@tokenbuddy/tb-admin 1.0.15 → 1.0.28

package/tests/admin.test.ts

@@ -3,8 +3,27 @@ import { buildAdminCli } from "../src/cli.js";
 import { FlyProvider, parseFlyMachineIds, requirePublishedDockerImage } from "../src/server-cmd.js";
 import { startAdminUiServer } from "../src/ui-server.js";
 import { AdminUiState } from "../src/ui-state.js";
-import { UiActions, type UiActionResult } from "../src/ui-actions.js";
+import { UiActions, type CreateSellerRequest, type UiActionResult } from "../src/ui-actions.js";
 import { adminUiHtml } from "../src/ui-static.js";
+import {
+  formatBalanceAmount,
+  formatCount,
+  formatDiscountRatio,
+  formatDuration,
+  formatMoney,
+  formatPercent,
+  formatPricePair,
+  formatSellerCapacity,
+  formatSellerStatus,
+  formatSellerId,
+  formatSpeed,
+  formatTimeCompact,
+  formatTimeFull,
+  formatTimeLedger,
+  sellerStatusTone,
+  statusTone,
+  UNKNOWN_VALUE
+} from "../src/display-format.js";
 import {
   BalanceProbeCache,
   probeUpstreamBalance
@@ -15,8 +34,10 @@ import {
 import * as fs from "fs";
 import * as http from "http";
 import * as path from "path";
+import * as vm from "vm";
 
 const TEMP_CONF_PATH = path.resolve(__dirname, "../../data-test/admin-config.json");
+const PACKAGE_JSON = path.resolve(__dirname, "../package.json");
 
 describe("Admin CLI Config Profile Management Tests", () => {
   beforeEach(() => {
@@ -54,6 +75,21 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(defaultP?.url).toBe("http://127.0.0.1:8000");
   });
 
+  test("tb-admin version follows package version", () => {
+    const packageJson = JSON.parse(fs.readFileSync(PACKAGE_JSON, "utf8"));
+    const program = buildAdminCli(new ConfigManager(TEMP_CONF_PATH));
+
+    expect(program.version()).toBe(packageJson.version);
+  });
+
+  test("admin UI inline script is valid JavaScript", () => {
+    const html = adminUiHtml();
+    const scripts = [...html.matchAll(/<script>([\s\S]*?)<\/script>/g)].map((match) => match[1]);
+
+    expect(scripts.length).toBe(1);
+    expect(() => new vm.Script(scripts[0])).not.toThrow();
+  });
+
   test("Switch default profiles", () => {
     const mgr = new ConfigManager(TEMP_CONF_PATH);
     mgr.setProfile("prod", { url: "http://127.0.0.1:8000", token: "secret-op" });
@@ -81,9 +117,30 @@ describe("Admin CLI Config Profile Management Tests", () => {
 
     expect(bootstrap).toBeDefined();
     expect(sellers).toBeDefined();
-    expect(sellers?.commands.map((command) => command.name()).sort()).toEqual(["get", "put", "validate"]);
+    expect(sellers?.commands.map((command) => command.name()).sort()).toEqual([
+      "add",
+      "get",
+      "list",
+      "put",
+      "remove",
+      "status",
+      "update",
+      "validate"
+    ]);
     expect(sellers?.commands.find((command) => command.name() === "put")?.options.some((option) => option.long === "--file")).toBe(true);
+    expect(sellers?.commands.find((command) => command.name() === "put")?.options.some((option) => option.long === "--force")).toBe(true);
+    expect(sellers?.commands.find((command) => command.name() === "add")?.options.some((option) => option.long === "--expect-version")).toBe(true);
+    expect(sellers?.commands.find((command) => command.name() === "update")?.options.some((option) => option.long === "--expect-version")).toBe(true);
+    expect(sellers?.commands.find((command) => command.name() === "status")?.options.some((option) => option.long === "--expect-version")).toBe(true);
+    expect(sellers?.commands.find((command) => command.name() === "remove")?.options.some((option) => option.long === "--expect-version")).toBe(true);
     expect(sellers?.commands.find((command) => command.name() === "validate")?.options.some((option) => option.long === "--file")).toBe(true);
+    const defaultSeller = bootstrap?.commands.find((command) => command.name() === "default-seller");
+    const registry = bootstrap?.commands.find((command) => command.name() === "registry");
+    expect(defaultSeller?.commands.map((command) => command.name()).sort()).toEqual(["set"]);
+    expect(defaultSeller?.commands.find((command) => command.name() === "set")?.options.some((option) => option.long === "--expect-version")).toBe(true);
+    expect(registry?.commands.map((command) => command.name()).sort()).toEqual(["diff", "import", "publish", "versions"]);
+    expect(registry?.commands.find((command) => command.name() === "import")?.options.some((option) => option.long === "--dry-run")).toBe(true);
+    expect(registry?.commands.find((command) => command.name() === "import")?.options.some((option) => option.long === "--force")).toBe(true);
     expect(sellerConfig).toBeDefined();
     expect(sellerConfig?.commands.map((command) => command.name()).sort()).toEqual(["get", "put", "validate"]);
     expect(sellerConfig?.commands.find((command) => command.name() === "put")?.options.some((option) => option.long === "--file")).toBe(true);
@@ -170,6 +227,32 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(commands).toEqual([]);
   });
 
