fix(agents): separate heartbeat runtime template#85416
Conversation
Dependency Changes DetectedThis PR changes dependency-related files. Maintainers should confirm these changes are intentional. Changed files:
Maintainer follow-up:
|
|
No dependency changes detected. Learn more about Socket for GitHub. 👍 No dependency changes detected in pull request |
|
Codex review: passed. Reviewed May 27, 2026, 8:29 AM ET / 12:29 UTC. Summary PR surface: Source +281, Tests +283, Docs +11, Config +1, Other 0. Total +576 across 15 files. Reproducibility: yes. from source inspection: current main loads Review metrics: 1 noteworthy metric.
Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Risk before merge
Maintainer options:
Next step before merge Security Review detailsBest possible solution: Land the template split with the narrow doctor repair if maintainers accept the compatibility behavior; otherwise keep the runtime/docs separation and revise the repair policy before merge. Do we have a high-confidence way to reproduce the issue? Yes from source inspection: current main loads Is this the best way to solve the issue? Yes. Separating the runtime template from the docs page and adding a narrow doctor repair is the maintainable fix; the compatibility-sensitive part is the exact policy for rewriting legacy user files. AGENTS.md: found and applied where relevant. Codex review notes: model gpt-5.5, reasoning high; reviewed against 3e351b718e28. Label changesLabel justifications:
Evidence reviewedPR surface: Source +281, Tests +283, Docs +11, Config +1, Other 0. Total +576 across 15 files. View PR surface stats
What I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
|
ClawSweeper PR egg ✨ Hatched: ✨ glimmer Cosmic Proofling Hatch commandComment Hatchability rules:
Rarity: ✨ glimmer. What is this egg doing here?
|
d51ef17 to
20ffaf2
Compare
|
@clawsweeper automerge |
|
🦞✅ Source: What merged:
Automerge notes:
The automerge loop is complete. Automerge progress:
|
6e9d23e to
e34e858
Compare
Summary: - The PR moves the runtime `HEARTBEAT.md` bootstrap template into `src/agents/templates`, keeps docs templates ... or other workspace files, adds a legacy heartbeat-template doctor repair, and updates package guards/tests. - PR surface: Source +281, Tests +283, Docs +11, Config +1, Other 0. Total +576 across 15 files. - Reproducibility: yes. from source inspection: current main loads `HEARTBEAT.md` from the docs template, and ... pty heartbeat file non-empty to the runtime. I did not run a live heartbeat repro in this read-only review. Automerge notes: - PR branch already contained follow-up commit before automerge: fix(doctor): recognize heartbeat docs boilerplate - PR branch already contained follow-up commit before automerge: fix(agents): update heartbeat workspace test - PR branch already contained follow-up commit before automerge: fix(doctor): tighten heartbeat template repair Validation: - ClawSweeper review passed for head e34e858. - Required merge gates passed before the squash merge. Prepared head SHA: e34e858 Review: openclaw#85416 (comment) Co-authored-by: Mason Huang <masonxhuang@tencent.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: hxy91819 Co-authored-by: hxy91819 <8814856+hxy91819@users.noreply.github.com>
…026.5.27) (#698) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.5.26` → `2026.5.27` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.5.27`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#2026527) [Compare Source](openclaw/openclaw@v2026.5.26...v2026.5.27) ##### Highlights - Safer local/runtime boundaries: OpenClaw now rejects unsafe command wrappers, malformed CLI numeric options, unsafe Node runtime env overrides, no-auth Tailscale exposure, and non-admin device-role pairing approvals before they can affect live runs. ([#​87308](openclaw/openclaw#87308), [#​87305](openclaw/openclaw#87305), [#​87292](openclaw/openclaw#87292), [#​87146](openclaw/openclaw#87146)) - Matrix and auto-reply delivery are steadier: mention previews stay inert, final mention replies deliver normally, shared-DM notices are awaited, MXID parsing ignores filenames, and reasoning-prefixed `NO_REPLY` responses stay suppressed. - Provider and agent reliability improved across OpenAI-compatible embeddings, cached token usage, Anthropic/Codex/Claude runtime state, unsupported tool-schema quarantine, heartbeat templates, and session fallback errors. ([#​85269](openclaw/openclaw#85269), [#​82062](openclaw/openclaw#82062), [#​85416](openclaw/openclaw#85416), [#​86855](openclaw/openclaw#86855)) - Plugin