qualty 0.1.20 → 0.1.21

package/bin/local-runner.js

@@ -78,6 +78,25 @@ function localAuthStatePath({ orgId, projectId, profile }) {
   return join(homedir(), ".qualty", "local-contexts", orgSeg, projectSeg, `${profileSeg}.json`);
 }
 
+function jobUsesSavedLogin(job) {
+  if (!job) return false;
+  if (job.use_saved_login) return true;
+  if (job.saved_login_profile_id) return true;
+  const profile = job.saved_login_profile;
+  return Boolean(profile && typeof profile === "object" && (profile.id || profile.name));
+}
+
+function localProfileLabel(profile) {
+  if (!profile || typeof profile !== "object") return "";
+  return String(profile.local_profile_name || profile.name || "").trim();
+}
+
+function authSetupCommand(projectId, profileName) {
+  const pid = String(projectId || "").trim();
+  const name = String(profileName || "").trim();
+  return `qualty auth setup --project ${pid} --profile "${name}"`;
+}
+
 export function summarizeStorageStateFile(statePath) {
   const path = String(statePath || "").trim();
   if (!path || !existsSync(path)) {
@@ -233,6 +252,31 @@ export async function logAuthStateAfterInjection(tag, context, { testUrl = "" }
   }
 }
 
+export async function logAuthStateAfterNavigation(tag, page) {
+  try {
+    const snapshot = await page.evaluate(() => ({
+      origin: window.location.origin,
+      href: window.location.href,
+      localStorageKeys: Object.keys(localStorage),
+      cookieCount: document.cookie ? document.cookie.split(";").filter(Boolean).length : 0,
+    }));
+    const keys = snapshot.localStorageKeys.length ? snapshot.localStorageKeys.join(", ") : "none";
+    // eslint-disable-next-line no-console
+    console.log(
+      `${tag} after navigation (${snapshot.origin}): localStorage keys [${keys}], document.cookie entries ~${snapshot.cookieCount}`
+    );
+    if (snapshot.localStorageKeys.length === 0 && snapshot.cookieCount === 0) {
+      // eslint-disable-next-line no-console
+      console.warn(
+        `${tag} warning: page has no localStorage keys and no cookies after navigation — app will likely appear logged out`
+      );
+    }
+  } catch (err) {
+    // eslint-disable-next-line no-console
+    console.warn(`${tag} could not read auth state after navigation: ${err?.message || err}`);
+  }
+}
+
 const localBindingSetupPromises = new Map();
 
 async function promptYesNo(question, defaultYes = true) {
@@ -340,11 +384,21 @@ async function maybeSetupMissingLocalBinding({
     ? claim.saved_login_profile
     : null;
   if (!profile || !profile.name) return null;
-  if (profile.has_local_binding) return null;
-  if (!process.stdin.isTTY || !process.stdout.isTTY) return null;
-
   const profileName = String(profile.name || "").trim();
   if (!profileName) return null;
+  const localProfileName = localProfileLabel(profile) || profileName;
+  const statePath = localAuthStatePath({
+    orgId,
+    projectId: claim?.project_id,
+    profile: localProfileName,
+  });
+  if (existsSync(statePath)) return null;
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    throw new Error(
+      `Local login state missing for profile "${profileName}". Run: ${authSetupCommand(claim?.project_id, profileName)}`
+    );
+  }
+
   const key = `${String(orgId || "")}:${String(claim?.project_id || "")}:${profileName}`;
   if (localBindingSetupPromises.has(key)) {
     return localBindingSetupPromises.get(key);
@@ -398,20 +452,21 @@ async function preflightMissingLocalBindings({
 }) {
   if (noAuthState) return;
   if (explicitAuthProfile) return;
-  if (!process.stdin.isTTY || !process.stdout.isTTY) return;
   const missingByProfile = new Map();
   for (const job of savedJobs || []) {
-    const useSaved = Boolean(job?.use_saved_login);
+    if (!jobUsesSavedLogin(job)) continue;
     const profileName = String(job?.saved_login_profile?.name || "").trim();
-    if (!useSaved || !profileName) continue;
+    if (!profileName) continue;
+    const localProfileName =
+      String(job?.saved_login_profile?.local_profile_name || "").trim() || profileName;
     const statePath = localAuthStatePath({
       orgId,
       projectId: String(job?.project_id || projectId || "").trim(),
-      profile: profileName,
+      profile: localProfileName,
     });
     if (existsSync(statePath)) continue;
     const entry = missingByProfile.get(profileName) || {
-      localProfileName: profileName,
+      localProfileName,
       projectId: String(job?.project_id || projectId || "").trim(),
       startUrl: rewriteUrlForLocalRun(String(job?.url || "").trim(), localPort),
       tests: [],
@@ -427,6 +482,13 @@ async function preflightMissingLocalBindings({
   }
   if (missingByProfile.size === 0) return;
 
