fix(triggers): stop workflow copy paths wiping a user-entered webhookId

The trigger-runtime strip on the workflow-level copy paths was keyed on subblock
id alone. Discord, Attio, and Vercel action blocks expose a REQUIRED
user-entered `webhookId` field, so duplicating, forking, or importing a workflow
blanked it while leaving the `webhookToken` it pairs with — a silently
half-configured copy that fails at runtime with an error pointing nowhere near
the copy that caused it.

- Gate the TRIGGER_RUNTIME_SUBBLOCK_IDS strip on isBlockActingAsTrigger in
  sanitizeSubBlocksForDuplicate (server duplicate + workspace forking) and in
  updateBlockReferences (export/import).
- Make sanitizeSubBlocksForDuplicate's flag a required parameter so every call
  site must decide rather than inheriting a silent default.
- Widen isBlockActingAsTrigger to accept a DB block row as well as BlockState.

Trigger blocks are unaffected — they still lose their webhook identity on a copy.
Display-only system subblocks are still stripped unconditionally; those ids exist
only on trigger definitions. Verified `scheduleInfo` is the only other collision
and it belongs to the schedule block, which is category: 'triggers'.

Author: waleedlatif1

apps/sim/ee/workspace-forking/lib/copy/copy-workflows.ts

@@ -13,6 +13,7 @@ import {
 } from '@/lib/workflows/persistence/remap-internal-ids'
 import { saveWorkflowToNormalizedTables } from '@/lib/workflows/persistence/utils'
 import type { CanonicalModeOverrides } from '@/lib/workflows/subblocks/visibility'
+import { isBlockActingAsTrigger } from '@/lib/workflows/triggers/trigger-utils'
 import {
   deriveForkBlockId,
   type ForkBlockIdResolver,
@@ -436,7 +437,10 @@ export async function copyWorkflowStateIntoTarget(
 
     // double-cast-allowed: SubBlockState is structurally a SubBlockRecord entry but lacks the open index signature SubBlockRecord declares
     const sourceSubBlocks = (block.subBlocks ?? {}) as unknown as SubBlockRecord
-    const sanitizedSource = sanitizeSubBlocksForDuplicate(sourceSubBlocks)
+    const sanitizedSource = sanitizeSubBlocksForDuplicate(
+      sourceSubBlocks,
+      isBlockActingAsTrigger(block)
+    )
     let subBlocks: SubBlockRecord = sanitizedSource
     // Tracks the block's live `canonicalModes` through this pass, so a `tool-input` reindex
     // (a dropped custom-tool/MCP entry shifts later tools' array positions) is visible to every

apps/sim/lib/workflows/persistence/duplicate.ts

@@ -22,6 +22,7 @@ import {
   type SubBlockRecord,
   sanitizeSubBlocksForDuplicate,
 } from '@/lib/workflows/persistence/remap-internal-ids'
+import { isBlockActingAsTrigger } from '@/lib/workflows/triggers/trigger-utils'
 import { deduplicateWorkflowName } from '@/lib/workflows/utils'
 import type { Variable } from '@/stores/variables/types'
 import type { LoopConfig, ParallelConfig } from '@/stores/workflows/workflow/types'
@@ -304,7 +305,10 @@ export async function duplicateWorkflow(
           typeof updatedSubBlocks === 'object' &&
           !Array.isArray(updatedSubBlocks)
         ) {
-          updatedSubBlocks = sanitizeSubBlocksForDuplicate(updatedSubBlocks as SubBlockRecord)
+          updatedSubBlocks = sanitizeSubBlocksForDuplicate(
+            updatedSubBlocks as SubBlockRecord,
+            isBlockActingAsTrigger(block)
+          )
         }
         if (
           varIdMapping.size > 0 &&

apps/sim/lib/workflows/persistence/remap-internal-ids.test.ts

@@ -8,6 +8,7 @@ import {
   remapConditionIdsInSubBlocks,
   remapWorkflowReferencesInSubBlocks,
   type SubBlockRecord,
+  sanitizeSubBlocksForDuplicate,
 } from '@/lib/workflows/persistence/remap-internal-ids'
 
