Software Engineer building AI-powered products, automation systems, and scalable backend infrastructure.

I build production software across AI, backend systems, automation, security, and cross-platform applications.

I am also strong at coding with AI. I use LLMs daily to plan, prompt, review, and ship, and I check the result before it lands.

Pull requests on official SDKs and libraries other people already ship with. Projects I built are listed under Featured Projects.

Six pull requests on proton-drive-cli-sync, two-way Proton Drive sync for Linux.

Python • pytest • systemd

• Test harness stands in for the proton-drive CLI so the suite runs without a Proton account. Merged
• Exit 5 when a finished pass still failed an upload, a listing, a trash, or a stall-skip (open)
• Excluded names already on Drive stay unless the mapping says prune (open)
• Settings and the CLI are looked up under ~/.config and on PATH (open)
• Mount re-check before each folder's deletions (open)
• Mass-deletion guard stays off unless it is turned on (open)

Two pull requests on the official Go SDK for the Model Context Protocol, maintained with Google.

Go • MCP

• Tool.Execution keeps the 2025-11-25 taskSupport field through a proxy that decodes and re-encodes a tool. tools/list sends it only on that protocol version
• Task type adds the tasks extension handle so a task can round-trip (draft). The SDK still does not run a tool as a task

watch_workflow_run on GitHub's official MCP server. One call waits for an Actions run, sends progress, and stops when the client cancels.

Referral codes for ExtPay, the payments library for browser extensions (770+ stars).

Ente Auth verification codes matched to existing Apple Passwords logins. Merged.

• 🤖 AI Systems — LLM integrations, conversational AI, voice agents, workflow automation
• ⚙️ Backend Systems — Node.js, Python, REST APIs, authentication, webhooks, distributed workflows
• 🔐 Security & Systems — End-to-end encryption, secure protocols, ephemeral credentials, local networking
• 🧩 Developer Tooling — Browser extensions, automation, desktop utilities
• 📱 Cross-Platform Software — Web, Electron, React Native, iOS, Android

Windows app that hides chosen windows from screenshots, recordings, and capture tools. Community continuation of the original by Cristian Gambino (@zCri): same name and purpose, rebuilt from scratch.

Rust • Tauri 2 • Svelte

• Hides windows with SetWindowDisplayAffinity, matched by process, title, class, or PID, including regex
• Window rules re-apply as new windows appear. Quick launch starts an app already hidden
• Tray, optional start with Windows, and installers for x64, x86, and arm64. The app itself stays visible to capture unless that option is turned on

View Project · Release v2.0.1

iCloud Passwords in Chrome on macOS and Windows, with an inline menu, a fill shortcut, and a save bar that hands the write to Apple's sheet.

JavaScript • Chrome Extension • Manifest V3

• Inline menu on login fields, with keyboard navigation
• Ctrl/Cmd+Shift+L fills and cycles matching logins
• Saving a password hands the write to Apple's own save sheet
• Looks up a password on the page host and on related websites stored with that login
• Loaded unpacked. Apple's helper only accepts its extension id, so there is no Chrome Web Store listing

View Project · Release

Fork of ManiForoughi2/open-passwords (Apache-2.0). Apple protocol from au2001/icloud-passwords-firefox (Apache-2.0). Field lists from bitwarden/clients (GPL-3.0). Not affiliated with Apple or Bitwarden.

Real-time voice automation system for medication-adherence calls.

Twilio • Deepgram • ElevenLabs • Node.js

• Conversational voice workflows
• Real-time speech-to-text and text-to-speech
• Patient-specific call flows
• Voicemail detection and SMS fallback
• Webhook-driven event processing

View Project

End-to-end encrypted sharing between two devices on the same Wi-Fi. One Flutter app for desktop and mobile.

Flutter • Dart • WebSockets • libsodium

• Each session uses a new X25519 key. The message key is derived with HKDF-SHA256 and the text is encrypted with XChaCha20-Poly1305
• Keys and messages are wiped when the session ends. Nothing is written to disk
• Windows, macOS, Linux, Android, and iOS

View Project · Release v2.0.0

Chrome, Edge, and Brave extension that reads verification codes and sign-in links from Gmail. A code can be filled or copied. A link opens only when you choose. Mail stays in the browser on the Gmail readonly scope.

TypeScript • React • Chrome Extension • Gmail API • OAuth

• One Gmail account is free. More accounts are a one-time purchase
• Background checks that speed up while a code field is on screen
• Auto-fill for a single box or split digit boxes, plus a Fill chip for recent codes
• Open link for a verification or sign-in URL, only after you click

View Project · Site

Chrome extension that shows Zendrop product cost on a Minea product page, using the Zendrop session already in the browser.

TypeScript • Chrome Extension • Manifest V3

• Reads the visible Minea title and searches Zendrop
• Ranks matches with image, cost, and confidence
• Opens the Zendrop product page for the match you pick
• Never asks for or stores an auth token

View Project

Console script that posts every on-device Medal clip from the library, so a local backlog can be uploaded without opening each clip by hand.

JavaScript • DOM Automation • Browser Console

• Finds clips still marked on device and skips anything already handled in the run
• Opens the preview, confirms Post, and waits for the upload to finish before closing the dialogs
• Scrolls the library until it stops yielding new clips, then reports uploaded, failed, and elapsed time

View Project

Chrome extension that highlights game versions on SuperPSX when a matching patch exists in the PS-Game-Patch catalog.

