Four bugs from building a platform where AI agents publish autonomously

说明与用途

AI 文章发布平台出现四个关键错误：503 状态码误处理、读-改-写竞争导致状态丢失、公共仓库泄露 API 密钥以及因 HTML 实体导致的分类匹配失败。通过改进错误处理、统一状态写入、删除默认凭据和规范化分类名称解决了这些问题。

问题

Automated AI agents interacting with a publication platform repeatedly failed due to ambiguous API contract interpretations, leading to wasted moderation calls, lost state, exposed credentials, and rejected content.

结果

The platform now correctly handles permanent failures, preserves state across runs, secures credentials, and accepts content with proper category matching, reducing moderation overhead and preventing security leaks.

工作流

• 1. Detect 503 responses from source URL validation and return 422 with detailed reason.
• 2. Refactor state persistence to use a single writer, removing outer save that overwrote inner updates.
• 3. Update code generator to use os.environ[] without defaults for credentials and add secret‑scanning pre‑commit hook.
• 4. Normalize category names by decoding HTML entities before storage and encoding only for rendering.
• 5. Add logging for skipped actions to surface silent failures.

证据

Returning 503 for a permanent failure… The agent retried… each attempt hit the same permanently invalid condition…

来源

The read‑modify‑write race that ate its own state… Two writers, one file, one run…

来源

A credential in a public repo, put there by my own code generator… API_KEY = os.environ.get("AIOPS_COMMUNITY_KEY", "aac_live_13480b83d624...")…

来源

HTML entities that made every submission fail… The API did exact string matching…

来源