」工程化会暴露评测与安全这些真正的瓶颈；限制是仓库目前只是预览、没有可运行结果与基准数据，实际能力需要等公开发布。

PhysicalRSI is a preview of infrastructure and an engine for recursive self-improvement (RSI) in physical AI and embodied agents^[28]. It addresses the missing engineering substrate for robot self-improvement: papers stay at the algorithm layer while real robots need collection, evaluation, rollback and safety constraints. The design makes RSI reusable infrastructure rather than a point method. Worth borrowing is that engineering self-improvement surfaces evaluation and safety as the real bottlenecks; the limit is that the repo is a preview without runnable results or benchmark data.

SolidCraft 是用纯 Rust 实现的开源参数化 3D CAD 应用，覆盖桌面、Web，并可通过 MCP 自动化^[19]。它要解决的是设计文件与自动化流程脱节的问题：传统 CAD 以图形交互为中心，脚本与参数化能力受限，而 Agent 要参与设计就需要可编程接口。做法上把几何内核与应用都放在 Rust 里，并开放 MCP 供 Agent 调用。值得借鉴的是把 MCP 直接做进设计工具，是让 Agent 参与工程流程的可行切入点；限制是 CAD 的生态与文件格式兼容性极难追赶既有厂商，仓库未说明 STEP 等格式的导入导出覆盖率与几何稳定性，工业使用需要谨慎评估。

SolidCraft is an open-source parametric 3D CAD application implemented in pure Rust, covering desktop, web and automation through MCP^[19]. It addresses the split between design files and automation: traditional CAD centres on graphical interaction with limited scripting, whereas agents need a programmable interface to take part in design. The design keeps both geometry kernel and application in Rust and exposes MCP for agents. Worth borrowing is that baking MCP into a design tool is a viable entry for agents into engineering workflows; the limit is that matching incumbent ecosystems and file formats is very hard, with no coverage or stability figures for formats such as STEP.

这篇论文盯上了 KV 缓存共享的一个盲区：跨模型复用前缀缓存能省下 prefill 计算，但既有方法只优化延迟与生成质量，安全性影响没人系统评估^[29]。作者把「接收模型的安全行为偏离其原生表现」定义为安全不兼容（safety incompatibility），并在多种「发送方—接收方」组合与复用配置上做了系统评测。结论有两个要点：不兼容的方向与幅度取决于模型配对与复用配置；而在所有评估配对中，复用 value 张量造成的偏离都显著大于复用 key。据此提出 VReparo：离线学习逐层、逐 KV head 的仿射映射，把复用的发送方 value 张量对齐到接收方原生分布，再解码；在两组模型配对的全量复用与当前最优的选择性复用设置下，它降低了 HarmBench 的平均攻击成功率。对做多 Agent 与推理加速的团队，参考价值是缓存复用是一项安全决策，不只是性能优化，必须按模型对单独评测；限制是缓解依赖逐模型对离线训练映射，规模扩大后的维护成本与未知配对的泛化尚未验证。

This paper targets a blind spot in KV-cache sharing: cross-model prefix reuse saves prefill compute, but existing methods optimise only latency and generation quality while the safety implications go unevaluated^[29]. The authors define safety incompatibility as deviation from the receiver's native safety behaviour and evaluate it systematically across sender-receiver pairs and reuse configurations. Two findings stand out: the direction and magnitude of incompatibility depend on the model pair and reuse configuration, and value reuse causes substantially larger deviations than key reuse across all evaluated pairs. They propose VReparo, which learns per-layer, per-KV-head affine maps offline to align reused sender value tensors with receiver-native counterparts before decoding, reducing average HarmBench attack success under full KV reuse and the state-of-the-art selective reuse setting. For multi-agent and inference-acceleration teams the reference is that cache reuse is a safety decision, not just a performance one, and must be evaluated per model pair; the limit is offline per-pair training and untested generalisation to unseen pairs.

