fix(triggers): stop cloned trigger blocks reusing the source's webhook URL

Before a deploy, a trigger block's webhook URL is DERIVED — use-webhook-management
falls back to the block's own id, which paste already regenerates, so cloning an
undeployed trigger yields a fresh URL. Deploy then registers the webhook at
`path = triggerPath || block.id` and writes that literal string back into the
source block's `triggerPath`. From then on the URL is STORED, and copy/paste
copies it verbatim, so the clone renders the source's URL.

Clear the two identity fields (`webhookId`, `triggerPath`) on in-canvas clones so
the clone falls back to deriving a path from its new block id.

- Clear both the subBlocks structure AND the sub-block value map: the value map
  is authoritative in mergeSubblockStateWithValues, and `triggerPath` normally
  lives only there since no trigger declares it as a subblock.
- Gate on `blockOwnsWebhookIdentity`, never on the subblock id: Discord, Attio,
  and Vercel action blocks expose a REQUIRED user-entered `webhookId` that must
  survive a copy. The predicate mirrors deploy's `resolveTriggerId` so both sides
  agree on which blocks own a webhook, and fails closed on unregistered types.
- `triggerConfig`/`triggerId` are deliberately preserved — they are user
  configuration, and `triggerConfig` can be a legacy trigger's only config home.

Scoped to the clone paths. No deploy-side, server-side, or import/export
behavior changes.

Author: waleedlatif1

apps/sim/lib/workflows/triggers/trigger-utils.test.ts

@@ -0,0 +1,97 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, type Mock, vi } from 'vitest'
+
+vi.mock('@/blocks', () => ({ getBlock: vi.fn(), getAllBlocks: vi.fn(() => []) }))
+vi.mock('@/triggers', () => ({ getTrigger: vi.fn(), isTriggerValid: vi.fn() }))
+
+import { blockOwnsWebhookIdentity } from '@/lib/workflows/triggers/trigger-utils'
+import { getBlock } from '@/blocks'
+import { isTriggerValid } from '@/triggers'
+
+/** A dedicated trigger block, as the real registry describes `generic_webhook`. */
+const TRIGGER_BLOCK = {
+  category: 'triggers',
+  subBlocks: [{ id: 'webhookUrlDisplay', mode: 'trigger' }],
+}
+
+/**
+ * Discord: `category: 'tools'`, NO `triggers` config and NO `mode: 'trigger'` subblocks, but a
+ * REQUIRED user-entered `webhookId` action field.
+ */
+const ACTION_BLOCK_WITH_WEBHOOK_ID = {
+  category: 'tools',
+  subBlocks: [{ id: 'webhookId', required: true }],
+}
+
+/** Attio/Vercel: `category: 'tools'` that DO declare `triggers.enabled`. */
+const TRIGGER_CAPABLE_TOOL = {
+  category: 'tools',
+  subBlocks: [{ id: 'webhookId', required: true }],
+  triggers: { enabled: true, available: ['attio_webhook'] },
+}
+
+describe('blockOwnsWebhookIdentity', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    ;(isTriggerValid as Mock).mockReturnValue(true)
+  })
+
+  /**
+   * The production-dominant case. A standalone Webhook block is `category: 'triggers'` and its
+   * `trigger_mode` column defaults to false, so a predicate keyed on `triggerMode` alone would
+   * answer "no" for exactly the block the reported bug travels through.
+   */
+  it('is true for a dedicated trigger block even with triggerMode false', () => {
+    ;(getBlock as Mock).mockReturnValue(TRIGGER_BLOCK)
+
+    expect(blockOwnsWebhookIdentity({ type: 'generic_webhook', triggerMode: false })).toBe(true)
+  })
+
+  it('is false for a dedicated trigger block whose type is not a registered trigger', () => {
+    ;(getBlock as Mock).mockReturnValue(TRIGGER_BLOCK)
+    ;(isTriggerValid as Mock).mockReturnValue(false)
+
+    expect(blockOwnsWebhookIdentity({ type: 'retired_trigger', triggerMode: false })).toBe(false)
+  })
+
+  /**
+   * The regression this predicate exists to prevent: `triggerMode` is persisted raw, so it can be
+   * true on a block with no trigger capability. Clearing there would wipe Discord's required
+   * user-entered `webhookId` on every copy.
+   */
+  it('is false for an action block with no trigger capability, even when triggerMode is true', () => {
+    ;(getBlock as Mock).mockReturnValue(ACTION_BLOCK_WITH_WEBHOOK_ID)
+
+    expect(blockOwnsWebhookIdentity({ type: 'discord', triggerMode: true })).toBe(false)
+  })
+
+  it('is false for a trigger-capable tool used in action mode', () => {
+    ;(getBlock as Mock).mockReturnValue(TRIGGER_CAPABLE_TOOL)
+
+    expect(blockOwnsWebhookIdentity({ type: 'attio', triggerMode: false })).toBe(false)
+  })
+
+  it('is true for a trigger-capable tool switched into trigger mode', () => {
+    ;(getBlock as Mock).mockReturnValue(TRIGGER_CAPABLE_TOOL)
+
+    expect(blockOwnsWebhookIdentity({ type: 'attio', triggerMode: true })).toBe(true)
+  })
+
+  /**
+   * Fails CLOSED. Callers strip on true, and clearing a field we cannot classify is recoverable,
+   * whereas keeping a stale `triggerPath` risks the clone answering on the source's URL.
+   */
+  it('is true for an unregistered block type', () => {
+    ;(getBlock as Mock).mockReturnValue(undefined)
+
+    expect(blockOwnsWebhookIdentity({ type: 'deleted_block_type', triggerMode: false })).toBe(true)
+  })
+
+  it('treats a missing triggerMode the same as false', () => {
+    ;(getBlock as Mock).mockReturnValue(ACTION_BLOCK_WITH_WEBHOOK_ID)
+
+    expect(blockOwnsWebhookIdentity({ type: 'discord' })).toBe(false)
+  })
+})

