qualty 0.1.26 → 0.1.29

package/bin/local-runner.js

@@ -1374,8 +1374,9 @@ async function runLocalSingleCombination({
     explicitAuthProfile: String(authProfile || "").trim(),
     noAuthState: Boolean(noAuthState),
   });
+  const explicitAuthProfile = String(authProfile || "").trim();
   const claimProfile = localProfileLabel(claimSavedLogin);
-  const effectiveProfile = String(authProfile || "").trim() || setupFromClaim?.profile || claimProfile;
+  const effectiveProfile = explicitAuthProfile || setupFromClaim?.profile || claimProfile;
   const resolvedStoragePath =
     !noAuthState && effectiveProfile
       ? localAuthStatePath({
@@ -1387,17 +1388,20 @@ async function runLocalSingleCombination({
   const finalStoragePath =
     !noAuthState && setupFromClaim?.path && existsSync(setupFromClaim.path)
       ? setupFromClaim.path
-      : !noAuthState && storageStatePath && existsSync(storageStatePath)
-      ? storageStatePath
-      : !noAuthState && resolvedStoragePath && existsSync(resolvedStoragePath)
-        ? resolvedStoragePath
-        : null;
+      : !noAuthState &&
+          explicitAuthProfile &&
+          storageStatePath &&
+          existsSync(storageStatePath)
+        ? storageStatePath
+        : !noAuthState && resolvedStoragePath && existsSync(resolvedStoragePath)
+          ? resolvedStoragePath
+          : null;
 
   let authSource = "none";
   if (!noAuthState && finalStoragePath) {
     if (setupFromClaim?.path && finalStoragePath === setupFromClaim.path) {
       authSource = "interactive setup during run";
-    } else if (storageStatePath && finalStoragePath === storageStatePath) {
+    } else if (explicitAuthProfile && storageStatePath && finalStoragePath === storageStatePath) {
       authSource = "--auth-profile flag";
     } else if (resolvedStoragePath && finalStoragePath === resolvedStoragePath) {
       authSource = claimProfile ? "dashboard saved login profile" : "resolved profile path";

package/bin/qualty.js

@@ -30,6 +30,7 @@ import {
 const DEFAULT_QUALTY_API_URL = "https://qualty-api-production.up.railway.app";
 
 const PROJECT_CONFIG_FILENAME = ".qualty.json";
+const DOTENV_FILENAME = ".env";
 const QUALTY_SHARED_CREDS_DIR = join(homedir(), ".qualty");
 const QUALTY_SHARED_CREDS_PATH = join(QUALTY_SHARED_CREDS_DIR, "credentials");
 
@@ -48,6 +49,47 @@ function getProjectConfigWritePath() {
   return findProjectConfigPath() || join(process.cwd(), PROJECT_CONFIG_FILENAME);
 }
 
+function findProjectDotenvPath() {
+  let current = process.cwd();
+  for (;;) {
+    const candidate = join(current, DOTENV_FILENAME);
+    if (existsSync(candidate)) return candidate;
+    const parent = dirname(current);
+    if (parent === current) return null;
+    current = parent;
+  }
+}
+
+function parseDotenvText(text) {
+  const out = {};
+  for (const raw of String(text || "").split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#") || !line.includes("=")) continue;
+    const eq = line.indexOf("=");
+    const key = line.slice(0, eq).trim();
+    let value = line.slice(eq + 1).trim();
+    if (
+      (value.startsWith('"') && value.endsWith('"'))
+      || (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1);
+    }
+    if (key) out[key] = value;
+  }
+  return out;
+}
+
+/** Project .env walked up from cwd (same resolution as Qualty MCP). */
+function loadProjectDotenv() {
+  const path = findProjectDotenvPath();
+  if (!path) return {};
+  try {
+    return parseDotenvText(readFileSync(path, "utf8"));
+  } catch {
+    return {};
+  }
+}
+
 function readSharedCredentials() {
   if (!existsSync(QUALTY_SHARED_CREDS_PATH)) return {};
   try {
@@ -82,6 +124,11 @@ function authProfileFromConfig(projectCfg, fallback = "") {
   return String(fallback || projectCfg.default_auth_profile || "").trim();
 }
 
