fix(triggers): close two Greptile-flagged crash/collision gaps

instantly: the timestamp-present branch was fixed for the email_id
collision risk, but the no-timestamp fallback still keyed on bare
email_id — same collision risk, unfixed. Return null instead so dedup
is skipped rather than risking a false collision between repeat opens/
clicks/replies on the same email.

linear: extractIdempotencyId cast `body` straight to a Record without
checking it was actually an object first, so a JSON `null` body (no
Linear-Delivery header available) would throw on `b.type` and turn a
malformed payload into a webhook 500 instead of a clean skip.

Author: waleedlatif1

apps/sim/lib/webhooks/providers/instantly.test.ts

@@ -176,12 +176,12 @@ describe('Instantly webhook provider', () => {
       expect(id).toBe('instantly:email_sent:email-123:2026-07-08T12:00:00.000Z')
     })
 
-    it('falls back to the bare email_id when timestamp is missing', () => {
+    it('returns null when email_id is present but timestamp is missing, rather than risk a false collision', () => {
       const id = instantlyHandler.extractIdempotencyId!({
         event_type: 'email_sent',
         email_id: 'email-123',
       })
-      expect(id).toBe('instantly:email_sent:email-123')
+      expect(id).toBeNull()
     })
 
     it('falls back to a content-based key without an email_id', () => {

apps/sim/lib/webhooks/providers/instantly.ts

@@ -64,7 +64,9 @@ export const instantlyHandler: WebhookProviderHandler = {
    * a thread), so email_id alone would collapse those distinct, legitimate
    * deliveries into one idempotency slot. `timestamp` is fixed per event
    * occurrence (not regenerated on retry), so appending it keeps the key
-   * both retry-stable and unique per occurrence.
+   * both retry-stable and unique per occurrence — without it there's no way
+   * to distinguish occurrences, so dedup is skipped rather than risking a
+   * false collision.
    */
   extractIdempotencyId(body: unknown): string | null {
     if (!isRecordLike(body)) return null
@@ -75,9 +77,7 @@ export const instantlyHandler: WebhookProviderHandler = {
     const timestamp = typeof body.timestamp === 'string' ? body.timestamp : undefined
     const emailId = typeof body.email_id === 'string' ? body.email_id : undefined
     if (emailId) {
-      return timestamp
-        ? `instantly:${eventType}:${emailId}:${timestamp}`
-        : `instantly:${eventType}:${emailId}`
+      return timestamp ? `instantly:${eventType}:${emailId}:${timestamp}` : null
     }
 
     const campaignId = typeof body.campaign_id === 'string' ? body.campaign_id : undefined

apps/sim/lib/webhooks/providers/linear.test.ts

@@ -141,5 +141,15 @@ describe('Linear webhook provider', () => {
       const key = linearHandler.extractIdempotencyId!({ action: 'create', data: { id: 'x' } })
       expect(key).toBeNull()
     })
+
+    it('returns null instead of throwing when the body is null', () => {
+      expect(linearHandler.extractIdempotencyId!(null)).toBeNull()
+    })
+
+    it('returns null instead of throwing when the body is a non-object', () => {
+      expect(linearHandler.extractIdempotencyId!('not an object')).toBeNull()
+      expect(linearHandler.extractIdempotencyId!(42)).toBeNull()
+      expect(linearHandler.extractIdempotencyId!(['array'])).toBeNull()
+    })
   })
 })

apps/sim/lib/webhooks/providers/linear.ts

@@ -157,6 +157,8 @@ export const linearHandler: WebhookProviderHandler = {
    * not a request-time timestamp, so retried deliveries of the same event still collapse.
    */
   extractIdempotencyId(body: unknown): string | null {
+    if (!body || typeof body !== 'object' || Array.isArray(body)) return null
+
     const b = body as Record<string, unknown>
     const type = typeof b.type === 'string' ? b.type : undefined
     const action = typeof b.action === 'string' ? b.action : undefined