AI Agent Engineer · Backend Engineer

Agents that do real work, on backends that hold up.做能落地的 Agent，也做撑得住的后端。

I'm Ray Tse, an AI agent and backend engineer. On the agent side, I start from real business requirements — breaking the task down, designing tools and permission boundaries — and own the runtime, context and memory, evals and observability. On the backend side, I ship business systems on Java with Spring Boot and Spring Cloud microservices — service integration, Redis-backed sessions, fine-grained authorization and data modeling — and build TypeScript / Node.js services too.我是谢梓睿（Ray Tse），AI Agent 与后端工程师。Agent 方面，从真实业务需求出发拆解任务、设计工具与权限边界，负责 runtime、上下文与记忆、评测与可观测性；后端方面，基于 Java / Spring Boot / Spring Cloud 微服务交付业务系统 —— 服务间调用、Redis 分布式会话、细粒度权限与数据建模，同时开发 TypeScript / Node.js 服务端。

ray@raytse.io GitHub Résumé →简历 →

Flagship project · Open source · macOS核心项目 · 开源 · macOS

OpenScreen

GitHub ↗

A screen-aware desktop agent for macOS. Ask about whatever is in front of you, then let it act — on files, the shell and other apps — with every consequential step behind your approval.面向 macOS 的 screen-aware 桌面 Agent。对眼前的任何内容提问，然后让它动手 —— 操作文件、Shell 和其他应用，而每一个有后果的步骤都要经过你的批准。

What it does today目前能做什么

  • Option + Space opens an overlay that answers about the current screen without taking focus from the app you are in.Option + Space 呼出浮层，在不抢走当前应用焦点的情况下回答关于屏幕的问题。
  • Each prompt carries a screenshot of every display and the focused window's accessibility text; if capture fails, the run continues as text.每次提问都附带所有显示器的截图和焦点窗口的无障碍文本；截图失败时仍以纯文本继续运行。
  • An agent loop with multi-step Function Calling over file and shell tools, plus Computer Use: desktop observation, click, scroll and text input.基于 Agent Loop 的多步 Function Calling，调用文件与 Shell 工具，并支持 Computer Use：观察桌面、点击、滚动和输入文本。
  • Automatic and manual compaction against the model's context window, and token-budgeted observational memory injected every turn.按模型 context window 自动或手动 compaction，以及按 token budget 压缩、每轮注入的 observational memory。
  • Persistent sessions with streaming answers and reasoning; a run started in one window can be watched and stopped from the other.持久化 Session，流式输出回答和推理；在一个窗口发起的运行可以在另一个窗口查看和停止。

Architecture架构

Electron      overlay (Option+Space) · main window
   │          JSONL over stdio · one protocol, typed on both sides
Node runtime
   ├─ Agent    agent loop · sessions · tools · approvals · compaction
   ├─ Capture  Swift helper · ScreenCaptureKit + Accessibility at submit
   ├─ Desktop  computer-use driver · native focus guard
   └─ Memory   screen recording → activity rollouts → observational memory

Dependencies point one way down this stack, enforced by tests.依赖沿着这个栈单向向下，由测试强制约束。

Engineering problems工程难题

What happens when a user cancels after a dozen tool calls?用户在 Agent 调用了十几次工具之后取消任务，会发生什么？

Cancellation is its own outcome — not a failure, not a denial. The abort signal reaches the model request, the running tool and any in-flight compaction, and pending approvals are invalidated. Completed side effects are not rolled back, and the system says so: a host command aborted mid-run is recorded as an uncertain execution, and the agent is told to check side effects before it retries.取消是一种独立的结果，既不是失败，也不是拒绝。abort 信号会传到模型请求、正在运行的工具和进行中的 compaction，待处理的审批随之失效。已完成的副作用不会回滚，系统也会如实说明：运行中被中止的宿主命令会记为 uncertain execution，并提示 Agent 在重试前先检查副作用。

Can compaction turn a tool's output into the user's goal?compaction 会不会把工具输出总结成用户的目标？

