qualty 0.1.21 → 0.1.22

package/bin/qualty.js

@@ -17,9 +17,8 @@ import { createInterface } from "node:readline/promises";
 import process from "node:process";
 import { rewriteUrlForLocalRun, runLocalCi, summarizeStorageStateFile, logAuthStateDiagnostics } from "./local-runner.js";
 
-/** Default Qualty API base URL (no trailing slash). Override with QUALTY_API_URL env. */
-//const DEFAULT_QUALTY_API_URL = "https://qualty-api-production.up.railway.app";
-const DEFAULT_QUALTY_API_URL = "http://127.0.0.1:8000";
+/** CLI backend URL is fixed by Qualty distribution. */
+const DEFAULT_QUALTY_API_URL = "https://qualty-api-production.up.railway.app";
 
 const PROJECT_CONFIG_FILENAME = ".qualty.json";
 const QUALTY_SHARED_CREDS_DIR = join(homedir(), ".qualty");
@@ -66,6 +65,10 @@ function projectIdFromConfig(projectCfg, fallback = "") {
   return String(fallback || projectCfg.default_project_id || "").trim();
 }
 
+function orgIdFromConfig(projectCfg, fallback = "") {
+  return String(fallback || projectCfg.default_org_id || "").trim();
+}
+
 function authProfileFromConfig(projectCfg, fallback = "") {
   return String(fallback || projectCfg.default_auth_profile || "").trim();
 }
@@ -94,9 +97,39 @@ function writeProjectConfig(updates) {
   writeFileSync(configPath, `${JSON.stringify(next, null, 2)}\n`, "utf8");
 }
 
+function normalizeApiUrl(raw, { label = "API URL" } = {}) {
+  const trimmed = String(raw || "").trim();
+  if (!trimmed) {
+    throw new Error(`${label} is empty.`);
+  }
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new Error(`${label} is not a valid URL: ${trimmed}`);
+  }
+  if (!["http:", "https:"].includes(parsed.protocol)) {
+    throw new Error(`${label} must use http or https (got ${parsed.protocol}).`);
+  }
+  return trimmed.replace(/\/$/, "");
+}
+
+function qualtyBaseUrlFromEnv() {
+  return String(process.env.QUALTY_BASE_URL || process.env.QUALTY_API_URL || "").trim();
+}
+
 function resolveApiUrl(args = {}) {
-  void args;
-  return String(process.env.QUALTY_API_URL || DEFAULT_QUALTY_API_URL).replace(/\/$/, "");
+  const fromFlag = String(args.url || args["api-url"] || "").trim();
+  const fromEnv = qualtyBaseUrlFromEnv();
+  const raw = fromFlag || fromEnv || DEFAULT_QUALTY_API_URL;
+  const label = fromFlag
+    ? "--url"
+    : process.env.QUALTY_BASE_URL
+      ? "QUALTY_BASE_URL"
+      : fromEnv
+        ? "QUALTY_API_URL"
+        : "default API URL";
+  return normalizeApiUrl(raw, { label });
 }
 
 function resolveToken(args = {}) {
@@ -106,7 +139,7 @@ function resolveToken(args = {}) {
 
 function resolveOrgId(args = {}) {
   const projectCfg = readProjectConfig();
-  return args.org || process.env.QUALTY_ORG_ID || projectCfg.default_org_id || "";
+  return orgIdFromConfig(projectCfg, args.org);
 }
 
 function maskSecret(secret) {
@@ -145,8 +178,8 @@ function usage() {
       "Usage:",
       "  qualty setup [--token <bearer-token>] [--org <org-id>]",
       "  qualty auth setup [--project <project-id>] [--profile <profile-name>] [--headed]",
-      "  qualty auth export-ci --project <project-id> [--profile <profile-name>] [--org <org-id>]",
-      "                   [--suite-id <suite-uuid>] [--repo <owner/repo>]",
+      "  qualty auth export-ci [--project <project-id>] [--profile <profile-name>] [--org <org-id>]",
+      "                   [--url <api-base-url>] [--suite-id <suite-uuid>] [--repo <owner/repo>]",
       "                   [--output <path>] [--no-file] [--copy] [--gzip] [--include-token]",
       "                   [--set-secret | --set-github]  gh: secrets (token, API URL, auth) + variables (org, project, profile, …)",
       "                   [--cli-repo <owner/repo>] [--cli-ref <branch>]  Optional CI variables",
@@ -161,9 +194,11 @@ function usage() {
       "",
       "Env vars:",
       "  QUALTY_API_TOKEN  Bearer token used for auth",
-      "  QUALTY_API_URL    API base URL (default: bundled CLI default)",
-      "  QUALTY_ORG_ID     Org context override (default: .qualty.json default_org_id)",
+      "  QUALTY_BASE_URL   API base URL when --url is not set (default: production)",
       "  QUALTY_LOCAL_CONCURRENCY  Local parallel workers for --local runs (default: 4)",
+      "",
+      "Config (.qualty.json): default_org_id, default_project_id, default_auth_profile",
+      "  CLI flags (--org, --project, --profile, --url) override config values.",
     ].join("\n")
   );
 }
@@ -371,7 +406,7 @@ async function runSetup(args) {
     let currentOrgName = "";
     try {
       const orgResp = await apiRequest({
-        apiUrl: resolveApiUrl({}, {}),
+        apiUrl: resolveApiUrl({}),
         token,
         orgId: "",
         path: "/api/v1/orgs",
@@ -440,7 +475,7 @@ async function runSetup(args) {
     }
 