+  test("FlyProvider passes configured Fly token to flyctl commands", () => {
+    const envs: Array<string | undefined> = [];
+    const provider = new FlyProvider({ token: "fly-token-value" }, {
+      checkFlyctlInstalled: () => true,
+      imageInspector: () => ({ ok: true }),
+      execSync: (_command, options) => {
+        envs.push(options?.env?.FLY_API_TOKEN);
+        return "";
+      },
+      spawnSync: (_command, _args, options) => {
+        envs.push(options?.env?.FLY_API_TOKEN);
+        return { status: 0, signal: null, stdout: "", stderr: "", pid: 1, output: [] };
+      }
+    });
+
+    provider.createSeller({
+      name: "tbs-test",
+      app: "tbs-test",
+      image: "registry.fly.io/tb-seller:latest",
+      flyConfig: "deploy/fly.io/fly.tb-seller.toml",
+      operatorSecret: "operator-secret"
+    });
+
+    expect(envs).toEqual(["fly-token-value", "fly-token-value", "fly-token-value"]);
+  });
+
   test("parseFlyMachineIds reads machine ids and rejects unusable machine lists", () => {
     expect(parseFlyMachineIds(JSON.stringify([
       { id: "machine-1" },
@@ -200,7 +283,7 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(() => validateRegistryDocument(badDefault)).toThrow("defaultSeller `missing`");
   });
 
-  test("tb-admin ui server binds loopback, protects APIs with a session, and serves bootstrap data", async () => {
+  test("tb-admin ui server binds loopback, rejects cross-origin APIs, and serves bootstrap data", async () => {
     const mgr = new ConfigManager(TEMP_CONF_PATH);
     const started = await startAdminUiServer({
       host: "127.0.0.1",
@@ -222,10 +305,14 @@ describe("Admin CLI Config Profile Management Tests", () => {
       })
     });
     try {
-      await expect(fetch(`${started.url.replace(/\?.*/, "")}api/bootstrap`).then((res) => res.status)).resolves.toBe(401);
-      const response = await fetch(`${started.url.replace(/\?.*/, "")}api/bootstrap`, {
-        headers: { "X-TokenBuddy-Ui-Session": started.sessionToken }
+      expect(started.url).not.toContain("session=");
+      const blocked = await fetch(`${started.url}api/bootstrap`, {
+        headers: { Origin: "http://malicious.example" }
       });
+      expect(blocked.status).toBe(403);
+      await expect(blocked.json()).resolves.toMatchObject({ error: "invalid UI origin" });
+
+      const response = await fetch(`${started.url}api/bootstrap`);
       await expect(response.json()).resolves.toMatchObject({
         status: "available",
         registryVersion: 7,
@@ -256,22 +343,19 @@ describe("Admin CLI Config Profile Management Tests", () => {
       url: "https://bootstrap.example.test",
       fetchJson: async (url) => createSellerFetchJson(url),
       commandRunner: async (args): Promise<UiActionResult> => {
-        if (isBootstrapSellersValidate(args)) {
+        if (isBootstrapSellersAdd(args)) {
           const filePath = args[args.indexOf("--file") + 1];
-          const doc = JSON.parse(fs.readFileSync(filePath, "utf8")) as { sellers: Array<{ id: string; status?: string }> };
-          expect(doc.sellers.find((seller) => seller.id === "tbs-nrt-07")?.status).toBe("pending");
+          const entry = JSON.parse(fs.readFileSync(filePath, "utf8")) as { id: string; status?: string };
+          expect(entry).toMatchObject({ id: "tbs-nrt-07", status: "active" });
         }
         calls.push(args);
         return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
       }
     });
     try {
-      const response = await fetch(`${started.url.replace(/\?.*/, "")}api/sellers`, {
+      const response = await fetch(`${started.url}api/sellers`, {
         method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "X-TokenBuddy-Ui-Session": started.sessionToken
-        },
+        headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           sellerName: "tbs-nrt-07",
           app: "tbs-nrt-07",
@@ -305,9 +389,7 @@ describe("Admin CLI Config Profile Management Tests", () => {
 
       let job: any;
       for (let attempt = 0; attempt < 20; attempt += 1) {
-        const poll = await fetch(`${started.url.replace(/\?.*/, "")}api/jobs/${created.jobId}`, {
-          headers: { "X-TokenBuddy-Ui-Session": started.sessionToken }
-        });
+        const poll = await fetch(`${started.url}api/jobs/${created.jobId}`);
         job = await poll.json();
         if (job.status !== "running") {
           break;
@@ -336,9 +418,9 @@ describe("Admin CLI Config Profile Management Tests", () => {
         expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-token-value status"),
         expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-token-value seller-config put --file"),
         expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-token-value upstreams refresh --auto-models"),
-        expect.stringContaining("bootstrap sellers validate --file"),
-        expect.stringContaining("bootstrap sellers put --file")
+        expect.stringContaining("bootstrap sellers add --file"),
       ]);
+      expect(commandLines[5]).toContain("--expect-version 7");
       expect(commandLines.find((line) => line.includes("seller create tbs-nrt-07"))).toContain("--initial-config");
     } finally {
       await new Promise<void>((resolve) => started.server.close(() => resolve()));
@@ -373,7 +455,8 @@ describe("Admin CLI Config Profile Management Tests", () => {
         lastInferenceMs: 700,
         latencySamples: 2,
         upstreamStatus: "healthy",
-        upstreamBalance: "USD 47.95",
+        upstreamBalanceUsdMicros: 47_950_000,
+        upstreamBalanceCurrency: "USD",
         upstreamBalanceSource: "openrouter"
       });
 
