@ttmg/cli 0.4.6-agent-beta.2 → 0.4.6-agent-beta.3

package/dist/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@ttmg/cli",
-  "version": "0.4.6-agent-beta.2",
+  "version": "0.4.6-agent-beta.3",
   "description": "TikTok Mini Game Command Line Tool",
   "license": "ISC",
   "bin": {
     "ttmg": "dist/index.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "vibe-upload.md"
   ],
   "publishConfig": {
     "access": "public",
@@ -15,7 +16,8 @@
   },
   "scripts": {
     "demo:vibe": "npm run build && node scripts/vibe-upload-demo.js",
-    "test:vibe": "node scripts/run-ts-test.js src/commands/common/vibe/vibe.test.ts",
+    "test:game-categories": "node scripts/run-ts-test.js src/commands/common/game/categories.test.ts",
+    "test:vibe": "npm run test:game-categories && node scripts/run-ts-test.js src/commands/common/vibe/vibe.test.ts",
     "test:vibe-process": "node scripts/vibe-upload-smoke.js",
     "prepack": "npm run build && npm run verify:dist-version && npm run verify:agent-contract",
     "build": "node scripts/build.js",
@@ -46,7 +48,7 @@
     "test:check-ai": "node scripts/run-ts-test.js src/commands/native/check/ai.test.ts",
     "test:build-structured": "node scripts/run-ts-test.js src/commands/native/build/build.test.ts",
     "test:doctor": "node scripts/run-ts-test.js src/commands/native/doctor/doctor.test.ts",
-    "test:wasm": "node scripts/run-ts-test.js src/commands/native/wasm/wasm.test.ts && node scripts/acceptance-fixture.test.js",
+    "test:wasm": "node scripts/run-ts-test.js src/commands/native/wasm/wasm.test.ts && node scripts/run-ts-test.js src/commands/native/wasm/collect.test.ts && node scripts/acceptance-fixture.test.js",
     "test:agent-contract": "npm run test:login && npm run test:auth && npm run test:capabilities && npm run test:test-account && npm run test:upload-preview && npm run test:preview-page && npm run test:check && npm run test:check-ai && npm run test:build-structured && npm run test:doctor && npm run test:wasm && npm run test:dev-session && npm run test:dev-session-command && npm run test:dev-runtime-event && npm run test:dev-runtime-client && npm run test:dev-session-control && npm run test:dev-runtime-session-follow && npm run test:dev-client-preview-orchestrator && npm run test:dev-watch-change && npm run test:network && npm run test:vibe && npx tsc --noEmit && npm run build && npm run test:vibe-process && npm run test:preview-page-process && npm run test:preview-page-detached && npm run verify:dist-version && npm run verify:agent-contract",
     "test:agent-contract:full": "npm run test:agent-contract && npm run test:dev-default-process && npm run test:dev-game-ready-process && npm run test:dev-client-preview-control-process && node scripts/dev-workflow-smoke.js",
     "publish:beta": "npm publish --registry=https://registry.npmjs.org/ --access public --tag beta",

package/dist/scripts/verify-agent-contract.js

@@ -126,6 +126,18 @@ const capabilitiesResult = runCli(['capabilities', '--format', 'json']);
 assertExit(capabilitiesResult, 0, 'capabilities');
 const capabilities = parseSingleJson(capabilitiesResult, 'capabilities');
 assert.equal(capabilities.command, 'capabilities');
+const gameCategories = runCli(['game', 'categories', '--format', 'json']);
+assertExit(gameCategories, 0, 'game categories');
+const categoryCatalog = parseSingleJson(gameCategories, 'game categories');
+assert.equal(categoryCatalog.platformWrite, false);
+assert.equal(categoryCatalog.categoryCount, 12);
+assert.equal(categoryCatalog.subcategoryCount, 114);
+assert.equal(capabilities.commands.gameCategories.catalogVersion, categoryCatalog.catalogVersion);
+assert.match(capabilities.commands.vibeUpload.command, /--vibe --web/);
+assert.equal(capabilities.commands.vibeUpload.skillWorkflow.keepUploadProcessRunning, true);
+assert.equal(capabilities.commands.vibeUpload.skillWorkflow.realUploadSuccess.simulation, false);
+assert.equal(capabilities.commands.vibeUpload.appInfoFields.defaultedByCli.includes('privacy_policy'), true);
+assert.equal(packageJson.files.includes('vibe-upload.md'), true);
 assert.equal(capabilities.structuredOutput.stdoutProtocolOnly, true);
 assert.equal(capabilities.commands.check.platformWrite, false);
 assert.equal(capabilities.commands.check.ai.option, '--ai');
@@ -385,7 +397,14 @@ assert.notEqual(
 );
 
