@ttmg/cli 0.4.6-vibe-beta.8 → 0.4.6-vibe-beta.10

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttmg/cli",
-  "version": "0.4.6-vibe-beta.8",
+  "version": "0.4.6-vibe-beta.10",
   "description": "TikTok Mini Game Command Line Tool",
   "license": "ISC",
   "bin": {

package/dist/scripts/verify-agent-contract.js

@@ -385,6 +385,8 @@ assert.notEqual(
 );
 
 const uploadHelp = runCli(['upload', '--help']);
+assert.doesNotMatch(uploadHelp.stdout, /--app-info/);
+assert.match(uploadHelp.stdout.replace(/\s+/g, ' '), /only title and icon|只收集标题和头像/);
 assertExit(uploadHelp, 0, 'upload help');
 assert.match(uploadHelp.stdout, /--preview\b/);
 assert.match(uploadHelp.stdout, /--serve-preview-page\b/);

package/dist/scripts/vibe-ppe-test-preload.cjs

@@ -3,18 +3,32 @@
 const assert = require('node:assert/strict');
 const http = require('node:http');
 const https = require('node:https');
+const net = require('node:net');
 const port = Number(process.env.TTMG_VIBE_TEST_PORT);
 assert.ok(Number.isInteger(port) && port > 0 && port < 65536);
 https.request = (options, callback) => {
   assert.equal(typeof options, 'object');
   assert.equal(options.hostname, 'developers.tiktok.com');
   assert.equal(options.protocol, 'https:');
-  assert.match(options.path, /^\/bff\/app_info\/minis_import\/(create_minis_import_task_for_agent|get_minis_import_task_status_for_agent)\//);
-  return http.request({
+  assert.match(options.path, /^\/bff\/app_info\/minis_import\/(create_minis_import_task_for_agent|get_minis_import_task_status_for_agent|upload_minis_import_app_icon_for_agent|submit_minis_import_info_for_agent|upload_minis_import_package_for_agent)\//);
+  const request = http.request({
     ...options,
     protocol: 'http:', hostname: '127.0.0.1', host: undefined, port,
     agent: undefined, servername: undefined,
   }, callback);
+  if (process.env.TTMG_VIBE_TEST_RETAIN_UPLOAD_SOCKET === '1' &&
+      /upload_minis_import_(app_icon|package)_for_agent/.test(options.path)) {
+    // Reproduce the live gateway's completed response with a retained upload
+    // socket. The socket is real but loopback-only; operation cleanup must close it.
+    assert.ok(options.agent && options.agent !== https.globalAgent);
+    request.once('response', response => response.once('end', () => {
+      const socket = net.connect({host: '127.0.0.1', port});
+      const key = 'retained-vibe-test-sockets';
+      (options.agent.sockets[key] ||= []).push(socket);
+      socket.on('error', () => {});
+    }));
+  }
+  return request;
 };
 https.get = (options, callback) => {
   const request = https.request(options, callback);