apps/sim/lib/workflows/triggers/trigger-utils.ts

@@ -5,7 +5,7 @@ import { type StartBlockCandidate, StartBlockPath } from '@/lib/workflows/trigge
 import { getAllBlocks, getBlock } from '@/blocks'
 import type { BlockConfig } from '@/blocks/types'
 import type { BlockState, WorkflowState } from '@/stores/workflows/workflow/types'
-import { getTrigger } from '@/triggers'
+import { getTrigger, isTriggerValid } from '@/triggers'
 
 const logger = createLogger('TriggerUtils')
 
@@ -199,6 +199,34 @@ export function getAllTriggerBlocks(): TriggerInfo[] {
   })
 }
 
+/**
+ * Whether a block instance owns a webhook, so its {@link WEBHOOK_IDENTITY_SUBBLOCK_IDS} hold
+ * runtime metadata a clone must not inherit rather than user configuration.
+ *
+ * Mirrors the deploy-side `resolveTriggerId` gate, and that equivalence is what makes it safe in
+ * both directions: when this says no, deploy also resolves no trigger and registers no webhook, so
+ * a stale path left on the block cannot collide with anything.
+ *
+ * Deliberately NOT {@link TriggerUtils.isTriggerBlock}, which is `category || triggerMode`. Two
+ * reasons it cannot be reused here:
+ * - `triggerMode` is persisted raw (`prepareBlockState` and the copilot's `buildBlockState` both
+ *   compute an `effectiveTriggerMode` for outputs yet store the unfiltered flag), so it can be
+ *   `true` on a block with no trigger capability at all — e.g. Discord, which declares no `triggers`
+ *   config and no `mode: 'trigger'` subblocks but does expose a REQUIRED user-entered `webhookId`
+ *   action field. Treating that as runtime metadata would wipe it on every copy.
+ * - It also matches the legacy starter block, which owns no webhook.
+ */
+export function blockOwnsWebhookIdentity(block: Pick<BlockState, 'type' | 'triggerMode'>): boolean {
+  const blockConfig = getBlock(block.type)
+  // Unknown type (deprecated/renamed block, or a row written by an older deployment): fail CLOSED.
+  // Callers strip on `true`, and clearing a field we cannot classify is recoverable, whereas
+  // keeping a stale `triggerPath` risks the clone silently answering on the source's URL.
+  if (!blockConfig) return true
+  if (blockConfig.category === 'triggers' && isTriggerValid(block.type)) return true
+  if (!block.triggerMode) return false
+  return hasTriggerCapability(blockConfig)
+}
+
 /**
  * Check if a block has trigger capability (contains trigger mode subblocks)
  */