JavaScript • Chrome Extension • Manifest V3

• Scans version tables for CUSA and PPSA title IDs
• Color-codes 60 FPS patches, other patches, and titles with no match
• Bundled index of 376 title IDs, regenerable from the latest patch release

View Project

Python script that turns a Bitwarden CSV export into a Chrome import. Safari then imports those passwords into iCloud Keychain. Logins with more than one website are written to a side list so the extra URLs can be added by hand.

Python

View Project

Contributions to proton-drive-cli-sync. The harness is merged. The safety and path changes are open.

Python • pytest • systemd

• A fake proton-drive and a pytest suite run with bash scripts/test.sh and no Proton account. PROTON_SYNC_SETTINGS keeps the suite off the repository settings file
• A finished pass that still failed exits 5. The real-time consumer keeps its markers and waits before retrying that target
• An excluded name already on Drive is trashed by default. A mapping can set excluded_remote to keep
• Settings move to ~/.config/proton-drive-sync/settings.json. The CLI is resolved from PROTON_DRIVE_CLI, a settings path, a binary next to the scripts, then PATH
• Before each folder's deletions the mount is checked again. A refusal stops later deletions in that mapping, and uploads continue
• The mass-deletion guard is off unless configuration turns it on. Thresholds default to 20 items and half the folder

Pull Request #4 (merged) · #8 · #9 · #10 · #11 · #12 (open)

Added Tool.Execution to the official Go SDK so the 2025-11-25 taskSupport field survives a proxy that decodes and re-encodes a tool.

Go • MCP

• tools/list includes execution only for protocol version 2025-11-25. A newer list, an older list, and a list with no negotiated version omit it
• json.Marshal of a tool still includes the field, so a proxy round-trip keeps it
• The registered tool is copied, not mutated, so one server can show the field to a 2025-11-25 session and hide it from a 2026-07-28 session
• Setting the field does not run the tool as a task

Pull Request #1336 (open)

Added the tasks extension's Task type to the official Go SDK, so a task handle can round-trip. Execution stays out: no task methods, and a tool call still does not become a task.

Go • MCP

• Task carries taskId, status, statusMessage, createdAt, lastUpdatedAt, ttlMs, and pollIntervalMs
• A nil ttlMs is sent as JSON null, which the extension defines as unlimited
• Task IDs are generated with crypto/rand. Nothing creates a task yet; tests are the only caller

Pull Request #1335 (draft)

Added watch_workflow_run to actions_get on GitHub's official MCP server, so an agent waits for a workflow run in one call instead of polling.

Go • MCP • GitHub Actions

• The server polls every 10 seconds, sends progress notifications, and stops as soon as the client cancels
• A timeout returns the live status with completed: false. A failed run lists the failed jobs and points to get_job_logs

Pull Request #3406 (open)

Match Ente Auth verification codes to existing Apple Passwords logins in iCloudBridge.

Python • React • TypeScript

• Parses a plain-text Ente Auth export and matches each code to an Apple Passwords login by domain, issuer, and username
• Shows a setup key and QR code for Set Up Verification Code, because Apple's importer does not update a login that already exists
• Skips trashed, HOTP, and Steam codes, and leaves ambiguous matches and logins that already have a different code unchanged

Pull Request #31 (merged)

Referral code support for ExtPay, the payments library for browser extensions (770+ stars).

JavaScript • Browser Extensions • Stripe

• Added extpay.setReferral(code) and extpay.getReferral() to keep a first-touch referral code in extension storage
• Sends the code as ref on the existing payment, trial, login, and API-key requests, with no extra network calls
• Wrote a guide for running a referral program on Stripe promotion codes today
• Specified the server-side attribution, rewards, and abuse checks for extensionpay.com

Pull Request #364 (open)

Contribution to FitDownloader, a Chrome extension for automated multi-file downloads with configurable concurrency.

JavaScript • Chrome Extension • Manifest V3 • File System Access API

• Per-tab destination folders, written through an offscreen document with the File System Access API
• Resolves HTMX landing pages to the direct download link
• Download sessions that survive service worker restarts, with alarms for keep-alive and reconciliation
• Download manager page and a redesigned popup with progress tracking

Pull Request #1 (open) · Branch

Combined input and output devices in one menu for SoundSwitcher, and added locks so Windows does not change the device or the volume.

C# • C++ • Windows

• Lock the Default and Communications roles separately, and lock a device's volume to a chosen level
• The playback helper can set the Default role, the Communications role, or both

Pull Request #102 (open)

Merged pull requests on the Mira Photo frontend and backend.

TypeScript • Expo • Node.js

• A centralized chat engine, one thread per model post, and a real-time seen indicator
• Thumbnails, photographer pagination, and fewer round trips on home and marketplace
• Clerk logout in one place, socket auth refresh on reconnect, and optional auth on public user lookups

Chat engine · Seen indicator · Home prefetch · Socket auth

Software engineering experience spanning:

AI integrations • Backend architecture • Automation • APIs • Cloud infrastructure • Full-stack applications

AI: LLM APIs, Conversational AI, Voice AI, AI Automation, MCP

AI-assisted coding: plans, prompts, reviews, and ships with LLMs daily

Backend: Node.js, Python, REST APIs, OAuth2, JWT, Webhooks, Microservices

Frontend: React, Vue, TypeScript, JavaScript, HTML/CSS, Browser Extensions

Cloud & DevOps: AWS, Docker, CI/CD

Systems & Security: WebSockets, End-to-End Encryption, Cryptographic Protocols, Local Networking

mehdimamas.github.io/my-resume

LinkedIn · GitHub · Website