package/dist/scripts/vibe-upload-smoke.js

@@ -29,6 +29,7 @@ const requests = [];
 let failStatus = false;
 let webMode = false;
 let webPolls = 0;
+let webFailureEndpoint;
 const env = {
   ...process.env,
   HOME: temp,
@@ -98,7 +99,15 @@ function events(result) {
   return result.stdout
     .trim()
     .split('\n')
-    .map(line => JSON.parse(line));
+    .map(line => {
+      const event = JSON.parse(line);
+      if (event.mode === 'vibe') {
+        assert.deepEqual(event.inputRequirements.requiredUserInputs, ['title', 'icon']);
+        assert.equal(event.inputRequirements.requestAdditionalMetadata, false);
+        assert.equal(event.inputRequirements.additionalMetadataSource, 'platform-defaults');
+      }
+      return event;
+    });
 }
 async function main() {
   // Exercise the built worker IPC and new command without creating a platform task.
@@ -152,15 +161,20 @@ async function main() {
   assert.equal(fs.readFileSync(browserReceipt, 'utf8').trim().split('\n').length, 2);
   authWorker.kill();
   children.delete(authWorker);
-  fixtureServer = http.createServer((req, res) => {
+  fixtureServer = http.createServer(async (req, res) => {
     const url = new URL(req.url, 'http://127.0.0.1');
     requests.push({ path: url.pathname, method: req.method, headers: req.headers });
-    req.resume();
+    const chunks = [];
+    for await (const chunk of req) chunks.push(chunk);
+    const body = Buffer.concat(chunks);
     const create = url.pathname.endsWith('/create_minis_import_task_for_agent/');
     const status = url.pathname.endsWith('/get_minis_import_task_status_for_agent/');
+    const iconUpload = url.pathname.endsWith('/upload_minis_import_app_icon_for_agent/');
+    const infoUpload = url.pathname.endsWith('/submit_minis_import_info_for_agent/');
+    const packageUpload = url.pathname.endsWith('/upload_minis_import_package_for_agent/');
     if (create) webPolls = 0;
     if (status && webMode) webPolls++;
-    assert.ok(create || status, 'Unexpected real upload endpoint');
+    assert.ok(create || status || (webMode && (iconUpload || infoUpload || packageUpload)), 'Mock must not call material-upload endpoints');
     assert.equal(req.headers['x-use-ppe'], '1');
     assert.equal(req.headers['x-tt-env'], 'ppe_op_vc');
     assert.equal(req.headers.cookie, undefined);
@@ -168,13 +182,35 @@ async function main() {
       assert.equal(url.searchParams.get('task_id'), '7684370037737553941');
       assert.equal(url.searchParams.get('import_token'), 'process-test-secret');
     }
+    if (iconUpload || infoUpload || packageUpload) {
+      assert.equal(webPolls, 5, 'Do not upload before server readiness');
+      assert.equal(req.method, 'POST');
+      if (infoUpload) {
+        assert.match(body.toString(), /"task_id":7684370037737553941/);
+        const info = JSON.parse(body.toString());
+        assert.equal(info.import_token, 'process-test-secret');
+        assert.equal(info.app_info.icon_uri, 'web-icon-receipt');
+        assert.equal(info.app_info.app_name, input[input.indexOf('--title') + 1]);
+        assert.deepEqual(Object.keys(info.app_info).sort(), ['app_name', 'icon_uri'],
+          'Default uploads must leave other metadata to platform defaults');
+      } else {
+        assert.match(req.headers['content-type'], /^multipart\/form-data; boundary=/);
+        assert.match(body.toString(), /name="task_id"\r\n\r\n7684370037737553941\r\n/);
+        assert.match(body.toString(), /name="import_token"\r\n\r\nprocess-test-secret\r\n/);
+        assert.ok(body.includes(fs.readFileSync(iconUpload ? icon : zip)));
+        if (packageUpload) assert.match(body.toString(), /name="asset_type"\r\n\r\n2\r\n/);
+      }
+    }
     const data = create ? {
       task_id: '7684370037737553941', import_token: 'process-test-secret',
       landing_url: 'https://developers.tiktok.com/portal_h5/minis_import?task_id=7684370037737553941&import_token=process-test-secret',
       poll_interval_seconds: 0.01,
-    } : { status: webMode && webPolls >= 5 ? 2 : 1, ready_for_input: webMode && webPolls >= 5 };
+    } : iconUpload ? {icon_uri: 'web-icon-receipt'}
+      : infoUpload ? {}
+      : packageUpload ? {status: 3, package_uri: 'web-package-receipt'}
+      : { status: webMode && webPolls >= 5 ? 2 : 1, ready_for_input: webMode && webPolls >= 5 };
     res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify({ ...data, error_info: { code: failStatus && status ? 420500 : 0 } }));
+    res.end(JSON.stringify({ ...data, error_info: { code: (failStatus && status) || url.pathname === webFailureEndpoint ? 420500 : 0 } }));
   });
   await new Promise(resolve => fixtureServer.listen(0, '127.0.0.1', resolve));
   env.TTMG_VIBE_TEST_PORT = String(fixtureServer.address().port);
@@ -193,6 +229,13 @@ async function main() {
 
