qualty 0.1.15 → 0.1.17

package/bin/local-runner.js

@@ -9,6 +9,68 @@ function safePathSegment(value, fallback) {
   return normalized || fallback;
 }
 
+/**
+ * Rewrite a dashboard/production test URL to localhost for local CLI runs.
+ * Keeps pathname, search, and hash; swaps origin to http://localhost:<port>.
+ */
+export function rewriteUrlForLocalRun(rawUrl, port) {
+  const portNum = Number(port);
+  if (!Number.isFinite(portNum) || portNum < 1 || portNum > 65535) {
+    return String(rawUrl || "").trim();
+  }
+  const trimmed = String(rawUrl || "").trim();
+  if (!trimmed) return trimmed;
+
+  let parsed;
+  try {
+    const withProtocol = /^https?:\/\//i.test(trimmed) ? trimmed : `https://${trimmed}`;
+    parsed = new URL(withProtocol);
+  } catch {
+    return trimmed;
+  }
+
+  const suffix = `${parsed.pathname}${parsed.search}${parsed.hash}`;
+  return `http://localhost:${portNum}${suffix}`;
+}
+
+function resolveLocalPort(rawPort, fallback = 3000) {
+  const portNum = Number(rawPort);
+  if (Number.isFinite(portNum) && portNum >= 1 && portNum <= 65535) return portNum;
+  return fallback;
+}
+
+const DEFAULT_DESKTOP_DEVICE = "1440x900";
+const DEFAULT_MOBILE_DEVICE = "390x844";
+const LEGACY_DEVICE_PRESETS = {
+  desktop: DEFAULT_DESKTOP_DEVICE,
+  mobile: DEFAULT_MOBILE_DEVICE,
+};
+
+/** Match backend/dashboard device list (desktop + mobile toggles). */
+export function normalizeJobDevices(devices) {
+  const raw = Array.isArray(devices) ? devices : devices != null ? [devices] : [];
+  const out = [];
+  for (const entry of raw) {
+    const token = String(entry || "").trim().toLowerCase();
+    if (!token) continue;
+    out.push(LEGACY_DEVICE_PRESETS[token] || token.replace(/\s+/g, ""));
+  }
+  const unique = [...new Set(out)];
+  return unique.length > 0 ? unique : [DEFAULT_DESKTOP_DEVICE];
+}
+
+function devicesForLocalRun(job, cliDeviceFilter) {
+  const jobDevices = normalizeJobDevices(job?.devices);
+  const filter = String(cliDeviceFilter || "").trim();
+  if (!filter) return jobDevices;
+  const allowed = new Set(normalizeJobDevices([filter]));
+  return jobDevices.filter((d) => allowed.has(d));
+}
+
+function withDevice(device, body = {}) {
+  return { device, ...body };
+}
+
 function localAuthStatePath({ orgId, projectId, profile }) {
   const orgSeg = safePathSegment(orgId || "default-org", "default-org");
   const projectSeg = safePathSegment(projectId || "default-project", "default-project");
@@ -177,6 +239,7 @@ async function preflightMissingLocalBindings({
   savedJobs,
   explicitAuthProfile,
   noAuthState,
+  localPort = 3000,
 }) {
   if (noAuthState) return;
   if (explicitAuthProfile) return;
@@ -195,14 +258,16 @@ async function preflightMissingLocalBindings({
     const entry = missingByProfile.get(profileName) || {
       localProfileName: profileName,
       projectId: String(job?.project_id || projectId || "").trim(),
-      startUrl: String(job?.url || "").trim(),
+      startUrl: rewriteUrlForLocalRun(String(job?.url || "").trim(), localPort),
       tests: [],
     };
     entry.tests.push({
       id: String(job?.id || "").trim(),
       name: String(job?.name || job?.id || "Unnamed test").trim(),
     });
-    if (!entry.startUrl) entry.startUrl = String(job?.url || "").trim();
+    if (!entry.startUrl) {
+      entry.startUrl = rewriteUrlForLocalRun(String(job?.url || "").trim(), localPort);
+    }
     missingByProfile.set(profileName, entry);
   }
   if (missingByProfile.size === 0) return;
@@ -464,6 +529,7 @@ async function runActStep({
   token,
   orgId,
   executionId,
+  device,
   stepIndex,
   page,
   credentials,
@@ -491,7 +557,7 @@ async function runActStep({
         orgId,
         path: `/api/v1/cli/executions/${executionId}/observe`,
         method: "POST",
-        body: {
+        body: withDevice(device, {
           step_index: stepIndex,
           attempt,
           page_text: ctx.page_text,
@@ -500,7 +566,7 @@ async function runActStep({
           excluded_selectors: excluded,
           top_candidates_cache: topCandidatesCache,
           ...(extraBody && typeof extraBody === "object" ? extraBody : {}),
-        },
+        }),
       });
 
