Changeset 0.28.0.2 (#174)

server/tools/task_create.go

@@ -11,7 +11,6 @@ import (
 	"git.gobha.me/xcaliber/chat-switchboard/models"
 	"git.gobha.me/xcaliber/chat-switchboard/store"
 	"git.gobha.me/xcaliber/chat-switchboard/taskutil"
-	"git.gobha.me/xcaliber/chat-switchboard/webhook"
 )
 
 // ── Late Registration ────────────────────────
@@ -100,6 +99,12 @@ func (t *taskCreateTool) Execute(ctx context.Context, execCtx ExecutionContext,
 		return "", fmt.Errorf("name, prompt, and schedule are required")
 	}
 
+	// F5 audit fix: reject webhook schedule — webhook-triggered tasks
+	// require API creation (trigger token generation, no cron).
+	if args.Schedule == "webhook" {
+		return "", fmt.Errorf("webhook-triggered tasks cannot be created via this tool — use the API directly")
+	}
+
 	// Validate cron
 	if err := taskutil.ValidateCron(args.Schedule); err != nil {
 		return "", fmt.Errorf("invalid schedule: %w", err)
@@ -162,9 +167,6 @@ func (t *taskCreateTool) Execute(ctx context.Context, execCtx ExecutionContext,
 	cfg := taskutil.LoadTaskConfig(ctx, t.stores.GlobalConfig)
 	cfg.ApplyDefaults(task)
 
-	// Generate webhook secret in case webhook is added later
-	task.WebhookSecret = webhook.GenerateSecret()
-
 	// Compute next_run_at
 	if args.Schedule == "once" {
 		now := time.Now().UTC()