@ttmg/cli 0.4.6-vibe-beta.6 → 0.4.6-vibe-beta.7

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttmg/cli",
-  "version": "0.4.6-vibe-beta.6",
+  "version": "0.4.6-vibe-beta.7",
   "description": "TikTok Mini Game Command Line Tool",
   "license": "ISC",
   "bin": {

package/dist/scripts/vibe-ppe-test-preload.cjs

@@ -0,0 +1,23 @@
+// Explicit test-process preload only; never loaded by the CLI. Replace HTTPS
+// transport with a local fixture so --mock regressions cannot create real tasks.
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const https = require('node:https');
+const port = Number(process.env.TTMG_VIBE_TEST_PORT);
+assert.ok(Number.isInteger(port) && port > 0 && port < 65536);
+https.request = (options, callback) => {
+  assert.equal(typeof options, 'object');
+  assert.equal(options.hostname, 'developers.tiktok.com');
+  assert.equal(options.protocol, 'https:');
+  assert.match(options.path, /^\/bff\/app_info\/minis_import\/(create_minis_import_task_for_agent|get_minis_import_task_status_for_agent)\//);
+  return http.request({
+    ...options,
+    protocol: 'http:', hostname: '127.0.0.1', host: undefined, port,
+    agent: undefined, servername: undefined,
+  }, callback);
+};
+https.get = (options, callback) => {
+  const request = https.request(options, callback);
+  request.end();
+  return request;
+};

package/dist/scripts/vibe-upload-demo.js

@@ -29,7 +29,7 @@ fs.writeFileSync(
   ),
 );
 console.error(
-  'MOCK demo: temporary game/image fixtures; no backend, login or phone scan.',
+  'Integration demo: creates a real PPE task; authorization and uploads are simulated. No environment setup or phone authorization required.',
 );
 const child = spawn(
   process.execPath,

package/dist/scripts/vibe-upload-smoke.js

@@ -4,6 +4,7 @@ const os = require('node:os');
 const path = require('node:path');
 const { spawn } = require('node:child_process');
 const archiver = require('archiver');
+const http = require('node:http');
 
 const entry = path.resolve(__dirname, '../dist/index.js');
 const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'ttmg-vibe-process-'));
@@ -23,6 +24,9 @@ const input = [
 const png =
   'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aXyoAAAAASUVORK5CYII=';
 const children = new Set();
+let fixtureServer;
+const requests = [];
+let failStatus = false;
 const env = {
   ...process.env,
   HOME: temp,
@@ -31,6 +35,7 @@ const env = {
   TTMG_VIBE_PAGE_TTL_MS: '7000',
   TTMG_VIBE_BACKEND: '',
   TTMG_VIBE_API: '',
+  TTMG_VIBE_PPE: '',
 };
 
