@vellumai/assistant 0.6.3 → 0.6.4

package/src/runtime/routes/inbound-stages/transcribe-audio.test.ts

@@ -1,6 +1,7 @@
 import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
 
-import type { SpeechToTextProvider } from "../../../providers/speech-to-text/types.js";
+import type { BatchTranscriber } from "../../../stt/types.js";
+import { SttError } from "../../../stt/types.js";
 
 // ---------------------------------------------------------------------------
 // Mocks — must be set up before importing the module under test
@@ -17,7 +18,7 @@ let mockAttachments: Array<{
   thumbnailBase64: string | null;
   createdAt: number;
 }> = [];
-let mockProvider: SpeechToTextProvider | null = null;
+let mockTranscriber: BatchTranscriber | null = null;
 
 mock.module("../../../config/assistant-feature-flags.js", () => ({
   isAssistantFeatureFlagEnabled: () => mockFeatureFlagEnabled,
@@ -35,7 +36,18 @@ mock.module("../../../memory/attachments-store.js", () => ({
 }));
 
 mock.module("../../../providers/speech-to-text/resolve.js", () => ({
-  resolveSpeechToTextProvider: async () => mockProvider,
+  resolveBatchTranscriber: async () => mockTranscriber,
+}));
+
+mock.module("../../../stt/daemon-batch-transcriber.js", () => ({
+  normalizeSttError: (err: unknown): SttError => {
+    if (err instanceof SttError) return err;
+    const message = err instanceof Error ? err.message : String(err);
+    if (err instanceof Error && err.name === "AbortError") {
+      return new SttError("timeout", message);
+    }
+    return new SttError("provider-error", message);
+  },
 }));
 
 mock.module("../../../util/logger.js", () => ({
@@ -105,7 +117,7 @@ describe("tryTranscribeAudioAttachments", () => {
   beforeEach(() => {
     mockFeatureFlagEnabled = true;
     mockAttachments = [];
-    mockProvider = null;
+    mockTranscriber = null;
   });
 
   afterEach(() => {
@@ -115,7 +127,9 @@ describe("tryTranscribeAudioAttachments", () => {
   test("audio attachment is transcribed and returns transcribed result", async () => {
     const audio = makeAudioAttachment("a1");
     mockAttachments = [audio];
-    mockProvider = {
+    mockTranscriber = {
+      providerId: "openai-whisper",
+      boundaryId: "daemon-batch",
       transcribe: async () => ({ text: "Hello, how are you?" }),
     };
 
@@ -131,7 +145,9 @@ describe("tryTranscribeAudioAttachments", () => {
     const doc = makeDocumentAttachment("d1");
     const img = makeImageAttachment("i1");
     mockAttachments = [doc, img];
-    mockProvider = {
+    mockTranscriber = {
+      providerId: "openai-whisper",
+      boundaryId: "daemon-batch",
       transcribe: async () => ({ text: "should not be called" }),
     };
 
@@ -140,23 +156,26 @@ describe("tryTranscribeAudioAttachments", () => {
     expect(result).toEqual({ status: "no_audio" });
   });
 
-  test("no API key returns no_provider with helpful reason string", async () => {
+  test("no provider returns no_provider with service-agnostic reason", async () => {
     const audio = makeAudioAttachment("a1");
     mockAttachments = [audio];
-    mockProvider = null; // No provider resolved
+    mockTranscriber = null; // No transcriber resolved
 
     const result = await tryTranscribeAudioAttachments(["a1"]);
 
     expect(result.status).toBe("no_provider");
-    expect((result as { reason: string }).reason).toContain(
-      "No OpenAI API key configured",
-    );
+    const reason = (result as { reason: string }).reason;
+    expect(reason).toContain("speech-to-text");
+    expect(reason).toContain("voice message transcription");
+    expect(reason).not.toContain("OpenAI");
   });
 
