@ttmg/cli 0.4.6-vibe-beta.7 → 0.4.6-vibe-beta.8

package/dist/scripts/vibe-upload-smoke.js

@@ -27,6 +27,8 @@ const children = new Set();
 let fixtureServer;
 const requests = [];
 let failStatus = false;
+let webMode = false;
+let webPolls = 0;
 const env = {
   ...process.env,
   HOME: temp,
@@ -99,12 +101,65 @@ function events(result) {
     .map(line => JSON.parse(line));
 }
 async function main() {
+  // Exercise the built worker IPC and new command without creating a platform task.
+  const authWorker = spawn(process.execPath, [entry, '__vibe-page-server'], {
+    env: {...env, TTMG_VIBE_PAGE_TTL_MS: '30000'}, stdio: ['ignore', 'ignore', 'ignore', 'ipc'],
+  });
+  children.add(authWorker);
+  const workerMessage = predicate => new Promise((resolve, reject) => {
+    const timer = setTimeout(() => {authWorker.off('message', receive); reject(new Error('worker timeout'));}, 5000);
+    function receive(message) {
+      if (predicate(message)) {clearTimeout(timer); authWorker.off('message', receive); resolve(message);}
+    }
+    authWorker.on('message', receive);
+  });
+  const ready = await workerMessage(message => message.type === 'ready');
+  const landing = 'https://developers.tiktok.com/portal_h5/minis_import?task_id=123&import_token=process-private-token';
+  let rendered = workerMessage(message => message.type === 'rendered' && message.id === 1);
+  authWorker.send({type: 'render', id: 1, html: '<h1>Waiting</h1>', browserLandingUrl: landing});
+  await rendered;
+  const browserReceipt = path.join(temp, 'browser-open.ndjson');
+  const browserEnv = {
+    NODE_OPTIONS: `--require=${path.join(__dirname, 'vibe-auth-open-test-preload.cjs')}`,
+    TTMG_AUTH_OPEN_TEST_RECEIPT: browserReceipt,
+  };
+  for (const format of ['json', 'ndjson']) {
+    const opened = await run(['auth', 'open', '--page-url', ready.url, '--format', format], undefined, browserEnv);
+    assert.equal(opened.code, 0, opened.stderr);
+    const result = JSON.parse(opened.stdout);
+    assert.equal(result.status, 'open_requested');
+    assert.equal(result.platformWrite, false);
+    assert.doesNotMatch(opened.stdout + opened.stderr, /import_token|process-private-token/);
+  }
+  const launches = fs.readFileSync(browserReceipt, 'utf8').trim().split('\n').map(JSON.parse);
+  assert.equal(launches.length, 2);
+  assert.ok(launches.every(item => item.args.includes(ready.url + '/authorize')));
+  const redirect = await fetch(ready.url + '/authorize', {redirect: 'manual'});
+  assert.equal(redirect.headers.get('location'), landing);
+  assert.equal(redirect.status, 302);
+  rendered = workerMessage(message => message.type === 'rendered' && message.id === 2);
+  authWorker.send({type: 'render', id: 2, html: '<h1>Complete</h1>'});
+  await rendered;
+  const stale = await run(['auth', 'open', '--page-url', ready.url, '--format', 'json'], undefined, browserEnv);
+  assert.equal(stale.code, 1);
+  assert.equal(JSON.parse(stale.stdout).errorCode, 'VIBE_AUTH_PAGE_UNAVAILABLE');
+  for (const args of [[], ['--page-url', landing]]) {
+    const invalid = await run(['auth', 'open', ...args, '--format', 'json'], undefined, browserEnv);
+    assert.equal(invalid.code, 1);
+    assert.equal(JSON.parse(invalid.stdout).errorCode, 'VIBE_INVALID_PAGE_URL');
+    assert.doesNotMatch(invalid.stdout + invalid.stderr, /process-private-token/);
+  }
+  assert.equal(fs.readFileSync(browserReceipt, 'utf8').trim().split('\n').length, 2);
+  authWorker.kill();
+  children.delete(authWorker);
   fixtureServer = http.createServer((req, res) => {
     const url = new URL(req.url, 'http://127.0.0.1');
     requests.push({ path: url.pathname, method: req.method, headers: req.headers });
     req.resume();
     const create = url.pathname.endsWith('/create_minis_import_task_for_agent/');
     const status = url.pathname.endsWith('/get_minis_import_task_status_for_agent/');
+    if (create) webPolls = 0;
+    if (status && webMode) webPolls++;
     assert.ok(create || status, 'Unexpected real upload endpoint');
     assert.equal(req.headers['x-use-ppe'], '1');
     assert.equal(req.headers['x-tt-env'], 'ppe_op_vc');
@@ -115,9 +170,9 @@ async function main() {
     }
     const data = create ? {
       task_id: '7684370037737553941', import_token: 'process-test-secret',
-      landing_url: 'https://developers.tiktok.com/portal_h5/minis_import?import_token=process-test-secret',
+      landing_url: 'https://developers.tiktok.com/portal_h5/minis_import?task_id=7684370037737553941&import_token=process-test-secret',
       poll_interval_seconds: 0.01,
-    } : { status: 1, ready_for_input: false };
+    } : { status: webMode && webPolls >= 5 ? 2 : 1, ready_for_input: webMode && webPolls >= 5 };
     res.writeHead(200, { 'Content-Type': 'application/json' });
     res.end(JSON.stringify({ ...data, error_info: { code: failStatus && status ? 420500 : 0 } }));
   });
@@ -137,6 +192,77 @@ async function main() {
   });
 