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    const [profileName, entry] = missingByProfile.entries().next().value;
+    throw new Error(
+      `Local login state missing for profile "${profileName}". Run: ${authSetupCommand(entry.projectId, profileName)}`
+    );
+  }
+
   // eslint-disable-next-line no-console
   console.log("[qualty][auth] Missing local login state for attached dashboard profiles:");
   for (const [profileName, entry] of missingByProfile.entries()) {
@@ -1228,6 +1290,51 @@ export async function runLocalExecution({
   authProfile,
   noAuthState,
   storageStatePath,
+}) {
+  let overallSuccess = true;
+  let lastError = null;
+  let claimDevice = device || undefined;
+
+  while (true) {
+    let once;
+    try {
+      once = await runLocalSingleCombination({
+        apiRequest,
+        apiUrl,
+        token,
+        orgId,
+        executionId,
+        device: claimDevice,
+        headless,
+        authProfile,
+        noAuthState,
+        storageStatePath,
+      });
+    } catch (err) {
+      const msg = String(err?.message || err);
+      if (msg.includes("No queued combinations")) break;
+      throw err;
+    }
+    claimDevice = undefined;
+    overallSuccess = overallSuccess && once.success;
+    if (!once.success) lastError = once.error;
+    if (device || !once.combinationsRemaining) break;
+  }
+
+  return { success: overallSuccess, error: lastError };
+}
+
+async function runLocalSingleCombination({
+  apiRequest,
+  apiUrl,
+  token,
+  orgId,
+  executionId,
+  device,
+  headless,
+  authProfile,
+  noAuthState,
+  storageStatePath,
 }) {
   const { chromium } = await import("playwright");
 
@@ -1238,7 +1345,7 @@ export async function runLocalExecution({
     orgId,
     path: `/api/v1/cli/executions/${executionId}/claim`,
     method: "POST",
-    body: { device: runDevice },
+    body: device ? { device: String(device).trim() } : {},
   });
   const effectiveDevice = String(claim.device || runDevice).trim() || runDevice;
 
@@ -1267,7 +1374,7 @@ export async function runLocalExecution({
     explicitAuthProfile: String(authProfile || "").trim(),
     noAuthState: Boolean(noAuthState),
   });
-  const claimProfile = String(claimSavedLogin?.local_profile_name || "").trim();
+  const claimProfile = localProfileLabel(claimSavedLogin);
   const effectiveProfile = String(authProfile || "").trim() || setupFromClaim?.profile || claimProfile;
   const resolvedStoragePath =
     !noAuthState && effectiveProfile
@@ -1309,12 +1416,22 @@ export async function runLocalExecution({
   });
 
   if (!noAuthState && effectiveProfile && !finalStoragePath) {
+    const profileName = String(claimSavedLogin?.name || effectiveProfile).trim();
     const candidates = [storageStatePath, resolvedStoragePath].filter(Boolean);
+    const setupCmd = authSetupCommand(claim.project_id, profileName);
+    const detail =
+      `Local login state missing for profile "${profileName}".` +
+      (candidates.length ? ` Checked: ${candidates.join(", ")}.` : "") +
+      ` Run: ${setupCmd}`;
+    const failLoud =
+      !process.stdin.isTTY ||
+      !process.stdout.isTTY ||
+      (claimSavedLogin?.name && !String(authProfile || "").trim());
+    if (failLoud) {
+      throw new Error(detail);
+    }
     // eslint-disable-next-line no-console
-    console.warn(
-      `[qualty][auth] profile "${effectiveProfile}" was requested but no auth state file exists` +
-        (candidates.length ? ` (checked: ${candidates.join(", ")})` : "")
-    );
+    console.warn(`[qualty][auth] ${detail}`);
   }
 
   const browserServer = await chromium.launchServer({
@@ -1379,6 +1496,9 @@ export async function runLocalExecution({
   try {
     await page.goto(url, { waitUntil: "domcontentloaded", timeout: 60000 });
     await page.waitForTimeout(500);
+    if (finalStoragePath) {
+      await logAuthStateAfterNavigation("[qualty][auth]", page);
+    }
 
     for (let stepIndex = 0; stepIndex < totalSteps; stepIndex += 1) {
       const step = steps[stepIndex] || {};
@@ -1544,7 +1664,12 @@ export async function runLocalExecution({
     }),
   });
 
-  return { success: runSuccess, stepsJson, error: runError, device: effectiveDevice };
+  if (completeResp && completeResp.status) {
+    runSuccess = completeResp.status === "completed" || runSuccess;
+  }
+
+  const combinationsRemaining = Number(completeResp?.combinations_remaining ?? 0);
+  return { success: runSuccess, stepsJson, error: runError, combinationsRemaining, device: effectiveDevice };
 }
 
 async function fetchProjectLocalPort({ apiRequest, apiUrl, token, orgId, projectId }) {
@@ -1604,6 +1729,10 @@ export async function runLocalCi({
   const started = runs.filter((r) => r.execution_job_id);
   if (started.length === 0) throw new Error("Failed to start any local runs.");
 
+  const executionIds = started.map((r) => r.execution_job_id);
+  // eslint-disable-next-line no-console
+  console.log(`QUALTY_EXECUTION_IDS=${JSON.stringify(executionIds)}`);
+
   await preflightMissingLocalBindings({
     apiRequest,
     apiUrl,

package/bin/qualty.js

@@ -12,40 +12,32 @@ import {
 import { gzipSync } from "node:zlib";
 import { spawn, spawnSync } from "node:child_process";
 import { homedir, hostname } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import process from "node:process";
 import { rewriteUrlForLocalRun, runLocalCi, summarizeStorageStateFile, logAuthStateDiagnostics } from "./local-runner.js";
 
-/** CLI backend URL is fixed by Qualty distribution. */
-const DEFAULT_QUALTY_API_URL = "https://qualty-api-production.up.railway.app";
+/** Default Qualty API base URL (no trailing slash). Override with QUALTY_API_URL env. */
+//const DEFAULT_QUALTY_API_URL = "https://qualty-api-production.up.railway.app";
+const DEFAULT_QUALTY_API_URL = "http://127.0.0.1:8000";
 