   let bindingHtml;
   const appInfoPath = path.join(temp, 'app-info.json');
+  const invalidLegacy = await run([...input, '--app-info', appInfoPath, '--dry-run', '--format', 'json']);
+  assert.equal(invalidLegacy.code, 1);
+  const legacyFailure = events(invalidLegacy)[0];
+  assert.equal(legacyFailure.errorCode, 'VIBE_INVALID_APP_INFO');
+  assert.equal(legacyFailure.platformWrite, false);
+  assert.match(legacyFailure.message, /Remove --app-info|移除 --app-info/);
+  assert.doesNotMatch(legacyFailure.message, /are required|需要简介/);
   fs.writeFileSync(appInfoPath, JSON.stringify({
     description: 'Process contract fixture', category: 'Casual', subcategory: 'Puzzle',
     terms_of_service: 'https://example.invalid/terms', privacy_policy: 'https://example.invalid/privacy',
@@ -323,6 +366,7 @@ async function main() {
   webMode = true;
   for (const format of ['json', 'ndjson']) {
     const receipt = path.join(temp, `upload-web-${format}.ndjson`);
+    const requestStart = requests.length;
     const web = await run([...input.filter(v => v !== '--no-open'), '--web', '--format', format, '--poll-interval', '0.2'], async event => {
       if (event.status === 'waiting_authorization') {
         assert.equal(event.authorizationMode, 'web');
@@ -342,22 +386,45 @@ async function main() {
       TTMG_AUTH_OPEN_TEST_RECEIPT: receipt,
       // Explicit --web must not inherit an old Mock backend setting.
       TTMG_VIBE_BACKEND: 'mock',
+      TTMG_VIBE_TEST_RETAIN_UPLOAD_SOCKET: '1',
     });
-    assert.equal(web.code, 1, web.stderr);
+    assert.equal(web.code, 0, web.stderr);
     const output = events(web);
-    assert.equal(output.at(-1).errorCode, 'VIBE_REAL_UPLOAD_NOT_READY');
+    assert.equal(output.at(-1).status, 'uploaded');
     assert.equal(output.at(-1).simulation, false);
     assert.equal(output.at(-1).backend, 'ppe');
     assert.equal(output.at(-1).readyForInput, true);
-    assert.equal(output.at(-1).uploadAttempted, false);
-    assert.equal(output.at(-1).uploaded, false);
+    assert.equal(output.at(-1).uploadAttempted, true);
+    assert.equal(output.at(-1).uploaded, true);
+    assert.equal(output.at(-1).taskStatusRaw, 3);
+    assert.equal(output.filter(e => e.terminal).length, 1);
     assert.equal(webPolls, 5, 'Only true backend readiness unlocks authorization');
+    assert.deepEqual(requests.slice(requestStart).map(r => r.path.split('/').filter(Boolean).at(-1)), [
+      'create_minis_import_task_for_agent', ...Array(5).fill('get_minis_import_task_status_for_agent'),
+      'upload_minis_import_app_icon_for_agent', 'submit_minis_import_info_for_agent', 'upload_minis_import_package_for_agent',
+    ]);
     if (format === 'json') assert.equal(output.length, 1);
     const opens = fs.readFileSync(receipt, 'utf8').trim().split('\n').map(line => JSON.parse(line));
     assert.equal(opens.length, 1);
     assert.ok(opens[0].args.some(arg => /^http:\/\/127\.0\.0\.1:\d+\/[a-f0-9]{48}\/authorize$/.test(arg)));
-    assert.doesNotMatch(JSON.stringify(opens) + web.stdout + web.stderr, /process-test-secret|import_token|aweme:\/\//);
+    assert.doesNotMatch(JSON.stringify(opens) + web.stdout + web.stderr, /process-test-secret|import_token|web-icon-receipt|web-package-receipt|aweme:\/\//);
   }
+  webFailureEndpoint = '/bff/app_info/minis_import/submit_minis_import_info_for_agent/';
+  const failedStart = requests.length;
+  const webUploadFailure = await run([...input.filter(v => v !== '--no-open'), '--web', '--format', 'json'], undefined, {
+    NODE_OPTIONS: env.NODE_OPTIONS + ' --require=' + path.join(__dirname, 'vibe-auth-open-test-preload.cjs'),
+    TTMG_AUTH_OPEN_TEST_RECEIPT: path.join(temp, 'web-failure-open.ndjson'),
+    TTMG_VIBE_TEST_RETAIN_UPLOAD_SOCKET: '1',
+  });
+  assert.equal(webUploadFailure.code, 1);
+  const webFailure = events(webUploadFailure)[0];
+  assert.equal(webFailure.errorCode, 'VIBE_BACKEND_REJECTED');
+  assert.equal(webFailure.uploadAttempted, true);
+  assert.equal(webFailure.uploaded, false);
+  assert.equal(webFailure.simulation, false);
+  assert.equal(requests.at(-1).path, webFailureEndpoint);
+  assert.equal(requests.slice(failedStart).filter(r => r.path === webFailureEndpoint).length, 1);
+  webFailureEndpoint = undefined;
   webMode = false;
 
