@@ -494,6 +494,50 @@ describe("listDMChannels", () => {
     expect(markNeedsReauth).not.toHaveBeenCalled();
     expect(store.map.has("dm_channels")).toBe(false);
   });
+
+  it("flags re-auth when the token has im:history but not im:read (opted into DMs on a pre-im:read grant)", async () => {
+    // A token granted before im:read/mpim:read joined the `dms` scope group
+    // carries im:history but not im:read. That user OPTED IN to DM sync, so
+    // silently no-oping strands them: the DM webhook registers (it only needs
+    // im:history), but listDMChannels never populates `dm_channels`, so
+    // isKnownDMChannel rejects every incoming DM event forever — while the
+    // connection still reports itself healthy. Both scopes come from the same
+    // group, so im:history-without-im:read can only mean a stale grant, never
+    // a decline; prompt a reconnect to re-consent.
+    const store = makeStore({});
+    const integrationsGet = vi.fn().mockResolvedValue({
+      token: "xoxp-test",
+      scopes: ["channels:history", "im:history", "im:write", "mpim:history"], // pre-fix grant
+    });
+    const markNeedsReauth = vi.fn().mockResolvedValue(undefined);
+    const create = vi.fn(async () => ({ token: "cb" }) as never);
+    const tools = {
+      store,
+      integrations: { get: integrationsGet, markNeedsReauth },
+      network: { createWebhook: vi.fn() },
+      files: {},
+      callbacks: { create },
+      tasks: { runTask: vi.fn(async () => "task-token"), scheduleRecurring: vi.fn(async () => {}) },
+    };
+    const slack = new Slack("twist-instance-1" as never, { getTools: () => tools } as never);
+
+    const fetchMock = vi.fn();
+    vi.stubGlobal("fetch", fetchMock);
+    try {
+      await (slack as unknown as {
+        listDMChannels: (c: string) => Promise<void>;
+      }).listDMChannels("C1");
+    } finally {
+      vi.unstubAllGlobals();
+    }
+
+    // Still no API call: the grant genuinely lacks the enumeration scope, so
+    // conversations.list would only return missing_scope.
+    expect(fetchMock).not.toHaveBeenCalled();
+    // ...but unlike a decline, surface it so the user can reconnect.
+    expect(markNeedsReauth).toHaveBeenCalledWith("C1");
+    expect(store.map.has("dm_channels")).toBe(false);
+  });
 });
 
 describe("extractSlackMessageReactions (custom emoji)", () => {
 
@@ -1683,11 +1683,16 @@ export class Slack extends Connector<Slack> {
    * immediately if proactively registered (see `createDirectMessage`).
    *
    * Requires the `im:read` optional scope (part of the `dms` group) to have
-   * been granted — no-ops otherwise (the user declined DM sync at connect
-   * time). Without this guard, a token missing `im:read` would hit
+   * been granted. Without that guard, a token missing `im:read` would hit
    * `conversations.list`, get back `missing_scope` (a permanent error in
    * `SLACK_AUTH_ERRORS`), and force-flag the entire connection as needing
    * reconnection even though nothing is actually broken.
+   *
+   * When `im:read` is absent, `im:history` disambiguates why: both come from
+   * the `dms` group, so having `im:history` alone means the user opted into DM
+   * sync on a grant made before `im:read` joined that group. That grant can
+   * never enumerate DMs, so re-auth is flagged to prompt a reconnect. A user
+   * who declined DM sync has neither scope and is left alone.
    */
   async listDMChannels(channelId: string): Promise<void> {
     const now = Date.now();
@@ -1700,7 +1705,20 @@ export class Slack extends Connector<Slack> {
       console.warn("listDMChannels: Slack token unavailable");
       return;
     }
-    if (!token.scopes?.includes("im:read")) return; // optional scope declined
+    if (!token.scopes?.includes("im:read")) {
+      // im:read and im:history are granted together by the `dms` group, so a
+      // token carrying im:history WITHOUT im:read predates im:read joining
+      // that group — the user opted into DM sync but their grant can't
+      // enumerate DMs. Returning quietly would strand them permanently: the
+      // DM webhook registers (im:history is enough), but `dm_channels` stays
+      // empty, so isKnownDMChannel drops every incoming DM while the
+      // connection still reports healthy. Prompt a reconnect to re-consent.
+      // A user who declined DMs has neither scope and is left alone.
+      if (token.scopes?.includes("im:history")) {
+        await this.tools.integrations.markNeedsReauth(channelId);
+      }
+      return;
+    }
 
     const api = new SlackApi(token.token);