 const uploadHelp = runCli(['upload', '--help']);
+assert.doesNotMatch(uploadHelp.stdout, /--app-info/);
+assert.match(uploadHelp.stdout.replace(/\s+/g, ' '), /only title and icon|只收集标题和头像/);
 assertExit(uploadHelp, 0, 'upload help');
+assert.match(uploadHelp.stdout, /--vibe --web --dir/);
+assert.match(uploadHelp.stdout, /authorizationOpenCommand/);
+assert.match(uploadHelp.stdout, /simulation=false/);
+assert.match(uploadHelp.stdout, /--category <category>/);
+assert.match(uploadHelp.stdout, /--subcategory <subcategory>/);
 assert.match(uploadHelp.stdout, /--preview\b/);
 assert.match(uploadHelp.stdout, /--serve-preview-page\b/);
 assert.match(uploadHelp.stdout, /--no-open\b/);
@@ -432,6 +451,17 @@ const wasmSmoke = spawnSync(process.execPath, [path.join(cliRoot, 'scripts/wasm-
 });
 assertExit(wasmSmoke, 0, 'Wasm built-artifact process smoke');
 console.log(wasmSmoke.stdout.trim());
+for (const operation of ['start', 'export']) {
+  assertExit(runWithoutWasmBinding(['wasm', 'collect', operation, '--help']), 0, `collect ${operation} help without binding`);
+  const invalid = runCli(['wasm', 'collect', operation, '--format', 'json']);
+  assertExit(invalid, 1, `collect ${operation} missing input`);
+  assert.equal(parseSingleJson(invalid, `collect ${operation}`).errorCode, 'WASM_COLLECT_INVALID_OPTIONS');
+}
+const collectSmoke = spawnSync(process.execPath, [path.join(cliRoot, 'scripts/wasm-collect-smoke.js')], {
+  cwd: cliRoot, encoding: 'utf8', timeout: 60000,
+});
+assertExit(collectSmoke, 0, 'Wasm collection built-artifact process smoke');
+console.log(collectSmoke.stdout.trim());
 const captureHelp = runCli(['dev', 'capture', '--help']);
 assertExit(captureHelp, 0, 'capture help');
 assert.match(captureHelp.stdout, /--timeout/);

package/dist/scripts/vibe-ppe-test-preload.cjs

@@ -3,18 +3,32 @@
 const assert = require('node:assert/strict');
 const http = require('node:http');
 const https = require('node:https');
+const net = require('node:net');
 const port = Number(process.env.TTMG_VIBE_TEST_PORT);
 assert.ok(Number.isInteger(port) && port > 0 && port < 65536);
 https.request = (options, callback) => {
   assert.equal(typeof options, 'object');
   assert.equal(options.hostname, 'developers.tiktok.com');
   assert.equal(options.protocol, 'https:');
-  assert.match(options.path, /^\/bff\/app_info\/minis_import\/(create_minis_import_task_for_agent|get_minis_import_task_status_for_agent)\//);
-  return http.request({
+  assert.match(options.path, /^\/bff\/app_info\/minis_import\/(create_minis_import_task_for_agent|get_minis_import_task_status_for_agent|upload_minis_import_app_icon_for_agent|submit_minis_import_info_for_agent|upload_minis_import_package_for_agent)\//);
+  const request = http.request({
     ...options,
     protocol: 'http:', hostname: '127.0.0.1', host: undefined, port,
     agent: undefined, servername: undefined,
   }, callback);
+  if (process.env.TTMG_VIBE_TEST_RETAIN_UPLOAD_SOCKET === '1' &&
+      /upload_minis_import_(app_icon|package)_for_agent/.test(options.path)) {
+    // Reproduce the live gateway's completed response with a retained upload
+    // socket. The socket is real but loopback-only; operation cleanup must close it.
+    assert.ok(options.agent && options.agent !== https.globalAgent);
+    request.once('response', response => response.once('end', () => {
+      const socket = net.connect({host: '127.0.0.1', port});
+      const key = 'retained-vibe-test-sockets';
+      (options.agent.sockets[key] ||= []).push(socket);
+      socket.on('error', () => {});
+    }));
+  }
+  return request;
 };
 https.get = (options, callback) => {
   const request = https.request(options, callback);

