fix(triggers): stop copy/paste and duplicate reusing a trigger block's webhook URL

Pasting or duplicating a deployed webhook trigger block carried the source's
triggerPath and webhookId onto the clone. The clone rendered the original's
public URL, and deploy resolved both blocks to one path — landing on the
path_deployment_unique index as an opaque 500 rather than an actionable error.

PR #1784 fixed this for duplicate, but the guard was deleted by three later
paste refactors (#2649, #2738, #3024) and had no regression test.

- Clear only the webhook identity (webhookId, triggerPath) on clones, so deploy
  falls back to the clone's freshly generated block id for the path. Trigger
  configuration (triggerConfig, triggerId) is preserved — it can be a legacy
  trigger's only config home.
- Clear both the subBlocks structure and the sub-block value map: the value map
  is authoritative in mergeSubblockStateWithValues.
- Gate on isBlockActingAsTrigger, not the subblock id: Discord, Attio, and
  Vercel action blocks expose a required user-entered webhookId field. Mirrors
  deploy's resolveTriggerId so both sides agree on which blocks own a webhook.
- Cover duplicateBlock, which bypasses regenerateBlockIds entirely.
- Reject two same-workflow trigger blocks sharing a path at deploy with a 400
  naming both blocks; the existing guards are cross-workflow only.

Import/export and server-side duplicate paths are deliberately untouched.

Author: waleedlatif1

apps/sim/lib/webhooks/deploy.test.ts

@@ -49,6 +49,7 @@ import {
   buildProviderConfig,
   resolveTriggerCredentialId,
   resolveWebhookConfigForBlock,
+  validateTriggerWebhookConfigForDeploy,
 } from '@/lib/webhooks/deploy'
 import { getBlock } from '@/blocks'
 import { getTrigger } from '@/triggers'
@@ -359,3 +360,73 @@ describe('resolveWebhookConfigForBlock — slack_oauth routing', () => {
     expect(mockFetchSlackTeamId).not.toHaveBeenCalled()
   })
 })
+
+describe('validateTriggerWebhookConfigForDeploy — duplicate path guard', () => {
+  const pathTrigger = trigger([{ id: 'eventType', mode: 'trigger', required: false }])
+
+  function triggerBlockWithPath(id: string, name: string, triggerPath: string): BlockState {
+    return {
+      id,
+      name,
+      type: 'generic_webhook',
+      enabled: true,
+      triggerMode: true,
+      subBlocks: { triggerPath: { value: triggerPath } },
+    } as unknown as BlockState
+  }
+
+  beforeEach(() => {
+    ;(getBlock as Mock).mockReturnValue({ category: 'triggers' })
+    ;(getTrigger as Mock).mockReturnValue(pathTrigger)
+  })
+
+  /**
+   * The cross-workflow guards do not cover two blocks in ONE workflow sharing a path:
+   * findConflictingWebhookPathOwner ignores same-workflow owners and claimWebhookPath's CAS
+   * accepts a same-workflow re-claim. Without this guard it surfaces as an opaque 500 from the
+   * `path_deployment_unique` index.
+   */
+  it('rejects two trigger blocks in one workflow sharing a triggerPath', async () => {
+    const result = await validateTriggerWebhookConfigForDeploy({
+      'block-a': triggerBlockWithPath('block-a', 'Webhook 1', 'shared-path'),
+      'block-b': triggerBlockWithPath('block-b', 'Webhook 2', 'shared-path'),
+    })
+
+    expect(result.success).toBe(false)
+    if (result.success) return
+    expect(result.error.status).toBe(400)
+    expect(result.error.message).toContain('shared-path')
+    expect(result.error.message).toContain('Webhook 1')
+    expect(result.error.message).toContain('Webhook 2')
+  })
+
+  it('allows distinct paths', async () => {
+    const result = await validateTriggerWebhookConfigForDeploy({
+      'block-a': triggerBlockWithPath('block-a', 'Webhook 1', 'path-a'),
+      'block-b': triggerBlockWithPath('block-b', 'Webhook 2', 'path-b'),
+    })
+
+    expect(result.success).toBe(true)
+  })
+
+  it('allows multiple blocks with no explicit path (each falls back to its block id)', async () => {
+    const result = await validateTriggerWebhookConfigForDeploy({
+      'block-a': triggerBlockWithPath('block-a', 'Webhook 1', ''),
+      'block-b': triggerBlockWithPath('block-b', 'Webhook 2', ''),
+    })
+
+    expect(result.success).toBe(true)
+  })
+
+  it('ignores a disabled block that shares a path', async () => {
+    const disabled = triggerBlockWithPath('block-b', 'Webhook 2', 'shared-path')
+    ;(disabled as { enabled: boolean }).enabled = false
+
+    const result = await validateTriggerWebhookConfigForDeploy({
+      'block-a': triggerBlockWithPath('block-a', 'Webhook 1', 'shared-path'),
+      'block-b': disabled,
+    })
+
+    expect(result.success).toBe(true)
+  })
+})

