v0.0.1

[0.0.1] - 2026-11-13

Added

• Status's account (teamId, userId, enterpriseId), from auth.test. Thanks to @domeevans (#18).
• The tools RPC's status method (slack_status, allowed at every access). Thanks to @domeevans (#18).
• slack_mark_read / mark_read (write): Slack's conversations.mark. Needs a :write scope; SCOPE_MISSING without it. Thanks to @domeevans (#18).
• oauth.auth_server_metadata_url, passed unchanged into the slack server's oauth block, so a host with an https: callback can keep Slack's client secret on its own sign-in service. OpenCode uses that document in place of Slack's for the whole sign-in; SECURITY.md says what its server controls. Without it the entry is unchanged.
• The jelly access setting declares its choices (needs a jelly that includes app#1301).
• The README and docs/configuration.md say that Slack refreshes without a secret only for desktop redirects, and answers a refused refresh with HTTP 200 bad_client_secret.

Changed

• The plugin now reads the Slack token, in src/slack-api.ts only, to call auth.test and conversations.mark, and never stores, logs or returns it.

Known limits

• Slack's server and Slack's tools. The plugin adds Slack's hosted MCP server and no wrapper tools; its only Web API calls, auth.test and conversations.mark, are tested against a fake Slack, not a live one. Tool schemas, results (Markdown text, not JSON) and rate limits are Slack's.
• The default access is all. Agents can then read private channels and files, and send or change things, without asking. Set access to "ask-changes" or "read-only" to restrict it; see Permissions.
• Tool classes are set by hand. A tool Slack adds later runs under the namespace rule (allowed at all, asks at ask-changes, denied at read-only) and is not a script method until the plugin classifies it. /slack-status names such tools.
• mark_read needs im:write, channels:write or the like, not in the default scopes.
• Jelly. access needs a Jelly with app#1301.
• Private search needs scopes the default sign-in lacks. With the default scopes, Slack answers missing_scope for it. See the scope table.
• Tested on OpenCode 2.2.3, 2.2.4, 2.2.5 and 2.2.6 only. Other releases in >=2.2.3 <2.3.0 run untested.
• A script's calls are not recorded in the session. Slack's audit logs record them.
• Names keep the doubled prefix. A permission action is the tool's full name, such as slack_slack_search_public. Renaming it would break saved rules.
• Updates are not automatic for a Git install, and opencode plugin update and opencode plugin check do not work on one: to move to a newer release, remove the old entry and add the new tag.

v0.0.0

[0.0.0] - 2026-11-10

Added

• opencode.icons and opencode.vendor, with assets/icon.svg, icon-128.png and icon-256.png from the family icon kit, the three exports and files entries, and the icons stage of npm run check.
• An actionlint stage, and an actionlint job in CI.
• One typed code table, src/codes.ts, with a test that fails when a code in src is missing from it, or when the README's or the scripting doc's table drifts from it.
• A test that parses every example in docs/scripting.md and the README: the method, the location header, the strict envelope and the tool's own fields.

Changed

• The Slack skill's first line says how to sign in when the tools are absent: /connect, or on Jelly jelly_connection_request.
• docs/scripting.md says a script's session needs the project as its location; without one, each call fails Agent not found.
• SKILLS_INVALID says to reinstall the plugin from its tag: opencode plugin remove with the installed spec, then opencode plugin add with it. opencode plugin update does not take a Git install.
• slack_events_list runs without a prompt at every access value, because it is a read and Memory's collector runs it unattended. Its six error codes are in the Troubleshooting table.
• Every tool is allowed by default. The generated block allows every Slack tool and the slack_* namespace, so a tool Slack adds later runs at once and a script can call everything. The Jelly declaration's tools are all allow. Restrict it with access, with an agent's own rules, or with a rule per tool; the README's Permissions section, docs/configuration.md, SECURITY.md and the slack-search skill say what an all-allow default means and how to restrict it.
• The access option, "all" (the default), "ask-changes" and "read-only" (there is no earlier option to map): it generates the default rules from the tool classes, so "ask-changes" lets the reads run and asks for the private-channel search, file reads, writes, sends and new tools, and "read-only" denies them. Status and the /slack dialog show what it allows.
• docs/scripting.md carries the family's envelope, location section, unload note, result wording and refusal table, word for word.
• tools RPC v2: every known tool is scriptable under a prior explicit allow. slack.workspace.tools now has one method per known tool, by exact name and with a class (read, send or write), not only the fourteen reads. The rule for each call is resolved before the tool runs, in OpenCode's own order; only an allow runs, and an ask is refused with no prompt and no tool call. describe reports each method's class, and — given a session — that session's permission, plus any live tool this plugin does not classify. A saved "Always allow" approval no longer authorizes an ad-hoc script: a script's grant is a rule in the agent's or the session's config, or a Jobs jobs_run_script run session. opencode api callers must send -H "x-opencode-directory:$PWD", or the call reaches the service's default location and fails rpc.unavailable.

Known limits

• Slack's server and Slack's tools. The plugin adds Slack's hosted MCP server and nothing else: no Slack Web API client and no wrapper tools. Tool schemas, results (Markdown text, not JSON) and rate limits are Slack's.
• The default access is all. Agents can then read private channels and files, and send or change things, without asking. Set access to "ask-changes" or "read-only" to restrict it; see Permissions.
• Tool classes are set by hand. A tool Slack adds later runs under the namespace rule (allowed at all, asks at ask-changes, denied at read-only) and is not a script method until the plugin classifies it. /slack-status names such tools.
• Private search needs scopes the default sign-in lacks. With the default scopes, Slack answers missing_scope for it. See the scope table.
• Tested on OpenCode 2.2.3, 2.2.4, 2.2.5 and 2.2.6 only. Other releases in >=2.2.3 <2.3.0 run untested.
• A script's calls are not recorded in the session. Slack's audit logs record them.
• Names keep the doubled prefix. A permission action is the tool's full name, such as slack_slack_search_public. Renaming it would break saved rules.
• Updates are not automatic for a Git install, and opencode plugin update and opencode plugin check do not work on one: to move to a newer release, remove the old entry and add the new tag.