package/dist/scripts/vibe-upload-smoke.js

@@ -27,6 +27,10 @@ const children = new Set();
 let fixtureServer;
 const requests = [];
 let failStatus = false;
+let webMode = false;
+let webPolls = 0;
+let webFailureEndpoint;
+let expectedWebCategory = { category: 'Other', subcategory: 'Other' };
 const env = {
   ...process.env,
   HOME: temp,
@@ -96,7 +100,16 @@ function events(result) {
   return result.stdout
     .trim()
     .split('\n')
-    .map(line => JSON.parse(line));
+    .map(line => {
+      const event = JSON.parse(line);
+      if (event.mode === 'vibe') {
+        assert.deepEqual(event.inputRequirements.requiredUserInputs, ['title', 'icon']);
+        assert.equal(event.inputRequirements.requestAdditionalMetadata, false);
+        assert.equal(event.inputRequirements.additionalMetadataSource, 'cli-defaults');
+        assert.equal(event.inputRequirements.defaultMetadataProfile, 'ppe-trial');
+      }
+      return event;
+    });
 }
 async function main() {
   // Exercise the built worker IPC and new command without creating a platform task.
@@ -150,13 +163,20 @@ async function main() {
   assert.equal(fs.readFileSync(browserReceipt, 'utf8').trim().split('\n').length, 2);
   authWorker.kill();
   children.delete(authWorker);
-  fixtureServer = http.createServer((req, res) => {
+  fixtureServer = http.createServer(async (req, res) => {
     const url = new URL(req.url, 'http://127.0.0.1');
     requests.push({ path: url.pathname, method: req.method, headers: req.headers });
-    req.resume();
+    const chunks = [];
+    for await (const chunk of req) chunks.push(chunk);
+    const body = Buffer.concat(chunks);
     const create = url.pathname.endsWith('/create_minis_import_task_for_agent/');
     const status = url.pathname.endsWith('/get_minis_import_task_status_for_agent/');
-    assert.ok(create || status, 'Unexpected real upload endpoint');
+    const iconUpload = url.pathname.endsWith('/upload_minis_import_app_icon_for_agent/');
+    const infoUpload = url.pathname.endsWith('/submit_minis_import_info_for_agent/');
+    const packageUpload = url.pathname.endsWith('/upload_minis_import_package_for_agent/');
+    if (create) webPolls = 0;
+    if (status && webMode) webPolls++;
+    assert.ok(create || status || (webMode && (iconUpload || infoUpload || packageUpload)), 'Mock must not call material-upload endpoints');
     assert.equal(req.headers['x-use-ppe'], '1');
     assert.equal(req.headers['x-tt-env'], 'ppe_op_vc');
     assert.equal(req.headers.cookie, undefined);
@@ -164,13 +184,41 @@ async function main() {
       assert.equal(url.searchParams.get('task_id'), '7684370037737553941');
       assert.equal(url.searchParams.get('import_token'), 'process-test-secret');
     }
+    if (iconUpload || infoUpload || packageUpload) {
+      assert.equal(webPolls, 5, 'Do not upload before server readiness');
+      assert.equal(req.method, 'POST');
+      if (infoUpload) {
+        assert.match(body.toString(), /"task_id":7684370037737553941/);
+        const info = JSON.parse(body.toString());
+        assert.equal(info.import_token, 'process-test-secret');
+        assert.equal(info.app_info.icon_uri, 'web-icon-receipt');
+        assert.equal(info.app_info.app_name, input[input.indexOf('--title') + 1]);
+        assert.deepEqual(info.app_info, {
+          description: 'DevTool PPE integration test fixture. Not a production game.',
+          ...expectedWebCategory,
+          terms_of_service: 'https://www.tiktok.com',
+          privacy_policy: 'https://www.tiktok.com',
+          copyright_confirmation: true, contact_email: 'devtool-test@example.invalid',
+          app_name: input[input.indexOf('--title') + 1], icon_uri: 'web-icon-receipt',
+        }, 'CLI must send complete PPE trial defaults without asking the user for them');
+      } else {
+        assert.match(req.headers['content-type'], /^multipart\/form-data; boundary=/);
+        assert.match(body.toString(), /name="task_id"\r\n\r\n7684370037737553941\r\n/);
+        assert.match(body.toString(), /name="import_token"\r\n\r\nprocess-test-secret\r\n/);
+        assert.ok(body.includes(fs.readFileSync(iconUpload ? icon : zip)));
+        if (packageUpload) assert.match(body.toString(), /name="asset_type"\r\n\r\n2\r\n/);
+      }
+    }
     const data = create ? {
       task_id: '7684370037737553941', import_token: 'process-test-secret',
-      landing_url: 'https://developers.tiktok.com/portal_h5/minis_import?import_token=process-test-secret',
+      landing_url: 'https://developers.tiktok.com/portal_h5/minis_import?task_id=7684370037737553941&import_token=process-test-secret',
       poll_interval_seconds: 0.01,
-    } : { status: 1, ready_for_input: false };
+    } : iconUpload ? {icon_uri: 'web-icon-receipt'}
+      : infoUpload ? {}
+      : packageUpload ? {status: 3, package_uri: 'web-package-receipt'}
+      : { status: webMode && webPolls >= 5 ? 2 : 1, ready_for_input: webMode && webPolls >= 5 };
     res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ ...data, error_info: { code: failStatus && status ? 420500 : 0 } }));
+    res.end(JSON.stringify({ ...data, error_info: { code: (failStatus && status) || url.pathname === webFailureEndpoint ? 420500 : 0 } }));
   });
   await new Promise(resolve => fixtureServer.listen(0, '127.0.0.1', resolve));
   env.TTMG_VIBE_TEST_PORT = String(fixtureServer.address().port);
@@ -189,6 +237,13 @@ async function main() {
 