+/** Only --auth-profile on the CLI; config default is not a run-wide override. */
+function explicitAuthProfileFromArgs(args) {
+  return String(args["auth-profile"] || "").trim();
+}
+
 function readProjectConfig() {
   const configPath = findProjectConfigPath();
   if (!configPath) return {};
@@ -124,7 +171,14 @@ function normalizeApiUrl(raw, { label = "API URL" } = {}) {
 }
 
 function qualtyBaseUrlFromEnv() {
-  return String(process.env.QUALTY_BASE_URL || process.env.QUALTY_API_URL || "").trim();
+  const dotenv = loadProjectDotenv();
+  return String(
+    dotenv.QUALTY_BASE_URL
+      || dotenv.QUALTY_API_URL
+      || process.env.QUALTY_BASE_URL
+      || process.env.QUALTY_API_URL
+      || ""
+  ).trim();
 }
 
 function resolveApiUrl(args = {}) {
@@ -142,8 +196,14 @@ function resolveApiUrl(args = {}) {
 }
 
 function resolveToken(args = {}) {
+  if (args.token) return String(args.token).trim();
+  const dotenv = loadProjectDotenv();
+  const fromDotenv = String(dotenv.QUALTY_API_TOKEN || "").trim();
+  if (fromDotenv) return fromDotenv;
+  const fromProcessEnv = String(process.env.QUALTY_API_TOKEN || "").trim();
+  if (fromProcessEnv) return fromProcessEnv;
   const creds = readSharedCredentials();
-  return args.token || process.env.QUALTY_API_TOKEN || creds.api_token || "";
+  return String(creds.api_token || "").trim();
 }
 
 function resolveOrgId(args = {}) {
@@ -187,6 +247,10 @@ function usage() {
       "Usage:",
       "  qualty setup [--token <bearer-token>] [--org <org-id>]",
       "  qualty auth setup [--project <project-id>] [--profile <profile-name>] [--headed]",
+      "  qualty auth export [--project <project-id>] [--profile <profile-name>] [--org <org-id>]",
+      "               [--profiles <name1,name2>] [--repo <owner/repo>]",
+      "               [--output <path>] [--no-file] [--copy] [--set-secret | --set-github]",
+      "               Push login profile state to GitHub only (not API token, org, or project vars).",
       "  qualty ci setup [--project <project-id>] [--profile <profile-name>] [--org <org-id>]",
       "               [--all-profiles] [--profiles <name1,name2>]",
       "               [--suite-id <suite-uuid>] [--ids <id1,id2>]  bundle login profiles required by tests",
@@ -206,11 +270,11 @@ function usage() {
       "  qualty resolve --project <project-id> [--suite-id <suite-id>] [--ids <id1,id2>] [--json] [--token <bearer-token>]",
       "",
       "Env vars:",
-      "  QUALTY_API_TOKEN  Bearer token used for auth",
+      "  QUALTY_API_TOKEN  Project .env first (same as MCP), then process env, then ~/.qualty/credentials",
       "  QUALTY_BASE_URL   API base URL when --url is not set (default: production)",
       "  QUALTY_LOCAL_CONCURRENCY  Local parallel workers for --local runs (default: 4)",
       "",
-      "Config (.qualty.json): default_org_id, default_project_id, default_auth_profile",
+      "Config (.qualty.json): default_org_id, default_project_id, default_auth_profile (ci/auth setup only; local runs use each test's saved login profile unless --auth-profile is set)",
       "  CLI flags (--org, --project, --profile, --url) override config values.",
     ].join("\n")
   );
@@ -393,9 +457,7 @@ async function runSetup(args) {
 
   try {
     const currentOrgId = String(args.org || projectCfg.default_org_id || "");
-    const currentToken = String(
-      args.token || process.env.QUALTY_API_TOKEN || sharedCreds.api_token || ""
-    );
+    const currentToken = resolveToken(args);
 
     let token = "";
     if (args.token) {
@@ -674,6 +736,37 @@ function syncGithubCiConfig({
   return results;
 }
 