 function run(args, onEvent, extraEnv = {}) {
@@ -94,6 +99,31 @@ function events(result) {
     .map(line => JSON.parse(line));
 }
 async function main() {
+  fixtureServer = http.createServer((req, res) => {
+    const url = new URL(req.url, 'http://127.0.0.1');
+    requests.push({ path: url.pathname, method: req.method, headers: req.headers });
+    req.resume();
+    const create = url.pathname.endsWith('/create_minis_import_task_for_agent/');
+    const status = url.pathname.endsWith('/get_minis_import_task_status_for_agent/');
+    assert.ok(create || status, 'Unexpected real upload endpoint');
+    assert.equal(req.headers['x-use-ppe'], '1');
+    assert.equal(req.headers['x-tt-env'], 'ppe_op_vc');
+    assert.equal(req.headers.cookie, undefined);
+    if (status) {
+      assert.equal(url.searchParams.get('task_id'), '7684370037737553941');
+      assert.equal(url.searchParams.get('import_token'), 'process-test-secret');
+    }
+    const data = create ? {
+      task_id: '7684370037737553941', import_token: 'process-test-secret',
+      landing_url: 'https://developers.tiktok.com/portal_h5/minis_import?import_token=process-test-secret',
+      poll_interval_seconds: 0.01,
+    } : { status: 1, ready_for_input: false };
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ...data, error_info: { code: failStatus && status ? 420500 : 0 } }));
+  });
+  await new Promise(resolve => fixtureServer.listen(0, '127.0.0.1', resolve));
+  env.TTMG_VIBE_TEST_PORT = String(fixtureServer.address().port);
+  env.NODE_OPTIONS = `--require ${JSON.stringify(path.join(__dirname, 'vibe-ppe-test-preload.cjs'))}`;
   fs.writeFileSync(icon, Buffer.from(png, 'base64'));
   await new Promise((resolve, reject) => {
     const out = fs.createWriteStream(zip);
@@ -117,9 +147,9 @@ async function main() {
   assert.equal(success.code, 0, success.stderr);
   assert.match(bindingHtml, /Upload to TikTok/);
   assert.match(bindingHtml, /class="game-avatar"/);
-  assert.match(bindingHtml, /Mock only/);
+  assert.match(bindingHtml, /PPE \+ Mock/);
   assert.match(bindingHtml, /data-phase="binding"/);
-  assert.match(bindingHtml, /无需扫码|no scan needed/);
+  assert.match(bindingHtml, /Phone authorization is not required/);
   assert.doesNotMatch(bindingHtml, /<form|<input/);
   const sequence = events(success);
   const final = sequence[sequence.length - 1];
@@ -129,7 +159,16 @@ async function main() {
   assert.equal(final.nextAction, 'none');
   assert.equal(sequence.filter(e => e.terminal).length, 1);
   assert.equal(final.uploaded, true);
-  assert.equal(final.platformWrite, false);
+  assert.equal(final.platformWrite, true);
+  assert.equal(final.backend, 'ppe-mock');
+  assert.equal(final.taskStatusRaw, 1);
+  assert.equal(final.readyForInput, false);
+  assert.equal(final.simulatedReadyForInput, true);
+  assert.equal(final.simulatedTaskStatusRaw, 3);
+  assert.equal(requests.length, 4);
+  assert.equal(requests[0].method, 'POST');
+  assert.ok(requests.slice(1).every(r => r.method === 'GET'));
+  assert.doesNotMatch(success.stdout, /process-test-secret/);
   assert.equal(final.simulation, true);
   const progress = sequence.filter(
     e => e.status === 'uploading' && e.loadedBytes !== undefined,
@@ -145,7 +184,7 @@ async function main() {
     1,
   );
   const previewHtml = await (await fetch(final.pageUrl)).text();
-  assert.match(previewHtml, /Upload complete/);
+  assert.match(previewHtml, /Simulated upload complete/);
   assert.match(previewHtml, /data-phase="complete"/);
   assert.doesNotMatch(previewHtml, /QR|preview|review|Publish to TikTok/);
 
@@ -160,6 +199,44 @@ async function main() {
   assert.equal(JSON.parse(json.stdout).simulation, true);
   assert.match(json.stderr, /http:\/\/127\.0\.0\.1:/);
 
