@ttmg/cli 0.4.6-agent-beta.1 → 0.4.6-agent-beta.3

package/dist/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@ttmg/cli",
-  "version": "0.4.6-agent-beta.1",
+  "version": "0.4.6-agent-beta.3",
   "description": "TikTok Mini Game Command Line Tool",
   "license": "ISC",
   "bin": {
     "ttmg": "dist/index.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "vibe-upload.md"
   ],
   "publishConfig": {
     "access": "public",
@@ -15,7 +16,8 @@
   },
   "scripts": {
     "demo:vibe": "npm run build && node scripts/vibe-upload-demo.js",
-    "test:vibe": "node scripts/run-ts-test.js src/commands/common/vibe/vibe.test.ts",
+    "test:game-categories": "node scripts/run-ts-test.js src/commands/common/game/categories.test.ts",
+    "test:vibe": "npm run test:game-categories && node scripts/run-ts-test.js src/commands/common/vibe/vibe.test.ts",
     "test:vibe-process": "node scripts/vibe-upload-smoke.js",
     "prepack": "npm run build && npm run verify:dist-version && npm run verify:agent-contract",
     "build": "node scripts/build.js",
@@ -30,7 +32,8 @@
     "test:auth": "node scripts/run-ts-test.js src/commands/common/auth.test.ts",
     "test:capabilities": "node scripts/run-ts-test.js src/commands/common/capabilities.test.ts",
     "test:test-account": "node scripts/run-ts-test.js src/commands/common/testAccount.test.ts",
-    "test:dev-session": "node scripts/run-ts-test.js src/commands/native/dev/agentSession.test.ts",
+    "test:dev-session": "node scripts/run-ts-test.js src/commands/native/dev/agentSession.test.ts && npm run test:packaging-compatibility",
+    "test:packaging-compatibility": "node scripts/run-ts-test.js src/commands/native/dev/packagingCompatibility.test.ts",
     "test:dev-session-command": "node scripts/run-ts-test.js src/commands/native/dev/session.test.ts && node scripts/run-ts-test.js src/commands/native/dev/projectSession.test.ts && node scripts/run-ts-test.js src/commands/native/dev/scanPage.test.ts && node scripts/run-ts-test.js src/commands/native/dev/runtime/logArchive.test.ts && node scripts/run-ts-test.js src/commands/native/dev/capture.test.ts",
     "test:dev-runtime-event": "node scripts/run-ts-test.js src/commands/native/dev/utils/scoket.test.ts",
     "test:dev-runtime-client": "node scripts/run-ts-test.js src/commands/native/dev/runtime/runtime.test.ts",
@@ -45,7 +48,7 @@
     "test:check-ai": "node scripts/run-ts-test.js src/commands/native/check/ai.test.ts",
     "test:build-structured": "node scripts/run-ts-test.js src/commands/native/build/build.test.ts",
     "test:doctor": "node scripts/run-ts-test.js src/commands/native/doctor/doctor.test.ts",
-    "test:wasm": "node scripts/run-ts-test.js src/commands/native/wasm/wasm.test.ts && node scripts/acceptance-fixture.test.js",
+    "test:wasm": "node scripts/run-ts-test.js src/commands/native/wasm/wasm.test.ts && node scripts/run-ts-test.js src/commands/native/wasm/collect.test.ts && node scripts/acceptance-fixture.test.js",
     "test:agent-contract": "npm run test:login && npm run test:auth && npm run test:capabilities && npm run test:test-account && npm run test:upload-preview && npm run test:preview-page && npm run test:check && npm run test:check-ai && npm run test:build-structured && npm run test:doctor && npm run test:wasm && npm run test:dev-session && npm run test:dev-session-command && npm run test:dev-runtime-event && npm run test:dev-runtime-client && npm run test:dev-session-control && npm run test:dev-runtime-session-follow && npm run test:dev-client-preview-orchestrator && npm run test:dev-watch-change && npm run test:network && npm run test:vibe && npx tsc --noEmit && npm run build && npm run test:vibe-process && npm run test:preview-page-process && npm run test:preview-page-detached && npm run verify:dist-version && npm run verify:agent-contract",
     "test:agent-contract:full": "npm run test:agent-contract && npm run test:dev-default-process && npm run test:dev-game-ready-process && npm run test:dev-client-preview-control-process && node scripts/dev-workflow-smoke.js",
     "publish:beta": "npm publish --registry=https://registry.npmjs.org/ --access public --tag beta",
@@ -93,7 +96,7 @@
     "qs": "6.12.1",
     "semver": "^7.7.2",
     "socks-proxy-agent": "^9.0.0",
-    "ttmg-pack": "0.4.13-beta.2",
+    "ttmg-pack": "0.4.13",
     "ws": "^8.18.3"
   },
   "devDependencies": {