   test("API failure returns error with reason", async () => {
     const audio = makeAudioAttachment("a1");
     mockAttachments = [audio];
-    mockProvider = {
+    mockTranscriber = {
+      providerId: "openai-whisper",
+      boundaryId: "daemon-batch",
       transcribe: async () => {
         throw new Error("API rate limit exceeded");
       },
@@ -183,29 +202,9 @@ describe("tryTranscribeAudioAttachments", () => {
   test("30-second timeout fires and returns error without blocking", async () => {
     const audio = makeAudioAttachment("a1");
     mockAttachments = [audio];
-    mockProvider = {
-      transcribe: async (_audio, _mime, signal) => {
-        // Simulate a provider that respects the abort signal
-        return new Promise((_resolve, reject) => {
-          if (signal?.aborted) {
-            reject(new DOMException("The operation was aborted", "AbortError"));
-            return;
-          }
-          const onAbort = () => {
-            reject(new DOMException("The operation was aborted", "AbortError"));
-          };
-          signal?.addEventListener("abort", onAbort, { once: true });
-        });
-      },
-    };
-
-    // The timeout is 30s in the real code, but the test's mock provider
-    // aborts immediately when signaled. We verify the error path works
-    // by checking the result type. For a true timeout test we'd need
-    // to override the timeout constant, but this confirms the abort
-    // path produces the correct result.
-    // Instead, let's test with a provider that checks signal state:
-    mockProvider = {
+    mockTranscriber = {
+      providerId: "openai-whisper",
+      boundaryId: "daemon-batch",
       transcribe: async () => {
         throw new DOMException("The operation was aborted", "AbortError");
       },
@@ -225,7 +224,9 @@ describe("tryTranscribeAudioAttachments", () => {
     mockAttachments = [a1, a2];
 
     let callCount = 0;
-    mockProvider = {
+    mockTranscriber = {
+      providerId: "openai-whisper",
+      boundaryId: "daemon-batch",
       transcribe: async () => {
         callCount++;
         return { text: callCount === 1 ? "First message" : "Second message" };
@@ -247,7 +248,9 @@ describe("tryTranscribeAudioAttachments", () => {
     mockAttachments = [audio, doc];
 
     let transcribeCallCount = 0;
-    mockProvider = {
+    mockTranscriber = {
+      providerId: "openai-whisper",
+      boundaryId: "daemon-batch",
       transcribe: async () => {
         transcribeCallCount++;
         return { text: "Voice transcription" };
@@ -264,7 +267,9 @@ describe("tryTranscribeAudioAttachments", () => {
   });
 
   test("empty attachment IDs returns no_audio", async () => {
-    mockProvider = {
+    mockTranscriber = {
+      providerId: "openai-whisper",
+      boundaryId: "daemon-batch",
       transcribe: async () => ({ text: "should not be called" }),
     };
 
@@ -276,7 +281,9 @@ describe("tryTranscribeAudioAttachments", () => {
   test("attachment with empty transcription returns no_audio", async () => {
     const audio = makeAudioAttachment("a1");
     mockAttachments = [audio];
-    mockProvider = {
+    mockTranscriber = {
+      providerId: "openai-whisper",
+      boundaryId: "daemon-batch",
       transcribe: async () => ({ text: "   " }), // whitespace-only
     };
 

package/src/runtime/routes/inbound-stages/transcribe-audio.ts

@@ -10,7 +10,8 @@
 import { isAssistantFeatureFlagEnabled } from "../../../config/assistant-feature-flags.js";
 import { getConfig } from "../../../config/loader.js";
 import * as attachmentsStore from "../../../memory/attachments-store.js";
-import { resolveSpeechToTextProvider } from "../../../providers/speech-to-text/resolve.js";
+import { resolveBatchTranscriber } from "../../../providers/speech-to-text/resolve.js";
+import { normalizeSttError } from "../../../stt/daemon-batch-transcriber.js";
 import { getLogger } from "../../../util/logger.js";
 
 const log = getLogger("transcribe-audio");
@@ -55,13 +56,13 @@ export async function tryTranscribeAudioAttachments(
       return { status: "no_audio" };
     }
 
-    // Resolve STT provider
-    const provider = await resolveSpeechToTextProvider();
-    if (!provider) {
+    // Resolve STT provider via daemon batch transcriber facade
+    const transcriber = await resolveBatchTranscriber();
+    if (!transcriber) {
       return {
         status: "no_provider",
         reason:
-          "No OpenAI API key configured. Set one up to enable voice message transcription.",
+          "No speech-to-text provider configured. Add an API key for your STT service to enable voice message transcription.",
       };
     }
 