   let bindingHtml;
+  const appInfoPath = path.join(temp, 'app-info.json');
+  fs.writeFileSync(appInfoPath, JSON.stringify({
+    description: 'Process contract fixture', category: 'Casual', subcategory: 'Puzzle',
+    terms_of_service: 'https://example.invalid/terms', privacy_policy: 'https://example.invalid/privacy',
+    copyright_confirmation: true,
+  }));
+  const badIcon = await run([...input, '--mock', '--app-info', appInfoPath, '--format', 'json']);
+  assert.equal(badIcon.code, 1);
+  assert.equal(events(badIcon)[0].errorCode, 'VIBE_PLATFORM_ICON_INVALID');
+  assert.equal(events(badIcon)[0].platformWrite, false);
+  assert.equal(requests.length, 0, 'Invalid input must not create a task');
+  assert.equal(fs.existsSync(path.join(temp, '.ttmg/vibe-project.json')), false);
+  const platformHeader = Buffer.from(png, 'base64');
+  platformHeader.writeUInt32BE(1024, 16);
+  platformHeader.writeUInt32BE(1024, 20);
+  fs.writeFileSync(icon, platformHeader); // Header preflight fixture, not a decoded image.
+  const completeDry = await run([...input, '--app-info', appInfoPath, '--dry-run', '--format', 'json']);
+  assert.equal(completeDry.code, 0, completeDry.stderr);
+  assert.equal(events(completeDry)[0].status, 'prepared');
+  assert.equal(requests.length, 0);
+  fs.writeFileSync(appInfoPath, '{private-token');
+  const badInfo = await run([...input, '--mock', '--app-info', appInfoPath, '--format', 'json']);
+  assert.equal(events(badInfo)[0].errorCode, 'VIBE_INVALID_APP_INFO');
+  assert.doesNotMatch(badInfo.stdout + badInfo.stderr, /private-token/);
+  assert.equal(requests.length, 0);
+  const legacyInfo = await run(['upload', '--app-info', appInfoPath, '--format', 'json']);
+  assert.equal(events(legacyInfo)[0].errorCode, 'VIBE_OPTION_REQUIRES_VIBE');
+  assert.equal(events(legacyInfo)[0].platformWrite, false);
+  fs.writeFileSync(icon, Buffer.from(png, 'base64'));
+  // Replay the live package receipt through the built CLI without PPE writes.
+  const uploadPaths = [];
+  const uploadServer = http.createServer((req, res) => {
+    const url = new URL(req.url, 'http://127.0.0.1');
+    const endpoint = url.pathname.split('/').filter(Boolean).at(-1);
+    uploadPaths.push(endpoint);
+    req.resume();
+    const replies = {
+      create_minis_import_task_for_agent: {
+        task_id: '7684370037737619477', import_token: 'receipt-test-secret',
+        landing_url: 'https://example.invalid/auth', poll_interval_seconds: 0.01,
+      },
+      get_minis_import_task_status_for_agent: { status: 2, ready_for_input: true },
+      upload_minis_import_app_icon_for_agent: { icon_uri: 'test-icon' },
+      submit_minis_import_info_for_agent: {},
+      upload_minis_import_package_for_agent: { status: 2, package_uri: 'test-package' },
+    };
+    res.writeHead(endpoint in replies ? 200 : 404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error_info: { code: 0 }, ...replies[endpoint] }));
+  });
+  await new Promise(resolve => uploadServer.listen(0, '127.0.0.1', resolve));
+  try {
+    const saved = await run([...input, '--format', 'ndjson'], undefined, {
+      TTMG_VIBE_BACKEND: 'local-http',
+      TTMG_VIBE_API: `http://127.0.0.1:${uploadServer.address().port}`,
+    });
+    assert.equal(saved.code, 0, saved.stderr);
+    const savedEvents = events(saved);
+    const savedFinal = savedEvents.at(-1);
+    assert.equal(savedFinal.status, 'uploaded', JSON.stringify(savedEvents.map(e => ({ status: e.status, terminal: e.terminal, step: e.uploadStep, uploaded: e.uploaded }))));
+    assert.equal(savedFinal.uploaded, true);
+    assert.equal(savedFinal.taskStatusRaw, 2);
+    assert.equal(savedEvents.filter(e => e.terminal).length, 1);
+    assert.deepEqual(uploadPaths, [
+      'create_minis_import_task_for_agent', 'get_minis_import_task_status_for_agent',
+      'upload_minis_import_app_icon_for_agent', 'submit_minis_import_info_for_agent',
+      'upload_minis_import_package_for_agent',
+    ]);
+    assert.doesNotMatch(saved.stdout + saved.stderr, /receipt-test-secret|test-package/);
+  } finally {
+    uploadServer.close();
+  }
   const success = await run(
     [...input, '--mock', '--format', 'ndjson', '--poll-interval', '0.2'],
     async event => {
@@ -188,6 +314,52 @@ async function main() {
   assert.match(previewHtml, /data-phase="complete"/);
   assert.doesNotMatch(previewHtml, /QR|preview|review|Publish to TikTok/);
 
