@@ -421,7 +421,10 @@ describe("listDMChannels", () => {
 
   it("caches discovered im/mpim channel ids and gates re-runs to once per 24h", async () => {
     const store = makeStore({});
-    const integrationsGet = vi.fn().mockResolvedValue({ token: "xoxp-test" });
+    const integrationsGet = vi.fn().mockResolvedValue({
+      token: "xoxp-test",
+      scopes: ["im:read", "mpim:read"],
+    });
     const slack = makeDMListSlack({ store, integrationsGet });
 
     const fetchMock = vi.fn(async () =>
@@ -452,6 +455,45 @@ describe("listDMChannels", () => {
       vi.unstubAllGlobals();
     }
   });
+
+  it("no-ops when im:read is not granted, without calling the API or flagging re-auth", async () => {
+    // Guards against the false-positive-reconnect bug class this branch
+    // otherwise fixes: without this guard, a token missing im:read hits
+    // conversations.list, gets `missing_scope` back (a SlackPermanentError
+    // in SLACK_AUTH_ERRORS), and markNeedsReauth force-flags the whole
+    // connection as needing reconnection even though nothing is broken.
+    const store = makeStore({});
+    const integrationsGet = vi.fn().mockResolvedValue({
+      token: "xoxp-test",
+      scopes: ["channels:history"], // no im:read
+    });
+    const markNeedsReauth = vi.fn().mockResolvedValue(undefined);
+    const runTask = vi.fn(async () => "task-token");
+    const create = vi.fn(async () => ({ token: "cb" }) as never);
+    const tools = {
+      store,
+      integrations: { get: integrationsGet, markNeedsReauth },
+      network: { createWebhook: vi.fn() },
+      files: {},
+      callbacks: { create },
+      tasks: { runTask, scheduleRecurring: vi.fn(async () => {}) },
+    };
+    const slack = new Slack("twist-instance-1" as never, { getTools: () => tools } as never);
+
+    const fetchMock = vi.fn();
+    vi.stubGlobal("fetch", fetchMock);
+    try {
+      await (slack as unknown as {
+        listDMChannels: (c: string) => Promise<void>;
+      }).listDMChannels("C1");
+    } finally {
+      vi.unstubAllGlobals();
+    }
+
+    expect(fetchMock).not.toHaveBeenCalled();
+    expect(markNeedsReauth).not.toHaveBeenCalled();
+    expect(store.map.has("dm_channels")).toBe(false);
+  });
 });
 
 describe("extractSlackMessageReactions (custom emoji)", () => {
@@ -717,6 +759,17 @@ describe("Slack.SCOPES — DM sync is optional and opt-in", () => {
     );
     expect(dmsGroup?.default).toBe(true);
   });
+
+  it("declares im:read and mpim:read in the dms group, required to enumerate/list DM conversations", () => {
+    // conversations.list with types=im,mpim (used by listDMChannels to
+    // discover DM/MPIM conversation ids) requires im:read/mpim:read per
+    // Slack's API docs — distinct from im:history/mpim:history, which only
+    // grant reading message content within an already-known conversation.
+    // Without these, listDMChannels gets `missing_scope` on every call.
+    const dmsGroup = Slack.SCOPES.optional?.find((g) => g.id === "dms");
+    expect(dmsGroup).toBeDefined();
+    expect(dmsGroup?.scopes).toEqual(expect.arrayContaining(["im:read", "mpim:read"]));
+  });
 });
 
 describe("onChannelEnabled — workspace daily task dedup", () => {
 
@@ -82,6 +82,12 @@ import { slackFacets } from "./slack-facets";
  * - `emoji:read` — render the workspace's custom emoji in reactions
  * - `im:history`, `im:write`, `mpim:history`, `mpim:write` — read and compose
  *   direct messages and group DMs
+ * - `im:read`, `mpim:read` — enumerate/list the user's DM and group-DM
+ *   conversations (`conversations.list` with `types=im,mpim`), which is how
+ *   {@link listDMChannels} discovers DM/MPIM conversation ids. Distinct from
+ *   `im:history`/`mpim:history`, which only grant reading message content
+ *   within a conversation whose id is already known — they do not grant
+ *   enumeration, so `listDMChannels` needs both.
  */
 
 /**
@@ -147,7 +153,17 @@ export class Slack extends Connector<Slack> {
         label: "Sync direct messages",
         description:
           "Bring your Slack DMs and group DMs into Plot, and let you send new ones from Plot.",
-        scopes: ["im:history", "im:write", "mpim:history", "mpim:write"],
+        scopes: [
+          "im:history",
+          "im:write",
+          "mpim:history",
+          "mpim:write",
+          // Enumeration scopes: conversations.list with types=im,mpim (used by
+          // listDMChannels to discover conversation ids) requires these, not
+          // the *:history scopes above — see the class doc comment.
+          "im:read",
+          "mpim:read",
+        ],
         default: true,
       },
     ],
@@ -1665,20 +1681,28 @@ export class Slack extends Connector<Slack> {
    * mirroring {@link syncMembers} / {@link syncCustomEmoji}. A brand-new
    * incoming DM conversation is picked up on the next daily run, or
    * immediately if proactively registered (see `createDirectMessage`).
+   *
+   * Requires the `im:read` optional scope (part of the `dms` group) to have
+   * been granted — no-ops otherwise (the user declined DM sync at connect
+   * time). Without this guard, a token missing `im:read` would hit
+   * `conversations.list`, get back `missing_scope` (a permanent error in
+   * `SLACK_AUTH_ERRORS`), and force-flag the entire connection as needing
+   * reconnection even though nothing is actually broken.
    */
   async listDMChannels(channelId: string): Promise<void> {
     const now = Date.now();
     const ONE_DAY_MS = 24 * 60 * 60 * 1000;
     const last = await this.get<number>("dmChannelsSyncedAt");
     if (last && now - last < ONE_DAY_MS) return;
 
-    let api: SlackApi;
-    try {
-      api = await this.getApi(channelId);
-    } catch (error) {
-      console.warn("listDMChannels: Slack token unavailable", error);
+    const token = await this.tools.integrations.get(channelId);
+    if (!token) {
+      console.warn("listDMChannels: Slack token unavailable");
       return;
     }
+    if (!token.scopes?.includes("im:read")) return; // optional scope declined
+
+    const api = new SlackApi(token.token);
 
     const ids: string[] = [];
     let cursor: string | undefined;