   const json = await run(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttmg/cli",
-  "version": "0.4.6-vibe-beta.8",
+  "version": "0.4.6-vibe-beta.10",
   "description": "TikTok Mini Game Command Line Tool",
   "license": "ISC",
   "bin": {

package/vibe-upload.md

@@ -2,7 +2,7 @@
 
 ## 中文
 
-本次范围：本地准备 → 扫码绑定 → 上传头像 → 提交名称和头像信息 → 上传代码包 → 上传完成。不包含预览、审核或正式发布。当前创建／查询接 PPE，授权和素材上传仍为模拟。
+本次范围：本地准备 → 授权绑定 → 上传头像 → 提交应用信息 → 上传代码包 → 上传完成。不包含预览、审核或正式发布。`--web` 使用真实 PPE 授权和上传；`--mock` 的授权与素材上传仍为模拟。网页授权后自动上传的修复已在 `0.4.6-vibe-beta.9` 发布；用户输入要求已在 `0.4.6-vibe-beta.10` 修正。
 
 ### 博华如何接入
 
@@ -26,36 +26,23 @@ ttmg upload --vibe --dir ./game --title "星环守卫" --icon ./avatar.png --dry
 
 已有 ZIP 时，用 `--package ./game.zip` 替换 `--dir ./game`。名称和头像必须由开发者提供；演示脚本中的临时样本不作为产品默认素材。
 
-### 完整应用信息校验
+### 用户需要提供什么
 
-维护者可添加 `--app-info ./app-info.json`，为真实上传准备完整参数。该选项不改变现有 `--mock` 用法，也不解除 PPE 素材上传限制。
+**只收集游戏标题和本地头像，并使用当前游戏目录或代码包。** 描述、分类、服务条款、隐私政策、版权确认及其他应用资料由平台默认处理，Skill 不向用户索要，也不生成资料表单或自行补值。
 
-```sh
-ttmg upload --vibe --package ./game.zip --title "测试游戏" --icon ./avatar.png --app-info ./app-info.json --dry-run --format json
-```
-
-JSON 文件为以下字段组成的对象，最大 64 KiB；名称由 `--title` 提供，头像 URI 由上传接口返回，不在文件中填写。
-
-| 字段 | 要求 |
-| --- | --- |
-| description、category、subcategory | 必填非空字符串；分类与子分类应使用平台分类表中的配对值，本地暂不校验分类枚举 |
-| terms_of_service、privacy_policy | 必填 HTTP(S) 链接，不含用户名和密码；须使用游戏自己的真实条款与隐私链接 |
-| copyright_confirmation | 必须显式为 true；只有用户已确认版权时才填写，Skill 不得代为默认确认 |
-| apple_team_id、contact_email、region、min_sdk_version | 可选字符串；填写邮箱时检查基本格式 |
-
-提供该文件后，创建任务前检查名称最多 30 个字符，以及头像为 PNG/JPEG、1024×1024、最大 5 MiB。头像仅做文件头预检，完整解码由后端校验。错误分别返回 `VIBE_INVALID_APP_INFO`、`VIBE_TITLE_TOO_LONG`、`VIBE_PLATFORM_ICON_INVALID`，`nextAction=fix_input`。JSON 不接受额外字段，内容不会进入结构化输出；修改后重新运行 dry-run。
+能力查询和上传事件均返回 `inputRequirements`：`requiredUserInputs=["title","icon"]`、`additionalMetadataSource="platform-defaults"`、`requestAdditionalMetadata=false`。`--app-info` 仅兼容旧调用，当前流程不使用。
 
