fix(slack-search): align custom and shared app permissions

[TheodoreSpeaks]

Summary

• Give custom and shared Slack Search manifests the same complete permission sets: 23 bot scopes and 22 user scopes, with existing custom user scopes preserved.
• Require channels:read and groups:read when connecting or authorizing a bot so the source channel picker can list accessible channels. Document how existing installations approve the added scopes and reconnect.
• Keep member OAuth requests and runtime validation limited to implemented capabilities; expanded manifest declarations do not automatically grant every scope to member connections.

Type of Change

• Bug fix

Testing

• 145 focused tests cover exact manifest scope sets, existing-grant preservation, bot authorization, setup, channel selection, and Slack indexing.
• App type-check, repository lint, all repository audits, block registry, docs manifest, and API validation passed. No migrations changed.
• Live Slack reinstallation and channel listing have not been retested with the added scopes.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 21, 2026 5:52pm UTC

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the manifest expansion is intentionally separated from the narrower scopes requested and validated by implemented runtime flows.

Summary

Aligns custom and shared Slack Search manifests while preserving narrower runtime authorization requirements.

• Adds channels:read and groups:read to required bot grants so the source channel picker can enumerate accessible conversations.
• Gives custom and shared manifests identical bot and user scope declarations while preserving existing custom user scopes without duplicates.
• Adds focused authorization, verification, and manifest tests.
• Documents scope approval, reinstallation, reconnection, and channel-picker troubleshooting.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Manifest[Custom or shared Slack manifest] --> Declared[Complete declared scope sets]
  Declared --> Install[Slack app installation]
  Install --> BotOAuth[Bot OAuth]
  BotOAuth --> BotValidation[Validate implemented bot scopes]
  BotValidation --> Picker[Channel picker]
  Declared --> MemberOAuth[Member OAuth]
  MemberOAuth --> MemberValidation[Request and validate implemented user scopes]
  MemberValidation --> Indexing[Slack indexing]

Loading

_{Reviews (2) · Last reviewed commit: "fix(slack-search): include full scope se..."}

[TheodoreSpeaks]

@greptile

[TheodoreSpeaks]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@TheodoreSpeaks I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 6 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}