@@ -89,11 +90,11 @@ export async function tryTranscribeAudioAttachments(
         }
 
         const buffer = Buffer.from(hydrated.dataBase64, "base64");
-        const result = await provider.transcribe(
-          buffer,
-          attachment.mimeType,
-          abortController.signal,
-        );
+        const result = await transcriber.transcribe({
+          audio: buffer,
+          mimeType: attachment.mimeType,
+          signal: abortController.signal,
+        });
 
         if (result.text.trim()) {
           transcriptions.push(result.text.trim());
@@ -109,12 +110,11 @@ export async function tryTranscribeAudioAttachments(
       clearTimeout(timeoutId);
     }
   } catch (err: unknown) {
+    const sttErr = normalizeSttError(err);
     const reason =
-      err instanceof Error
-        ? err.name === "AbortError"
-          ? "Transcription timed out"
-          : err.message
-        : String(err);
+      sttErr.category === "timeout"
+        ? "Transcription timed out"
+        : sttErr.message;
     log.warn({ err }, "Audio transcription failed");
     return { status: "error", reason };
   }

package/src/runtime/routes/integrations/slack/__tests__/channel.test.ts

@@ -0,0 +1,137 @@
+/**
+ * Unit tests for the POST /v1/integrations/slack/channel/config HTTP route.
+ *
+ * Mocks `setSlackChannelConfig` in the config-slack-channel handler module so
+ * the test can observe which arguments the HTTP handler forwards from the
+ * request body — particularly the optional `userToken` field.
+ */
+
+import { afterEach, describe, expect, mock, test } from "bun:test";
+
+import type { SlackChannelConfigResult } from "../../../../../daemon/handlers/config-slack-channel.js";
+
+// ---------------------------------------------------------------------------
+// Module mock — must appear before importing the module under test
+// ---------------------------------------------------------------------------
+
+interface SetConfigCall {
+  botToken?: string;
+  appToken?: string;
+  userToken?: string;
+}
+
+let lastSetConfigCall: SetConfigCall | null = null;
+let mockSetConfigResult: SlackChannelConfigResult = {
+  success: true,
+  hasBotToken: false,
+  hasAppToken: false,
+  hasUserToken: false,
+  connected: false,
+};
+
+mock.module("../../../../../daemon/handlers/config-slack-channel.js", () => ({
+  setSlackChannelConfig: async (
+    botToken?: string,
+    appToken?: string,
+    userToken?: string,
+  ): Promise<SlackChannelConfigResult> => {
+    lastSetConfigCall = { botToken, appToken, userToken };
+    return mockSetConfigResult;
+  },
+  getSlackChannelConfig: async (): Promise<SlackChannelConfigResult> => ({
+    success: true,
+    hasBotToken: false,
+    hasAppToken: false,
+    hasUserToken: false,
+    connected: false,
+  }),
+  clearSlackChannelConfig: async (): Promise<SlackChannelConfigResult> => ({
+    success: true,
+    hasBotToken: false,
+    hasAppToken: false,
+    hasUserToken: false,
+    connected: false,
+  }),
+}));
+
+const { handleSetSlackChannelConfig } = await import("../channel.js");
+
+describe("POST /v1/integrations/slack/channel/config", () => {
+  afterEach(() => {
+    lastSetConfigCall = null;
+    mockSetConfigResult = {
+      success: true,
+      hasBotToken: false,
+      hasAppToken: false,
+      hasUserToken: false,
+      connected: false,
+    };
+  });
+
+  test("forwards userToken from request body as the third argument", async () => {
+    const req = new Request("http://localhost/v1/integrations/slack/channel/config", {
+      method: "POST",
+      body: JSON.stringify({ userToken: "xoxp-test-user-token" }),
+    });
+
+    const res = await handleSetSlackChannelConfig(req);
+    expect(res.status).toBe(200);
+
+    expect(lastSetConfigCall).not.toBeNull();
+    expect(lastSetConfigCall?.botToken).toBeUndefined();
+    expect(lastSetConfigCall?.appToken).toBeUndefined();
+    expect(lastSetConfigCall?.userToken).toBe("xoxp-test-user-token");
+  });
+
+  test("forwards all three tokens when present in body", async () => {
+    const req = new Request("http://localhost/v1/integrations/slack/channel/config", {
+      method: "POST",
+      body: JSON.stringify({
+        botToken: "xoxb-bot",
+        appToken: "xapp-app",
+        userToken: "xoxp-user",
+      }),
+    });
+
+    const res = await handleSetSlackChannelConfig(req);
+    expect(res.status).toBe(200);
+
+    expect(lastSetConfigCall?.botToken).toBe("xoxb-bot");
+    expect(lastSetConfigCall?.appToken).toBe("xapp-app");
+    expect(lastSetConfigCall?.userToken).toBe("xoxp-user");
+  });
+
+  test("leaves userToken undefined when absent from body", async () => {
+    const req = new Request("http://localhost/v1/integrations/slack/channel/config", {
+      method: "POST",
+      body: JSON.stringify({ botToken: "xoxb-bot", appToken: "xapp-app" }),
+    });
+
+    const res = await handleSetSlackChannelConfig(req);
+    expect(res.status).toBe(200);
+
+    expect(lastSetConfigCall?.botToken).toBe("xoxb-bot");
+    expect(lastSetConfigCall?.appToken).toBe("xapp-app");
+    expect(lastSetConfigCall?.userToken).toBeUndefined();
+  });
+
+  test("returns 400 when handler reports success: false", async () => {
+    mockSetConfigResult = {
+      success: false,
+      hasBotToken: false,
+      hasAppToken: false,
+      hasUserToken: false,
+      connected: false,
+      error: "Invalid user token: must start with \"xoxp-\"",
+    };
+
+    const req = new Request("http://localhost/v1/integrations/slack/channel/config", {
+      method: "POST",
+      body: JSON.stringify({ userToken: "abc-123" }),
+    });
+
+    const res = await handleSetSlackChannelConfig(req);
+    expect(res.status).toBe(400);
+    expect(lastSetConfigCall?.userToken).toBe("abc-123");
+  });
+});

