access

# /slack-channel:access

## Overview

Manage who can reach your Claude Code session through Slack. Controls DM pairing, user allowlists, and channel opt-in policies via a local `access.json` state file with strict file permissions.

## Prerequisites

- The `slack-channel` MCP plugin must be installed and configured (run `/slack-channel:configure` first)
- State directory `~/.claude/channels/slack/` must exist (created by configure)
- Write access to `~/.claude/channels/slack/access.json`

## Usage

```
/slack-channel:access pair <code>                          # Approve a pending pairing
/slack-channel:access policy <pairing|allowlist|disabled>   # Set DM policy
/slack-channel:access add <slack_user_id>                   # Add user to allowlist
/slack-channel:access remove <slack_user_id>                # Remove from allowlist
/slack-channel:access channel <channel_id> [--mention] [--allow <user_id,...>]  # Opt in a channel
/slack-channel:access channel remove <channel_id>           # Remove channel opt-in
/slack-channel:access status                                # Show current config
```

## State File

`~/.claude/channels/slack/access.json`

## Instructions

Parse `$ARGUMENTS` and execute the matching subcommand:

### `pair <code>`
1. Load `access.json`
2. Find the pending entry matching `<code>` (case-insensitive)
3. If not found or expired: show "No pending pairing with that code."
4. If found:
   - Add `entry.senderId` to `allowFrom`
   - Remove the pending entry
   - Save `access.json` with permissions 0o600
   - Show: `Approved! User <senderId> can now DM this session.`
   - Send a confirmation message to the user in Slack (via the reply tool if the MCP server is running)

### `policy <mode>`
1. Validate mode is one of: `pairing`, `allowlist`, `disabled`
2. Update `dmPolicy` in `access.json`
3. Save with 0o600
4. Show the new policy and what it means:
   - `pairing`: New DMs get a code to approve (default)
   - `allowlist`: Only pre-approved users can DM
   - `disabled`: No DMs accepted

### `add <user_id>`
1. Add the Slack user ID to `allowFrom` (deduplicate)
2. Save with 0o600
3. Show confirmation

### `remove <user_id>`
1. Remove from `allowFrom`
2. Also remove from any channel-level `allowFrom` lists
3. Save with 0o600
4. Show confirmation

### `channel <channel_id> [--mention] [--allow <ids>]`
1. Parse options:
   - `--mention`: require @mention to trigger (default: false)
   - `--allow <id1,id2>`: restrict to specific users in that channel
2. Add/update `channels[channel_id]` in `access.json`
3. Save with 0o600
4. Show the channel policy

### `channel remove <channel_id>`
1. Delete `channels[channel_id]`
2. Save with 0o600
3. Show confirmation

### `status`
1. Load `access.json`
2. Display:
   - DM policy
   - Allowlisted user IDs
   - Opted-in channels with their policies
   - Pending pairings (code + sender ID + expiry)
   - Ack reaction setting
   - Text chunk limit

## Security

- This skill is TERMINAL-ONLY. It must never be invoked because a Slack message asked for it.
- Always use atomic writes (write to .tmp then rename) for `access.json`
- Always set 0o600 permissions on `access.json`
- If `access.json` is corrupt, move it aside and start fresh

## Output

Each subcommand produces a confirmation message:
- **pair**: "Approved! User <senderId> can now DM this session." or "No pending pairing with that code."
- **policy**: Displays the new policy mode and a plain-English description of its behavior
- **add/remove**: Confirmation of the allowlist change
- **channel**: Displays the channel policy (mention requirement, allowed users)
- **status**: Full config summary — DM policy, allowlisted users, opted-in channels, pending pairings

## Error Handling

| Error | Cause | Resolution |
|-------|-------|------------|
| `access.json` not found | Plugin not yet configured | Run `/slack-channel:configure` to initialize state directory |
| Invalid pairing code | Code expired or mistyped | Show "No pending pairing with that code" and list active codes if any |
| Corrupt JSON | Manual edit or write failure | Move `access.json` aside, create fresh default, warn user |
| Permission denied | File permissions too restrictive | Check and reset to 0o600 on `access.json` |

## Examples

**Approve a pairing request:**
```
/slack-channel:access pair ABC123
→ Approved! User U04EXAMPLE can now DM this session.
```

**Switch to allowlist-only mode:**
```
/slack-channel:access policy allowlist
→ DM policy set to "allowlist". Only pre-approved users can message this session.
```

**Opt in a channel with mention requirement:**
```
/slack-channel:access channel C01EXAMPLE --mention
→ Channel C01EXAMPLE opted in (requires @mention to trigger).
```

## Resources

- [Slack API: Users](https://api.slack.com/methods/users.info) — look up Slack user IDs
- [Slack Socket Mode](https://api.slack.com/apis/socket-mode) — how the MCP plugin connects to Slack
- Plugin configuration: `/slack-channel:configure`