@ttmg/cli 0.4.6-vibe-beta.9 → 0.4.6-vibe-beta.10

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttmg/cli",
-  "version": "0.4.6-vibe-beta.9",
+  "version": "0.4.6-vibe-beta.10",
   "description": "TikTok Mini Game Command Line Tool",
   "license": "ISC",
   "bin": {

package/dist/scripts/verify-agent-contract.js

@@ -385,6 +385,8 @@ assert.notEqual(
 );
 
 const uploadHelp = runCli(['upload', '--help']);
+assert.doesNotMatch(uploadHelp.stdout, /--app-info/);
+assert.match(uploadHelp.stdout.replace(/\s+/g, ' '), /only title and icon|只收集标题和头像/);
 assertExit(uploadHelp, 0, 'upload help');
 assert.match(uploadHelp.stdout, /--preview\b/);
 assert.match(uploadHelp.stdout, /--serve-preview-page\b/);

package/dist/scripts/vibe-upload-smoke.js

@@ -99,7 +99,15 @@ function events(result) {
   return result.stdout
     .trim()
     .split('\n')
-    .map(line => JSON.parse(line));
+    .map(line => {
+      const event = JSON.parse(line);
+      if (event.mode === 'vibe') {
+        assert.deepEqual(event.inputRequirements.requiredUserInputs, ['title', 'icon']);
+        assert.equal(event.inputRequirements.requestAdditionalMetadata, false);
+        assert.equal(event.inputRequirements.additionalMetadataSource, 'platform-defaults');
+      }
+      return event;
+    });
 }
 async function main() {
   // Exercise the built worker IPC and new command without creating a platform task.
@@ -183,6 +191,8 @@ async function main() {
         assert.equal(info.import_token, 'process-test-secret');
         assert.equal(info.app_info.icon_uri, 'web-icon-receipt');
         assert.equal(info.app_info.app_name, input[input.indexOf('--title') + 1]);
+        assert.deepEqual(Object.keys(info.app_info).sort(), ['app_name', 'icon_uri'],
+          'Default uploads must leave other metadata to platform defaults');
       } else {
         assert.match(req.headers['content-type'], /^multipart\/form-data; boundary=/);
         assert.match(body.toString(), /name="task_id"\r\n\r\n7684370037737553941\r\n/);
@@ -219,6 +229,13 @@ async function main() {
 
   let bindingHtml;
   const appInfoPath = path.join(temp, 'app-info.json');
+  const invalidLegacy = await run([...input, '--app-info', appInfoPath, '--dry-run', '--format', 'json']);
+  assert.equal(invalidLegacy.code, 1);
+  const legacyFailure = events(invalidLegacy)[0];
+  assert.equal(legacyFailure.errorCode, 'VIBE_INVALID_APP_INFO');
+  assert.equal(legacyFailure.platformWrite, false);
+  assert.match(legacyFailure.message, /Remove --app-info|移除 --app-info/);
+  assert.doesNotMatch(legacyFailure.message, /are required|需要简介/);
   fs.writeFileSync(appInfoPath, JSON.stringify({
     description: 'Process contract fixture', category: 'Casual', subcategory: 'Puzzle',
     terms_of_service: 'https://example.invalid/terms', privacy_policy: 'https://example.invalid/privacy',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ttmg/cli",
-  "version": "0.4.6-vibe-beta.9",
+  "version": "0.4.6-vibe-beta.10",
   "description": "TikTok Mini Game Command Line Tool",
   "license": "ISC",
   "bin": {

package/vibe-upload.md

@@ -2,7 +2,7 @@
 
 ## 中文
 
-本次范围：本地准备 → 授权绑定 → 上传头像 → 提交应用信息 → 上传代码包 → 上传完成。不包含预览、审核或正式发布。`--web` 使用真实 PPE 授权和上传；`--mock` 的授权与素材上传仍为模拟。网页授权后的自动上传修复尚未发布，已发布的 `0.4.6-vibe-beta.8` 会在授权就绪后错误停止。
+本次范围：本地准备 → 授权绑定 → 上传头像 → 提交应用信息 → 上传代码包 → 上传完成。不包含预览、审核或正式发布。`--web` 使用真实 PPE 授权和上传；`--mock` 的授权与素材上传仍为模拟。网页授权后自动上传的修复已在 `0.4.6-vibe-beta.9` 发布；用户输入要求已在 `0.4.6-vibe-beta.10` 修正。
 
