WhatsApp AI 接待助理發佈前修復 3 個問題

My WhatsApp AI receptionist answered pricing questions, booked appointments, and handed off to a human.

The demo worked. Then a production review exposed three bugs in its knowledge pipeline: CSV/PDF/URL → chunks → Postgres.

1. Re-uploading erased unchanged facts

Deduplication compared incoming chunks against the previous version. Unchanged chunks were discarded as duplicates—then deleted when the old version was replaced.

A 10% update left just 10% of the knowledge. No error. Just missing answers.

Fix: Identify the previous version before deduping, exclude its chunks from the comparison, and replace it in one transaction. Add a regression test.

2. Two workers could claim the same job

A SELECT followed by an UPDATE let two workers pick the same pending source.

Fix: Claim it atomically:

UPDATE knowledge_sources
SET status = 'processing'
WHERE id = $1
  AND status = 'pending'
RETURNING *;

No returned row means no claim. That worker skips ingestion.

3. Website imports opened an SSRF path

A submitted URL could send the server to localhost, internal services, or cloud metadata—including through redirects.

Fix: Add URL-fetch safeguards: allow HTTP(S) only, check resolved IPs for internal destinations, revalidate every redirect, and cap responses at 5 MB.

The lesson

These fixes shipped in v0.5.0, with 30 tests using Node’s built-in runner.

A working conversation is only part of the test. Re-uploads, competing workers, and untrusted URLs deserve their own.

Which of these has caught you before? My bet: the check-then-act race.

— Sajib, full-stack developer from Dhaka · sajib.dev.cv