fix(slack): prompt reconnect when a DM grant predates im:read

The `dms` optional scope group originally requested only im:history/im:write
and their mpim counterparts. im:read/mpim:read were added later, because
enumerating DM conversations (conversations.list with types=im,mpim) needs the
read scopes rather than the history ones.

OAuth scopes are fixed when the grant is made, so a connection authorized
before that change keeps the older scope set and cannot enumerate DMs. The
resulting failure is silent and permanent:

  - registerDMWebhook only needs im:history, so the DM webhook registers and
    the connection looks healthy.
  - listDMChannels guards on im:read and returns early, so `dm_channels` is
    never populated.
  - isKnownDMChannel therefore rejects every incoming DM event, and no DM ever
    syncs — with no error surfaced and no reconnect prompt.

That early return exists so a user who declined DM sync isn't force-flagged for
reconnection by a missing_scope error. But it could not tell "declined DM sync"
apart from "opted in on an older grant", so it silently stranded the latter.

Both scopes come from the same group, so im:history without im:read can only
mean an older grant, never a decline. Use that to disambiguate: flag re-auth so
the user is prompted to reconnect and re-consent. A connection that declined DM
sync has neither scope and is left alone, preserving the original guard.

Reconnecting is required to recover — a scope the grant never had cannot be
obtained without re-consent.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: KrisBraun

connectors/slack/src/slack.test.ts

@@ -494,6 +494,50 @@ describe("listDMChannels", () => {
     expect(markNeedsReauth).not.toHaveBeenCalled();
     expect(store.map.has("dm_channels")).toBe(false);
   });
+
+  it("flags re-auth when the token has im:history but not im:read (opted into DMs on a pre-im:read grant)", async () => {
+    // A token granted before im:read/mpim:read joined the `dms` scope group
+    // carries im:history but not im:read. That user OPTED IN to DM sync, so
+    // silently no-oping strands them: the DM webhook registers (it only needs
+    // im:history), but listDMChannels never populates `dm_channels`, so
+    // isKnownDMChannel rejects every incoming DM event forever — while the
+    // connection still reports itself healthy. Both scopes come from the same
+    // group, so im:history-without-im:read can only mean a stale grant, never
+    // a decline; prompt a reconnect to re-consent.
+    const store = makeStore({});
+    const integrationsGet = vi.fn().mockResolvedValue({
+      token: "xoxp-test",
+      scopes: ["channels:history", "im:history", "im:write", "mpim:history"], // pre-fix grant
+    });
+    const markNeedsReauth = vi.fn().mockResolvedValue(undefined);
+    const create = vi.fn(async () => ({ token: "cb" }) as never);
+    const tools = {
+      store,
+      integrations: { get: integrationsGet, markNeedsReauth },
+      network: { createWebhook: vi.fn() },
+      files: {},
+      callbacks: { create },
+      tasks: { runTask: vi.fn(async () => "task-token"), scheduleRecurring: vi.fn(async () => {}) },
+    };
+    const slack = new Slack("twist-instance-1" as never, { getTools: () => tools } as never);
+
+    const fetchMock = vi.fn();
+    vi.stubGlobal("fetch", fetchMock);
+    try {
+      await (slack as unknown as {
+        listDMChannels: (c: string) => Promise<void>;
+      }).listDMChannels("C1");
+    } finally {
+      vi.unstubAllGlobals();
+    }
+
+    // Still no API call: the grant genuinely lacks the enumeration scope, so
+    // conversations.list would only return missing_scope.
+    expect(fetchMock).not.toHaveBeenCalled();
+    // ...but unlike a decline, surface it so the user can reconnect.
+    expect(markNeedsReauth).toHaveBeenCalledWith("C1");
+    expect(store.map.has("dm_channels")).toBe(false);
+  });
 });
 
 describe("extractSlackMessageReactions (custom emoji)", () => {

connectors/slack/src/slack.ts

@@ -1683,11 +1683,16 @@ export class Slack extends Connector<Slack> {
    * immediately if proactively registered (see `createDirectMessage`).
    *
    * Requires the `im:read` optional scope (part of the `dms` group) to have
-   * been granted — no-ops otherwise (the user declined DM sync at connect
-   * time). Without this guard, a token missing `im:read` would hit
+   * been granted. Without that guard, a token missing `im:read` would hit
    * `conversations.list`, get back `missing_scope` (a permanent error in
    * `SLACK_AUTH_ERRORS`), and force-flag the entire connection as needing
    * reconnection even though nothing is actually broken.
+   *
+   * When `im:read` is absent, `im:history` disambiguates why: both come from
+   * the `dms` group, so having `im:history` alone means the user opted into DM
+   * sync on a grant made before `im:read` joined that group. That grant can
+   * never enumerate DMs, so re-auth is flagged to prompt a reconnect. A user
+   * who declined DM sync has neither scope and is left alone.
    */
   async listDMChannels(channelId: string): Promise<void> {
     const now = Date.now();
@@ -1700,7 +1705,20 @@ export class Slack extends Connector<Slack> {
       console.warn("listDMChannels: Slack token unavailable");
       return;
     }
-    if (!token.scopes?.includes("im:read")) return; // optional scope declined
+    if (!token.scopes?.includes("im:read")) {
+      // im:read and im:history are granted together by the `dms` group, so a
+      // token carrying im:history WITHOUT im:read predates im:read joining
+      // that group — the user opted into DM sync but their grant can't
+      // enumerate DMs. Returning quietly would strand them permanently: the
+      // DM webhook registers (im:history is enough), but `dm_channels` stays
+      // empty, so isKnownDMChannel drops every incoming DM while the
+      // connection still reports healthy. Prompt a reconnect to re-consent.
+      // A user who declined DMs has neither scope and is left alone.
+      if (token.scopes?.includes("im:history")) {
+        await this.tools.integrations.markNeedsReauth(channelId);
+      }
+      return;
+    }
 
     const api = new SlackApi(token.token);