apps/sim/stores/workflows/utils.test.ts

@@ -6,10 +6,38 @@ import {
   createStarterBlock,
 } from '@sim/testing'
 import type { Edge } from 'reactflow'
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it, vi } from 'vitest'
 import { normalizeName } from '@/executor/constants'
 import { getUniqueBlockName, regenerateBlockIds } from './utils'
 
+// The global `@/blocks/registry` mock returns a config with no `category`, which would make
+// `blockOwnsWebhookIdentity` answer "not a trigger" for every type and let these tests pass while
+// the production predicate is broken. Override it with the shape the real registry returns.
+vi.mock('@/blocks/registry', () => ({
+  getBlock: vi.fn((type: string) =>
+    type === 'generic_webhook'
+      ? {
+          name: 'Webhook',
+          description: 'Webhook trigger',
+          icon: () => null,
+          category: 'triggers',
+          subBlocks: [{ id: 'webhookUrlDisplay', mode: 'trigger' }],
+          outputs: {},
+        }
+      : {
+          name: 'Mock Block',
+          description: 'Mock block description',
+          icon: () => null,
+          category: 'tools',
+          subBlocks: [],
+          outputs: {},
+        }
+  ),
+  getAllBlocks: vi.fn(() => []),
+  getLatestBlock: vi.fn(() => undefined),
+  getBlockByToolName: vi.fn(() => undefined),
+}))
+
 describe('normalizeName', () => {
   it.concurrent('should convert to lowercase', () => {
     expect(normalizeName('MyVariable')).toBe('myvariable')
@@ -857,3 +885,111 @@ describe('regenerateBlockIds', () => {
     expect(names).toContain('Agent 2')
   })
 })
+
+describe('regenerateBlockIds — webhook identity on clones', () => {
+  const positionOffset = { x: 50, y: 50 }
+  const sourceId = 'webhook-source'
+  const deployedPath = 'webhook-source'
+
+  function pasteOne(block: Record<string, unknown>, values: Record<string, unknown>) {
+    const blocks = { [sourceId]: createBlock({ id: sourceId, ...block }) as never }
+    const result = regenerateBlockIds(
+      blocks,
+      [],
+      {},
+      {},
+      { [sourceId]: values },
+      positionOffset,
+      {},
+      getUniqueBlockName
+    )
+    const newId = Object.keys(result.blocks)[0]
+    return { newId, result }
+  }
+
+  /**
+   * The reported bug, in its production shape: a dedicated trigger block has `category: 'triggers'`
+   * and `triggerMode: false`. Deploy writes `webhook.path` (its own block id) back into
+   * `triggerPath`, after which a clone renders the SOURCE's URL instead of deriving its own.
+   */
+  it('clears the webhook identity on a pasted dedicated trigger block', () => {
+    const { newId, result } = pasteOne(
+      {
+        type: 'generic_webhook',
+        name: 'Webhook 1',
+        triggerMode: false,
+        subBlocks: {
+          triggerPath: { id: 'triggerPath', type: 'short-input', value: deployedPath },
+          webhookId: { id: 'webhookId', type: 'short-input', value: 'wh_original' },