     if (!orgId) {
-      throw new Error("Org ID is required. Re-run setup and provide QUALTY_ORG_ID.");
+      throw new Error("Org ID is required. Re-run setup and enter your org ID when prompted.");
     }
 
     writeSharedCredentials(token);
@@ -590,14 +625,8 @@ function syncGithubCiConfig({
   }
 
   const apiUrlNorm = String(apiUrl || "").replace(/\/$/, "");
-  const isLocalDefault = apiUrlNorm === "http://127.0.0.1:8000";
-  if (apiUrlNorm && !isLocalDefault) {
-    record("secret", "QUALTY_API_URL", setGithubSecret("QUALTY_API_URL", apiUrlNorm, { repo }));
-  } else {
-    record("secret", "QUALTY_API_URL", {
-      ok: false,
-      reason: "Set QUALTY_API_URL to your dev/prod API (not localhost) before export-ci.",
-    });
+  if (apiUrlNorm) {
+    record("secret", "QUALTY_BASE_URL", setGithubSecret("QUALTY_BASE_URL", apiUrlNorm, { repo }));
   }
 
   record("variable", "QUALTY_ORG_ID", setGithubVariable("QUALTY_ORG_ID", orgId, { repo }));
@@ -649,6 +678,134 @@ function printGithubSyncResults(results, { repo }) {
   console.log("");
 }
 
+function readProjectConfigStrict() {
+  const configPath = findProjectConfigPath();
+  if (!configPath) {
+    return { configPath: null, config: {} };
+  }
+  let raw;
+  try {
+    raw = readFileSync(configPath, "utf8");
+  } catch (err) {
+    throw new Error(
+      `Could not read ${PROJECT_CONFIG_FILENAME} at ${configPath}: ${err.message}`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      [
+        `Invalid ${PROJECT_CONFIG_FILENAME} at ${configPath}: ${err.message}`,
+        "Fix the JSON syntax or pass --org, --project, and --profile on the command line.",
+      ].join("\n")
+    );
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(
+      [
+        `Invalid ${PROJECT_CONFIG_FILENAME} at ${configPath}: expected a JSON object.`,
+        "Fix the file or pass --org, --project, and --profile on the command line.",
+      ].join("\n")
+    );
+  }
+  return { configPath, config: parsed };
+}
+
+function configStringValue(projectCfg, key, configPath) {
+  const value = projectCfg[key];
+  if (value === undefined || value === null || value === "") return "";
+  if (typeof value === "string" || typeof value === "number") {
+    return String(value).trim();
+  }
+  const where = configPath
+    ? `${PROJECT_CONFIG_FILENAME} at ${configPath}`
+    : PROJECT_CONFIG_FILENAME;
+  throw new Error(
+    `Invalid ${key} in ${where}: expected a string or number, got ${typeof value}.`
+  );
+}
+
+function missingExportCiField(fieldLabel, { flag, configKey, configPath, hasFlag }) {
+  const configHint = configPath
+    ? `${PROJECT_CONFIG_FILENAME} at ${configPath} (${configKey})`
+    : `${PROJECT_CONFIG_FILENAME} (not found walking up from ${process.cwd()})`;
+  if (hasFlag) {
+    return [
+      `Missing ${fieldLabel}: ${flag} was empty.`,
+      `Set ${configKey} in ${configHint} or pass a non-empty ${flag}.`,
+    ].join(" ");
+  }
+  return [
+    `Missing ${fieldLabel}.`,
+    `Pass ${flag} or set ${configKey} in ${configHint}.`,
+  ].join(" ");
+}
+
+function resolveExportCiConfig(args) {
+  const { configPath, config: projectCfg } = readProjectConfigStrict();
+
+  const orgFromFlag = String(args.org || "").trim();
+  const projectFromFlag = String(args.project || "").trim();
+  const profileFromFlag = String(args.profile || args["auth-profile"] || "").trim();
+
+  let orgId = orgFromFlag;
+  if (!orgId) {
+    orgId = configStringValue(projectCfg, "default_org_id", configPath);
+  }
+
+  let projectId = projectFromFlag;
+  if (!projectId) {
+    projectId = configStringValue(projectCfg, "default_project_id", configPath);
+  }
+
+  let profile = profileFromFlag;
+  if (!profile) {
+    profile = configStringValue(projectCfg, "default_auth_profile", configPath);
+  }
+
+  if (!orgId) {
+    throw new Error(
+      missingExportCiField("org ID", {
+        flag: "--org",
+        configKey: "default_org_id",
+        configPath,
+        hasFlag: Boolean(orgFromFlag),
+      })
+    );
+  }
+  if (!projectId) {
+    throw new Error(
+      missingExportCiField("project ID", {
+        flag: "--project",
+        configKey: "default_project_id",
+        configPath,
+        hasFlag: Boolean(projectFromFlag),
+      })
+    );
+  }
+  if (!profile) {
+    throw new Error(
+      missingExportCiField("auth profile", {
+        flag: "--profile",
+        configKey: "default_auth_profile",
+        configPath,
+        hasFlag: Boolean(profileFromFlag),
+      })
+    );
+  }
+
+  let apiUrl;
+  try {
+    apiUrl = resolveApiUrl(args);
+  } catch (err) {
+    throw new Error(`Invalid API URL: ${err.message}`);
+  }
+
+  return { orgId, projectId, profile, apiUrl, configPath };
+}
+
 function encodeAuthStateForGithubSecret(statePath, { gzip = false } = {}) {
   const raw = readFileSync(statePath);
   if (gzip) {
@@ -666,62 +823,55 @@ function encodeAuthStateForGithubSecret(statePath, { gzip = false } = {}) {
 }
 
