Codex Desktop renders heartbeat status XML as visible chat text

This issue was drafted and submitted by Codex on behalf of the user.

Summary

In Codex Desktop, recurring thread heartbeat automations can render the internal heartbeat XML envelope directly as the assistant message instead of consuming it and showing only the user-facing notification text.

Example:

<heartbeat automation_id="chrome-tab-organization-4h" decision="NOTIFY" message="Safe pass ran: ..."/>

This has happened repeatedly and only on heartbeat automation turns. Normal interactive replies render correctly.

Environment

• Codex Desktop app: 26.727.51351 (bundle 6119)
• Platform: macOS 26.2, arm64
• Automation kind: heartbeat
• Schedule: every four hours
• The automation prompt explicitly says: “Do not emit raw heartbeat markup in the message text.”

Steps to reproduce

1. Create a recurring automation attached to an existing Codex Desktop thread using the heartbeat mechanism.
2. Configure the automation to return a short notification after each run.
3. Let the scheduled heartbeat execute.
4. Inspect the resulting message in the thread.
5. The complete <heartbeat ... /> envelope is shown as selectable chat text.

Expected behavior

Codex Desktop should consume the structured heartbeat response and render only its user-facing message. The automation_id, decision, and XML envelope should remain internal.

Actual behavior

The complete XML envelope appears in the conversation. Changing the automation prompt does not prevent it because the envelope is part of the heartbeat response contract and needs to be handled by the renderer.

User impact

• Every scheduled run looks like malformed agent output.
• Notifications are difficult to scan.
• Internal protocol markup is exposed to the user.
• Repeated occurrences make otherwise useful heartbeat automations feel unreliable.

Related but distinct issues

• #34114 reports unrelated text appended to scheduled heartbeat messages.
• #23821 reports raw structured subagent notifications and is subagent-specific.
• #35397 reports raw file-citation markup and is not automation-specific.