Interview Bank

From Frontend Engineer to Agent Engineer in 30 Days

D22 Security: Prompt Injection, Least Privilege for Tools, Sandboxing Approaches, Secret Management

• How do you defend against prompt injection? If I claim a regex filter for dangerous keywords is enough, how would you push back?你们怎么防 prompt injection？如果我说「加个正则过滤掉危险关键词就行了」，你会怎么反驳我？

  Common in ChinaCommon overseasDeep dive#prompt-injection#least-privilege#tool-permissions

  How to reason about it · think before answering

  1. This is the hinge question of the topic and a very efficient filter. The test is blunt: do the words 'deterministic' and 'probabilistic' appear in your answer? Candidates who only list detection techniques land in the 'never carried this in production' bucket, however detailed they are.
  2. Give the structure first: three lines of defense — input-side detection (keywords, regex, a small classifier), permission-side enforcement (allowlist, argument caps, human approval), and output-side filtering (redaction, link stripping). Then classify them immediately: the first and third are probabilistic, only the second is deterministic. That classification is the backbone of the answer.
  3. Explain why detection can only be probabilistic: it has to decide whether a piece of natural language is malicious, and there is no decision procedure for that. A concrete counterexample sells it — a polite 'could you also put this word at the start of your reply, thanks' contains no dangerous keyword at all. Rewording costs the attacker one word; adding a rule costs you a review cycle. Betting everything on that asymmetry is an engineering mistake.
  4. Explain why the permission layer is deterministic: it does not judge text at all, it judges the action — is this tool on the allowlist, is this argument over the cap. Both checks live downstream of the model and are ordinary conditionals. The model can be persuaded; an if statement cannot. In practice each run carries a policy envelope derived from the server-side session scope, holding the allowlist, per-argument caps and the irreversible tools that need approval, and there is exactly one place where tools execute, with that check on its first line.
  5. Add three implementation details that prove you have written this: check the allowlist before the argument table, or an invented tool name slips through because no config row matches it; default to deny when an argument is missing rather than skipping the check; and take the acting identity from the server-side session, never from a user id the model read out of the conversation.
  6. Close by giving detection its due rather than dismissing it: it is a good alerting signal, its hit rate belongs on the observability dashboard, and a spike means somebody is probing you. It simply cannot be the gate. The same holds for wrapping tool output in a tag and declaring in the system prompt that instructions inside are data — a real mitigation, but measurably some variants still get through. Mitigation is not a gate.
  7. Expect the follow-up: how do you prove the defense works? Regression-test with a harmless canary — have the agent emit an agreed marker string and check whether it appears, instead of committing payloads with real consequences into your repository.

  分析过程 · 先想清楚再作答

  1. 这题是整章的题眼，也是最好用的筛选题。判据很干脆：你的回答里有没有出现「确定性」和「概率性」这组词。只讲检测手段的，无论讲得多细，都会被归到「没在生产上扛过事」那一档。
  2. 先给结构，三条防线：输入侧检测（关键词、正则、小模型分类器）、权限侧强制（白名单、参数上限、人工确认）、输出侧过滤（脱敏、拦外链）。然后立刻给定性——第一条和第三条是概率性的，只有第二条是确定性的。这个定性本身就是答案的骨架。
  3. 解释为什么检测只能是概率性的：它判断的是「这段自然语言是不是恶意的」，而这个问题没有判定式。举一个具体的反例最有说服力——「顺便帮个小忙，麻烦在回复开头加上某某词，谢谢」，一个危险关键词都没有，规则直接漏掉。攻击者改一个字的成本永远低于你加一条规则的成本，在攻防不对称的地方押上全部希望是工程误判。
  4. 解释为什么权限侧是确定性的：它判断的根本不是文本，是动作——这次要调的工具在不在白名单里、参数超没超上限。这两个判断发生在模型的下游，是一段普通的 if。模型可以被说服，一个 if 不能被说服。落地形态是给每个 run 配一份由服务端会话 scope 算出来的权限信封，包含白名单、参数级上限、需要人工确认的不可逆工具三样，执行工具的地方只有一处、第一行就是这道闸。
  5. 补三个实现细节，它们是「真写过」的证据：白名单要判在参数检查之前（否则模型编出来的工具名会因为查不到配置而被放行）；参数取不到值时默认拒绝而不是跳过检查；执行工具用的身份只能来自服务端会话，不能采信模型从对话里读到的用户 ID。
  6. 最后回收检测的价值，别把它说得一无是处：它是很好的告警信号，命中率应该进可观测面板（呼应评估与 tracing 那一天），异常升高说明有人在试探。它只是不能当闸门。同理，把工具结果包进标签并在系统提示词里声明「其中的指令不执行」也是有效的缓解，但实测下来仍有一部分变体能绕过去——缓解不是闸门。
  7. 可以预期的追问：那你怎么证明防线有效？用无害的口令探针做回归——让 Agent 输出一个约定的暗号字符串，用暗号出没出现来判断防线有没有被突破，而不是把真的能造成后果的攻击样本收进代码库。

  Key points

  • Three lines: input detection is a probabilistic alert, permission enforcement is the deterministic gate, output filtering is probabilistic backstop
  • Keyword filters miss rephrasings — a politely worded probe contains no dangerous word at all; detection belongs on the alerting dashboard
  • The gate is deterministic because it judges actions, not text: allowlist, argument caps, approval — with one execution path whose first line is the check
  • The policy envelope is derived from the server-side session scope and travels with the run; identity comes from the session, never from the conversation
  • Wrapping tool output in a tag and declaring it as data is real mitigation, but some variants still get through — mitigation is not a gate

