Full-stack engineer · AI coding-agent internals
I work on the parts of developer tools that fail quietly — sandbox policy, tool harnesses, streaming edits, and agent orchestration.
Merged upstream — oh-my-pi (23.7k★)
8 commits on can1357/oh-my-pi@main across 5 merged pull requests. Both numbers are real and measure different things: the contributor graph counts commits carrying my authorship, while #7853 and #7849 were landed by the maintainer as squashed merge commits authored by can1357, so their code is in main but does not appear in my commit count.
| # | PR | Area | What it fixes | Merged |
|---|---|---|---|---|
| 1 | #8213 — fix: OSC 133 command start |
TUI / terminal | 133;B latches a sticky .input cursor semantic in Ghostty-derived terminals, so every later painted cell is tagged as prompt input and click-to-move injects arrow keys into the pty. Emits a balanced 133;C + 133;D;0 inside the same render, clearing the state without regrouping later output (#8030, #6115). +45 / −7 across 2 files |
2026-08-11 |
| 2 | #7853 — fix(extensions): roll back providers after load failure |
Extension loader | registerProvider() wrote straight into the shared ExtensionRuntime.pendingProviderRegistrations, so an extension that threw during init was rejected while its provider survived and kept influencing model routing. Checkpoints the queue and restores it on throw, preserving earlier extensions' entries (#7472). 4 regression tests. +138 / −4 |
2026-08-07 |
| 3 | #7849 — fix(catalog): enrich Alibaba Token Plan discovered model limits |
Model catalog | The /models endpoint omits context_length, so dynamically discovered models showed ? in the selector. Adds curated contextWindow/maxTokens for known discovered models while unknown future models stay visible with null rather than guessed limits (#7486). +89 / −4 |
2026-08-07 |
| 4 | #7536 — perf(fuzzy-find): retain only the bounded top-K scored matches |
Fuzzy find | Allocated a scored match for every hit and full-sorted before truncating to maxResults (100). Now scores into a bounded worst-first BinaryHeap of at most maxResults, keeping the exact totalMatches contract; path_depth computed once per retained candidate instead of inside the comparator |
2026-08-05 |
| 5 | #7515 — feat(browser): auto-detect Ungoogled Chromium on Linux |
Browser tool | Ungoogled Chromium executable names, absolute paths, and the system-wide and per-user Flatpak shims for io.github.ungoogled_software.ungoogled_chromium are appended to systemChromiumCandidates(), so a stock Chrome install still wins and PUPPETEER_EXECUTABLE_PATH is unaffected (#7509) |
2026-08-05 |
The 8 commits, individually
| Commit | Message | PR | Date |
|---|---|---|---|
bf99f9c |
test(tui): lock the paired OSC 133 command zone instead of its absence |
#8213 | 2026-08-11 |
d5e2bb9 |
fix(tui): close the OSC 133 prompt zone so terminals clear input state |
#8213 | 2026-08-11 |
f4811ce |
Merge pull request #4 from can1357/main (fork sync) |
— | 2026-08-09 |
60187c9 |
refactor(fuzzy-find): release the heap borrow before evicting |
#7536 | 2026-08-03 |
2cf0a47 |
perf(fuzzy-find): retain only the bounded top-K scored matches |
#7536 | 2026-08-03 |
cc66b1d |
feat(browser): detect Ungoogled Chromium on Linux |
#7515 | 2026-08-03 |
0124728 |
Merge pull request #2 from can1357/main (fork sync) |
— | 2026-08-03 |
386f05d |
Merge pull request #1 from can1357/main (fork sync) |
— | 2026-08-03 |
Five carry code; three are fork-sync merges. The squashed merge commits for #7853 (22a3393) and #7849 are authored by the maintainer and so fall outside this list.
| PR | What it does | Size |
|---|---|---|
#8215 — fix: missing-usage resume crash |
Resume path crashes when usage data is absent (#8142) | +108 / −23, 8 files |
#7899 — fix(task): dedupe parallel fallback selector resolution |
Parallel Task siblings stampede unknown fallback selectors; adds an in-flight coordinator that dedupes concurrent resolution, clears settled entries so retries still work, and keeps caller abort isolated (#7484). 6 unit tests | +224 / −13, 5 files |
#7855 — fix(shell): deterministic native session close |
Shell had no explicit close(), so callers relied on GC to release pty and child-process handles. Adds an idempotent async close that aborts active execution and drops the session core (#7491) |
+98, 4 files |
#7512 — fix(bash-interceptor): don't block grep as a pipeline stdin filter |
printf 'x' | grep x was blocked with "use the grep tool", but the grep tool searches disk and cannot read pipeline stdout. Narrow exemption for grep-family stages that consume pipeline stdin and take no path operand (#7496). 19 new assertions |
+193 / −16, 3 files |
Also working across openhuman (36k★), graphify (105k★), prime-agent (13k★) and forgecode (7k★).
Agent safety and sandboxing. Most agent bugs are not crashes — they are guards that fail open. A permission check that returns 0 on an unreadable file reads as "clean." A Math.max(0, NaN) passes every threshold. I audit for the failure mode where a system reports success while doing nothing.
Tool harness correctness. Command interception that blocks grep when it is a legitimate pipeline stage. Shell sessions that never deterministically close. Fallback selectors resolved twice in parallel. These are the defects that make an agent feel unreliable without ever producing an error.
Retrieval and grounding. Claim extraction, evidence verification, and the reranking logic that decides whether a generated answer is actually supported by its sources.
An autonomous CLI development environment built on a dual-model split — a reasoning model that plans and a fast model that executes — with an organ-based internal architecture and a gated policy layer between the agent and the host machine.
Focus areas: workspace path confinement, single-use consent tokens for privileged operations, command allowlisting, and a response-path gate that verifies generated claims against retrieved evidence before they reach the user.
Currently private. Happy to walk through the architecture.
Ongoing upstream work on oh-my-pi, openhuman, graphify and prime-agent — mostly correctness fixes in extension loading, terminal shell integration, memory and embedding resolution, parser edge cases, and concurrency.
- Auditing agent security boundaries: sandbox escape paths, path traversal in workspace policy, and fail-open guards in permission checks
- Building retrieval-grounding verification that catches unsupported claims before they are returned
- Contributing fixes upstream to open-source coding agents
Open to collaboration on developer tooling and AI agent infrastructure.