 ### Skill 读取什么
 
 #### 上传时直接使用网页授权
 
-使用 `--web`：CLI 通过内置 `ppe_op_vc` 真实创建任务，在执行机的系统浏览器打开授权页，并持续查询真实绑定状态。Skill 不需要配置环境或再调用 `auth open`。只有服务端返回 `ready_for_input=true` 才算绑定就绪，不模拟授权成功。
+使用 `--web`：CLI 通过内置 `ppe_op_vc` 真实创建任务，在执行机的系统浏览器打开授权页，并持续查询真实绑定状态。服务端返回 `ready_for_input=true` 后，原进程使用同一任务依次上传头像、提交应用信息、上传代码包。Skill 不需要配置环境、再调用 `auth open` 或另发上传命令。
 
 ```sh
 ttmg upload --vibe --web --dir ./game --title "星环守卫" --icon ./avatar.png --format ndjson
 ```
 
-原 `upload --vibe --mock` 链路不变。`--web` 与 `--mock`、`--mock-scenario`、`--vibe-api`、`--no-open` 互斥，在创建任务前报错；显式 `--web` 不继承旧 Mock 后端设置。`--dry-run` 不创建任务或打开浏览器。JSON/NDJSON 模式也会打开浏览器，但不污染结构化输出。当前授权就绪后仍返回 `VIBE_REAL_UPLOAD_NOT_READY`，不会伪装成上传成功，也不自动降级 Mock。
+原 `upload --vibe --mock` 链路不变。`--web` 与 `--mock`、`--mock-scenario`、`--vibe-api`、`--no-open` 互斥，在创建任务前报错；显式 `--web` 不继承旧 Mock 后端设置。`--dry-run` 不创建任务或打开浏览器。JSON/NDJSON 模式也会打开浏览器，但不污染结构化输出。真实上传失败时返回对应错误，不自动重试写入或降级 Mock。
 
 等待事件返回 `authorizationMode=web` 和 `browserOpenRequested`。真实授权场景的 `nextAction=open_browser` 表示在浏览器完成授权，不代表已授权。打开失败时返回 `browserOpenErrorCode=VIBE_BROWSER_OPEN_FAILED`，仍轮询原任务，可用下面的辅助命令重试，不重新建任务。
 
@@ -71,7 +58,7 @@ ttmg auth open --page-url <pageUrl> --format json
 
 成功返回 `status=open_requested`、`browserOpenRequested=true`、`platformWrite=false`，只表示已请求系统浏览器打开。页面过期、流程结束或没有可用真实授权地址时，返回 `VIBE_AUTH_PAGE_UNAVAILABLE`；URL 输入错误返回 `VIBE_INVALID_PAGE_URL`，浏览器启动失败返回 `VIBE_BROWSER_OPEN_FAILED`。不得因打开失败而自动创建新任务。
 
-命令在 CLI 所在电脑执行；远程机器不会打开开发者电脑的浏览器。二维码原路径和 `--mock` 自动推进逻辑保持不变：混合模拟不会等待网页授权，真实网页联调请使用维护者的 PPE 模式。本功能需包含新命令的构建版本。
+命令在 CLI 所在电脑执行；远程机器不会打开开发者电脑的浏览器。二维码原路径和 `--mock` 自动推进逻辑保持不变；真实网页授权与上传使用 `--web`。
 
 输出 schema 为 `"2"`。每行 NDJSON 是同一 `operationId` 的状态快照；只有最后一行 `terminal=true`。`--format json` 仅在结束时向 stdout 输出一个对象，等待授权的本地页面地址写到 stderr。不要解析中文／英文文案判断状态。
 
@@ -79,7 +66,7 @@ ttmg auth open --page-url <pageUrl> --format json
 | ------------------------------- | ----------------------------------------------------------------------------------------- |
 | precheck / packaging / prepared | 正在检查或准备素材；dry-run 的 prepared 为终态                                            |
 | creating_task                   | 正在准备授权绑定                                                                          |
-| waiting_authorization           | 打开 pageUrl；nextAction=scan_qr 时提示使用 TikTok 扫码，nextAction=wait 时仅等待模拟推进 |
+| waiting_authorization           | nextAction=open_browser 时在已打开的系统浏览器完成授权；scan_qr 时提示 TikTok 扫码；wait 时等待模拟推进 |
 | uploading                       | 根据 uploadStep 显示 avatar、app_info、package 的进度，不再询问授权                       |
 | uploaded                        | terminal=true 且 uploaded=true：本次上传完成；不是审核通过或正式发布                      |
 | failed / cancelled              | 根据 errorCode、message 和 nextAction 提示处理，不自动重传                                |
@@ -92,7 +79,7 @@ ttmg auth open --page-url <pageUrl> --format json
 