package/dist/scripts/dev-default-smoke.js

@@ -13,6 +13,10 @@ async function run() {
   fs.mkdirSync(gameDirectory);
   fs.writeFileSync(path.join(gameDirectory, 'game.js'), 'console.log("game");\n');
   fs.writeFileSync(path.join(gameDirectory, 'game.json'), '{}\n');
+  for (const directory of ['.ttmg', '.ttmg-assets', 'assets/.ttmg']) {
+    fs.mkdirSync(path.join(gameDirectory, directory), { recursive: true });
+    fs.writeFileSync(path.join(gameDirectory, directory, 'data.txt'), 'before');
+  }
 
   let output = '';
   const child = spawn(
@@ -49,7 +53,24 @@ async function run() {
       await delay(100);
     }
     assert.match(output, /Game resources compiled successfully|游戏资源编译成功/);
-    assert.equal(fs.existsSync(path.join(gameDirectory, '.ttmg')), false);
+    // Ordinary dev must not create an Agent session. Existing evidence must
+    // not trigger reloads, while similarly named runtime assets still do.
+    assert.equal(fs.existsSync(path.join(gameDirectory, '.ttmg/sessions')), false);
+    const compileCount = () => (output.match(/Game resources compiled successfully|游戏资源编译成功/g) || []).length;
+    const initialCount = compileCount();
+    fs.writeFileSync(path.join(gameDirectory, '.ttmg/data.txt'), 'new log');
+    await delay(4500);
+    assert.equal(compileCount(), initialCount, 'session writes triggered a rebuild');
+    for (const file of ['.ttmg-assets/data.txt', 'assets/.ttmg/data.txt']) {
+      const before = compileCount();
+      fs.writeFileSync(path.join(gameDirectory, file), 'updated runtime asset');
+      const deadline = Date.now() + 15000;
+      while (compileCount() === before && Date.now() < deadline) {
+        if (child.exitCode !== null) throw new Error(`Default dev exited while watching ${file}:\n${output}`);
+        await delay(100);
+      }
+      assert.ok(compileCount() > before, `${file} did not trigger a rebuild`);
+    }
   } finally {
     if (child.exitCode === null) {
       child.kill('SIGTERM');

package/dist/scripts/verify-agent-contract.js

@@ -10,7 +10,7 @@ const packageJson = JSON.parse(
   fs.readFileSync(path.join(cliRoot, 'package.json'), 'utf8'),
 );
 
