@tokenbuddy/tb-admin 1.0.33 → 1.0.35

package/tests/admin.test.ts

@@ -2,6 +2,7 @@ import { ConfigManager } from "../src/config.js";
 import { buildAdminCli } from "../src/cli.js";
 import { FlyProvider, parseFlyMachineIds, requirePublishedDockerImage } from "../src/server-cmd.js";
 import { startAdminUiServer } from "../src/ui-server.js";
+import { defaultUiProfile } from "../src/ui-command.js";
 import { AdminUiState } from "../src/ui-state.js";
 import { UiActions, type CreateSellerRequest, type UiActionResult } from "../src/ui-actions.js";
 import { adminUiHtml } from "../src/ui-static.js";
@@ -91,13 +92,16 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(() => new vm.Script(scripts[0])).not.toThrow();
   });
 
-  test("admin UI release requests tab targets the releases page and loader", () => {
+  test("admin UI keeps release state in the seller table instead of a separate releases page", () => {
     const html = adminUiHtml();
 
-    expect(html).toContain('data-page="releases"');
-    expect(html).toContain('id="page-releases"');
-    expect(html).toContain('id="releasesGrid"');
-    expect(html).toContain('btn.dataset.page === "releases"');
+    expect(html).toContain("<span>Pub</span>");
+    expect(html).not.toContain("Release Requests");
+    expect(html).not.toContain('data-page="releases"');
+    expect(html).not.toContain('id="page-releases"');
+    expect(html).not.toContain('id="releasesGrid"');
+    expect(html).not.toContain('btn.dataset.page === "releases"');
+    expect(html).not.toContain("/api/vendor/release-requests");
     expect(html).not.toContain('id="page-bootstrap"');
     expect(html).not.toContain('getElementById("bootstrapGrid")');
   });
@@ -370,6 +374,15 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(() => validateRegistryDocument(badDefault)).toThrow("defaultSeller `missing`");
   });
 
+  test("tb-admin ui prefers vendor bootstrap profile when available", () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setProfile("bootstrap", { url: "https://tb-registry.fly.dev", token: "operator-token" });
+    expect(defaultUiProfile(mgr)).toBe("bootstrap");
+
+    mgr.setProfile("bootstrap-vendor", { url: "https://tb-registry.fly.dev", token: "vendor-token" });
+    expect(defaultUiProfile(mgr)).toBe("bootstrap-vendor");
+  });
+
   test("tb-admin ui server binds loopback, rejects cross-origin APIs, and serves bootstrap data", async () => {
     const mgr = new ConfigManager(TEMP_CONF_PATH);
     const started = await startAdminUiServer({
@@ -418,6 +431,103 @@ describe("Admin CLI Config Profile Management Tests", () => {
     })).rejects.toThrow("loopback");
   });
 
+  test("tb-admin ui status refresh updates existing rows without inventory reload", async () => {
+    const seller = http.createServer((req, res) => {
+      const url = new URL(req.url || "/", "http://127.0.0.1");
+      if (req.method === "GET" && url.pathname === "/manifest") {
+        sendJson(res, { sellerId: "tbs-status-only" });
+        return;
+      }
+      if (req.method === "GET" && url.pathname === "/operator/status") {
+        expect(req.headers.authorization).toBe("Bearer operator-secret");
+        sendJson(res, {
+          status: "healthy",
+          upstream: { status: "healthy" },
+          capacity: { activeConnections: 2, maxConnections: 9 },
+          runtime: { cpuPercent: 8.4, memoryPercent: 41.2, memoryRssMb: 211, memoryLimitMb: 512 },
+          latency: { ttftMs: 123, avgTokensPerSecond: 42.5, sampleCount: 7 }
+        });
+        return;
+      }
+      if (req.method === "GET" && url.pathname === "/operator/admin/upstream-balance") {