 按阶段补充：`taskId`（字符串，禁止转成 JS Number）、`pollIntervalSeconds`、`readyForInput`、`taskStatusRaw`（仅诊断）、`uploadStep`、`loadedBytes`、`totalBytes`、`pageUrl`、`qrPurpose=authorization_binding`、素材大小和包 SHA256。代码包字节进度达到 100% 不代表成功，必须等待最终上传回执。
 
-`nextAction` 取值：`wait`、`scan_qr`、`fix_input`、`restart_authorization`、`check_task`、`none`。已开始上传后发生失败／超时，先检查 task，不能直接再次创建并重传。若上传已完成但页面失败，仍保留 `uploaded=true`，同时返回错误；Skill 提示上传已完成但展示失败。
+`nextAction` 取值：`wait`、`open_browser`、`scan_qr`、`fix_input`、`restart_authorization`、`check_task`、`none`。已开始上传后发生失败／超时，先检查 task，不能直接再次创建并重传。若上传已完成但页面失败，仍保留 `uploaded=true`，同时返回错误；Skill 提示上传已完成但展示失败。
 
 退出码：成功／dry-run 为 0，失败为 1，Ctrl+C 为 130。进程或宿主意外终止导致没有终态时，不得认定上传成功。模拟必须显示为模拟：即使 `uploaded=true`，`simulation=true` 时也只表示模拟步骤完成。纯 Mock 的 `platformWrite=false`；混合联调创建过真实任务时为 true，但都不代表真实上传。
 
@@ -166,7 +153,9 @@ TTMG_VIBE_BACKEND=local-http TTMG_VIBE_API=http://127.0.0.1:3100 ttmg upload --v
 
 ### Skill entry
 
-Scope: local preparation → authorization binding → avatar upload → app-info submission → package upload → **upload complete**. No preview, review or production release. Mock and loopback HTTP cover this contract. PPE additionally supports real task creation, polling and the authorization QR only; material upload and production access are not enabled.
+Scope: local preparation → authorization binding → avatar upload → app-info submission → package upload → **upload complete**. No preview, review or production release. `--web` uses real PPE authorization and uploads; `--mock` still simulates authorization and material uploads.
+
+Automatic upload was fixed in `0.4.6-vibe-beta.9`; the user-input clarification ships in `0.4.6-vibe-beta.10`.
 
 Keep the existing --mock command; no environment setup is required:
 
@@ -178,24 +167,13 @@ Use `--package ./game.zip` instead of --dir for a prepared ZIP. Use `--dry-run -
 
 The Skill gathers the title and user-selected local icon in conversation. It does not call backend APIs, store credentials, poll services, or introduce a metadata form. The CLI internally connects working steps to PPE and simulates the remaining steps. Removing PPE at production launch is a CLI release change, not a Skill configuration step.
 
-### Complete metadata validation
-
-Maintainers can add `--app-info ./app-info.json` to prepare complete upload parameters. It does not change the existing --mock entry or enable PPE material uploads.
-
-```sh
-ttmg upload --vibe --package ./game.zip --title "Test game" --icon ./avatar.png --app-info ./app-info.json --dry-run --format json
-```
+### User inputs
 
-The file is a JSON object, at most 64 KiB. The CLI supplies app_name from --title and icon_uri from the upload response; do not put them in this file.
+**Collect only the game title and local icon, using the current game directory or ZIP.** The platform defaults all other app metadata. Do not request extra fields, add a form or invent values.
 
-| Fields | Requirements |
-| --- | --- |
-| description, category, subcategory | Required nonempty strings; use a valid platform category/subcategory pair. Local enum validation is not implemented yet |
-| terms_of_service, privacy_policy | Required HTTP(S) URLs without embedded credentials; provide the game's actual legal links |
-| copyright_confirmation | Explicit true only after the user confirms ownership; the Skill must not infer consent |
-| apple_team_id, contact_email, region, min_sdk_version | Optional strings; email receives a basic syntax check |
+Capabilities and upload events include `inputRequirements` with `requiredUserInputs=["title","icon"]`, `additionalMetadataSource="platform-defaults"` and `requestAdditionalMetadata=false`.
 
