Engineer working on censorship-resistant networking, Android/desktop proxy clients and Telegram/AI tooling. I run a production VPN product end to end and contribute upstream to the open-source stack it is built on.
| Project | What I did |
|---|---|
| Nemu-x/ClashFest · Android client on mihomo · 219★ | Core contributor: 30 merged PRs, +19.6k LOC, ~15% of the current codebase. Wi-Fi ↔ LTE failover with consistent DNS/underlying network (#154); comment-preserving mihomo config layer with native Go validation (#29) and YAML diff preview (#13); trust-boundary hardening (#171, #172); APK update verification (#158); Material 3 redesign (#3). |
| PasarGuard · VPN panel + node · 2.6k★ | Merged: Mihomo xHTTP subscription options (panel#509), UTC-correct API dates (panel#208), share-link fix (panel#880), WireGuard log timestamps (node#47). In review: per-app routing & DNS editor (panel#759), confirmed access revocation with node-sync fencing (panel#756), node lifecycle hardening (node#78), atomic node updates with rollback (scripts#25). |
| MetaCubeX/ClashMetaForAndroid | In review: local control boundary hardening (#798), Gradle distribution verification (#799). |
| Other merged | Russian localization for Better Politics Mod, Victoria 3 (#334, +6k lines) · async client and token refresh for kworker. |
tg-recall — local-first Telegram archive for people and AI agents. Syncs allow-listed chats into SQLite FTS5, hybrid retrieval, local transcription, hand-rolled MCP server that answers with tg:// source links. Python, 15k LOC, 300+ tests, CI on Windows and Linux.
bpn-client — Windows-first desktop VPN client. Tauri UI, privileged Rust service over IPC, Mihomo TUN, optional zapret/winws DPI tooling. 25k LOC Rust, 158 tests.
BPN / BadVPN (private, in production) — the VPN product itself: Next.js + Prisma/Postgres backend, Python Telegram bot and Mini App, multi-brand. ~190k LOC, 1.8k commits, 160+ test files. Traffic accounting on a ledger with rollover (shadow validation, staged rollout, fail-closed gates), payment reconciliation that does not trust webhooks, idempotent admin actions via outbox, front-node → exit routing for restricted mobile networks. Public pieces: badvpn-routing (Mihomo rulesets with source-checking CI) and server-checker (VPS reachability and DPI checks).
sre-agent-bench — benchmark of AI coding agents repairing a deliberately broken Ubuntu server over SSH: 11 injected faults (service, creds, proxy, DB exposure, backups, restart policy), auditd action capture, an external verifier that checks survival after SIGKILL and reboot. Results for 11 model/harness configurations.
wiki-mcp — agent-maintained research wiki served as a remote MCP server on Cloudflare Workers: OAuth 2.1 for claude.ai/ChatGPT, D1 + KV, agents write through proposal branches that merge only after a schema-lint CI gate, retrieval tracked against a golden set (recall@5 0.83 on the private 536-page instance).
lumacalc — native Windows calculator in Rust + Slint: pure engine crate with unsafe forbidden, thin Win32 platform layer, clippy pedantic, per-user install.
Remoji-tg-mcp — MCP server for finding Telegram custom emoji and stickers, on PyPI. yookassa-telegram — YooKassa payments for aiogram 3: fiscal receipts, webhooks, refunds, on PyPI.
AI-directed engineering: Claude Code and Codex write a lot of the code; I own the architecture, review, tests and production operations. Specs first (OpenSpec), reviewed PRs, CI gates.
Stack: Python · TypeScript · Rust · Kotlin · Go — Next.js, FastAPI, aiogram, Tauri, Android, mihomo/Xray, PostgreSQL, Cloudflare Workers.