+  const missingPpe = await run([...input, '--format', 'json'], undefined, {
+    TTMG_VIBE_BACKEND: 'ppe',
+  });
+  assert.equal(missingPpe.code, 1);
+  assert.equal(events(missingPpe)[0].errorCode, 'VIBE_INVALID_PPE_ENV');
+  assert.equal(events(missingPpe)[0].platformWrite, false);
+  const dryPpe = await run([...input, '--dry-run', '--format', 'json'], undefined, {
+    TTMG_VIBE_BACKEND: 'ppe', TTMG_VIBE_PPE: 'ppe_op_vc',
+  });
+  assert.equal(dryPpe.code, 0, dryPpe.stderr);
+  assert.equal(events(dryPpe)[0].status, 'prepared');
+  assert.equal(events(dryPpe)[0].platformWrite, false);
+  const missingHybrid = await run([...input, '--format', 'json'], undefined, {
+    TTMG_VIBE_BACKEND: 'ppe-mock',
+  });
+  assert.equal(events(missingHybrid)[0].errorCode, 'VIBE_INVALID_PPE_ENV');
+  assert.equal(events(missingHybrid)[0].platformWrite, false);
+  const dryHybrid = await run([...input, '--dry-run', '--format', 'json'], undefined, {
+    TTMG_VIBE_BACKEND: 'ppe-mock', TTMG_VIBE_PPE: 'ppe_op_vc',
+  });
+  assert.equal(dryHybrid.code, 0, dryHybrid.stderr);
+  assert.equal(events(dryHybrid)[0].status, 'prepared');
+  assert.equal(events(dryHybrid)[0].platformWrite, false);
+  const hybridMockOverride = await run([...input, '--mock', '--poll-interval', '0.01', '--format', 'json'], undefined, {
+    TTMG_VIBE_BACKEND: 'ppe-mock', TTMG_VIBE_PPE: 'ppe_op_vc',
+  });
+  assert.equal(hybridMockOverride.code, 0, hybridMockOverride.stderr);
+  assert.equal(events(hybridMockOverride)[0].backend, 'ppe-mock');
+  assert.equal(events(hybridMockOverride)[0].platformWrite, true);
+
+  failStatus = true;
+  const realFailure = await run([...input, '--mock', '--format', 'json']);
+  assert.equal(realFailure.code, 1, realFailure.stderr);
+  assert.equal(events(realFailure)[0].errorCode, 'VIBE_BACKEND_REJECTED');
+  assert.equal(events(realFailure)[0].uploadAttempted, false);
+  assert.equal(events(realFailure)[0].uploaded, false);
+  failStatus = false;
+
   for (const [scenario, errorCode, attempted] of [
     ['denied', 'VIBE_AUTH_DENIED', false],
     ['upload-failed', 'VIBE_BACKEND_REQUEST_FAILED', true],
@@ -193,6 +270,11 @@ async function main() {
   assert.equal(prepared.backend, 'none');
   assert.equal(prepared.pageUrl, undefined);
   assert.equal(prepared.uploadAttempted, false);
+  const beforeDryMock = requests.length;
+  const dryMock = await run([...input, '--mock', '--dry-run', '--format', 'json']);
+  assert.equal(dryMock.code, 0);
+  assert.equal(events(dryMock)[0].platformWrite, false);
+  assert.equal(requests.length, beforeDryMock);
 
   const project = path.join(temp, 'project');
   fs.mkdirSync(project);
@@ -254,5 +336,6 @@ main()
   })
   .finally(() => {
     for (const child of children) child.kill('SIGKILL');
+    fixtureServer?.close();
     fs.rmSync(temp, { recursive: true, force: true });
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttmg/cli",
-  "version": "0.4.6-vibe-beta.6",
+  "version": "0.4.6-vibe-beta.7",
   "description": "TikTok Mini Game Command Line Tool",
   "license": "ISC",
   "bin": {

package/vibe-upload.md

@@ -2,25 +2,21 @@
 
 ## 中文
 
-本次范围：本地准备 → 扫码绑定 → 上传头像 → 提交名称和头像信息 → 上传代码包 → 上传完成。不包含预览、审核或正式发布。当前可交付的是 Mock 与本地 HTTP 合同验证，尚未开放真实平台上传。
+本次范围：本地准备 → 扫码绑定 → 上传头像 → 提交名称和头像信息 → 上传代码包 → 上传完成。不包含预览、审核或正式发布。当前创建／查询接 PPE，授权和素材上传仍为模拟。
 
