@ttmg/cli 0.4.6-agent-beta.1 → 0.4.6-agent-beta.2

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttmg/cli",
-  "version": "0.4.6-agent-beta.1",
+  "version": "0.4.6-agent-beta.2",
   "description": "TikTok Mini Game Command Line Tool",
   "license": "ISC",
   "bin": {
@@ -30,7 +30,8 @@
     "test:auth": "node scripts/run-ts-test.js src/commands/common/auth.test.ts",
     "test:capabilities": "node scripts/run-ts-test.js src/commands/common/capabilities.test.ts",
     "test:test-account": "node scripts/run-ts-test.js src/commands/common/testAccount.test.ts",
-    "test:dev-session": "node scripts/run-ts-test.js src/commands/native/dev/agentSession.test.ts",
+    "test:dev-session": "node scripts/run-ts-test.js src/commands/native/dev/agentSession.test.ts && npm run test:packaging-compatibility",
+    "test:packaging-compatibility": "node scripts/run-ts-test.js src/commands/native/dev/packagingCompatibility.test.ts",
     "test:dev-session-command": "node scripts/run-ts-test.js src/commands/native/dev/session.test.ts && node scripts/run-ts-test.js src/commands/native/dev/projectSession.test.ts && node scripts/run-ts-test.js src/commands/native/dev/scanPage.test.ts && node scripts/run-ts-test.js src/commands/native/dev/runtime/logArchive.test.ts && node scripts/run-ts-test.js src/commands/native/dev/capture.test.ts",
     "test:dev-runtime-event": "node scripts/run-ts-test.js src/commands/native/dev/utils/scoket.test.ts",
     "test:dev-runtime-client": "node scripts/run-ts-test.js src/commands/native/dev/runtime/runtime.test.ts",
@@ -93,7 +94,7 @@
     "qs": "6.12.1",
     "semver": "^7.7.2",
     "socks-proxy-agent": "^9.0.0",
-    "ttmg-pack": "0.4.13-beta.2",
+    "ttmg-pack": "0.4.13",
     "ws": "^8.18.3"
   },
   "devDependencies": {

package/dist/scripts/dev-default-smoke.js

@@ -13,6 +13,10 @@ async function run() {
   fs.mkdirSync(gameDirectory);
   fs.writeFileSync(path.join(gameDirectory, 'game.js'), 'console.log("game");\n');
   fs.writeFileSync(path.join(gameDirectory, 'game.json'), '{}\n');
+  for (const directory of ['.ttmg', '.ttmg-assets', 'assets/.ttmg']) {
+    fs.mkdirSync(path.join(gameDirectory, directory), { recursive: true });
+    fs.writeFileSync(path.join(gameDirectory, directory, 'data.txt'), 'before');
+  }
 
   let output = '';
   const child = spawn(
@@ -49,7 +53,24 @@ async function run() {
       await delay(100);
     }
     assert.match(output, /Game resources compiled successfully|游戏资源编译成功/);
-    assert.equal(fs.existsSync(path.join(gameDirectory, '.ttmg')), false);
+    // Ordinary dev must not create an Agent session. Existing evidence must
+    // not trigger reloads, while similarly named runtime assets still do.
+    assert.equal(fs.existsSync(path.join(gameDirectory, '.ttmg/sessions')), false);
+    const compileCount = () => (output.match(/Game resources compiled successfully|游戏资源编译成功/g) || []).length;
+    const initialCount = compileCount();
+    fs.writeFileSync(path.join(gameDirectory, '.ttmg/data.txt'), 'new log');
+    await delay(4500);
+    assert.equal(compileCount(), initialCount, 'session writes triggered a rebuild');
+    for (const file of ['.ttmg-assets/data.txt', 'assets/.ttmg/data.txt']) {
+      const before = compileCount();
+      fs.writeFileSync(path.join(gameDirectory, file), 'updated runtime asset');
+      const deadline = Date.now() + 15000;
+      while (compileCount() === before && Date.now() < deadline) {
+        if (child.exitCode !== null) throw new Error(`Default dev exited while watching ${file}:\n${output}`);
+        await delay(100);
+      }
+      assert.ok(compileCount() > before, `${file} did not trigger a rebuild`);
+    }
   } finally {
     if (child.exitCode === null) {
       child.kill('SIGTERM');

package/dist/scripts/verify-agent-contract.js

@@ -10,7 +10,7 @@ const packageJson = JSON.parse(
   fs.readFileSync(path.join(cliRoot, 'package.json'), 'utf8'),
 );
 