+        expect(req.headers.authorization).toBe("Bearer operator-secret");
+        sendJson(res, {
+          status: "ok",
+          balance: {
+            rawAmount: 12.75,
+            amountUsdMicros: 12750000,
+            currency: "USD",
+            source: "openrouter",
+            fetchedAt: 1800000000000
+          }
+        });
+        return;
+      }
+      res.statusCode = 404;
+      sendJson(res, { error: "not found" });
+    });
+    await new Promise<void>((resolve) => seller.listen(0, "127.0.0.1", () => resolve()));
+    const address = seller.address();
+    if (!address || typeof address !== "object") {
+      throw new Error("seller fixture did not bind a TCP port");
+    }
+    const sellerUrl = `http://127.0.0.1:${address.port}`;
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+    const started = await startAdminUiServer({
+      host: "127.0.0.1",
+      port: 0,
+      openBrowser: false,
+      configManager: mgr
+    });
+    try {
+      const response = await fetch(`${started.url}api/sellers/status`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          rows: [{
+            id: "tbs-status-only",
+            name: "tbs-status-only",
+            app: "tbs-status-only",
+            url: sellerUrl,
+            registryStatus: "unknown",
+            nodeStatus: "unknown",
+            upstreamDomain: "seller.example",
+            upstreamStatus: "unknown",
+            upstreamBalanceError: "unauthorized: check upstreamApiKey",
+            dataSource: "fly",
+            flyApp: { name: "tbs-status-only", status: "deployed" }
+          }]
+        })
+      });
+      expect(response.status).toBe(200);
+      const wrongMethodResponse = await fetch(`${started.url}api/sellers/status`);
+      expect(wrongMethodResponse.status).toBe(405);
+      await expect(wrongMethodResponse.json()).resolves.toMatchObject({ error: "method not allowed" });
+      const rows = await response.json() as any[];
+      expect(rows).toHaveLength(1);
+      expect(rows[0]).toMatchObject({
+        id: "tbs-status-only",
+        nodeStatus: "active",
+        upstreamStatus: "healthy",
+        capacityUsed: 2,
+        capacityLimit: 9,
+        resourceCpuPercent: 8.4,
+        resourceMemoryPercent: 41.2,
+        ttftMs: 123,
+        avgTokensPerSecond: 42.5,
+        latencySamples: 7,
+        upstreamBalanceUsdMicros: 12750000,
+        upstreamBalanceCurrency: "USD",
+        upstreamBalanceSource: "openrouter"
+      });
+      expect(rows[0].upstreamBalanceError).toBeUndefined();
+    } finally {
+      await new Promise<void>((resolve) => started.server.close(() => resolve()));
+      await new Promise<void>((resolve) => seller.close(() => resolve()));
+    }
+  });
+
   test("tb-admin ui release requests endpoint proxies the active vendor profile", async () => {
     const registry = http.createServer((req, res) => {
       const url = new URL(req.url || "/", "http://127.0.0.1");
@@ -465,6 +575,72 @@ describe("Admin CLI Config Profile Management Tests", () => {
     }
   });
 
+  test("UiActions setRegistryStatus uses vendor-scoped seller list and mutation auth", async () => {
+    const calls: Array<{ method?: string; path: string; authorization?: string; body?: any }> = [];
+    const registry = http.createServer((req, res) => {
+      const url = new URL(req.url || "/", "http://127.0.0.1");
+      let body = "";
+      req.on("data", (chunk) => {
+        body += chunk;
+      });
+      req.on("end", () => {
+        const parsed = body ? JSON.parse(body) : undefined;
+        calls.push({ method: req.method, path: url.pathname, authorization: req.headers.authorization, body: parsed });