It can, so every compaction request carries a provenance rule: only user messages define goals and constraints; tool output is source-attributed evidence that may not supply a task target or imply progress. The same rule is rebuilt into every prompt, and screen content and memory enter as evidence — never as instructions or approval. That is the agent's prompt-injection boundary.会。所以每次 compaction 请求都带一条 provenance 规则：只有用户消息能定义目标和约束；工具输出是标明来源的证据，不能提供任务目标，也不能暗示任务进度。同样的规则在每次 prompt 中重建，屏幕内容和记忆都只作为证据进入，绝不作为指令或授权 —— 这就是 Agent 的 prompt injection 边界。

What exactly does an approval authorize?一次审批到底授权了什么？

Exactly what was shown: one file change, or one host command with its full text. Desktop actions are granted per application, per chat. There are no standing grants, no command-prefix allowlists and no permissions inferred from the task; without the macOS sandbox, tools fail closed. A host command's receipt says it ran — not that it succeeded.只授权展示出来的内容：一次文件修改，或一条展示了完整文本的宿主命令；桌面操作按应用、按会话授权。没有长期授权，没有命令前缀白名单，也不会根据任务推断权限；没有 macOS 沙箱时，工具直接 fail closed。宿主命令的回执只说明它运行过，不代表它成功了。

How do you stop state leaking between executions?如何避免状态在不同执行之间泄漏？

Each session runs one prompt at a time; different sessions run concurrently. Bash can write only to a per-prompt output directory. Security, trust and memory context is rebuilt for each prompt and removed when it ends — including on failure or cancellation — rather than persisted into session history.每个 Session 同一时间只运行一个 prompt，不同 Session 可以并发。Bash 只能写入每次 prompt 独立的输出目录。安全、信任和记忆上下文在每次 prompt 时重建，结束时移除（包括失败和取消），而不是写进会话历史。

When a run fails, was it the model, a tool, or the runtime?一次运行失败了，问题出在模型、工具，还是 runtime？

Every turn leaves a trace — each inference with its token usage and stop reason, each tool dispatch, each Bash attempt with a typed error code, and the approval timeline — queryable from a CLI. Five eval suites then grade deterministic artifacts and authorization separately from evidence-linked semantic judgments. Latest graded runs: 32/34, 5/5, 8/8, 9/9, 12/12.每个 Turn 都会留下 trace：每次 inference 的 token usage 和 stop reason、每次工具调用、每次带类型化错误码的 Bash 尝试，以及审批时间线，都能通过 CLI 查询。五套评测再把确定性的产物和授权检查，与基于证据的语义评判分开打分。最近一次评分：32/34、5/5、8/8、9/9、12/12。

My role我的角色

Built solo. I designed and wrote the agent runtime, the tool and security model, the memory pipeline, the evals and the Electron app — 65 commits since July 2026, MIT licensed. Development builds only; there is no packaged release yet.独立完成。Agent runtime、工具与安全模型、记忆管线、评测和 Electron 应用均由我设计和编写 —— 2026 年 7 月至今 65 次提交，MIT 协议。目前只有开发版，还没有发布安装包。

  • TypeScript
  • Node.js
  • Electron
  • React
  • Swift

Industry work · HQNEAT · Backend Engineer · 2025.11 – 2026.03企业项目 · 深圳市泓齐网络科技有限公司 · 后端工程师 · 2025.11 – 2026.03

OathXPay

OpenScreen is where I explore architecture. OathXPay is where I shipped inside someone else's: an existing codebase, real business rules, delivery dates, and technical choices other engineers had already made.OpenScreen 是我探索架构的地方；OathXPay 是我在别人的架构里交付的地方：已有的代码库、真实的业务规则、交付期限，以及其他工程师已经做出的技术选择。

A cross-border payments platform — merchant onboarding with KYB, fiat and crypto deposits and withdrawals, currency exchange and settlement — built as Spring Cloud Alibaba microservices. I owned the operations console service.一个跨境支付平台，覆盖商户入驻与 KYB、法币与数币充提、币种兑换和结算，采用 Spring Cloud Alibaba 微服务架构。我负责其中的运营平台服务。

