diff --git a/src/main/__tests__/integration-event-bridge.test.ts b/src/main/__tests__/integration-event-bridge.test.ts
index 801e564b..bebd9a26 100644
--- a/src/main/__tests__/integration-event-bridge.test.ts
+++ b/src/main/__tests__/integration-event-bridge.test.ts
@@ -9,6 +9,7 @@ import {
   getIntegrationEventTelemetrySnapshot,
   IntegrationEventBridge,
   createWorkspaceScopedEventClient,
+  eventPathGlobsForIntegration,
   integrationSubscriptionSummaries,
   integrationRelayFileSyncOptions,
   localWatchEventPathsForFilename,
@@ -306,6 +307,29 @@ test('relayfile sdk path filters broaden partial-segment Slack DM globs', () =>
   ])
 })
 
+test('slack DM watch globs use the user-message model and drop vestigial /slack/dms', () => {
+  const slackDm = integration({
+    provider: 'slack',
+    integrationId: 'slack-1',
+    mountPaths: ['/slack/channels/C123ABC__proj-cloud'],
+    scope: { listenDms: true }
+  })
+  const globs = eventPathGlobsForIntegration(slackDm)
+  assert.ok(globs.includes('/slack/users/*/messages/**'), 'canonical user-message DM watch present')
+  assert.ok(globs.includes('/slack/channels/D*/**'), 'raw-D diagnostic alias retained')
+  assert.ok(!globs.includes('/slack/dms/*/**'), 'vestigial /slack/dms watch glob dropped')
+
+  const noDm = integration({
+    provider: 'slack',
+    integrationId: 'slack-2',
+    mountPaths: ['/slack/channels/C123ABC__proj-cloud'],
+    scope: { listenDms: false }
+  })
+  const noDmGlobs = eventPathGlobsForIntegration(noDm)
+  assert.ok(!noDmGlobs.includes('/slack/users/*/messages/**'), 'no DM watch when listenDms is off')
+  assert.ok(!noDmGlobs.includes('/slack/channels/D*/**'), 'no raw-D diagnostic watch when listenDms is off')
+})
+
 test('integration event remote stream keeps a refreshable relayfile token provider', () => {
   const tokenProvider = async () => 'workspace-token'
   const options = integrationRelayFileSyncOptions({
diff --git a/src/main/integration-event-bridge.ts b/src/main/integration-event-bridge.ts
index 2e72759b..e467fadf 100644
--- a/src/main/integration-event-bridge.ts
+++ b/src/main/integration-event-bridge.ts
@@ -38,9 +38,15 @@ const INTEGRATION_EVENT_LOG_PATH = join(homedir(), '.agentworkforce', 'pear', 'i
 const AGGREGATED_WARNING_REPEAT_EVERY = 25
 const MAX_AGGREGATED_WARNING_KEYS = 256
 const SLACK_LIVE_EVENT_WINDOW_MS = 30 * 60 * 1_000
+// DM event watch globs. Canonical 1:1 DM surface is the user-recipient model
+// `/slack/users/<U>/messages` (where the adapter materializes message.im once
+// D→U mapping lands). `/slack/channels/D*` is retained only as a diagnostic
+// alias for raw Slack IM conversation ids the adapter still materializes
+// channel-style today. `/slack/dms/*` was vestigial residue — no adapter
+// resource or record ever materialized there — so it is intentionally dropped;
+// it must not imply mounted/readable DM content.
