Skip to main content

max / makenotwork

33.8 KB · 618 lines History Blame Raw
1 # MNW CLI: SSH Terminal Interface
2
3 ## Overview
4
5 A TUI application served over SSH at `ssh cli.makenot.work`. Creators connect from any terminal and get a full-screen interactive interface for managing their MNW projects, items, uploads, analytics, and monetization, no browser needed.
6
7 Inspired by `ssh terminal.shop` (Charm/Go). Built in Rust with russh + ratatui.
8
9 ## Why
10
11 The web dashboard is thorough but slow for repeated I/O. Creators who publish frequently (musicians uploading tracks, developers shipping versions, writers posting articles) benefit from a fast keyboard-driven workflow. The CLI collapses multi-step wizard flows into single commands and makes bulk operations natural.
12
13 SSH as transport means zero client installation, every machine already has an SSH client.
14
15 ## Architecture
16
17 ```
18 ┌──────────────┐ SSH (port 2222) ┌──────────────────────┐
19 │ Creator's │ ◄─────────────────────► │ mnw-cli binary │
20 │ Terminal │ (russh server) │ (separate process) │
21 └──────────────┘ │ │
22 │ ┌────────────────┐ │
23 │ │ ratatui TUI │ │
24 │ │ (per-session) │ │
25 │ └────────┬───────┘ │
26 │ │ │
27 │ ┌────────▼───────┐ │
28 │ │ HTTP client │ │
29 │ │ → MNW API │ │
30 │ └────────┬───────┘ │
31 └───────────┼──────────┘
32 │
33 ┌───────────▼──────────┐
34 │ MNW server │
35 │ (Axum, port 3000) │
36 │ PostgreSQL │
37 │ S3 │
38 └──────────────────────┘
39 ```
40
41 ### Separate binary, not embedded in MNW
42
43 - `mnw-cli` is its own Rust binary with its own Cargo project
44 - Talks to MNW via its existing JSON API (same endpoints the dashboard uses)
45 - Runs on the same Hetzner VPS, connects to MNW at localhost:3000
46 - Caddy proxies SSH on port 22 or the binary listens on 2222 (Caddy can't proxy SSH. See Deployment)
47
48 ### Why API client, not direct DB access
49
50 - MNW's API already handles auth, validation, storage tracking, Stripe, email notifications
51 - No risk of bypassing business logic (tier limits, malware scanning, etc.)
52 - CLI stays thin, a TUI skin over the API
53 - Can run on a different machine if needed
54
55 ## Tech Stack
56
57 | Component | Crate | Role |
58 |-----------|-------|------|
59 | SSH server | `russh` (0.58+) | Accept connections, authenticate, manage sessions |
60 | TUI framework | `ratatui` (0.30+) | Render UI into SSH channel |
61 | Terminal backend | `crossterm` | Crossterm backend with custom Write impl |
62 | HTTP client | `reqwest` | Call MNW API endpoints |
63 | Async runtime | `tokio` | russh and reqwest both need it |
64 | Key parsing | `ssh-key` (re-exported by russh) | Parse/fingerprint public keys |
65 | S3 uploads | `reqwest` | PUT to presigned URLs |
66
67 No new dependencies on MNW's side. The CLI is a pure API consumer.
68
69 ## Authentication
70
71 MNW already stores SSH public keys per user (`user_ssh_keys` table, managed via `/api/users/me/ssh-keys`). Creators register keys for git access to `ssh.makenot.work`. The CLI reuses this.