-function runCli(args, environment = {}) {
+function runCli(args, environment = {}, cwd = cliRoot) {
   const env = {
     ...process.env,
     NO_COLOR: '1',
@@ -20,7 +20,7 @@ function runCli(args, environment = {}) {
   delete env.TTMG_LOGIN_EMAIL;
   delete env.TTMG_LOGIN_PASSWORD;
   return spawnSync(process.execPath, [cliEntry, ...args], {
-    cwd: cliRoot,
+    cwd,
     env,
     encoding: 'utf8',
   });
@@ -126,6 +126,18 @@ const capabilitiesResult = runCli(['capabilities', '--format', 'json']);
 assertExit(capabilitiesResult, 0, 'capabilities');
 const capabilities = parseSingleJson(capabilitiesResult, 'capabilities');
 assert.equal(capabilities.command, 'capabilities');
+const gameCategories = runCli(['game', 'categories', '--format', 'json']);
+assertExit(gameCategories, 0, 'game categories');
+const categoryCatalog = parseSingleJson(gameCategories, 'game categories');
+assert.equal(categoryCatalog.platformWrite, false);
+assert.equal(categoryCatalog.categoryCount, 12);
+assert.equal(categoryCatalog.subcategoryCount, 114);
+assert.equal(capabilities.commands.gameCategories.catalogVersion, categoryCatalog.catalogVersion);
+assert.match(capabilities.commands.vibeUpload.command, /--vibe --web/);
+assert.equal(capabilities.commands.vibeUpload.skillWorkflow.keepUploadProcessRunning, true);
+assert.equal(capabilities.commands.vibeUpload.skillWorkflow.realUploadSuccess.simulation, false);
+assert.equal(capabilities.commands.vibeUpload.appInfoFields.defaultedByCli.includes('privacy_policy'), true);
+assert.equal(packageJson.files.includes('vibe-upload.md'), true);
 assert.equal(capabilities.structuredOutput.stdoutProtocolOnly, true);
 assert.equal(capabilities.commands.check.platformWrite, false);
 assert.equal(capabilities.commands.check.ai.option, '--ai');
@@ -270,6 +282,44 @@ assert.equal(parseSingleJson(invalidBackground, 'background').errorCode, 'DEV_IT
 const invalidManual = runCli(['dev', '--update-mode', 'invalid', '--format', 'json']);
 assertExit(invalidManual, 1, 'update mode validation');
 assert.equal(parseSingleJson(invalidManual, 'manual').errorCode, 'DEV_ITERATION_INVALID_OPTIONS');
+// Validation must happen before writing evidence or starting local services.
+const unsafeEvidence = path.join(cliRoot, 'unsafe-evidence-' + process.pid);
+const invalidEvidence = runCli(['dev', '--client-key', 'fixture', '--mode', 'client-preview', '--no-open', '--format', 'json', '--evidence-dir', unsafeEvidence]);
+assertExit(invalidEvidence, 1, 'evidence directory isolation');
+assert.equal(parseSingleJson(invalidEvidence, 'evidence directory').errorCode, 'DEV_EVIDENCE_DIRECTORY_UNSAFE');
+assert.equal(fs.existsSync(unsafeEvidence), false);
+assert.deepEqual(capabilities.commands.dev.sessionLogs.evidenceDirectoryLocations, ['outside-project', 'project-root-.ttmg']);
+const packagingFixture = fs.mkdtempSync(path.join(os.tmpdir(), 'ttmg-installed-pack-gate-'));
+try {
+  fs.writeFileSync(path.join(packagingFixture, 'game.js'), 'console.log("fixture");');
+  fs.writeFileSync(path.join(packagingFixture, 'game.json'), '{}');
+  fs.mkdirSync(path.join(packagingFixture, '.ttmg'));
+  fs.writeFileSync(path.join(packagingFixture, '.ttmg/logs.ndjson'), Buffer.alloc(5 * 1024 * 1024));
+  fs.writeFileSync(path.join(packagingFixture, '.ttmg/旧构建.js'), 'tt.login();');
+  const checked = runCli(['check', '--dir', packagingFixture, '--format', 'json']);
+  assertExit(checked, 0, 'installed packaging evidence exclusion');
+  const report = parseSingleJson(checked, 'installed packaging evidence exclusion');
+  assert.ok(!report.diagnostics.some(item => item.type === 'size' && !item.passed), 'installed ttmg-pack counted CLI evidence in package size');
+  assert.ok(report.diagnostics.some(item => item.name === 'login' && !item.passed), 'installed ttmg-pack scanned APIs from old debug builds');
+} finally {
+  fs.rmSync(packagingFixture, { recursive: true, force: true });
+}
+if (process.platform !== 'win32') {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ttmg-evidence-symlink-'));
+  try {
+    fs.mkdirSync(path.join(root, 'assets'));
+    fs.writeFileSync(path.join(root, 'game.js'), 'console.log("fixture");');
+    fs.symlinkSync(path.join(root, 'assets'), path.join(root, '.ttmg'));
+    for (const extra of [[], ['--background']]) {
+      const result = runCli(['dev', '--mode', 'client-preview', '--update-mode', 'manual', '--client-key', 'fixture', '--no-open', '--format', 'json', ...extra], {}, root);
+      assertExit(result, 1, 'symlinked evidence isolation');
+      assert.equal(parseSingleJson(result, 'symlinked evidence').errorCode, 'DEV_EVIDENCE_DIRECTORY_UNSAFE');
+      assert.deepEqual(fs.readdirSync(path.join(root, 'assets')), [], 'validation wrote into game assets');
+    }
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}
 // Both formats perform the same local build validation; the former text placeholder is retired.
 const missingBuildDirectory = path.join(os.tmpdir(), 'ttmg-build-dir-that-does-not-exist-' + process.pid);
 for (const format of ['text', 'json']) {
@@ -347,7 +397,14 @@ assert.notEqual(
 );
 
 const uploadHelp = runCli(['upload', '--help']);
+assert.doesNotMatch(uploadHelp.stdout, /--app-info/);
+assert.match(uploadHelp.stdout.replace(/\s+/g, ' '), /only title and icon|只收集标题和头像/);
 assertExit(uploadHelp, 0, 'upload help');
+assert.match(uploadHelp.stdout, /--vibe --web --dir/);
+assert.match(uploadHelp.stdout, /authorizationOpenCommand/);
+assert.match(uploadHelp.stdout, /simulation=false/);
+assert.match(uploadHelp.stdout, /--category <category>/);
+assert.match(uploadHelp.stdout, /--subcategory <subcategory>/);
 assert.match(uploadHelp.stdout, /--preview\b/);
 assert.match(uploadHelp.stdout, /--serve-preview-page\b/);
 assert.match(uploadHelp.stdout, /--no-open\b/);
@@ -394,6 +451,17 @@ const wasmSmoke = spawnSync(process.execPath, [path.join(cliRoot, 'scripts/wasm-
 });
 assertExit(wasmSmoke, 0, 'Wasm built-artifact process smoke');
 console.log(wasmSmoke.stdout.trim());
+for (const operation of ['start', 'export']) {
+  assertExit(runWithoutWasmBinding(['wasm', 'collect', operation, '--help']), 0, `collect ${operation} help without binding`);
+  const invalid = runCli(['wasm', 'collect', operation, '--format', 'json']);
+  assertExit(invalid, 1, `collect ${operation} missing input`);
+  assert.equal(parseSingleJson(invalid, `collect ${operation}`).errorCode, 'WASM_COLLECT_INVALID_OPTIONS');
+}
+const collectSmoke = spawnSync(process.execPath, [path.join(cliRoot, 'scripts/wasm-collect-smoke.js')], {
+  cwd: cliRoot, encoding: 'utf8', timeout: 60000,
+});
+assertExit(collectSmoke, 0, 'Wasm collection built-artifact process smoke');
+console.log(collectSmoke.stdout.trim());
 const captureHelp = runCli(['dev', 'capture', '--help']);
 assertExit(captureHelp, 0, 'capture help');
 assert.match(captureHelp.stdout, /--timeout/);