 const SLACK_DM_EVENT_GLOBS = [
   '/slack/channels/D*/**',
-  '/slack/dms/*/**',
   '/slack/users/*/messages/**'
 ]
 const MAX_EVENT_CONTEXT_PREVIEW_BYTES = 32 * 1024
@@ -480,7 +486,7 @@ function watchGlobForPath(path: string): string {
   return root.endsWith('/**') ? root : `${root || '/'}/**`
 }
 
-function eventPathGlobsForIntegration(integration: ConnectedIntegration): string[] {
+export function eventPathGlobsForIntegration(integration: ConnectedIntegration): string[] {
   return dedupeStrings([
     ...canonicalMountPaths(integration).map(watchGlobForPath),
     ...(slackListenDms(integration) ? SLACK_DM_EVENT_GLOBS : [])
diff --git a/src/renderer/src/components/settings/ProjectSettings.tsx b/src/renderer/src/components/settings/ProjectSettings.tsx
index c9762635..ec822455 100644
--- a/src/renderer/src/components/settings/ProjectSettings.tsx
+++ b/src/renderer/src/components/settings/ProjectSettings.tsx
@@ -24,9 +24,15 @@ import { ProactiveAgentsSection } from '@/components/proactive/ProactiveAgentsSe
 import { pear, type ConnectedIntegration } from '@/lib/ipc'
 import {
   SlackChannelPicker,
+  SlackDmRecipientPicker,
   type IntegrationAccessibleResource,
   type ScopePickerValue
 } from '@/components/settings/scope-pickers'
+import {
+  isSlackUserMessagesMountPath,
+  mergeSlackScopeMountPaths,
+  slackUserResourceFromOption
+} from '@/components/settings/slack-scope'
 import { useAgentStore } from '@/stores/agent-store'
 import {
   normalizeChannelName,
@@ -385,6 +391,7 @@ function IntegrationVisibilitySection({
   const [error, setError] = useState<string | null>(null)
   const [scopeEditorIntegrationId, setScopeEditorIntegrationId] = useState<string | null>(null)
   const [pendingScopeValue, setPendingScopeValue] = useState<ScopePickerValue | null>(null)
+  const [pendingDmScopeValue, setPendingDmScopeValue] = useState<ScopePickerValue | null>(null)
   const [pendingSlackListenDms, setPendingSlackListenDms] = useState<boolean | null>(null)
   const resourceCacheRef = useRef(new Map<string, ResourceCacheEntry>())
 
@@ -634,6 +641,23 @@ function IntegrationVisibilitySection({
     })
   }, [cachedResources, projectId])
 
+  const listSlackDmRecipients = useCallback(async (integration: ConnectedIntegration): Promise<IntegrationAccessibleResource[]> => {
+    const cacheKey = `slack-users:${projectId}:${integration.integrationId}`
+    return cachedResources(cacheKey, async () => {
+      const listOptions = (pear.integrations as typeof pear.integrations & {
+        listOptions?: typeof pear.integrations.listOptions
+      }).listOptions
+      if (typeof listOptions !== 'function') {
+        throw new Error('Slack DM recipient options are not available yet.')
+      }
+      const options = await listOptions(projectId, integration.provider, 'users')
+      if (!Array.isArray(options)) {
+        throw new Error('Slack DM recipient options returned an unexpected response.')
+      }
+      return options.map(slackUserResourceFromOption)
+    })
+  }, [cachedResources, projectId])
+
   const saveSlackSourceChannels = useCallback(async (integration: ConnectedIntegration) => {
     const listenDms = pendingSlackListenDms ?? slackListenDmsFromScope(integration.scope)
     const nextScope = {
@@ -642,8 +666,18 @@ function IntegrationVisibilitySection({
       selection: pendingScopeValue?.scope.selection ?? integration.scope.selection ?? 'selected',
       channels: pendingScopeValue?.scope.channels ?? integration.scope.channels ?? [],
       resources: pendingScopeValue?.scope.resources ?? integration.scope.resources ?? [],
+      dmUsers: pendingDmScopeValue?.scope.dmUsers ?? integration.scope.dmUsers ?? [],
       listenDms
     }
+    const nextMountPaths = mergeSlackScopeMountPaths({
+      existing: integration.mountPaths ?? [],
+      channelPaths: pendingScopeValue?.mountPaths ?? null,
+      // Only mount concrete `/slack/users/<U>/messages` recipients — never a bare
+      // `/slack/users` root (emitted when no users are available to select).