72
73 ### Flow
74
75 1. Creator runs `ssh cli.makenot.work`
76 2. russh server receives connection, calls `auth_publickey_offered` with the offered key
77 3. Handler queries MNW API: `GET /api/internal/ssh-key-lookup?fingerprint={sha256}` (new internal endpoint)
78 4. If key found → `Auth::Accept`, russh verifies signature, then `auth_publickey` fires
79 5. Handler stores authenticated user info (user_id, username, display_name, creator_tier)
80 6. TUI launches with full creator context
81 7. All subsequent API calls use an internal service token + user_id header (no session cookie needed)
82
83 ### New MNW endpoint needed
84
85 ```
86 GET /api/internal/ssh-key-lookup?fingerprint={sha256_fingerprint}
87 → 200 { user_id, username, display_name, creator_tier, can_create_projects }
88 → 404 (key not found)
89 ```
90
91 Internal-only (localhost or shared secret). Not exposed publicly.
92
93 ### No key? Helpful rejection
94
95 If the SSH key isn't registered, the CLI sends a message before disconnecting:
96
97 ```
98 Your SSH key is not linked to a Makenot.work account.
99
100 To connect:
101 1. Log in at makenot.work/dashboard
102 2. Go to Settings → SSH Keys
103 3. Add your public key (~/.ssh/id_ed25519.pub)
104
105 Then try again: ssh cli.makenot.work
106 ```
107
108 ## Screens
109
110 ### Home (after auth)
111
112 ```
113 ┌─ Makenot.work ── max ── Small Files tier ── 142MB / 10GB ─────────┐
114 │ │
115 │ Projects │
116 │ ┌─────────────────────────────────────────────────────────────┐ │
117 │ │ ▸ ambient-textures 12 items $847 revenue 3 drafts │ │
118 │ │ sound-tools 4 items $203 revenue 0 drafts │ │
119 │ │ field-recordings 8 items $56 revenue 1 draft │ │
120 │ └─────────────────────────────────────────────────────────────┘ │
121 │ │
122 │ Quick Stats (last 30 days) │
123 │ Revenue: $312 Sales: 47 Followers: 89 Views: 1,204 │
124 │ │
125 │ [n] New project [u] Upload [b] Blog post [a] Analytics │
126 │ [p] Promo codes [e] Export [s] Settings [q] Quit │
127 └─────────────────────────────────────────────────────────────────────┘
128 ```
129
130 ### Project View
131
132 ```
133 ┌─ ambient-textures ── Music ── 12 items ── $847 total ──────────────┐
134 │ │
135 │ Items Filter: [All ▾] │
136 │ ┌──────────────────────────────────────────────────────────────┐ │
137 │ │ ● dawn-chorus-vol-2 Audio $12.00 Published Mar 25 │ │
138 │ │ ● rain-on-glass Audio $8.00 Published Mar 20 │ │
139 │ │ ○ city-at-night Audio $0.00 Draft Mar 18 │ │
140 │ │ ● texture-pack-spring Bundle $24.00 Published Mar 15 │ │
141 │ │ ... │ │
142 │ └──────────────────────────────────────────────────────────────┘ │
143 │ │
144 │ [u] Upload new [n] New item [b] Blog [p] Promo [t] Tiers │
145 │ [Enter] Open item [d] Delete [Space] Select [P] Bulk publish │
146 │ [Esc] Back │
147 └─────────────────────────────────────────────────────────────────────┘
148 ```
149
150 ### Upload Flow (the killer feature)
151
152 ```
153 ┌─ Upload to: ambient-textures ───────────────────────────────────────┐
154 │ │
155 │ Drop files or enter paths: │
156 │ > ~/Music/exports/dawn-chorus-v2.wav │
157 │ │
158 │ Queue: │
159 │ ┌──────────────────────────────────────────────────────────────┐ │
160 │ │ dawn-chorus-v2.wav Audio [dawn chorus v2 ] ██████ ✓ │ │
161 │ │ rain-textures.flac Audio [rain textures ] ████░░ 67%│ │
162 │ │ field-kit-march.zip Digital[field kit march ] ░░░░░░ Q │ │
163 │ └──────────────────────────────────────────────────────────────┘ │
164 │ │
165 │ Title auto-filled from filename. Tab to edit before upload. │
166 │ │
167 │ Price: [$8.00 ] PWYW: [off] Publish: [immediately] │
168 │ │
169 │ [Enter] Start upload [Tab] Edit field [Esc] Cancel │
170 └─────────────────────────────────────────────────────────────────────┘
171 ```
172
173 Upload pipeline per file (same as web):
174 1. Create item → `POST /api/projects/{pid}/items` (form: title, item_type, price_cents)
175 2. For audio: `POST /api/upload/presign` → PUT to S3 → `POST /api/upload/confirm`
176 3. For other: `POST /api/items/{id}/versions` → `POST /api/versions/{vid}/upload/presign` → PUT to S3 → confirm
177 4. Publish if requested
178
179 **Path input**: The TUI reads local file paths from stdin. The file bytes are read locally and uploaded directly to S3 via the presigned URL. The SSH channel carries the TUI frames + user input, not the file data, files go straight to S3 from the creator's machine.