 ### 博华如何接入
 
@@ -26,24 +26,11 @@ ttmg upload --vibe --dir ./game --title "星环守卫" --icon ./avatar.png --dry
 
 已有 ZIP 时，用 `--package ./game.zip` 替换 `--dir ./game`。名称和头像必须由开发者提供；演示脚本中的临时样本不作为产品默认素材。
 
-### 完整应用信息校验
+### 用户需要提供什么
 
-使用 `--app-info ./app-info.json` 提供完整应用资料。CLI 将其与开发者提供的名称、上传返回的头像 URI 一起提交；不为缺失的条款、隐私链接或版权确认填默认值。该选项不改变现有 `--mock` 用法。
+**只收集游戏标题和本地头像，并使用当前游戏目录或代码包。** 描述、分类、服务条款、隐私政策、版权确认及其他应用资料由平台默认处理，Skill 不向用户索要，也不生成资料表单或自行补值。
 
-```sh
-ttmg upload --vibe --package ./game.zip --title "测试游戏" --icon ./avatar.png --app-info ./app-info.json --dry-run --format json
-```
-
-JSON 文件为以下字段组成的对象，最大 64 KiB；名称由 `--title` 提供，头像 URI 由上传接口返回，不在文件中填写。
-
-| 字段 | 要求 |
-| --- | --- |
-| description、category、subcategory | 必填非空字符串；分类与子分类应使用平台分类表中的配对值，本地暂不校验分类枚举 |
-| terms_of_service、privacy_policy | 必填 HTTP(S) 链接，不含用户名和密码；须使用游戏自己的真实条款与隐私链接 |
-| copyright_confirmation | 必须显式为 true；只有用户已确认版权时才填写，Skill 不得代为默认确认 |
-| apple_team_id、contact_email、region、min_sdk_version | 可选字符串；填写邮箱时检查基本格式 |
-
-提供该文件后，创建任务前检查名称最多 30 个字符，以及头像为 PNG/JPEG、1024×1024、最大 5 MiB。头像仅做文件头预检，完整解码由后端校验。错误分别返回 `VIBE_INVALID_APP_INFO`、`VIBE_TITLE_TOO_LONG`、`VIBE_PLATFORM_ICON_INVALID`，`nextAction=fix_input`。JSON 不接受额外字段，内容不会进入结构化输出；修改后重新运行 dry-run。
+能力查询和上传事件均返回 `inputRequirements`：`requiredUserInputs=["title","icon"]`、`additionalMetadataSource="platform-defaults"`、`requestAdditionalMetadata=false`。`--app-info` 仅兼容旧调用，当前流程不使用。
 
 ### Skill 读取什么
 
@@ -166,7 +153,9 @@ TTMG_VIBE_BACKEND=local-http TTMG_VIBE_API=http://127.0.0.1:3100 ttmg upload --v
 
 ### Skill entry
 
-Scope: local preparation → authorization binding → avatar upload → app-info submission → package upload → **upload complete**. No preview, review or production release. `--web` uses real PPE authorization and uploads; `--mock` still simulates authorization and material uploads. The automatic-upload fix is unreleased; published `0.4.6-vibe-beta.8` incorrectly stops after authorization.
+Scope: local preparation → authorization binding → avatar upload → app-info submission → package upload → **upload complete**. No preview, review or production release. `--web` uses real PPE authorization and uploads; `--mock` still simulates authorization and material uploads.
+
+Automatic upload was fixed in `0.4.6-vibe-beta.9`; the user-input clarification ships in `0.4.6-vibe-beta.10`.
 
 Keep the existing --mock command; no environment setup is required:
 
@@ -178,24 +167,13 @@ Use `--package ./game.zip` instead of --dir for a prepared ZIP. Use `--dry-run -
 
 The Skill gathers the title and user-selected local icon in conversation. It does not call backend APIs, store credentials, poll services, or introduce a metadata form. The CLI internally connects working steps to PPE and simulates the remaining steps. Removing PPE at production launch is a CLI release change, not a Skill configuration step.
 