   let bindingHtml;
   const appInfoPath = path.join(temp, 'app-info.json');
+  const invalidLegacy = await run([...input, '--app-info', appInfoPath, '--dry-run', '--format', 'json']);
+  assert.equal(invalidLegacy.code, 1);
+  const legacyFailure = events(invalidLegacy)[0];
+  assert.equal(legacyFailure.errorCode, 'VIBE_INVALID_APP_INFO');
+  assert.equal(legacyFailure.platformWrite, false);
+  assert.match(legacyFailure.message, /Remove --app-info|移除 --app-info/);
+  assert.doesNotMatch(legacyFailure.message, /are required|需要简介/);
   fs.writeFileSync(appInfoPath, JSON.stringify({
     description: 'Process contract fixture', category: 'Casual', subcategory: 'Puzzle',
     terms_of_service: 'https://example.invalid/terms', privacy_policy: 'https://example.invalid/privacy',
@@ -207,6 +262,14 @@ async function main() {
   const completeDry = await run([...input, '--app-info', appInfoPath, '--dry-run', '--format', 'json']);
   assert.equal(completeDry.code, 0, completeDry.stderr);
   assert.equal(events(completeDry)[0].status, 'prepared');
+  assert.equal(events(completeDry)[0].classification.category, 'Casual');
+  assert.equal(events(completeDry)[0].classification.subcategory, 'Puzzle');
+  assert.equal(events(completeDry)[0].classification.source, 'app-info');
+  const overrideDry = await run([...input, '--app-info', appInfoPath, '--category', 'Puzzle', '--subcategory', 'Physics', '--dry-run', '--format', 'json']);
+  assert.equal(overrideDry.code, 0, overrideDry.stderr);
+  assert.equal(events(overrideDry)[0].classification.category, 'Puzzle');
+  assert.equal(events(overrideDry)[0].classification.subcategory, 'Physics');
+  assert.equal(events(overrideDry)[0].classification.source, 'arguments');
   assert.equal(requests.length, 0);
   fs.writeFileSync(appInfoPath, '{private-token');
   const badInfo = await run([...input, '--mock', '--app-info', appInfoPath, '--format', 'json']);
@@ -310,6 +373,102 @@ async function main() {
   assert.match(previewHtml, /data-phase="complete"/);
   assert.doesNotMatch(previewHtml, /QR|preview|review|Publish to TikTok/);
 