180
181 Wait, that's wrong. The SSH session runs on the server. The creator's local files aren't accessible.
182
183 ### File Upload: The SSH Problem
184
185 SSH TUI apps run server-side. The creator's local files aren't accessible from the server process. Solutions:
186
187 **Option A: SCP/SFTP sidecar** (recommended)
188 - The SSH server also handles SCP/SFTP subsystem requests
189 - Creator uploads files first: `scp track.wav cli.makenot.work:upload/`
190 - Files land in a per-user staging directory on the server
191 - TUI shows staged files, creator assigns titles/types/prices, then publishes
192 - Staging dir cleaned after publish or on timeout
193
194 ```bash
195 # Upload files
196 scp *.wav cli.makenot.work:upload/
197
198 # Then connect to manage them
199 ssh cli.makenot.work
200 ```
201
202 Or in one flow with SSH command mode:
203 ```bash
204 # Upload + auto-publish
205 scp track.wav cli.makenot.work:upload/ambient-textures/
206 ssh cli.makenot.work publish ambient-textures # publishes all staged files
207 ```
208
209 **Option B: Pipe mode**
210 ```bash
211 # Pipe a file directly
212 cat track.wav | ssh cli.makenot.work upload --project ambient-textures --title "Dawn Chorus" --type audio
213 ```
214
215 **Option C: Local CLI client** (complementary, not primary)
216 A thin local binary that handles file reading and calls the API directly. But this requires installation, loses the zero-install SSH advantage. Better as a future add-on.
217
218 **Recommendation**: Option A (SCP staging) as primary. Option B (pipe) as shortcut for single files.
219
220 ### Upload Screen (with staging)
221
222 ```
223 ┌─ Upload to: ambient-textures ───────────────────────────────────────┐
224 │ │
225 │ Staged files (scp'd to cli.makenot.work:upload/) │
226 │ ┌──────────────────────────────────────────────────────────────┐ │
227 │ │ ✓ dawn-chorus-v2.wav 43MB Audio [dawn chorus v2 ] │ │
228 │ │ ✓ rain-textures.flac 67MB Audio [rain textures ] │ │
229 │ │ ✓ field-kit-march.zip 12MB Digital[field kit march ] │ │
230 │ └──────────────────────────────────────────────────────────────┘ │
231 │ │
232 │ Defaults for all: │
233 │ Price: [$8.00 ] PWYW: [off] Publish: [immediately] │
234 │ │
235 │ [Enter] Upload + publish all [Tab] Edit per-file [Esc] Cancel │
236 └─────────────────────────────────────────────────────────────────────┘
237 ```
238
239 ### Item Editor
240
241 ```
242 ┌─ dawn-chorus-vol-2 ── Audio ── $12.00 ── Published ────────────────┐
243 │ │
244 │ Title: [dawn chorus vol 2 ] │
245 │ Description: [Layered field recordings from sunrise sessions ] │
246 │ [in Olympic National Park. 24-bit WAV. ] │
247 │ Price: [$12.00 ] PWYW: [on ] Min: [$5.00] │
248 │ Tags: ambient, field-recording, nature │
249 │ Status: Published (Mar 25, 2026) │
250 │ File: dawn-chorus-v2.wav (43MB, v1.0) │
251 │ Downloads: 127 │
252 │ │
253 │ Versions: │
254 │ ┌──────────────────────────────────────────────────────────┐ │
255 │ │ v1.0 dawn-chorus-v2.wav 43MB Mar 25 │ │
256 │ │ v0.9 dawn-chorus-v2-beta.wav 41MB Mar 20 │ │
257 │ └──────────────────────────────────────────────────────────┘ │
258 │ │
259 │ [e] Edit fields [v] New version [u] Unpublish [d] Delete │
260 │ [c] Chapters [t] Tags [Esc] Back │
261 └─────────────────────────────────────────────────────────────────────┘
262 ```
263
264 ### Analytics
265
266 ```