apps/sim/lib/webhooks/deploy.ts

@@ -73,11 +73,31 @@ export async function validateTriggerWebhookConfigForDeploy(
   blocks: Record<string, BlockState>
 ): Promise<TriggerSaveResult> {
   const triggerBlocks = Object.values(blocks || {}).filter((b) => b && b.enabled !== false)
+  const blockNameByPath = new Map<string, string>()
 
   for (const block of triggerBlocks) {
     const triggerId = resolveTriggerId(block)
     if (!triggerId || !isTriggerValid(triggerId)) continue
 
+    // Two blocks in ONE workflow claiming the same path is unreachable through the UI, but the
+    // cross-workflow guards do not cover it (findConflictingWebhookPathOwner ignores same-workflow
+    // owners; claimWebhookPath's CAS accepts a same-workflow re-claim). Without this it lands on
+    // the `path_deployment_unique` index as an opaque 500 instead of an actionable message.
+    const pathValue = getSubBlockValue(block, 'triggerPath')
+    if (typeof pathValue === 'string' && pathValue.length > 0) {
+      const owner = blockNameByPath.get(pathValue)
+      if (owner) {
+        return {
+          success: false,
+          error: {
+            message: `Webhook path "${pathValue}" is used by more than one trigger block ("${owner}" and "${block.name}"). Each trigger needs its own path.`,
+            status: 400,
+          },
+        }
+      }
+      blockNameByPath.set(pathValue, block.name)
+    }
+
     const triggerDef = getTrigger(triggerId)
     const { providerConfig, missingFields } = buildProviderConfig(block, triggerId, triggerDef)
 

apps/sim/lib/workflows/triggers/trigger-utils.ts

@@ -199,6 +199,22 @@ export function getAllTriggerBlocks(): TriggerInfo[] {
   })
 }
 
+/**
+ * Whether a block instance is actually acting as a trigger, so its
+ * {@link TRIGGER_RUNTIME_SUBBLOCK_IDS} values are webhook runtime metadata rather than user
+ * configuration.
+ *
+ * Deliberately narrower than {@link hasTriggerCapability}: several `category: 'tools'` blocks
+ * declare `triggers.enabled` AND expose a required user-entered `webhookId` action field
+ * (Discord, Attio, Vercel). Gating on capability would treat that field as runtime metadata and
+ * silently clear it. Mirrors the deploy-side `resolveTriggerId` gate so both sides agree on which
+ * blocks own a webhook.
+ */
+export function isBlockActingAsTrigger(block: BlockState): boolean {
+  if (block.triggerMode === true) return true
+  return getBlock(block.type)?.category === 'triggers'
+}
+
 /**
  * Check if a block has trigger capability (contains trigger mode subblocks)
  */