     let observe = await observeRequest();
@@ -532,6 +598,7 @@ async function runActStep({
         token,
         orgId,
         executionId,
+        device,
         stepIndex,
         instruction: String(observe.remainder_instruction || ""),
         page,
@@ -610,6 +677,7 @@ async function runActStep({
           token,
           orgId,
           executionId,
+          device,
           stepIndex,
           instruction: String(observe.remainder_instruction || ""),
           page,
@@ -881,6 +949,7 @@ async function runAgentStep({
   token,
   orgId,
   executionId,
+  device,
   stepIndex,
   instruction,
   page,
@@ -896,13 +965,13 @@ async function runAgentStep({
 
   while (turnCount < maxTurns) {
     const screenshotB64 = (await page.screenshot({ type: "png" })).toString("base64");
-    const turnBody = {
+    const turnBody = withDevice(device, {
       step_index: stepIndex,
       screenshot_b64: screenshotB64,
       page_url: page.url(),
       reset,
       function_results: pendingFunctionResults.length ? pendingFunctionResults : undefined,
-    };
+    });
     if (instructionOverride && instruction) {
       turnBody.instruction_override = instruction;
     }
@@ -967,7 +1036,7 @@ async function runAgentStep({
           orgId,
           path: `/api/v1/cli/executions/${executionId}/agent-segment`,
           method: "POST",
-          body: {
+          body: withDevice(device, {
             step_index: stepIndex,
             turn: turnCount,
             turn_thought: turn.turn_thought || "",
@@ -976,7 +1045,7 @@ async function runAgentStep({
             error: actionErr || undefined,
             screenshot_b64: afterB64,
             page_url: page.url(),
-          },
+          }),
         });
       } catch (segErr) {
         console.warn("[CLI] agent-segment upload failed:", segErr.message || segErr);
@@ -1007,16 +1076,27 @@ export async function runLocalExecution({
 }) {
   const { chromium } = await import("playwright");
 
+  const runDevice = String(device || "").trim() || "1440x900";
   const claim = await apiRequest({
     apiUrl,
     token,
     orgId,
     path: `/api/v1/cli/executions/${executionId}/claim`,
     method: "POST",
-    body: { device },
+    body: { device: runDevice },
   });
+  const effectiveDevice = String(claim.device || runDevice).trim() || runDevice;
 