+        if (req.method === "GET" && url.pathname === "/platform/sellers") {
+          expect(req.headers.authorization).toBe("Bearer vendor-token-value");
+          sendJson(res, {
+            sellers: [{
+              id: "vendor-live-1",
+              name: "Vendor Live 1",
+              app: "tbs-vendor-live-1",
+              url: "https://tbs-vendor-live-1.fly.dev",
+              status: "active",
+              supportedProtocols: ["chat_completions"],
+              paymentMethods: ["clawtip"]
+            }]
+          });
+          return;
+        }
+        if (req.method === "GET" && url.pathname === "/registry/sellers") {
+          expect(req.headers.authorization).toBeUndefined();
+          sendJson(res, { version: 12, sellers: [] });
+          return;
+        }
+        if (req.method === "PUT" && url.pathname === "/platform/sellers/vendor-live-1/status") {
+          expect(req.headers.authorization).toBe("Bearer vendor-token-value");
+          expect(parsed).toMatchObject({ status: "draining", expectedVersion: 12 });
+          expect(req.headers["idempotency-key"]).toMatch(/^tb-admin-ui-vendor-live-1-draining-12-/);
+          sendJson(res, { registry: { version: 13, sellers: [] } });
+          return;
+        }
+        res.statusCode = 404;
+        sendJson(res, { error: "not found" });
+      });
+    });
+    await new Promise<void>((resolve) => registry.listen(0, "127.0.0.1", () => resolve()));
+    const address = registry.address();
+    if (!address || typeof address !== "object") {
+      throw new Error("registry fixture did not bind a TCP port");
+    }
+
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setProfile("bootstrap", { url: `http://127.0.0.1:${address.port}`, token: "vendor-token-value" });
+    const actions = new UiActions({ configManager: mgr, profile: "bootstrap" });
+    try {
+      const result = await actions.setRegistryStatus("vendor-live-1", "draining");
+
+      expect(result.ok).toBe(true);
+      expect(result.stdout).toContain("version=13");
+      expect(calls.map((call) => `${call.method} ${call.path}`)).toEqual([
+        "GET /platform/sellers",
+        "GET /registry/sellers",
+        "PUT /platform/sellers/vendor-live-1/status"
+      ]);
+    } finally {
+      await new Promise<void>((resolve) => registry.close(() => resolve()));
+    }
+  });
+
   test("tb-admin ui create seller returns a progress job", async () => {
     const mgr = new ConfigManager(TEMP_CONF_PATH);
     mgr.setSellerProvider("fly", { operator_secret: "operator-token-value" });
@@ -579,10 +755,20 @@ describe("Admin CLI Config Profile Management Tests", () => {
           owner: "vendor-a",
           raw: {}
         }],
-        balanceFetch: async (url, init) => {
-          expect(String(url)).toBe("https://openrouter.ai/api/v1/credits");
-          expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer fixture-live-key-27f9");
-          return jsonResponse({ data: { total_credits: 50, total_usage: 2.05 } });
+        flyMachineSpecs: async (appName) => {
+          expect(appName).toBe("tbs-sin-06");
+          return {
+            machines: 1,
+            runningMachines: 1,
+            cpuKind: "shared",
+            cpuCores: 1,
+            memoryMb: 512,
+            volumeGb: 1,
+            regions: ["sin"]
+          };
+        },
+        balanceFetch: async () => {
+          throw new Error("admin UI must use seller operator balance endpoint before local probing");
         }
       });
       const sellers = await state.sellers();
@@ -601,9 +787,16 @@ describe("Admin CLI Config Profile Management Tests", () => {
         upstreamBalanceCurrency: "USD",
