Problem

Security Issue

Users could post workflows to Slack channels they had left, as long as the Bot remained in those channels.

Current Behavior

1. User joins a Slack channel and shares a workflow
2. User leaves the channel
3. ❌ User can still post to the channel (via Bot Token)

Expected Behavior

1. User joins a Slack channel and shares a workflow
2. User leaves the channel
3. ✅ User cannot post to the channel (User Token respects channel membership)

Solution

Migrate all Slack API operations from Bot Token (xoxb-) to User Token (xoxp-).

Key Changes

Bot Token vs User Token:

• Bot Token (chat:write): Posts as Bot, can post to any channel Bot is in
• User Token (chat:write): Posts as user, can only post to channels user is a member of

Changes

Extension Host:

• slack-api-service.ts: Remove ensureClient() (Bot Token), use only ensureUserClient() (User Token) for all operations
• slack-connect-oauth.ts: Validate User Token instead of Bot Token in OAuth response
• slack-connect-manual.ts: Only require User Token input
• slack-token-manager.ts: Check User Token for connection validation
• open-editor.ts: Remove CHECK_BOT_CHANNEL_MEMBERSHIP handler

Webview:

• SlackShareDialog.tsx: Remove Bot membership check UI
• SlackManualTokenDialog.tsx: Remove Bot Token input field
• slack-integration-service.ts: Remove checkBotChannelMembership() function

Types & i18n:

• messages.ts: Remove Bot membership check types
• Translation files: Remove Bot membership related messages

Impact

• ✅ Security: Users can only post to channels they are members of
• ✅ UX: Messages appear as user (not Bot), more natural
• ✅ Simplified: No Bot membership checking needed
• ⚠️ Breaking: Existing Bot Token connections need re-authentication

Testing

• OAuth authentication flow works with User Token only
• Channel list shows only channels user is member of
• Workflow sharing posts as user
• Manual token input accepts User Token only
• Build passes without errors

🤖 Generated with Claude Code