package/src/runtime/routes/integrations/slack/__tests__/share.test.ts

@@ -0,0 +1,179 @@
+/**
+ * Unit tests for the Share UI Slack route handlers.
+ *
+ * Verifies the read/write auth split mirrors `messaging/providers/slack/adapter.ts`:
+ * - Channel enumeration (GET /v1/slack/channels) is a read path and must
+ *   prefer the user_token when present so the picker surfaces channels the
+ *   user is in but the bot isn't.
+ * - Channel sharing (POST /v1/slack/share) is a write path and must always
+ *   use the bot_token so posts come from the bot identity.
+ */
+
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+
+import { credentialKey } from "../../../../../security/credential-key.js";
+
+// ── Module mocks ────────────────────────────────────────────────────────────
+
+const getSecureKeyAsyncMock = mock(
+  async (_key: string): Promise<string | null> => null,
+);
+mock.module("../../../../../security/secure-keys.js", () => ({
+  getSecureKeyAsync: getSecureKeyAsyncMock,
+}));
+
+// share.ts imports getConnectionByProvider from oauth-store at module load.
+// Stub it to return undefined so Socket Mode tokens are the only source.
+mock.module("../../../../../oauth/oauth-store.js", () => ({
+  getConnectionByProvider: () => undefined,
+}));
+
+// Stub the app store so handleShareToSlackChannel finds the app.
+const FAKE_APP = { id: "app-1", name: "Test App", description: "desc" };
+mock.module("../../../../../memory/app-store.js", () => ({
+  getApp: (id: string) => (id === FAKE_APP.id ? FAKE_APP : undefined),
+}));
+
+const { handleListSlackChannels, handleShareToSlackChannel } = await import(
+  "../share.js"
+);
+
+// ── fetch capture ───────────────────────────────────────────────────────────
+
+type CapturedRequest = {
+  url: string;
+  method: string;
+  authorization: string | null;
+};
+
+const captured: CapturedRequest[] = [];
+const originalFetch = globalThis.fetch;
+
+function installFetchStub() {
+  globalThis.fetch = (async (
+    input: RequestInfo | URL,
+    init?: RequestInit,
+  ): Promise<Response> => {
+    const url =
+      typeof input === "string"
+        ? input
+        : input instanceof URL
+          ? input.toString()
+          : input.url;
+    const method = (init?.method ?? "GET").toUpperCase();
+    const headers = new Headers(init?.headers ?? {});
+    captured.push({
+      url,
+      method,
+      authorization: headers.get("authorization"),
+    });
+
+    // Minimal OK Slack envelopes so handlers don't throw on shape mismatches.
+    const body = fakeSlackResponse(url);
+    return new Response(JSON.stringify(body), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  }) as typeof fetch;
+}
+
+function fakeSlackResponse(url: string): Record<string, unknown> {
+  if (url.includes("/conversations.list")) {
+    return { ok: true, channels: [], response_metadata: { next_cursor: "" } };
+  }
+  if (url.includes("/chat.postMessage")) {
+    return { ok: true, ts: "1700000000.000100", channel: "C123" };
+  }
+  return { ok: true };
+}
+
+// ── Test fixtures ───────────────────────────────────────────────────────────
+
+const BOT_TOKEN = "xoxb-BOT";
+const USER_TOKEN = "xoxp-USER";