 ### 博华如何接入
 
-Skill 只引导开发者准备游戏名称、本地头像和工程，然后调用 CLI、读取结构化状态。不调用平台接口、不保存 Token、不自行轮询、不增加名称头像表单。
-
-开发环境先配置一次（属于运行配置，不写成 Skill 的流程分支）：
+继续使用 `--mock`，无需本地环境配置。CLI 内置 `ppe_op_vc` 创建任务，展示授权二维码，并查询三次真实状态；之后模拟授权和头像／信息／代码包上传。二维码可用于查看端内授权页，不要求完成授权。真实请求失败仍报错，素材不会上传到 PPE。上线时由 CLI 版本去掉 PPE 路由，Skill 不负责切换环境。
 
-```sh
-export TTMG_VIBE_BACKEND=mock
-```
+Skill 只引导开发者准备游戏名称、本地头像和工程，然后调用 CLI、读取结构化状态。不调用平台接口、不保存 Token、不自行轮询、不增加名称头像表单。
 
 Skill 固定调用：
 
 ```sh
-ttmg upload --vibe --dir ./game --title "星环守卫" --icon ./avatar.png --format ndjson
+ttmg upload --vibe --mock --dir ./game --title "星环守卫" --icon ./avatar.png --format ndjson
 ```
 
-未安装本地构建时，以 `node /绝对路径/cli/dist/index.js` 替换 `ttmg`。也可以显式传 `--mock`；命令行选择优先于环境配置。未来真实后端由 CLI 内部适配，Skill 的参数、状态分支和完成判定不需要跟着 HTTP 字段变化。
+未安装本地构建时，以 `node /绝对路径/cli/dist/index.js` 替换 `ttmg`。已调通的步骤接真实接口、未调通的步骤继续模拟，由 CLI 内部维护；Skill 不跟着 HTTP 字段和联调环境变化。
 
 可先检查素材，不创建 task、不打开页面：
 
@@ -45,15 +41,19 @@ ttmg upload --vibe --dir ./game --title "星环守卫" --icon ./avatar.png --dry
 
 固定字段：`schemaVersion`、`command`、`mode`、`operationId`、`ts`、`status`、`terminal`、`nextAction`、`message`、`backend`、`simulation`、`platformWrite`、`uploadAttempted`、`uploaded`、`errorCode`、`error`。
 
+从真实创建任务请求发起前开始 `platformWrite=true`，表示已尝试平台写入，不代表创建或上传成功。只有内部离线测试、本机 HTTP 和 dry-run 保持 `platformWrite=false`。
+
+`backend=ppe-mock` 时 `simulation=true`、`simulationStartsAt=authorization`；创建任务前开始 `platformWrite=true`。`taskStatusRaw`、`readyForInput` 始终保留最后一次真实查询值，模拟状态单独放在 `simulatedTaskStatusRaw`、`simulatedReadyForInput`。终态仍为 `uploaded`，但只表示模拟上传完成，不代表真实授权或上传成功；Skill 必须保留模拟提示。
+
 按阶段补充：`taskId`（字符串，禁止转成 JS Number）、`pollIntervalSeconds`、`readyForInput`、`taskStatusRaw`（仅诊断）、`uploadStep`、`loadedBytes`、`totalBytes`、`pageUrl`、`qrPurpose=authorization_binding`、素材大小和包 SHA256。代码包字节进度达到 100% 不代表成功，必须等待最终上传回执。
 
 `nextAction` 取值：`wait`、`scan_qr`、`fix_input`、`restart_authorization`、`check_task`、`none`。已开始上传后发生失败／超时，先检查 task，不能直接再次创建并重传。若上传已完成但页面失败，仍保留 `uploaded=true`，同时返回错误；Skill 提示上传已完成但展示失败。
 
