From b9e07ad7b4fa65e6a2e29589fbc48ee6c0e72da5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jc=20Mi=C3=B1arro?= Date: Sun, 1 Mar 2026 18:25:52 +0100 Subject: [PATCH] docs(slack): add missing DM scopes to manifest (openclaw#29999) thanks @JcMinarro Verified: - pnpm install --frozen-lockfile - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: JcMinarro <4047514+JcMinarro@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com> --- CHANGELOG.md | 1 + docs/channels/slack.md | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 9d4cb83b551..68bc9cd52b7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -83,6 +83,7 @@ Docs: https://docs.openclaw.ai ### Fixes +- Docs/Slack manifest scopes: add missing DM/group-DM bot scopes (`im:read`, `im:write`, `mpim:read`, `mpim:write`) to the Slack app manifest example so DM setup guidance is complete. (#29999) Thanks @JcMinarro. - Slack/Bot attachment-only messages: when `allowBots: true`, bot messages with empty `text` now include non-forwarded attachment `text`/`fallback` content so webhook alerts are not silently dropped. (#27616) - Slack/Inbound media auth + HTML guard: keep Slack auth headers on forwarded shared attachment image downloads, and reject login/error HTML payloads (while allowing expected `.html` uploads) when resolving Slack media so auth failures do not silently pass as files. (#18642) - Slack/Security ingress mismatch guard: drop slash-command and interaction payloads when app/team identifiers do not match the active Slack account context (including nested `team.id` interaction payloads), preventing cross-app or cross-workspace payload injection into system-event handling. (#29091) Thanks @Solvely-Colin. diff --git a/docs/channels/slack.md b/docs/channels/slack.md index 4fa23cf1ee7..6cd8bfccf81 100644 --- a/docs/channels/slack.md +++ b/docs/channels/slack.md @@ -359,7 +359,11 @@ Notes: "channels:read", "groups:history", "im:history", + "im:read", + "im:write", "mpim:history", + "mpim:read", + "mpim:write", "users:read", "app_mentions:read", "assistant:write",