-function runCli(args, environment = {}) {
+function runCli(args, environment = {}, cwd = cliRoot) {
   const env = {
     ...process.env,
     NO_COLOR: '1',
@@ -20,7 +20,7 @@ function runCli(args, environment = {}) {
   delete env.TTMG_LOGIN_EMAIL;
   delete env.TTMG_LOGIN_PASSWORD;
   return spawnSync(process.execPath, [cliEntry, ...args], {
-    cwd: cliRoot,
+    cwd,
     env,
     encoding: 'utf8',
   });
@@ -270,6 +270,44 @@ assert.equal(parseSingleJson(invalidBackground, 'background').errorCode, 'DEV_IT
 const invalidManual = runCli(['dev', '--update-mode', 'invalid', '--format', 'json']);
 assertExit(invalidManual, 1, 'update mode validation');
 assert.equal(parseSingleJson(invalidManual, 'manual').errorCode, 'DEV_ITERATION_INVALID_OPTIONS');
+// Validation must happen before writing evidence or starting local services.
+const unsafeEvidence = path.join(cliRoot, 'unsafe-evidence-' + process.pid);
+const invalidEvidence = runCli(['dev', '--client-key', 'fixture', '--mode', 'client-preview', '--no-open', '--format', 'json', '--evidence-dir', unsafeEvidence]);
+assertExit(invalidEvidence, 1, 'evidence directory isolation');
+assert.equal(parseSingleJson(invalidEvidence, 'evidence directory').errorCode, 'DEV_EVIDENCE_DIRECTORY_UNSAFE');
+assert.equal(fs.existsSync(unsafeEvidence), false);
+assert.deepEqual(capabilities.commands.dev.sessionLogs.evidenceDirectoryLocations, ['outside-project', 'project-root-.ttmg']);
+const packagingFixture = fs.mkdtempSync(path.join(os.tmpdir(), 'ttmg-installed-pack-gate-'));
+try {
+  fs.writeFileSync(path.join(packagingFixture, 'game.js'), 'console.log("fixture");');
+  fs.writeFileSync(path.join(packagingFixture, 'game.json'), '{}');
+  fs.mkdirSync(path.join(packagingFixture, '.ttmg'));
+  fs.writeFileSync(path.join(packagingFixture, '.ttmg/logs.ndjson'), Buffer.alloc(5 * 1024 * 1024));
+  fs.writeFileSync(path.join(packagingFixture, '.ttmg/旧构建.js'), 'tt.login();');
+  const checked = runCli(['check', '--dir', packagingFixture, '--format', 'json']);
+  assertExit(checked, 0, 'installed packaging evidence exclusion');
+  const report = parseSingleJson(checked, 'installed packaging evidence exclusion');
+  assert.ok(!report.diagnostics.some(item => item.type === 'size' && !item.passed), 'installed ttmg-pack counted CLI evidence in package size');
+  assert.ok(report.diagnostics.some(item => item.name === 'login' && !item.passed), 'installed ttmg-pack scanned APIs from old debug builds');
+} finally {
+  fs.rmSync(packagingFixture, { recursive: true, force: true });
+}
+if (process.platform !== 'win32') {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ttmg-evidence-symlink-'));
+  try {
+    fs.mkdirSync(path.join(root, 'assets'));
+    fs.writeFileSync(path.join(root, 'game.js'), 'console.log("fixture");');
+    fs.symlinkSync(path.join(root, 'assets'), path.join(root, '.ttmg'));
+    for (const extra of [[], ['--background']]) {
+      const result = runCli(['dev', '--mode', 'client-preview', '--update-mode', 'manual', '--client-key', 'fixture', '--no-open', '--format', 'json', ...extra], {}, root);
+      assertExit(result, 1, 'symlinked evidence isolation');
+      assert.equal(parseSingleJson(result, 'symlinked evidence').errorCode, 'DEV_EVIDENCE_DIRECTORY_UNSAFE');
+      assert.deepEqual(fs.readdirSync(path.join(root, 'assets')), [], 'validation wrote into game assets');
+    }
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
 // Both formats perform the same local build validation; the former text placeholder is retired.
 const missingBuildDirectory = path.join(os.tmpdir(), 'ttmg-build-dir-that-does-not-exist-' + process.pid);
 for (const format of ['text', 'json']) {