+/**
+ * Push only auth bundle secrets and auth-related repository variables (no API token or org/project).
+ */
+function syncGithubAuthProfileOnly({ repo, profile, profileNames, authShards }) {
+  const results = [];
+  const record = (kind, name, outcome) => {
+    results.push({ kind, name, ...outcome });
+  };
+
+  for (const shard of authShards || []) {
+    record("secret", shard.secretName, setGithubSecret(shard.secretName, shard.payload, { repo }));
+  }
+
+  const names = (profileNames || []).filter(Boolean);
+  if (names.length > 0) {
+    record("variable", AUTH_PROFILES_VARIABLE, setGithubVariable(AUTH_PROFILES_VARIABLE, names.join(","), { repo }));
+  }
+  if (profile) {
+    record("variable", "QUALTY_AUTH_PROFILE", setGithubVariable("QUALTY_AUTH_PROFILE", profile, { repo }));
+  }
+  if ((authShards || []).length > 1) {
+    record(
+      "variable",
+      AUTH_SHARDS_VARIABLE,
+      setGithubVariable(AUTH_SHARDS_VARIABLE, String(authShards.length), { repo })
+    );
+  }
+
+  return results;
+}
+
 function printGithubSyncResults(results, { repo }) {
   const target = repo ? ` (repo ${repo})` : "";
   const printGroup = (title, rows) => {
@@ -1033,7 +1126,7 @@ async function runAuthRestoreCi(args) {
   const payloads = collectAuthShardPayloadsFromEnv(process.env);
   if (payloads.length === 0) {
     throw new Error(
-      `Missing ${AUTH_SECRET_PRIMARY}. Run qualty ci setup --set-github from your app repo.`
+      `Missing ${AUTH_SECRET_PRIMARY}. Run qualty ci setup --set-github (first time) or qualty auth export --set-github (profile refresh).`
     );
   }
 
@@ -1052,6 +1145,197 @@ async function runAuthRestoreCi(args) {
   console.log(`Restored ${restored.length} login profile(s).`);
 }
 