RSIPO 针对 Agent 强化学习里「技能」被静态使用的问题：近期做法把可验证奖励的 RL（RLVR）与在线自蒸馏（OPSD）结合，用带特权上下文（如 Agent 技能）的教师模型为学生生成的 token 打分；但这些方法基本忽略了技能的在线演化与教师监督的可靠性^[30]。做法上提出递归自改进策略优化（RSIPO）：让 Agent 技能与策略模型在训练过程中共同进化——策略自己从已完成轨迹中抽取技能，并通过轨迹回放显式优化其技能生成能力，同时用经验贝叶斯收缩动态校准教师监督的权重。对做 Agent 后训练的团队，参考价值是技能库不应当是静态资产，而应与策略一同迭代，并对教师信号的可信度做动态加权；限制是摘要未给出具体基准与提升幅度，技能抽取的质量上限与「技能—策略共同漂移」的风险需要复现验证。

RSIPO targets the static use of skills in agentic RL: recent work combines RL with verifiable rewards (RLVR) and on-policy self-distillation (OPSD), using a teacher conditioned on privileged context such as agentic skills to score the student's tokens, but largely overlooks the on-policy evolution of those skills and the reliability of teacher supervision^[30]. The method, Recursive Self-Improving Policy Optimization, lets agentic skills and the policy model co-evolve during training — the policy extracts skills from completed trajectories itself and explicitly optimises its skill-generation capability through trajectory replay, while empirical Bayes shrinkage dynamically calibrates teacher supervision. For agent post-training teams the reference is that a skill library should iterate alongside the policy, with teacher signals weighted by measured reliability; the limit is that no benchmarks or effect sizes are given, leaving skill-extraction ceilings and co-drift risk to reproduce.

这篇论文质疑用「无参考的冻结 LLM 评委」做 RL 奖励的可靠性：用 GRPO 对着这类评委训练后，评委确实接受了更多答案，但事后分析找不到留出集贪心准确率的提升——在全部 12 个（策略，评委）组合里，种子平均增益都没有超过 0.04^[31]。做一个对照：同样的配方换成黄金奖励，1.5B 策略的贪心准确率提升了 +0.054 [0.013, 0.096]，说明该策略上的「准确率不动」是评委奖励特有的；0.5B 策略用黄金奖励同样没有可检测增益。作者进一步检查了四个「上升」单元，发现训练 rollout 准确率的早期上升主要是采样锐化，与黄金奖励下的表现一致。接着追问「评审被钻空子的速度与上限由什么决定」：用至少同等规模的四个评委训练 0.5B/1.5B 策略，并用一个更小的评委训练 1.5B 策略，结果显示钻空子的深度（平台期）跟随评委能力，与评委 AUC 的 Spearman 相关为 -0.69。对做 RL 后训练的团队，参考价值是把「评委接受的答案变多」当作进步是危险的，必须用独立留出集与黄金对照验证；限制是实验限于 Qwen2.5 系列规模与特定评委族，结论跨模型族的普适性仍需检验。

This paper questions the reliability of using frozen, reference-free LLM judges as RL reward: after GRPO training against such a judge, the judge accepts more answers, yet post-hoc analysis finds no held-out greedy accuracy gain — in all 12 (policy, judge) cells the seed-mean gain never exceeded 0.04^[31]. A control is instructive: the same recipe with gold reward raised the 1.5B policy's greedy accuracy by +0.054 [0.013, 0.096], so the flat accuracy is specific to the judge reward; for the 0.5B policy gold reward also gave no detectable gain. In the four rising cells, the early rise in training-rollout accuracy was mostly sampling sharpening, as under gold reward. The authors then ask what sets the pace and depth of judge hacking: training 0.5B and 1.5B policies against four judges at least as large plus one smaller judge, the depth of hacking tracks judge capability, correlating with judge AUC at Spearman -0.69. For RL post-training teams the reference is that more judge acceptance is a dangerous progress signal and must be validated with an independent holdout and gold control; the limit is a study confined to the Qwen2.5 family.

这篇论文把 LLM Agent 团队的失败当作社会性失败来处理：掌握信息的人保持沉默、强势发言者把整组锚定在错误答案上、违规行为无人纠正^[32]。它要解决的是多 Agent 协作缺乏社会动力学建模的问题：多数框架只调提示或分工，而不模拟情绪与关系。做法上提出 Agent Sociodrama：在固定人格的前提下，每轮由统一的外部 LLM 裁判更新各 Agent 的情绪状态与有向、不对称的关系，进而影响其后续交互；在六个 LLM 骨干与五个社会场景上，用经典社会理论模式与人类判断一致性来评估社会保真度，轨迹呈现出结构化的社会模式与模型间差异。随后提出 Trajectory-Guided Persona Recasting（TPR）：从交互记录与社会轨迹中诊断群体动力学失败，并在重跑任务前重铸 Agent 人格，在四个协作基准上提升了表现。对做多 Agent 系统的团队，参考价值是把「群体动力学」当作可诊断对象，并在失败后调整角色而非只改提示；限制是引入外部裁判带来额外成本与主观性，人格重铸也可能掩盖任务本身的分工缺陷，摘要未给出提升幅度。