package/dist/scripts/vibe-auth-open-test-preload.cjs

@@ -0,0 +1,11 @@
+// Test-only browser boundary: never launch a real browser from process smoke.
+const cp = require('node:child_process');
+const fs = require('node:fs');
+const original = cp.spawn;
+cp.spawn = function(command, args, options) {
+  if (command === 'open' || /(?:xdg-open|powershell\.exe)$/i.test(command)) {
+    fs.appendFileSync(process.env.TTMG_AUTH_OPEN_TEST_RECEIPT, JSON.stringify({command, args}) + '\n');
+    return original(process.execPath, ['-e', 'process.exit(0)'], {stdio: 'ignore'});
+  }
+  return original.call(this, command, args, options);
+};

package/dist/scripts/vibe-upload-smoke.js

@@ -99,6 +99,57 @@ function events(result) {
     .map(line => JSON.parse(line));
 }
 async function main() {
+  // Exercise the built worker IPC and new command without creating a platform task.
+  const authWorker = spawn(process.execPath, [entry, '__vibe-page-server'], {
+    env: {...env, TTMG_VIBE_PAGE_TTL_MS: '30000'}, stdio: ['ignore', 'ignore', 'ignore', 'ipc'],
+  });
+  children.add(authWorker);
+  const workerMessage = predicate => new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {authWorker.off('message', receive); reject(new Error('worker timeout'));}, 5000);
+    function receive(message) {
+      if (predicate(message)) {clearTimeout(timer); authWorker.off('message', receive); resolve(message);}
+    }
+    authWorker.on('message', receive);
+  });
+  const ready = await workerMessage(message => message.type === 'ready');
+  const landing = 'https://developers.tiktok.com/portal_h5/minis_import?task_id=123&import_token=process-private-token';
+  let rendered = workerMessage(message => message.type === 'rendered' && message.id === 1);
+  authWorker.send({type: 'render', id: 1, html: '<h1>Waiting</h1>', browserLandingUrl: landing});
+  await rendered;
+  const browserReceipt = path.join(temp, 'browser-open.ndjson');
+  const browserEnv = {
+    NODE_OPTIONS: `--require=${path.join(__dirname, 'vibe-auth-open-test-preload.cjs')}`,
+    TTMG_AUTH_OPEN_TEST_RECEIPT: browserReceipt,
+  };
+  for (const format of ['json', 'ndjson']) {
+    const opened = await run(['auth', 'open', '--page-url', ready.url, '--format', format], undefined, browserEnv);
+    assert.equal(opened.code, 0, opened.stderr);
+    const result = JSON.parse(opened.stdout);
+    assert.equal(result.status, 'open_requested');
+    assert.equal(result.platformWrite, false);
+    assert.doesNotMatch(opened.stdout + opened.stderr, /import_token|process-private-token/);
+  }
+  const launches = fs.readFileSync(browserReceipt, 'utf8').trim().split('\n').map(JSON.parse);
+  assert.equal(launches.length, 2);
+  assert.ok(launches.every(item => item.args.includes(ready.url + '/authorize')));
+  const redirect = await fetch(ready.url + '/authorize', {redirect: 'manual'});
+  assert.equal(redirect.headers.get('location'), landing);
+  assert.equal(redirect.status, 302);
+  rendered = workerMessage(message => message.type === 'rendered' && message.id === 2);
+  authWorker.send({type: 'render', id: 2, html: '<h1>Complete</h1>'});
+  await rendered;
+  const stale = await run(['auth', 'open', '--page-url', ready.url, '--format', 'json'], undefined, browserEnv);
+  assert.equal(stale.code, 1);
+  assert.equal(JSON.parse(stale.stdout).errorCode, 'VIBE_AUTH_PAGE_UNAVAILABLE');
+  for (const args of [[], ['--page-url', landing]]) {
+    const invalid = await run(['auth', 'open', ...args, '--format', 'json'], undefined, browserEnv);
+    assert.equal(invalid.code, 1);
+    assert.equal(JSON.parse(invalid.stdout).errorCode, 'VIBE_INVALID_PAGE_URL');
+    assert.doesNotMatch(invalid.stdout + invalid.stderr, /process-private-token/);
+  }
+  assert.equal(fs.readFileSync(browserReceipt, 'utf8').trim().split('\n').length, 2);
+  authWorker.kill();
+  children.delete(authWorker);
   fixtureServer = http.createServer((req, res) => {
     const url = new URL(req.url, 'http://127.0.0.1');
     requests.push({ path: url.pathname, method: req.method, headers: req.headers });
@@ -381,6 +432,9 @@ async function main() {
   assert.equal(help.code, 0);
   assert.match(help.stdout, /--vibe/);
   assert.match(help.stdout, /--client-key/);
+  const authHelp = await run(['auth', 'open', '--help']);
+  assert.equal(authHelp.code, 0);
+  assert.match(authHelp.stdout, /--page-url/);
 
