fix(slack): comprehensive mrkdwn formatting for send, edit, and tool paths

[dashed]

Summary

Normalizes markdown-to-Slack-mrkdwn conversion across all message delivery paths (gateway send, streaming edit, tool-layer direct send). Fixes 6 bugs found during audit against the Slack mrkdwn spec.

Fork branch: fix/slack-mrkdwn-formatting — part of the dashed/hermes-agent modular fork. See FORK_WORKFLOW.md.

Bugs fixed

• Blockquote markers escaped — > at line start was escaped to >, breaking blockquote rendering. Now protected with placeholders before escaping.
• edit_message() sent raw markdown — streamed/edited messages showed literal **bold** and [links](url). Now calls format_message() before chat_update().
• ***bold italic*** produced invalid mrkdwn — triple-star was consumed by the bold regex, producing **text**. Added dedicated triple-star step producing *_text_*.
• HTML entity double-escaping — pre-escaped & became &. Added unescape-before-escape to make the operation idempotent.
• URLs with parentheses truncated — Wikipedia-style links like Foo_(bar) were cut short. Replaced URL regex with balanced-parentheses matching.
• Step comment numbering — duplicate step numbers after inserting new steps. Renumbered 1-13.

Other changes

• Explicitly set mrkdwn: True on chat.postMessage and chat.update payloads
• Protect existing Slack entities (<@user>, <#channel>, <!here>, <!subteam^...>, <!date^...>) from escaping
• Handle CommonMark angle-bracket link syntax [text](<url>)
• Use idiomatic reversed(dict) instead of reversed(list(dict.keys()))

Test coverage

• 47 unit tests in TestFormatMessage covering all formatting conversions, entity preservation, edge cases
• 4 unit tests in TestEditMessage for edit formatting
• 8 e2e tests in TestEditMessageStreamingPipeline simulating streaming edits
• 7 e2e tests in TestMessageSplitting for the gateway send path
• 5 e2e tests in TestSendToPlatformChunking for the tool-layer send path

140 tests pass, 0 failures.

Test plan

uv run --extra dev --extra messaging pytest tests/gateway/test_slack.py tests/tools/test_send_message_tool.py -v

• All unit tests for format_message() pass
• All e2e tests for send, edit, and tool paths pass
• Existing tests unaffected (no regressions)
• Reviewed against Slack mrkdwn spec

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: base64 encoding/decoding detected

Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.

Matches (first 20):

3025:+        b64_data = base64.b64encode(png_data).decode()
3051:+        b64_data = base64.b64encode(pdf_data).decode()
4563:+                b64 = base64.b64encode(content.encode("utf-8")).decode("ascii")

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

4532:+        content into the sandbox via exec(), so new/updated credentials are

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/setup.py

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: base64 encoding/decoding detected

Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.

Matches (first 20):

9003:+        return base64.b64decode(payload)
9242:+        key = base64.b64decode(aes_key)
9395:+                    "base64_data": base64.b64encode(chunk).decode("ascii"),
26555:+        b64_data = base64.b64encode(png_data).decode()
26581:+        b64_data = base64.b64encode(pdf_data).decode()
27651:+        decrypted = WeComAdapter._decrypt_file_bytes(encrypted, base64.b64encode(key).decode("ascii"))
27770:+                "aeskey": base64.b64encode(key).decode("ascii"),
35205:+        img_b64 = base64.b64encode(resp.content).decode("utf-8")
36021:+        b64 = base64.b64encode(content).decode("ascii")

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

2496:+                self.rollout_and_score_eval(item),
2519:+        Runs all tasks through rollout_and_score_eval() via asyncio.gather()
35781:+            home = self._sandbox.process.exec("echo $HOME").result.strip()
35812:+            self._sandbox.process.exec(f"mkdir -p {parent}")

⚠️ WARNING: Outbound network calls (POST/PUT)

Outbound POST/PUT requests in new code could be data exfiltration. Verify the destination URLs are legitimate.