267 ┌─ Analytics ── Last 30 days ──────────────────────────────────────────┐
268 │ │
269 │ Revenue Sales Followers Views │
270 │ $312.00 47 89 (+12) 1,204 │
271 │ │
272 │ Revenue by day: │
273 │ $40 │ ╷ │
274 │ $30 │ ╷ │ ╷ │
275 │ $20 │ ╷ │ ╷ │ │ ╷ │
276 │ $10 │ │ │ │ │╷ │ │ ╷ ╷ ╷ │
277 │ $0 └─┴─┴─┴─┴┴─┴─┴─┴──┴─────┴──────────────────── │
278 │ 1 3 5 7 9 11 13 15 17 19 21 23 25 27 │
279 │ │
280 │ Top items: │
281 │ 1. dawn-chorus-vol-2 $144 (12 sales) │
282 │ 2. texture-pack-spring $96 (4 sales) │
283 │ 3. rain-on-glass $72 (9 sales) │
284 │ │
285 │ [w] Week [m] Month [y] Year [e] Export CSV [Esc] Back │
286 └──────────────────────────────────────────────────────────────────────┘
287 ```
288
289 ### Blog Post Editor
290
291 ```
292 ┌─ New Blog Post ── ambient-textures ──────────────────────────────────┐
293 │ │
294 │ Title: [March field recording roundup ] │
295 │ Slug: [march-field-recording-roundup ] │
296 │ │
297 │ ┌── Markdown ──────────────────────────────────────────────────┐ │
298 │ │ ## What I recorded this month │ │
299 │ │ │ │
300 │ │ Three new locations in the Pacific Northwest: │ │
301 │ │ │ │
302 │ │ 1. **Hoh Rainforest**, moss-dampened bird calls at dawn │ │
303 │ │ 2. **Ruby Beach**, wave textures on cobblestone │ │
304 │ │ 3. **Hurricane Ridge**, wind through subalpine fir │ │
305 │ │ │ │
306 │ │ Each recording is 20+ minutes of unprocessed audio. │ │
307 │ │ ~ │ │
308 │ └──────────────────────────────────────────────────────────────┘ │
309 │ │
310 │ Publish: [now ▾] Email followers: [yes] Web only: [no] │
311 │ │
312 │ [Ctrl+S] Save draft [Ctrl+P] Publish [Esc] Cancel │
313 └──────────────────────────────────────────────────────────────────────┘
314 ```
315
316 ### Promo Codes
317
318 ```
319 ┌─ Promo Codes ── ambient-textures ────────────────────────────────────┐
320 │ │
321 │ Active codes: │
322 │ ┌──────────────────────────────────────────────────────────────┐ │
323 │ │ SPRING25 25% off All items 47 uses No limit │ │
324 │ │ FREESAMPLE Free rain-on-glass 12 uses 50 max │ │
325 │ │ BETATESTERS $5 off All items 3 uses 10 max │ │
326 │ └──────────────────────────────────────────────────────────────┘ │
327 │ │
328 │ [n] New code [d] Delete [Esc] Back │
329 └──────────────────────────────────────────────────────────────────────┘
330 ```
331
332 ### License Keys (software creators)
333
334 ```
335 ┌─ License Keys ── sound-tools ── audio-splitter-pro ──────────────────┐
336 │ │
337 │ Settings: Max activations per key: 3 │
338 │ │
339 │ Keys: │
340 │ ┌──────────────────────────────────────────────────────────────┐ │
341 │ │ ABCD-1234-EFGH Active 2/3 activations Mar 25 │ │
342 │ │ IJKL-5678-MNOP Active 1/3 activations Mar 20 │ │
343 │ │ QRST-9012-UVWX Revoked 0/3 activations Mar 15 │ │
344 │ └──────────────────────────────────────────────────────────────┘ │
345 │ │
346 │ [g] Generate keys [r] Revoke [Esc] Back │
347 └──────────────────────────────────────────────────────────────────────┘
348 ```
349
350 ### Settings
351
352 ```
353 ┌─ Settings ───────────────────────────────────────────────────────────┐
354 │ │
355 │ Account │
356 │ Username: max │
357 │ Display name: [Max J ] │
358 │ Email: max@example.com (verified) │
359 │ Tier: Small Files ($24/mo) │
360 │ Storage: 142MB / 10GB ██░░░░░░░░ 1.4% │
361 │ │
362 │ Security │
363 │ 2FA: TOTP enabled │
364 │ SSH Keys: 2 registered │
365 │ Sessions: 3 active │