-With this file, preflight checks the title length (30 characters maximum) and icon (PNG/JPEG, 1024 x 1024, at most 5 MiB) before task creation. Image validation inspects headers only; the backend performs decoding. Failures return VIBE_INVALID_APP_INFO, VIBE_TITLE_TOO_LONG or VIBE_PLATFORM_ICON_INVALID with nextAction=fix_input. Unknown JSON fields are rejected, and metadata is not exposed in structured output. Fix the input and rerun dry-run.
+The `--app-info` option remains for legacy callers only; the current workflow does not use it.
 
 Source checked on 2026-09-14: BFF enforces these icon limits and a 100 MiB Native ZIP/uncompressed-size limit. Full local ZIP-content/uncompressed-size validation is not implemented. Gateway transport, TOS access, phone OAuth and upload receipts still require real integration testing.
 
@@ -203,13 +181,13 @@ Source checked on 2026-09-14: BFF enforces these icon limits and a 100 MiB Nativ
 
 #### Use browser authorization during upload
 
-Use `--web` for real authorization. The CLI creates a task through the built-in `ppe_op_vc` lane, opens authorization in the execution machine's system browser and polls real binding status until `ready_for_input=true`. No environment setup or second Skill command is required. Authorization success is never simulated.
+Use `--web` for real authorization. The CLI creates a task through the built-in `ppe_op_vc` lane, opens authorization in the execution machine's system browser and polls real binding status. Once the server returns `ready_for_input=true`, the same process uploads the icon, submits app information and uploads the package using the same task. No environment setup, `auth open` helper or second upload command is required.
 
 ```sh
 ttmg upload --vibe --web --dir ./game --title "My game" --icon ./avatar.png --format ndjson
 ```
 
-The original `upload --vibe --mock` workflow is unchanged. `--web` conflicts with `--mock`, `--mock-scenario`, `--vibe-api` and `--no-open` before task creation, and does not inherit an old Mock backend environment setting. Dry-run creates no task and opens no browser. JSON/NDJSON also open the browser without contaminating stdout. Real material upload remains gated: after authorization, the command returns `VIBE_REAL_UPLOAD_NOT_READY`, not upload success or a Mock fallback.
+The original `upload --vibe --mock` workflow is unchanged. `--web` conflicts with `--mock`, `--mock-scenario`, `--vibe-api` and `--no-open` before task creation, and does not inherit an old Mock backend environment setting. Dry-run creates no task and opens no browser. JSON/NDJSON also open the browser without contaminating stdout. Real upload failures return an error; writes are not automatically retried or replaced by Mock results.
 
 Waiting events add `authorizationMode=web` and `browserOpenRequested`. For real authorization, `nextAction=open_browser` requests browser approval; it does not prove approval. If opening fails, `browserOpenErrorCode=VIBE_BROWSER_OPEN_FAILED` is returned while polling continues. Retry the helper below against the same task instead of creating another one.
 
@@ -235,17 +213,16 @@ bad input returns `VIBE_INVALID_PAGE_URL`, and browser launch failures return
 `VIBE_BROWSER_OPEN_FAILED`. Do not create another task automatically on failure.
 
 This opens the browser on the CLI computer, not a remote user's computer. Existing
-QR behavior and `--mock` auto-advance stay unchanged; use the maintainer PPE mode
-for real browser authorization, since hybrid simulation does not wait for it.
-Use a build containing the new command; existing released versions are unchanged.
+QR behavior and `--mock` auto-advance stay unchanged. Use `--web` for real browser
+authorization followed by upload.
 