+
+describe("Slack share route token routing", () => {
+  beforeEach(() => {
+    captured.length = 0;
+    getSecureKeyAsyncMock.mockReset();
+    installFetchStub();
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  test("GET /v1/slack/channels: bot-only install reads with bot token", async () => {
+    getSecureKeyAsyncMock.mockImplementation(async (key: string) => {
+      if (key === credentialKey("slack_channel", "bot_token")) return BOT_TOKEN;
+      return null;
+    });
+
+    const res = await handleListSlackChannels();
+    expect(res.status).toBe(200);
+
+    const listCall = captured.find((c) =>
+      c.url.includes("/conversations.list"),
+    );
+    expect(listCall).toBeDefined();
+    expect(listCall!.authorization).toBe(`Bearer ${BOT_TOKEN}`);
+  });
+
+  test("GET /v1/slack/channels: bot + user tokens prefer user_token for reads", async () => {
+    // Core fix: with both tokens stored, the Share UI picker must see every
+    // channel the USER can see — not just ones the bot is a member of.
+    getSecureKeyAsyncMock.mockImplementation(async (key: string) => {
+      if (key === credentialKey("slack_channel", "bot_token")) return BOT_TOKEN;
+      if (key === credentialKey("slack_channel", "user_token"))
+        return USER_TOKEN;
+      return null;
+    });
+
+    const res = await handleListSlackChannels();
+    expect(res.status).toBe(200);
+
+    const listCall = captured.find((c) =>
+      c.url.includes("/conversations.list"),
+    );
+    expect(listCall).toBeDefined();
+    expect(listCall!.authorization).toBe(`Bearer ${USER_TOKEN}`);
+  });
+
+  test("POST /v1/slack/share: bot + user tokens still write with bot token", async () => {
+    // SAFETY invariant: posts MUST come from the bot identity. If the handler
+    // ever routed the write through user_token, the posted message would
+    // appear as the user — unambiguously wrong.
+    getSecureKeyAsyncMock.mockImplementation(async (key: string) => {
+      if (key === credentialKey("slack_channel", "bot_token")) return BOT_TOKEN;
+      if (key === credentialKey("slack_channel", "user_token"))
+        return USER_TOKEN;
+      return null;
+    });
+
+    const req = new Request("http://localhost/v1/slack/share", {
+      method: "POST",
+      body: JSON.stringify({ appId: FAKE_APP.id, channelId: "C123" }),
+    });
+
+    const res = await handleShareToSlackChannel(req);
+    expect(res.status).toBe(200);
+
+    const postCall = captured.find((c) => c.url.includes("/chat.postMessage"));
+    expect(postCall).toBeDefined();
+    expect(postCall!.authorization).toBe(`Bearer ${BOT_TOKEN}`);
+  });
+
+  test("no tokens configured: both handlers return 503", async () => {
+    getSecureKeyAsyncMock.mockImplementation(async () => null);
+
+    const listRes = await handleListSlackChannels();
+    expect(listRes.status).toBe(503);
+
+    const shareReq = new Request("http://localhost/v1/slack/share", {
+      method: "POST",
+      body: JSON.stringify({ appId: FAKE_APP.id, channelId: "C123" }),
+    });
+    const shareRes = await handleShareToSlackChannel(shareReq);
+    expect(shareRes.status).toBe(503);
+  });
+});