 function githubAuthRestoreShell({ orgId, projectId, profile }) {
-  const orgSeg = safePathSegment(orgId, "default-org");
-  const projectSeg = safePathSegment(projectId, "default-project");
-  const profileSeg = safePathSegment(profile, "default");
   return [
     `- name: Restore Qualty login state`,
     `  env:`,
     `    QUALTY_AUTH_STATE_B64: \${{ secrets.QUALTY_AUTH_STATE_B64 }}`,
     `  run: |`,
-    `    AUTH_DIR="$HOME/.qualty/local-contexts/${orgSeg}/${projectSeg}"`,
-    `    mkdir -p "$AUTH_DIR"`,
-    `    echo "$QUALTY_AUTH_STATE_B64" | base64 -d | gunzip > "$AUTH_DIR/${profileSeg}.json"`,
-    `    test -s "$AUTH_DIR/${profileSeg}.json"`,
+    `    set -euo pipefail`,
+    `    slug_segment() {`,
+    `      printf '%s' "$1" | sed -E 's/^[[:space:]]+|[[:space:]]+$//g; s/[^a-zA-Z0-9._-]+/_/g; s/^_+|_+$//g'`,
+    `    }`,
+    `    org_seg=$(slug_segment "$QUALTY_ORG_ID"); [ -n "$org_seg" ] || org_seg="default-org"`,
+    `    project_seg=$(slug_segment "$QUALTY_PROJECT_ID"); [ -n "$project_seg" ] || project_seg="default-project"`,
+    `    profile_seg=$(slug_segment "$QUALTY_AUTH_PROFILE"); [ -n "$profile_seg" ] || profile_seg="default"`,
+    `    auth_dir="$HOME/.qualty/local-contexts/\${org_seg}/\${project_seg}"`,
+    `    auth_file="\${auth_dir}/\${profile_seg}.json"`,
+    `    mkdir -p "$auth_dir"`,
+    `    echo "$QUALTY_AUTH_STATE_B64" | base64 -d | gunzip > "$auth_file"`,
+    `    test -s "$auth_file"`,
     ``,
-    `- name: Run Qualty (local)`,
+    `- name: Run Qualty tests (local)`,
     `  env:`,
     `    QUALTY_API_TOKEN: \${{ secrets.QUALTY_API_TOKEN }}`,
-    `    QUALTY_ORG_ID: \${{ vars.QUALTY_ORG_ID }}`,
+    `    QUALTY_BASE_URL: \${{ secrets.QUALTY_BASE_URL }}`,
     `  run: |`,
-    `    npx qualty@latest run --local \\`,
-    `      --project ${projectId} \\`,
-    `      --suite-id YOUR_SUITE_UUID \\`,
-    `      --auth-profile "${profile}" \\`,
+    `    npx --yes qualty run --local \\`,
+    `      --org "$QUALTY_ORG_ID" \\`,
+    `      --project "$QUALTY_PROJECT_ID" \\`,
+    `      --suite-id "YOUR-SUITE-UUID" \\`,
+    `      --auth-profile "$QUALTY_AUTH_PROFILE" \\`,
     `      --fail-on-failure true`,
   ].join("\n");
 }
 