-退出码：成功／dry-run 为 0，失败为 1，Ctrl+C 为 130。进程或宿主意外终止导致没有终态时，不得认定上传成功。Mock 必须显示为模拟：即使 `uploaded=true`，只表示模拟步骤完成，`simulation=true`、`platformWrite=false`，不是真实平台结果。
+退出码：成功／dry-run 为 0，失败为 1，Ctrl+C 为 130。进程或宿主意外终止导致没有终态时，不得认定上传成功。模拟必须显示为模拟：即使 `uploaded=true`，`simulation=true` 时也只表示模拟步骤完成。纯 Mock 的 `platformWrite=false`；混合联调创建过真实任务时为 true，但都不代表真实上传。
 
 ### Mock 覆盖与演示
 
-`npm run demo:vibe` 会构建并用临时工程和头像运行真实 CLI；真实检查和 ZIP 打包，模拟平台调用，无需手机或后端。结果页在进程结束后继续保留至到期。
+`npm run demo:vibe` 会构建并用临时工程和头像运行 CLI；真实检查、ZIP 打包和 PPE 创建／查询，模拟授权与上传。需要后端可访问，无需完成手机授权。结果页在进程结束后继续保留至到期。
 
 ```sh
 ttmg upload --vibe --package ./game.zip --title "测试游戏" --icon ./avatar.png --mock --format ndjson
@@ -73,7 +73,7 @@ ttmg upload --vibe --package ./game.zip --title "测试游戏" --icon ./avatar.p
 
 Mock 的 denied 是交互测试场景，真实端内拒绝授权如何映射错误仍待后端确认。Mock 不请求任何远端，不更改平台登录态，不创建真实应用。
 
-默认 Mock 轮询间隔 1 秒；其他适配使用创建任务返回的 `poll_interval_seconds`。`--poll-interval` 仅用于覆盖测试间隔。`--timeout` 是整体超时，默认 300 秒。不自动重试写接口、不实现跨进程续传。
+轮询间隔使用创建任务返回的 `poll_interval_seconds`，第三次真实查询后模拟授权。`--poll-interval` 仅用于覆盖测试间隔。`--timeout` 是整体超时，默认 300 秒。不自动重试写接口、不实现跨进程续传。
 
 ### 页面与素材
 
@@ -105,7 +105,7 @@ Mock 与本地 HTTP 共用请求构造、业务响应校验及状态映射，基
 TTMG_VIBE_BACKEND=local-http TTMG_VIBE_API=http://127.0.0.1:3100 ttmg upload --vibe --package ./game.zip --title "测试游戏" --icon ./avatar.png --format ndjson
 ```
 
-也可显式使用 `--vibe-api http://127.0.0.1:3100`。只接受回环 IP，不接受远端或 localhost，不跟随重定向、不读取 Cookie。没有配置则明确失败，不自动使用 Mock。该本地服务需实现上表协议；本轮没有开放 PPE／正式平台 HTTP 模式。真实接入后才能报告 platformWrite=true。
+维护者可使用 `--vibe-api http://127.0.0.1:3100` 验证本机 HTTP 合同，只接受回环 IP，不跟随重定向、不读取 Cookie；本地服务需实现上表协议。博华试用无需此选项，直接 `--mock`，PPE 路由由 CLI 内置。正式环境未开放。
 
 **v1 → v2 兼容性变化**：旧 UUID 换 Token 的三接口协议废弃，`--vibe-authorize-url` 返回明确错误；授权地址来自 landing_url。不再输出 preview_ready、game_preview、uploadId、reviewStatus。Skill 必须校验 schemaVersion=2，并按新终态处理。普通不带 --vibe 的 upload 不变。
 
@@ -121,17 +121,17 @@ TTMG_VIBE_BACKEND=local-http TTMG_VIBE_API=http://127.0.0.1:3100 ttmg upload --v
 
 ### Skill entry
 
-Scope: local preparation → authorization binding → avatar upload → app-info submission → package upload → **upload complete**. No preview, review or production release. Current backends are Mock and a loopback HTTP contract adapter; production upload is not enabled.
+Scope: local preparation → authorization binding → avatar upload → app-info submission → package upload → **upload complete**. No preview, review or production release. Mock and loopback HTTP cover this contract. PPE additionally supports real task creation, polling and the authorization QR only; material upload and production access are not enabled.
 