@@ -394,6 +477,130 @@ describe("Admin CLI Config Profile Management Tests", () => {
     }
   });
 
+  test("AdminUiState uses Fly provider operator secret for registry sellers without local profiles", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+    const state = new AdminUiState({
+      configManager: mgr,
+      url: "https://bootstrap.example.test",
+      fetchJson: async (url, init) => {
+        const pathName = new URL(url).pathname;
+        if (pathName === "/registry/sellers") {
+          return {
+            version: 9,
+            sellers: [{
+              id: "tbs-openrouter-ai-qecae",
+              name: "tbs-openrouter-ai-qecae",
+              app: "tbs-openrouter-ai-qecae",
+              url: "https://tbs-openrouter-ai-qecae.fly.dev",
+              status: "active",
+              region: "sin",
+              modelsCount: 2,
+              supportedProtocols: ["chat_completions"],
+              paymentMethods: ["clawtip"]
+            }]
+          };
+        }
+        expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer operator-secret");
+        if (pathName === "/operator/status") {
+          return { status: "healthy", upstream: { status: "healthy" }, capacity: { activeConnections: 1, maxConnections: 8 } };
+        }
+        if (pathName === "/operator/admin/service") {
+          return { sellerId: "node-seller-core", modelsCount: 2, capacity: { maxConnections: 8, maxQueueDepth: 4 } };
+        }
+        if (pathName === "/operator/admin/upstreams") {
+          return {
+            upstreams: [{
+              upstreamUrl: "https://openrouter.ai/api",
+              upstreamApiKey: "****abcd",
+              models: [{ id: "openai/gpt-5.4" }, { id: "anthropic/claude-opus-4.7" }]
+            }]
+          };
+        }
+        if (pathName === "/operator/admin/config") {
+          return {
+            config: {
+              upstreamUrl: "https://openrouter.ai/api",
+              upstreamApiKey: "live-secret-abcd",
+              upstreamBalanceProbe: { template: "none" },
+              markupRatio: 1.2,
+              discountRatio: 1,
+              maxConnections: 8,
+              maxQueueDepth: 4
+            }
+          };
+        }
+        throw new Error(`unexpected fetch url ${url}`);
+      }
+    });
+
+    const sellers = await state.sellers();
+    expect(sellers[0]).toMatchObject({
+      id: "tbs-openrouter-ai-qecae",
+      name: "tbs-openrouter-ai-qecae",
+      nodeStatus: "active",
+      upstreamDomain: "openrouter.ai",
+      profile: "tbs-openrouter-ai-qecae",
+      modelsCount: 2
+    });
+
+    const detail = await state.sellerDetail("tbs-openrouter-ai-qecae");
+    expect(detail.configuration.upstreamUrl).toBe("https://openrouter.ai/api");
+    expect(detail.configuration.upstreamApiKeyMasked).toBe("**** **** **** abcd");
+    expect(detail.models.map((model) => model.upstreamModel)).toEqual(["openai/gpt-5.4", "anthropic/claude-opus-4.7"]);
+  });
+
+  test("UiActions updates new registry seller config without a local profile", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+    const calls: string[][] = [];
+    const actions = new UiActions({
+      configManager: mgr,
+      url: "https://bootstrap.example.test",
+      fetchJson: async (url, init) => {
+        const pathName = new URL(url).pathname;
+        if (pathName === "/registry/sellers") {
+          return {
+            version: 10,
+            sellers: [{
+              id: "tbs-openrouter-ai-qecae",
+              name: "tbs-openrouter-ai-qecae",
+              app: "tbs-openrouter-ai-qecae",
+              url: "https://tbs-openrouter-ai-qecae.fly.dev",
+              status: "active",
+              supportedProtocols: ["chat_completions"],
+              paymentMethods: ["clawtip"]
+            }]
+          };
+        }
+        expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer operator-secret");
+        if (pathName === "/operator/admin/config") {
+          return {
+            config: {
+              upstreamUrl: "https://openrouter.ai/api",
+              upstreamApiKey: "live-secret-abcd",
+              maxConnections: 8,
+              maxQueueDepth: 4
+            }
+          };
+        }
+        throw new Error(`unexpected fetch url ${url}`);
+      },
+      commandRunner: async (args): Promise<UiActionResult> => {
+        calls.push(args);
+        return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+      }
+    });
+
+    const result = await actions.updateSellerConfig("tbs-openrouter-ai-qecae", { maxConnections: 12 });
+
+    expect(result.ok).toBe(true);
+    expect(calls.map((args) => args.join(" "))).toEqual([
+      expect.stringContaining("--url https://tbs-openrouter-ai-qecae.fly.dev --token operator-secret seller-config validate --file"),
+      expect.stringContaining("--url https://tbs-openrouter-ai-qecae.fly.dev --token operator-secret seller-config put --file")
+    ]);
+  });
+
   test("admin UI seller rows render missing telemetry without unknown data labels", () => {
     const html = adminUiHtml();
     expect(html).toContain("class=\"spinner\"");
@@ -407,6 +614,7 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(html).toContain("currentCreateJob");