-  const url = claim.url;
+  const originalUrl = String(claim.url || "").trim();
+  const localPort = resolveLocalPort(claim.local_port);
+  const url = rewriteUrlForLocalRun(originalUrl, localPort);
+  if (url !== originalUrl) {
+    // eslint-disable-next-line no-console
+    console.log(`[qualty] Local URL rewrite: ${originalUrl} -> ${url}`);
+  }
+  claim.url = url;
+  // eslint-disable-next-line no-console
+  console.log(`[qualty] Local run ${executionId} device=${effectiveDevice}`);
   const viewport = claim.viewport || { width: 1440, height: 900 };
   const steps = Array.isArray(claim.steps) ? claim.steps : [];
   const totalSteps = claim.total_steps || steps.length;
@@ -1126,6 +1206,7 @@ export async function runLocalExecution({
           token,
           orgId,
           executionId,
+          device: effectiveDevice,
           stepIndex,
           instruction,
           page,
@@ -1144,6 +1225,7 @@ export async function runLocalExecution({
           token,
           orgId,
           executionId,
+          device: effectiveDevice,
           stepIndex,
           page,
           credentials,
@@ -1177,14 +1259,14 @@ export async function runLocalExecution({
             orgId,
             path: `/api/v1/cli/executions/${executionId}/step-result`,
             method: "POST",
-            body: {
+            body: withDevice(effectiveDevice, {
               step_index: stepIndex,
               executor_ok: executorOk,
               action,
               result: row,
               prev_screenshot_b64: prevB64,
               curr_screenshot_b64: currB64,
-            },
+            }),
           });
           if (stepResp && stepResp.result && typeof stepResp.result === "object") {
             row = { ...row, ...stepResp.result };
@@ -1218,14 +1300,14 @@ export async function runLocalExecution({
         orgId,
         path: `/api/v1/cli/executions/${executionId}/step-result`,
         method: "POST",
-        body: {
+        body: withDevice(effectiveDevice, {
           step_index: stepIndex,
           executor_ok: executorOk,
           action,
           result: row,
           prev_screenshot_b64: prevB64,
           curr_screenshot_b64: currB64,
-        },
+        }),
       });
 
       if (stepResp && stepResp.result && typeof stepResp.result === "object") {
@@ -1260,7 +1342,7 @@ export async function runLocalExecution({
     orgId,
     path: `/api/v1/cli/executions/${executionId}/complete`,
     method: "POST",
-    body: {
+    body: withDevice(effectiveDevice, {
       success: runSuccess,
       steps_json: stepsJson,
       explanation: runSuccess ? "Local run completed" : runError || "Local run failed",
@@ -1269,14 +1351,25 @@ export async function runLocalExecution({
       final_screenshot_b64: lastCurrScreenshotB64,
       prev_screenshot_b64: firstPrevScreenshotB64 || lastPrevScreenshotB64,
       network_report: networkCollector.snapshot(),
-    },
+    }),
   });
 
-  if (completeResp && completeResp.status) {
-    runSuccess = completeResp.status === "completed";
-  }
+  return { success: runSuccess, stepsJson, error: runError, device: effectiveDevice };
+}
 
-  return { success: runSuccess, stepsJson, error: runError };
+async function fetchProjectLocalPort({ apiRequest, apiUrl, token, orgId, projectId }) {
+  if (!projectId) return 3000;
+  try {
+    const project = await apiRequest({
+      apiUrl,
+      token,
+      orgId,
+      path: `/api/v1/projects/${encodeURIComponent(String(projectId))}`,
+    });
+    return resolveLocalPort(project?.localhost?.port);
+  } catch {
+    return 3000;
+  }
 }
 
 export async function runLocalCi({
@@ -1301,6 +1394,8 @@ export async function runLocalCi({
     throw new Error("No saved tests matched your selector.");
   }
 
+  const localPort = await fetchProjectLocalPort({ apiRequest, apiUrl, token, orgId, projectId });
+
   const startResp = await apiRequest({
     apiUrl,
     token,
@@ -1328,29 +1423,57 @@ export async function runLocalCi({
     savedJobs,
     explicitAuthProfile: String(authProfile || "").trim(),
     noAuthState: Boolean(noAuthState),
+    localPort,
   });
 
