fix: consolidated inbox reliability, AI resilience, and Meta compliance

[khilta]

Summary

Consolidated PR addressing the spec from @mikipalet in #23. Originally six changes based on current main (f7b056f, post-#28). Now includes critical self-reply loop prevention fixes discovered during production deployment.

What's included

1–6: Inbox reliability, AI resilience, and Meta compliance (original)

Direction fix: m.direction === "outbound" never matched because Zernio's enum value is "outgoing". Fixed in both messages-route mapper and webhook loop guard.

Local incoming DM storage + Zernio merge: Incoming DMs are now stored locally in the webhook. Messages route fetches both Zernio API and local DB, deduplicates on platform_message_id, returns single sorted list.

Comment stored as inbound message: Triggering comment is inserted as an inbound message in processComment so inbox shows what the contact commented.

AI retry with backoff + fallback: Transient errors retried with exponential backoff (1s, 2s, 4s, capped 8s). Permanent errors skip retries. Configurable fallbackMessage sent when retries exhausted.

{{contact_name}} personalization + 24h-window logging: executeFlow seeds {{contact_name}} idempotently. Flow execution errors classified: 24h window failures log as message_failed_24h_window.

STOP/START confirmation DMs: handleGlobalKeywords sends confirmation DM on opt-in/opt-out. Refactored to single object parameter.

---

7–10: Self-reply loop prevention (NEW — discovered in production)

Production incident: Bot sent 723 self-replies in ~2 hours on a Facebook page post. Two root causes found and fixed.

7. Triple-identifier self-comment guard

Problem: The self-comment guard only checked author.username === channel.username. Facebook page comments arrive with username=null (Meta strips author identity from page-owned comments — Graph API v26.0 doesn't even list a from field). The && short-circuited → guard skipped → infinite loop.

Fix: Now checks three identifiers (any match = skip):

• author.username === channel.username (Instagram)
• author.name === channel.display_name (both platforms, string match)
• author.id === channel.platform_page_id (Facebook — author.id = FB Page ID)

Files: app/api/webhooks/late/route.ts, lib/comment-processor.ts

8. Fix: Check 3 was dead code (different ID systems)

Problem: The third check compared author.id (Facebook Page ID) against payload.account.id (Zernio internal account ID). These are different ID systems that never match. The check looked correct but could never trigger.

Fix: Added platform_page_id column to channels table. Now compares author.id against channel.platform_page_id (the actual FB Page ID).

Industry validation: Pabbly Connect docs confirm "Ensure From ID does not equal your Facebook page ID" is the standard approach.

Files: app/api/webhooks/late/route.ts, lib/comment-processor.ts, lib/types/database.ts

9. DM self-account guard hardened for Facebook

Same username=null bug existed in the DM path's backup self-account guard. Added late_account_id check as defense-in-depth (in addition to the existing direction === "outgoing" primary guard).

File: app/api/webhooks/late/route.ts

10. One-reply-per-user-per-post rule (loop prevention)

Problem: Even with identity checks, there was no deduplication — the bot could reply to the same user on the same post unlimited times.

Fix: Before processing a comment, check if the bot has already replied to this author on this post. If reply_sent=true count ≥ 1, skip. This makes self-reply loops mathematically impossible — the bot can only ever send 1 reply per user per post.

if (comment.author.id) {
  const { count } = await supabase
    .from("comment_logs")
    .select("*", { count: "exact", head: true })
    .eq("channel_id", channel.id)
    .eq("post_id", comment.postId)
    .eq("author_id", comment.author.id)
    .eq("reply_sent", true);
  if ((count ?? 0) >= 1) return { matched: false, skipped: "rate_limited" };
}

File: lib/comment-processor.ts

Defense architecture summary

Layer	What	Catches
1. Webhook guard	Triple identity check (username + name + page_id)	Bot's own comments at ingestion
2. Processor guard	Same triple check, repeated	Defense-in-depth if webhook is bypassed
3. Reply text rule	Keyword not in reply text	Text-level loop trigger
4. One-reply rule	Already replied to this author on this post?	Everything else — mathematical guarantee

Result: Max possible replies per author per post = 1 (was ∞, proven by 723-reply incident).

Migration required

ALTER TABLE channels ADD COLUMN IF NOT EXISTS platform_page_id text;

What's NOT included

• 5-second concurrent-flow guard (silently drops legitimate follow-ups, doesn't close the race)
• Debounce / natural-delay (holds serverless function open, needs scheduled-jobs approach)

[vercel]

@khilta is attempting to deploy a commit to the Zernio Team on Vercel.

A member of the Team first needs to authorize it.