+        },
+      },
+      { triggerPath: deployedPath, webhookId: 'wh_original' }
+    )
+
+    expect(newId).not.toBe(sourceId)
+    // Both sources must be cleared: the value map overrides the structure in mergeSubblockState.
+    expect(result.blocks[newId].subBlocks.triggerPath?.value).toBeNull()
+    expect(result.blocks[newId].subBlocks.webhookId?.value).toBeNull()
+    expect(result.subBlockValues[newId].triggerPath).toBeNull()
+    expect(result.subBlockValues[newId].webhookId).toBeNull()
+  })
+
+  it('clears it when the path lives only in the value map, not the structure', () => {
+    const { newId, result } = pasteOne(
+      { type: 'generic_webhook', name: 'Webhook 1', triggerMode: false, subBlocks: {} },
+      { triggerPath: deployedPath }
+    )
+
+    expect(result.subBlockValues[newId].triggerPath).toBeNull()
+  })
+
+  /**
+   * Discord/Attio/Vercel expose a REQUIRED user-entered `webhookId`. Clearing by subblock id alone
+   * would silently blank it, leaving the copy half-configured next to a surviving `webhookToken`.
+   */
+  it('preserves a user-entered webhookId on an action block', () => {
+    const { newId, result } = pasteOne(
+      {
+        type: 'discord',
+        name: 'Discord 1',
+        triggerMode: false,
+        subBlocks: {
+          webhookId: { id: 'webhookId', type: 'short-input', value: '1234567890' },
+          webhookToken: { id: 'webhookToken', type: 'short-input', value: 'tok_abc' },
+        },
+      },
+      { webhookId: '1234567890', webhookToken: 'tok_abc' }
+    )
+
+    expect(result.blocks[newId].subBlocks.webhookId?.value).toBe('1234567890')
+    expect(result.subBlockValues[newId].webhookId).toBe('1234567890')
+    expect(result.subBlockValues[newId].webhookToken).toBe('tok_abc')
+  })
+
+  it('preserves trigger configuration on a cloned trigger block', () => {
+    const { newId, result } = pasteOne(
+      {
+        type: 'generic_webhook',
+        name: 'Webhook 1',
+        triggerMode: false,
+        subBlocks: {
+          triggerPath: { id: 'triggerPath', type: 'short-input', value: deployedPath },
+          triggerConfig: { id: 'triggerConfig', type: 'short-input', value: { labelIds: ['a'] } },
+          triggerId: { id: 'triggerId', type: 'short-input', value: 'generic_webhook' },
+          token: { id: 'token', type: 'short-input', value: 'user-secret' },
+        },
+      },
+      {
+        triggerPath: deployedPath,
+        triggerConfig: { labelIds: ['a'] },
+        triggerId: 'generic_webhook',
+        token: 'user-secret',
+      }
+    )
+
+    expect(result.subBlockValues[newId].triggerPath).toBeNull()
+    expect(result.subBlockValues[newId].triggerConfig).toEqual({ labelIds: ['a'] })
+    expect(result.subBlockValues[newId].triggerId).toBe('generic_webhook')
+    expect(result.subBlockValues[newId].token).toBe('user-secret')
+  })
+})