     expect(html).toContain("setCreateFormDisabled(true)");
     expect(html).toContain("setCreateFormDisabled(false)");
+    expect(html).toContain("Retry create");
     expect(html).toContain("data-progress-step");
     expect(html).toContain("aria-expanded");
     expect(html).toContain("progress-title");
@@ -414,25 +622,26 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(html).toContain("Hide details");
     expect(html).toContain("/api/jobs/");
     expect(html).toContain("function uiErrorMessage");
-    expect(html).toContain("Admin UI connection lost. Reopen the latest tb-admin UI URL and reload this page.");
-    expect(html).toContain("Admin UI session expired. Reopen the latest tb-admin UI URL.");
+    expect(html).toContain("Admin UI connection lost. Restart tb-admin ui and reload this page.");
+    expect(html).toContain("Admin profile authentication failed. Check the configured operator token.");
     expect(html).toContain("renderCreateJob");
     expect(html).toContain("pollCreateJob");
-    expect(html).toContain("Created and published to bootstrap registry.");
+    expect(html).toContain("Created and added to bootstrap registry.");
     expect(html).toContain("upstreamUrl:\"https://openrouter.ai/api/v1\"");
     expect(html).toContain("loadingSpinner(\"Loading sellers\")");
     expect(html).toContain("loadingSpinner(\"Loading configuration\")");
     expect(html).toContain("loadingSpinner(\"Loading models\")");
     expect(html).toContain("sellerRefreshIntervalMs = 30000");
-    expect(html).toContain("Last updated: never");
     expect(html).toContain("function scheduleSellerRefresh()");
     expect(html).toContain("sellerNextRefreshAt = new Date(Date.now() + sellerRefreshIntervalMs)");
     expect(html).toContain("sellerRefreshTimer = setTimeout(() => loadSellers(), sellerRefreshIntervalMs)");
     expect(html).toContain("Next refresh: ");
-    expect(html).toContain("s ago");
+    expect(html).not.toContain("sellerLastUpdated");
+    expect(html).not.toContain("Last updated:");
+    expect(html).not.toContain("s ago");
     expect(html).toContain("sellerClockTimer = setInterval(() => updateSellerRefreshMeta(sellerRefreshInFlight), 1000)");
     expect(html).toContain("function renderSellerRows(rows)");
-    expect(html).toContain("sellerLastUpdatedAt = new Date()");
+    expect(html).toContain("sellerRefreshLoaded = true");
     expect(html).toContain("readonly-value");
     expect(html).toContain("--seller-grid");
     expect(html).toContain("grid-template-columns:var(--seller-grid)");
@@ -440,10 +649,25 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(html).toContain("gap:12px;width:100%;min-width:0");
     expect(html).toContain("detailFieldsHtml");
     expect(html).toContain("data-original");
-    expect(html).toContain("Latency");
-    expect(html).toContain("avg n/a");
-    expect(html).toContain("Avg infer");
+    // Design-spec header labels (TTFT not Latency, Disc not Discount)
+    expect(html).toContain(">TTFT</span>");
+    expect(html).toContain(">Disc</span>");
+    expect(html).not.toContain(">Latency</span>");
+    // Spec-compliant token formats
+    expect(html).toContain("tok/s");
+    expect(html).toContain("AVG speed");
     expect(html).toContain("Samples");
+    // Spec-compliant unknown-value char (em dash) lives in formatter
+    expect(html).toContain("UNKNOWN_VALUE");
+    expect(html).toContain("formatDuration");
+    expect(html).toContain("formatSellerStatus");
+    expect(html).toContain("formatDiscountRatio");
+    expect(html).toContain("formatBalanceAmount");
+    // No glassmorphism per spec
+    expect(html).not.toContain("backdrop-filter");
+    // Detail field references
+    expect(html).toContain("avgTokensPerSecond");
+    expect(html).toContain("lastTokensPerSecond");
     expect(html).toContain("lastInferenceMs");
     expect(html).toContain("upstreamBalanceSource");
     expect(html).toContain("upstreamBalanceFetchedAt");
@@ -452,6 +676,7 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(html).toContain("upstreamBalanceProbeUrl");
     expect(html).toContain("upstreamBalanceProbeUserId");
     expect(html).toContain("upstreamBalanceProbeRechargeUrl");
+    // Payment tabs
     expect(html).toContain("paymentMethods");
     expect(html).toContain("payment-tabs");
     expect(html).toContain("payment-tab");
@@ -489,7 +714,9 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(html).toContain("clawtipResourceUrl");
     expect(html).toContain("clawtipActivationFeeFen");
     expect(html).toContain("clawtipMicrosPerFen");
-    expect(html).toContain("not reported");
+    // Spec uses — (em dash) for unknown, not "not reported" or "n/a"
+    expect(html).not.toContain("not reported");
+    expect(html).not.toContain("\"n/a\"");
     expect(html).toContain("aria-label=\"Seller specs\"");
     expect(html).toContain("<svg viewBox=\"0 0 24 24\"");
     expect(html).not.toContain(">i</span>");
@@ -500,7 +727,6 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(html).not.toContain("Loading models...");
     expect(html).not.toContain("<div id=\"createStatus\" class=\"status-line\">Ready</div>");
     expect(html).not.toContain("not set");
-    expect(html).not.toContain("tok/s");
     expect(html).not.toContain(" multiple");
   });
 