package/src/runtime/routes/integrations/slack/channel.ts

@@ -28,13 +28,21 @@ export async function handleGetSlackChannelConfig(): Promise<Response> {
 /**
  * POST /v1/integrations/slack/channel/config
  *
- * Body: { botToken?: string, appToken?: string }
+ * Body: { botToken?: string, appToken?: string, userToken?: string }
  */
 export async function handleSetSlackChannelConfig(
   req: Request,
 ): Promise<Response> {
-  const body = (await req.json()) as { botToken?: string; appToken?: string };
-  const result = await setSlackChannelConfig(body.botToken, body.appToken);
+  const body = (await req.json()) as {
+    botToken?: string;
+    appToken?: string;
+    userToken?: string;
+  };
+  const result = await setSlackChannelConfig(
+    body.botToken,
+    body.appToken,
+    body.userToken,
+  );
   const status = result.success ? 200 : 400;
   return Response.json(result, { status });
 }

package/src/runtime/routes/integrations/slack/share.ts

@@ -13,6 +13,7 @@ import {
 } from "../../../../messaging/providers/slack/client.js";
 import type { SlackConversation } from "../../../../messaging/providers/slack/types.js";
 import { getConnectionByProvider } from "../../../../oauth/oauth-store.js";
+import { credentialKey } from "../../../../security/credential-key.js";
 import { getSecureKeyAsync } from "../../../../security/secure-keys.js";
 import { getLogger } from "../../../../util/logger.js";
 import { httpError } from "../../../http-errors.js";
@@ -25,13 +26,46 @@ const log = getLogger("slack-share");
 // ---------------------------------------------------------------------------
 
 /**
- * Resolve the Slack bot token from the OAuth connection store.
+ * Resolve a Slack token for the Share UI, mirroring the read/write auth split
+ * in `messaging/providers/slack/adapter.ts`.
+ *
+ * For Socket Mode installs (tokens stored under `credential/slack_channel/*`),
+ * prefer the user OAuth token (xoxp-) for reads when present — this lets the
+ * channel picker surface channels the user belongs to but the bot doesn't.
+ * Fall back to the bot token (xoxb-) otherwise.
+ *
+ * Writes MUST always use the bot token so posted messages come from the bot
+ * identity, never the user. Passing `user_token` to chat.postMessage would
+ * post as the user — unambiguously wrong for Share UI behavior.
+ *
+ * For legacy OAuth installs (no Socket Mode tokens), fall back to the OAuth
+ * connection's access_token, which is the bot token in Slack's OAuth v2 flow.
  */
-async function resolveSlackToken(): Promise<string | undefined> {
+async function resolveSlackToken(
+  mode: "read" | "write",
+): Promise<string | undefined> {
+  // Socket Mode path — tokens stored directly in the credential vault.
+  const botToken = await getSecureKeyAsync(
+    credentialKey("slack_channel", "bot_token"),
+  );
+  if (botToken) {
+    if (mode === "read") {
+      const userToken = await getSecureKeyAsync(
+        credentialKey("slack_channel", "user_token"),
+      );
+      return userToken ?? botToken;
+    }
+    // SAFETY: writes must use the bot token. Using the user token here would
+    // post as the user rather than the bot.
+    return botToken;
+  }
+
+  // Legacy OAuth path. Slack's OAuth v2 access_token is the bot token; there
+  // is no separate user token stored for this install, so reads and writes
+  // both use access_token.
   const conn = getConnectionByProvider("slack");
-  return conn
-    ? await getSecureKeyAsync(`oauth_connection/${conn.id}/access_token`)
-    : undefined;
+  if (!conn) return undefined;
+  return await getSecureKeyAsync(`oauth_connection/${conn.id}/access_token`);
 }
 
 // ---------------------------------------------------------------------------
@@ -61,7 +95,9 @@ const TYPE_SORT_ORDER: Record<string, number> = {
 };
 
 export async function handleListSlackChannels(): Promise<Response> {
-  const token = await resolveSlackToken();
+  // Channel enumeration is a read path — prefer user_token when present so
+  // the picker surfaces channels the user is in but the bot isn't.
+  const token = await resolveSlackToken("read");
   if (!token) {
     return httpError("SERVICE_UNAVAILABLE", "No Slack token configured", 503);
   }
@@ -137,7 +173,9 @@ export async function handleListSlackChannels(): Promise<Response> {
 export async function handleShareToSlackChannel(
   req: Request,
 ): Promise<Response> {
-  const token = await resolveSlackToken();
+  // Posting a message is a write path — must use the bot token so the message
+  // comes from the bot identity, never the user.
+  const token = await resolveSlackToken("write");
   if (!token) {
     return httpError("SERVICE_UNAVAILABLE", "No Slack token configured", 503);
   }