+      dmPaths: pendingDmScopeValue
+        ? (pendingDmScopeValue.mountPaths ?? []).filter(isSlackUserMessagesMountPath)
+        : null
+    })
 
     setBusyIntegrationId(integration.integrationId)
     setError(null)
@@ -652,7 +686,7 @@ function IntegrationVisibilitySection({
         projectId,
         integration.integrationId,
         nextScope,
-        pendingScopeValue?.mountPaths ?? integration.mountPaths
+        nextMountPaths
       )
       setIntegrations((current) =>
         current.map((entry) =>
@@ -661,13 +695,14 @@ function IntegrationVisibilitySection({
       )
       setScopeEditorIntegrationId(null)
       setPendingScopeValue(null)
+      setPendingDmScopeValue(null)
       setPendingSlackListenDms(null)
     } catch (err) {
       setError(err instanceof Error ? err.message : String(err))
     } finally {
       setBusyIntegrationId(null)
     }
-  }, [pendingScopeValue, pendingSlackListenDms, projectId])
+  }, [pendingScopeValue, pendingDmScopeValue, pendingSlackListenDms, projectId])
 
   return (
     <Section
@@ -729,11 +764,19 @@ function IntegrationVisibilitySection({
             const scopeEditorOpen = scopeEditorIntegrationId === integration.integrationId
             const savedSlackListenDms = slackListenDmsFromScope(integration.scope)
             const slackListenDms = pendingSlackListenDms ?? savedSlackListenDms
+            const integrationMountPaths = integration.mountPaths ?? []
             const selectedSlackSourceIds = Array.from(new Set([
-              ...integration.mountPaths,
+              ...integrationMountPaths,
               ...scopeStringList(integration.scope, 'channels')
             ]))
-            const slackScopeDirty = !!pendingScopeValue || (
+            const selectedSlackDmRecipientIds = Array.from(new Set([
+              ...integrationMountPaths
+                .filter(isSlackUserMessagesMountPath)
+                .map((path) => path.split('/')[3])
+                .filter(Boolean),
+              ...scopeStringList(integration.scope, 'dmUsers')
+            ]))
+            const slackScopeDirty = !!pendingScopeValue || !!pendingDmScopeValue || (
               pendingSlackListenDms !== null && pendingSlackListenDms !== savedSlackListenDms
             )
             const knownTargetValues = new Set([
@@ -773,6 +816,7 @@ function IntegrationVisibilitySection({
                       disabled={busy}
                       onClick={() => {
                         setPendingScopeValue(null)
+                        setPendingDmScopeValue(null)
                         setPendingSlackListenDms(scopeEditorOpen ? null : savedSlackListenDms)
                         setScopeEditorIntegrationId(scopeEditorOpen ? null : integration.integrationId)
                       }}
@@ -879,9 +923,20 @@ function IntegrationVisibilitySection({
                       />
                       <span className="min-w-0">
                         <span className="block text-sm text-[var(--pear-text)]">Direct messages</span>
-                        <span className="block text-xs text-[var(--pear-text-faint)]">Listen for Slack DMs</span>
+                        <span className="block text-xs text-[var(--pear-text-faint)]">
+                          Observe DM events (watch-only). Choose recipients below to read &amp; send their DMs.
+                        </span>
                       </span>
                     </label>
+                    <div className="mt-3">
+                      <SlackDmRecipientPicker
+                        provider="slack"
+                        disabled={busy}
+                        initialSelectedIds={selectedSlackDmRecipientIds}
+                        listAccessibleResources={() => listSlackDmRecipients(integration)}
+                        onChange={setPendingDmScopeValue}
+                      />
+                    </div>
                     <div className="mt-3 flex justify-end gap-2">
                       <button
                         type="button"
@@ -889,6 +944,7 @@ function IntegrationVisibilitySection({
                         onClick={() => {
                           setScopeEditorIntegrationId(null)
                           setPendingScopeValue(null)
+                          setPendingDmScopeValue(null)
                           setPendingSlackListenDms(null)
                         }}
                         className="h-8 rounded-md border border-[var(--pear-border)] px-3 text-xs text-[var(--pear-text-dim)] hover:text-[var(--pear-text)] disabled:opacity-40"
diff --git a/src/renderer/src/components/settings/scope-pickers/GenericScopePicker.tsx b/src/renderer/src/components/settings/scope-pickers/GenericScopePicker.tsx
index d6c7a800..cd07db6d 100644
--- a/src/renderer/src/components/settings/scope-pickers/GenericScopePicker.tsx
+++ b/src/renderer/src/components/settings/scope-pickers/GenericScopePicker.tsx
@@ -32,6 +32,10 @@ type GenericScopePickerProps = ScopePickerProps & {
   resourceNoun?: string
   baseMountPath?: string
   scopeKey?: string
+  // When no prior selection exists, select every resource by default (true) or
+  // none (false). Bounded "watch everything" surfaces like channels default to
+  // true; DM recipients default to false so we never mount every user's DMs.