+  const beforeWeb = requests.length;
+  const webConflict = await run([...input, '--web', '--mock', '--format', 'json']);
+  assert.equal(events(webConflict)[0].errorCode, 'VIBE_WEB_OPTION_CONFLICT');
+  const legacyWeb = await run(['upload', '--web', '--format', 'json']);
+  assert.equal(events(legacyWeb)[0].errorCode, 'VIBE_OPTION_REQUIRES_VIBE');
+  assert.equal(requests.length, beforeWeb);
+  webMode = true;
+  for (const format of ['json', 'ndjson']) {
+    const receipt = path.join(temp, `upload-web-${format}.ndjson`);
+    const web = await run([...input.filter(v => v !== '--no-open'), '--web', '--format', format, '--poll-interval', '0.2'], async event => {
+      if (event.status === 'waiting_authorization') {
+        assert.equal(event.authorizationMode, 'web');
+        assert.equal(event.browserOpenRequested, true);
+        assert.equal(event.simulation, false);
+        assert.equal(event.nextAction, 'open_browser');
+        assert.equal(event.qrPurpose, undefined);
+        const response = await fetch(event.pageUrl + '/authorize', {redirect: 'manual'});
+        assert.equal(response.status, 302);
+        assert.match(response.headers.get('location'), /^https:\/\/developers\.tiktok\.com\/portal_h5\/minis_import\?/);
+        const html = await (await fetch(event.pageUrl)).text();
+        assert.match(html, /Authorize in your browser/);
+        assert.doesNotMatch(html, /alt="Authorization QR"|Scan the QR code/);
+      }
+    }, {
+      NODE_OPTIONS: env.NODE_OPTIONS + ' --require=' + path.join(__dirname, 'vibe-auth-open-test-preload.cjs'),
+      TTMG_AUTH_OPEN_TEST_RECEIPT: receipt,
+      // Explicit --web must not inherit an old Mock backend setting.
+      TTMG_VIBE_BACKEND: 'mock',
+    });
+    assert.equal(web.code, 1, web.stderr);
+    const output = events(web);
+    assert.equal(output.at(-1).errorCode, 'VIBE_REAL_UPLOAD_NOT_READY');
+    assert.equal(output.at(-1).simulation, false);
+    assert.equal(output.at(-1).backend, 'ppe');
+    assert.equal(output.at(-1).readyForInput, true);
+    assert.equal(output.at(-1).uploadAttempted, false);
+    assert.equal(output.at(-1).uploaded, false);
+    assert.equal(webPolls, 5, 'Only true backend readiness unlocks authorization');
+    if (format === 'json') assert.equal(output.length, 1);
+    const opens = fs.readFileSync(receipt, 'utf8').trim().split('\n').map(line => JSON.parse(line));
+    assert.equal(opens.length, 1);
+    assert.ok(opens[0].args.some(arg => /^http:\/\/127\.0\.0\.1:\d+\/[a-f0-9]{48}\/authorize$/.test(arg)));
+    assert.doesNotMatch(JSON.stringify(opens) + web.stdout + web.stderr, /process-test-secret|import_token|aweme:\/\//);
+  }
+  webMode = false;
+
   const json = await run(
     [...input, '--format', 'json', '--poll-interval', '0.01'],
     undefined,
@@ -310,6 +482,9 @@ async function main() {
   assert.equal(help.code, 0);
   assert.match(help.stdout, /--vibe/);
   assert.match(help.stdout, /--client-key/);
+  const authHelp = await run(['auth', 'open', '--help']);
+  assert.equal(authHelp.code, 0);
+  assert.match(authHelp.stdout, /--page-url/);
 