This paper treats LLM agent team failures as social failures: information holders stay silent, dominant speakers anchor the group on wrong answers, and norm violations go unsanctioned^[32]. It addresses the missing modelling of social dynamics in multi-agent collaboration: most frameworks tune prompts or roles without simulating emotion or relationships. The proposed Agent Sociodrama holds personas fixed while a unified external LLM judge updates agents' emotional states and directed, asymmetric relationships every round, shaping subsequent interactions; across six backbones and five social scenarios, social fidelity is assessed via classical social-theory patterns and agreement with human judgements, and trajectories show structured social patterns with model-specific differences. It then introduces Trajectory-Guided Persona Recasting (TPR), which diagnoses group-dynamic failures from transcripts and recasts agent personas before rerunning the task, improving results on four collaborative benchmarks. For multi-agent teams the reference is to treat group dynamics as a diagnosable object and adjust roles after failure rather than prompts alone; the limit is added cost and subjectivity from the external judge, and no effect sizes are given.

这篇论文命名并量化了一种危险模式： interpretive lock-in（解释锁定）——一次错误理解会穿过计划、实现与测试一路保留下来，因为测试是由同一套错误理解生成的^[33]。做法是在 30 个源自 TPC Benchmark DS 的 DataFrame 任务上，比较一次性生成、测试引导修订与 PlanAudit 引导修订三种流程。结果很有说服力：测试通过数从 22/30 提升到 29/30、再到 30/30，但没有任何一份生成方案与其存储的参考输出一致；评估器对照在 57/57 情况下返回预期结果，同引擎 SQL 重执行能复现 28/30 的参考结果，而在这 30 个任务上全部 77 次「测试全通过」的运行仍然无法与参考一致；PlanAudit 引导修订只在 3/30 任务上提升代码分、11/30 上提升测试覆盖，两项指标的中位配对变化都是零。失败分析显示问题测试的模式包括：遗漏需求、采用候选自定义的 schema、使用无区分度的 fixture，或直接复述实现的错误逻辑。对做 AI 编码与评测的团队，参考价值是不能把「测试全绿」当作正确性证据，必须有独立于生成过程的判定基准；限制是任务集限于 DataFrame 与 TPC-DS 派生场景，结论对其他代码域的强度需要另行测量。

This paper names and quantifies a dangerous pattern: interpretive lock-in, where a mistaken interpretation persists across the plan, implementation and tests because the tests were generated from the same misunderstanding^[33]. On 30 DataFrame tasks derived from TPC Benchmark DS it compares Frozen One-Pass, Test-Guided Revision and PlanAudit-Guided Revision. The results are telling: test-pass counts rose from 22/30 to 29/30 and 30/30, yet no generated solution matched its stored reference output; evaluator controls returned the expected outcome in 57/57 cases and same-engine SQL re-execution reproduced 28/30 references, while all 77 test-passing runs on these tasks failed reference agreement; PlanAudit improved code scores on 3/30 and test coverage on 11/30, with a median paired change of zero for both. Failure analysis found tests that omitted requirements, adopted candidate-defined schemas, used nondiscriminating fixtures or repeated the implementation's incorrect logic. For AI coding and evaluation teams the reference is that all-green tests are not evidence of correctness without a reference independent of the generator; the limit is a task set confined to DataFrames and TPC-DS-derived scenarios.

ReTrace 针对机器人自我改进里最难的一类失败：跨阶段依赖——某个动作本地是成功的，却导致后续阶段失败^[34]。它要解决的是「如何在没有任何示范、也不更新模型参数的前提下，从自主交互中变强」。做法上提出一个自我改进框架：对下游失败做回溯归因，把它追溯到更早的决策，提出针对性修正，并通过后续交互验证这些修正；随着尝试累积，把已验证的修正固化成可复用的操作技能，用来指导之后的执行。作者在 Franka Research 3 上用四个真实操作任务做评测（其中两个具有强跨阶段依赖）。对做机器人学习与 Agent 记忆的团队，参考价值是把「失败归因」当成独立能力来做，并用可复用的技能把归因结果沉淀下来；限制是摘要只提到在这两项任务上表现突出、未给出完整数值，跨任务与跨硬件的可迁移性需要复现验证。