package/dist/scripts/vibe-auth-open-test-preload.cjs

@@ -0,0 +1,11 @@
+// Test-only browser boundary: never launch a real browser from process smoke.
+const cp = require('node:child_process');
+const fs = require('node:fs');
+const original = cp.spawn;
+cp.spawn = function(command, args, options) {
+  if (command === 'open' || /(?:xdg-open|powershell\.exe)$/i.test(command)) {
+    fs.appendFileSync(process.env.TTMG_AUTH_OPEN_TEST_RECEIPT, JSON.stringify({command, args}) + '\n');
+    return original(process.execPath, ['-e', 'process.exit(0)'], {stdio: 'ignore'});
+  }
+  return original.call(this, command, args, options);
+};

package/dist/scripts/vibe-ppe-test-preload.cjs

@@ -3,18 +3,32 @@
 const assert = require('node:assert/strict');
 const http = require('node:http');
 const https = require('node:https');
+const net = require('node:net');
 const port = Number(process.env.TTMG_VIBE_TEST_PORT);
 assert.ok(Number.isInteger(port) && port > 0 && port < 65536);
 https.request = (options, callback) => {
   assert.equal(typeof options, 'object');
   assert.equal(options.hostname, 'developers.tiktok.com');
   assert.equal(options.protocol, 'https:');
-  assert.match(options.path, /^\/bff\/app_info\/minis_import\/(create_minis_import_task_for_agent|get_minis_import_task_status_for_agent)\//);
-  return http.request({
+  assert.match(options.path, /^\/bff\/app_info\/minis_import\/(create_minis_import_task_for_agent|get_minis_import_task_status_for_agent|upload_minis_import_app_icon_for_agent|submit_minis_import_info_for_agent|upload_minis_import_package_for_agent)\//);
+  const request = http.request({
     ...options,
     protocol: 'http:', hostname: '127.0.0.1', host: undefined, port,
     agent: undefined, servername: undefined,
   }, callback);
+  if (process.env.TTMG_VIBE_TEST_RETAIN_UPLOAD_SOCKET === '1' &&
+      /upload_minis_import_(app_icon|package)_for_agent/.test(options.path)) {
+    // Reproduce the live gateway's completed response with a retained upload
+    // socket. The socket is real but loopback-only; operation cleanup must close it.
+    assert.ok(options.agent && options.agent !== https.globalAgent);
+    request.once('response', response => response.once('end', () => {
+      const socket = net.connect({host: '127.0.0.1', port});
+      const key = 'retained-vibe-test-sockets';
+      (options.agent.sockets[key] ||= []).push(socket);
+      socket.on('error', () => {});
+    }));
+  }
+  return request;
 };
 https.get = (options, callback) => {
   const request = https.request(options, callback);