   let cancelledPage;
   const cancelled = await run(

package/dist/scripts/wasm-smoke.js

@@ -0,0 +1,53 @@
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { spawnSync } = require('node:child_process');
+const entry = process.argv[2] ? path.resolve(process.argv[2]) : path.resolve(__dirname, '../dist/index.js');
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ttmg-wasm-smoke-'));
+const input = path.join(root, 'original.wasm');
+const wasm = Buffer.from('0061736d010000000105016000017f0304030000000404017000030707010372756e00000909010041000b030001020a1003040010010b0400412a0b040041070b', 'hex');
+const sha = crypto.createHash('sha256').update(wasm).digest('hex');
+function run(args, env = {}) {
+  const result = spawnSync(process.execPath, [entry, ...args, '--format', 'json'], {
+    cwd: root, encoding: 'utf8', timeout: 15000,
+    env: { ...process.env, TTMGRC_PATH: path.join(root, 'rc.json'), ...env },
+  });
+  assert.ifError(result.error);
+  assert.equal(result.stdout.trim().split('\n').length, 1, result.stdout + result.stderr);
+  const body = JSON.parse(result.stdout);
+  assert.equal(result.status, body.status === 'failed' ? 1 : 0, result.stderr);
+  return body;
+}
+try {
+  fs.writeFileSync(input, wasm);
+  const stub = path.join(root, 'missing-binding.js');
+  fs.writeFileSync(stub, "const Module=require('node:module'); const load=Module._load; Module._load=function(name,...args){if(name==='@anrans001/ttmg-wasmtool')throw new Error('fixture unavailable');return load.call(this,name,...args)};");
+  const unavailable = run(['wasm', 'prepare', '--input', input, '--output', path.join(root, 'missing')], { NODE_OPTIONS: '--require=' + stub });
+  assert.equal(unavailable.errorCode, 'WASM_BINDING_UNAVAILABLE');
+  assert.equal(fs.existsSync(path.join(root, 'missing')), false);
+  const preflight = run(['wasm', 'prepare', '--input', input, '--output', path.join(root, 'dry'), '--dry-run'], { NODE_OPTIONS: '--require=' + stub });
+  assert.equal(preflight.status, 'ready');
+  assert.equal(preflight.nativeBindingChecked, false);
+  assert.equal(fs.existsSync(path.join(root, 'dry')), false);
+  const collection = path.join(root, 'collection.json');
+  fs.writeFileSync(collection, JSON.stringify({ schemaVersion: '1', wasmSha256: sha, funcIds: [0, 1], bootFuncIds: [0] }));
+  const prepared = run(['wasm', 'prepare', '--input', input, '--output', path.join(root, 'prepared')]);
+  if (prepared.errorCode === 'WASM_BINDING_UNAVAILABLE') {
+    console.log('wasm process contract passed; native execution unavailable on this host, not verified');
+  } else {
+    assert.equal(prepared.status, 'succeeded', JSON.stringify(prepared));
+    const split = run(['wasm', 'split', '--input', input, '--collection', collection, '--output', path.join(root, 'split')]);
+    assert.equal(split.status, 'succeeded', JSON.stringify(split));
+    assert.equal(split.detail.totalWasmCount, 3);
+    assert.equal(split.detail.mainWasmCount, 2);
+    assert.equal(split.gameValidation, 'not_evaluated');
+    assert.equal(split.input.wasmSha256, sha);
+    assert.deepEqual(JSON.parse(fs.readFileSync(split.manifest, 'utf8')), split);
+    for (const artifact of split.artifacts) assert.equal(crypto.createHash('sha256').update(fs.readFileSync(artifact.path)).digest('hex'), artifact.sha256);
+    assert.deepEqual(fs.readFileSync(input), wasm);
+    assert.equal(fs.existsSync(path.join(root, 'rc.json')), false);
+    console.log(`wasm process contract passed: native prepare/split on ${process.platform}/${process.arch}, immutable input and verified artifacts`);
+  }
+} finally { fs.rmSync(root, { recursive: true, force: true }); }