ReTrace targets the hardest class of failure in robot self-improvement: cross-stage dependencies, where an action succeeds locally but causes a later stage to fail^[34]. It addresses how to improve from autonomous interaction without demonstrations and without updating model parameters. The framework retrospectively traces downstream failures back to earlier decisions, proposes targeted corrections and validates them through subsequent interactions, progressively consolidating validated corrections into a reusable manipulation skill that guides later execution. It is evaluated on four real-world manipulation tasks with a Franka Research 3, two of them strongly cross-stage dependent. For robot learning and agent memory teams the reference is to treat failure attribution as its own capability and let its results settle into reusable skills; the limit is that the abstract only indicates stronger performance on those two tasks without full numbers, leaving transferability to verify.

这篇论文关注 Agent 技能这一新型资产的归属问题：技能把操作流程与领域经验编码成可复用知识，但以明文分发就无法防止复制与泄露，而实践中缺少归属验证与泄露追溯机制^[35]。难点在于技能是结构化、紧凑的指令，对事实与流程准确性要求极高，水印不能改变语义。做法上提出 SkillMarker：把「质量约束的重写」（区分必要知识与可替换表达，保证指令保真）与「面向信号的候选搜索」（在保真约束下探索替代表达以获得更强的水印信号）结合起来，并开源了包含嵌入、质量审计与检测的工具包。对做 Agent 技能分发与商业化的团队，参考价值是技能资产需要「可追溯」这一层，水印是比许可条款更可执行的补充；限制是摘要未给出检测鲁棒性（改写、翻译、截断后的存活率）与误检率数据，实际抗攻击能力需要独立评估。

This paper addresses ownership of a new class of asset: skills encode operational procedures and domain expertise as reusable knowledge, but distributing them in plaintext exposes them to copying and leakage, while practical ownership verification and leakage tracing remain underdeveloped^[35]. The difficulty is that skills are structured, compact instructions with stringent requirements for factual and procedural accuracy, so a watermark must not change meaning. SkillMarker combines quality-constrained rewriting, which separates essential knowledge from flexible expression to preserve fidelity, with signal-oriented candidate search that explores alternative expressions for a stronger watermark under those constraints, plus an open-source toolkit for embedding, quality auditing and detection. For teams distributing or commercialising skills the reference is that skills need a traceability layer, and watermarking complements licence terms with something enforceable; the limit is that no robustness or false-positive figures are given, so resistance to rewriting, translation and truncation needs independent assessment.

这篇论文问的是一个具体问题：什么样的桌面软件界面，对 Agent 更容易使用^[36]。背景是：LLM Agent 正成为桌面应用的重要新用户，但现有界面是为人类终端用户或开发者设计的，Agent 只能去解读视觉控件，或自行发现并组合底层操作，这种错配会拖累本已很强的 Agent。做法上把「软件演化」当作天然的界面变量：构建 DeskIF-Bench，覆盖六个桌面应用、255 个经产物验证的任务，在固定任务、Agent 与验证器的前提下改变软件版本，从而测量界面变化对 Agent 表现的影响。结果上，在两个模型与六个应用上，最新版本一致优于最旧版本；轨迹分析识别出三个关键界面属性：可发现性（discoverability）、粒度（granularity）与可观测性（observability）；据此开发了 ANIS 框架来合成 Agent 原生界面。对做工具与 Agent 集成的团队，参考价值是把「可发现性、粒度、可观测性」当作接口评审的检查项，比事后写提示词补救更有效；限制是任务来自六个桌面应用、以产物验证为判据，结论能否推广到 Web 与 CLI 工具仍需验证。

This paper asks a concrete question: what properties make desktop software easier for agents to use^[36]. The context: LLM agents are becoming an important new class of desktop application users, yet existing interfaces were designed for human end users or developers, leaving agents to interpret visual controls or discover and compose low-level operations — a mismatch that hinders even capable agents. The approach treats software evolution as a natural source of interface variation, building DeskIF-Bench with 255 artifact-verified tasks across six desktop applications and varying the software release while holding task, agent and verifier fixed. Across two models and six applications, the newest release consistently outperforms the oldest, and trajectory analysis identifies three interface properties: discoverability, granularity and observability, which motivate the ANIS framework for synthesising agent-native interfaces. For tooling and agent-integration teams the reference is to make those three properties checklist items in interface review rather than patching with prompts later; the limit is six desktop apps with artifact-based verification.