package/dist/scripts/vibe-upload-smoke.js

@@ -27,6 +27,10 @@ const children = new Set();
 let fixtureServer;
 const requests = [];
 let failStatus = false;
+let webMode = false;
+let webPolls = 0;
+let webFailureEndpoint;
+let expectedWebCategory = { category: 'Other', subcategory: 'Other' };
 const env = {
   ...process.env,
   HOME: temp,
@@ -96,16 +100,83 @@ function events(result) {
   return result.stdout
     .trim()
     .split('\n')
-    .map(line => JSON.parse(line));
+    .map(line => {
+      const event = JSON.parse(line);
+      if (event.mode === 'vibe') {
+        assert.deepEqual(event.inputRequirements.requiredUserInputs, ['title', 'icon']);
+        assert.equal(event.inputRequirements.requestAdditionalMetadata, false);
+        assert.equal(event.inputRequirements.additionalMetadataSource, 'cli-defaults');
+        assert.equal(event.inputRequirements.defaultMetadataProfile, 'ppe-trial');
+      }
+      return event;
+    });
 }
 async function main() {
-  fixtureServer = http.createServer((req, res) => {
+  // Exercise the built worker IPC and new command without creating a platform task.
+  const authWorker = spawn(process.execPath, [entry, '__vibe-page-server'], {
+    env: {...env, TTMG_VIBE_PAGE_TTL_MS: '30000'}, stdio: ['ignore', 'ignore', 'ignore', 'ipc'],
+  });
+  children.add(authWorker);
+  const workerMessage = predicate => new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {authWorker.off('message', receive); reject(new Error('worker timeout'));}, 5000);
+    function receive(message) {
+      if (predicate(message)) {clearTimeout(timer); authWorker.off('message', receive); resolve(message);}
+    }
+    authWorker.on('message', receive);
+  });
+  const ready = await workerMessage(message => message.type === 'ready');
+  const landing = 'https://developers.tiktok.com/portal_h5/minis_import?task_id=123&import_token=process-private-token';
+  let rendered = workerMessage(message => message.type === 'rendered' && message.id === 1);
+  authWorker.send({type: 'render', id: 1, html: '<h1>Waiting</h1>', browserLandingUrl: landing});
+  await rendered;
+  const browserReceipt = path.join(temp, 'browser-open.ndjson');
+  const browserEnv = {
+    NODE_OPTIONS: `--require=${path.join(__dirname, 'vibe-auth-open-test-preload.cjs')}`,
+    TTMG_AUTH_OPEN_TEST_RECEIPT: browserReceipt,
+  };
+  for (const format of ['json', 'ndjson']) {
+    const opened = await run(['auth', 'open', '--page-url', ready.url, '--format', format], undefined, browserEnv);
+    assert.equal(opened.code, 0, opened.stderr);
+    const result = JSON.parse(opened.stdout);
+    assert.equal(result.status, 'open_requested');
+    assert.equal(result.platformWrite, false);
+    assert.doesNotMatch(opened.stdout + opened.stderr, /import_token|process-private-token/);
+  }
+  const launches = fs.readFileSync(browserReceipt, 'utf8').trim().split('\n').map(JSON.parse);
+  assert.equal(launches.length, 2);
+  assert.ok(launches.every(item => item.args.includes(ready.url + '/authorize')));
+  const redirect = await fetch(ready.url + '/authorize', {redirect: 'manual'});
+  assert.equal(redirect.headers.get('location'), landing);
+  assert.equal(redirect.status, 302);
+  rendered = workerMessage(message => message.type === 'rendered' && message.id === 2);
+  authWorker.send({type: 'render', id: 2, html: '<h1>Complete</h1>'});
+  await rendered;
+  const stale = await run(['auth', 'open', '--page-url', ready.url, '--format', 'json'], undefined, browserEnv);
+  assert.equal(stale.code, 1);
+  assert.equal(JSON.parse(stale.stdout).errorCode, 'VIBE_AUTH_PAGE_UNAVAILABLE');
+  for (const args of [[], ['--page-url', landing]]) {
+    const invalid = await run(['auth', 'open', ...args, '--format', 'json'], undefined, browserEnv);
+    assert.equal(invalid.code, 1);
+    assert.equal(JSON.parse(invalid.stdout).errorCode, 'VIBE_INVALID_PAGE_URL');
+    assert.doesNotMatch(invalid.stdout + invalid.stderr, /process-private-token/);
+  }
+  assert.equal(fs.readFileSync(browserReceipt, 'utf8').trim().split('\n').length, 2);
+  authWorker.kill();
+  children.delete(authWorker);
+  fixtureServer = http.createServer(async (req, res) => {
     const url = new URL(req.url, 'http://127.0.0.1');
     requests.push({ path: url.pathname, method: req.method, headers: req.headers });
-    req.resume();
+    const chunks = [];
+    for await (const chunk of req) chunks.push(chunk);
+    const body = Buffer.concat(chunks);
     const create = url.pathname.endsWith('/create_minis_import_task_for_agent/');
     const status = url.pathname.endsWith('/get_minis_import_task_status_for_agent/');
-    assert.ok(create || status, 'Unexpected real upload endpoint');
+    const iconUpload = url.pathname.endsWith('/upload_minis_import_app_icon_for_agent/');
+    const infoUpload = url.pathname.endsWith('/submit_minis_import_info_for_agent/');
+    const packageUpload = url.pathname.endsWith('/upload_minis_import_package_for_agent/');
+    if (create) webPolls = 0;
+    if (status && webMode) webPolls++;
+    assert.ok(create || status || (webMode && (iconUpload || infoUpload || packageUpload)), 'Mock must not call material-upload endpoints');
     assert.equal(req.headers['x-use-ppe'], '1');
     assert.equal(req.headers['x-tt-env'], 'ppe_op_vc');
     assert.equal(req.headers.cookie, undefined);
@@ -113,13 +184,41 @@ async function main() {
       assert.equal(url.searchParams.get('task_id'), '7684370037737553941');
       assert.equal(url.searchParams.get('import_token'), 'process-test-secret');
     }
+    if (iconUpload || infoUpload || packageUpload) {
+      assert.equal(webPolls, 5, 'Do not upload before server readiness');
+      assert.equal(req.method, 'POST');
+      if (infoUpload) {
+        assert.match(body.toString(), /"task_id":7684370037737553941/);
+        const info = JSON.parse(body.toString());
+        assert.equal(info.import_token, 'process-test-secret');
+        assert.equal(info.app_info.icon_uri, 'web-icon-receipt');
+        assert.equal(info.app_info.app_name, input[input.indexOf('--title') + 1]);
+        assert.deepEqual(info.app_info, {
+          description: 'DevTool PPE integration test fixture. Not a production game.',
+          ...expectedWebCategory,
+          terms_of_service: 'https://www.tiktok.com',
+          privacy_policy: 'https://www.tiktok.com',
+          copyright_confirmation: true, contact_email: 'devtool-test@example.invalid',
+          app_name: input[input.indexOf('--title') + 1], icon_uri: 'web-icon-receipt',
+        }, 'CLI must send complete PPE trial defaults without asking the user for them');
+      } else {
+        assert.match(req.headers['content-type'], /^multipart\/form-data; boundary=/);
+        assert.match(body.toString(), /name="task_id"\r\n\r\n7684370037737553941\r\n/);
+        assert.match(body.toString(), /name="import_token"\r\n\r\nprocess-test-secret\r\n/);
+        assert.ok(body.includes(fs.readFileSync(iconUpload ? icon : zip)));
+        if (packageUpload) assert.match(body.toString(), /name="asset_type"\r\n\r\n2\r\n/);
+      }
+    }
     const data = create ? {
       task_id: '7684370037737553941', import_token: 'process-test-secret',
-      landing_url: 'https://developers.tiktok.com/portal_h5/minis_import?import_token=process-test-secret',
+      landing_url: 'https://developers.tiktok.com/portal_h5/minis_import?task_id=7684370037737553941&import_token=process-test-secret',
       poll_interval_seconds: 0.01,
-    } : { status: 1, ready_for_input: false };
+    } : iconUpload ? {icon_uri: 'web-icon-receipt'}
+      : infoUpload ? {}
+      : packageUpload ? {status: 3, package_uri: 'web-package-receipt'}
+      : { status: webMode && webPolls >= 5 ? 2 : 1, ready_for_input: webMode && webPolls >= 5 };
     res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ ...data, error_info: { code: failStatus && status ? 420500 : 0 } }));
+    res.end(JSON.stringify({ ...data, error_info: { code: (failStatus && status) || url.pathname === webFailureEndpoint ? 420500 : 0 } }));
   });
   await new Promise(resolve => fixtureServer.listen(0, '127.0.0.1', resolve));
   env.TTMG_VIBE_TEST_PORT = String(fixtureServer.address().port);
@@ -138,6 +237,13 @@ async function main() {
 