+  const beforeWeb = requests.length;
+  const webConflict = await run([...input, '--web', '--mock', '--format', 'json']);
+  assert.equal(events(webConflict)[0].errorCode, 'VIBE_WEB_OPTION_CONFLICT');
+  const legacyWeb = await run(['upload', '--web', '--format', 'json']);
+  assert.equal(events(legacyWeb)[0].errorCode, 'VIBE_OPTION_REQUIRES_VIBE');
+  assert.equal(requests.length, beforeWeb);
+  for (const [args, code] of [
+    [['--category', 'Puzzle'], 'VIBE_CATEGORY_PAIR_REQUIRED'],
+    [['--subcategory', 'Physics'], 'VIBE_CATEGORY_PAIR_REQUIRED'],
+    [['--category', 'Other', '--subcategory', 'Physics'], 'VIBE_INVALID_CATEGORY'],
+    [['--category', 'Unknown', '--subcategory', 'Other'], 'VIBE_INVALID_CATEGORY'],
+    [['--category', '', '--subcategory', ''], 'VIBE_INVALID_CATEGORY'],
+  ]) {
+    const invalid = await run([...input.filter(v => v !== '--no-open'), '--web', ...args, '--format', 'json']);
+    assert.equal(invalid.code, 1);
+    const result = events(invalid)[0];
+    assert.equal(result.errorCode, code);
+    assert.equal(result.platformWrite, false);
+    assert.equal(result.taskId, undefined);
+    assert.equal(result.pageUrl, undefined);
+  }
+  assert.equal(requests.length, beforeWeb, 'Invalid classification must not create tasks or upload');
+  webMode = true;
+  for (const format of ['json', 'ndjson']) {
+    expectedWebCategory = format === 'json' ? {category: 'Other', subcategory: 'Other'} : {category: 'Puzzle', subcategory: 'Physics'};
+    const categoryArgs = format === 'json' ? [] : ['--category', 'Puzzle', '--subcategory', 'Physics'];
+    const receipt = path.join(temp, `upload-web-${format}.ndjson`);
+    const requestStart = requests.length;
+    const web = await run([...input.filter(v => v !== '--no-open'), '--web', ...categoryArgs, '--format', format, '--poll-interval', '0.2'], async event => {
+      if (event.status === 'prepared') assert.deepEqual(
+        {category: event.classification.category, subcategory: event.classification.subcategory},
+        expectedWebCategory);
+      if (event.status === 'waiting_authorization') {
+        assert.equal(event.authorizationMode, 'web');
+        assert.equal(event.browserOpenRequested, true);
+        assert.equal(event.simulation, false);
+        assert.equal(event.nextAction, 'open_browser');
+        assert.equal(event.qrPurpose, undefined);
+        const response = await fetch(event.pageUrl + '/authorize', {redirect: 'manual'});
+        assert.equal(response.status, 302);
+        assert.match(response.headers.get('location'), /^https:\/\/developers\.tiktok\.com\/portal_h5\/minis_import\?/);
+        const html = await (await fetch(event.pageUrl)).text();
+        assert.match(html, /Authorize in your browser/);
+        assert.doesNotMatch(html, /alt="Authorization QR"|Scan the QR code/);
+      }
+    }, {
+      NODE_OPTIONS: env.NODE_OPTIONS + ' --require=' + path.join(__dirname, 'vibe-auth-open-test-preload.cjs'),
+      TTMG_AUTH_OPEN_TEST_RECEIPT: receipt,
+      // Explicit --web must not inherit an old Mock backend setting.
+      TTMG_VIBE_BACKEND: 'mock',
+      TTMG_VIBE_TEST_RETAIN_UPLOAD_SOCKET: '1',
+    });
+    assert.equal(web.code, 0, web.stderr);
+    const output = events(web);
+    assert.equal(output.at(-1).status, 'uploaded');
+    assert.equal(output.at(-1).simulation, false);
+    assert.equal(output.at(-1).backend, 'ppe');
+    assert.equal(output.at(-1).readyForInput, true);
+    assert.equal(output.at(-1).uploadAttempted, true);
+    assert.equal(output.at(-1).uploaded, true);
+    assert.deepEqual(
+      { category: output.at(-1).classification.category, subcategory: output.at(-1).classification.subcategory },
+      expectedWebCategory);
+    assert.equal(output.at(-1).classification.source, format === 'json' ? 'defaults' : 'arguments');
+    assert.equal(output.at(-1).taskStatusRaw, 3);