+async function runAuthExport(args) {
+  if (
+    parseBoolean(args["all-profiles"], false) ||
+    String(args["suite-id"] || args.suite || "").trim() ||
+    String(args.ids || "")
+      .split(",")
+      .map((part) => part.trim())
+      .filter(Boolean).length > 0
+  ) {
+    throw new Error(
+      "qualty auth export only updates login profile secrets. For full CI bootstrap use: qualty ci setup"
+    );
+  }
+
+  const profilesList = String(args.profiles || "")
+    .split(",")
+    .map((part) => part.trim())
+    .filter(Boolean);
+  const { orgId, projectId, profile, apiUrl, configPath } = resolveCiSetupConfig(args, {
+    requireProfile: profilesList.length === 0,
+  });
+  const token = resolveToken(args);
+
+  const profileEntries = await resolveCiSetupProfileEntries({
+    orgId,
+    projectId,
+    profile,
+    allProfiles: false,
+    profilesList,
+    suiteId: "",
+    explicitIds: [],
+    apiUrl,
+    token,
+  });
+  const profileNames = profileEntries.map((entry) => entry.name);
+  const primaryProfile = profile || profileNames[0] || "";
+
+  const manifest = buildAuthBundleManifest({ orgId, projectId, profileEntries });
+  const authShards = shardAuthBundleManifest(manifest);
+  const primaryShard = authShards[0];
+
+  const setGithubFlag =
+    parseBoolean(args["set-github"], false) || parseBoolean(args["set-secret"], false);
+  const noFile = parseBoolean(args["no-file"], false);
+  const outputPath = noFile
+    ? String(args.output || "").trim()
+    : String(args.output || "").trim() ||
+      ciSetupAuthBundleOutputPath(
+        localAuthStatePath({ orgId, projectId, profile: profileEntries[0].localProfileName })
+      );
+  const copyToClipboardFlag = parseBoolean(args.copy, false);
+  const githubRepo = String(args.repo || "").trim();
+
+  if (outputPath) {
+    writeFileSync(outputPath, primaryShard.payload, "utf8");
+    try {
+      chmodSync(outputPath, 0o600);
+    } catch {
+      // ignore platforms that do not support chmod
+    }
+    for (let index = 1; index < authShards.length; index += 1) {
+      const shard = authShards[index];
+      const shardPath = outputPath.replace(/(\.[^./]+)?$/, `_${index + 1}$1`);
+      writeFileSync(shardPath, shard.payload, "utf8");
+      try {
+        chmodSync(shardPath, 0o600);
+      } catch {
+        // ignore
+      }
+    }
+  }
+
+  const skipPayloadPrint = Boolean(outputPath || copyToClipboardFlag || setGithubFlag);
+  const totalSecretBytes = authShards.reduce(
+    (sum, shard) => sum + Buffer.byteLength(shard.payload, "utf8"),
+    0
+  );
+
+  // eslint-disable-next-line no-console
+  console.log("");
+  // eslint-disable-next-line no-console
+  console.log("=== Qualty → GitHub Actions (login profiles only) ===");
+  // eslint-disable-next-line no-console
+  console.log("");
+  // eslint-disable-next-line no-console
+  console.log(
+    `Auth bundle: ${profileNames.length} profile(s), ${authShards.length} secret shard(s), ${totalSecretBytes} bytes total`
+  );
+  for (const shard of authShards) {
+    // eslint-disable-next-line no-console
+    console.log(
+      `  - ${shard.secretName}: ${shard.profileNames.join(", ")} (${Buffer.byteLength(shard.payload, "utf8")} bytes)`
+    );
+  }
+  // eslint-disable-next-line no-console
+  console.log("");
+  if (outputPath) {
+    // eslint-disable-next-line no-console
+    console.log(`Wrote ${AUTH_SECRET_PRIMARY} to ${outputPath}`);
+    for (let index = 1; index < authShards.length; index += 1) {
+      const shard = authShards[index];
+      const shardPath = outputPath.replace(/(\.[^./]+)?$/, `_${index + 1}$1`);
+      // eslint-disable-next-line no-console
+      console.log(`Wrote ${shard.secretName} to ${shardPath}`);
+    }
+    // eslint-disable-next-line no-console
+    console.log("");
+  }
+  if (setGithubFlag) {
+    const syncResults = syncGithubAuthProfileOnly({
+      repo: githubRepo,
+      profile: primaryProfile,
+      profileNames,
+      authShards,
+    });
+    printGithubSyncResults(syncResults, { repo: githubRepo });
+    const failedAuth = syncResults.filter((row) => row.kind === "secret" && !row.ok);
+    if (failedAuth.length > 0 && outputPath) {
+      // eslint-disable-next-line no-console
+      console.log("  Manual auth secrets:");
+      authShards.forEach((shard, index) => {
+        const shardPath =
+          index === 0 ? outputPath : outputPath.replace(/(\.[^./]+)?$/, `_${index + 1}$1`);
+        // eslint-disable-next-line no-console
+        console.log(`    gh secret set ${shard.secretName} < ${shardPath}`);
+      });
+      // eslint-disable-next-line no-console
+      console.log("");
+    }
+  } else {
+    // eslint-disable-next-line no-console
+    console.log("GitHub secrets (login state only — does not update QUALTY_API_TOKEN or org/project):");
+    // eslint-disable-next-line no-console
+    console.log("");
+    for (const shard of authShards) {
+      // eslint-disable-next-line no-console
+      console.log("---");
+      // eslint-disable-next-line no-console
+      console.log(`Name:  ${shard.secretName}`);
+      if (skipPayloadPrint) {
+        // eslint-disable-next-line no-console
+        console.log(
+          `Value: (see file above${copyToClipboardFlag && shard.secretName === AUTH_SECRET_PRIMARY ? " or clipboard" : ""})`
+        );
+      } else {
+        // eslint-disable-next-line no-console
+        console.log("Value:");
+        // eslint-disable-next-line no-console
+        console.log(shard.payload);
+      }
+    }
+    // eslint-disable-next-line no-console
+    console.log("---");
+    // eslint-disable-next-line no-console
+    console.log("");
+    // eslint-disable-next-line no-console
+    console.log(
+      "Re-run with --set-github from this repo's git root to push via gh (after qualty ci setup for first-time CI)."
+    );
+    // eslint-disable-next-line no-console
+    console.log("");
+  }
+  if (copyToClipboardFlag) {
+    if (copyToClipboard(primaryShard.payload)) {
+      // eslint-disable-next-line no-console
+      console.log(`✓ Copied ${AUTH_SECRET_PRIMARY} to clipboard.`);
+    } else {
+      // eslint-disable-next-line no-console
+      console.log("Could not copy to clipboard on this machine.");
+    }
+    // eslint-disable-next-line no-console
+    console.log("");
+  }
+  for (const entry of profileEntries) {
+    // eslint-disable-next-line no-console
+    console.log(`Profile "${entry.name}" → ${entry.statePath}`);
+  }
+  if (configPath) {
+    // eslint-disable-next-line no-console
+    console.log(`Config: ${configPath}`);
+  }
+  // eslint-disable-next-line no-console
+  console.log("");
+  // eslint-disable-next-line no-console
+  console.log(
+    "When login expires, re-run qualty auth setup then qualty auth export --set-github (or qualty ci setup for a full refresh)."
+  );
+  // eslint-disable-next-line no-console
+  console.log("");
+}
+
 async function runCiSetup(args) {
   const {
     orgId,
@@ -1359,7 +1643,9 @@ async function runCiSetup(args) {
   // eslint-disable-next-line no-console
   console.log("");
   // eslint-disable-next-line no-console
-  console.log("When login expires, re-run qualty auth setup and qualty ci setup --set-github to refresh secrets.");
+  console.log(
+    "When login expires, re-run qualty auth setup and qualty auth export --set-github (or qualty ci setup --set-github for a full refresh)."
+  );
   // eslint-disable-next-line no-console
   console.log("");
 }
@@ -2217,8 +2503,7 @@ async function maybePromptProjectIdForLocalRun({ args, apiUrl, token, orgId }) {
 