   let bindingHtml;
   const appInfoPath = path.join(temp, 'app-info.json');
+  const invalidLegacy = await run([...input, '--app-info', appInfoPath, '--dry-run', '--format', 'json']);
+  assert.equal(invalidLegacy.code, 1);
+  const legacyFailure = events(invalidLegacy)[0];
+  assert.equal(legacyFailure.errorCode, 'VIBE_INVALID_APP_INFO');
+  assert.equal(legacyFailure.platformWrite, false);
+  assert.match(legacyFailure.message, /Remove --app-info|移除 --app-info/);
+  assert.doesNotMatch(legacyFailure.message, /are required|需要简介/);
   fs.writeFileSync(appInfoPath, JSON.stringify({
     description: 'Process contract fixture', category: 'Casual', subcategory: 'Puzzle',
     terms_of_service: 'https://example.invalid/terms', privacy_policy: 'https://example.invalid/privacy',
@@ -156,6 +262,14 @@ async function main() {
   const completeDry = await run([...input, '--app-info', appInfoPath, '--dry-run', '--format', 'json']);
   assert.equal(completeDry.code, 0, completeDry.stderr);
   assert.equal(events(completeDry)[0].status, 'prepared');
+  assert.equal(events(completeDry)[0].classification.category, 'Casual');
+  assert.equal(events(completeDry)[0].classification.subcategory, 'Puzzle');
+  assert.equal(events(completeDry)[0].classification.source, 'app-info');
+  const overrideDry = await run([...input, '--app-info', appInfoPath, '--category', 'Puzzle', '--subcategory', 'Physics', '--dry-run', '--format', 'json']);
+  assert.equal(overrideDry.code, 0, overrideDry.stderr);
+  assert.equal(events(overrideDry)[0].classification.category, 'Puzzle');
+  assert.equal(events(overrideDry)[0].classification.subcategory, 'Physics');
+  assert.equal(events(overrideDry)[0].classification.source, 'arguments');
   assert.equal(requests.length, 0);
   fs.writeFileSync(appInfoPath, '{private-token');
   const badInfo = await run([...input, '--mock', '--app-info', appInfoPath, '--format', 'json']);
@@ -259,6 +373,102 @@ async function main() {
   assert.match(previewHtml, /data-phase="complete"/);
   assert.doesNotMatch(previewHtml, /QR|preview|review|Publish to TikTok/);
 