+  const jobById = new Map(savedJobs.map((j) => [String(j.id || "").trim(), j]));
+  const workItems = [];
+  for (const run of started) {
+    const jobId = String(run.saved_job_id || "").trim();
+    const job = jobById.get(jobId);
+    const devices = devicesForLocalRun(job, device);
+    if (devices.length === 0) {
+      // eslint-disable-next-line no-console
+      console.warn(
+        `[qualty] Skipping ${run.saved_job_name || jobId}: no devices match filter${device ? ` (--device ${device})` : ""}`
+      );
+      continue;
+    }
+    for (const dev of devices) {
+      workItems.push({
+        executionId: run.execution_job_id,
+        device: dev,
+        testName: run.saved_job_name || run.saved_job_id,
+      });
+    }
+  }
+  if (workItems.length === 0) {
+    throw new Error("No device combinations to run.");
+  }
+
   const concurrency = Math.max(1, Number(localConcurrency) || 4);
-  const workerCount = Math.min(concurrency, started.length);
+  const workerCount = Math.min(concurrency, workItems.length);
 
   let passed = 0;
   let failed = 0;
 
   // eslint-disable-next-line no-console
-  console.log(`[qualty] Running ${started.length} local run(s) with concurrency=${workerCount}`);
+  console.log(
+    `[qualty] Running ${workItems.length} local device run(s) across ${started.length} test(s) with concurrency=${workerCount}`
+  );
 
   let cursor = 0;
   const worker = async (workerId) => {
     while (true) {
       const idx = cursor;
       cursor += 1;
-      const run = started[idx];
-      if (!run) return;
+      const item = workItems[idx];
+      if (!item) return;
 
-      const id = run.execution_job_id;
+      const id = item.executionId;
       // eslint-disable-next-line no-console
       console.log(
-        `[qualty][worker ${workerId}] Local run ${id} (${run.saved_job_name || run.saved_job_id})`
+        `[qualty][worker ${workerId}] Local run ${id} (${item.testName}) device=${item.device}`
       );
       try {
         const result = await runLocalExecution({
@@ -1359,7 +1482,7 @@ export async function runLocalCi({
           token,
           orgId,
           executionId: id,
-          device,
+          device: item.device,
           headless,
           authProfile,
           noAuthState,
@@ -1404,9 +1527,9 @@ export async function runLocalCi({
     Array.from({ length: workerCount }, (_, idx) => worker(idx + 1))
   );
 
-  if (started.length > 1) {
+  if (workItems.length > 1) {
     // eslint-disable-next-line no-console
-    console.log(`[qualty] Parallel local runs complete (${started.length} total).`);
+    console.log(`[qualty] Parallel local runs complete (${workItems.length} device run(s)).`);
   }
 
   // eslint-disable-next-line no-console

package/bin/qualty.js

@@ -1,12 +1,21 @@
 #!/usr/bin/env node
 
-import { appendFileSync, chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { spawn } from "node:child_process";
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  readdirSync,
+  writeFileSync,
+} from "node:fs";
+import { gzipSync } from "node:zlib";
+import { spawn, spawnSync } from "node:child_process";
 import { homedir, hostname } from "node:os";
 import { join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import process from "node:process";
-import { runLocalCi } from "./local-runner.js";
+import { rewriteUrlForLocalRun, runLocalCi } from "./local-runner.js";
 
 /** CLI backend URL is fixed by Qualty distribution. */
 const DEFAULT_QUALTY_API_URL = "https://qualty-api-production.up.railway.app";
@@ -135,6 +144,8 @@ function usage() {
       "Usage:",
       "  qualty setup [--token <bearer-token>] [--org <org-id>]",
       "  qualty auth setup [--project <project-id>] [--profile <profile-name>] [--headed]",
+      "  qualty auth export-ci --project <project-id> [--profile <profile-name>] [--org <org-id>]",
+      "                   [--output <path>] [--no-file] [--copy] [--set-secret] [--gzip] [--include-token]",
       "  qualty connect --project <project-id> [--port 3000] [--token <bearer-token>] [--org <org-id>]",
       "  qualty run --project <project-id> [--suite-id <suite-id>] [--ids <id1,id2>] [--local] [--token <bearer-token>] [--org <org-id>]",
       "             [--poll-interval 5] [--timeout 30] [--fail-on-failure true] [--no-view-logs]",
@@ -485,6 +496,281 @@ function localAuthStatePath({ orgId, projectId, profile }) {
   return join(QUALTY_SHARED_CREDS_DIR, "local-contexts", orgSeg, projectSeg, `${profileSeg}.json`);
 }
 