 describe('remapWorkflowReferencesInSubBlocks', () => {
@@ -463,3 +464,78 @@ describe('coerceObjectArray', () => {
     expect(coerceObjectArray(42)).toEqual({ array: null, wasString: false })
   })
 })
+
+describe('sanitizeSubBlocksForDuplicate', () => {
+  /**
+   * Regression: the strip was keyed on subblock id alone, so duplicating or forking a workflow
+   * blanked Discord/Attio/Vercel's REQUIRED user-entered `webhookId` while leaving the
+   * `webhookToken` it pairs with — a silently half-configured copy.
+   */
+  it('keeps a user-entered webhookId on a block that is not acting as a trigger', () => {
+    const discord: SubBlockRecord = {
+      operation: { type: 'dropdown', value: 'discord_execute_webhook' },
+      webhookId: { type: 'short-input', value: '1234567890' },
+      webhookToken: { type: 'short-input', value: 'tok_abc' },
+      content: { type: 'long-input', value: 'hello' },
+    }
+
+    const out = sanitizeSubBlocksForDuplicate(discord, false)
+
+    expect(out.webhookId).toEqual({ type: 'short-input', value: '1234567890' })
+    expect(out.webhookToken).toEqual({ type: 'short-input', value: 'tok_abc' })
+    expect(out.content).toBeDefined()
+    expect(out.operation).toBeDefined()
+  })
+
+  it('keeps prefixed keys on a block that is not acting as a trigger', () => {
+    const out = sanitizeSubBlocksForDuplicate(
+      {
+        webhookId_custom: { type: 'short-input', value: 'x' },
+        triggerConfig: { type: 'short-input', value: { labelIds: ['a'] } },
+      },
+      false
+    )
+
+    expect(out.webhookId_custom).toBeDefined()
+    expect(out.triggerConfig).toBeDefined()
+  })
+
+  it('still strips webhook runtime identity on a real trigger block', () => {
+    const out = sanitizeSubBlocksForDuplicate(
+      {
+        webhookId: { type: 'short-input', value: 'wh_original' },
+        triggerPath: { type: 'short-input', value: 'deployed-path' },
+        triggerConfig: { type: 'short-input', value: { labelIds: ['a'] } },
+        triggerId: { type: 'short-input', value: 'generic_webhook' },
+        requireAuth: { type: 'switch', value: true },
+      },
+      true
+    )
+
+    expect(out.webhookId).toBeUndefined()
+    expect(out.triggerPath).toBeUndefined()
+    expect(out.triggerConfig).toBeUndefined()
+    expect(out.triggerId).toBeUndefined()
+    expect(out.requireAuth).toBeDefined()
+  })
+
+  it('strips display-only system subblocks regardless of trigger status', () => {
+    for (const isTrigger of [true, false]) {
+      const out = sanitizeSubBlocksForDuplicate(
+        {
+          webhookUrlDisplay: { type: 'short-input', value: 'https://x' },
+          samplePayload: { type: 'code', value: '{}' },
+          scheduleInfo: { type: 'schedule-info', value: null },
+          triggerCredentials: { type: 'oauth-input', value: 'cred-1' },
+        },
+        isTrigger
+      )
+
+      expect(out.webhookUrlDisplay).toBeUndefined()
+      expect(out.samplePayload).toBeUndefined()
+      expect(out.scheduleInfo).toBeUndefined()
+      // triggerCredentials is deliberately preserved so a copy keeps its OAuth connection.
+      expect(out.triggerCredentials).toBeDefined()
+    }
+  })
+})

apps/sim/lib/workflows/persistence/remap-internal-ids.ts

@@ -47,11 +47,25 @@ export function isSystemSubBlockKey(key: string, ids: Set<string> | string[]): b
   return idList.some((id) => key === id || key.startsWith(`${id}_`))
 }
 
-/** Strip trigger-runtime and non-credential system subblocks for a fresh copy. */
-export function sanitizeSubBlocksForDuplicate(subBlocks: SubBlockRecord): SubBlockRecord {
+/**
+ * Strip trigger-runtime and non-credential system subblocks for a fresh copy.
+ *
+ * `isActingAsTrigger` is required, not optional, so every call site must decide: the
+ * {@link TRIGGER_RUNTIME_SUBBLOCK_IDS} strip is only correct for a block that actually owns a
+ * webhook. Discord, Attio, and Vercel action blocks expose a REQUIRED user-entered `webhookId`
+ * field, and stripping it left the copy half-configured (`webhookToken` survives while the id it
+ * pairs with vanishes). Resolve the flag with `isBlockActingAsTrigger(block)`.
+ *
+ * The display-only system subblocks are stripped unconditionally: those ids exist only on trigger
+ * definitions, so the strip is a no-op for anything else.
+ */
+export function sanitizeSubBlocksForDuplicate(
+  subBlocks: SubBlockRecord,
+  isActingAsTrigger: boolean
+): SubBlockRecord {
   const sanitized: SubBlockRecord = {}
   for (const [key, subBlock] of Object.entries(subBlocks)) {
-    if (isSystemSubBlockKey(key, TRIGGER_RUNTIME_SUBBLOCK_IDS)) continue
+    if (isActingAsTrigger && isSystemSubBlockKey(key, TRIGGER_RUNTIME_SUBBLOCK_IDS)) continue
     if (isSystemSubBlockKey(key, DUPLICATE_STRIPPED_SYSTEM_SUBBLOCK_IDS)) continue
     sanitized[key] = subBlock
   }