-### Complete metadata validation
-
-Use `--app-info ./app-info.json` to supply complete app information. The CLI submits it with the developer's title and the uploaded icon URI; it does not invent legal URLs or copyright consent. The existing --mock entry is unchanged.
-
-```sh
-ttmg upload --vibe --package ./game.zip --title "Test game" --icon ./avatar.png --app-info ./app-info.json --dry-run --format json
-```
+### User inputs
 
-The file is a JSON object, at most 64 KiB. The CLI supplies app_name from --title and icon_uri from the upload response; do not put them in this file.
+**Collect only the game title and local icon, using the current game directory or ZIP.** The platform defaults all other app metadata. Do not request extra fields, add a form or invent values.
 
-| Fields | Requirements |
-| --- | --- |
-| description, category, subcategory | Required nonempty strings; use a valid platform category/subcategory pair. Local enum validation is not implemented yet |
-| terms_of_service, privacy_policy | Required HTTP(S) URLs without embedded credentials; provide the game's actual legal links |
-| copyright_confirmation | Explicit true only after the user confirms ownership; the Skill must not infer consent |
-| apple_team_id, contact_email, region, min_sdk_version | Optional strings; email receives a basic syntax check |
+Capabilities and upload events include `inputRequirements` with `requiredUserInputs=["title","icon"]`, `additionalMetadataSource="platform-defaults"` and `requestAdditionalMetadata=false`.
 
-With this file, preflight checks the title length (30 characters maximum) and icon (PNG/JPEG, 1024 x 1024, at most 5 MiB) before task creation. Image validation inspects headers only; the backend performs decoding. Failures return VIBE_INVALID_APP_INFO, VIBE_TITLE_TOO_LONG or VIBE_PLATFORM_ICON_INVALID with nextAction=fix_input. Unknown JSON fields are rejected, and metadata is not exposed in structured output. Fix the input and rerun dry-run.
+The `--app-info` option remains for legacy callers only; the current workflow does not use it.
 
 Source checked on 2026-09-14: BFF enforces these icon limits and a 100 MiB Native ZIP/uncompressed-size limit. Full local ZIP-content/uncompressed-size validation is not implemented. Gateway transport, TOS access, phone OAuth and upload receipts still require real integration testing.
 
@@ -277,7 +255,7 @@ The five endpoint contracts are listed in the table above. Mock and loopback HTT
 
 A business-success response requires error_info.code=0. Package completion additionally requires package_uri and a valid non-failure status; no polling until SUCCEEDED. No platform Cookies or redirects are used. Configure TTMG_VIBE_BACKEND=local-http plus TTMG_VIBE_API=http://127.0.0.1:3100, or pass --vibe-api explicitly; this option rejects remote hosts.
 
-For internal PPE integration, set TTMG_VIBE_BACKEND=ppe and TTMG_VIBE_PPE=ppe_op_vc without changing the Skill command. This uses real creation/polling on developers.tiktok.com and encodes the QR as aweme://webview?url=<encodeURIComponent(landing_url)>. The phone must use the same lane. OAuth is not bypassed or simulated. After authorization, the CLI uploads the icon, submits app information and uploads the package; --app-info supplies complete app metadata. The regular --web entry configures PPE internally and opens the system browser.
+For internal PPE integration, set TTMG_VIBE_BACKEND=ppe and TTMG_VIBE_PPE=ppe_op_vc without changing the Skill command. This uses real creation/polling on developers.tiktok.com and encodes the QR as aweme://webview?url=<encodeURIComponent(landing_url)>. The phone must use the same lane. OAuth is not bypassed or simulated. After authorization, the CLI uploads the icon, submits the title and icon URI, and uploads the package. Other app metadata uses platform defaults. The regular --web entry configures PPE internally and opens the system browser.
 
 The normal --mock trial internally uses ppe_op_vc without environment variables. Task creation, QR and three polls are real; authorization, icon, app-info and package uploads are simulated with separate in-memory credentials. This changes --mock from an offline run into a PPE integration trial: platformWrite becomes true when task creation is attempted, while simulation remains true. No real material-upload endpoint is called, and real request failures still fail. --mock-scenario controls only simulated steps. Offline unit/process tests use injected transports, not a separate developer configuration.