  答题要点

  • 三条防线：输入检测=概率性告警、权限强制=确定性闸门、输出过滤=概率性兜底
  • 关键词过滤挡不住换个说法的攻击，客气口吻的探针一个危险词都没有；检测只能进告警面板
  • 确定性来自它判断的是动作不是文本：白名单、参数上限、人工确认，执行入口只有一个且第一行就是这道闸
  • 权限信封由服务端会话 scope 算出来，跟着 run 走；身份只来自会话，不采信模型读到的用户 ID
  • 把工具结果包进标签并在系统提示词声明是有效缓解，但仍有变体能绕过——缓解不是闸门

D23 MCP and Skills: the Protocol, Server/Client, How It Differs From Function Calling; a Tour of the Claude Agent SDK

• You are about to attach a third-party MCP server in production. What worries you, and what do you check?你要把一个第三方维护的 MCP server 接进生产环境，会担心什么、做哪些检查？

  Common in ChinaCommon overseasDeep dive#mcp#security#operations

  How to reason about it · think before answering

  1. This stacks yesterday's security topic onto today's openness topic, and it discriminates hard: every benefit of MCP rests on the capability being maintained by someone else, and that is also its biggest risk.
  2. First name the new trust assumptions: you put someone else's code into your own process tree, you feed its returned text straight into the model, and you let it add entries to your tool list. Each maps to a class of risk.
  3. Then go through the checks. Execution: the server is a process that runs, so constrain which files it can read, whether it has network access, its timeout and the identity it runs as — the least-privilege and sandbox story from yesterday. Data: treat everything it returns as untrusted input, which is exactly the indirect-injection scenario where instructions hide in a field of a tool result. Tool output is never instructions, and the permission gate must live in your process and fire before the call.
  4. Third, governance, the part most people miss: the tool list can change at runtime — one listChanged notification and a new tool appears. So pin your allowlist by tool name, keep newly appearing tools out of the model's list until a human approves, and pin the server version instead of tracking upstream latest.
  5. Fourth, availability and cost: this is a new external dependency. If it is down your agent silently loses a set of capabilities, so you need timeouts, graceful degradation (tell the model the capability is temporarily unavailable rather than failing the whole turn), and its calls on your observability dashboard.
  6. Expect the follow-up: how do you decide it is worth attaching at all? Back to the three criteria — if only one host uses it and you could implement it yourself, you are taking third-party risk with no matching benefit.

  分析过程 · 先想清楚再作答

  1. 这题是把昨天的安全和今天的开放性叠在一起考，区分度极高：接 MCP 的全部好处，都建立在「能力由别人维护」这一点上，而这一点同时就是它最大的风险。
  2. 第一层想清楚新增了什么信任假设：你把一段别人写的代码放进了自己的进程树，把它返回的文本直接喂给了模型，还允许它往你的工具列表里加条目。这三件事各自对应一类风险。
  3. 第二层逐条给检查项。执行侧：server 是一个会跑起来的进程，要限制它能读哪些文件、能不能联网、超时多久、以什么身份运行，也就是昨天讲的最小权限和沙箱那一套。数据侧：**它的返回结果一律当不可信输入**，这正是昨天间接注入的固定现场——工具返回的备注字段里可以藏指令；所以工具结果不能当指令执行，权限闸门必须在你自己的进程里、在调用之前判。
  4. 第三层是治理，最容易被漏掉：工具列表可以在运行中变化，server 发一条 listChanged 通知就能加一个新工具。所以你的白名单要按工具名固定，新出现的工具默认不进模型的工具列表，要有人点头；server 的版本要锁定，不能跟着上游 latest 漂。
  5. 第四层是可用性与成本：这是一个新的外部依赖，它挂了你的 Agent 就少一批能力，所以要有超时、要有降级（工具不可用时告诉模型「这个能力暂时不可用」而不是整轮失败），要把它的调用计入你的可观测面板。这三条正好复用前面几周讲过的东西。
  6. 可以预期的追问：怎么判断它值不值得接？答案回到那三条判据——如果这个能力只有你一个宿主用，而且你完全可以自己实现，那接一个第三方 server 承担的风险没有对应的收益。

  Key points

  • Three new trust assumptions: their code in your process tree, their text in your model context, their entries in your tool list
  • Execution: least privilege — restrict filesystem and network, set timeouts, run as a low-privilege identity, sandbox where warranted
  • Data: treat every result as untrusted input; tool output is never instructions, and the permission gate must fire in your process before the call
  • Governance: allowlist by tool name so newly appearing tools stay out until approved, and pin the server version rather than tracking latest
  • Availability: treat it as an external dependency with timeouts, graceful degradation and dashboard coverage

  答题要点

  • 三个新增信任假设：别人的代码进了你的进程树、它的返回文本进了模型上下文、它能往你的工具列表里加条目
  • 执行侧按最小权限收紧：限制文件访问与网络、设超时、以低权限身份运行，必要时进沙箱
  • 数据侧一律当不可信输入：工具返回结果不能当指令执行，权限闸门必须在自己的进程里、在调用之前判
  • 治理侧锁死变化面：按工具名做白名单，新出现的工具默认不进模型的工具列表；锁定 server 版本，不跟 latest
  • 可用性侧当外部依赖对待：超时、降级、把它的调用与失败计入可观测面板