         upstreamBalanceSource: "openrouter"
       });
+      expect(sellers[0].specs).toMatchObject({
+        machines: 1,
+        runningMachines: 1,
+        cpuCores: 1,
+        memoryMb: 512,
+        volumeGb: 1
+      });
 
       const detail = await state.sellerDetail("tbs-sin-06");
-      expect(detail.configuration.upstreamApiKeyMasked).toBe("**** **** **** 27f9");
+      expect(detail.configuration.upstreamApiKeyMasked).toBe("configured");
       expect(detail.configuration.upstreamBalance).toBe("USD 47.95");
       expect(detail.configuration.upstreamBalanceSource).toBe("openrouter");
       expect(detail.configuration.upstreamBalanceProbeTemplate).toBe("openrouter");
@@ -703,6 +896,67 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(detail.models.map((model) => model.upstreamModel)).toEqual(["openai/gpt-5.4", "anthropic/claude-opus-4.7"]);
   }, ADMIN_UI_STATE_TEST_TIMEOUT_MS);
 
+  test("AdminUiState loads Fly seller detail when vendor registry auth fails", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+    const state = new AdminUiState({
+      configManager: mgr,
+      url: "https://bootstrap.example.test",
+      flyApps: async () => [{
+        name: "tbs-flyonly-node",
+        status: "running",
+        owner: "vendor-a",
+        raw: {}
+      }],
+      fetchJson: async (url, init) => {
+        const pathName = new URL(url).pathname;
+        if (pathName === "/platform/sellers") {
+          throw new Error('HTTP Error 401: {"error":"vendor_auth_failed"}');
+        }
+        expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer operator-secret");
+        if (pathName === "/operator/status") {
+          return { status: "healthy", upstream: { status: "healthy" }, capacity: { activeConnections: 2, maxConnections: 6 } };
+        }
+        if (pathName === "/operator/admin/service") {
+          return { sellerId: "tbs-flyonly-node", modelsCount: 1, capacity: { maxConnections: 6, maxQueueDepth: 3 } };
+        }
+        if (pathName === "/operator/admin/upstreams") {
+          return {
+            upstreams: [{
+              upstreamUrl: "https://api.moonshot.cn/v1",
+              models: [{ id: "moonshot-v1-8k" }]
+            }]
+          };
+        }
+        if (pathName === "/operator/admin/config") {
+          return {
+            config: {
+              upstreamUrl: "https://api.moonshot.cn/v1",
+              upstreamApiKey: "moonshot-live-secret",
+              upstreamBalanceProbe: { template: "none" },
+              maxConnections: 6,
+              maxQueueDepth: 3
+            }
+          };
+        }
+        throw new Error(`unexpected fetch url ${url}`);
+      }
+    });
+
+    const detail = await state.sellerDetail("tbs-flyonly-node");
+
+    expect(detail.row).toMatchObject({
+      id: "tbs-flyonly-node",
+      dataSource: "fly",
+      nodeStatus: "active",
+      upstreamDomain: "api.moonshot.cn",
+      capacityUsed: 2,
+      capacityLimit: 6
+    });
+    expect(detail.configuration.upstreamApiKeyMasked).toBe("**** **** **** cret");
+    expect(detail.models.map((model) => model.upstreamModel)).toEqual(["moonshot-v1-8k"]);
+  }, ADMIN_UI_STATE_TEST_TIMEOUT_MS);
+
   test("UiActions updates new registry seller config without a local profile", async () => {
     const mgr = new ConfigManager(TEMP_CONF_PATH);
     mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
@@ -754,11 +1008,68 @@ describe("Admin CLI Config Profile Management Tests", () => {
     ]);
   });
 
+  test("UiActions updates Fly seller config when vendor registry auth fails", async () => {
+    const mgr = new ConfigManager(TEMP_CONF_PATH);