+function authExportCiOutputPath(statePath) {
+  return statePath.replace(/\.json$/i, ".b64");
+}
+
+const GITHUB_SECRET_MAX_BYTES = 64 * 1024;
+
+function copyToClipboard(text) {
+  if (process.platform === "darwin") {
+    const result = spawnSync("pbcopy", { input: text, encoding: "utf8" });
+    return result.status === 0;
+  }
+  if (process.platform === "linux") {
+    for (const [cmd, ...cmdArgs] of [
+      ["xclip", "-selection", "clipboard"],
+      ["xsel", "--clipboard", "--input"],
+    ]) {
+      const result = spawnSync(cmd, cmdArgs, { input: text, encoding: "utf8" });
+      if (result.status === 0) return true;
+    }
+    return false;
+  }
+  if (process.platform === "win32") {
+    const result = spawnSync("clip", { input: text, shell: true, encoding: "utf8" });
+    return result.status === 0;
+  }
+  return false;
+}
+
+function setGithubSecret(name, value) {
+  const result = spawnSync("gh", ["secret", "set", name], { input: value, encoding: "utf8" });
+  if (result.error?.code === "ENOENT") {
+    return { ok: false, reason: "GitHub CLI (gh) is not installed." };
+  }
+  if (result.status !== 0) {
+    const detail = String(result.stderr || result.stdout || "").trim();
+    return { ok: false, reason: detail || `gh secret set failed (exit ${result.status})` };
+  }
+  return { ok: true };
+}
+
+function encodeAuthStateForGithubSecret(statePath, { gzip = false } = {}) {
+  const raw = readFileSync(statePath);
+  if (gzip) {
+    return {
+      encoding: "gzip+base64",
+      payload: gzipSync(raw).toString("base64"),
+      rawBytes: raw.length,
+    };
+  }
+  return {
+    encoding: "base64",
+    payload: raw.toString("base64"),
+    rawBytes: raw.length,
+  };
+}
+
+function githubAuthRestoreShell({ orgId, projectId, profile, encoding }) {
+  const orgSeg = safePathSegment(orgId, "default-org");
+  const projectSeg = safePathSegment(projectId, "default-project");
+  const profileSeg = safePathSegment(profile, "default");
+  const decodeCmd =
+    encoding === "gzip+base64"
+      ? 'echo "$QUALTY_AUTH_STATE_B64" | base64 -d | gunzip'
+      : 'echo "$QUALTY_AUTH_STATE_B64" | base64 -d';
+  return [
+    `- name: Restore Qualty login state`,
+    `  env:`,
+    `    QUALTY_AUTH_STATE_B64: \${{ secrets.QUALTY_AUTH_STATE_B64 }}`,
+    `  run: |`,
+    `    AUTH_DIR="$HOME/.qualty/local-contexts/${orgSeg}/${projectSeg}"`,
+    `    mkdir -p "$AUTH_DIR"`,
+    `    ${decodeCmd} > "$AUTH_DIR/${profileSeg}.json"`,
+    `    test -s "$AUTH_DIR/${profileSeg}.json"`,
+    ``,
+    `- name: Run Qualty (local)`,
+    `  env:`,
+    `    QUALTY_API_TOKEN: \${{ secrets.QUALTY_API_TOKEN }}`,
+    `    QUALTY_ORG_ID: \${{ secrets.QUALTY_ORG_ID }}`,
+    `  run: |`,
+    `    npx qualty@latest run --local \\`,
+    `      --project ${projectId} \\`,
+    `      --suite-id YOUR_SUITE_UUID \\`,
+    `      --auth-profile "${profile}" \\`,
+    `      --fail-on-failure true`,
+  ].join("\n");
+}
+
+async function runAuthExportCi(args) {
+  const config = readQualtyConfig();
+  const orgId = resolveOrgId(args, config);
+  const token = resolveToken(args, config);
+  const projectCfg = readProjectConfig();
+  const projectId = String(args.project || projectCfg.local_auth_project_id || "").trim();
+  const profile = String(args.profile || args["auth-profile"] || projectCfg.local_auth_profile || "").trim();
+
+  if (!orgId) {