+  defaultSelectAll?: boolean
   getResourceLabel?: (resource: IntegrationAccessibleResource) => string
   getResourceDescription?: (resource: IntegrationAccessibleResource) => string
   getResourceMountSegment?: (resource: IntegrationAccessibleResource) => string
@@ -89,6 +93,7 @@ export function GenericScopePicker({
   resourceNoun = 'resources',
   baseMountPath = `/integrations/${provider}`,
   scopeKey = 'resources',
+  defaultSelectAll = true,
   getResourceLabel = (resource) => resourceText(resource, 'displayName', 'title', 'name', 'slug', 'key', 'path', 'id'),
   getResourceDescription = (resource) => resourceText(resource, 'path', 'type', 'kind'),
   getResourceMountSegment = (resource) => resourceText(resource, 'path', 'slug', 'key', 'name', 'id'),
@@ -103,6 +108,7 @@ export function GenericScopePicker({
   const getResourceScopeIdRef = useRef(getResourceScopeId)
   const listAccessibleResourcesRef = useRef(listAccessibleResources)
   const initialSelectedIdsRef = useRef(initialSelectedIds)
+  const defaultSelectAllRef = useRef(defaultSelectAll)
 
   useEffect(() => {
     onChangeRef.current = onChange
@@ -110,6 +116,7 @@ export function GenericScopePicker({
     getResourceScopeIdRef.current = getResourceScopeId
     listAccessibleResourcesRef.current = listAccessibleResources
     initialSelectedIdsRef.current = initialSelectedIds
+    defaultSelectAllRef.current = defaultSelectAll
   })
 
   useEffect(() => {
@@ -126,7 +133,9 @@ export function GenericScopePicker({
           new Set(
             seeds && seeds.length > 0
               ? seeds
-              : nextResources.map(resourceId)
+              : defaultSelectAllRef.current
+                ? nextResources.map(resourceId)
+                : []
           )
         )
       })
@@ -153,9 +162,10 @@ export function GenericScopePicker({
   )
 
   useEffect(() => {
-    if (loading) return
+    if (loading || error) return
 
     if (resources.length === 0) {
+      if (!defaultSelectAll) return
       onChangeRef.current({
         scope: { provider, selection: 'all', [scopeKey]: [] },
         mountPaths: [baseMountPath]
@@ -181,6 +191,8 @@ export function GenericScopePicker({
     })
   }, [
     baseMountPath,
+    defaultSelectAll,
+    error,
     loading,
     provider,
     resources.length,
diff --git a/src/renderer/src/components/settings/scope-pickers/SlackDmRecipientPicker.tsx b/src/renderer/src/components/settings/scope-pickers/SlackDmRecipientPicker.tsx
new file mode 100644
index 00000000..6bb635b0
--- /dev/null
+++ b/src/renderer/src/components/settings/scope-pickers/SlackDmRecipientPicker.tsx
@@ -0,0 +1,26 @@
+import type React from 'react'
+import { GenericScopePicker, metadataText, resourceText, type ScopePickerProps } from './GenericScopePicker'
+import { slackDmMountSegment, slackDmUserId } from '../slack-scope'
+
+export function SlackDmRecipientPicker(props: ScopePickerProps): React.ReactNode {
+  return (
+    <GenericScopePicker
+      {...props}
+      title="Choose DM recipients"
+      resourceNoun="people"
+      baseMountPath="/slack/users"
+      scopeKey="dmUsers"
+      defaultSelectAll={false}
+      getResourceLabel={(resource) => {
+        const name = resourceText(resource, 'displayName', 'name', 'title')
+        if (!name) return slackDmUserId(resource)
+        return name.startsWith('@') ? name : `@${name}`
+      }}
+      getResourceDescription={(resource) =>
+        metadataText(resource, 'realName', 'email', 'workspace', 'team') || slackDmUserId(resource)
+      }
+      getResourceMountSegment={slackDmMountSegment}
+      getResourceScopeId={slackDmUserId}
+    />