+    mgr.setSellerProvider("fly", { operator_secret: "operator-secret" });
+    const calls: string[][] = [];
+    const fetchPaths: string[] = [];
+    const actions = new UiActions({
+      configManager: mgr,
+      url: "https://bootstrap.example.test",
+      token: "vendor-token",
+      flyApps: async () => [{
+        name: "tbs-flyonly-node",
+        status: "running",
+        owner: "vendor-a",
+        raw: {}
+      }],
+      fetchJson: async (url, init) => {
+        const pathName = new URL(url).pathname;
+        fetchPaths.push(pathName);
+        if (pathName === "/platform/sellers") {
+          expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer vendor-token");
+          throw new Error('HTTP Error 401: {"error":"vendor_auth_failed"}');
+        }
+        expect((init?.headers as Record<string, string>)?.Authorization).toBe("Bearer operator-secret");
+        if (pathName === "/operator/admin/config") {
+          return {
+            config: {
+              upstreamUrl: "https://api.moonshot.cn/v1",
+              upstreamApiKey: "live-secret-abcd",
+              maxConnections: 6,
+              maxQueueDepth: 3
+            }
+          };
+        }
+        throw new Error(`unexpected fetch url ${url}`);
+      },
+      commandRunner: async (args): Promise<UiActionResult> => {
+        calls.push(args);
+        return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
+      }
+    });
+
+    const result = await actions.updateSellerConfig("tbs-flyonly-node", { maxConnections: 9 });
+
+    expect(result.ok).toBe(true);
+    expect(fetchPaths).toEqual([
+      "/platform/sellers",
+      "/registry/sellers",
+      "/operator/admin/config"
+    ]);
+    expect(calls.map((args) => args.join(" "))).toEqual([
+      expect.stringContaining("--url https://tbs-flyonly-node.fly.dev --token operator-secret seller-config validate --file"),
+      expect.stringContaining("--url https://tbs-flyonly-node.fly.dev --token operator-secret seller-config put --file")
+    ]);
+  });
+
   test("admin UI seller rows render missing telemetry without unknown data labels", () => {
     const html = adminUiHtml();
     expect(html).toContain("class=\"spinner\"");
     expect(html).toContain("@keyframes spin");
     expect(html).toContain("role=\"status\" aria-label=\"Loading sellers\"");
+    expect(html).toContain("<th>Enable</th>");
+    expect(html).toContain("data-model-enabled");
     expect(html).toContain("id=\"createStatus\" class=\"status-line hidden\"");
     expect(html).toContain("id=\"createProgress\"");
     expect(html).toContain("create-progress");
@@ -781,31 +1092,62 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(html).toContain("pollCreateJob");
     expect(html).toContain("Created and added to bootstrap registry.");
     expect(html).toContain("upstreamUrl:\"https://openrouter.ai/api/v1\"");
-    expect(html).toContain("loadingSpinner(\"Loading sellers\")");
-    expect(html).toContain("loadingSpinner(\"Loading configuration\")");
-    expect(html).toContain("loadingSpinner(\"Loading models\")");
-    expect(html).toContain("sellerRefreshIntervalMs = 30000");
-    expect(html).toContain("function scheduleSellerRefresh()");
-    expect(html).toContain("sellerNextRefreshAt = new Date(Date.now() + sellerRefreshIntervalMs)");
-    expect(html).toContain("sellerRefreshTimer = setTimeout(() => loadSellers(), sellerRefreshIntervalMs)");
-    expect(html).toContain("Next refresh: ");
+    expect(html).toContain("loadingSpinner(\"Loading registry\")");
+    expect(html).toContain('id="detailGrid" class="detail-grid hidden"');
+    expect(html).toContain('showDetailStatus("Loading seller data", true)');