apps/sim/stores/workflows/utils.test.ts

@@ -857,3 +857,135 @@ describe('regenerateBlockIds', () => {
     expect(names).toContain('Agent 2')
   })
 })
+
+describe('regenerateBlockIds — trigger webhook identity', () => {
+  const positionOffset = { x: 50, y: 50 }
+  const sourceId = 'webhook-source'
+  const deployedPath = 'abc123deployedpath'
+
+  /**
+   * Regression: PR #1784 stripped `webhookId`/`triggerPath` on duplicate, but three later
+   * paste refactors deleted the guard. A clone that keeps `triggerPath` renders the source's
+   * webhook URL and collides with it on `path_deployment_unique` at deploy.
+   */
+  it('clears webhook runtime values on a pasted trigger block', () => {
+    const blocksToCopy = {
+      [sourceId]: createBlock({
+        id: sourceId,
+        type: 'generic_webhook',
+        name: 'Webhook 1',
+        triggerMode: true,
+        subBlocks: {
+          triggerPath: { id: 'triggerPath', type: 'short-input', value: deployedPath },
+          webhookId: { id: 'webhookId', type: 'short-input', value: 'wh_original' },
+        },
+      }),
+    }
+
+    const result = regenerateBlockIds(
+      blocksToCopy,
+      [],
+      {},
+      {},
+      { [sourceId]: { triggerPath: deployedPath, webhookId: 'wh_original' } },
+      positionOffset,
+      {},
+      getUniqueBlockName
+    )
+
+    const newId = Object.keys(result.blocks)[0]
+    expect(newId).not.toBe(sourceId)
+
+    // Both sources must be cleared: the value map wins in mergeSubblockState.
+    expect(result.blocks[newId].subBlocks.triggerPath?.value).toBeNull()
+    expect(result.blocks[newId].subBlocks.webhookId?.value).toBeNull()
+    expect(result.subBlockValues[newId].triggerPath).toBeNull()
+    expect(result.subBlockValues[newId].webhookId).toBeNull()
+  })
+
+  /**
+   * Discord, Attio, and Vercel action blocks expose a REQUIRED user-entered `webhookId`
+   * subblock. Clearing by subblock id alone would silently wipe it, so the clear is gated on
+   * the block actually acting as a trigger.
+   */
+  it('preserves the user-entered webhookId on a non-trigger action block', () => {
+    const discordId = 'discord-1'
+    const blocksToCopy = {
+      [discordId]: createBlock({
+        id: discordId,
+        type: 'discord',
+        name: 'Discord 1',
+        triggerMode: false,
+        subBlocks: {
+          webhookId: { id: 'webhookId', type: 'short-input', value: '1234567890' },
+        },
+      }),
+    }
+
+    const result = regenerateBlockIds(
+      blocksToCopy,
+      [],
+      {},
+      {},
+      { [discordId]: { webhookId: '1234567890' } },
+      positionOffset,
+      {},
+      getUniqueBlockName
+    )
+
+    const newId = Object.keys(result.blocks)[0]
+    expect(result.blocks[newId].subBlocks.webhookId?.value).toBe('1234567890')
+    expect(result.subBlockValues[newId].webhookId).toBe('1234567890')
+  })
+
+  /**
+   * Only the webhook IDENTITY is cleared. Trigger configuration — including `triggerConfig`,
+   * which can be the only home for a legacy trigger's fields — must survive the copy, or pasting
+   * a configured trigger would silently lose its setup.
+   */
+  it('preserves trigger configuration and ordinary values on a cloned trigger block', () => {
+    const blocksToCopy = {
+      [sourceId]: createBlock({
+        id: sourceId,
+        type: 'generic_webhook',
+        name: 'Webhook 1',
+        triggerMode: true,
+        subBlocks: {
+          triggerPath: { id: 'triggerPath', type: 'short-input', value: deployedPath },
+          triggerConfig: { id: 'triggerConfig', type: 'short-input', value: { labelIds: ['x'] } },
+          triggerId: { id: 'triggerId', type: 'short-input', value: 'generic_webhook' },
+          token: { id: 'token', type: 'short-input', value: 'user-secret' },
+          requireAuth: { id: 'requireAuth', type: 'switch', value: true },
+        },
+      }),
+    }
+
+    const result = regenerateBlockIds(
+      blocksToCopy,
+      [],
+      {},
+      {},
+      {
+        [sourceId]: {
+          triggerPath: deployedPath,
+          triggerConfig: { labelIds: ['x'] },
+          triggerId: 'generic_webhook',
+          token: 'user-secret',
+          requireAuth: true,
+        },
+      },
+      positionOffset,
+      {},
+      getUniqueBlockName
+    )
+
+    const newId = Object.keys(result.blocks)[0]
+    expect(result.subBlockValues[newId].triggerPath).toBeNull()
+    expect(result.subBlockValues[newId].triggerConfig).toEqual({ labelIds: ['x'] })
+    expect(result.subBlockValues[newId].triggerId).toBe('generic_webhook')
+    expect(result.subBlockValues[newId].token).toBe('user-secret')
+    expect(result.subBlockValues[newId].requireAuth).toBe(true)
+    expect(result.blocks[newId].subBlocks.triggerConfig?.value).toEqual({ labelIds: ['x'] })
+    expect(result.blocks[newId].subBlocks.token?.value).toBe('user-secret')
+  })
+})