 function resolveLocalAuthStateForRun({ args, orgId, projectId }) {
   if (parseBoolean(args["no-auth-state"], false)) return null;
-  const projectCfg = readProjectConfig();
-  const profile = authProfileFromConfig(projectCfg, args["auth-profile"]);
+  const profile = explicitAuthProfileFromArgs(args);
   if (!profile) return null;
   const path = localAuthStatePath({ orgId, projectId, profile });
   const summary = summarizeStorageStateFile(path);
@@ -2232,12 +2517,10 @@ function resolveLocalAuthStateForRun({ args, orgId, projectId }) {
 
 async function maybePromptAuthProfileForLocalRun({ args, orgId, projectId }) {
   const projectCfg = readProjectConfig();
-  const requestedProfile = authProfileFromConfig(projectCfg, args["auth-profile"]);
+  const requestedProfile = explicitAuthProfileFromArgs(args);
   if (requestedProfile) return { authProfile: requestedProfile, noAuthState: false };
   if (parseBoolean(args["no-auth-state"], false)) return { authProfile: "", noAuthState: true };
   if (!process.stdin.isTTY || !process.stdout.isTTY) {
-    const defaultProfile = authProfileFromConfig(projectCfg);
-    if (defaultProfile) return { authProfile: defaultProfile, noAuthState: false };
     return { authProfile: "", noAuthState: false };
   }
   if (!projectId) return { authProfile: "", noAuthState: false };
@@ -2472,8 +2755,8 @@ async function runAuthSetup(args) {
     console.log("");
     // eslint-disable-next-line no-console
     console.log(
-      `[qualty][auth] For GitHub Actions secrets, run:\n` +
-        `  qualty ci setup --project ${project.id} --profile "${profile}"`
+      `[qualty][auth] Push this profile to GitHub Actions:\n` +
+        `  qualty auth export --project ${project.id} --profile "${profile}" --set-github`
     );
   } finally {
     rl.close();
@@ -2509,11 +2792,15 @@ async function main() {
       await runAuthSetup(args);
       return;
     }
+    if (sub === "export") {
+      await runAuthExport(args);
+      return;
+    }
     if (sub === "restore-ci") {
       await runAuthRestoreCi(args);
       return;
     }
-    throw new Error("Unknown auth subcommand. Use: qualty auth setup | qualty auth restore-ci");
+    throw new Error("Unknown auth subcommand. Use: qualty auth setup | qualty auth export | qualty auth restore-ci");
   }
   if (command === "run") {
     if (parseBoolean(args.local, false)) {
@@ -2546,7 +2833,7 @@ async function main() {
             projectId,
           })
         : {
-            authProfile: String(args["auth-profile"] || "").trim(),
+            authProfile: explicitAuthProfileFromArgs(args),
             noAuthState: parseBoolean(args["no-auth-state"], false),
           };
       const localAuthArgs = {
@@ -2569,9 +2856,9 @@ async function main() {
         device: args.device ? String(args.device).trim() : undefined,
         headless: !parseBoolean(args.headed, false),
         localConcurrency: resolveLocalConcurrency(args),
-        authProfile: localAuth?.profile || authChoice.authProfile || "",
+        authProfile: authChoice.authProfile || "",
         noAuthState: Boolean(authChoice.noAuthState || parseBoolean(args["no-auth-state"], false)),
-        storageStatePath: localAuth?.path,
+        storageStatePath: authChoice.authProfile ? localAuth?.path : undefined,
       };
       if (suiteId && explicitIds.length === 0) {
         await runLocalSuiteWithSequences(localRunArgs);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qualty",
-  "version": "0.1.26",
+  "version": "0.1.29",
   "description": "Qualty CLI for localhost and CI test runs",
   "bin": {
     "qualty": "bin/qualty.js"