+    assert.equal(output.filter(e => e.terminal).length, 1);
+    assert.equal(webPolls, 5, 'Only true backend readiness unlocks authorization');
+    assert.deepEqual(requests.slice(requestStart).map(r => r.path.split('/').filter(Boolean).at(-1)), [
+      'create_minis_import_task_for_agent', ...Array(5).fill('get_minis_import_task_status_for_agent'),
+      'upload_minis_import_app_icon_for_agent', 'submit_minis_import_info_for_agent', 'upload_minis_import_package_for_agent',
+    ]);
+    if (format === 'json') assert.equal(output.length, 1);
+    const opens = fs.readFileSync(receipt, 'utf8').trim().split('\n').map(line => JSON.parse(line));
+    assert.equal(opens.length, 1);
+    assert.ok(opens[0].args.some(arg => /^http:\/\/127\.0\.0\.1:\d+\/[a-f0-9]{48}\/authorize$/.test(arg)));
+    assert.doesNotMatch(JSON.stringify(opens) + web.stdout + web.stderr, /process-test-secret|import_token|web-icon-receipt|web-package-receipt|aweme:\/\//);
+  }
+  expectedWebCategory = {category: 'Other', subcategory: 'Other'};
+  webFailureEndpoint = '/bff/app_info/minis_import/submit_minis_import_info_for_agent/';
+  const failedStart = requests.length;
+  const webUploadFailure = await run([...input.filter(v => v !== '--no-open'), '--web', '--format', 'json'], undefined, {
+    NODE_OPTIONS: env.NODE_OPTIONS + ' --require=' + path.join(__dirname, 'vibe-auth-open-test-preload.cjs'),
+    TTMG_AUTH_OPEN_TEST_RECEIPT: path.join(temp, 'web-failure-open.ndjson'),
+    TTMG_VIBE_TEST_RETAIN_UPLOAD_SOCKET: '1',
+  });
+  assert.equal(webUploadFailure.code, 1);
+  const webFailure = events(webUploadFailure)[0];
+  assert.equal(webFailure.errorCode, 'VIBE_BACKEND_REJECTED');
+  assert.equal(webFailure.uploadAttempted, true);
+  assert.equal(webFailure.uploaded, false);
+  assert.equal(webFailure.simulation, false);
+  assert.equal(requests.at(-1).path, webFailureEndpoint);
+  assert.equal(requests.slice(failedStart).filter(r => r.path === webFailureEndpoint).length, 1);
+  webFailureEndpoint = undefined;
+  webMode = false;
+
   const json = await run(
     [...input, '--format', 'json', '--poll-interval', '0.01'],
     undefined,
@@ -428,6 +587,29 @@ async function main() {
   const badMode = await run(['upload', '--title', 'x', '--format', 'json']);
   assert.equal(badMode.code, 1);
   assert.equal(events(badMode)[0].errorCode, 'VIBE_OPTION_REQUIRES_VIBE');
+  const badCategoryMode = await run(['upload', '--category', 'Puzzle', '--subcategory', 'Physics', '--format', 'json']);
+  assert.equal(events(badCategoryMode)[0].errorCode, 'VIBE_OPTION_REQUIRES_VIBE');
+  const beforeCatalog = requests.length;
+  const catalog = await run(['game', 'categories', '--format', 'json']);
+  assert.equal(catalog.code, 0, catalog.stderr);
+  assert.equal(events(catalog).length, 1);
+  assert.equal(events(catalog)[0].categoryCount, 12);
+  assert.equal(events(catalog)[0].subcategoryCount, 114);
+  assert.equal(events(catalog)[0].platformWrite, false);
+  const filtered = await run(['game', 'categories', '--category', 'Puzzle', '--format', 'ndjson']);
+  assert.equal(filtered.code, 0);
+  assert.deepEqual(events(filtered)[0].categories.map(item => item.value), ['Puzzle']);
+  assert.ok(events(filtered)[0].categories[0].subcategories.every(item => item.description));
+  for (const [args, code] of [
+    [['--category', 'unknown'], 'GAME_CATEGORY_UNKNOWN'],
+    [['--format', 'xml'], 'GAME_CATEGORIES_INVALID_FORMAT'],
+  ]) {
+    const invalid = await run(['game', 'categories', '--format', 'json', ...args]);
+    assert.equal(invalid.code, 1);
+    assert.equal(events(invalid)[0].errorCode, code);
+    assert.equal(events(invalid)[0].platformWrite, false);
+  }
+  assert.equal(requests.length, beforeCatalog, 'Catalog commands must remain offline');
   const help = await run(['upload', '--help']);
   assert.equal(help.code, 0);
   assert.match(help.stdout, /--vibe/);