package/dist/scripts/wasm-worker.js

@@ -0,0 +1,63 @@
+// Native Wasm operations run in a disposable process so a deadline can stop
+// synchronous native code without blocking or corrupting the CLI owner.
+const fs = require('node:fs');
+const path = require('node:path');
+const zlib = require('node:zlib');
+
+process.once('message', request => {
+  let response;
+  try {
+    let binding;
+    try {
+      binding = require('@anrans001/ttmg-wasmtool');
+    } catch {
+      throw Object.assign(new Error('Wasm tool binding is unavailable for this OS/architecture.'), {
+        code: 'WASM_BINDING_UNAVAILABLE',
+      });
+    }
+    if (request.operation === 'prepare') {
+      const output = path.join(request.output, 'prepared.wasm');
+      const result = binding.prepare(request.input, output);
+      if (!fs.existsSync(output) || result.outputSize <= 0)
+        throw new Error('Wasm preparation produced no output.');
+      fs.writeFileSync(output + '.br', zlib.brotliCompressSync(fs.readFileSync(output), {
+        params: { [zlib.constants.BROTLI_PARAM_QUALITY]: 9 },
+      }));
+      response = { ok: true, detail: { outputSize: result.outputSize, timeCost: result.timeCost } };
+    } else if (request.operation === 'split') {
+      const result = binding.split({
+        input: request.input,
+        outputDir: request.output,
+        funcIds: request.funcIds,
+        alwaysInclude: request.bootFuncIds,
+        archive: true,
+        compress: true,
+        quality: 9,
+        callClosure: true,
+        callIndirectClosure: false,
+      });
+      if (result.code !== 0) throw new Error(result.errMsg || 'Wasm split failed.');
+      if (![...request.funcIds, ...request.bootFuncIds].every(id => id < result.totalWasmCount))
+        throw Object.assign(new Error('Collection contains function IDs outside this Wasm module.'), {
+          code: 'WASM_COLLECTION_INVALID',
+        });
+      const detail = {};
+      for (const key of ['totalWasmCount', 'mainWasmCount', 'tableSize', 'timeCost',
+        'globalVarList', 'collectFuncCount', 'alwaysIncludeAdded', 'closureAdded',
+        'indirectClosureAdded', 'indirectClosureTypes', 'exportAdded']) detail[key] = result[key];
+      detail.outputFiles = [result.mainWasmPath, result.subWasmPath, result.funcMetaPath, result.archivePath]
+        .filter(Boolean).map(file => {
+          if (path.dirname(path.resolve(file)) !== path.resolve(request.output))
+            throw new Error('Native output escaped its assigned directory.');
+          return path.basename(file);
+        });
+      response = { ok: true, detail };
+    } else throw new Error('Unknown Wasm operation.');
+    response.detail.bindingVersion = require('@anrans001/ttmg-wasmtool/package.json').version;
+    response.detail.platform = process.platform;
+    response.detail.arch = process.arch;
+  } catch (error) {
+    response = { ok: false, errorCode: error.code || 'WASM_OPERATION_FAILED', error: error.message };
+  }
+  process.send(response, () => process.disconnect());
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttmg/cli",
-  "version": "0.4.6-vibe-beta.7",
+  "version": "0.4.6-vibe-beta.8",
   "description": "TikTok Mini Game Command Line Tool",
   "license": "ISC",
   "bin": {
@@ -31,11 +31,12 @@
     "test:auth": "node scripts/run-ts-test.js src/commands/common/auth.test.ts",
     "test:capabilities": "node scripts/run-ts-test.js src/commands/common/capabilities.test.ts",
     "test:test-account": "node scripts/run-ts-test.js src/commands/common/testAccount.test.ts",
-    "test:dev-session": "node scripts/run-ts-test.js src/commands/native/dev/agentSession.test.ts",
-    "test:dev-session-command": "node scripts/run-ts-test.js src/commands/native/dev/session.test.ts",
+    "test:dev-session": "node scripts/run-ts-test.js src/commands/native/dev/agentSession.test.ts && npm run test:packaging-compatibility",
+    "test:packaging-compatibility": "node scripts/run-ts-test.js src/commands/native/dev/packagingCompatibility.test.ts",
+    "test:dev-session-command": "node scripts/run-ts-test.js src/commands/native/dev/session.test.ts && node scripts/run-ts-test.js src/commands/native/dev/projectSession.test.ts && node scripts/run-ts-test.js src/commands/native/dev/scanPage.test.ts && node scripts/run-ts-test.js src/commands/native/dev/runtime/logArchive.test.ts && node scripts/run-ts-test.js src/commands/native/dev/capture.test.ts",
     "test:dev-runtime-event": "node scripts/run-ts-test.js src/commands/native/dev/utils/scoket.test.ts",
     "test:dev-runtime-client": "node scripts/run-ts-test.js src/commands/native/dev/runtime/runtime.test.ts",
-    "test:dev-session-control": "node scripts/run-ts-test.js src/commands/native/dev/runtime/sessionControl.test.ts",
+    "test:dev-session-control": "node scripts/run-ts-test.js src/commands/native/dev/runtime/sessionControl.test.ts && node scripts/run-ts-test.js src/commands/native/dev/runtime/previewWorkflow.test.ts",
     "test:dev-runtime-session-follow": "node scripts/run-ts-test.js src/commands/native/dev/runtime/runtimeSessionFollow.test.ts",
     "test:dev-client-preview-orchestrator": "node scripts/run-ts-test.js src/commands/native/dev/runtime/clientPreviewOrchestrator.test.ts",
     "test:dev-watch-change": "node scripts/run-ts-test.js src/commands/native/dev/utils/watchChange.test.ts",
@@ -46,9 +47,10 @@
     "test:check-ai": "node scripts/run-ts-test.js src/commands/native/check/ai.test.ts",
     "test:build-structured": "node scripts/run-ts-test.js src/commands/native/build/build.test.ts",
     "test:doctor": "node scripts/run-ts-test.js src/commands/native/doctor/doctor.test.ts",
-    "test:agent-contract": "npm run test:login && npm run test:auth && npm run test:capabilities && npm run test:test-account && npm run test:upload-preview && npm run test:preview-page && npm run test:check && npm run test:check-ai && npm run test:build-structured && npm run test:doctor && npm run test:dev-session && npm run test:dev-session-command && npm run test:dev-runtime-event && npm run test:dev-runtime-client && npm run test:dev-session-control && npm run test:dev-runtime-session-follow && npm run test:dev-client-preview-orchestrator && npm run test:dev-watch-change && npm run test:network && npm run test:vibe && npx tsc --noEmit && npm run build && npm run test:vibe-process && npm run test:preview-page-process && npm run test:preview-page-detached && npm run verify:dist-version && npm run verify:agent-contract",
-    "test:agent-contract:full": "npm run test:agent-contract && npm run test:dev-default-process && npm run test:dev-game-ready-process && npm run test:dev-client-preview-control-process",
-    "publish:beta": "npm publish --registry=https://registry.npmjs.org/ --access public --tag beta",
+    "test:wasm": "node scripts/run-ts-test.js src/commands/native/wasm/wasm.test.ts && node scripts/acceptance-fixture.test.js",
+    "test:agent-contract": "npm run test:login && npm run test:auth && npm run test:capabilities && npm run test:test-account && npm run test:upload-preview && npm run test:preview-page && npm run test:check && npm run test:check-ai && npm run test:build-structured && npm run test:doctor && npm run test:wasm && npm run test:dev-session && npm run test:dev-session-command && npm run test:dev-runtime-event && npm run test:dev-runtime-client && npm run test:dev-session-control && npm run test:dev-runtime-session-follow && npm run test:dev-client-preview-orchestrator && npm run test:dev-watch-change && npm run test:network && npm run test:vibe && npx tsc --noEmit && npm run build && npm run test:vibe-process && npm run test:preview-page-process && npm run test:preview-page-detached && npm run verify:dist-version && npm run verify:agent-contract",
+    "test:agent-contract:full": "npm run test:agent-contract && npm run test:dev-default-process && npm run test:dev-game-ready-process && npm run test:dev-client-preview-control-process && node scripts/dev-workflow-smoke.js",
+    "publish:beta": "npm publish --registry=https://registry.npmjs.org/ --access public --tag vibe-beta",
     "setup": "node scripts/setup.js",
     "reset:local-state": "node scripts/resetLocalState.js",
     "dev:link": "npm run build && npm link",
@@ -60,7 +62,7 @@
   ],
   "author": "zhanghongyang.mocha",
   "dependencies": {
-    "@anrans001/ttmg-wasmtool": "^0.3.2",
+    "@anrans001/ttmg-wasmtool": "^0.3.3",
     "acorn": "^8.15.0",
     "archiver": "^7.0.1",
     "axios": "^1.11.0",
@@ -93,7 +95,7 @@
     "qs": "6.12.1",
     "semver": "^7.7.2",
     "socks-proxy-agent": "^9.0.0",
-    "ttmg-pack": "0.4.13-beta.2",
+    "ttmg-pack": "0.4.13",
     "ws": "^8.18.3"
   },
   "devDependencies": {