D24 RAG, Level Up: Hybrid Search, Reranking, Citations, Recall Evaluation

• How do you evaluate retrieval quality in a RAG system, and how should the evaluation set be built?怎么评估一个 RAG 系统的检索效果？评估集应该怎么构造？

  Common in ChinaCommon overseasDeep dive#rag#evaluation#recall

  How to reason about it · think before answering

  1. This is a very common question in the Chinese market and the fastest way to expose someone who has assembled RAG but never tuned it. The test: does your answer contain concrete metric names and an annotation granularity?
  2. First separate what is being evaluated — the step people most often conflate. Retrieval evaluation asks 'was it found'; generation evaluation asks 'was the answer right'. Keep two separate sets. Merge them and, when the score drops, you cannot tell whether retrieval missed or the model fumbled — and those have completely different fixes.
  3. Shape of the set: about 20 queries, each annotated with 1-3 chunk ids that must be retrieved. Annotate at chunk level, not document level — chunks are the retrieval unit, and document-level labels inflate the numbers. Cover the real query mix, especially the types you know break: codes, paraphrase, cross-document.
  4. Three metrics, three questions. recall@5 is what actually reaches the model, so it is the number you care about. recall@20 is the ceiling — if it does not move, the problem is on the recall side and no reranker will save you. MRR is sensitive to ordering and breaks ties when recall is equal.
  5. Production view: freeze the set once agreed, because changing samples destroys comparability — the same reason a factory keeps fixed reference samples. Pair it with online counterparts (empty-citation rate, hallucinated-citation rate, escalation rate), since passing offline does not mean passing in production.
  6. Expected follow-up: is 20 enough given the labelling cost? Not for statistical significance, but enough for regression — its job is to stop retrieval silently getting worse. Scale up before you settle an A/B, and grow it from failure cases rather than random additions.

  分析过程 · 先想清楚再作答

  1. 这题是国内面试的极高频题，也是最容易暴露「只搭过没调过」的一题。判据很简单：你的回答里有没有出现**具体的指标名和标注粒度**，没有就是没做过。
  2. 先把评估对象分清楚——这是最容易混的一步：**检索评估问「找得到找不到」，生成评估问「答得对不对」**。两套评估集要分开维护。混成一套的后果是分数掉了你分不清是检索漏了还是模型答砸了，而这两件事的修法完全不同。
  3. 评估集的形状：20 条左右的 query，每条**人工标注 1 到 3 个必须召回的 chunkId**。注意标注粒度是**块**不是文档——检索的单位就是块，标到文档级会让指标虚高。query 要覆盖真实分布，尤其要包含那些你知道会翻车的类型（编号、同义改写、跨文档）。
  4. 三个指标各回答一个问题：recall@5 是「进上下文的那几条覆盖了多少」，也就是你真正关心的数；recall@20 是天花板，它上不去说明问题在召回侧、重排再强也没用；MRR 对排序质量敏感，recall 打平时用它分高下。
  5. 生产视角：评估集一旦定下来就要冻结，换了样本分数就没有可比性——这和产线质检必须用固定的标准样品是同一个道理。同时线上要有对照指标（引用为空率、幻觉引用率、转人工率），因为离线过了不等于线上没事。
  6. 可预期的追问：标注成本这么高，20 条够吗？答：20 条不够做统计显著性，但足够做**回归**——它的作用是「改了检索之后别悄悄变差」。要做 A/B 定论再上规模，而且优先扩充失败案例，不是随机加样本。

  Key points

  • Retrieval and generation evaluation are two separate sets: 'was it found' versus 'was the answer right'.
  • Around 20 queries, each labelled with 1-3 chunk ids that must be retrieved — chunk level, not document level.
  • recall@5 is what the model actually sees, recall@20 is the ceiling, MRR measures ordering quality.
  • Freeze the set once agreed or scores stop being comparable; pair it with online empty-citation and hallucinated-citation rates.
  • Twenty cases is a regression guard, not a significance test; grow it from failure cases, not random samples.

  答题要点

  • 检索评估和生成评估是两套：前者问「找得到找不到」，后者问「答得对不对」，分开维护。
  • 评估集是 20 条左右的 query，每条人工标 1 到 3 个必须召回的 chunkId——标到块级，不是文档级。
  • recall@5 是真正关心的数（模型只看得到这几条），recall@20 是天花板，MRR 衡量排序质量。
  • 评估集一旦定下来就冻结，否则分数没有可比性；线上再配引用为空率、幻觉引用率做对照。
  • 20 条不够做显著性但够做回归；扩充时优先补失败案例，不是随机加样本。

D25 The Frontend Agent Experience: Streaming Rendering, Visualizing Tool Calls, Interrupt/Retry, SSE Hooks

• The user hits Stop and the frontend calls AbortController.abort(). What is the backend doing at that moment?用户点了「停止生成」，前端调用 AbortController.abort() 之后，后端在做什么？