-const QUALTY_CONFIG_DIR = join(homedir(), ".config", "qualty");
-const QUALTY_CONFIG_PATH = join(QUALTY_CONFIG_DIR, "config.json");
+const PROJECT_CONFIG_FILENAME = ".qualty.json";
 const QUALTY_SHARED_CREDS_DIR = join(homedir(), ".qualty");
 const QUALTY_SHARED_CREDS_PATH = join(QUALTY_SHARED_CREDS_DIR, "credentials");
-const QUALTY_PROJECT_CONFIG_PATH = join(process.cwd(), ".qualty.json");
 
-function readQualtyConfig() {
-  if (!existsSync(QUALTY_CONFIG_PATH)) return {};
-  try {
-    const raw = readFileSync(QUALTY_CONFIG_PATH, "utf8");
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object") return {};
-    return parsed;
-  } catch {
-    return {};
+function findProjectConfigPath() {
+  let current = process.cwd();
+  for (;;) {
+    const candidate = join(current, PROJECT_CONFIG_FILENAME);
+    if (existsSync(candidate)) return candidate;
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
   }
 }
 
-function writeQualtyConfig(config) {
-  mkdirSync(QUALTY_CONFIG_DIR, { recursive: true });
-  writeFileSync(QUALTY_CONFIG_PATH, `${JSON.stringify(config, null, 2)}\n`, "utf8");
-  try {
-    chmodSync(QUALTY_CONFIG_PATH, 0o600);
-  } catch {
-    // best effort on non-posix systems
-  }
+function getProjectConfigWritePath() {
+  return findProjectConfigPath() || join(process.cwd(), PROJECT_CONFIG_FILENAME);
 }
 
 function readSharedCredentials() {
@@ -70,10 +62,19 @@ function writeSharedCredentials(token) {
   }
 }
 
+function projectIdFromConfig(projectCfg, fallback = "") {
+  return String(fallback || projectCfg.default_project_id || "").trim();
+}
+
+function authProfileFromConfig(projectCfg, fallback = "") {
+  return String(fallback || projectCfg.default_auth_profile || "").trim();
+}
+
 function readProjectConfig() {
-  if (!existsSync(QUALTY_PROJECT_CONFIG_PATH)) return {};
+  const configPath = findProjectConfigPath();
+  if (!configPath) return {};
   try {
-    const raw = readFileSync(QUALTY_PROJECT_CONFIG_PATH, "utf8");
+    const raw = readFileSync(configPath, "utf8");
     const parsed = JSON.parse(raw);
     if (!parsed || typeof parsed !== "object") return {};
     return parsed;
@@ -83,29 +84,29 @@ function readProjectConfig() {
 }
 
 function writeProjectConfig(updates) {
+  const configPath = getProjectConfigWritePath();
   const current = readProjectConfig();
   const next = { ...current };
   for (const [k, v] of Object.entries(updates || {})) {
     if (v === undefined || v === null || v === "") delete next[k];
     else next[k] = v;
   }
-  writeFileSync(QUALTY_PROJECT_CONFIG_PATH, `${JSON.stringify(next, null, 2)}\n`, "utf8");
+  writeFileSync(configPath, `${JSON.stringify(next, null, 2)}\n`, "utf8");
 }
 
-function resolveApiUrl(args, config = {}) {
+function resolveApiUrl(args = {}) {
   void args;
-  void config;
-  return String(DEFAULT_QUALTY_API_URL).replace(/\/$/, "");
+  return String(process.env.QUALTY_API_URL || DEFAULT_QUALTY_API_URL).replace(/\/$/, "");
 }
 
-function resolveToken(args, config = {}) {
+function resolveToken(args = {}) {
   const creds = readSharedCredentials();
-  return args.token || process.env.QUALTY_API_TOKEN || creds.api_token || config.api_token || "";
+  return args.token || process.env.QUALTY_API_TOKEN || creds.api_token || "";
 }
 
-function resolveOrgId(args, config = {}) {
+function resolveOrgId(args = {}) {
   const projectCfg = readProjectConfig();
-  return args.org || process.env.QUALTY_ORG_ID || config.org_id || projectCfg.default_org_id || "";
+  return args.org || process.env.QUALTY_ORG_ID || projectCfg.default_org_id || "";
 }
 
 function maskSecret(secret) {
@@ -145,7 +146,10 @@ function usage() {
       "  qualty setup [--token <bearer-token>] [--org <org-id>]",
       "  qualty auth setup [--project <project-id>] [--profile <profile-name>] [--headed]",
       "  qualty auth export-ci --project <project-id> [--profile <profile-name>] [--org <org-id>]",
-      "                   [--output <path>] [--no-file] [--copy] [--set-secret] [--gzip] [--include-token]",
+      "                   [--suite-id <suite-uuid>] [--repo <owner/repo>]",
+      "                   [--output <path>] [--no-file] [--copy] [--gzip] [--include-token]",
+      "                   [--set-secret | --set-github]  gh: secrets (token, API URL, auth) + variables (org, project, profile, …)",
+      "                   [--cli-repo <owner/repo>] [--cli-ref <branch>]  Optional CI variables",
       "  qualty connect --project <project-id> [--port 3000] [--token <bearer-token>] [--org <org-id>]",
       "  qualty run --project <project-id> [--suite-id <suite-id>] [--ids <id1,id2>] [--local] [--token <bearer-token>] [--org <org-id>]",
       "             [--poll-interval 5] [--timeout 30] [--fail-on-failure true] [--no-view-logs]",
@@ -157,7 +161,8 @@ function usage() {
       "",
       "Env vars:",
       "  QUALTY_API_TOKEN  Bearer token used for auth",
-      "  QUALTY_ORG_ID     Org context for scoped API requests",
+      "  QUALTY_API_URL    API base URL (default: bundled CLI default)",
+      "  QUALTY_ORG_ID     Org context override (default: .qualty.json default_org_id)",
       "  QUALTY_LOCAL_CONCURRENCY  Local parallel workers for --local runs (default: 4)",
     ].join("\n")
   );
@@ -228,12 +233,11 @@ function startCloudflared(token, port) {
 }
 