+  )
+}
diff --git a/src/renderer/src/components/settings/scope-pickers/index.ts b/src/renderer/src/components/settings/scope-pickers/index.ts
index a9ef9fab..8ba5fe36 100644
--- a/src/renderer/src/components/settings/scope-pickers/index.ts
+++ b/src/renderer/src/components/settings/scope-pickers/index.ts
@@ -11,3 +11,4 @@ export { GitHubRepoPicker } from './GitHubRepoPicker'
 export { LinearTeamPicker } from './LinearTeamPicker'
 export { NotionDatabasePicker } from './NotionDatabasePicker'
 export { SlackChannelPicker } from './SlackChannelPicker'
+export { SlackDmRecipientPicker } from './SlackDmRecipientPicker'
diff --git a/src/renderer/src/components/settings/slack-scope.test.ts b/src/renderer/src/components/settings/slack-scope.test.ts
new file mode 100644
index 00000000..664a1840
--- /dev/null
+++ b/src/renderer/src/components/settings/slack-scope.test.ts
@@ -0,0 +1,139 @@
+import { describe, expect, test } from 'vitest'
+import {
+  isSlackChannelMountPath,
+  isSlackUserMessagesMountPath,
+  mergeSlackScopeMountPaths,
+  slackDmMountSegment,
+  slackDmUserId,
+  slackUserResourceFromOption
+} from './slack-scope'
+
+describe('slack DM recipient helpers', () => {
+  test('slackUserResourceFromOption keeps a bare Slack user id', () => {
+    const resource = slackUserResourceFromOption({ value: 'U123', label: '@alice', hint: 'Alice A.' })
+    expect(resource.id).toBe('U123')
+    expect(resource.metadata?.userId).toBe('U123')
+    expect(slackDmUserId(resource)).toBe('U123')
+  })
+
+  test('slackDmMountSegment yields <U>/messages, never suffixed', () => {
+    const resource = slackUserResourceFromOption({ value: 'U123', label: '@alice' })
+    expect(slackDmMountSegment(resource)).toBe('U123/messages')
+  })
+
+  test('slackDmMountSegment supports enterprise W… ids', () => {
+    const resource = slackUserResourceFromOption({ value: 'W0123ABCDEF', label: '@ent' })
+    expect(slackDmUserId(resource)).toBe('W0123ABCDEF')
+    expect(slackDmMountSegment(resource)).toBe('W0123ABCDEF/messages')
+  })
+
+  test('slackDmMountSegment is empty without an id', () => {
+    expect(slackDmMountSegment({})).toBe('')
+  })
+
+  test('slackDmMountSegment does not use display names as user ids', () => {
+    expect(slackDmMountSegment({ name: 'alice', displayName: '@alice' })).toBe('')
+  })
+
+  test('slack DM helpers tolerate nullish resources', () => {
+    expect(slackDmUserId(null)).toBe('')
+    expect(slackDmUserId(undefined)).toBe('')
+    expect(slackDmMountSegment(null)).toBe('')
+    expect(slackDmMountSegment(undefined)).toBe('')
+  })
+
+  test('slackUserResourceFromOption tolerates missing option data', () => {
+    const resource = slackUserResourceFromOption(null)
+    expect(resource.id).toBe('')
+    expect(resource.displayName).toBe('')
+    expect(resource.name).toBe('')
+    expect(resource.metadata?.userId).toBe('')
+  })
+})
+
+describe('slack mount-path classifiers', () => {
+  test('channel vs user-message paths are distinguished', () => {
+    expect(isSlackChannelMountPath('/slack/channels/C123__proj')).toBe(true)
+    expect(isSlackChannelMountPath('/slack/channels')).toBe(true)
+    expect(isSlackChannelMountPath('/slack/users/U1/messages')).toBe(false)
+
+    expect(isSlackUserMessagesMountPath('/slack/users/U1/messages')).toBe(true)
+    expect(isSlackUserMessagesMountPath('/slack/users/W1/messages/1780.json')).toBe(true)
+    expect(isSlackUserMessagesMountPath('/slack/users')).toBe(false)
+    expect(isSlackUserMessagesMountPath('/slack/channels/C1')).toBe(false)
+    // raw D conversation stays diagnostic, not a user-message product path