  Common in ChinaCommon overseasDeep dive#streaming#cancellation#cost

  How to reason about it · think before answering

  1. This is the core question of the chapter and a deliberate trap: the prompt states the abort as a given and waits for you to say 'so it stopped'. Saying that ends the conversation.
  2. The correct answer in one line: the backend knows nothing and is still running — still calling the model, still writing messages, still billing tokens. abort only stops your end from reading; at most it drops the TCP connection, and whether the backend notices, or acts on noticing, is a separate matter.
  3. Decompose by drawing who knows what: the user knows, the frontend knows, the chain breaks, the backend does not know. That broken link must be closed with an explicit request: POST /runs/:id/cancel. So stopping is two steps, not one.
  4. A quantified contrast lands best: on the same 70-character reply interrupted at character 5, the two-step version stops the backend at 5/70 while abort-only runs to 70/70. That is 14x the tokens, and those 65 characters also land in conversation history and get resent as context next turn, billing you twice.
  5. Production addendum: on cancel, do not hard-kill. Move the run to a cancelled state and let the current step finish, or you leave half-written messages and gaps in the sequence numbers. Also make cancel idempotent, because you will retry it when the network flakes.
  6. Expected follow-up: can the backend just detect the dropped connection and stop by itself? It can and should, as a safety net, but not as the only mechanism. Proxies and load balancers often hold connections open, so detection can lag by tens of seconds, and if the client auto-reconnects the connection never drops at all. The net is a net; the explicit cancel is the main path.

  分析过程 · 先想清楚再作答

  1. 这题是本章题眼，也是一道**陷阱题**：题干里已经把「前端 abort 了」当成既成事实，等你顺着说「那就停了」。答「停了」的直接出局。
  2. 正确答案一句话：**后端什么都不知道，它还在跑。** 还在调模型、还在往库里写消息、还在按 token 计费。`abort` 只是让你这一端不再读了，它顶多让 TCP 连接断开，而后端是否感知得到连接断开、感知到之后做不做事，是另一回事。
  3. 怎么拆：把「谁知道这件事」画出来。用户知道 → 前端知道 → **中间断了** → 后端不知道。断掉的这一环必须用一个显式的请求补上：`POST /runs/:id/cancel`。所以打断是两步，不是一步。
  4. 给一个量化的对照最有说服力：同一段 70 个字的回复，在第 5 个字打断——两步打断的后端停在 5/70，只 abort 的后端照跑到 70/70。差 14 倍的 token，而且那 65 个字还会落进会话历史，下一轮当上下文重新发一遍，付第二遍钱。
  5. 生产视角的补充：cancel 收到之后**不要硬杀**，把 run 迁到 cancelled 状态、让当前这一步跑完再退出——硬杀会留下半写的消息和对不上的序号。而且 cancel 本身必须幂等，因为网络抖动时你会重试它。
  6. 可预期的追问：那能不能靠后端检测连接断开来自动停？可以做，而且应该做（作为兜底），但不能只靠它——反向代理和负载均衡常常会把连接维持一段时间，后端感知到断开可能已经是十几秒之后；而且用户点停止之后如果自动重连，连接根本没断。**兜底归兜底，显式 cancel 才是主路径。**

  Key points

  • The backend has no idea: still calling the model, still writing, still billing. abort only stops your side reading.
  • Stopping is two steps: abort for instant UI response, plus POST /runs/:id/cancel to actually halt the run.
  • Quantified: interrupting the same 70-character reply at character 5 gives 5/70 with both steps versus 70/70 with abort alone.
  • On cancel, transition the run to cancelled and let the current step finish rather than hard-killing; make cancel idempotent.
  • Backend disconnect detection is only a safety net — proxies hold connections open and auto-reconnect means no disconnect at all.

  答题要点

  • 后端完全不知情：还在调模型、还在写库、还在计费。abort 只让前端这一端停止读取。
  • 打断必须两步：abort（界面立刻响应）+ POST /runs/:id/cancel（后端真的停）。
  • 量化差别：同一段 70 字的回复在第 5 个字打断，两步是 5/70，只 abort 是 70/70。
  • 后端收到 cancel 不要硬杀，迁到 cancelled 状态让当前步跑完；cancel 必须幂等。
  • 靠后端检测连接断开只能当兜底：代理会维持连接、自动重连时连接根本没断。

D26 System Design Deep Dive: Agent Platforms / Customer-Support Agents / Multi-Tenancy / Cost Control

• System design: design an e-commerce customer support agent. It looks up orders and shipments, drafts refunds by policy, answers product and policy questions, and escalates to a human when it cannot resolve the issue.系统设计：请设计一个电商客服 Agent。它要能查订单和物流、按规则拟退款方案、回答商品与政策问题，并在搞不定时转人工。

  Common in ChinaCommon overseasDeep dive#system-design#customer-support#escalation

