fix(agent_api_keys): require provided secret for Slack triggers

Slack signs requests with the app's existing Signing Secret, not a per-webhook
secret we can generate. Auto-generating one for a Slack trigger stored a random
value that would never match, so every real Slack delivery failed signature
verification. Now Slack requires the caller to supply 'secret'; GitHub still
auto-generates. Addresses Greptile P1.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: danielmillerp

agentex/src/api/routes/agent_api_keys.py

@@ -141,6 +141,20 @@ async def create_webhook_trigger(
             detail=f"A {request.source} webhook key named '{request.name}' already exists for this agent.",
         )
 
+    # GitHub lets you supply (and we can generate) a per-webhook secret to paste into the
+    # repo's Secret field. Slack is different: it signs every request with the app's own
+    # Signing Secret, so the caller must supply that exact value — a generated one would
+    # never match, and validate_slack_delivery_webhook would reject every real delivery.
+    # (See PR #329 discussion.)
+    if request.source == AgentAPIKeyType.SLACK and not request.secret:
+        raise HTTPException(
+            status_code=400,
+            detail=(
+                "Slack triggers must supply 'secret' set to the Slack app's Signing Secret "
+                "(from your app credentials); it can't be generated."
+            ),
+        )
+
     secret = request.secret or secrets.token_hex(32)
     agent_api_key_entity = await agent_api_key_use_case.create(
         agent_id=agent.id,

agentex/tests/unit/api/test_webhook_trigger.py

@@ -96,3 +96,25 @@ async def test_rejects_non_webhook_source(self):
                 authorization_service=MagicMock(),
             )
         assert exc.value.status_code == 400
+
+    async def test_slack_without_secret_rejected(self, monkeypatch):
+        # Slack signs with the app's existing Signing Secret — we can't generate one,
+        # so omitting it must 400 rather than store a random value that never matches.
+        req = CreateWebhookTriggerRequest(
+            agent_name="a", source=AgentAPIKeyType.SLACK, name="my-app", forward_path="slack"
+        )
+        with pytest.raises(HTTPException) as exc:
+            await self._call(monkeypatch, req)
+        assert exc.value.status_code == 400
+
+    async def test_slack_with_provided_secret_ok(self, monkeypatch):
+        req = CreateWebhookTriggerRequest(
+            agent_name="a",
+            source=AgentAPIKeyType.SLACK,
+            name="my-app",
+            forward_path="slack",
+            secret="slack-signing-secret",
+        )
+        resp, akuc = await self._call(monkeypatch, req)
+        assert resp.secret == "slack-signing-secret"
+        assert akuc.create.await_args.kwargs["api_key"] == "slack-signing-secret"