 async function runConnect(args) {
-  const config = readQualtyConfig();
   const projectId = args.project;
   const port = Number(args.port || 3000);
-  const apiUrl = resolveApiUrl(args, config);
-  const token = resolveToken(args, config);
-  const orgId = resolveOrgId(args, config);
+  const apiUrl = resolveApiUrl(args);
+  const token = resolveToken(args);
+  const orgId = resolveOrgId(args);
 
   if (!projectId || !token) {
     usage();
@@ -305,7 +309,6 @@ async function runConnect(args) {
 }
 
 async function runSetup(args) {
-  const existing = readQualtyConfig();
   const sharedCreds = readSharedCredentials();
   const projectCfg = readProjectConfig();
   const rl = createInterface({
@@ -341,8 +344,10 @@ async function runSetup(args) {
   };
 
   try {
-    const currentOrgId = String(args.org || existing.org_id || projectCfg.default_org_id || "");
-    const currentToken = String(args.token || process.env.QUALTY_API_TOKEN || sharedCreds.api_token || existing.api_token || "");
+    const currentOrgId = String(args.org || projectCfg.default_org_id || "");
+    const currentToken = String(
+      args.token || process.env.QUALTY_API_TOKEN || sharedCreds.api_token || ""
+    );
 
     let token = "";
     if (args.token) {
@@ -438,20 +443,13 @@ async function runSetup(args) {
       throw new Error("Org ID is required. Re-run setup and provide QUALTY_ORG_ID.");
     }
 
-    const next = {
-      org_id: orgId,
-    };
-    // Keep token in the same place MCP uses.
     writeSharedCredentials(token);
-    writeQualtyConfig(next);
-    // Keep org in MCP-compatible per-project config too.
     writeProjectConfig({ default_org_id: orgId });
-    // eslint-disable-next-line no-console
-    console.log(`[qualty] Saved config to ${QUALTY_CONFIG_PATH}`);
+    const projectConfigPath = getProjectConfigWritePath();
     // eslint-disable-next-line no-console
     console.log(`[qualty] Saved shared token to ${QUALTY_SHARED_CREDS_PATH} (used by MCP)`);
     // eslint-disable-next-line no-console
-    console.log(`[qualty] Saved project org to ${QUALTY_PROJECT_CONFIG_PATH} (MCP-compatible)`);
+    console.log(`[qualty] Saved project config to ${projectConfigPath} (MCP-compatible)`);
     // eslint-disable-next-line no-console
     console.log(`[qualty] Org: ${orgName || "configured"}`);
     // eslint-disable-next-line no-console
@@ -524,8 +522,17 @@ function copyToClipboard(text) {
   return false;
 }
 
-function setGithubSecret(name, value) {
-  const result = spawnSync("gh", ["secret", "set", name], { input: value, encoding: "utf8" });
+function ghRepoArgs(repo) {
+  const target = String(repo || "").trim();
+  return target ? ["--repo", target] : [];
+}
+
+function setGithubSecret(name, value, { repo } = {}) {
+  const result = spawnSync(
+    "gh",
+    ["secret", "set", name, ...ghRepoArgs(repo)],
+    { input: value, encoding: "utf8" }
+  );
   if (result.error?.code === "ENOENT") {
     return { ok: false, reason: "GitHub CLI (gh) is not installed." };
   }
@@ -536,6 +543,112 @@ function setGithubSecret(name, value) {
   return { ok: true };
 }
 
