BEFORE Adding ten proxies today

Fleet → scroll → “Add a proxy”

• Lives inside Fleet below the boxes, owner-only (fleet.html:76-80). Not in the nav, not in the setup wizard.
• One proxy = Name, Type, Host, Port, User, Password, Cap, Stop %, Reset day, Rotating, Save (fleet.html:92-110). A provider sends a list of 10: ≈ 80 inputs plus 10 Saves.
• Types: SOCKS5, HTTP, Tailscale exit (fleet.html:93-96). No WireGuard or OpenVPN file, no provider picker.
• Test checks the tunnel and exit IP only (tunnel/cp-probe:8-14): a proxy that 403s PacketStream still shows green, and the copy earns nothing.
• Running a copy is a second form with three selects, one copy per submit (fleet.html:114-123).
• Keyboard: no shortcut reaches it; Tab from the top of Fleet takes 30+ presses (screenshot 36-kbd-fleet-proxy.png).

SCREEN 1 Proxies & VPNs page, reached with g e

One row per way out to the internet, starting with the box's own line. Status means “the services can earn through it”, not “a socket opened”.

1. 1Own nav item, visible to every role. g e jumps here; the hint shows when the link has focus. Today proxies are a section of Fleet behind {% if user.r == 'owner' %} (fleet.html:76). Viewers see the table read-only; only the owner sees Add.
2. 2One primary action, with a key. n opens the Add egress dialog from anywhere on the page. Today: scroll, find the collapsed <details>, open it (3 actions before the first field).
3. 3The box's own IP is row one. It is the baseline every other row is compared to, and it makes the rule “one payout per IP” obvious without reading docs. Exit IPs are masked to the last octet by default (screenshots get shared); Shift-click reveals.
4. 4“Works” means the vendors answer through it, not only that the tunnel opened (see Screen 3). Other values: Partly some vendors blocked, Down, Untested.
5. 5Cost vs earnings. Cost per GB from the plan the user typed; earnings per GB from the copies' own balance history. Red “losing money” when cost > earnings. Today there is a cap but no cost, so a paid proxy can burn money silently.
6. 6Kill switch shown, not assumed. Green only after the test proved the copy has no route to the home line (the probe tries the direct route and expects it to fail).
7. 7Datacenter warning names the services. The list comes from the catalog's residential_ip: true key in services/**/*.yml; the link opens Place with only the services that pay pre-ticked.
8. 8Totals first. How many IPs, how many earn, what egress cost this month. Net in red when negative.
9. 9Copy as CLI (wave 3, L5) puts the equivalent commands on the clipboard: cashpilot egress ls --json, cashpilot egress test --all. The same affordance sits in every dialog footer.

STATES Empty, and the 390-wide phone layout

SCREEN 2 Add egress, Paste tab: ten proxies in one paste

Every common provider format is parsed live. Bad lines are shown with their reason and skipped, never silently dropped.

1. 1Four tabs, one dialog. Paste covers proxy lists; VPN file or provider takes a WireGuard .conf / OpenVPN .ovpn drop or a provider picker (adds a gluetun-style sidecar, no VPN client on the host); Tailscale is Screen 4; By hand is today's form. Digits switch tabs.
2. 2Paste is the default and is focused on open, so n then Ctrl V is the whole input step. Passwords are masked in the box the moment they are parsed.
3. 3Live preview, one row per line. The parser in app/proxies.py gains parse_proxy_line(); the API takes a list (POST /api/egress/batch). Today the API takes one proxy per call (app/proxies.py:24).
4. 4Bad line in red with the reason, skipped, counted out of the Add button (“Add 3”, not 4). Fixing it in the textarea updates the row at once.
5. 5Shared fields typed once. Ten proxies from one plan share cap, reset day and price. Rotation is measured, not asked (Screen 3).
6. 6Copy as CLI (wave 3, L5) with the exact flags the dialog holds, passwords excluded (the file keeps them). An agent can do the same with one command.
7. 7Test before Add. Enter tests all parsed lines in parallel; Add stays available but warns if a line has not passed. ten proxies: ≈ 80 inputs → 3 keys (n, Ctrl V, Enter) plus one click to add.

SCREEN 3 Test result: what the IP is, and which vendors answer through it

The probe in tunnel/cp-probe already fetches the exit IP. It gains three checks: IP type from the ASN, rotation from three samples, and a reach test against each deployed service's own endpoints through the egress.

1. 1IP type with the network's name. Residential, Residential/ISP, Datacenter, Mobile, from the ASN of the exit IP. Users buy “residential” proxies that turn out to be hosting ranges; this shows it before money is spent.
2. 2Rotation is measured. Three samples. Same IP = sticky; different = rotating, and the rotating box ticks itself. Today it is a checkbox the user must know to tick (fleet.html:109).
3. 3Vendor reach, per deployed service. One request to each vendor's endpoint (the new docker.egress list of {host, port} in the service YAML) through the egress. This is the check whose absence made copies run green and earn nothing.
4. 4Failures say what to do, in plain words, not an HTTP dump. Ports come from the service YAML.
5. 5Services that cannot run through any egress are greyed, with the reason the code already enforces (no host networking, ports, volumes or devices, fleet.html:121).
6. 6Place earners pre-selects only the services that passed, on the boxes that already run them, and asks once. Today: one “Run a copy” submit per service per proxy (fleet.html:114-123).

SCREEN 4 Tailscale tab: connect once, pick an exit node

Today the user creates an auth key in the Tailscale admin, pastes it, and types the exit node name or its 100.x address (fleet.html:103-105). Here CashPilot signs in with Tailscale OAuth and lists the nodes that can be exits.

{
  "tagOwners": { "tag:cashpilot": ["autogroup:admin"] },
  "grants": [
    { "src": ["tag:cashpilot"], "dst": ["autogroup:internet"], "ip": ["*"] }
  ]
}

1. 1Connect Tailscale runs an OAuth flow and stores a read-only client. The button greys after it works and the tailnet name shows, with Disconnect beside it. Self-hosted Headscale keeps the By hand tab (login server field).
2. 2A picker instead of a typed name or 100.x address. Online dot, last seen, exit country. Already-added nodes are ticked and labelled. Arrow keys and Space work.
3. 3Offline nodes stay listed but greyed, so the user does not wonder where “travel-router” went.
4. 4Missing-grant state, specific. The error comes back from the tailscale sidecar; the screen names the node and the reason instead of a generic failure.
5. 5The exact JSON to paste, with Copy, and a link that opens the admin page. CashPilot never asks for a write token to the policy file.

CLI · API Same actions without the browser

Every dialog above has a Copy as CLI line (wave 3, L5). The CLI is a thin client over the same REST endpoints (bearer token from Settings → API tokens), so a person in a terminal and an agent such as Claude Code get identical behaviour.

1. AHuman output by default, --json for agents, stable field names, documented exit codes so a script or an agent can branch without parsing prose.
2. B--dry-run on every write and a “Next:” hint after each command. Docs page docs/egress.md carries a copy-paste block per provider format, and docs/agents.md lists the commands and exit codes for agents.