  How to reason about it · think before answering

  1. Start by separating this from 'design an agent platform', or you will answer an infrastructure question. The platform question is about running execution reliably; this one is about not trapping users inside a bot. The rubric lives in the business exits, not the message bus. So pin the thesis in your first sentence: every conversation must end in exactly one of three exits — self-served, handed to a human, or filed as a ticket.
  2. Clarify for 5 minutes, asking four things: daily actives and concurrent sessions (does execution need to be split out), whether human agents work nights (does exit three exist), whether the agent executes refunds or only drafts them (do you need an approval tier), and how large the knowledge base is and how often it changes (is retrieval the centre of this problem). The third question matters most: it decides whether this system has irreversible side effects.
  3. Estimate for 3 minutes, out loud: 2000 input plus 500 output per turn, input is 2000 over a million times $0.15 which is $0.0003, output is 500 over a million times $0.60 which is also $0.0003, so about $0.0006 per turn. 10k daily actives at five turns is 50k turns, roughly $30 a day and $900 a month in model spend, machines excluded. For concurrency, a peak factor of 3 and 6 seconds per turn gives about 11 in-flight executions at peak, which is 3 worker replicas at 4 concurrent each. State the arithmetic before the result — the interviewer's next line is always 'where did that number come from'.
  4. Sketch for 8 minutes, four blocks: ingress does auth, rate limiting, persistence and publish, then returns immediately; execution pulls from the bus, runs the agent loop, and streams sequenced fragments back; storage is sessions, runs and messages plus a chunk table for the knowledge base; observability is tracing plus a cost ledger. Then mark on the diagram which node decides between the three exits — that single annotation tells the interviewer you are answering the support question rather than the generic platform one.
  5. Go deep for 15 minutes, starting with escalation because that is the crux. The criteria must be quantified, any one of four triggering a handoff: two consecutive unresolved turns, an explicit user request, an amount above the auto-execution ceiling (50 CNY in our setup), or a sentiment keyword hit. Then describe the handoff payload: not forty turns of raw transcript, but a structured summary — the user's ask in one line, verified facts, actions already taken, and the failure reason, with a link to the full transcript. Cover the knowledge base in one line (hybrid search, rerank, inline citations) and spend the weight on 'when the citation set comes back empty, take exit two or three rather than letting the model invent an answer' — that is the sentence they will push on. Cover multi-turn in one line too: compress once history passes 70% of budget, cut on a turn boundary, and merge a change of mind within 30 seconds into the same execution.
  6. Trade-offs for 5 minutes, three points: bias the escalation threshold toward escalating, because a false handoff costs one human conversation while trapping a user costs a churned customer and a bad review — different orders of magnitude. Drafting refunds instead of executing them trades one human approval for an entire class of irreversible incidents. And name what breaks the design: once the agent team is large enough to need skill-based routing and queueing, escalation stops being a boolean and becomes its own scheduling system.
  7. Expect, in rough order: does 'I want to file a complaint' count as a sentiment hit (yes, and track that class separately — it is a product signal); should the agent keep listening after handoff (yes, to summarise and prompt the human, but not to speak); how do you stop users being bounced repeatedly (allow one handoff per conversation, then file a ticket); and what happens to old answers when the knowledge base changes (cite chunk ids and versions so you can trace which revision was wrong).

  分析过程 · 先想清楚再作答

  1. 先说这题和「设计一个 Agent 平台」的区别，否则你会把它答成一道基础设施题。平台题考的是怎么把执行跑稳，这题考的是**怎么保证不把用户困在机器人里**——面试官心里的评分点在业务出口上，不在消息总线上。所以主线要一开口就钉死：任何一通会话最后只能落到三条出口之一，自助解决、转人工、留工单。
  2. 第一步澄清 5 分钟，问四件事：日活与并发会话数（决定要不要拆执行层）、人工坐席有没有夜班（决定出口三存不存在）、退款是 Agent 直接执行还是只拟方案（决定要不要人工确认档）、知识库有多大且多久更新一次（决定检索是不是本题的重点）。第三个问题尤其关键，它直接决定这道题是不是带副作用。
  3. 第二步估算 3 分钟，现场算：单轮 2000 输入加 500 输出，输入 2000 除以一百万乘 0.15 等于 0.0003 美元，输出 500 除以一百万乘 0.60 也等于 0.0003 美元，一轮约 0.0006 美元；日活 1 万、人均 5 轮就是 5 万轮，一天约 30 美元、一个月约 900 美元，模型费不含机器。并发按峰谷比 3、单轮 6 秒算，峰值在途约 11 次执行，每个 worker 并发 4 就是 3 个副本。报数字之前先报算式，面试官插的那句一定是「这个数怎么来的」。
  4. 第三步草图 8 分钟，四块：接入层只做鉴权、限流、落库、投递并立刻返回；执行层从消息总线取活跑 Agent 循环、片段带序号回传；存储是会话、执行、消息三张表加一张知识库切块表；可观测是 tracing 加成本台账。在这张图上额外标出三条出口的分叉点在哪一个节点上——这是本题独有的一笔，画上去面试官立刻知道你答的是客服而不是通用平台。
  5. 第四步深入 15 分钟，优先讲转人工这一支，因为它是本题的题眼。判据必须量化，四条任一命中就转：连续 2 轮未解决、用户明确要求、涉及金额超过自动执行上限（本课口径 50 元）、情绪词命中。接着讲交接形状——不是把 40 轮原文丢给客服，而是一段结构化摘要：用户诉求一句、已核实事实几条、Agent 已做过的动作、失败原因，附原始对话链接。知识库那一支一句话带过混合检索加重排加引用，重点落在「引用为空时走出口二或三，而不是让模型编一个答案」，这是最容易被追的一句。多轮那一支同样一句话：历史超七成预算触发压缩且切口对齐到一轮开头，用户中途改口则 30 秒内合并进同一次执行。
  6. 第五步权衡 5 分钟，说三件事：转人工的判据宁可偏松，因为误转的代价是一次人工会话，把用户困住的代价是一个流失客户加一条差评，两者不在一个量级；退款只拟方案不直接执行，是拿一次人工点头换掉一整类不可逆事故；以及什么规模会推翻这个设计——坐席团队大到需要技能路由和排队策略时，转人工就不再是一个布尔判断，而是另一套调度系统。
  7. 可以预期的追问，按频率排：用户说「我要投诉」算不算情绪词命中（算，且这一类要单独统计，它是产品问题的信号）；转人工之后 Agent 还要不要继续在旁边听（要，用来生成小结和给坐席提示，但不允许再发言）；怎么防止用户被反复转来转去（同一通会话只允许转一次，第二次直接留工单）；以及知识库更新后旧答案怎么办（回答里带引用编号和版本，出问题能倒查是哪一版说错的）。