package/dist/scripts/wasm-collect-smoke.js

@@ -0,0 +1,78 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const http = require('node:http');
+const { spawn } = require('node:child_process');
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ttmg-collect-process-'));
+const entry = path.resolve(__dirname, '../dist/index.js');
+const preload = path.resolve(__dirname, 'wasm-collect-test-preload.cjs');
+const input = path.join(root, 'original.wasm');
+const wasm = Buffer.from('0061736d010000000105016000017f0304030000000404017000030707010372756e00000909010041000b030001020a1003040010010b0400412a0b040041070b', 'hex');
+fs.writeFileSync(input, wasm);
+const md5 = crypto.createHash('md5').update(wasm).digest('hex');
+const rc = path.join(root, 'rc.json');
+const secret = 'sessionid=TEST_ONLY_COLLECT_SECRET';
+fs.writeFileSync(rc, JSON.stringify({ cookie: secret }));
+let mode = 'success'; const calls = [];
+const server = http.createServer(async (req, res) => {
+  let body = ''; for await (const b of req) body += b;
+  calls.push({ url: req.url, method: req.method, body: body ? JSON.parse(body) : null, cookie: req.headers.cookie });
+  res.setHeader('content-type', 'application/json');
+  const data = mode === 'auth' ? { code: -401, message: secret }
+    : req.url.includes('/start') ? { code: 0, collect_state: 'open', cookie: secret }
+      : { code: 0, func_ids: [1, 0, 1], boot_func_ids: [0], cookie: secret };
+  res.end(JSON.stringify(data));
+});
+async function run(args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, ['-r', preload, entry, ...args], { cwd: root,
+      env: { ...process.env, TTMGRC_PATH: rc, TTMG_COLLECT_TEST_PORT: String(server.address().port),
+        HTTP_PROXY: '', HTTPS_PROXY: '', ALL_PROXY: '', http_proxy: '', https_proxy: '', all_proxy: '',
+        NO_COLOR: '1', FORCE_COLOR: '0' } });
+    let stdout = '', stderr = '';
+    child.stdout.on('data', b => stdout += b); child.stderr.on('data', b => stderr += b);
+    const timer = setTimeout(() => { child.kill('SIGKILL'); reject(Error('CLI timeout')); }, 15000);
+    child.on('error', reject); child.on('close', code => { clearTimeout(timer); resolve({ code, stdout, stderr }); });
+  });
+}
+function result(r, code = 0) {
+  assert.equal(r.code, code, r.stderr || r.stdout);
+  assert.equal(r.stdout.trim().split('\n').length, 1, r.stdout);
+  assert.equal((r.stdout+r.stderr).includes(secret), false);
+  return JSON.parse(r.stdout);
+}
+(async () => {
+  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+  const args = ['--client-key','fixture','--wasm-md5',md5,'--format','json'];
+  const a = result(await run(['wasm','collect','start', ...args, '--verbose']));
+  assert.equal(a.collectState,'open'); assert.equal(calls[0].cookie,secret);
+  assert.equal(calls[0].body.reset,false);
+  result(await run(['wasm','collect','start',...args,'--reset']));
+  assert.equal(calls[1].body.reset,true);
+  const beforeDefault = calls.length;
+  const defaultJson = result(await run(['--verbose', 'wasm','collect','start','--client-key','fixture','--wasm-md5',md5]));
+  assert.equal(defaultJson.collectState,'open');assert.equal(calls.length,beforeDefault+1);
+  const output=path.join(root,'collection.json');
+  const exported=result(await run(['wasm','collect','export',...args,'--input',input,'--output',output,'--verbose']));
+  assert.equal(exported.collection.path,output);assert.equal(calls[3].method,'GET');
+  assert.equal(calls[3].cookie,secret);assert.match(calls[3].url,/strategy=union/);
+  const collection=JSON.parse(fs.readFileSync(output,'utf8'));
+  assert.deepEqual(collection.funcIds,[0,1]);assert.deepEqual(collection.bootFuncIds,[0]);
+  assert.equal(fs.readFileSync(output,'utf8').includes(secret),false);
+  const split=result(await run(['wasm','split','--input',input,'--collection',output,
+    '--output',path.join(root,'split'),'--dry-run','--format','json']));
+  assert.equal(split.status,'ready');
+  mode='auth';
+  assert.equal(result(await run(['wasm','collect','start',...args,'--verbose']),1).errorCode,'WASM_AUTH_REQUIRED');
+  const count=calls.length;fs.writeFileSync(rc,'{}');
+  assert.equal(result(await run(['wasm','collect','start',...args]),1).errorCode,'WASM_AUTH_REQUIRED');
+  assert.equal(calls.length,count);
+  const unknown=await run(['wasm','collect','export',...args,'--reset']);assert.notEqual(unknown.code,0);
+  assert.equal(calls.length,count);
+  assert.deepEqual(fs.readFileSync(input),wasm);
+  console.log('Wasm collect process contract passed: local login transport, reset, export-to-split, clean verbose output; fixture only');
+})().catch(e => { console.error(e); process.exitCode=1; }).finally(() => {
+  server.closeAllConnections();server.close();fs.rmSync(root,{recursive:true,force:true});
+});

