fix(webhooks): stop dropping pre-deployment verification response on shared paths

[waleedlatif1]

Summary

• dispatchResolvedWebhookTarget's block-missing case now reports a distinct verified outcome for the pre-deployment URL-verification response, instead of the route inferring it from response internals
• the trigger route returns that verified response immediately, even when the path is shared by multiple webhooks - previously it was silently dropped via continue, which could surface a 500 instead of the 200 a provider needs to accept the trigger URL
• added a unit test for both dispatchResolvedWebhookTarget outcomes (verified vs. 404) and a route-level regression test for the shared-path case

Type of Change

• Bug fix

Testing

• bun vitest run lib/webhooks/processor.test.ts app/api/webhooks/trigger/[path]/route.test.ts - 33 passed
• bunx tsc --noEmit - clean
• bun run check:api-validation - passed

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 10, 2026 11:36pm

[cursor]

PR Summary

Low Risk
Targeted webhook fan-out behavior change with new tests; no auth, billing, or data-model changes beyond dispatch outcome typing.

Overview
Fixes pre-deployment URL verification being dropped when multiple webhooks share the same path. Providers that validate the trigger URL before the workflow is deployed need a 200 with the verification payload; on shared paths the route used to treat block-missing like a skippable failure and continue, which could end in 500 instead of the handshake response.

dispatchResolvedWebhookTarget now returns a distinct verified outcome (with reason: 'block-missing') when the trigger block is not in the deployment but handlePreDeploymentVerification applies. The trigger route returns that response immediately and does not fan out to other webhooks on the path. Non-verification block-missing cases still return ignored with 404.

Tests cover processor outcomes (verified vs ignored) and a route regression for a shared path where the first dispatch is verified.

^{Reviewed by Cursor Bugbot for commit f95c224. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f95c224. Configure here.}

[cursor]

Verified return skips queued sibling

Medium Severity

On a shared path, when an earlier webhook already produced a queued success response, a later webhook with outcome verified still short-circuits the loop and returns the URL-verification body. The caller may get a verification 200 even though another webhook on the path already accepted the delivery.

 

^{Reviewed by Cursor Bugbot for commit f95c224. Configure here.}

[greptile-apps]

Greptile Summary

This PR updates webhook verification handling for shared trigger paths. The main changes are:

• Adds a verified dispatch outcome for block-missing pre-deployment verification.
• Returns verified webhook responses immediately from the trigger route.
• Adds processor and route tests for the new shared-path verification behavior.

Confidence Score: 4/5

The shared-path webhook route can acknowledge an event while skipping later matching webhooks.

• The new verified outcome is not tied to a matched verification probe.
• The route returns immediately on that outcome, so later webhooks on the same path are not processed.
• The tests cover the intended verification response, but not real event traffic during the same block-missing state.

apps/sim/app/api/webhooks/trigger/[path]/route.ts

Important Files Changed

Filename	Overview
apps/sim/app/api/webhooks/trigger/[path]/route.ts	Returns verified dispatch results immediately from the shared-path webhook loop.
apps/sim/lib/webhooks/processor.ts	Adds the verified outcome and emits it for block-missing pre-deployment verification responses.
apps/sim/lib/webhooks/processor.test.ts	Adds unit coverage for verified and ignored block-missing dispatch outcomes.
apps/sim/app/api/webhooks/trigger/[path]/route.test.ts	Adds route coverage for returning a verification response on a shared path.

_{Reviews (1): Last reviewed commit: "fix(webhooks): stop dropping pre-deploym..." | Re-trigger Greptile}

[greptile-apps]

Shared Path Events Are Skipped

When a block-missing webhook on a shared path belongs to a provider with pending verification enabled, this branch returns 200 before later webhooks on the same path are checked. Since the new verified outcome is based on provider registration rather than a matched verification probe, a real event during that block-missing state can be acknowledged and the remaining shared-path deliveries are never dispatched.