and package release paths got tighter: Pixverse ships as an external video plugin with region selection, package exclusions and shrinkwrap inventory match the published npm shape, and release/package smoke commands fail bounded instead of hanging. - Gateway hot paths do less rediscovery by reusing current plugin metadata fingerprints, stable plugin index fingerprints, read-only session metadata, active working stores, status fast paths, and auth/env snapshots. ([#​86439](openclaw/openclaw#86439)) ##### Changes - Memory: add a core OpenAI-compatible embedding provider for local and hosted OpenAI-style endpoints, with config, doctor, and docs support. ([#​85269](openclaw/openclaw#85269)) Thanks [@​dutifulbob](https://github.com/dutifulbob). - Plugin SDK: mark memory-specific embedding provider registration as deprecated compatibility and surface non-bundled usage in plugin compatibility diagnostics. ([#​85072](openclaw/openclaw#85072)) Thanks [@​mbelinky](https://github.com/mbelinky). - Pixverse: add video generation provider support, API region selection, and external plugin publishing. - Plugins: expose approval action metadata for plugin-driven approval surfaces. ##### Fixes - Security/CLI/runtime: harden hostname normalization for repeated trailing dots, block side-effecting command wrappers, reject unsafe Node runtime env overrides, reject loose numeric CLI and gateway options, require admin approval for node device-role pairing, and reject no-auth Tailscale exposure. ([#​87305](openclaw/openclaw#87305), [#​87292](openclaw/openclaw#87292), [#​87308](openclaw/openclaw#87308), [#​87146](openclaw/openclaw#87146)) Thanks [@​pgondhi987](https://github.com/pgondhi987). - Doctor: validate runtime tool schemas for every configured embedded agent while skipping ACP-only profiles, so bad non-default plugin or MCP tools are reported before assistant turns. - Telegram: route `sendMessage` action replies through durable outbound delivery so completed agent responses remain retryable when the gateway send path times out. ([#​87261](openclaw/openclaw#87261)) Thanks [@​mbelinky](https://github.com/mbelinky). - Matrix/auto-reply: keep draft previews mention-inert, preserve final mention delivery, send mention finals normally, await shared DM notices, ignore filename-embedded MXIDs, and suppress reasoning-prefixed `NO_REPLY` responses. - Agents/providers: add OpenAI-compatible cache retention, forward cached token usage in chat completions, preserve runtime context before active user turns, strip stale Anthropic thinking, load Claude CLI OAuth for Pi auth profiles, avoid false Codex runtime live switches, and quarantine unsupported tool schemas. ([#​82062](openclaw/openclaw#82062), [#​87167](openclaw/openclaw#87167), [#​86855](openclaw/openclaw#86855)) - Gateway/performance: cache plugin metadata fingerprints and stable plugin index fingerprints, borrow read-only session metadata safely, keep the active session working store hot, keep status on a bounded fast path, and preserve model auth profile suffixes. ([#​86439](openclaw/openclaw#86439)) - Package/install/release: align npm package exclusions and inventory, omit unpacked test helpers, skip Homebrew until macOS packages need it, cap tsdown heap in containers, bound install/release smoke waits, and harden post-publish verification. - Codex/Auth: bound ChatGPT OAuth token exchange and refresh requests, and honor cancellation across Codex and Anthropic OAuth login flows. - QA/E2E/CI: bound Telegram, kitchen-sink, Open WebUI, ClawHub, MCP, Discord, realtime, labeler, and GitHub API waits; fail empty explicit test, live-media, gateway CPU, startup benchmark, plugin gauntlet, and beta-smoke runs instead of false-greening. - Agents/Codex: keep spawned agent bootstrap files rooted in the agent workspace while running task commands, transcripts, and compaction from the requested cwd. ([#​87218](openclaw/openclaw#87218)) Thanks [@​mbelinky](https://github.com/mbelinky). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19--> Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/698