@@ -729,10 +955,10 @@ describe("Admin CLI Config Profile Management Tests", () => {
         profile: "bootstrap",
         fetchJson: async (url) => createSellerFetchJson(url),
         commandRunner: async (args): Promise<UiActionResult> => {
-          if (isBootstrapSellersValidate(args)) {
+          if (isBootstrapSellersAdd(args)) {
             const filePath = args[args.indexOf("--file") + 1];
-            const doc = JSON.parse(fs.readFileSync(filePath, "utf8")) as { sellers: Array<{ id: string; status?: string }> };
-            expect(doc.sellers.find((seller) => seller.id === "tbs-nrt-07")?.status).toBe("pending");
+            const entry = JSON.parse(fs.readFileSync(filePath, "utf8")) as { id: string; status?: string };
+            expect(entry).toMatchObject({ id: "tbs-nrt-07", status: "active" });
           }
           calls.push(args);
           return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
@@ -772,6 +998,8 @@ describe("Admin CLI Config Profile Management Tests", () => {
       expect(response.registryPublish?.ok).toBe(true);
       expect(response.publishRegistry).toBe("completed");
       expect(response.configPreview.upstreamUrl).toBe("https://openrouter.ai/api");
+      expect(response.configPreview.sellerId).toBe("tbs-nrt-07");
+      expect(response.configPreview.manifestVersion).toBe("manifest.v1");
       expect(response.configPreview.upstreamBalanceProbe).toEqual({
         template: "usage_generic",
         url: "https://code.shoestravel.xin/v1/usage",
@@ -798,13 +1026,153 @@ describe("Admin CLI Config Profile Management Tests", () => {
         expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-secret status"),
         expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-secret seller-config put --file"),
         expect.stringContaining("--url https://tbs-nrt-07.fly.dev --token operator-secret upstreams refresh --auto-models"),
-        expect.stringContaining("bootstrap sellers validate --file"),
-        expect.stringContaining("bootstrap sellers put --file")
+          expect.stringContaining("bootstrap sellers add --file")
       ]);
+      expect(commandLines[5]).toContain("--expect-version 7");
       expect(commandLines.find((line) => line.includes("seller create tbs-nrt-07"))).toContain("--initial-config");
+      expect(mgr.getProfile("tbs-nrt-07")).toEqual({
+        url: "https://tbs-nrt-07.fly.dev",
+        token: "operator-secret"
+      });
+    } finally {
+      await fixture.close();
+    }
+  });
+
+  test("UiActions create retries transient upstream model refresh failures", async () => {
+    const fixture = await startFixtureAdminServer();
+    try {
+      const mgr = new ConfigManager(TEMP_CONF_PATH);
+      mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+      const registry = await createSellerFetchJson(`${fixture.baseUrl}/registry/sellers`);
+      let refreshAttempts = 0;
+      const calls: string[][] = [];
+      const actions = new UiActions({
+        configManager: mgr,
+        url: fixture.baseUrl,
+        fetchJson: async (url) => {
+          const pathName = new URL(url).pathname;
+          if (pathName === "/registry/sellers") {
+            return registry;
+          }
+          return createSellerFetchJson(url);
+        },
+        commandRunner: async (args): Promise<UiActionResult> => {
+          calls.push(args);
+          if (args.includes("upstreams") && args.includes("refresh")) {
+            refreshAttempts += 1;
+            if (refreshAttempts < 3) {
+              return { ok: false, stdout: "", stderr: "Error: Connection failed: fetch failed", command: ["node", "tb-admin", ...args] };
+            }
+          }
+          if (args.includes("bootstrap") && args.includes("sellers") && args.includes("add")) {
+            const filePath = args[args.indexOf("--file") + 1];
+            const doc = JSON.parse(fs.readFileSync(filePath, "utf8"));
+            expect(doc).toMatchObject({ id: "tbs-nrt-07" });
+            expect(doc.models).toHaveLength(2);
+          }
+          return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+        }
+      });
+
+      const response = await actions.createSeller({
+        sellerName: "tbs-nrt-07",
+        app: "tbs-nrt-07",
+        region: "nrt",
+        image: "registry.fly.io/tb-seller:latest",
+        upstreamWebsite: "https://openrouter.ai",
+        upstreamUrl: "https://openrouter.ai/api/v1",
+        upstreamApiKey: "fixture-upstream-key",
+        upstreamBalanceProbeTemplate: "none",
+        maxConnections: 8,
+        maxQueueDepth: 4,
+        markupRatio: 1.2,
+        discountRatio: 1,
+        paymentMethods: ["mock"],
+        flyConfig: "deploy/fly.io/fly.tb-seller.toml"
+      });
+
+      expect(response.modelsRefresh?.ok).toBe(true);
+      expect(response.registryPublish?.ok).toBe(true);
+      expect(refreshAttempts).toBe(3);
+      expect(calls.filter((args) => args.includes("upstreams") && args.includes("refresh"))).toHaveLength(3);
     } finally {
       await fixture.close();
     }
+  }, 30000);
+
+  test("UiActions create publishes registry from wrapped upstream metadata", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+    let published: any;
+    const actions = new UiActions({
+      configManager: mgr,
+      url: "https://bootstrap.example.test",
+      fetchJson: async (url) => createSellerFetchJson(url, "wrappedArray"),
+      commandRunner: async (args): Promise<UiActionResult> => {
+        if (args.includes("bootstrap") && args.includes("sellers") && args.includes("add")) {
+          const filePath = args[args.indexOf("--file") + 1];
+          published = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        }
+        return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+      }
+    });
+
+      const response = await actions.createSeller(createSellerRequestFixture({
+        sellerName: "openrouter-ai",
+        app: "tbs-openrouter-ai-qecae"
+      }));
+
+      expect(response.registryPublish?.ok).toBe(true);
+      expect(published).toMatchObject({
+        id: "tbs-openrouter-ai-qecae",
+        name: "tbs-openrouter-ai-qecae",
+        app: "tbs-openrouter-ai-qecae",
+        status: "active",
+        models: ["openai/gpt-5.4", "openai/gpt-5.4-mini"],
+        supportedProtocols: ["chat_completions"]
+      });
+      expect(mgr.getProfile("tbs-openrouter-ai-qecae")).toEqual({
+        url: "https://tbs-openrouter-ai-qecae.fly.dev",
+        token: "operator-secret"
+      });
+  });
+
+  test("UiActions create falls back to public manifest models for registry publish", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+    let published: any;
+    const actions = new UiActions({
+      configManager: mgr,
+      url: "https://bootstrap.example.test",
+      fetchJson: async (url) => createSellerFetchJson(url, "manifest"),
+      commandRunner: async (args): Promise<UiActionResult> => {
+        if (args.includes("bootstrap") && args.includes("sellers") && args.includes("add")) {
+          const filePath = args[args.indexOf("--file") + 1];
+          published = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        }
+        return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+      }
+    });
+
+    const response = await actions.createSeller(createSellerRequestFixture({
+      sellerName: "openrouter-ai",
+      app: "tbs-openrouter-ai-qecae"
+    }));
+
+    expect(response.registryPublish?.ok).toBe(true);
+    expect(published).toMatchObject({
+      id: "tbs-openrouter-ai-qecae",
+      name: "tbs-openrouter-ai-qecae",
+      app: "tbs-openrouter-ai-qecae",
+      status: "active",
+      models: ["anthropic/claude-opus-4.7"],
+      supportedProtocols: ["chat_completions"]
+    });
+    expect(mgr.getProfile("tbs-openrouter-ai-qecae")).toEqual({
+      url: "https://tbs-openrouter-ai-qecae.fly.dev",
+      token: "operator-secret"
+    });
   });
 