366 │ │
367 │ SSH Keys: │
368 │ ┌──────────────────────────────────────────────────────────────┐ │
369 │ │ laptop ssh-ed25519 SHA256:abc... Added Mar 10 │ │
370 │ │ desktop ssh-ed25519 SHA256:def... Added Feb 28 │ │
371 │ └──────────────────────────────────────────────────────────────┘ │
372 │ │
373 │ [e] Edit profile [k] Manage keys [x] Export data [Esc] Back │
374 └──────────────────────────────────────────────────────────────────────┘
375 ```
376
377 ## SSH Command Mode
378
379 Beyond the interactive TUI, support direct commands via SSH:
380
381 ```bash
382 # Quick publish staged files
383 ssh cli.makenot.work publish ambient-textures
384
385 # List projects
386 ssh cli.makenot.work projects
387
388 # View analytics
389 ssh cli.makenot.work analytics --last 30d
390
391 # Generate promo code
392 ssh cli.makenot.work promo ambient-textures --code SPRING25 --discount 25%
393
394 # Upload and publish in one shot (pipe mode)
395 cat track.wav | ssh cli.makenot.work upload ambient-textures --title "New Track" --type audio --price 800
396
397 # Export sales data
398 ssh cli.makenot.work export sales --format csv > sales.csv
399
400 # Blog post from file
401 cat post.md | ssh cli.makenot.work blog ambient-textures --title "March Update" --publish
402 ```
403
404 These are handled by checking the SSH "exec" request type. If the client sends a command instead of requesting a shell/pty, run it non-interactively and return output.
405
406 ## Project Structure
407
408 ```
409 mnw-cli/
410 ├── Cargo.toml
411 ├── src/
412 │ ├── main.rs Entry point, russh server setup
413 │ ├── config.rs CLI config (port, MNW API URL, staging dir)
414 │ ├── ssh/
415 │ │ ├── mod.rs SSH server + handler
416 │ │ ├── auth.rs Public key authentication
417 │ │ ├── terminal.rs TerminalHandle (Write impl → SSH channel)
418 │ │ └── commands.rs Non-interactive command dispatch
419 │ ├── api/
420 │ │ ├── mod.rs MNW API client
421 │ │ ├── projects.rs Project endpoints
422 │ │ ├── items.rs Item CRUD + upload
423 │ │ ├── analytics.rs Analytics endpoints
424 │ │ ├── blog.rs Blog post endpoints
425 │ │ ├── promo.rs Promo code endpoints
426 │ │ ├── keys.rs License key endpoints
427 │ │ └── account.rs User account endpoints
428 │ ├── tui/
429 │ │ ├── mod.rs App state + event loop
430 │ │ ├── home.rs Home screen
431 │ │ ├── project.rs Project view
432 │ │ ├── upload.rs Upload/staging screen
433 │ │ ├── item.rs Item editor
434 │ │ ├── analytics.rs Analytics dashboard
435 │ │ ├── blog.rs Blog editor
436 │ │ ├── promo.rs Promo code manager
437 │ │ ├── keys.rs License key manager
438 │ │ ├── settings.rs Settings screen
439 │ │ └── widgets/
440 │ │ ├── mod.rs
441 │ │ ├── table.rs Selectable table widget
442 │ │ ├── input.rs Text input widget
443 │ │ ├── editor.rs Multi-line markdown editor
444 │ │ ├── progress.rs Upload progress bar
445 │ │ └── chart.rs Revenue sparkline/bar chart
446 │ └── staging/
447 │ ├── mod.rs Staging directory management
448 │ └── detect.rs File type detection (same as web: audio extensions)
449 └── tests/
450 ├── auth.rs Key lookup + rejection tests
451 ├── commands.rs Non-interactive command tests
452 └── upload.rs Staging + upload pipeline tests
453 ```
454
455 ## MNW Changes Required
456
457 ### New internal endpoint
458
459 ```rust
460 // routes/api/internal.rs (new file)
461
462 /// Look up a user by SSH key fingerprint.