 async function runAuthExportCi(args) {
-  const orgId = resolveOrgId(args);
+  const { orgId, projectId, profile, apiUrl, configPath } = resolveExportCiConfig(args);
   const token = resolveToken(args);
-  const projectCfg = readProjectConfig();
-  const projectId = projectIdFromConfig(projectCfg, args.project);
-  const profile = authProfileFromConfig(
-    projectCfg,
-    args.profile || args["auth-profile"]
-  );
-
-  if (!orgId) {
-    throw new Error("Missing org. Pass --org, set QUALTY_ORG_ID, or add default_org_id to .qualty.json.");
-  }
-  if (!projectId) {
-    throw new Error("Missing project. Pass --project (or run qualty auth setup first).");
-  }
-  if (!profile) {
-    throw new Error('Missing profile. Pass --profile "your-profile" (or run qualty auth setup first).');
-  }
 
   const statePath = localAuthStatePath({ orgId, projectId, profile });
   if (!existsSync(statePath)) {
     throw new Error(
       [
-        `Local auth state not found:`,
+        "Local auth state not found:",
         `  ${statePath}`,
         "",
         "Create it first:",
         `  qualty auth setup --project ${projectId} --profile "${profile}"`,
-      ].join("\n")
+        configPath ? `  (org/project/profile from ${configPath})` : "",
+      ]
+        .filter(Boolean)
+        .join("\n")
     );
   }
 
@@ -729,11 +879,24 @@ async function runAuthExportCi(args) {
     parseBoolean(args["set-github"], false) || parseBoolean(args["set-secret"], false);
   // CI path: one format only — gzip then base64 in QUALTY_AUTH_STATE_B64 (no separate gzip flag).
   let gzip = parseBoolean(args.gzip, false) || setGithubFlag;
-  let encoded = encodeAuthStateForGithubSecret(statePath, { gzip });
+  let encoded;
+  try {
+    encoded = encodeAuthStateForGithubSecret(statePath, { gzip });
+  } catch (err) {
+    throw new Error(
+      `Could not read auth state at ${statePath}: ${err.message}`
+    );
+  }
   let secretBytes = Buffer.byteLength(encoded.payload, "utf8");
   if (!gzip && secretBytes > GITHUB_SECRET_MAX_BYTES - 1024) {
     gzip = true;
-    encoded = encodeAuthStateForGithubSecret(statePath, { gzip: true });
+    try {
+      encoded = encodeAuthStateForGithubSecret(statePath, { gzip: true });
+    } catch (err) {
+      throw new Error(
+        `Could not gzip auth state at ${statePath}: ${err.message}`
+      );
+    }
     secretBytes = Buffer.byteLength(encoded.payload, "utf8");
   }
   if (secretBytes > GITHUB_SECRET_MAX_BYTES - 1024) {
@@ -752,7 +915,6 @@ async function runAuthExportCi(args) {
   const suiteId = String(args["suite-id"] || args.suite || "").trim();
   const cliRepo = String(args["cli-repo"] || "").trim();
   const cliRef = String(args["cli-ref"] || "").trim();
-  const apiUrl = resolveApiUrl(args);
 
   if (outputPath) {
     writeFileSync(outputPath, encoded.payload, "utf8");
@@ -835,7 +997,7 @@ async function runAuthExportCi(args) {
     if (!suiteId) {
       // eslint-disable-next-line no-console
       console.log(
-        "   Tip: re-run with --suite-id <uuid> to set QUALTY_SUITE_ID (or set it in the GitHub UI)."
+        "   Tip: hardcode --suite-id or --ids in your workflow (see templates/github-actions/qualty-local-pr.yml)."
       );
     }
     // eslint-disable-next-line no-console

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qualty",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "Qualty CLI for localhost and CI test runs",
   "bin": {
     "qualty": "bin/qualty.js"