   test("UiActions create supports mock-only payment without ClawTip parameters", async () => {
@@ -879,12 +1247,13 @@ describe("Admin CLI Config Profile Management Tests", () => {
 
   test("UiActions subprocess runner uses the tb-admin bin entrypoint", async () => {
     const previousArgv = process.argv[1];
-    process.argv[1] = path.resolve(__dirname, "../dist/src/index.js");
+    process.argv[1] = path.resolve(process.env.HOME || "/tmp", "packages/admin-cli/bin/tb-admin.js");
     const { runTbAdmin } = await import("../src/ui-actions.js");
     try {
       const result = await runTbAdmin(["--help"], 30000);
       expect(result.ok).toBe(true);
       expect(result.command[1]).toMatch(/packages\/admin-cli\/bin\/tb-admin\.js$/);
+      expect(fs.existsSync(result.command[1])).toBe(true);
       expect(result.stdout).toContain("Remote admin CLI");
     } finally {
       process.argv[1] = previousArgv;
@@ -892,6 +1261,127 @@ describe("Admin CLI Config Profile Management Tests", () => {
   });
 });
 
+describe("Admin CLI Display Format Spec Compliance", () => {
+  test("formatDuration uses ms under 1s and 2-decimal seconds above 1s", () => {
+    expect(formatDuration(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatDuration(0)).toBe("0ms");
+    expect(formatDuration(272)).toBe("272ms");
+    expect(formatDuration(999)).toBe("999ms");
+    expect(formatDuration(1000)).toBe("1.00s");
+    expect(formatDuration(3542)).toBe("3.54s");
+    expect(formatDuration(11540)).toBe("11.54s");
+  });
+
+  test("formatMoney uses 4 decimals by default and 6 for tiny ledger amounts", () => {
+    expect(formatMoney(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatMoney(0)).toBe("$0.0000");
+    expect(formatMoney(138600)).toBe("$0.1386");
+    expect(formatMoney(2_772_200)).toBe("$2.7722");
+    expect(formatMoney(138600, { ledger: true })).toBe("$0.1386");
+    expect(formatMoney(5782, { ledger: true })).toBe("$0.005782");
+  });
+
+  test("formatDiscountRatio converts ratio to percentage per the design spec", () => {
+    expect(formatDiscountRatio(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatDiscountRatio(0.5)).toBe("50%");
+    expect(formatDiscountRatio(0.01)).toBe("99%");
+    expect(formatDiscountRatio(0.99)).toBe("1%");
+    expect(formatDiscountRatio(1)).toBe("0%");
+    expect(formatDiscountRatio(0)).toBe("100%");
+  });
+
+  test("formatPercent rounds to whole percent", () => {
+    expect(formatPercent(0.123)).toBe("12%");
+    expect(formatPercent(0.987)).toBe("99%");
+    expect(formatPercent(undefined)).toBe(UNKNOWN_VALUE);
+  });
+
+  test("formatPricePair renders $/1M with 4 decimals per spec", () => {
+    expect(formatPricePair(undefined, undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatPricePair(2_500_000, 3_000_000)).toBe("$2.5000 / $3.0000");
+  });
+
+  test("formatCount uses en-US grouping", () => {
+    expect(formatCount(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatCount(7_529)).toBe("7,529");
+    expect(formatCount(218_700)).toBe("218,700");
+  });
+
+  test("formatTimeCompact emits HH:mm for today and MM/DD HH:mm otherwise", () => {
+    const now = new Date();
+    const todayIso = new Date(now.getFullYear(), now.getMonth(), now.getDate(), 14, 51).toISOString();
+    const yesterdayIso = new Date(now.getFullYear(), now.getMonth(), now.getDate() - 1, 9, 5).toISOString();
+    expect(formatTimeCompact(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatTimeCompact(todayIso)).toBe("14:51");
+    expect(formatTimeCompact(yesterdayIso)).toMatch(/^\d{2}\/\d{2} 09:05$/);
+  });
+
+  test("formatTimeFull uses YYYY-MM-DD HH:mm:ss for detail panels", () => {