  • Delivered the operations console microservice from zero (Spring Boot 3, Spring Cloud Alibaba, Nacos): 80+ REST endpoints across 10+ business modules — merchants, KYB, risk, order review, reconciliation.从 0 到 1 交付运营平台微服务（Spring Boot 3 + Spring Cloud Alibaba / Nacos）：80+ 个 REST 接口，覆盖商户、KYB、风控、订单审核、对账等 10+ 个业务模块。
  • Connected 5 downstream services (user, account, order, withdrawal, config) through OpenFeign, relaying login state with a RequestInterceptor for unified cross-service auth.基于 OpenFeign + RequestInterceptor 打通用户、账户、订单、提现、配置 5 个下游服务，登录态跨服务透传，统一鉴权。
  • Shipped Redis-backed distributed sessions and Spring AOP data scoping with button-level RBAC, so sales staff see only their own merchants.落地 Redis 分布式会话，以及基于 Spring AOP 的数据权限 + 按钮级 RBAC，销售人员只能访问名下商户。
  • Built the MyBatis-Plus data layer (MySQL schema, shared pagination and responses, audit-field auto-fill) and the EasyExcel reconciliation export; fixed boot failures from Spring Boot 3 auto-configuration changes and a bean circular dependency.搭建 MyBatis-Plus 数据层（MySQL 表结构、统一分页与响应、审计字段自动填充）与 EasyExcel 对账导出；解决 Spring Boot 3 自动配置失效与 Bean 循环依赖导致的启动失败。
My work我使用的
  • Java 17
  • Spring Boot 3
  • Spring Cloud Alibaba
  • Nacos
  • OpenFeign
  • Spring AOP
  • MyBatis-Plus
  • MySQL
  • Redis
  • EasyExcel
Platform stack平台技术栈
  • Sentinel
  • Seata
  • RocketMQ

How I work我的工作方式

Codex and Claude Code are my everyday engineering tools. I use them to read large repositories, study how other systems are built, implement features, run tests, chase regressions and iterate.Codex 和 Claude Code 是我日常的工程工具：用它们阅读大型代码库、研究其他系统的架构、实现功能、运行测试、定位 regression，并持续迭代。

I also study how real agents — Codex, Claude Code, pi — draw their boundaries around sessions, tool execution, compaction, approvals, sandboxing, diagnostics and cancellation, then build and test similar mechanisms myself. Being a heavy user and a builder at the same time keeps my attention on what surrounds the model: context, tools, permissions, state, observability and UX.我也会研究 Codex、Claude Code、pi 等真实 Agent 系统如何划分边界 —— session、工具执行、compaction、审批、沙箱、诊断和取消 —— 再在自己的项目里实现并验证类似机制。既是高频用户又是构建者，让我始终关注模型之外的问题：上下文、工具、权限、状态、可观测性和 UX。

I like systems with an explicit state model, clear API boundaries and real failure handling, and owning a feature end to end — from UI through API, database and agent runtime to deployment and observability.我喜欢有明确状态模型、清晰 API 边界和真正 failure handling 的系统，也喜欢端到端地负责一个功能：从 UI 到 API、数据库、Agent runtime，再到部署和可观测性。

Toolbox技术栈

AI / Agent
LangChain, MCP, Function Calling, RAG, Prompt / Context Engineering, agent memory, multi-agent systems, Computer Use, LLM-as-Judge evals
Java backendJava 后端
Java, Spring Boot, Spring MVC, Spring Cloud Alibaba (Nacos, OpenFeign), MyBatis-Plus, Maven
TS / Python
TypeScript, Node.js, Python, FastAPI, REST APIs, WebSocket
Data数据
MySQL, Redis, PostgreSQL, MongoDB, SQLite
Tools工程
Claude Code, Codex, Docker, Linux, Git, Nginx, Caddy

Contact联系

The fastest way to reach me is email.联系我最快的方式是邮件。

ray@raytse.io GitHub Résumé →简历 →