-Configure `TTMG_VIBE_BACKEND=mock` in the development environment. The Skill keeps one command:
+Keep the existing --mock command; no environment setup is required:
 
 ```sh
-ttmg upload --vibe --dir ./game --title "My game" --icon ./avatar.png --format ndjson
+ttmg upload --vibe --mock --dir ./game --title "My game" --icon ./avatar.png --format ndjson
 ```
 
 Use `--package ./game.zip` instead of --dir for a prepared ZIP. Use `--dry-run --format json` for local preparation only. When running a source build, replace ttmg with `node /absolute/path/cli/dist/index.js`. Explicit --mock or --vibe-api overrides environment selection; an unconfigured backend fails instead of silently simulating.
 
-The Skill gathers the title and user-selected local icon in conversation. It does not call backend APIs, store credentials, poll services, or introduce a metadata form. Backend selection belongs to environment configuration, not a Skill-specific branch.
+The Skill gathers the title and user-selected local icon in conversation. It does not call backend APIs, store credentials, poll services, or introduce a metadata form. The CLI internally connects working steps to PPE and simulates the remaining steps. Removing PPE at production launch is a CLI release change, not a Skill configuration step.
 
 ### Output and decisions
 
@@ -148,17 +148,21 @@ Schema **2** provides NDJSON snapshots under one operationId, with exactly one f
 
 Stable fields: schemaVersion, command, mode, operationId, ts, status, terminal, nextAction, message, backend, simulation, platformWrite, uploadAttempted, uploaded, errorCode, error. Optional evidence: taskId (string), taskStatusRaw (diagnostics only), pollIntervalSeconds, readyForInput, uploadStep, loadedBytes, totalBytes, pageUrl, qrPurpose=authorization_binding, sizes and packageSha256.
 
+platformWrite becomes true immediately before attempting real task creation, not as proof of successful creation or upload. Only injected offline tests, loopback HTTP and dry-run keep platformWrite=false.
+
+For backend=ppe-mock, simulation=true and simulationStartsAt=authorization. platformWrite becomes true before real task creation. taskStatusRaw and readyForInput retain the last real observation; simulatedTaskStatusRaw and simulatedReadyForInput describe the local demo separately. The uploaded terminal state means simulated completion only; the Skill must retain the simulation label.
+
 nextAction is wait, scan_qr, fix_input, restart_authorization, check_task or none. If upload was attempted, verify the task before retrying. If a result page fails after confirmed upload, uploaded remains true alongside the error. Progress at 100% is not a receipt. Missing terminal output after a killed process is not success. Exit codes: 0 success/dry-run, 1 failure, 130 cancellation.
 
-Mock always reports simulation=true and platformWrite=false; uploaded=true means simulated completion only. Neither backend exposes credentials or raw HTTP errors. Backend integration must preserve this public contract; changes to user actions or completion semantics require an explicit schema migration.
+Pure Mock reports simulation=true and platformWrite=false. Hybrid PPE + Mock reports platformWrite=true once real task creation is attempted, but uploaded=true still means simulated completion only. No backend exposes credentials or raw HTTP errors. Backend integration must preserve this public contract; changes to user actions or completion semantics require an explicit schema migration.
 
 ### Mock, UI and inputs
 
-Run `npm run demo:vibe` for the actual CLI with temporary game/icon fixtures. Local checking and ZIP creation are real; server operations are simulated without a phone or network. Scenarios: success, denied, expired, timeout, upload-failed, processing, icon-failed, info-failed. Use --mock-scenario and --timeout to test failures. Denial is a mock interaction scenario, not a confirmed backend error mapping.
+Run `npm run demo:vibe` for the CLI with temporary game/icon fixtures. Local checking, ZIP creation and PPE task creation/polling are real; authorization and uploads are simulated. Backend access is required, phone authorization is not. Scenarios: success, denied, expired, timeout, upload-failed, processing, icon-failed, info-failed. Use --mock-scenario and --timeout to test failures. Denial is a mock interaction scenario, not a confirmed backend error mapping.
 
