/slack-channel:access

Overview

Manage who can reach your Claude Code session through Slack. This terminal-only workflow approves pairing codes, sets the DM policy, maintains allowlists, and atomically updates channel interaction modes in access.json.

Usage

/slack-channel:access pair <code>                          # Approve a pending pairing
/slack-channel:access policy <pairing|allowlist|disabled>   # Set DM policy
/slack-channel:access add <slack_user_id>                   # Add user to allowlist
/slack-channel:access remove <slack_user_id>                # Remove from allowlist
/slack-channel:access channel <channel_id> [--ambient] [--allow <user_id,...>]  # Opt in a channel (default: mention-to-engage)
/slack-channel:access channel remove <channel_id>           # Remove channel opt-in
/slack-channel:access status                                # Show current config

Prerequisites

• A completed install (/slack-channel:install) — the state directory ~/.claude/channels/slack/ must exist.
• State file: ~/.claude/channels/slack/access.json — every subcommand operates on this one file. It holds the DM policy, allowlist, channel opt-ins, and pending pairing codes, and must stay mode 0o600.
• For pair, the MCP server should be running so the confirmation message can be delivered back to the Slack user.

Instructions

Parse $ARGUMENTS and execute the matching subcommand. Use Read to inspect the complete state and Write only for the complete temporary replacement; then use mv for the atomic swap and chmod to restore mode 0600.

pair <code>

1. Load access.json
2. Find the pending entry matching <code> (case-insensitive)
3. If not found or expired: show "No pending pairing with that code."
4. If found:

• Add entry.senderId to allowFrom
• Remove the pending entry
• Save access.json with permissions 0o600
• Show: Approved! User <senderId> can now DM this session.
• Send a confirmation message to the user in Slack (via the reply tool if the MCP server is running)

policy <mode>

1. Validate mode is one of: pairing, allowlist, disabled
2. Update dmPolicy in access.json
3. Save with 0o600
4. Show the new policy and what it means:

• pairing: New DMs get a code to approve (default)
• allowlist: Only pre-approved users can DM
• disabled: No D…

/slack-channel:configure

Overview

Configure the Slack channel with its bot and app-level tokens. This is the only token-writing path: validate prefixes, write .env with owner-only permissions, never echo secrets, and return control to the install walkthrough.

Prerequisites

• A Slack app already created (via /slack-channel:install Step 1 or manually at api.slack.com/apps) with:
• the Bot User OAuth Token (xoxb-...) from OAuth & Permissions, and
• the App-Level Token (xapp-..., scope connections:write) from Socket Mode settings.
• A writable home directory — state lives at ~/.claude/channels/slack/.

Usage

Pass both tokens as arguments, bot token first. Obtain them directly from the Slack app dashboard and avoid shell history or shared transcripts:

/slack-channel:configure <xoxb-bot-token> <xapp-app-token>

Authentication

• The xoxb- Bot User OAuth Token represents the installed bot and authorizes Web API calls within its granted bot scopes.
• The xapp- app-level token represents the Slack app and requires connections:write to open the Socket Mode WebSocket.
• Prefix checks establish token type, not validity. install doctor verifies liveness against Slack without printing the credential.
• Store tokens only in ~/.claude/channels/slack/.env; never commit them or include them in output, logs, screenshots, or issue reports.

Read references/official-auth.md when creating, rotating, revoking, or diagnosing either token type.

Instructions

1. Parse the two arguments from $ARGUMENTS:

• First token must start with xoxb- (Bot User OAuth Token)
• Second token must start with xapp- (App-Level Token)

1. If either token is missing or has the wrong prefix, show this error and stop:

   Error: Two tokens required.
     - Bot token (starts with xoxb-) from OAuth & Permissions
     - App token (starts with xapp-) from Socket Mode settings

   Usage: /slack-channel:configure xoxb-... xapp-...

1. Create the state directory if it doesn't exist, then make the directory owner-only before writing any secret-bearing file:

   mkdir -p ~/.claude/channels/slack
   # 0700 = owner may read/write/traverse; no group or other access
   chmod 700 ~/.claude/channels/slack

1. Pre-create the fixed can…

/slack-channel:install

Overview

Run the CCSC lifecycle from fresh installation through safe teardown. With no argument, execute the complete install walkthrough.

Delegate token storage to /slack-channel:configure and pairing to /slack-channel:access pair. Do not duplicate those security-sensitive flows.

Prerequisites

Before installation, verify:

1. Runtime: Bun 1.0 or newer. Node.js 20+ and Docker 24+ are documented fallbacks.
2. Claude Code: use a current build whose claude --help includes --channels.
3. Anthropic authentication: use either a claude.ai account or an Anthropic Console API key. Team and Enterprise organizations must enable Channels. Bedrock, Google Cloud Agent Platform, and Microsoft Foundry are unsupported for Channels.
4. Slack: use a workspace where the operator may create and install apps.

Run command -v and version/help checks without modifying the machine. Read references/prerequisites.md for exact checks and fallback paths. doctor and repair additionally require curl and jq.

Authentication

Keep the two authentication layers separate:

• Claude Code: authenticate through claude.ai or Anthropic Console. For Team and Enterprise, confirm an Owner enabled Channels or deployed channelsEnabled: true.
• Slack: use a Bot User OAuth Token (xoxb-...) and an app-level token (xapp-...) with connections:write. Store both only through /slack-channel:configure; never print or commit them.

Verify current rules in the Claude Code Channels documentation, …

/slack-channel:policy

Overview

Author, lint, and remove policy rules under access.json's top-level policy field. The evaluator (evaluate() in policy.ts) is the veto layer for every MCP tool call — this skill is the ergonomic front door to authoring rules without opening access.json in a text editor.

See ACCESS.md §Policy schema for the full rule shape and semantics. This skill does not replace the hand-edit path; it complements it.

Prerequisites

• A completed install (/slack-channel:install) — the state file ~/.claude/channels/slack/access.json must exist.
• Bun available on PATH — every write is validated by running bun scripts/policy-validate.ts from the plugin repo.
• Familiarity with the rule shape in ACCESS.md §Policy schema (linked above) helps when composing json-match objects.

Usage

/slack-channel:policy list
/slack-channel:policy lint
/slack-channel:policy add <id> <effect> <json-match> [--reason "..."] [--ttl-ms N] [--approvers N] [--priority N]
/slack-channel:policy remove <id>

Effect is one of auto_approve, deny, require_approval. json-match is a JSON object literal for the match field — e.g. '{"tool":"read_file","pathPrefix":"/workspace/docs"}'. At least one field must be populated; the validator rejects empty matches.

Options by effect

Defaults: priority=100, ttl-ms=300000 (5 min), approvers=1.

State file

~/.claude/channels/slack/access.json — the policy field is a JSON array. A missing or empty array means "no authored rules" and is valid.

Instructions

Parse $ARGUMENTS and execute the matching subcommand. Before every write, run the validator script. Exit cleanly without writing if validation fails.

list

1. Read ~/.claude/channels/slack/access.json
2. If the policy field is missing or empty, print No policy rules…