package/vibe-upload.md

@@ -26,8 +26,53 @@ ttmg upload --vibe --dir ./game --title "星环守卫" --icon ./avatar.png --dry
 
 已有 ZIP 时，用 `--package ./game.zip` 替换 `--dir ./game`。名称和头像必须由开发者提供；演示脚本中的临时样本不作为产品默认素材。
 
+### 完整应用信息校验
+
+维护者可添加 `--app-info ./app-info.json`，为真实上传准备完整参数。该选项不改变现有 `--mock` 用法，也不解除 PPE 素材上传限制。
+
+```sh
+ttmg upload --vibe --package ./game.zip --title "测试游戏" --icon ./avatar.png --app-info ./app-info.json --dry-run --format json
+```
+
+JSON 文件为以下字段组成的对象，最大 64 KiB；名称由 `--title` 提供，头像 URI 由上传接口返回，不在文件中填写。
+
+| 字段 | 要求 |
+| --- | --- |
+| description、category、subcategory | 必填非空字符串；分类与子分类应使用平台分类表中的配对值，本地暂不校验分类枚举 |
+| terms_of_service、privacy_policy | 必填 HTTP(S) 链接，不含用户名和密码；须使用游戏自己的真实条款与隐私链接 |
+| copyright_confirmation | 必须显式为 true；只有用户已确认版权时才填写，Skill 不得代为默认确认 |
+| apple_team_id、contact_email、region、min_sdk_version | 可选字符串；填写邮箱时检查基本格式 |
+
+提供该文件后，创建任务前检查名称最多 30 个字符，以及头像为 PNG/JPEG、1024×1024、最大 5 MiB。头像仅做文件头预检，完整解码由后端校验。错误分别返回 `VIBE_INVALID_APP_INFO`、`VIBE_TITLE_TOO_LONG`、`VIBE_PLATFORM_ICON_INVALID`，`nextAction=fix_input`。JSON 不接受额外字段，内容不会进入结构化输出；修改后重新运行 dry-run。
+
 ### Skill 读取什么
 
+#### 上传时直接使用网页授权
+
+使用 `--web`：CLI 通过内置 `ppe_op_vc` 真实创建任务，在执行机的系统浏览器打开授权页，并持续查询真实绑定状态。Skill 不需要配置环境或再调用 `auth open`。只有服务端返回 `ready_for_input=true` 才算绑定就绪，不模拟授权成功。
+
+```sh
+ttmg upload --vibe --web --dir ./game --title "星环守卫" --icon ./avatar.png --format ndjson
+```
+
+原 `upload --vibe --mock` 链路不变。`--web` 与 `--mock`、`--mock-scenario`、`--vibe-api`、`--no-open` 互斥，在创建任务前报错；显式 `--web` 不继承旧 Mock 后端设置。`--dry-run` 不创建任务或打开浏览器。JSON/NDJSON 模式也会打开浏览器，但不污染结构化输出。当前授权就绪后仍返回 `VIBE_REAL_UPLOAD_NOT_READY`，不会伪装成上传成功，也不自动降级 Mock。
+
+等待事件返回 `authorizationMode=web` 和 `browserOpenRequested`。真实授权场景的 `nextAction=open_browser` 表示在浏览器完成授权，不代表已授权。打开失败时返回 `browserOpenErrorCode=VIBE_BROWSER_OPEN_FAILED`，仍轮询原任务，可用下面的辅助命令重试，不重新建任务。
+
+#### 手动打开浏览器授权
+
+保持上传命令运行。收到 `waiting_authorization` 后，如果事件提供 `authorizationOpenCommand`，Skill 可执行该命令，或使用同一事件的 `pageUrl`：
+
+```sh
+ttmg auth open --page-url <pageUrl> --format json
+```
+
+命令通过临时本地页面跳转到后端原始 `landing_url`，不使用 `aweme://`，不新建任务或上传文件。凭证只留在上传进程与页面服务中，不输出到 Skill 或放进命令参数。原上传进程继续轮询，授权成功与否以其 `readyForInput` 为准。
+
+成功返回 `status=open_requested`、`browserOpenRequested=true`、`platformWrite=false`，只表示已请求系统浏览器打开。页面过期、流程结束或没有可用真实授权地址时，返回 `VIBE_AUTH_PAGE_UNAVAILABLE`；URL 输入错误返回 `VIBE_INVALID_PAGE_URL`，浏览器启动失败返回 `VIBE_BROWSER_OPEN_FAILED`。不得因打开失败而自动创建新任务。
+
+命令在 CLI 所在电脑执行；远程机器不会打开开发者电脑的浏览器。二维码原路径和 `--mock` 自动推进逻辑保持不变：混合模拟不会等待网页授权，真实网页联调请使用维护者的 PPE 模式。本功能需包含新命令的构建版本。
+
 输出 schema 为 `"2"`。每行 NDJSON 是同一 `operationId` 的状态快照；只有最后一行 `terminal=true`。`--format json` 仅在结束时向 stdout 输出一个对象，等待授权的本地页面地址写到 stderr。不要解析中文／英文文案判断状态。
 