+function setGithubVariable(name, value, { repo } = {}) {
+  const result = spawnSync("gh", ["variable", "set", name, "--body", value, ...ghRepoArgs(repo)], {
+    encoding: "utf8",
+  });
+  if (result.error?.code === "ENOENT") {
+    return { ok: false, reason: "GitHub CLI (gh) is not installed." };
+  }
+  if (result.status !== 0) {
+    const detail = String(result.stderr || result.stdout || "").trim();
+    return { ok: false, reason: detail || `gh variable set failed (exit ${result.status})` };
+  }
+  return { ok: true };
+}
+
+/**
+ * Push Qualty CI secrets + repository variables via gh (run from target app repo root).
+ */
+function syncGithubCiConfig({
+  repo,
+  orgId,
+  projectId,
+  profile,
+  authPayload,
+  apiUrl,
+  token,
+  suiteId,
+  cliRepo,
+  cliRef,
+}) {
+  const results = [];
+  const record = (kind, name, outcome) => {
+    results.push({ kind, name, ...outcome });
+  };
+
+  const authResult = setGithubSecret("QUALTY_AUTH_STATE_B64", authPayload, { repo });
+  record("secret", "QUALTY_AUTH_STATE_B64", authResult);
+
+  if (token) {
+    record("secret", "QUALTY_API_TOKEN", setGithubSecret("QUALTY_API_TOKEN", token, { repo }));
+  } else {
+    record("secret", "QUALTY_API_TOKEN", {
+      ok: false,
+      reason: "No token locally — run qualty setup or set QUALTY_API_TOKEN.",
+    });
+  }
+
+  const apiUrlNorm = String(apiUrl || "").replace(/\/$/, "");
+  const isLocalDefault = apiUrlNorm === "http://127.0.0.1:8000";
+  if (apiUrlNorm && !isLocalDefault) {
+    record("secret", "QUALTY_API_URL", setGithubSecret("QUALTY_API_URL", apiUrlNorm, { repo }));
+  } else {
+    record("secret", "QUALTY_API_URL", {
+      ok: false,
+      reason: "Set QUALTY_API_URL to your dev/prod API (not localhost) before export-ci.",
+    });
+  }
+
+  record("variable", "QUALTY_ORG_ID", setGithubVariable("QUALTY_ORG_ID", orgId, { repo }));
+  record("variable", "QUALTY_PROJECT_ID", setGithubVariable("QUALTY_PROJECT_ID", String(projectId), { repo }));
+  record("variable", "QUALTY_AUTH_PROFILE", setGithubVariable("QUALTY_AUTH_PROFILE", profile, { repo }));
+
+  if (suiteId) {
+    record("variable", "QUALTY_SUITE_ID", setGithubVariable("QUALTY_SUITE_ID", String(suiteId), { repo }));
+  }
+
+  if (cliRepo) {
+    record("variable", "QUALTY_CLI_REPO", setGithubVariable("QUALTY_CLI_REPO", cliRepo, { repo }));
+  }
+  if (cliRef) {
+    record("variable", "QUALTY_CLI_REF", setGithubVariable("QUALTY_CLI_REF", cliRef, { repo }));
+  }
+
+  return results;
+}
+
+function printGithubSyncResults(results, { repo }) {
+  const target = repo ? ` (repo ${repo})` : "";
+  const printGroup = (title, rows) => {
+    if (!rows.length) return;
+    // eslint-disable-next-line no-console
+    console.log(title);
+    for (const row of rows) {
+      if (row.ok) {
+        // eslint-disable-next-line no-console
+        console.log(`  ✓ ${row.name}`);
+      } else {
+        // eslint-disable-next-line no-console
+        console.log(`  ✗ ${row.name} — ${row.reason || "failed"}`);
+      }
+    }
+  };
+
+  // eslint-disable-next-line no-console
+  console.log(`GitHub sync${target} (gh secret set + gh variable set):`);
+  printGroup(
+    "  Repository secrets:",
+    results.filter((r) => r.kind === "secret")
+  );
+  printGroup(
+    "  Repository variables:",
+    results.filter((r) => r.kind === "variable")
+  );
+  // eslint-disable-next-line no-console
+  console.log("");
+}
+
 function encodeAuthStateForGithubSecret(statePath, { gzip = false } = {}) {
   const raw = readFileSync(statePath);
   if (gzip) {
@@ -552,14 +665,10 @@ function encodeAuthStateForGithubSecret(statePath, { gzip = false } = {}) {
   };
 }
 
-function githubAuthRestoreShell({ orgId, projectId, profile, encoding }) {
+function githubAuthRestoreShell({ orgId, projectId, profile }) {
   const orgSeg = safePathSegment(orgId, "default-org");
   const projectSeg = safePathSegment(projectId, "default-project");
   const profileSeg = safePathSegment(profile, "default");
-  const decodeCmd =
-    encoding === "gzip+base64"
-      ? 'echo "$QUALTY_AUTH_STATE_B64" | base64 -d | gunzip'
-      : 'echo "$QUALTY_AUTH_STATE_B64" | base64 -d';
   return [
     `- name: Restore Qualty login state`,
     `  env:`,
@@ -567,13 +676,13 @@ function githubAuthRestoreShell({ orgId, projectId, profile, encoding }) {
     `  run: |`,
     `    AUTH_DIR="$HOME/.qualty/local-contexts/${orgSeg}/${projectSeg}"`,
     `    mkdir -p "$AUTH_DIR"`,
-    `    ${decodeCmd} > "$AUTH_DIR/${profileSeg}.json"`,
+    `    echo "$QUALTY_AUTH_STATE_B64" | base64 -d | gunzip > "$AUTH_DIR/${profileSeg}.json"`,
     `    test -s "$AUTH_DIR/${profileSeg}.json"`,
     ``,
     `- name: Run Qualty (local)`,
     `  env:`,
     `    QUALTY_API_TOKEN: \${{ secrets.QUALTY_API_TOKEN }}`,
-    `    QUALTY_ORG_ID: \${{ secrets.QUALTY_ORG_ID }}`,
+    `    QUALTY_ORG_ID: \${{ vars.QUALTY_ORG_ID }}`,
     `  run: |`,
     `    npx qualty@latest run --local \\`,
     `      --project ${projectId} \\`,
@@ -584,12 +693,14 @@ function githubAuthRestoreShell({ orgId, projectId, profile, encoding }) {
 }
 
 async function runAuthExportCi(args) {
-  const config = readQualtyConfig();
-  const orgId = resolveOrgId(args, config);
-  const token = resolveToken(args, config);
+  const orgId = resolveOrgId(args);
+  const token = resolveToken(args);
   const projectCfg = readProjectConfig();
-  const projectId = String(args.project || projectCfg.local_auth_project_id || "").trim();
-  const profile = String(args.profile || args["auth-profile"] || projectCfg.local_auth_profile || "").trim();
+  const projectId = projectIdFromConfig(projectCfg, args.project);
+  const profile = authProfileFromConfig(
+    projectCfg,
+    args.profile || args["auth-profile"]
+  );
 
   if (!orgId) {
     throw new Error("Missing org. Pass --org, set QUALTY_ORG_ID, or add default_org_id to .qualty.json.");
@@ -614,7 +725,10 @@ async function runAuthExportCi(args) {
     );
   }
 