+    expect(isSlackUserMessagesMountPath('/slack/channels/D1/messages')).toBe(false)
+  })
+
+  test('malformed mount paths are ignored', () => {
+    for (const path of [null, undefined, 12, {}, []]) {
+      expect(isSlackChannelMountPath(path)).toBe(false)
+      expect(isSlackUserMessagesMountPath(path)).toBe(false)
+    }
+  })
+})
+
+describe('mergeSlackScopeMountPaths', () => {
+  test('selecting a DM recipient adds /slack/users/<U>/messages and preserves channels + discovery', () => {
+    const merged = mergeSlackScopeMountPaths({
+      existing: ['/discovery/slack', '/slack/channels/C1__proj'],
+      channelPaths: null,
+      dmPaths: ['/slack/users/U1/messages']
+    })
+    expect(merged).toEqual([
+      '/discovery/slack',
+      '/slack/channels/C1__proj',
+      '/slack/users/U1/messages'
+    ])
+  })
+
+  test('changing channels preserves existing DM mounts', () => {
+    const merged = mergeSlackScopeMountPaths({
+      existing: ['/slack/channels/C1__proj', '/slack/users/U1/messages'],
+      channelPaths: ['/slack/channels/C2__proj'],
+      dmPaths: null
+    })
+    expect(merged).toEqual(['/slack/channels/C2__proj', '/slack/users/U1/messages'])
+  })
+
+  test('clearing DM recipients drops user-message mounts but keeps channels', () => {
+    const merged = mergeSlackScopeMountPaths({
+      existing: ['/slack/channels/C1__proj', '/slack/users/U1/messages'],
+      channelPaths: null,
+      dmPaths: []
+    })
+    expect(merged).toEqual(['/slack/channels/C1__proj'])
+  })
+
+  test('listenDms-only (no recipient mounts) invents nothing', () => {
+    const merged = mergeSlackScopeMountPaths({
+      existing: ['/slack/channels/C1__proj'],
+      channelPaths: null,
+      dmPaths: null
+    })
+    expect(merged).toEqual(['/slack/channels/C1__proj'])
+    expect(merged.some(isSlackUserMessagesMountPath)).toBe(false)
+  })
+
+  test('result is de-duplicated and order-stable', () => {
+    const merged = mergeSlackScopeMountPaths({
+      existing: ['/slack/channels/C1__proj', '/slack/users/U1/messages'],
+      channelPaths: ['/slack/channels/C1__proj', '/slack/channels/C1__proj'],
+      dmPaths: ['/slack/users/U1/messages']
+    })
+    expect(merged).toEqual(['/slack/channels/C1__proj', '/slack/users/U1/messages'])
+  })
+
+  test('malformed path entries are ignored while merging', () => {
+    const merged = mergeSlackScopeMountPaths({
+      existing: ['/discovery/slack', null, '/slack/channels/C1__proj', 12],
+      channelPaths: null,
+      dmPaths: ['/slack/users/U1/messages', undefined]
+    })
+    expect(merged).toEqual([
+      '/discovery/slack',
+      '/slack/channels/C1__proj',
+      '/slack/users/U1/messages'
+    ])
+  })
+})
diff --git a/src/renderer/src/components/settings/slack-scope.ts b/src/renderer/src/components/settings/slack-scope.ts
new file mode 100644
index 00000000..c52d74fd
--- /dev/null
+++ b/src/renderer/src/components/settings/slack-scope.ts
@@ -0,0 +1,103 @@
+import type { IntegrationAccessibleResource } from './scope-pickers/GenericScopePicker'
+
+// Pure helpers for Slack scope/mount-path handling, kept free of React so they
+// can be unit-tested directly. Two Slack source surfaces share one mountPaths
+// array on the integration: channels (`/slack/channels/<C…>`) and 1:1 DM
+// recipients (`/slack/users/<U…>/messages`). The DM model is user-recipient
+// based — we never emit raw `/slack/channels/D…` or `/slack/dms/<D…>` product
+// mounts, and never suffixed `/slack/users/<U…>__<slug>` segments, because the
+// relayfile adapter writeback extraction and Cloud scope aliasing only bridge
+// channel suffixes today, not user suffixes.