apps/sim/stores/workflows/utils.ts

@@ -8,7 +8,10 @@ import { remapConditionBlockIds, remapConditionEdgeHandle } from '@/lib/workflow
 import { isDynamicHandleSubblock } from '@/lib/workflows/dynamic-handle-topology'
 import { createDefaultInputFormatField } from '@/lib/workflows/input-format'
 import { buildDefaultCanonicalModes } from '@/lib/workflows/subblocks/visibility'
-import { hasTriggerCapability } from '@/lib/workflows/triggers/trigger-utils'
+import {
+  blockOwnsWebhookIdentity,
+  hasTriggerCapability,
+} from '@/lib/workflows/triggers/trigger-utils'
 import { getBlock } from '@/blocks'
 import { escapeRegExp, normalizeName } from '@/executor/constants'
 import { useWorkflowRegistry } from '@/stores/workflows/registry/store'
@@ -22,7 +25,7 @@ import type {
   SubBlockState,
   WorkflowState,
 } from '@/stores/workflows/workflow/types'
-import { TRIGGER_RUNTIME_SUBBLOCK_IDS } from '@/triggers/constants'
+import { TRIGGER_RUNTIME_SUBBLOCK_IDS, WEBHOOK_IDENTITY_SUBBLOCK_IDS } from '@/triggers/constants'
 
 /** Threshold to detect viewport-based offsets vs small duplicate offsets */
 const LARGE_OFFSET_THRESHOLD = 300
@@ -251,6 +254,38 @@ function updateValueReferences(value: unknown, nameMap: Map<string, string>): un
   return value
 }
 
+/**
+ * Clears the {@link WEBHOOK_IDENTITY_SUBBLOCK_IDS} a cloned trigger block must not inherit, across
+ * BOTH the sub-block structure and the sub-block value map.
+ *
+ * Both are required. `mergeSubblockStateWithValues` treats the value map as authoritative — a `null`
+ * there overrides the structure — but only materializes an entry for a structure-less key when the
+ * value is non-null. So nulling the map covers the common shape (`triggerPath` is written into the
+ * store by `useWebhookManagement` and is never declared as a subblock), and clearing the structure
+ * covers blocks whose subBlocks were hydrated from a merge. Either way the clone resolves no path,
+ * and deploy's `triggerPath || block.id` fallback derives a fresh one from its new block id.
+ *
+ * Gated on {@link blockOwnsWebhookIdentity}, never on the subblock id alone: Discord, Attio, and
+ * Vercel action blocks expose a REQUIRED user-entered `webhookId` that must survive a copy.
+ *
+ * Mutates both arguments in place; both must be clone-owned copies. `subBlockValues` is optional so
+ * a caller with no value-map entry passes `undefined` rather than a throwaway object literal whose
+ * writes would be silently discarded.
+ */
+export function stripWebhookIdentityForClone(
+  block: Pick<BlockState, 'type' | 'triggerMode'>,
+  subBlocks: Record<string, SubBlockState>,
+  subBlockValues: Record<string, unknown> | undefined
+): void {
+  if (!blockOwnsWebhookIdentity(block)) return
+
+  for (const subBlockId of WEBHOOK_IDENTITY_SUBBLOCK_IDS) {
+    const subBlock = subBlocks[subBlockId]
+    if (subBlock) subBlocks[subBlockId] = { ...subBlock, value: null }
+    if (subBlockValues && subBlockId in subBlockValues) subBlockValues[subBlockId] = null
+  }
+}
+
 function updateBlockReferences(
   blocks: Record<string, BlockState>,
   nameMap: Map<string, string>,
@@ -565,6 +600,10 @@ export function regenerateBlockIds(
     })
   })
 
+  Object.entries(newBlocks).forEach(([blockId, block]) => {
+    stripWebhookIdentityForClone(block, block.subBlocks, newSubBlockValues[blockId])
+  })
+
   return {
     blocks: newBlocks,
     edges: newEdges,

apps/sim/stores/workflows/workflow/store.ts

@@ -17,6 +17,7 @@ import {
   getUniqueBlockName,
   mergeSubblockState,
   remapConditionIds,
+  stripWebhookIdentityForClone,
 } from '@/stores/workflows/utils'
 import type {
   Position,
@@ -599,6 +600,11 @@ export const useWorkflowStore = create<WorkflowStore>()(
           id,
           newId
         )
+        stripWebhookIdentityForClone(
+          block,
+          newSubBlocks as Record<string, SubBlockState>,
+          clonedSubBlockValues
+        )
 
         const newState = {
           blocks: {