463 /// Internal only, called by mnw-cli from localhost.
464 GET /api/internal/ssh-key-lookup?fingerprint={sha256}
465 → 200 { user_id, username, display_name, email, creator_tier, can_create_projects, suspended }
466 → 404 { error: "key not found" }
467 ```
468
469 Protected by either:
470 - Localhost-only check (`request.remote_addr` is 127.0.0.1)
471 - Shared secret header (`X-Internal-Token: {configured_secret}`)
472
473 ### Service auth for API calls
474
475 The CLI needs to call MNW API endpoints on behalf of authenticated users without a browser session. Options:
476
477 **Option A: Internal service token + user impersonation** (recommended)
478 - CLI sends `Authorization: Bearer {service_token}` + `X-On-Behalf-Of: {user_id}`
479 - MNW validates the service token (shared secret), then treats the request as coming from that user
480 - Simple, no per-user token management
481
482 **Option B: Per-user API tokens**
483 - Each SSH session generates a short-lived API token via the internal endpoint
484 - Stored in memory for the session duration
485 - More complex but more standard
486
487 Recommend Option A for simplicity.
488
489 ## Deployment
490
491 ### DNS
492
493 `cli.makenot.work`: A record → Hetzner public IP (proxy OFF in Cloudflare, same as `ssh.makenot.work`). SSH can't go through Cloudflare's HTTP proxy.
494
495 ### Caddy
496
497 Caddy doesn't handle SSH traffic. The mnw-cli binary listens directly on port 2222. Firewall opens 2222 to all.
498
499 Or: use port 22 directly. But OpenSSH already occupies port 22 on the VPS for admin access. Solutions:
500 - Move OpenSSH to a different port (e.g., 2200) and give mnw-cli port 22
501 - Keep OpenSSH on 22 for admin, mnw-cli on 2222, users connect with `ssh -p 2222 cli.makenot.work`
502 - Use a TCP multiplexer (sslh) to route based on SSH protocol fingerprinting, fragile, not recommended
503
504 **Recommendation**: mnw-cli on port 22, OpenSSH moved to 2200 (admin access via Tailscale anyway). Users get the clean `ssh cli.makenot.work` experience without specifying a port.
505
506 Alternatively, since `ssh.makenot.work` already points to the same IP for git, and git SSH goes through OpenSSH. Keep OpenSSH on 22, and use `ssh -p 2222 cli.makenot.work`. The port is slightly less clean but avoids conflicts.