Matches (first 10):

34893:+    resp = requests.post(
34922:+    resp = requests.post(url, json=body, timeout=timeout)

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/setup.py
tests/hermes_cli/test_setup.py

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

15105:+Persistent memory via the `brv` CLI — hierarchical knowledge tree with tiered retrieval (fuzzy text → LLM-driven search).
15153:+a hierarchical context tree with tiered retrieval (fuzzy text → LLM-driven
29306:+shell injection, SQL injection, path traversal, eval()/exec() with user input,
50662:+    def _start_modal_exec(self, prepared: PreparedModalExec) -> ModalExecStart:
50711:+    def _poll_modal_exec(self, handle: _ManagedModalExecHandle) -> dict | None:
50738:+    def _cancel_modal_exec(self, handle: _ManagedModalExecHandle) -> None:
50739:+        self._cancel_exec(handle.exec_id)
50838:+    def _cancel_exec(self, exec_id: str) -> None:
50890:+Uses ``Sandbox.create()`` + ``Sandbox.exec()`` instead of the older runtime
51242:+    def _start_modal_exec(self, prepared: PreparedModalExec) -> ModalExecStart:
51308:+    def _poll_modal_exec(self, handle: _DirectModalExecHandle) -> dict | None:
51315:+    def _cancel_modal_exec(self, handle: _DirectModalExecHandle) -> None:
51422:+        prepared = self._prepare_modal_exec(
51430:+            start = self._start_modal_exec(prepared)
51449:+                    self._cancel_modal_exec(start.handle)
51455:+                result = self._poll_modal_exec(start.handle)
51464:+                    self._cancel_modal_exec(start.handle)
51475:+    def _prepare_modal_exec(
51515:+    def _start_modal_exec(self, prepared: PreparedModalExec) -> ModalExecStart:
51519:+    def _poll_modal_exec(self, handle: Any) -> dict | None:

⚠️ WARNING: Outbound network calls (POST/PUT)

Outbound POST/PUT requests in new code could be data exfiltration. Verify the destination URLs are legitimate.

Matches (first 10):

1024:+        with urllib.request.urlopen(req, timeout=15) as resp:
20066:+        resp = self._httpx.post(
54310:+    response = requests.post(base_url, json=payload, headers=headers, timeout=60)

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/memory_setup.py
hermes_cli/setup.py
skills/productivity/google-workspace/scripts/setup.py
tests/hermes_cli/test_setup.py
tests/skills/test_google_oauth_setup.py

⚠️ WARNING: marshal/pickle/compile usage

These can deserialize or construct executable code objects.

Matches:

29307:+pickle.loads(), obfuscated commands.

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[github-actions]

⚠️ Supply Chain Risk Detected

This PR contains patterns commonly associated with supply chain attacks. This does not mean the PR is malicious — but these patterns require careful human review before merging.

⚠️ WARNING: base64 encoding/decoding detected

Base64 has legitimate uses (images, JWT, etc.) but is also commonly used to obfuscate malicious payloads. Verify the usage is appropriate.

Matches (first 20):

69852:+    encoded = base64.b64encode(content.encode("utf-8")).decode("ascii")
69978:+                encoded_result = base64.b64encode(

⚠️ WARNING: exec() or eval() usage

Dynamic code execution can hide malicious behavior, especially when combined with base64 or network fetches.

Matches (first 20):

69413:+        return _browser_eval(expression, task_id)
69423:+def _browser_eval(expression: str, task_id: Optional[str] = None) -> str:
69426:+        return _camofox_eval(expression, task_id)
69463:+def _camofox_eval(expression: str, task_id: Optional[str] = None) -> str:

⚠️ WARNING: Outbound network calls (POST/PUT)

Outbound POST/PUT requests in new code could be data exfiltration. Verify the destination URLs are legitimate.

Matches (first 10):

14732:+        with urllib.request.urlopen(req, timeout=timeout) as resp:
20701:+        resp = requests.post(url, files={"file": (filename, io.BytesIO(data), mime_type)}, data=fields, headers=headers, timeout=30)
21718:+        with urllib.request.urlopen(req, timeout=self._timeout + 3):
68528:+        with patch("tools.osv_check.urllib.request.urlopen", side_effect=ConnectionError("timeout")):
69141:+        response = requests.post(
72032:+    with urllib.request.urlopen(req, timeout=_TIMEOUT) as resp:
74363:+content = urllib.request.urlopen(req, timeout=30).read().decode()
74463:+data = json.loads(urllib.request.urlopen(url, timeout=30).read())
74724:+        resp = httpx.post(f"{MEMORY_API}/recall", json={
77184:+        resp = httpx.post(f"{MEMORY_API}/recall", json={

⚠️ WARNING: Install hook files modified

These files can execute code during package installation or interpreter startup.

Files:

hermes_cli/memory_setup.py
hermes_cli/setup.py
skills/productivity/google-workspace/scripts/setup.py

---

Automated scan triggered by supply-chain-audit. If this is a false positive, a maintainer can approve after manual review.

[dashed]

Closing — upstream absorbed this via NousResearch#6809 / commit 7f7b02b on 2026-04-09 (squash merge, authorship preserved). Branch kept on origin for historical reference; will prune after next fork cleanup pass.