-  let gzip = parseBoolean(args.gzip, false);
+  const setGithubFlag =
+    parseBoolean(args["set-github"], false) || parseBoolean(args["set-secret"], false);
+  // CI path: one format only — gzip then base64 in QUALTY_AUTH_STATE_B64 (no separate gzip flag).
+  let gzip = parseBoolean(args.gzip, false) || setGithubFlag;
   let encoded = encodeAuthStateForGithubSecret(statePath, { gzip });
   let secretBytes = Buffer.byteLength(encoded.payload, "utf8");
   if (!gzip && secretBytes > GITHUB_SECRET_MAX_BYTES - 1024) {
@@ -634,7 +748,12 @@ async function runAuthExportCi(args) {
     ? String(args.output || "").trim()
     : String(args.output || "").trim() || authExportCiOutputPath(statePath);
   const copyToClipboardFlag = parseBoolean(args.copy, false);
-  const setSecretFlag = parseBoolean(args["set-secret"], false);
+  const githubRepo = String(args.repo || "").trim();
+  const suiteId = String(args["suite-id"] || args.suite || "").trim();
+  const cliRepo = String(args["cli-repo"] || "").trim();
+  const cliRef = String(args["cli-ref"] || "").trim();
+  const apiUrl = resolveApiUrl(args);
+
   if (outputPath) {
     writeFileSync(outputPath, encoded.payload, "utf8");
     try {
@@ -646,12 +765,12 @@ async function runAuthExportCi(args) {
 
   const includeToken = parseBoolean(args["include-token"], false);
   const profileSeg = safePathSegment(profile, "default");
-  const skipPayloadPrint = Boolean(outputPath || copyToClipboardFlag || setSecretFlag);
+  const skipPayloadPrint = Boolean(outputPath || copyToClipboardFlag || setGithubFlag);
 
