Pake Jak Tok/CookiePilot

Stop managing orders manually. Let AI do it while you focus on what you do best.

Comment

Inspiration

Growing up in Sarawak, Malaysia, I watched family members and neighbours run small home-based food businesses such as selling kuih, cookies, and home-cooked meals entirely through WhatsApp groups and handwritten notebooks. Orders came in at all hours, payments were tracked manually, and customers would sometimes wait days just to find out if their order was confirmed.

The problem isn't unique to one person. Thousands of small home-based businesses across Malaysia operate this way not because they lack ambition, but because the tools available to them are either too expensive, too complex, or simply not designed for someone baking cookies part-time between other responsibilities.

I wanted to build something that felt like hiring a capable assistant one that handles the routine, repetitive parts of running a small business autonomously, while keeping the owner in control of every decision that actually matters.

What it does

Pake Jak Tok is an AI agent that autonomously manages the full order lifecycle for a small home-based cookie business.

For customers:

Place orders through a clean web form — cookie type, quantity, pickup or delivery, date Prices calculate automatically from the real menu After confirming, customers see the owner's QR code and bank details for payment Upload a payment screenshot directly on the confirmation screen Receive real-time Telegram notifications for confirmations, reminders, and when their order is ready

For the business owner:

Every morning at 7am, a Telegram message asks: "Are you open today?" — one tap sets the day's availability If no response by 9am, the system defaults to closed — protecting the owner from unexpected orders A daily packing list is generated by Qwen, showing exactly who ordered what, pickup vs delivery, and expected daily revenue Every evening, unpaid orders due tomorrow are flagged with a one-tap reminder system Payment screenshots are scanned automatically by Qwen-VL — the owner sees a colour-coded analysis showing whether the amount matches, and a "Prepare RM X change" alert if the customer overpaid Owners mark orders ready from a dashboard — the customer is notified instantly with a personalised message

How we built it

Agent core: A LangGraph.js state machine handles Scenario 1 (new order). It runs through three nodes: slot availability check, RAG-grounded reasoning with Qwen-Max, and either direct confirmation or a Telegram HITL approval card.

RAG pipeline: Business knowledge (menu, pricing, policies, FAQ) is embedded using Qwen text-embedding-v3 and stored in Alibaba DashVector. Before reasoning, the agent retrieves the most relevant context — so if a customer orders 5 cookies for next-day delivery, the agent catches that delivery requires a minimum of 6 pieces and 3 days notice, citing the actual policy in its reasoning.

MCP servers: Three independent MCP servers handle tool-calling — Orders (database operations), Owner Telegram (HITL cards, availability checks, notifications), and Customer Telegram (account linking, order notifications, photo-based payment proof re-upload). Each runs as a separate subprocess connected over stdio.

Payment vision: Qwen-VL reads payment screenshots automatically — extracting the transferred amount, comparing against the order total, detecting overpayments, and returning structured JSON analysis. The result is persisted alongside the image in Alibaba OSS.

Alibaba Cloud infrastructure: ECS hosts both the backend (Node.js/Express) and frontend (Next.js). ApsaraDB RDS MySQL stores all business data. DashVector stores the knowledge base vectors. OSS stores payment proof images with private ACL and signed URL access.

Scheduler: node-cron runs two daily jobs inside the backend process — 7am sends the availability check, 9am enforces the closed-by-default rule. A 9pm job handles unpaid order reminders.

Challenges we ran into

MCP connection stability. Running three separate MCP servers as subprocesses meant connection drops during long HITL polling loops caused the entire agent to crash rather than retry gracefully. We added per-attempt try/catch inside the polling loop so transient disconnections are logged and retried rather than propagated as fatal errors.

Qwen response formatting. Both Qwen-Max (reasoning) and Qwen-VL (payment analysis) occasionally wrapped their JSON responses in markdown code fences despite explicit instructions not to. We added a pre-parse stripping step that handles both json and plain ``` fence variations before attempting JSON.parse().

DashVector — no Node.js SDK. DashVector only has official SDKs for Python and Java. We built a lightweight HTTP wrapper in JavaScript using the documented REST API — covering collection creation, vector upsert, and semantic query with proper error handling.

Stale Node.js processes on Windows. Running multiple MCP servers as subprocesses on Windows meant leftover processes from previous sessions would conflict with new ones via Telegram's polling endpoint, causing 409 Conflict errors that looked like code bugs. Systematic process cleanup before every restart session resolved this.

OSS region configuration. The ali-oss SDK requires the region to be prefixed with oss- (e.g. oss-ap-southeast-3), not just the bare region code. This caused a DNS resolution failure that initially looked like a network problem rather than a configuration issue.

Accomplishments that we're proud of

Three distinct Qwen APIs working together in one coherent system. Qwen-Max for multi-step reasoning, Qwen Embeddings for semantic retrieval, and Qwen-VL for vision analysis — each solving a genuinely different problem, not the same capability reused three ways.

A layered availability system that handles real-world ambiguity. The daily Telegram check, closed-by-default safety net, and recurring weekly pattern work together in a way that reflects how a part-time business owner actually thinks about their schedule — not just a simple open/closed boolean.

Human-in-the-loop that feels natural, not disruptive. Every HITL checkpoint is a real Telegram inline button card — the owner never has to open a dashboard, log in, or navigate anywhere. A single tap on their phone is the entire interaction.

The payment proof pipeline. A customer uploads an unstructured bank transfer screenshot → it's stored on OSS → Qwen-VL reads and structures it → the result is colour-coded in the dashboard with specific change amounts calculated server-side. This is the moment where "AI-powered" becomes tangibly useful rather than just a label.

What we learned

MCP is genuinely powerful for agent tool isolation. Having each external capability (database, owner Telegram, customer Telegram) as its own MCP server made the agent dramatically easier to reason about and debug — failures in one tool don't cascade into others, and each server can be tested in isolation.

RAG makes the difference between "smart" and "knowledgeable". Before adding the knowledge base, the agent could only reason about slot availability. After, it enforces real business policies — minimum orders, lead times, delivery areas — by actually retrieving them, not hallucinating from training data.

Closed-by-default is the right design for ambiguous systems. When the owner doesn't respond to the morning check, treating silence as "open" would be optimistic but wrong. Defaulting to closed protects the business owner from consequences of ambiguity, even at the cost of a missed order.

Small scope decisions compound into big architecture decisions. Choosing "customer selects cash or transfer at checkout" led to needing different payment confirmation flows, different dashboard states, different receipt content, and different reminder message wording. Every product decision has a tail.

What's next for Pake Jak Tok/CookiePilot

Planned for future development:

A conversational ordering flow via Telegram for customers who prefer messaging over web forms Real payment gateway integration (e.g. billplz for Malaysian bank transfers) for fully automated payment confirmation Multi-business support — one deployment serving multiple home-based business owners, each with their own menu, availability, and Telegram bots Analytics dashboard showing revenue trends, popular items, and peak ordering times WhatsApp Business API integration as an alternative to Telegram for customers who prefer it

The core insight this project reinforced: the right role for AI in small business operations isn't to replace the owner's judgment — it's to handle everything that doesn't require judgment, so the owner can focus on the parts that do.

Built With

Share this project:

Updates