+    throw new Error("Missing org. Pass --org, set QUALTY_ORG_ID, or add default_org_id to .qualty.json.");
+  }
+  if (!projectId) {
+    throw new Error("Missing project. Pass --project (or run qualty auth setup first).");
+  }
+  if (!profile) {
+    throw new Error('Missing profile. Pass --profile "your-profile" (or run qualty auth setup first).');
+  }
+
+  const statePath = localAuthStatePath({ orgId, projectId, profile });
+  if (!existsSync(statePath)) {
+    throw new Error(
+      [
+        `Local auth state not found:`,
+        `  ${statePath}`,
+        "",
+        "Create it first:",
+        `  qualty auth setup --project ${projectId} --profile "${profile}"`,
+      ].join("\n")
+    );
+  }
+
+  let gzip = parseBoolean(args.gzip, false);
+  let encoded = encodeAuthStateForGithubSecret(statePath, { gzip });
+  let secretBytes = Buffer.byteLength(encoded.payload, "utf8");
+  if (!gzip && secretBytes > GITHUB_SECRET_MAX_BYTES - 1024) {
+    gzip = true;
+    encoded = encodeAuthStateForGithubSecret(statePath, { gzip: true });
+    secretBytes = Buffer.byteLength(encoded.payload, "utf8");
+  }
+  if (secretBytes > GITHUB_SECRET_MAX_BYTES - 1024) {
+    throw new Error(
+      `Auth state is too large for a GitHub secret (${secretBytes} bytes; limit ~64 KB). ` +
+        "Try a shorter-lived session, fewer cookies, or contact Qualty support."
+    );
+  }
+
+  const noFile = parseBoolean(args["no-file"], false);
+  const outputPath = noFile
+    ? String(args.output || "").trim()
+    : String(args.output || "").trim() || authExportCiOutputPath(statePath);
+  const copyToClipboardFlag = parseBoolean(args.copy, false);
+  const setSecretFlag = parseBoolean(args["set-secret"], false);
+  if (outputPath) {
+    writeFileSync(outputPath, encoded.payload, "utf8");
+    try {
+      chmodSync(outputPath, 0o600);
+    } catch {
+      // ignore platforms that do not support chmod
+    }
+  }
+
+  const includeToken = parseBoolean(args["include-token"], false);
+  const profileSeg = safePathSegment(profile, "default");
+  const skipPayloadPrint = Boolean(outputPath || copyToClipboardFlag || setSecretFlag);
+
+  // eslint-disable-next-line no-console
+  console.log("");
+  // eslint-disable-next-line no-console
+  console.log("=== Qualty → GitHub Actions secrets ===");
+  // eslint-disable-next-line no-console
+  console.log("");
+  if (encoded.encoding === "gzip+base64") {
+    // eslint-disable-next-line no-console
+    console.log(`Auth state: gzip+base64 (${encoded.rawBytes} bytes raw → ${secretBytes} bytes secret)`);
+  } else {
+    // eslint-disable-next-line no-console
+    console.log(`Auth state: base64 (${encoded.rawBytes} bytes raw → ${secretBytes} bytes secret)`);
+  }
+  // eslint-disable-next-line no-console
+  console.log("");
+  if (outputPath) {
+    // eslint-disable-next-line no-console
+    console.log(`Wrote QUALTY_AUTH_STATE_B64 to ${outputPath}`);
+    // eslint-disable-next-line no-console
+    console.log(`  gh secret set QUALTY_AUTH_STATE_B64 < ${outputPath}`);
+    // eslint-disable-next-line no-console
+    console.log("");
+  }
+  if (setSecretFlag) {
+    const result = setGithubSecret("QUALTY_AUTH_STATE_B64", encoded.payload);
+    if (result.ok) {
+      // eslint-disable-next-line no-console
+      console.log("✓ Set GitHub secret QUALTY_AUTH_STATE_B64 via gh CLI.");
+    } else {
+      // eslint-disable-next-line no-console
+      console.log(`Could not set QUALTY_AUTH_STATE_B64 automatically: ${result.reason}`);