apps/sim/stores/workflows/utils.ts

@@ -8,7 +8,10 @@ import { remapConditionBlockIds, remapConditionEdgeHandle } from '@/lib/workflow
 import { isDynamicHandleSubblock } from '@/lib/workflows/dynamic-handle-topology'
 import { createDefaultInputFormatField } from '@/lib/workflows/input-format'
 import { buildDefaultCanonicalModes } from '@/lib/workflows/subblocks/visibility'
-import { hasTriggerCapability } from '@/lib/workflows/triggers/trigger-utils'
+import {
+  hasTriggerCapability,
+  isBlockActingAsTrigger,
+} from '@/lib/workflows/triggers/trigger-utils'
 import { getBlock } from '@/blocks'
 import { escapeRegExp, normalizeName } from '@/executor/constants'
 import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
@@ -22,7 +25,7 @@ import type {
   SubBlockState,
   WorkflowState,
 } from '@/stores/workflows/workflow/types'
-import { TRIGGER_RUNTIME_SUBBLOCK_IDS } from '@/triggers/constants'
+import { TRIGGER_RUNTIME_SUBBLOCK_IDS, WEBHOOK_IDENTITY_SUBBLOCK_IDS } from '@/triggers/constants'
 
 /** Threshold to detect viewport-based offsets vs small duplicate offsets */
 const LARGE_OFFSET_THRESHOLD = 300
@@ -251,6 +254,36 @@ function updateValueReferences(value: unknown, nameMap: Map<string, string>): un
   return value
 }
 
+/**
+ * Clears the {@link WEBHOOK_IDENTITY_SUBBLOCK_IDS} a cloned trigger block must not inherit, across
+ * BOTH the sub-block structure and the sub-block value map.
+ *
+ * Both are required. `mergeSubblockStateWithValues` treats the value map as authoritative — a
+ * `null` there overrides the structure — but only creates an entry for a structure-less key when
+ * the value is non-null. So nulling the map covers the common case (`triggerPath` is written by
+ * `useWebhookManagement` into the store only, never declared as a subblock), and clearing the
+ * structure covers blocks whose subBlocks were hydrated from a merge. Either way the clone
+ * resolves no path and deploy falls back to its freshly generated block id.
+ *
+ * Gated on {@link isBlockActingAsTrigger}, NOT on the subblock id alone: Discord, Attio, and
+ * Vercel action blocks expose a required user-entered `webhookId` field that must survive a copy.
+ *
+ * Mutates both arguments in place; both are expected to be clone-owned copies.
+ */
+export function stripWebhookIdentityForClone(
+  block: BlockState,
+  subBlocks: Record<string, SubBlockState>,
+  subBlockValues: Record<string, unknown>
+): void {
+  if (!isBlockActingAsTrigger(block)) return
+
+  for (const subBlockId of WEBHOOK_IDENTITY_SUBBLOCK_IDS) {
+    const subBlock = subBlocks[subBlockId]
+    if (subBlock) subBlocks[subBlockId] = { ...subBlock, value: null }
+    if (subBlockId in subBlockValues) subBlockValues[subBlockId] = null
+  }
+}
+
 function updateBlockReferences(
   blocks: Record<string, BlockState>,
   nameMap: Map<string, string>,
@@ -565,6 +598,16 @@ export function regenerateBlockIds(
     })
   })
 
+  // Clones must not inherit the source's webhook identity: a pasted trigger block that keeps
+  // `triggerPath` renders the original's webhook URL and collides with it on deploy
+  // (`path_deployment_unique`). Deliberately a separate gated pass rather than
+  // `updateBlockReferences`' id-based `clearTriggerRuntimeValues` flag, so the import/export
+  // path that uses that flag keeps its exact current behavior.
+  Object.entries(newBlocks).forEach(([blockId, block]) => {
+    // An absent value-map entry needs no clearing: deploy treats absent and null identically.
+    stripWebhookIdentityForClone(block, block.subBlocks, newSubBlockValues[blockId] ?? {})
+  })
+
   return {
     blocks: newBlocks,
     edges: newEdges,