+    expect(html).toContain('document.getElementById("detailGrid").classList.add("hidden")');
+    expect(html).toContain('document.getElementById("detailGrid").classList.remove("hidden")');
+    expect(html).not.toContain("loadingSpinner(\"Loading configuration\")");
+    expect(html).not.toContain("loadingSpinner(\"Loading models\")");
+    expect(html).toContain("sellerStatusRefreshIntervalMs = 30000");
+    expect(html).toContain("/api/sellers/status");
+    expect(html).toContain("function pumpSellerDetailQueue()");
+    expect(html).toContain("function statusRefreshRow(row)");
+    expect(html).toContain("function scheduleSellerDetailRefresh(row)");
+    expect(html).toContain("const nextRefreshAt = new Date(Date.now() + sellerStatusRefreshIntervalMs).toISOString()");
+    expect(html).toContain("sellerDetailTimers.set(key, timer)");
+    expect(html).toContain("Refreshing details");
     expect(html).not.toContain("sellerLastUpdated");
     expect(html).not.toContain("Last updated:");
     expect(html).not.toContain("s ago");
-    expect(html).toContain("sellerClockTimer = setInterval(() => updateSellerRefreshMeta(sellerRefreshInFlight), 1000)");
+    expect(html).toContain("sellerClockTimer = setInterval(() => { updateSellerRefreshMeta(); updateSellerRowRefreshCountdowns(); }, 1000)");
     expect(html).toContain("function renderSellerRows(rows)");
     expect(html).toContain("sellerRefreshLoaded = true");
     expect(html).toContain("readonly-value");
     expect(html).toContain("--seller-grid");
     expect(html).toContain("grid-template-columns:var(--seller-grid)");
-    expect(html).toContain("#sellerRows{display:grid;gap:10px;width:100%;min-width:0}");
-    expect(html).toContain("gap:12px;width:100%;min-width:0");
+    expect(html).toContain("#sellerRows{display:grid;gap:8px;width:100%;min-width:0}");
+    expect(html).toContain("gap:8px;width:100%;min-width:0");
     expect(html).toContain("detailFieldsHtml");
     expect(html).toContain("data-original");
-    // Design-spec header labels (TTFT not Latency, Disc not Discount)
+    expect(html).toContain('id="closeDetail" class="modal-close"');
+    expect(html).toContain('aria-label="Close detail"');
+    expect(html).not.toContain('id="closeDetail" class="btn">Close</button>');
+    expect(html).toContain("function registryStatusForAction(action)");
+    expect(html).toContain("function patchSellerRegistryStatus(id, status)");
+    expect(html).toContain('showDetailStatus("Updating registry status", true)');
+    expect(html).toContain("patchSellerRegistryStatus(id, status)");
+    expect(html).toContain('document.getElementById("detailModal").classList.remove("open")');
+    expect(html).not.toContain("Set \"+currentDetail.row.name+\" registry status via");
+    expect(html).toContain("function registryStatusDisplay(status)");
+    expect(html).toContain('["registryStatus", registryStatusDisplay(c.registryStatus || d.row.registryStatus)]');
+    expect(html).toContain("function setDetailSavingBusy(busy)");
+    expect(html).toContain('edit.textContent = busy ? "Saving" : (editing ? "Save changes" : "Edit config")');
+    expect(html).toContain('showDetailStatus("Saving seller config", true)');
+    expect(html).toContain('if (!result.ok) throw new Error(result.stderr || "Save failed")');
+    expect(html).toContain("editing = false; renderDetail(); loadSellers();");
+    expect(html).toContain('catch (err) { showDetailStatus(err.message || "Save failed", false); }');
+    expect(html).not.toContain('showDetailStatus(result.ok ? "Saved"');
+    // Design-spec header labels keep monitoring fields visible.