 | status                          | Skill 处理                                                                                |
@@ -96,7 +141,7 @@ Mock 与本地 HTTP 共用请求构造、业务响应校验及状态映射，基
 | POST create_minis_import_task_for_agent/            | source_type=1、source_project_id、task_idempotency_id、minis_type=MINI_GAME | task_id、import_token、landing_url、poll_interval_seconds |
 | GET get_minis_import_task_status_for_agent/         | Query：task_id、import_token                                                | status、ready_for_input                                   |
 | POST upload_minis_import_app_icon_for_agent/        | Multipart：task_id、import_token、file                                      | icon_uri                                                  |
-| POST submit_minis_import_info_for_agent/            | JSON：task_id、import_token、app_info.app_name、app_info.icon_uri           | error_info                                                |
+| POST submit_minis_import_info_for_agent/            | JSON：task_id、import_token、app_info（完整应用信息，加 CLI 提供的 app_name、icon_uri） | error_info                                                |
 | POST upload_minis_import_package_for_agent/         | Multipart：task_id、import_token、asset_type=2、file                        | package_uri、status                                       |
 
 所有响应必须业务 `error_info.code=0`。最后一步还要求非空 package_uri 和合法非失败状态；完成后不再轮询。HTTP 200、进度100% 都不能单独作为成功判定。19位 task_id 在 CLI 内保留字符串，提交 i64 JSON 时无损编码。
@@ -109,7 +154,7 @@ TTMG_VIBE_BACKEND=local-http TTMG_VIBE_API=http://127.0.0.1:3100 ttmg upload --v
 
 **v1 → v2 兼容性变化**：旧 UUID 换 Token 的三接口协议废弃，`--vibe-authorize-url` 返回明确错误；授权地址来自 landing_url。不再输出 preview_ready、game_preview、uploadId、reviewStatus。Skill 必须校验 schemaVersion=2，并按新终态处理。普通不带 --vibe 的 upload 不变。
 
-仍待真实联调确认：头像／代码包规则、Token 有效期与重试规则、真实拒绝授权映射、端内 PPE Cookie 问题。后端接口调整留在适配层处理；若用户动作或成功语义改变，应协商升级 CLI schema，不能承诺 Skill 永远无需调整。
+2026-09-14 已核对 BFF 源码：头像 PNG/JPEG、1024×1024、5 MiB；Native ZIP 和解压总大小上限 100 MiB。本地暂未实现完整 ZIP 内容及解压总大小校验。待真实联调验证：网关包体透传、TOS 权限、手机 OAuth 授权与上传回执。后端接口调整留在适配层处理；若用户动作或成功语义改变，应协商升级 CLI schema。
 
 ### 验证
 
@@ -133,8 +178,67 @@ Use `--package ./game.zip` instead of --dir for a prepared ZIP. Use `--dry-run -
 
 The Skill gathers the title and user-selected local icon in conversation. It does not call backend APIs, store credentials, poll services, or introduce a metadata form. The CLI internally connects working steps to PPE and simulates the remaining steps. Removing PPE at production launch is a CLI release change, not a Skill configuration step.
 
+### Complete metadata validation
+
+Maintainers can add `--app-info ./app-info.json` to prepare complete upload parameters. It does not change the existing --mock entry or enable PPE material uploads.
+
+```sh
+ttmg upload --vibe --package ./game.zip --title "Test game" --icon ./avatar.png --app-info ./app-info.json --dry-run --format json
+```
+
+The file is a JSON object, at most 64 KiB. The CLI supplies app_name from --title and icon_uri from the upload response; do not put them in this file.
+
+| Fields | Requirements |
+| --- | --- |
+| description, category, subcategory | Required nonempty strings; use a valid platform category/subcategory pair. Local enum validation is not implemented yet |
+| terms_of_service, privacy_policy | Required HTTP(S) URLs without embedded credentials; provide the game's actual legal links |
+| copyright_confirmation | Explicit true only after the user confirms ownership; the Skill must not infer consent |
+| apple_team_id, contact_email, region, min_sdk_version | Optional strings; email receives a basic syntax check |
+
+With this file, preflight checks the title length (30 characters maximum) and icon (PNG/JPEG, 1024 x 1024, at most 5 MiB) before task creation. Image validation inspects headers only; the backend performs decoding. Failures return VIBE_INVALID_APP_INFO, VIBE_TITLE_TOO_LONG or VIBE_PLATFORM_ICON_INVALID with nextAction=fix_input. Unknown JSON fields are rejected, and metadata is not exposed in structured output. Fix the input and rerun dry-run.
+
+Source checked on 2026-09-14: BFF enforces these icon limits and a 100 MiB Native ZIP/uncompressed-size limit. Full local ZIP-content/uncompressed-size validation is not implemented. Gateway transport, TOS access, phone OAuth and upload receipts still require real integration testing.
+
 ### Output and decisions
 