+
+function resourceField(
+  resource: IntegrationAccessibleResource | null | undefined,
+  ...keys: Array<keyof IntegrationAccessibleResource>
+): string {
+  if (!resource) return ''
+  for (const key of keys) {
+    const value = resource[key]
+    if (typeof value === 'string' && value.trim()) return value.trim()
+  }
+  return ''
+}
+
+function resourceMeta(resource: IntegrationAccessibleResource | null | undefined, ...keys: string[]): string {
+  if (!resource) return ''
+  for (const key of keys) {
+    const value = resource.metadata?.[key]
+    if (typeof value === 'string' && value.trim()) return value.trim()
+  }
+  return ''
+}
+
+/** Bare Slack user id (`U…`) for a DM-recipient resource. Cloud `users` options
+ *  already normalize to bare ids; we never emit a suffixed `U…__slug`. */
+export function slackDmUserId(resource: IntegrationAccessibleResource | null | undefined): string {
+  return resourceMeta(resource, 'userId') || resourceField(resource, 'id', 'slug', 'key')
+}
+
+/** Mount segment appended to `/slack/users` → `<U…>/messages`, yielding the
+ *  canonical 1:1 DM path `/slack/users/<U…>/messages`. Empty when no id. */
+export function slackDmMountSegment(resource: IntegrationAccessibleResource | null | undefined): string {
+  const id = slackDmUserId(resource)
+  return id ? `${id}/messages` : ''
+}
+
+/** Map a Cloud `users` option into a scope-picker resource (bare `U…` id). */
+export function slackUserResourceFromOption(option: {
+  value: string
+  label: string
+  hint?: string
+} | null | undefined): IntegrationAccessibleResource {
+  const id = option?.value?.trim() ?? ''
+  const label = option?.label ?? ''
+  const name = label.replace(/^@/u, '').trim() || id
+  return {
+    id,
+    displayName: label,
+    name,
+    metadata: {
+      userId: id,
+      ...(option?.hint ? { hint: option.hint } : {})
+    }
+  }
+}
+
+export function isSlackChannelMountPath(path: unknown): path is string {
+  return typeof path === 'string' && /^\/slack\/channels(?:\/|$)/u.test(path.trim())
+}
+
+export function isSlackUserMessagesMountPath(path: unknown): path is string {
+  return typeof path === 'string' && /^\/slack\/users\/[^/]+\/messages(?:\/|$)/u.test(path.trim())
+}
+
+/**
+ * Merge the channel and DM-recipient halves of a Slack integration's mountPaths.
+ * Each picker emits the full set of paths for its own surface, so a `null` half
+ * means "unchanged — keep what's already on the integration." Non-Slack and
+ * non-channel/non-user paths (e.g. `/discovery/slack`) are always preserved.
+ * Result is order-stable and de-duplicated.
+ */
+export function mergeSlackScopeMountPaths(args: {
+  existing: unknown[] | null | undefined
+  channelPaths: unknown[] | null
+  dmPaths: unknown[] | null
+}): string[] {
+  const { existing, channelPaths, dmPaths } = args
+  const existingPaths = Array.isArray(existing) ? existing : []
+  const resolvedChannelPaths = channelPaths ?? existingPaths.filter(isSlackChannelMountPath)
+  const resolvedDmPaths = dmPaths ?? existingPaths.filter(isSlackUserMessagesMountPath)
+  const preserved = existingPaths.filter(
+    (path) => !isSlackChannelMountPath(path) && !isSlackUserMessagesMountPath(path)
+  )
+
+  const merged: string[] = []
+  const seen = new Set<string>()
+  for (const path of [...preserved, ...resolvedChannelPaths, ...resolvedDmPaths]) {
+    const trimmed = typeof path === 'string' ? path.trim() : ''
+    if (!trimmed || seen.has(trimmed)) continue
+    seen.add(trimmed)
+    merged.push(trimmed)
+  }
+  return merged
+}