+    expect(html).toContain(">Connection</span>");
+    expect(html).toContain(">Resources</span>");
+    expect(html).toContain(">Balance</span>");
     expect(html).toContain(">TTFT</span>");
-    expect(html).toContain(">Disc</span>");
+    expect(html).toContain(">Status</span>");
+    expect(html).toContain("function upstreamStatusTone(status)");
+    expect(html).toContain("Upstream status from seller /operator/status");
     expect(html).not.toContain(">Latency</span>");
+    expect(html).not.toContain(">Discount</span>");
     // Spec-compliant token formats
     expect(html).toContain("tok/s");
     expect(html).toContain("AVG speed");
@@ -816,6 +1158,13 @@ describe("Admin CLI Config Profile Management Tests", () => {
     expect(html).toContain("formatSellerStatus");
     expect(html).toContain("formatDiscountRatio");
     expect(html).toContain("formatBalanceAmount");
+    expect(html).not.toContain("status-badge");
+    expect(html).not.toContain("balance-badge");
+    expect(html).not.toContain("probe blocked");
+    expect(html).toContain("runningMachines");
+    expect(html).toContain("memoryMb");
+    expect(html).toContain("resourceCpuPercent");
+    expect(html).toContain("resourceMemoryPercent");
     // No glassmorphism per spec
     expect(html).not.toContain("backdrop-filter");
     // Detail field references
@@ -870,8 +1219,9 @@ describe("Admin CLI Config Profile Management Tests", () => {
     // Spec uses — (em dash) for unknown, not "not reported" or "n/a"
     expect(html).not.toContain("not reported");
     expect(html).not.toContain("\"n/a\"");
-    expect(html).toContain("aria-label=\"Seller specs\"");
-    expect(html).toContain("<svg viewBox=\"0 0 24 24\"");
+    expect(html).toContain("function usagePercent(value)");
+    expect(html).toContain("usage CPU ");
+    expect(html).toContain('const resourcePrimary = (cpuUsageText === "—" ? "-" : cpuUsageText) + "/" + (memoryUsageText === "—" ? "-" : memoryUsageText)');
     expect(html).not.toContain(">i</span>");
     expect(html).not.toContain(">×</button>");
     expect(html).not.toContain("Loading sellers...");
@@ -893,6 +1243,7 @@ describe("Admin CLI Config Profile Management Tests", () => {
       const actions = new UiActions({
         configManager: mgr,
         profile: "bootstrap",
+        flyApps: async () => [],
         commandRunner: async (args): Promise<UiActionResult> => {
           calls.push(args);
           return { ok: true, stdout: "ok", stderr: "", command: ["node", "tb-admin", ...args] };
@@ -1588,24 +1939,39 @@ async function startMutableSellerConfigServer(initialConfig: Record<string, any>
 async function startFixtureAdminServer(): Promise<{ baseUrl: string; close: () => Promise<void> }> {
   const server = http.createServer((req, res) => {
     const pathName = new URL(req.url || "/", "http://127.0.0.1").pathname;
+    const baseUrl = `http://${req.headers.host}`;
+    const registrySellers = [{
+      id: "tbs-sin-06",
+      name: "tbs-sin-06",
+      profile: "seller-sin",
+      app: "tbs-sin-06",
+      url: baseUrl,
+      status: "active",
+      region: "sin",
+      modelsCount: 1,
+      sampleModels: ["openai/gpt-5.4"],
+      supportedProtocols: ["responses"],
+      paymentMethods: ["clawtip"]
+    }];
+    if (pathName === "/platform/sellers") {
+      expect(req.headers.authorization).toBe("Bearer bootstrap-token");
+      sendJson(res, { sellers: registrySellers });
+      return;
+    }
     if (pathName === "/registry/sellers") {
       sendJson(res, {
         version: 7,
         updatedAt: "2026-06-05T00:00:00.000Z",
         defaultSeller: "tbs-sin-06",
-        sellers: [{
-          id: "tbs-sin-06",
-          name: "tbs-sin-06",
-          profile: "seller-sin",
-          app: "tbs-sin-06",
-          url: "https://seller.example.test",