+  const beforeWeb = requests.length;
+  const webConflict = await run([...input, '--web', '--mock', '--format', 'json']);
+  assert.equal(events(webConflict)[0].errorCode, 'VIBE_WEB_OPTION_CONFLICT');
+  const legacyWeb = await run(['upload', '--web', '--format', 'json']);
+  assert.equal(events(legacyWeb)[0].errorCode, 'VIBE_OPTION_REQUIRES_VIBE');
+  assert.equal(requests.length, beforeWeb);
+  for (const [args, code] of [
+    [['--category', 'Puzzle'], 'VIBE_CATEGORY_PAIR_REQUIRED'],
+    [['--subcategory', 'Physics'], 'VIBE_CATEGORY_PAIR_REQUIRED'],
+    [['--category', 'Other', '--subcategory', 'Physics'], 'VIBE_INVALID_CATEGORY'],
+    [['--category', 'Unknown', '--subcategory', 'Other'], 'VIBE_INVALID_CATEGORY'],
+    [['--category', '', '--subcategory', ''], 'VIBE_INVALID_CATEGORY'],
+  ]) {
+    const invalid = await run([...input.filter(v => v !== '--no-open'), '--web', ...args, '--format', 'json']);
+    assert.equal(invalid.code, 1);
+    const result = events(invalid)[0];
+    assert.equal(result.errorCode, code);
+    assert.equal(result.platformWrite, false);
+    assert.equal(result.taskId, undefined);
+    assert.equal(result.pageUrl, undefined);
+  }
+  assert.equal(requests.length, beforeWeb, 'Invalid classification must not create tasks or upload');
+  webMode = true;
+  for (const format of ['json', 'ndjson']) {
+    expectedWebCategory = format === 'json' ? {category: 'Other', subcategory: 'Other'} : {category: 'Puzzle', subcategory: 'Physics'};
+    const categoryArgs = format === 'json' ? [] : ['--category', 'Puzzle', '--subcategory', 'Physics'];
+    const receipt = path.join(temp, `upload-web-${format}.ndjson`);
+    const requestStart = requests.length;
+    const web = await run([...input.filter(v => v !== '--no-open'), '--web', ...categoryArgs, '--format', format, '--poll-interval', '0.2'], async event => {
+      if (event.status === 'prepared') assert.deepEqual(
+        {category: event.classification.category, subcategory: event.classification.subcategory},
+        expectedWebCategory);
+      if (event.status === 'waiting_authorization') {
+        assert.equal(event.authorizationMode, 'web');
+        assert.equal(event.browserOpenRequested, true);
+        assert.equal(event.simulation, false);
+        assert.equal(event.nextAction, 'open_browser');
+        assert.equal(event.qrPurpose, undefined);
+        const response = await fetch(event.pageUrl + '/authorize', {redirect: 'manual'});
+        assert.equal(response.status, 302);
+        assert.match(response.headers.get('location'), /^https:\/\/developers\.tiktok\.com\/portal_h5\/minis_import\?/);
+        const html = await (await fetch(event.pageUrl)).text();
+        assert.match(html, /Authorize in your browser/);
+        assert.doesNotMatch(html, /alt="Authorization QR"|Scan the QR code/);
+      }
+    }, {
+      NODE_OPTIONS: env.NODE_OPTIONS + ' --require=' + path.join(__dirname, 'vibe-auth-open-test-preload.cjs'),
+      TTMG_AUTH_OPEN_TEST_RECEIPT: receipt,
+      // Explicit --web must not inherit an old Mock backend setting.
+      TTMG_VIBE_BACKEND: 'mock',
+      TTMG_VIBE_TEST_RETAIN_UPLOAD_SOCKET: '1',
+    });
+    assert.equal(web.code, 0, web.stderr);
+    const output = events(web);
+    assert.equal(output.at(-1).status, 'uploaded');
+    assert.equal(output.at(-1).simulation, false);
+    assert.equal(output.at(-1).backend, 'ppe');
+    assert.equal(output.at(-1).readyForInput, true);
+    assert.equal(output.at(-1).uploadAttempted, true);
+    assert.equal(output.at(-1).uploaded, true);
+    assert.deepEqual(
+      { category: output.at(-1).classification.category, subcategory: output.at(-1).classification.subcategory },
+      expectedWebCategory);
+    assert.equal(output.at(-1).classification.source, format === 'json' ? 'defaults' : 'arguments');
+    assert.equal(output.at(-1).taskStatusRaw, 3);
+    assert.equal(output.filter(e => e.terminal).length, 1);
+    assert.equal(webPolls, 5, 'Only true backend readiness unlocks authorization');