 The same local page changes from binding QR to upload progress and completion, without preview QR or metadata form. Failures clear the binding QR. It listens only on 127.0.0.1, retains content in memory, and expires after 15 minutes; the phone scans the QR rather than visiting pageUrl. Success/failure pages remain after CLI completion; cancellation closes the page. Test TTL: TTMG_VIBE_PAGE_TTL_MS=1..900000.
 
-The mock uses a one-second polling interval and grants input on the third poll. Other adapters use poll_interval_seconds; --poll-interval is a testing override. The overall --timeout defaults to 300 seconds. No automatic write retries or cross-process resume.
+The trial follows poll_interval_seconds and simulates input readiness after the third real query; --poll-interval is a testing override. The overall --timeout defaults to 300 seconds. No automatic write retries or cross-process resume.
 
 The supplied title/icon/package bytes are fixed before authorization. Direct files are checked for size and signatures, not decoded or fully inspected. PNG/JPEG/WebP and 10 MiB icon / 100 MiB ZIP limits are provisional local guards, not confirmed platform rules. Project packaging excludes .ttmg, .env\*, PEM and KEY files, not every possible secret.
 
@@ -168,7 +172,11 @@ A non-secret source_project_id is persisted in .ttmg/vibe-project.json under the
 
 The five endpoint contracts are listed in the table above. Mock and loopback HTTP share request construction and response validation. The HTTP adapter implements POST create → GET status with task_id/import_token query parameters → Multipart icon → JSON app_info → Multipart package with asset_type=2 (Native). Multipart Content-Type includes its generated boundary; JSON i64 task IDs are encoded losslessly.
 
-A business-success response requires error_info.code=0. Package completion additionally requires package_uri and a valid non-failure status; no polling until SUCCEEDED. No platform Cookies or redirects are used. Configure TTMG_VIBE_BACKEND=local-http plus TTMG_VIBE_API=http://127.0.0.1:3100, or pass --vibe-api explicitly. Remote hosts are rejected. PPE/production wiring remains separate work.
+A business-success response requires error_info.code=0. Package completion additionally requires package_uri and a valid non-failure status; no polling until SUCCEEDED. No platform Cookies or redirects are used. Configure TTMG_VIBE_BACKEND=local-http plus TTMG_VIBE_API=http://127.0.0.1:3100, or pass --vibe-api explicitly; this option rejects remote hosts.
+
+For internal PPE integration, set TTMG_VIBE_BACKEND=ppe and TTMG_VIBE_PPE=ppe_op_vc without changing the Skill command. This uses real creation/polling on developers.tiktok.com and encodes the QR as aweme://webview?url=<encodeURIComponent(landing_url)>. The phone must use the same lane. OAuth is not bypassed or simulated. Complete upload inputs are not integrated yet: after authorization, VIBE_REAL_UPLOAD_NOT_READY stops the flow before any material upload. Production is not enabled.
+
+The normal --mock trial internally uses ppe_op_vc without environment variables. Task creation, QR and three polls are real; authorization, icon, app-info and package uploads are simulated with separate in-memory credentials. This changes --mock from an offline run into a PPE integration trial: platformWrite becomes true when task creation is attempted, while simulation remains true. No real material-upload endpoint is called, and real request failures still fail. --mock-scenario controls only simulated steps. Offline unit/process tests use injected transports, not a separate developer configuration.
 
 Schema-v1 UUID endpoints, --vibe-authorize-url, preview_ready, game_preview, uploadId and reviewStatus are retired. The deprecated option returns an explicit error. Ordinary upload without --vibe is unchanged.