  Key points

  • Thesis: every conversation ends in exactly one of three exits — self-served, escalated to a human, or filed as a ticket
  • Clarify four things: concurrent sessions, whether humans cover nights, whether refunds are executed or only drafted, and knowledge base size and churn
  • Estimate with arithmetic: about $0.0006 per turn, so 10k DAU at five turns is roughly $30/day and $900/month; peak concurrency about 11, meaning 3 worker replicas
  • Quantify escalation: two consecutive unresolved turns, an explicit request, an amount over the auto-execution ceiling, or a sentiment keyword
  • Hand over a structured summary — ask, verified facts, actions taken, failure reason — plus a transcript link, not forty raw turns
  • When retrieval returns no citations, take exit two or three instead of letting the model improvise; answers carry citation ids
  • Reuse compression and 30-second merge for multi-turn; draft refunds rather than executing them, trading one approval for a class of irreversible incidents
  • Trade-off: bias toward escalating, because a false handoff and a trapped user cost different orders of magnitude

  答题要点

  • 主线一句话：任何一通会话只能落到三条出口之一——自助解决、转人工、留工单
  • 澄清必问四件事：并发会话数、人工有没有夜班、退款是执行还是只拟方案、知识库规模与更新频率
  • 估算带算式：单轮约 0.0006 美元，日活 1 万人均 5 轮约 30 美元一天、900 美元一月；峰值并发约 11、3 个 worker 副本
  • 转人工判据必须量化，四条任一命中：连续 2 轮未解决、用户明确要求、金额超自动执行上限、情绪词命中
  • 交接给人工的是结构化摘要（诉求、已核实事实、已做动作、失败原因）加原始对话链接，不是 40 轮原文
  • 知识库检索不到时走出口二或三，绝不让模型自由发挥编答案；回答带引用编号
  • 多轮沿用压缩与 30 秒打断合并，退款只拟方案不直接执行，用一次人工点头换掉一类不可逆事故
  • 权衡：判据宁可偏松，因为误转和困住用户的代价不在一个量级

D27 Resume and Project Packaging: STAR, README, Architecture Diagrams, a Demo Video, an English Resume

• Tell me about the most challenging project you have worked on. What made it hard?讲讲你做过的最有挑战的一个项目，难在哪里？

  Common in ChinaCommon overseasDeep dive#behavioral#project-storytelling

  How to reason about it · think before answering

  1. The hinge is the word 'challenging', and almost everyone falls into the same trap: treating 'a lot of work' as a challenge. Three months of overtime proves stamina, not judgment. The interviewer wants to see how you decide under incomplete information.
  2. Pick the story first, because it caps everything after it: choose the project where you can name what you gave up. Hard test — if your answer is only 'I did A and it worked', with no 'I chose A over B and paid C for it', pick a different project.
  3. Order the answer as difficulty, decision, cost, outcome — not chronologically. Chronology drags the listener through a diary; leading with the difficulty pins their attention on the first sentence. 'With three replicas consuming in parallel, one user's messages arrived out of order' beats 'the project started in March'.
  4. When describing the difficulty, explain why it could not be solved by reading the docs. Real challenges carry conflicting constraints: parallel replicas for throughput versus strict per-user ordering. Surfacing that conflict is what makes the difficulty credible.
  5. Do not end on pure success. Volunteer one sentence on what you would change today — this is the highest-signal line available on this question, because it shows you kept thinking after shipping.
  6. Expect: 'did you consider alternatives?' It is nearly guaranteed, so prepare the option you rejected and an engineering reason for rejecting it — latency, cost, operational load — never 'it just felt wrong'.

  分析过程 · 先想清楚再作答

  1. 这题的题眼在「挑战」这两个字上，而它有一个几乎所有人都会踩的陷阱：把「工作量大」当成挑战。加了三个月班、写了两万行代码，这些证明的是耐力，不是判断力。面试官想看的是你在信息不足的情况下怎么做决定。
  2. 先做选题，这一步决定了后面的天花板：选那个**你能说出「我放弃了什么」**的项目。判据很硬——如果你的答案里只有「我做了 A，效果很好」，没有「我在 A 和 B 之间选了 A，代价是 C」，那这个项目就不适合回答这道题，换一个。
  3. 组织顺序建议用「困难 → 我的判断 → 代价 → 结果」，而不是时间顺序。时间顺序会把听众拖进流水账；从困难切入，第一句话就把对方的注意力钉住了。比如「三个副本同时消费的时候，同一个用户的消息顺序会乱」，比「这个项目是三月份开始的」有效得多。
  4. 描述困难时要给出「为什么这不是查一下文档就能解决的」。真正的挑战都带着约束冲突：既要多副本并行提高吞吐，又要同一用户严格保序——这两个诉求天然打架，所以才需要设计而不是查资料。把这层冲突讲出来，难度就立住了。
  5. 结果那部分不要只报成功。**主动说一句「现在回头看，我会改哪里」**，这是这道题上区分度最大的一句话。它表明你在项目结束之后还继续想过这件事，而不是交付完就翻篇了。
  6. 可以预期的追问：「当时有没有考虑过别的方案？」这几乎是必问。所以准备答案时要备好那个被你放弃的方案，以及放弃它的具体理由——理由要是工程性的（延迟、成本、运维复杂度），不能是「感觉那样不好」。