+    assert.deepEqual(requests.slice(requestStart).map(r => r.path.split('/').filter(Boolean).at(-1)), [
+      'create_minis_import_task_for_agent', ...Array(5).fill('get_minis_import_task_status_for_agent'),
+      'upload_minis_import_app_icon_for_agent', 'submit_minis_import_info_for_agent', 'upload_minis_import_package_for_agent',
+    ]);
+    if (format === 'json') assert.equal(output.length, 1);
+    const opens = fs.readFileSync(receipt, 'utf8').trim().split('\n').map(line => JSON.parse(line));
+    assert.equal(opens.length, 1);
+    assert.ok(opens[0].args.some(arg => /^http:\/\/127\.0\.0\.1:\d+\/[a-f0-9]{48}\/authorize$/.test(arg)));
+    assert.doesNotMatch(JSON.stringify(opens) + web.stdout + web.stderr, /process-test-secret|import_token|web-icon-receipt|web-package-receipt|aweme:\/\//);
+  }
+  expectedWebCategory = {category: 'Other', subcategory: 'Other'};
+  webFailureEndpoint = '/bff/app_info/minis_import/submit_minis_import_info_for_agent/';
+  const failedStart = requests.length;
+  const webUploadFailure = await run([...input.filter(v => v !== '--no-open'), '--web', '--format', 'json'], undefined, {
+    NODE_OPTIONS: env.NODE_OPTIONS + ' --require=' + path.join(__dirname, 'vibe-auth-open-test-preload.cjs'),
+    TTMG_AUTH_OPEN_TEST_RECEIPT: path.join(temp, 'web-failure-open.ndjson'),
+    TTMG_VIBE_TEST_RETAIN_UPLOAD_SOCKET: '1',
+  });
+  assert.equal(webUploadFailure.code, 1);
+  const webFailure = events(webUploadFailure)[0];
+  assert.equal(webFailure.errorCode, 'VIBE_BACKEND_REJECTED');
+  assert.equal(webFailure.uploadAttempted, true);
+  assert.equal(webFailure.uploaded, false);
+  assert.equal(webFailure.simulation, false);
+  assert.equal(requests.at(-1).path, webFailureEndpoint);
+  assert.equal(requests.slice(failedStart).filter(r => r.path === webFailureEndpoint).length, 1);
+  webFailureEndpoint = undefined;
+  webMode = false;
+
   const json = await run(
     [...input, '--format', 'json', '--poll-interval', '0.01'],
     undefined,
@@ -377,10 +587,36 @@ async function main() {
   const badMode = await run(['upload', '--title', 'x', '--format', 'json']);
   assert.equal(badMode.code, 1);
   assert.equal(events(badMode)[0].errorCode, 'VIBE_OPTION_REQUIRES_VIBE');
+  const badCategoryMode = await run(['upload', '--category', 'Puzzle', '--subcategory', 'Physics', '--format', 'json']);
+  assert.equal(events(badCategoryMode)[0].errorCode, 'VIBE_OPTION_REQUIRES_VIBE');
+  const beforeCatalog = requests.length;
+  const catalog = await run(['game', 'categories', '--format', 'json']);
+  assert.equal(catalog.code, 0, catalog.stderr);
+  assert.equal(events(catalog).length, 1);
+  assert.equal(events(catalog)[0].categoryCount, 12);
+  assert.equal(events(catalog)[0].subcategoryCount, 114);
+  assert.equal(events(catalog)[0].platformWrite, false);
+  const filtered = await run(['game', 'categories', '--category', 'Puzzle', '--format', 'ndjson']);
+  assert.equal(filtered.code, 0);
+  assert.deepEqual(events(filtered)[0].categories.map(item => item.value), ['Puzzle']);
+  assert.ok(events(filtered)[0].categories[0].subcategories.every(item => item.description));
+  for (const [args, code] of [
+    [['--category', 'unknown'], 'GAME_CATEGORY_UNKNOWN'],
+    [['--format', 'xml'], 'GAME_CATEGORIES_INVALID_FORMAT'],
+  ]) {
+    const invalid = await run(['game', 'categories', '--format', 'json', ...args]);
+    assert.equal(invalid.code, 1);
+    assert.equal(events(invalid)[0].errorCode, code);
+    assert.equal(events(invalid)[0].platformWrite, false);
+  }
+  assert.equal(requests.length, beforeCatalog, 'Catalog commands must remain offline');
   const help = await run(['upload', '--help']);
   assert.equal(help.code, 0);
   assert.match(help.stdout, /--vibe/);
   assert.match(help.stdout, /--client-key/);
+  const authHelp = await run(['auth', 'open', '--help']);
+  assert.equal(authHelp.code, 0);
+  assert.match(authHelp.stdout, /--page-url/);
 
   let cancelledPage;
   const cancelled = await run(