package/dist/scripts/wasm-collect-test-preload.cjs

@@ -0,0 +1,13 @@
+// Test-only transport: credentials and platform responses are synthetic.
+const assert = require('node:assert/strict');
+const https = require('node:https');
+const http = require('node:http');
+const port = Number(process.env.TTMG_COLLECT_TEST_PORT);
+assert.ok(Number.isInteger(port) && port > 0 && port < 65536);
+https.request = (options, callback) => {
+  assert.equal(options.hostname, 'developers.tiktok.com');
+  assert.match(options.path, /^\/api\/wasm-collect\/v1\/(start|export)(\?|$)/);
+  return http.request({ ...options, protocol: 'http:', hostname: '127.0.0.1', host: undefined,
+    port, agent: undefined, servername: undefined }, callback);
+};
+https.get = (options, callback) => { const req = https.request(options, callback); req.end(); return req; };

package/package.json

@@ -1,13 +1,14 @@
 {
   "name": "@ttmg/cli",
-  "version": "0.4.6-agent-beta.2",
+  "version": "0.4.6-agent-beta.3",
   "description": "TikTok Mini Game Command Line Tool",
   "license": "ISC",
   "bin": {
     "ttmg": "dist/index.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "vibe-upload.md"
   ],
   "publishConfig": {
     "access": "public",
@@ -15,7 +16,8 @@
   },
   "scripts": {
     "demo:vibe": "npm run build && node scripts/vibe-upload-demo.js",
-    "test:vibe": "node scripts/run-ts-test.js src/commands/common/vibe/vibe.test.ts",
+    "test:game-categories": "node scripts/run-ts-test.js src/commands/common/game/categories.test.ts",
+    "test:vibe": "npm run test:game-categories && node scripts/run-ts-test.js src/commands/common/vibe/vibe.test.ts",
     "test:vibe-process": "node scripts/vibe-upload-smoke.js",
     "prepack": "npm run build && npm run verify:dist-version && npm run verify:agent-contract",
     "build": "node scripts/build.js",
@@ -46,7 +48,7 @@
     "test:check-ai": "node scripts/run-ts-test.js src/commands/native/check/ai.test.ts",
     "test:build-structured": "node scripts/run-ts-test.js src/commands/native/build/build.test.ts",
     "test:doctor": "node scripts/run-ts-test.js src/commands/native/doctor/doctor.test.ts",
-    "test:wasm": "node scripts/run-ts-test.js src/commands/native/wasm/wasm.test.ts && node scripts/acceptance-fixture.test.js",
+    "test:wasm": "node scripts/run-ts-test.js src/commands/native/wasm/wasm.test.ts && node scripts/run-ts-test.js src/commands/native/wasm/collect.test.ts && node scripts/acceptance-fixture.test.js",
     "test:agent-contract": "npm run test:login && npm run test:auth && npm run test:capabilities && npm run test:test-account && npm run test:upload-preview && npm run test:preview-page && npm run test:check && npm run test:check-ai && npm run test:build-structured && npm run test:doctor && npm run test:wasm && npm run test:dev-session && npm run test:dev-session-command && npm run test:dev-runtime-event && npm run test:dev-runtime-client && npm run test:dev-session-control && npm run test:dev-runtime-session-follow && npm run test:dev-client-preview-orchestrator && npm run test:dev-watch-change && npm run test:network && npm run test:vibe && npx tsc --noEmit && npm run build && npm run test:vibe-process && npm run test:preview-page-process && npm run test:preview-page-detached && npm run verify:dist-version && npm run verify:agent-contract",
     "test:agent-contract:full": "npm run test:agent-contract && npm run test:dev-default-process && npm run test:dev-game-ready-process && npm run test:dev-client-preview-control-process && node scripts/dev-workflow-smoke.js",
     "publish:beta": "npm publish --registry=https://registry.npmjs.org/ --access public --tag beta",