configure

/slack-channel:configure

Overview

Configure the Slack channel with its bot and app-level tokens. This is the only token-writing path: validate prefixes, write .env with owner-only permissions, never echo secrets, and return control to the install walkthrough.

Prerequisites

A Slack app already created (via /slack-channel:install Step 1 or manually at api.slack.com/apps) with:
- the Bot User OAuth Token (xoxb-...) from OAuth & Permissions, and
- the App-Level Token (xapp-..., scope connections:write) from Socket Mode settings.
A writable home directory — state lives at ~/.claude/channels/slack/.

Usage

Pass both tokens as arguments, bot token first. Obtain them directly from the Slack app dashboard and avoid shell history or shared transcripts:

/slack-channel:configure <xoxb-bot-token> <xapp-app-token>

Authentication

The xoxb- Bot User OAuth Token represents the installed bot and authorizes Web API calls within its granted bot scopes.
The xapp- app-level token represents the Slack app and requires connections:write to open the Socket Mode WebSocket.
Prefix checks establish token type, not validity. install doctor verifies liveness against Slack without printing the credential.
Store tokens only in ~/.claude/channels/slack/.env; never commit them or include them in output, logs, screenshots, or issue reports.

Read references/official-auth.md when creating, rotating, revoking, or diagnosing either token type.

Instructions

Parse the two arguments from $ARGUMENTS:
- First token must start with xoxb- (Bot User OAuth Token)
- Second token must start with xapp- (App-Level Token)

If either token is missing or has the wrong prefix, show this error and stop:

Error: Two tokens required.
  - Bot token (starts with xoxb-) from OAuth & Permissions
  - App token (starts with xapp-) from Socket Mode settings

Usage: /slack-channel:configure xoxb-... xapp-...

Create the state directory if it doesn't exist, then make the directory owner-only before writing any secret-bearing file:

mkdir -p ~/.claude/channels/slack
# 0700 = owner may read/write/traverse; no group or other access
chmod 700 ~/.claude/channels/slack

Pre-create the fixed candidate path with owner-only permissions, then use Write to replace its complete contents. This makes the file 0600 from the instant it exists, independent of the process umask:
```
# 0600 = owner read/write; no group or other access
install -m 600 /dev/null ~/.claude/channels/slack/.env.tmp
```
Write this complete content to ~/.claude/channels/slack/.env.tmp:
```
SLACK_BOT_TOKEN=<bot-token>
SLACK_APP_TOKEN=<app-token>
```
Set the candidate file to owner-only, then atomically replace .env. If Write, chmod, or mv fails before replacement, remove only the exact candidate path ~/.claude/channels/slack/.env.tmp; leave the prior .env untouched.
```
# 0600 = owner read/write; no group or other access
chmod 600 ~/.claude/channels/slack/.env.tmp
mv ~/.claude/channels/slack/.env.tmp ~/.claude/channels/slack/.env
```

Confirm success:

Slack channel configured.

Start Claude with the Slack channel:
  claude --channels plugin:slack-channel@claude-code-plugins

Or for development:
  claude --dangerously-load-development-channels server:slack

Next: opt in a channel and pick its interaction mode with
/slack-channel:access channel <id>  (defaults to mention-to-engage;
pass --ambient for a dedicated bot channel). See ACCESS.md "Interaction modes".

Output

On success: ~/.claude/channels/slack/.env atomically replaced with both tokens and mode 0600, plus the confirmation block above (server start command and the pointer to channel opt-in). Tokens are never echoed.
On failure: the two-token usage error from step 2 and no file changes.

Error Handling

Missing token or wrong prefix — show the step-2 error block and stop; nothing is written. Bot tokens must start with xoxb-, app tokens with xapp-.
Tokens swapped — the prefix check catches it; re-run with the bot token first.
Existing .env — re-running atomically replaces it; this is the supported token-rotation path (rotation happens at api.slack.com/apps).
Write, permission, or move failure — remove only the fixed candidate ~/.claude/channels/slack/.env.tmp, leave the previous .env intact, and report only the failed stage without printing values.
Revoked/invalid tokens — this skill only validates prefixes, not liveness. If the server later fails auth, run /slack-channel:install doctor (checks 4–5 test both tokens live against the Slack API).

Examples

Both flows are the same command — the second run simply overwrites .env:

# First-time setup (illustrative placeholders, not live credentials)
/slack-channel:configure xoxb-WORKSPACE-EXAMPLE xapp-APP-EXAMPLE

# Rotation after regenerating tokens in the Slack UI — same command, overwrites .env
/slack-channel:configure xoxb-NEW-TOKEN xapp-NEW-TOKEN

Security

Never echo the tokens back in the confirmation message
Never log tokens to stdout or any file other than .env
Secure the state directory as 0700 before writing the candidate
Always set 0600 on the candidate before atomically moving it into place

Safety justification

rm is permitted only to clean the single fixed candidate path ~/.claude/channels/slack/.env.tmp after a failed rotation. Never pass a variable, glob, directory, recursive flag, or any other path to rm; never remove the previous .env.

Resources

skills/install/SKILL.md — the full install lifecycle that delegates to this skill (Step 3) and the doctor that verifies token liveness
skills/access/SKILL.md — the next step after configuring: channel opt-in and pairing
ACCESS.md — interaction modes referenced in the confirmation message
README.md — quick start, including Node.js and Docker server alternatives