ci: fix secrets job shell, format tests, llm-task timeout

- secrets: set defaults.run.shell to bash for mapfile/process substitution
- isolated-agent.auth-profile-propagation.test: oxfmt, multi-line it(..., timeoutMs)
- llm-task-tool.test: 180s timeout for 'throws on invalid thinking level'

Made-with: Cursor

.github/workflows/ci.yml

@@ -443,6 +443,9 @@ jobs:
 
   secrets:
     runs-on: blacksmith-16vcpu-ubuntu-2404
+    defaults:
+      run:
+        shell: bash
     steps:
       - name: Checkout
         uses: actions/checkout@v6

extensions/llm-task/src/llm-task-tool.test.ts

@@ -137,7 +137,7 @@ describe("llm-task tool (json-only)", () => {
     await expect(tool.execute("id", { prompt: "x", thinking: "banana" })).rejects.toThrow(
       /invalid thinking level/i,
     );
-  });
+  }, 180_000);
 
   it("throws on unsupported xhigh thinking level", async () => {
     const tool = createLlmTaskTool(fakeApi());

src/cron/isolated-agent.auth-profile-propagation.test.ts

@@ -20,71 +20,78 @@ describe("runCronIsolatedAgentTurn auth profile propagation (#20624)", () => {
     setupIsolatedAgentTurnMocks({ fast: true });
   });
 
-  it("passes authProfileId to runEmbeddedPiAgent when auth profiles exist", async () => {
-    await withTempCronHome(async (home) => {
-      const storePath = await writeSessionStore(home, { lastProvider: "webchat", lastTo: "" });
+  it(
+    "passes authProfileId to runEmbeddedPiAgent when auth profiles exist",
+    async () => {
+      await withTempCronHome(async (home) => {
+        const storePath = await writeSessionStore(home, {
+          lastProvider: "webchat",
+          lastTo: "",
+        });
 
-      // 2. Write auth-profiles.json in the agent directory
-      //    resolveAgentDir returns <stateDir>/agents/main/agent
-      //    stateDir = <home>/.openclaw
-      const agentDir = path.join(home, ".openclaw", "agents", "main", "agent");
-      await fs.mkdir(agentDir, { recursive: true });
-      await fs.writeFile(
-        path.join(agentDir, "auth-profiles.json"),
-        JSON.stringify({
-          version: 1,
-          profiles: {
-            "openrouter:default": {
-              type: "api_key",
-              provider: "openrouter",
-              key: "sk-or-test-key-12345",
+        // 2. Write auth-profiles.json in the agent directory
+        //    resolveAgentDir returns <stateDir>/agents/main/agent
+        //    stateDir = <home>/.openclaw
+        const agentDir = path.join(home, ".openclaw", "agents", "main", "agent");
+        await fs.mkdir(agentDir, { recursive: true });
+        await fs.writeFile(
+          path.join(agentDir, "auth-profiles.json"),
+          JSON.stringify({
+            version: 1,
+            profiles: {
+              "openrouter:default": {
+                type: "api_key",
+                provider: "openrouter",
+                key: "sk-or-test-key-12345",
+              },
+            },
+            order: {
+              openrouter: ["openrouter:default"],
+            },
+          }),
+          "utf-8",
+        );
+
+        // 3. Mock runEmbeddedPiAgent to return ok
+        vi.mocked(runEmbeddedPiAgent).mockResolvedValue({
+          payloads: [{ text: "done" }],
+          meta: {
+            durationMs: 5,
+            agentMeta: { sessionId: "s", provider: "openrouter", model: "kimi-k2.5" },
+          },
+        });
+
+        // 4. Run cron isolated agent turn with openrouter model
+        const cfg = makeCfg(home, storePath, {
+          agents: {
+            defaults: {
+              model: { primary: "openrouter/moonshotai/kimi-k2.5" },
+              workspace: path.join(home, "openclaw"),
             },
           },
-          order: {
-            openrouter: ["openrouter:default"],
-          },
-        }),
-        "utf-8",
-      );
+        });
 
-      // 3. Mock runEmbeddedPiAgent to return ok
-      vi.mocked(runEmbeddedPiAgent).mockResolvedValue({
-        payloads: [{ text: "done" }],
-        meta: {
-          durationMs: 5,
-          agentMeta: { sessionId: "s", provider: "openrouter", model: "kimi-k2.5" },
-        },
+        const res = await runCronIsolatedAgentTurn({
+          cfg,
+          deps: createCliDeps(),
+          job: makeJob({ kind: "agentTurn", message: "check status", deliver: false }),
+          message: "check status",
+          sessionKey: "cron:job-1",
+          lane: "cron",
+        });
+
+        expect(res.status).toBe("ok");
+        expect(vi.mocked(runEmbeddedPiAgent)).toHaveBeenCalledTimes(1);
+
+        // 5. Check that authProfileId was passed
+        const callArgs = vi.mocked(runEmbeddedPiAgent).mock.calls[0]?.[0] as {
+          authProfileId?: string;
+          authProfileIdSource?: string;
+        };
+
+        expect(callArgs?.authProfileId).toBe("openrouter:default");
       });
-
-      // 4. Run cron isolated agent turn with openrouter model
-      const cfg = makeCfg(home, storePath, {
-        agents: {
-          defaults: {
-            model: { primary: "openrouter/moonshotai/kimi-k2.5" },
-            workspace: path.join(home, "openclaw"),
-          },
-        },
-      });
-
-      const res = await runCronIsolatedAgentTurn({
-        cfg,
-        deps: createCliDeps(),
-        job: makeJob({ kind: "agentTurn", message: "check status", deliver: false }),
-        message: "check status",
-        sessionKey: "cron:job-1",
-        lane: "cron",
-      });
-
-      expect(res.status).toBe("ok");
-      expect(vi.mocked(runEmbeddedPiAgent)).toHaveBeenCalledTimes(1);
-
-      // 5. Check that authProfileId was passed
-      const callArgs = vi.mocked(runEmbeddedPiAgent).mock.calls[0]?.[0] as {
-        authProfileId?: string;
-        authProfileIdSource?: string;
-      };
-
-      expect(callArgs?.authProfileId).toBe("openrouter:default");
-    });
-  }, timeoutMs);
+    },
+    timeoutMs,
+  );
 });