   // eslint-disable-next-line no-console
   console.log("");
   // eslint-disable-next-line no-console
-  console.log("=== Qualty → GitHub Actions secrets ===");
+  console.log("=== Qualty → GitHub Actions (secrets & variables) ===");
   // eslint-disable-next-line no-console
   console.log("");
   if (encoded.encoding === "gzip+base64") {
@@ -671,21 +790,27 @@ async function runAuthExportCi(args) {
     // eslint-disable-next-line no-console
     console.log("");
   }
-  if (setSecretFlag) {
-    const result = setGithubSecret("QUALTY_AUTH_STATE_B64", encoded.payload);
-    if (result.ok) {
+  if (setGithubFlag) {
+    const syncResults = syncGithubCiConfig({
+      repo: githubRepo,
+      orgId,
+      projectId,
+      profile,
+      authPayload: encoded.payload,
+      apiUrl,
+      token,
+      suiteId,
+      cliRepo,
+      cliRef,
+    });
+    printGithubSyncResults(syncResults, { repo: githubRepo });
+    const authRow = syncResults.find((r) => r.name === "QUALTY_AUTH_STATE_B64");
+    if (!authRow?.ok && outputPath) {
       // eslint-disable-next-line no-console
-      console.log("✓ Set GitHub secret QUALTY_AUTH_STATE_B64 via gh CLI.");
-    } else {
+      console.log(`  Manual auth secret: gh secret set QUALTY_AUTH_STATE_B64 < ${outputPath}`);
       // eslint-disable-next-line no-console
-      console.log(`Could not set QUALTY_AUTH_STATE_B64 automatically: ${result.reason}`);
-      if (outputPath) {
-        // eslint-disable-next-line no-console
-        console.log(`  gh secret set QUALTY_AUTH_STATE_B64 < ${outputPath}`);
-      }
+      console.log("");
     }
-    // eslint-disable-next-line no-console
-    console.log("");
   }
   if (copyToClipboardFlag) {
     if (copyToClipboard(encoded.payload)) {
@@ -702,61 +827,124 @@ async function runAuthExportCi(args) {
     // eslint-disable-next-line no-console
     console.log("");
   }
-  // eslint-disable-next-line no-console
-  console.log("1. Add these GitHub secrets (Settings → Secrets and variables → Actions):");
-  // eslint-disable-next-line no-console
-  console.log("");
-  // eslint-disable-next-line no-console
-  console.log("---");
-  // eslint-disable-next-line no-console
-  console.log("Name:  QUALTY_ORG_ID");
-  // eslint-disable-next-line no-console
-  console.log("Value:");
-  // eslint-disable-next-line no-console
-  console.log(orgId);
-  // eslint-disable-next-line no-console
-  console.log("---");
-  // eslint-disable-next-line no-console
-  console.log("Name:  QUALTY_API_TOKEN");
-  // eslint-disable-next-line no-console
-  console.log("Value:");
-  if (includeToken && token) {
+  if (setGithubFlag) {
+    // eslint-disable-next-line no-console
+    console.log(
+      "1. GitHub Actions config was pushed via gh (secrets + repository variables — see sync above). Fix any ✗ manually."
+    );
+    if (!suiteId) {
+      // eslint-disable-next-line no-console
+      console.log(
+        "   Tip: re-run with --suite-id <uuid> to set QUALTY_SUITE_ID (or set it in the GitHub UI)."
+      );
+    }
+    // eslint-disable-next-line no-console
+    console.log("");
+  } else {
+    // eslint-disable-next-line no-console
+    console.log(
+      "1. Add repository variables (or re-run with --set-github from this repo's git root):"
+    );
     // eslint-disable-next-line no-console
-    console.log(token);
-  } else if (token) {
+    console.log("");
     // eslint-disable-next-line no-console
-    console.log(`(your qlty_ci_ token — already configured locally as ${maskSecret(token)})`);
+    console.log("---");
     // eslint-disable-next-line no-console
-    console.log("Paste the full token from Qualty → Account → API tokens.");
+    console.log("Name:  QUALTY_ORG_ID");
     // eslint-disable-next-line no-console
-    console.log("Re-run with --include-token to print the token from this machine (avoid shared screens).");
-  } else {
+    console.log("Value:");
+    // eslint-disable-next-line no-console
+    console.log(orgId);
+    // eslint-disable-next-line no-console
+    console.log(`  gh variable set QUALTY_ORG_ID --body "${orgId}"`);
+    // eslint-disable-next-line no-console
+    console.log("---");
+    // eslint-disable-next-line no-console
+    console.log("Name:  QUALTY_PROJECT_ID");
+    // eslint-disable-next-line no-console
+    console.log("Value:");
+    // eslint-disable-next-line no-console
+    console.log(projectId);
+    // eslint-disable-next-line no-console
+    console.log(`  gh variable set QUALTY_PROJECT_ID --body "${projectId}"`);
+    // eslint-disable-next-line no-console
+    console.log("---");
+    // eslint-disable-next-line no-console
+    console.log("Name:  QUALTY_AUTH_PROFILE");
+    // eslint-disable-next-line no-console
+    console.log("Value:");
+    // eslint-disable-next-line no-console
+    console.log(profile);
+    // eslint-disable-next-line no-console
+    console.log(`  gh variable set QUALTY_AUTH_PROFILE --body "${profile}"`);
     // eslint-disable-next-line no-console
-    console.log("(create in Qualty → Account → API tokens; must start with qlty_ci_)");
+    console.log("---");
+    // eslint-disable-next-line no-console
+    console.log("Name:  QUALTY_SUITE_ID");
+    // eslint-disable-next-line no-console
+    console.log("Value:");
+    // eslint-disable-next-line no-console
+    console.log(suiteId || "(suite UUID from Qualty dashboard — pass --suite-id)");
+    if (suiteId) {
+      // eslint-disable-next-line no-console
+      console.log(`  gh variable set QUALTY_SUITE_ID --body "${suiteId}"`);
+    }
+    // eslint-disable-next-line no-console
+    console.log("");
+    // eslint-disable-next-line no-console
+    console.log("2. Add these GitHub secrets:");
   }
-  // eslint-disable-next-line no-console
-  console.log("---");
-  // eslint-disable-next-line no-console
-  console.log("Name:  QUALTY_AUTH_STATE_B64");
-  if (skipPayloadPrint) {
+  if (!setGithubFlag) {
     // eslint-disable-next-line no-console
-    console.log(`Value: (see file above${copyToClipboardFlag ? " or clipboard" : ""}${setSecretFlag ? " or gh secret" : ""})`);
-  } else {
+    console.log("");
+    // eslint-disable-next-line no-console
+    console.log("---");
+    // eslint-disable-next-line no-console
+    console.log("Name:  QUALTY_API_TOKEN");
     // eslint-disable-next-line no-console
     console.log("Value:");
+    if (includeToken && token) {
+      // eslint-disable-next-line no-console
+      console.log(token);
+    } else if (token) {
+      // eslint-disable-next-line no-console
+      console.log(`(your qlty_ci_ token — already configured locally as ${maskSecret(token)})`);
+      // eslint-disable-next-line no-console
+      console.log("Paste the full token from Qualty → Account → API tokens.");
+      // eslint-disable-next-line no-console
+      console.log("Re-run with --set-github to push via gh (or --include-token to print).");
+    } else {
+      // eslint-disable-next-line no-console
+      console.log("(create in Qualty → Account → API tokens; must start with qlty_ci_)");
+    }
+    // eslint-disable-next-line no-console
+    console.log("---");
+    // eslint-disable-next-line no-console
+    console.log("Name:  QUALTY_AUTH_STATE_B64");
+    if (skipPayloadPrint) {
+      // eslint-disable-next-line no-console
+      console.log(
+        `Value: (see file above${copyToClipboardFlag ? " or clipboard" : ""})`
+      );
+    } else {
+      // eslint-disable-next-line no-console
+      console.log("Value:");
+      // eslint-disable-next-line no-console
+      console.log(encoded.payload);
+    }
+    // eslint-disable-next-line no-console
+    console.log("---");
     // eslint-disable-next-line no-console
-    console.log(encoded.payload);
+    console.log("");
   }
+
+  const stepLabel = setGithubFlag ? "2" : "3";
   // eslint-disable-next-line no-console
-  console.log("---");
-  // eslint-disable-next-line no-console
-  console.log("");
-  // eslint-disable-next-line no-console
-  console.log("3. Paste this workflow snippet before qualty run:");
+  console.log(`${stepLabel}. Workflow snippet (see templates/github-actions/qualty-local-pr.yml):`);
   // eslint-disable-next-line no-console
   console.log("");
   // eslint-disable-next-line no-console
-  console.log(githubAuthRestoreShell({ orgId, projectId, profile, encoding: encoded.encoding }));
+  console.log(githubAuthRestoreShell({ orgId, projectId, profile }));
   // eslint-disable-next-line no-console
   console.log("");
   // eslint-disable-next-line no-console
@@ -1113,10 +1301,9 @@ function printQualtyViewLogsReport(executionId, status) {
 }
 