apps/sim/lib/workflows/triggers/trigger-utils.ts

@@ -210,7 +210,10 @@ export function getAllTriggerBlocks(): TriggerInfo[] {
  * silently clear it. Mirrors the deploy-side `resolveTriggerId` gate so both sides agree on which
  * blocks own a webhook.
  */
-export function isBlockActingAsTrigger(block: BlockState): boolean {
+export function isBlockActingAsTrigger(block: {
+  type: string
+  triggerMode?: boolean | null
+}): boolean {
   if (block.triggerMode === true) return true
   return getBlock(block.type)?.category === 'triggers'
 }

apps/sim/stores/workflows/utils.test.ts

@@ -8,7 +8,7 @@ import {
 import type { Edge } from 'reactflow'
 import { describe, expect, it } from 'vitest'
 import { normalizeName } from '@/executor/constants'
-import { getUniqueBlockName, regenerateBlockIds } from './utils'
+import { getUniqueBlockName, regenerateBlockIds, regenerateWorkflowIds } from './utils'
 
 describe('normalizeName', () => {
   it.concurrent('should convert to lowercase', () => {
@@ -989,3 +989,75 @@ describe('regenerateBlockIds — trigger webhook identity', () => {
     expect(result.blocks[newId].subBlocks.token?.value).toBe('user-secret')
   })
 })
+
+describe('regenerateWorkflowIds — trigger webhook identity', () => {
+  function stateWith(block: Record<string, unknown>) {
+    return {
+      blocks: { 'block-1': { id: 'block-1', position: { x: 0, y: 0 }, outputs: {}, ...block } },
+      edges: [],
+      loops: {},
+      parallels: {},
+    } as never
+  }
+
+  /**
+   * Regression: import/export cleared runtime ids by subblock id alone, so an imported Discord
+   * block lost its REQUIRED user-entered `webhookId` while keeping the `webhookToken` it pairs
+   * with. Trigger blocks (below) must still be cleared.
+   */
+  it('keeps a user-entered webhookId on a non-trigger action block', () => {
+    const out = regenerateWorkflowIds(
+      stateWith({
+        type: 'discord',
+        name: 'Discord 1',
+        triggerMode: false,
+        subBlocks: {
+          operation: { id: 'operation', type: 'dropdown', value: 'discord_execute_webhook' },
+          webhookId: { id: 'webhookId', type: 'short-input', value: '1234567890' },
+          webhookToken: { id: 'webhookToken', type: 'short-input', value: 'tok_abc' },
+        },
+      })
+    )
+
+    const block = Object.values(out.blocks)[0]
+    expect(block.subBlocks.webhookId?.value).toBe('1234567890')
+    expect(block.subBlocks.webhookToken?.value).toBe('tok_abc')
+  })
+
+  it('still clears runtime identity on a block in trigger mode', () => {
+    const out = regenerateWorkflowIds(
+      stateWith({
+        type: 'generic_webhook',
+        name: 'Webhook 1',
+        triggerMode: true,
+        subBlocks: {
+          webhookId: { id: 'webhookId', type: 'short-input', value: 'wh_original' },
+          triggerPath: { id: 'triggerPath', type: 'short-input', value: 'deployed-path' },
+          requireAuth: { id: 'requireAuth', type: 'switch', value: true },
+        },
+      })
+    )
+
+    const block = Object.values(out.blocks)[0]
+    expect(block.subBlocks.webhookId?.value).toBeNull()
+    expect(block.subBlocks.triggerPath?.value).toBeNull()
+    expect(block.subBlocks.requireAuth?.value).toBe(true)
+  })
+
+  it('leaves runtime identity alone when clearTriggerRuntimeValues is opted out', () => {
+    const out = regenerateWorkflowIds(
+      stateWith({
+        type: 'generic_webhook',
+        name: 'Webhook 1',
+        triggerMode: true,
+        subBlocks: {
+          triggerPath: { id: 'triggerPath', type: 'short-input', value: 'deployed-path' },
+        },
+      }),
+      { clearTriggerRuntimeValues: false }
+    )
+
+    const block = Object.values(out.blocks)[0]
+    expect(block.subBlocks.triggerPath?.value).toBe('deployed-path')
+  })
+})

apps/sim/stores/workflows/utils.ts

@@ -290,9 +290,12 @@ function updateBlockReferences(
   clearTriggerRuntimeValues = false
 ): void {
   Object.entries(blocks).forEach(([_, block]) => {
+    // The clear is only correct for a block that actually owns a webhook — Discord, Attio, and
+    // Vercel action blocks expose a REQUIRED user-entered `webhookId` field that must survive.
+    const clearRuntimeValues = clearTriggerRuntimeValues && isBlockActingAsTrigger(block)
     if (block.subBlocks) {
       Object.entries(block.subBlocks).forEach(([subBlockId, subBlock]) => {
-        if (clearTriggerRuntimeValues && TRIGGER_RUNTIME_SUBBLOCK_IDS.includes(subBlockId)) {
+        if (clearRuntimeValues && TRIGGER_RUNTIME_SUBBLOCK_IDS.includes(subBlockId)) {
           block.subBlocks[subBlockId] = { ...subBlock, value: null }
           return
         }