+      if (outputPath) {
+        // eslint-disable-next-line no-console
+        console.log(`  gh secret set QUALTY_AUTH_STATE_B64 < ${outputPath}`);
+      }
+    }
+    // eslint-disable-next-line no-console
+    console.log("");
+  }
+  if (copyToClipboardFlag) {
+    if (copyToClipboard(encoded.payload)) {
+      // eslint-disable-next-line no-console
+      console.log("✓ Copied QUALTY_AUTH_STATE_B64 to clipboard. Paste into GitHub → Settings → Secrets.");
+    } else {
+      // eslint-disable-next-line no-console
+      console.log("Could not copy to clipboard on this machine.");
+      if (outputPath) {
+        // eslint-disable-next-line no-console
+        console.log(`  Use the file instead: ${outputPath}`);
+      }
+    }
+    // eslint-disable-next-line no-console
+    console.log("");
+  }
+  // eslint-disable-next-line no-console
+  console.log("1. Add these GitHub secrets (Settings → Secrets and variables → Actions):");
+  // eslint-disable-next-line no-console
+  console.log("");
+  // eslint-disable-next-line no-console
+  console.log("---");
+  // eslint-disable-next-line no-console
+  console.log("Name:  QUALTY_ORG_ID");
+  // eslint-disable-next-line no-console
+  console.log("Value:");
+  // eslint-disable-next-line no-console
+  console.log(orgId);
+  // eslint-disable-next-line no-console
+  console.log("---");
+  // eslint-disable-next-line no-console
+  console.log("Name:  QUALTY_API_TOKEN");
+  // eslint-disable-next-line no-console
+  console.log("Value:");
+  if (includeToken && token) {
+    // eslint-disable-next-line no-console
+    console.log(token);
+  } else if (token) {
+    // eslint-disable-next-line no-console
+    console.log(`(your qlty_ci_ token — already configured locally as ${maskSecret(token)})`);
+    // eslint-disable-next-line no-console
+    console.log("Paste the full token from Qualty → Account → API tokens.");
+    // eslint-disable-next-line no-console
+    console.log("Re-run with --include-token to print the token from this machine (avoid shared screens).");
+  } else {
+    // eslint-disable-next-line no-console
+    console.log("(create in Qualty → Account → API tokens; must start with qlty_ci_)");
+  }
+  // eslint-disable-next-line no-console
+  console.log("---");
+  // eslint-disable-next-line no-console
+  console.log("Name:  QUALTY_AUTH_STATE_B64");
+  if (skipPayloadPrint) {
+    // eslint-disable-next-line no-console
+    console.log(`Value: (see file above${copyToClipboardFlag ? " or clipboard" : ""}${setSecretFlag ? " or gh secret" : ""})`);
+  } else {
+    // eslint-disable-next-line no-console
+    console.log("Value:");
+    // eslint-disable-next-line no-console
+    console.log(encoded.payload);
+  }
+  // eslint-disable-next-line no-console
+  console.log("---");
+  // eslint-disable-next-line no-console
+  console.log("");
+  // eslint-disable-next-line no-console
+  console.log("3. Paste this workflow snippet before qualty run:");
+  // eslint-disable-next-line no-console
+  console.log("");
+  // eslint-disable-next-line no-console
+  console.log(githubAuthRestoreShell({ orgId, projectId, profile, encoding: encoded.encoding }));
+  // eslint-disable-next-line no-console
+  console.log("");
+  // eslint-disable-next-line no-console
+  console.log(`Local file: ${statePath}`);
+  // eslint-disable-next-line no-console
+  console.log(`Profile flag: --auth-profile "${profile}" (file on disk: ${profileSeg}.json)`);