-Schema **2** provides NDJSON snapshots under one operationId, with exactly one final `terminal=true` event. JSON mode emits one final object on stdout and the authorization page address on stderr. Structured modes do not open the browser automatically; open pageUrl in the AI workspace preview or browser. Text mode opens it unless --no-open.
+Schema **2** provides NDJSON snapshots under one operationId, with exactly one final `terminal=true` event. JSON mode emits one final object on stdout and the authorization page address on stderr. With `--web`, all output formats open the system browser automatically. Other modes open pageUrl automatically only in text mode unless --no-open is set.
 
 | status                          | Skill action                                                                              |
 | ------------------------------- | ----------------------------------------------------------------------------------------- |
 | precheck / packaging / prepared | Wait for input preparation; prepared is terminal only for dry-run                         |
 | creating_task                   | Preparing binding                                                                         |
-| waiting_authorization           | Open pageUrl; scan_qr requests a phone scan, wait means simulation advances automatically |
+| waiting_authorization           | open_browser requests approval in the opened system browser; scan_qr requests a TikTok scan; wait means simulation advances automatically |
 | uploading                       | Follow uploadStep: avatar, app_info, package                                              |
 | uploaded                        | terminal=true and uploaded=true mean upload complete, not release                         |
 | failed / cancelled              | Read errorCode, message and nextAction; do not blindly repeat uploads                     |
@@ -256,7 +233,7 @@ platformWrite becomes true immediately before attempting real task creation, not
 
 For backend=ppe-mock, simulation=true and simulationStartsAt=authorization. platformWrite becomes true before real task creation. taskStatusRaw and readyForInput retain the last real observation; simulatedTaskStatusRaw and simulatedReadyForInput describe the local demo separately. The uploaded terminal state means simulated completion only; the Skill must retain the simulation label.
 
-nextAction is wait, scan_qr, fix_input, restart_authorization, check_task or none. If upload was attempted, verify the task before retrying. If a result page fails after confirmed upload, uploaded remains true alongside the error. Progress at 100% is not a receipt. Missing terminal output after a killed process is not success. Exit codes: 0 success/dry-run, 1 failure, 130 cancellation.
+nextAction is wait, open_browser, scan_qr, fix_input, restart_authorization, check_task or none. If upload was attempted, verify the task before retrying. If a result page fails after confirmed upload, uploaded remains true alongside the error. Progress at 100% is not a receipt. Missing terminal output after a killed process is not success. Exit codes: 0 success/dry-run, 1 failure, 130 cancellation.
 
 Pure Mock reports simulation=true and platformWrite=false. Hybrid PPE + Mock reports platformWrite=true once real task creation is attempted, but uploaded=true still means simulated completion only. No backend exposes credentials or raw HTTP errors. Backend integration must preserve this public contract; changes to user actions or completion semantics require an explicit schema migration.
 
@@ -278,7 +255,7 @@ The five endpoint contracts are listed in the table above. Mock and loopback HTT
 
 A business-success response requires error_info.code=0. Package completion additionally requires package_uri and a valid non-failure status; no polling until SUCCEEDED. No platform Cookies or redirects are used. Configure TTMG_VIBE_BACKEND=local-http plus TTMG_VIBE_API=http://127.0.0.1:3100, or pass --vibe-api explicitly; this option rejects remote hosts.
 
-For internal PPE integration, set TTMG_VIBE_BACKEND=ppe and TTMG_VIBE_PPE=ppe_op_vc without changing the Skill command. This uses real creation/polling on developers.tiktok.com and encodes the QR as aweme://webview?url=<encodeURIComponent(landing_url)>. The phone must use the same lane. OAuth is not bypassed or simulated. After authorization, VIBE_REAL_UPLOAD_NOT_READY still stops the flow before any material upload; --app-info currently prepares and validates the local contract only.
+For internal PPE integration, set TTMG_VIBE_BACKEND=ppe and TTMG_VIBE_PPE=ppe_op_vc without changing the Skill command. This uses real creation/polling on developers.tiktok.com and encodes the QR as aweme://webview?url=<encodeURIComponent(landing_url)>. The phone must use the same lane. OAuth is not bypassed or simulated. After authorization, the CLI uploads the icon, submits the title and icon URI, and uploads the package. Other app metadata uses platform defaults. The regular --web entry configures PPE internally and opens the system browser.
 
 The normal --mock trial internally uses ppe_op_vc without environment variables. Task creation, QR and three polls are real; authorization, icon, app-info and package uploads are simulated with separate in-memory credentials. This changes --mock from an offline run into a PPE integration trial: platformWrite becomes true when task creation is attempted, while simulation remains true. No real material-upload endpoint is called, and real request failures still fail. --mock-scenario controls only simulated steps. Offline unit/process tests use injected transports, not a separate developer configuration.