   let cancelledPage;
   const cancelled = await run(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttmg/cli",
-  "version": "0.4.6-agent-beta.1",
+  "version": "0.4.6-agent-beta.2",
   "description": "TikTok Mini Game Command Line Tool",
   "license": "ISC",
   "bin": {
@@ -30,7 +30,8 @@
     "test:auth": "node scripts/run-ts-test.js src/commands/common/auth.test.ts",
     "test:capabilities": "node scripts/run-ts-test.js src/commands/common/capabilities.test.ts",
     "test:test-account": "node scripts/run-ts-test.js src/commands/common/testAccount.test.ts",
-    "test:dev-session": "node scripts/run-ts-test.js src/commands/native/dev/agentSession.test.ts",
+    "test:dev-session": "node scripts/run-ts-test.js src/commands/native/dev/agentSession.test.ts && npm run test:packaging-compatibility",
+    "test:packaging-compatibility": "node scripts/run-ts-test.js src/commands/native/dev/packagingCompatibility.test.ts",
     "test:dev-session-command": "node scripts/run-ts-test.js src/commands/native/dev/session.test.ts && node scripts/run-ts-test.js src/commands/native/dev/projectSession.test.ts && node scripts/run-ts-test.js src/commands/native/dev/scanPage.test.ts && node scripts/run-ts-test.js src/commands/native/dev/runtime/logArchive.test.ts && node scripts/run-ts-test.js src/commands/native/dev/capture.test.ts",
     "test:dev-runtime-event": "node scripts/run-ts-test.js src/commands/native/dev/utils/scoket.test.ts",
     "test:dev-runtime-client": "node scripts/run-ts-test.js src/commands/native/dev/runtime/runtime.test.ts",
@@ -93,7 +94,7 @@
     "qs": "6.12.1",
     "semver": "^7.7.2",
     "socks-proxy-agent": "^9.0.0",
-    "ttmg-pack": "0.4.13-beta.2",
+    "ttmg-pack": "0.4.13",
     "ws": "^8.18.3"
   },
   "devDependencies": {