-          status: "active",
-          region: "sin",
-          modelsCount: 1,
-          sampleModels: ["openai/gpt-5.4"],
-          supportedProtocols: ["responses"],
-          paymentMethods: ["clawtip"]
-        }]
+        sellers: registrySellers
+      });
+      return;
+    }
+    if (pathName === "/manifest") {
+      sendJson(res, {
+        sellerId: "tbs-sin-06",
+        supportedProtocols: ["responses"],
+        models: [{ id: "openai/gpt-5.4" }]
       });
       return;
     }
@@ -1646,7 +2012,7 @@ async function startFixtureAdminServer(): Promise<{ baseUrl: string; close: () =
       sendJson(res, {
         config: {
           upstreamUrl: "https://openrouter.ai/api/v1",
-          upstreamApiKey: "fixture-live-key-27f9",
+          upstreamApiKey: "[redacted]",
           upstreamBalanceUrl: "https://openrouter.ai/api/v1/credits",
           upstreamRechargeUrl: "https://openrouter.ai/settings/credits",
           upstreamBalanceProbe: {
@@ -1664,6 +2030,19 @@ async function startFixtureAdminServer(): Promise<{ baseUrl: string; close: () =
       });
       return;
     }
+    if (pathName === "/operator/admin/upstream-balance") {
+      sendJson(res, {
+        status: "ok",
+        balance: {
+          source: "openrouter",
+          rawAmount: 47.95,
+          amountUsdMicros: 47_950_000,
+          currency: "USD",
+          fetchedAt: 1781220000000
+        }
+      });
+      return;
+    }
     res.statusCode = 404;
     res.end();
   });

package/tests/seller.test.ts

@@ -222,6 +222,57 @@ describe("tb-admin seller CLI real spawn (no mock)", () => {
     });
     expect(parsed.commands[0]).toContain("apps destroy tbs-86d81e");
   });
+
+  itRequires("roll --dry-run text path lists all live tbs-* candidates from fly apps list", () => {
+    const result = runTbAdminReal([
+      "seller", "roll",
+      "--image", "registry.fly.io/tb-seller:1.0.33",
+      "--dry-run"
+    ]);
+    expect(result.ok).toBe(true);
+    expect(result.stdout).toMatch(/\[Fly\.io\] roll candidates \(tbs-\*, excludes applied\): \d+/);
+    // 至少要有 tbs-86d81e (live 1.0.31 已知)
+    expect(result.stdout).toMatch(/tbs-86d81e/);
+    // dry-run 模式: 每台都是 [DRY-RUN] 而非真 flyctl
+    expect(result.stdout).toMatch(/\[DRY-RUN\] would update tbs-86d81e image to/);
+  });
+
+  itRequires("roll --dry-run --json returns structured candidates/excluded/attempts", () => {
+    const result = runTbAdminReal([
+      "seller", "roll",
+      "--image", "registry.fly.io/tb-seller:1.0.33",
+      "--exclude", "tbs-anpin-ai-0d7517,tbs-openrouter-ai-06vry",
+      "--dry-run", "--json"
+    ]);
+    expect(result.ok).toBe(true);
+    const parsed = JSON.parse(result.stdout);
+    expect(parsed).toMatchObject({
+      ok: true,
+      provider: "fly",
+      action: "roll",
+      image: "registry.fly.io/tb-seller:1.0.33",
+      dryRun: true,
+      completed: true
+    });
+    expect(Array.isArray(parsed.candidates)).toBe(true);
+    expect(parsed.candidates).toContain("tbs-86d81e");
+    expect(parsed.candidates).not.toContain("tbs-anpin-ai-0d7517");
+    expect(parsed.excluded).toEqual(expect.arrayContaining(["tbs-anpin-ai-0d7517", "tbs-openrouter-ai-06vry"]));
+    // attempts 顺序应该跟 candidates 顺序一致
+    expect(parsed.attempts.length).toBe(parsed.candidates.length);
+    for (let i = 0; i < parsed.attempts.length; i++) {
+      expect(parsed.attempts[i].app).toBe(parsed.candidates[i]);
+      expect(parsed.attempts[i].ok).toBe(true);
+    }
+  });
+
+  itRequires("roll rejects empty image and returns 1 (with usage error)", () => {
+    const result = runTbAdminReal([
+      "seller", "roll", "--dry-run", "--json"
+    ]);
+    // commander requiredOption 失败时, 进程退出非 0
+    expect(result.ok).toBe(false);
+  });
 });
 
 describe("SellerCommandRunner integration with real ConfigManager (no mock)", () => {