Summary: - The PR moves the runtime `HEARTBEAT.md` bootstrap template into `src/agents/templates`, keeps docs templates ... or other workspace files, adds a legacy heartbeat-template doctor repair, and updates package guards/tests. - PR surface: Source +281, Tests +283, Docs +11, Config +1, Other 0. Total +576 across 15 files. - Reproducibility: yes. from source inspection: current main loads `HEARTBEAT.md` from the docs template, and ... pty heartbeat file non-empty to the runtime. I did not run a live heartbeat repro in this read-only review. Automerge notes: - PR branch already contained follow-up commit before automerge: fix(doctor): recognize heartbeat docs boilerplate - PR branch already contained follow-up commit before automerge: fix(agents): update heartbeat workspace test - PR branch already contained follow-up commit before automerge: fix(doctor): tighten heartbeat template repair Validation: - ClawSweeper review passed for head e34e858. - Required merge gates passed before the squash merge. Prepared head SHA: e34e858 Review: openclaw#85416 (comment) Co-authored-by: Mason Huang <masonxhuang@tencent.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: hxy91819 Co-authored-by: hxy91819 <8814856+hxy91819@users.noreply.github.com>
Summary: - The PR moves the runtime `HEARTBEAT.md` bootstrap template into `src/agents/templates`, keeps docs templates ... or other workspace files, adds a legacy heartbeat-template doctor repair, and updates package guards/tests. - PR surface: Source +281, Tests +283, Docs +11, Config +1, Other 0. Total +576 across 15 files. - Reproducibility: yes. from source inspection: current main loads `HEARTBEAT.md` from the docs template, and ... pty heartbeat file non-empty to the runtime. I did not run a live heartbeat repro in this read-only review. Automerge notes: - PR branch already contained follow-up commit before automerge: fix(doctor): recognize heartbeat docs boilerplate - PR branch already contained follow-up commit before automerge: fix(agents): update heartbeat workspace test - PR branch already contained follow-up commit before automerge: fix(doctor): tighten heartbeat template repair Validation: - ClawSweeper review passed for head e34e858. - Required merge gates passed before the squash merge. Prepared head SHA: e34e858 Review: openclaw#85416 (comment) Co-authored-by: Mason Huang <masonxhuang@tencent.com> Co-authored-by: clawsweeper[bot] <274271284+clawsweeper[bot]@users.noreply.github.com> Approved-by: hxy91819 Co-authored-by: hxy91819 <8814856+hxy91819@users.noreply.github.com>
Summary
HEARTBEAT.mdbootstrap template tosrc/agents/templates/so docs edits no longer change heartbeat behavior.Verification
pnpm docs:listnode scripts/run-vitest.mjs src/agents/workspace-templates.test.ts src/commands/doctor-heartbeat-template-repair.test.ts src/flows/doctor-health-contributions.test.ts src/auto-reply/heartbeat.test.tsnode scripts/run-vitest.mjs test/openclaw-npm-release-check.test.tsnode scripts/run-vitest.mjs src/commands/doctor-heartbeat-template-repair.test.tsnode scripts/run-vitest.mjs src/flows/doctor-health-conversion-plan.test.tspnpm exec node scripts/test-projects.mjs test/vitest/vitest.unit-src.config.ts test/vitest/vitest.unit-security.config.tsnpm pack --dry-run --json --ignore-scriptsconfirmedsrc/agents/templates/HEARTBEAT.mdis includedgit diff --checkReal behavior proof
Behavior addressed: Default heartbeat workspaces no longer receive docs-only
HEARTBEAT.mdcontent that makes an otherwise empty heartbeat file trigger model calls.Real environment tested: Local Linux worktree with Node 22.21.1 using repo test wrappers.
Exact steps or command run after this patch: Ran the verification commands listed above, including targeted runtime-template, doctor-repair, heartbeat empty-content, release pack guard, and npm dry-run package inclusion checks.
Evidence after fix: Runtime template tests assert
src/agents/templates/HEARTBEAT.mdhas no frontmatter and is effectively empty; doctor repair tests cover legacy fenced/Related templates and user-authored fenced content; npm dry-run includes the runtime heartbeat template path.Observed result after fix: Targeted Vitest checks passed, the core src/security shard passed after adding the doctor conversion-plan entry, the npm dry-run pack list included
src/agents/templates/HEARTBEAT.md, andgit diff --checkpassed.What was not tested: Full
pnpm check/full suite and installed package smoke were not run locally.Package/doctor black-box verification (v2 — updated)
Commands run
Clone at SHA
6e9d23eef3b047f3a50f396e1cf7f4c2f0c2be56→pnpm install --frozen-lockfile→pnpm pack→npm install -g <tarball>→openclaw doctor --fix(8 workspace variants) →openclaw doctor(diagnostic mode)Evidence
package/src/agents/templates/HEARTBEAT.mdHEARTBEAT.md- Check email) (VAL-VRFY-005)- Run daily check) (VAL-VRFY-010)Result: PASS
Gaps/blockers
None