+#### Use browser authorization during upload
+
+Use `--web` for real authorization. The CLI creates a task through the built-in `ppe_op_vc` lane, opens authorization in the execution machine's system browser and polls real binding status until `ready_for_input=true`. No environment setup or second Skill command is required. Authorization success is never simulated.
+
+```sh
+ttmg upload --vibe --web --dir ./game --title "My game" --icon ./avatar.png --format ndjson
+```
+
+The original `upload --vibe --mock` workflow is unchanged. `--web` conflicts with `--mock`, `--mock-scenario`, `--vibe-api` and `--no-open` before task creation, and does not inherit an old Mock backend environment setting. Dry-run creates no task and opens no browser. JSON/NDJSON also open the browser without contaminating stdout. Real material upload remains gated: after authorization, the command returns `VIBE_REAL_UPLOAD_NOT_READY`, not upload success or a Mock fallback.
+
+Waiting events add `authorizationMode=web` and `browserOpenRequested`. For real authorization, `nextAction=open_browser` requests browser approval; it does not prove approval. If opening fails, `browserOpenErrorCode=VIBE_BROWSER_OPEN_FAILED` is returned while polling continues. Retry the helper below against the same task instead of creating another one.
+
+#### Open browser authorization manually
+
+Keep the upload process running. On `waiting_authorization`, execute its optional
+`authorizationOpenCommand`, or use the `pageUrl` from that event:
+
+```sh
+ttmg auth open --page-url <pageUrl> --format json
+```
+
+The temporary loopback page redirects the system browser to the original backend
+`landing_url`, without the `aweme://` wrapper. No new task or upload is performed.
+Credentials stay inside the uploader/page worker, not in Skill output or command
+arguments. The original uploader keeps polling; its `readyForInput` determines
+authorization readiness.
+
+Success reports `status=open_requested`, `browserOpenRequested=true`, and
+`platformWrite=false`; it does not mean authorization succeeded. Expired,
+completed, or unavailable authorization pages return `VIBE_AUTH_PAGE_UNAVAILABLE`;
+bad input returns `VIBE_INVALID_PAGE_URL`, and browser launch failures return
+`VIBE_BROWSER_OPEN_FAILED`. Do not create another task automatically on failure.
+
+This opens the browser on the CLI computer, not a remote user's computer. Existing
+QR behavior and `--mock` auto-advance stay unchanged; use the maintainer PPE mode
+for real browser authorization, since hybrid simulation does not wait for it.
+Use a build containing the new command; existing released versions are unchanged.
+
 Schema **2** provides NDJSON snapshots under one operationId, with exactly one final `terminal=true` event. JSON mode emits one final object on stdout and the authorization page address on stderr. Structured modes do not open the browser automatically; open pageUrl in the AI workspace preview or browser. Text mode opens it unless --no-open.
 
 | status                          | Skill action                                                                              |
@@ -174,7 +278,7 @@ The five endpoint contracts are listed in the table above. Mock and loopback HTT
 
 A business-success response requires error_info.code=0. Package completion additionally requires package_uri and a valid non-failure status; no polling until SUCCEEDED. No platform Cookies or redirects are used. Configure TTMG_VIBE_BACKEND=local-http plus TTMG_VIBE_API=http://127.0.0.1:3100, or pass --vibe-api explicitly; this option rejects remote hosts.
 
-For internal PPE integration, set TTMG_VIBE_BACKEND=ppe and TTMG_VIBE_PPE=ppe_op_vc without changing the Skill command. This uses real creation/polling on developers.tiktok.com and encodes the QR as aweme://webview?url=<encodeURIComponent(landing_url)>. The phone must use the same lane. OAuth is not bypassed or simulated. Complete upload inputs are not integrated yet: after authorization, VIBE_REAL_UPLOAD_NOT_READY stops the flow before any material upload. Production is not enabled.
+For internal PPE integration, set TTMG_VIBE_BACKEND=ppe and TTMG_VIBE_PPE=ppe_op_vc without changing the Skill command. This uses real creation/polling on developers.tiktok.com and encodes the QR as aweme://webview?url=<encodeURIComponent(landing_url)>. The phone must use the same lane. OAuth is not bypassed or simulated. After authorization, VIBE_REAL_UPLOAD_NOT_READY still stops the flow before any material upload; --app-info currently prepares and validates the local contract only.
 
 The normal --mock trial internally uses ppe_op_vc without environment variables. Task creation, QR and three polls are real; authorization, icon, app-info and package uploads are simulated with separate in-memory credentials. This changes --mock from an offline run into a PPE integration trial: platformWrite becomes true when task creation is attempted, while simulation remains true. No real material-upload endpoint is called, and real request failures still fail. --mock-scenario controls only simulated steps. Offline unit/process tests use injected transports, not a separate developer configuration.