+    expect(formatTimeFull(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatTimeFull("2026-06-07T00:25:51.000Z")).toMatch(/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/);
+  });
+
+  test("formatTimeLedger uses YYYY/MM/DD HH:mm:ss for audit tables", () => {
+    expect(formatTimeLedger(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatTimeLedger("2026-06-07T00:25:51.000Z")).toMatch(/^\d{4}\/\d{2}\/\d{2} \d{2}:\d{2}:\d{2}$/);
+  });
+
+  test("formatSellerId trims long tbs ids to 10 chars", () => {
+    expect(formatSellerId(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatSellerId("tbs-825edb")).toBe("tbs-825edb");
+    expect(formatSellerId("tbs-openrouter-ai-k7p9x")).toBe("tbs-openro");
+  });
+
+  test("formatSpeed renders to one decimal with tok/s suffix", () => {
+    expect(formatSpeed(undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatSpeed(0)).toBe("0.0 tok/s");
+    expect(formatSpeed(11.54)).toBe("11.5 tok/s");
+  });
+
+  test("formatSellerCapacity renders used / limit with en-US grouping", () => {
+    expect(formatSellerCapacity(undefined, undefined)).toBe(UNKNOWN_VALUE);
+    expect(formatSellerCapacity(8, 16)).toBe("8 / 16");
+    expect(formatSellerCapacity(undefined, 16)).toBe(`${UNKNOWN_VALUE} / 16`);
+    expect(formatSellerCapacity(8, undefined)).toBe(`8 / ${UNKNOWN_VALUE}`);
+  });
+
+  test("formatBalanceAmount uses 0 decimals for >=100 and 2 decimals otherwise", () => {
+    expect(formatBalanceAmount(undefined, "USD")).toBe(UNKNOWN_VALUE);
+    expect(formatBalanceAmount(47_950_000, "USD")).toBe("USD 47.95");
+    expect(formatBalanceAmount(479_500_000, "USD")).toBe("USD 480");
+    expect(formatBalanceAmount(50_000_000, "EUR")).toBe("EUR 50.00");
+  });
+
+  test("formatSellerStatus maps all internal node statuses to the 7 canonical labels", () => {
+    const canonical = new Set(["ok", "online", "configured", "pending", "degraded", "error", "unknown"]);
+    for (const value of ["active", "healthy", "online", "configured", "pending", "draining", "degraded", "busy_capacity", "offline", "unhealthy", "error", "auth_unknown", "unknown", undefined, "weird-state"]) {
+      expect(canonical.has(formatSellerStatus(value))).toBe(true);
+    }
+    expect(formatSellerStatus("active")).toBe("ok");
+    expect(formatSellerStatus("draining")).toBe("degraded");
+    expect(formatSellerStatus("busy_capacity")).toBe("degraded");
+    expect(formatSellerStatus("offline")).toBe("error");
+    expect(formatSellerStatus("auth_unknown")).toBe("unknown");
+  });
+
+  test("statusTone / sellerStatusTone keep green/amber/red/blue/gray buckets stable", () => {
+    expect(statusTone("ok")).toBe("green");
+    expect(statusTone("online")).toBe("green");
+    expect(statusTone("configured")).toBe("green");
+    expect(statusTone("pending")).toBe("amber");
+    expect(statusTone("degraded")).toBe("amber");
+    expect(statusTone("error")).toBe("red");
+    expect(statusTone("offline")).toBe("red");
+    expect(statusTone("unknown")).toBe("gray");
+    expect(statusTone("running")).toBe("blue");
+    expect(sellerStatusTone("active")).toBe("green");
+    expect(sellerStatusTone("draining")).toBe("amber");
+    expect(sellerStatusTone("busy_capacity")).toBe("amber");
+    expect(sellerStatusTone("offline")).toBe("red");
+    expect(sellerStatusTone("auth_unknown")).toBe("gray");
+  });
+});
+
 async function startFixtureAdminServer(): Promise<{ baseUrl: string; close: () => Promise<void> }> {
   const server = http.createServer((req, res) => {
     const pathName = new URL(req.url || "/", "http://127.0.0.1").pathname;
@@ -990,7 +1480,27 @@ function sendJson(res: http.ServerResponse, body: unknown): void {
   res.end(JSON.stringify(body));
 }
 