507
508 ### systemd
509
510 ```ini
511 [Unit]
512 Description=MNW CLI SSH Server
513 After=network.target makenotwork.service
514
515 [Service]
516 Type=simple
517 ExecStart=/opt/mnw-cli/mnw-cli
518 Environment=MNW_API_URL=http://localhost:3000
519 Environment=MNW_SERVICE_TOKEN=<secret>
520 Environment=STAGING_DIR=/var/lib/mnw-cli/staging
521 Environment=SSH_HOST_KEY=/etc/mnw-cli/host_ed25519
522 Restart=always
523 User=mnw-cli
524
525 [Install]
526 WantedBy=multi-user.target
527 ```
528
529 ### Host key
530
531 Generate once, never change (TOFU model, users trust on first connect):
532 ```bash
533 ssh-keygen -t ed25519 -f /etc/mnw-cli/host_ed25519 -N ""
534 ```
535
536 ### Staging directory
537
538 Per-user staging dirs at `/var/lib/mnw-cli/staging/{user_id}/`. Cleaned up:
539 - After successful publish
540 - After 24 hours (cron or built-in cleanup task)
541 - Max 1GB per user (reject SCP if exceeded)
542
543 ## Implementation Phases
544
545 ### Phase 1: SSH skeleton + auth
546 - [ ] Project setup (Cargo workspace member or standalone)
547 - [ ] russh server with ed25519 host key
548 - [ ] TerminalHandle (Write → SSH channel bridge)
549 - [ ] ratatui rendering into SSH session
550 - [ ] Public key auth via MNW internal endpoint
551 - [ ] Rejection message for unregistered keys
552 - [ ] MNW: internal SSH key lookup endpoint
553 - [ ] MNW: service token auth middleware
554
555 ### Phase 2: Home + project views
556 - [ ] Home screen (project list, quick stats)
557 - [ ] Project view (item list with status)
558 - [ ] Navigation (keyboard shortcuts, breadcrumbs)
559 - [ ] Window resize handling
560 - [ ] API client for projects + items
561
562 ### Phase 3: Upload pipeline
563 - [ ] SCP/SFTP subsystem handler in russh
564 - [ ] Per-user staging directory
565 - [ ] Upload screen (list staged files, edit metadata)
566 - [ ] Type auto-detection from file extension
567 - [ ] Title derivation from filename
568 - [ ] Presign → S3 upload → confirm pipeline
569 - [ ] Progress tracking per file
570 - [ ] Staging cleanup (after publish + timeout)
571
572 ### Phase 4: Item management
573 - [ ] Item editor screen
574 - [ ] Create item (type, title, description, price)
575 - [ ] Edit item fields
576 - [ ] Publish / unpublish
577 - [ ] Bulk operations (select multiple, publish/unpublish/delete)
578 - [ ] Version management
579 - [ ] Tag management
580
581 ### Phase 5: Content + monetization
582 - [ ] Blog post editor (markdown, title, scheduling)
583 - [ ] Promo code management (create, list, delete)
584 - [ ] Subscription tier management
585 - [ ] License key generation + management
586 - [ ] Collection management
587
588 ### Phase 6: Analytics + export
589 - [ ] Analytics dashboard (revenue chart, top items, follower count)
590 - [ ] Time range selection (week/month/year)
591 - [ ] Export (CSV output to terminal or SCP download)
592 - [ ] Transaction history
593
594 ### Phase 7: Command mode
595 - [ ] SSH exec request handler (non-interactive commands)
596 - [ ] `projects`, `analytics`, `publish`, `upload`, `promo`, `export`, `blog`
597 - [ ] Pipe mode for uploads (`cat file | ssh cli.makenot.work upload ...`)
598 - [ ] Machine-readable output (JSON flag)
599
600 ### Phase 8: Polish
601 - [ ] Settings screen (profile, SSH keys, storage meter)
602 - [ ] Broadcast to followers
603 - [ ] Custom domain management
604 - [ ] Error handling + reconnection hints
605 - [ ] Rate limit awareness (back off + show message)
606 - [ ] Graceful shutdown
607 - [ ] Deploy script + systemd unit + monitoring (PoM health check)
608
609 ## Key Paths
610
611 - Design doc: `server/docs/cli.md` (this file)
612 - Project code: `mnw-cli/`
613 - MNW API routes: `MNW/server/src/routes/api/`
614 - MNW SSH key storage: `MNW/server/src/db/` (user_ssh_keys queries)
615 - MNW internal auth: `MNW/server/src/routes/api/internal.rs` (to be created)
616 - Staging directory: `/var/lib/mnw-cli/staging/` (on server)
617 - Host key: `/etc/mnw-cli/host_ed25519` (on server)
618