 async function runCi(args) {
-  const config = readQualtyConfig();
-  const apiUrl = resolveApiUrl(args, config);
-  const token = resolveToken(args, config);
-  const orgId = resolveOrgId(args, config);
+  const apiUrl = resolveApiUrl(args);
+  const token = resolveToken(args);
+  const orgId = resolveOrgId(args);
   const projectId = args.project;
   const suiteId = args["suite-id"];
   const explicitIds = String(args.ids || "")
@@ -1460,10 +1647,9 @@ async function runLocalSuiteWithSequences({
 }
 
 async function runResolve(args) {
-  const config = readQualtyConfig();
-  const apiUrl = resolveApiUrl(args, config);
-  const token = resolveToken(args, config);
-  const orgId = resolveOrgId(args, config);
+  const apiUrl = resolveApiUrl(args);
+  const token = resolveToken(args);
+  const orgId = resolveOrgId(args);
   const projectId = args.project;
   const suiteId = args["suite-id"];
   const explicitIds = String(args.ids || "")
@@ -1626,8 +1812,8 @@ async function maybePromptProjectIdForLocalRun({ args, apiUrl, token, orgId }) {
 
 function resolveLocalAuthStateForRun({ args, orgId, projectId }) {
   if (parseBoolean(args["no-auth-state"], false)) return null;
-  const requestedProfile = String(args["auth-profile"] || "").trim();
-  const profile = requestedProfile;
+  const projectCfg = readProjectConfig();
+  const profile = authProfileFromConfig(projectCfg, args["auth-profile"]);
   if (!profile) return null;
   const path = localAuthStatePath({ orgId, projectId, profile });
   const summary = summarizeStorageStateFile(path);
@@ -1640,17 +1826,21 @@ function resolveLocalAuthStateForRun({ args, orgId, projectId }) {
 }
 
 async function maybePromptAuthProfileForLocalRun({ args, orgId, projectId }) {
-  const requestedProfile = String(args["auth-profile"] || "").trim();
+  const projectCfg = readProjectConfig();
+  const requestedProfile = authProfileFromConfig(projectCfg, args["auth-profile"]);
   if (requestedProfile) return { authProfile: requestedProfile, noAuthState: false };
   if (parseBoolean(args["no-auth-state"], false)) return { authProfile: "", noAuthState: true };
-  if (!process.stdin.isTTY || !process.stdout.isTTY) return { authProfile: "", noAuthState: false };
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    const defaultProfile = authProfileFromConfig(projectCfg);
+    if (defaultProfile) return { authProfile: defaultProfile, noAuthState: false };
+    return { authProfile: "", noAuthState: false };
+  }
   if (!projectId) return { authProfile: "", noAuthState: false };
 
   const profiles = listLocalAuthProfiles({ orgId, projectId });
   if (profiles.length === 0) return { authProfile: "", noAuthState: false };
 
-  const projectCfg = readProjectConfig();
-  const defaultProfile = String(projectCfg.local_auth_profile || "").trim();
+  const defaultProfile = authProfileFromConfig(projectCfg);
   const defaultIndex = profiles.findIndex((p) => p === defaultProfile);
 
   // eslint-disable-next-line no-console
@@ -1692,10 +1882,9 @@ async function maybePromptAuthProfileForLocalRun({ args, orgId, projectId }) {
 }
 
 async function runAuthSetup(args) {
-  const config = readQualtyConfig();
-  const apiUrl = resolveApiUrl(args, config);
-  const token = resolveToken(args, config);
-  const orgId = resolveOrgId(args, config);
+  const apiUrl = resolveApiUrl(args);
+  const token = resolveToken(args);
+  const orgId = resolveOrgId(args);
   if (!token) {
     throw new Error("Missing auth token. Run `qualty setup` first.");
   }
@@ -1849,9 +2038,9 @@ async function runAuthSetup(args) {
     await browser.close();
 
     writeProjectConfig({
-      local_auth_project_id: project.id,
-      local_auth_profile: profile,
       default_org_id: orgId,
+      default_project_id: project.id,
+      default_auth_profile: profile,
     });
     try {
       const synced = await registerLocalLoginProfileBinding({
@@ -1914,11 +2103,10 @@ async function main() {
     throw new Error("Unknown auth subcommand. Use: qualty auth setup | qualty auth export-ci");
   }
   if (command === "run") {
-    const config = readQualtyConfig();
     if (parseBoolean(args.local, false)) {
-      const apiUrl = resolveApiUrl(args, config);
-      const token = resolveToken(args, config);
-      const orgId = resolveOrgId(args, config);
+      const apiUrl = resolveApiUrl(args);
+      const token = resolveToken(args);
+      const orgId = resolveOrgId(args);
       const projectId =
         (await maybePromptProjectIdForLocalRun({
           args,

package/bin/test-pw.mjs

@@ -0,0 +1,4 @@
+const { chromium } = await import("playwright");
+const s = await chromium.launchServer({ headless: true, host: "127.0.0.1" });
+console.log("launchServer OK");
+await s.close();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qualty",
-  "version": "0.1.20",
+  "version": "0.1.21",
   "description": "Qualty CLI for localhost and CI test runs",
   "bin": {
     "qualty": "bin/qualty.js"