-async function createSellerFetchJson(url: string): Promise<unknown> {
+function createSellerRequestFixture(overrides: Partial<CreateSellerRequest> = {}): CreateSellerRequest {
+  return {
+    sellerName: "tbs-nrt-07",
+    app: "tbs-nrt-07",
+    region: "nrt",
+    image: "registry.fly.io/tb-seller:latest",
+    upstreamWebsite: "https://openrouter.ai",
+    upstreamUrl: "https://openrouter.ai/api/v1",
+    upstreamApiKey: "fixture-upstream-key",
+    upstreamBalanceProbeTemplate: "none",
+    maxConnections: 8,
+    maxQueueDepth: 4,
+    markupRatio: 1.2,
+    discountRatio: 1,
+    paymentMethods: ["mock"],
+    flyConfig: "deploy/fly.io/fly.tb-seller.toml",
+    ...overrides
+  };
+}
+
+async function createSellerFetchJson(url: string, mode: "default" | "wrapped" | "wrappedArray" | "manifest" = "default"): Promise<unknown> {
   const pathName = new URL(url).pathname;
   if (pathName === "/registry/sellers") {
     return {
@@ -999,6 +1509,38 @@ async function createSellerFetchJson(url: string): Promise<unknown> {
     };
   }
   if (pathName === "/operator/admin/upstreams") {
+    if (mode === "wrapped") {
+      return {
+        upstreams: {
+          upstreamUrl: "https://openrouter.ai/api",
+          models: [
+            { id: "openai/gpt-5.4" },
+            { id: "openai/gpt-5.4-mini" }
+          ],
+          supportedProtocols: ["chat_completions"]
+        }
+      };
+    }
+    if (mode === "wrappedArray") {
+      return {
+        upstreams: [{
+          upstreamUrl: "https://openrouter.ai/api",
+          models: [
+            { id: "openai/gpt-5.4" },
+            { id: "openai/gpt-5.4-mini" }
+          ],
+          supportedProtocols: ["chat_completions"]
+        }]
+      };
+    }
+    if (mode === "manifest") {
+      return {
+        upstreams: {
+          upstreamUrl: "https://openrouter.ai/api",
+          modelsCount: 1
+        }
+      };
+    }
     return {
       upstreamUrl: "https://openrouter.ai/api",
       models: [
@@ -1015,12 +1557,19 @@ async function createSellerFetchJson(url: string): Promise<unknown> {
       supportedProtocols: ["chat_completions"]
     };
   }
+  if (pathName === "/manifest" && mode === "manifest") {
+    return {
+      sellerId: "tbs-nrt-07",
+      models: ["anthropic/claude-opus-4.7"],
+      supportedProtocols: ["chat_completions"]
+    };
+  }
   throw new Error(`unexpected fetch url ${url}`);
 }
 
-function isBootstrapSellersValidate(args: string[]): boolean {
-  const validateIndex = args.indexOf("validate");
-  return validateIndex >= 2 && args[validateIndex - 2] === "bootstrap" && args[validateIndex - 1] === "sellers";
+function isBootstrapSellersAdd(args: string[]): boolean {
+  const addIndex = args.indexOf("add");
+  return addIndex >= 2 && args[addIndex - 2] === "bootstrap" && args[addIndex - 1] === "sellers";
 }
 
 function jsonResponse(body: unknown, status = 200): Response {