+  // eslint-disable-next-line no-console
+  console.log("");
+  // eslint-disable-next-line no-console
+  console.log("When login expires, re-run qualty auth setup and qualty auth export-ci to refresh the secret.");
+  // eslint-disable-next-line no-console
+  console.log("");
+}
+
 function listLocalAuthProfiles({ orgId, projectId }) {
   const orgSeg = safePathSegment(orgId || "default-org", "default-org");
   const projectSeg = safePathSegment(projectId || "default-project", "default-project");
@@ -1426,6 +1712,7 @@ async function runAuthSetup(args) {
       id: String(p?.id || "").trim(),
       name: String(p?.name || "").trim() || "Unnamed project",
       url: String(p?.url || "").trim(),
+      localPort: Number(p?.localhost?.port) || 3000,
     }))
     .filter((p) => p.id);
   if (projects.length === 0) {
@@ -1537,7 +1824,15 @@ async function runAuthSetup(args) {
     }
     const context = await browser.newContext();
     const page = await context.newPage();
-    const startUrl = project.url || "about:blank";
+    const rawStartUrl = project.url || "about:blank";
+    const startUrl =
+      rawStartUrl === "about:blank"
+        ? rawStartUrl
+        : rewriteUrlForLocalRun(rawStartUrl, project.localPort);
+    if (startUrl !== rawStartUrl) {
+      // eslint-disable-next-line no-console
+      console.log(`[qualty][auth] Local URL rewrite: ${rawStartUrl} -> ${startUrl}`);
+    }
     await page.goto(startUrl, { waitUntil: "domcontentloaded", timeout: 60000 }).catch(() => {});
     // eslint-disable-next-line no-console
     console.log(`[qualty][auth] Browser opened for project "${project.name}".`);
@@ -1574,6 +1869,13 @@ async function runAuthSetup(args) {
     console.log(`[qualty][auth] Saved local context profile "${profile}" for project "${project.name}".`);
     // eslint-disable-next-line no-console
     console.log(`[qualty][auth] Path: ${statePath}`);
+    // eslint-disable-next-line no-console
+    console.log("");
+    // eslint-disable-next-line no-console
+    console.log(
+      `[qualty][auth] For GitHub Actions secrets, run:\n` +
+        `  qualty auth export-ci --project ${project.id} --profile "${profile}"`
+    );
   } finally {
     rl.close();
   }
@@ -1600,7 +1902,11 @@ async function main() {
       await runAuthSetup(args);
       return;
     }
-    throw new Error("Unknown auth subcommand. Use: qualty auth setup");
+    if (sub === "export-ci") {
+      await runAuthExportCi(args);
+      return;
+    }
+    throw new Error("Unknown auth subcommand. Use: qualty auth setup | qualty auth export-ci");
   }
   if (command === "run") {
     const config = readQualtyConfig();
@@ -1657,7 +1963,8 @@ async function main() {
         resolveSavedJobs,
         apiRequest,
         failOnFailure: parseBoolean(args["fail-on-failure"], true),
-        device: args.device || "1440x900",
+        // Only filter viewports when --device is passed; otherwise run all devices on each test.
+        device: args.device ? String(args.device).trim() : undefined,
         headless: !parseBoolean(args.headed, false),
         localConcurrency: resolveLocalConcurrency(args),
         authProfile: localAuth?.profile || authChoice.authProfile || "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qualty",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Qualty CLI for localhost and CI test runs",
   "bin": {
     "qualty": "bin/qualty.js"