  Key points

  • Challenge means judgment, not volume — overtime and lines of code are not difficulty
  • Pick a story where you can say 'I chose A over B and paid C for it'
  • Structure it as difficulty, decision, cost, outcome — never as a chronological diary
  • Name the conflicting constraints (parallel replicas versus strict per-user ordering) to make the difficulty real
  • Close with what you would change today, and have the rejected alternative plus an engineering reason ready

  答题要点

  • 挑战 = 判断力，不是工作量；别拿加班和代码行数当难度
  • 选题判据：这个项目你能说出「我在 A 和 B 之间选了 A，代价是 C」
  • 按「困难 → 判断 → 代价 → 结果」组织，不要按时间顺序讲流水账
  • 把约束冲突讲出来（比如既要多副本并行、又要同一用户保序），难度才立得住
  • 结尾主动说「现在回头看我会改哪里」，并备好那个被放弃的方案和工程性的理由

D29 Shoring Up Weak Points + a Coding Warm-Up: Rate Limiter, LRU, Concurrency Control, Streaming JSON Parsing

• Why can't you just call JSON.parse in a streaming response, and how would you parse incrementally?为什么流式场景下不能直接用 JSON.parse？你会怎么做增量解析？

  Common in ChinaCommon overseasDeep dive#streaming#json-parsing

  How to reason about it · think before answering

  1. Almost all the signal is in your first sentence. Whoever starts writing a state machine will spend twenty-plus minutes on something probably buggy; whoever first asks 'is it one complete JSON per line, or one big object split across chunks?' has already won half the question.
  2. Answer the why first: network chunking ignores syntax boundaries, so a single read often holds half a JSON document. Handing that to a parser only throws, and the exception carries nothing you can recover from.
  3. Then draw the distinction. Case (a) is SSE: each event is one line prefixed with data, holding one complete JSON object. This covers 99% of LLM work, and the fix is line buffering plus per-line parsing — keep the trailing fragment in the buffer and stitch it onto the next chunk.
  4. Case (b) — one large object arriving in pieces — is the only case needing real incremental parsing, and it rests on three state variables: bracket depth (back to zero means a complete object), whether you are inside a string (brackets in text must not count), and whether the previous character was a backslash (an escaped quote must not toggle string state). Drop any one and text containing brackets breaks the depth count.
  5. One trap almost nobody volunteers: chunks are split on bytes, and a CJK character takes three bytes in UTF-8, so a boundary can land mid-character. Use a streaming decoder — TextDecoder with the stream option, an incremental decoder in Python, InputStreamReader in Java — or you get a replacement character you can never recover. It is the half-line problem one layer down.
  6. Expect the follow-up: what about the terminator line? It is not JSON, so check for it and return before parsing. Feeding it to the parser is the single most common one-line bug in this question.

  分析过程 · 先想清楚再作答

  1. 这题的区分度几乎全在你开口的第一句话。听到「流式 JSON 解析」就动手写状态机的人，会花二十多分钟写一个大概率有 bug 的东西；先反问一句「是一行一个完整 JSON，还是一个大对象被切成很多片」的人，已经赢了一半。
  2. 先回答为什么不能直接解析：网络分包不认语法边界，一次读取拿到的很可能是半个 JSON。直接扔给解析器只会抛异常，而且这个异常没有任何可恢复的信息。
  3. 然后做那个关键区分。情况 a 是 SSE：每条事件是一行以 data 开头的文本，行内是完整 JSON，LLM 场景 99% 是这一种，解法是行缓冲加逐行解析，二十行代码——把切分出来的最后一段（可能是半行）留在缓冲区里，等下一次读到更多数据再拼。情况 b 是单个大对象跨分片到达，才需要真正的增量解析。
  4. 情况 b 的核心是三个状态变量：括号深度（深度归零说明一个完整对象结束）、是否在字符串内部（字符串里的括号不能计入深度）、前一个字符是不是反斜杠（转义中的引号不切换字符串状态）。三者缺一不可，少一个遇到含括号的文本就算错深度。
  5. 还有一条几乎没人主动说、但一说就加分的坑：分片是按字节切的，一个汉字在 UTF-8 里占三个字节，边界可能落在中间。必须用流式解码器（TextDecoder 的 stream 选项、Python 的增量解码器、Java 的 InputStreamReader），否则会拿到一个永远补不回来的乱码字符。这是「半行缓冲」在字节层的同款问题。
  6. 可以预期的追问：那结尾那个终止标记怎么办？答案是它不是 JSON，必须在解析前先判断并直接返回，拿它去解析必然抛异常——这是这道题里最常见的一行 bug。

  Key points

  • Network chunking ignores syntax boundaries, so a read can hold half a document; parsing it throws an unrecoverable error
  • Ask which case it is first: one complete JSON per line (SSE, the overwhelming majority of LLM work) or one large object split across chunks
  • The first case only needs line buffering plus per-line parsing, keeping the trailing partial line for the next chunk
  • Only the second case needs a state machine, tracking bracket depth, inside-string, and escaped-previous-character
  • One layer down, a multi-byte UTF-8 character can be split across chunks, so use a streaming decoder; and the terminator line is not JSON, so check for it before parsing

