feat(agentex): Linear gateway — invoke agents from Linear (re-land)

agentex/openapi.yaml

@@ -2985,6 +2985,21 @@ paths:
             application/json:
               schema:
                 $ref: '#/components/schemas/HTTPValidationError'
+  /linear/events:
+    post:
+      tags:
+      - Linear
+      summary: Linear agent webhook ingress for the @agentex app
+      operationId: linear_events_linear_events_post
+      responses:
+        '200':
+          description: Successful Response
+          content:
+            application/json:
+              schema:
+                additionalProperties: true
+                type: object
+                title: Response Linear Events Linear Events Post
   /deployment-history/{deployment_id}:
     get:
       tags:

agentex/src/api/app.py

@@ -37,6 +37,7 @@
     deployment_history,
     deployments,
     events,
+    linear,
     messages,
     slack,
     spans,
@@ -204,7 +205,7 @@ async def handle_unexpected(request, exc):
 fastapi_app.include_router(slack.router)
 fastapi_app.include_router(agent_task_tracker.router)
 fastapi_app.include_router(agent_api_keys.router)
-fastapi_app.include_router(slack.router)
+fastapi_app.include_router(linear.router)
 fastapi_app.include_router(deployment_history.router)
 fastapi_app.include_router(deployments.router)
 # Agent run schedules are feature-flagged (off by default, enabled in development).

agentex/src/api/middleware_utils.py

@@ -17,9 +17,8 @@
 WHITELISTED_ROUTES: set[str] = {
     "/agents/register",
     "/agents/forward",
-    # Slack can't present an SGP principal; the Slack signature is the auth,
-    # verified inside SlackGatewayUseCase against the app's signing secret.
     "/slack",
+    "/linear",
     "/docs",
     "/api",
     "/openapi.json",

agentex/src/api/routes/linear.py

@@ -0,0 +1,28 @@
+"""Linear gateway ingress — POST /linear/events.
+
+The webhook URL for the ``@agentex`` Linear agent app. Auth-whitelisted (like
+/slack) because Linear can't present an SGP principal; the Linear-Signature is the
+auth, verified in the use case against the app's webhook signing secret. Delegates
+all logic to LinearGatewayUseCase.
+"""
+
+from fastapi import APIRouter, BackgroundTasks, Request
+
+from src.domain.use_cases.linear_gateway_use_case import DLinearGatewayUseCase
+
+router = APIRouter(prefix="/linear", tags=["Linear"])
+
+
+@router.post("/events", summary="Linear agent webhook ingress for the @agentex app")
+async def linear_events(
+    request: Request,
+    background: BackgroundTasks,
+    use_case: DLinearGatewayUseCase,
+) -> dict:
+    # Read the raw body first (needed for HMAC signature verification), then parse.
+    body = await request.body()
+    payload = await request.json()
+    headers = {k.lower(): v for k, v in request.headers.items()}
+    return await use_case.handle_linear_event(
+        body=body, headers=headers, payload=payload, background=background
+    )