  答题要点

  • 网络分包不认语法边界，一次读取可能拿到半个 JSON，直接解析必然抛异常且不可恢复
  • 先问清是哪一种：一行一个完整 JSON（SSE，占 LLM 场景的绝大多数）还是一个大对象跨分片到达
  • 前者只需行缓冲加逐行解析：把最后一段可能的半行留在缓冲区，等下一次读到更多数据再拼
  • 后者才需要状态机，核心是括号深度、是否在字符串内部、前一个字符是否为转义反斜杠三个状态
  • 字节层还有一个同款坑：UTF-8 多字节字符可能被分片切开，必须用流式解码器；结尾的终止标记不是 JSON，解析前要先判断

D30 Full Retrospective and Application Kickoff: a Complete Pass Over the Interview Bank, a Knowledge Map, Month-Two Application Cadence, Public Launch of the Site

• Walk me through what you have been working on recently and why you moved toward agent engineering, in three to five minutes.用 3 到 5 分钟讲一下你最近这段时间的成长路径，以及为什么转向 Agent 工程。

  Common in ChinaCommon overseasDeep dive#self-introduction#storytelling

  How to reason about it · think before answering

  1. This opens almost every interview and it is the one question you can fully pre-write. It tests selection, not history: three minutes cannot hold a month, so which three things you pick reveals what you think matters. A week-by-week recital is the common failure — it hands the judgment back to the interviewer.
  2. Structure it as origin, turn, evidence, direction. Origin: one sentence on where you were and what capped you. Turn: the concrete problem that pushed you toward agents, not 'I believe in the space'. Evidence: whichever of your projects maps best onto this role, framed as an engineering problem you solved. Direction: the kind of team and problem you want next.
  3. The evidence part has a hard requirement: give something checkable. A repository link, numbers you measured yourself, and the conditions you measured them under. 'I built an agent platform' and 'I split gateway from worker behind a message bus, and with three local replicas, killing the lease holder lets another worker take over once the lease expires' differ by an order of magnitude in credibility.
  4. Hold the integrity line yourself: these are learning projects, say so, and attach measurement conditions to every number (single machine, mock mode). Never present them as company work or quote scale you never ran — two follow-up questions expose it, and that kind of exposure is unrecoverable.
  5. Common mistake: spending the three minutes on technical depth. The opener's job is not to explain anything fully, it is to shape which threads the interviewer pulls over the next forty minutes — so end each part on a deliberate hook, such as 'lease renewal had to be atomic, which took a script', and stop there.
  6. Expect the follow-up: why not stay on your previous track? Answer with a concrete blocker you kept hitting, not with industry trends. Everyone can recite a trend; naming a specific problem shows you reasoned your way here.

  分析过程 · 先想清楚再作答

  1. 这是几乎每场面试的第一题，也是唯一一道你能完全预写的题。它考的不是经历，是**取舍**：3 分钟装不下一个月，你选了讲哪三件事，直接暴露你认为什么重要。流水账式的「第一周我学了……第二周我学了……」是最常见的失败，它把判断权交回给了面试官。
  2. 怎么拆：套一条「起点 - 转折 - 证据 - 去向」的四段结构。起点一句话说清你原来的位置和它的天花板；转折说清是什么具体问题把你推向 Agent，不要用「看好这个方向」这种空话；证据是三个产出物中最能对上这个岗位的那一个，讲清楚它解决了什么工程问题；去向说清你想在什么样的团队继续解决什么问题。
  3. 证据那一段有个硬要求：**给出可被验证的东西**。仓库链接、你实测出来的数字、以及数字的测量条件。同一句话讲成「做了一个 Agent 平台」和讲成「gateway 和 worker 拆开、用消息总线解耦，本地三副本下杀掉持有租约的 worker，另一个能在租约到期后接手」，可信度差一个量级。
  4. 红线要自己守住：这三个是学习项目，说的时候就要说明是个人项目，数字要带测量条件（本地单机、模拟模式压测）。**不要把它讲成公司经历，也不要报没跑过的规模数**——面试官追问两句就穿帮，而且是不可挽回的那种。
  5. 常见误区：把这 3 分钟用来讲技术细节。开场白的目标不是讲透任何东西，是让面试官在后面 40 分钟里想问哪几个点——所以每段末尾都要故意留一个可追问的钩子，比如「租约续约那里我们用了一个脚本保证原子性」，停在这儿别展开。
  6. 可预期的追问：为什么不是继续做原来的方向？答案要落到具体问题上（原来的场景里你反复遇到什么做不了的事），而不是行业趋势——讲趋势的人到处都是，讲具体问题的人显得是自己想清楚的。

  Key points

  • Build the three minutes from origin, turn, evidence and direction — never a week-by-week recital
  • Ground the turn in one concrete thing you could not do before, not in a belief about the market
  • Make the evidence checkable: repository links, numbers you measured, and the conditions behind them
  • State plainly that these are personal learning projects; never dress them as company work or quote unmeasured scale
  • End each part on a deliberate hook so the next forty minutes land where you are strongest

  答题要点

  • 用「起点 - 转折 - 证据 - 去向」四段撑起 3 分钟，不要按周流水账
  • 转折要落到一个具体的做不了的问题上，而不是「看好这个方向」
  • 证据段给可验证的东西：仓库链接、自己实测的数字、以及测量条件
  • 明确说明这是个人学习项目，绝不包装成公司经历、绝不报没跑过的规模
  • 每段末尾留一个可追问的钩子，把后面 40 分钟引到你准备最充分的地方