Changelog
what changed, when.

011.1.0

Current First version published on CodeCanyon. package.json version 1.1.0 · operator console: MIKODES Admin Kit 0.6.0 in packages/admin-kit/ · Node.js 22.13 or newer.

A code-quality and safety release on top of 1.0.0, an earlier build that was not sold. The arena's features, data model and configuration format are the same.

Security

• First console owner. /admin creates the owner only with the one-time ADMIN_SETUP_TOKEN from the environment (openssl rand -hex 24, compared in constant time) or, when that is unset, the one-time setup code printed in the server log. A wrong or missing token is refused (403); once an owner exists, setup answers 409 (how).

Changed

• Production runs compiled JavaScript with plain Node. npm run build type-checks, builds the web app into dist/ and bundles the server into build/server.mjs; npm start runs that bundle with plain Node. tsx is a development dependency used by npm run dev and npm run dev:server only.
• npm start and npm test pass --disable-warning=ExperimentalWarning, so Node's notice about its built-in node:sqlite module does not appear in the console.
• MIKODES Admin Kit 0.6.0: the console's source packages/admin-kit/ui-src/ ships with its package-lock.json, so npm --prefix packages/admin-kit run build:ui rebuilds ui/ reproducibly. Stricter sign-in limits (per address, per account, known devices). Public API and storage schema are unchanged; the console carries only the modules PIT uses (Brand, Legal, builder fee, Integrations).
• The console stylesheet is split into nine ordered partials in web/src/admin/styles/.

Added

• Start-up check of the environment: a PORT that is not a port, an ADMIN_SECRET_KEY that is not 32 bytes, an unreadable RIDE_ENABLED or ADMIN_COOKIE_SECURE, or a URL variable that is not http(s) stops the start with a message naming the variable, never its value (messages). Risky settings are logged as warnings.
• npm run lint (ESLint), npm run format / npm run format:check (Prettier) and npm run check (type check, lint, format check, all tests). Lint and format cover server/, shared/, web/, deploy/ and the root config files; the vendored Admin Kit in packages/admin-kit/ is excluded. Run it before every deploy.
• Tests: 375 server tests (1 more runs once a real Polymarket response is recorded, which needs network access to Polymarket) and 244 web tests, including first-owner setup (no token, wrong token, right token, second setup), start-up checks and shipped-defaults guards (no competitor has a real account address, .env.example starts cleanly, builder fee and Ride off).

Fixed

• Share cards: a long one-line entrant name no longer pushes the chart and the PAPER label off the card.
• The console's Operator page shows a warning when the runner status cannot be read, and the runner logs a failed on-chain check of its agent key. Both were silent before.
• Tests that wait for a stream slot or a console setting to take effect retry until the condition holds (with a deadline) instead of sleeping a fixed time, so npm run check also passes on a busy machine.
• Errors re-thrown from network calls keep the original error as cause (except where a key could appear in the message).

021.0.0

Earlier build, not sold. Operator console: MIKODES Admin Kit 0.4.0.

What it contains

• House paper league, always on: every competitor × prompt variant (Baseline, Monk, Situational, Max-lev) trades a paper account on live Hyperliquid prices. Fills, taker fees, slippage, funding and liquidation are simulated by the server; every screen says PAPER; each entrant is compared with BTC buy-and-hold. A daily LLM budget with pacing caps model spend.
• Model providers with your own keys: Anthropic, OpenAI, Google (Gemini), xAI and DeepSeek. A competitor without a key is shown as not configured and never simulated. Each decision stores the model id that answered and a hash of the snapshot the model saw.
• Community: Sign-In with Ethereum, a builder for visitors' own paper agents (with optional moderation), and the picks game (season winner and daily duels; points only, no money).
• Radio: live decision feed with reasoning, filters, per-entrant replay; share cards (PNG) and share pages with preview tags.
• Prediction league: the same models forecast Polymarket markets, scored by Brier against the market price.
• Membership: plans paid by card (Stripe) or USDC to your own address; realtime feed, alerts (Telegram, Discord, signed webhook), archive, CSV/JSON export, RSS and a read-only API. Also labelled sponsor slots, affiliate links with per-country hiding, and an optional Hyperliquid builder fee.
• Real-money season (optional): your funded Hyperliquid sub-accounts, traded from your own browser tab with an agent key that cannot withdraw. Dry run by default, risk gate, kill switches. The server never holds a trading key.
• Ride (optional, off by default): viewers mirror a model from their own wallet and tab, behind a country gate that trusts only your proxy.
• Operator console at /admin: MIKODES Admin Kit 0.4.0 with PIT's own pages (owner setup code, roles, two-factor, encrypted write-only secrets, audit log, history and rollback, export and import, status checks, revenue of realised events only).
• Deploy files: a backup script, plus a Dockerfile and example Fly.io and Render files provided as-is.

03Known limits

• The real-money season and Ride are off by default. Run your first real-money season on Hyperliquid testnet (why).
• Hyperliquid's docs do not say whether a builder-fee approval by the master account also covers sub-accounts; the runner shows both values (Earnings).
• Card payments need your own Stripe account; run one checkout in Stripe test mode first (External setup).
• The Polymarket league needs a network that reaches Polymarket; one parser test runs only after a real response is recorded.
• Ride's country gate relies on a proxy you configure (Cloudflare); check it from an allowed and a blocked country before announcing Ride (Ride).
• Smart-contract wallets that are not yet deployed on the chain (ERC-6492) cannot sign in.
• Runner heartbeats live in memory and reset on restart.
• Hyperliquid returns at most 10,000 recent fills per account; beyond that the season PnL uses a labelled fallback.

04How to update

Keep the original package and your changes apart from day one, so a new version is a merge, not a rewrite:

cd pit                       # the folder with package.json
git init
git add .
git commit -m "PIT 1.1.0 (original)"
git branch upstream          # untouched copy of the original

The project's .gitignore keeps .env, arena.config.json and the databases in data/ out of git. Back them up separately.

1. Back upRun the backup script (how) and keep a copy of .env with ADMIN_SECRET_KEY. Export the console settings from Export / Import.
2. Download the new versionCodeCanyon → your account → Downloads → PIT.
3. Unpack it on the upstream branch

   git checkout upstream
   # delete the old files (not .git), unzip the new version here
   git add -A
   git commit -m "PIT <new version> (original)"
   git checkout main
   git merge upstream

4. Resolve conflictsUsually only in files you rebranded, such as web/src/styles/tokens.css or prompts. Keep your values, take the new code.
5. Install and check

   npm install
   npm test
   npm run build

6. Read the entryFollow the update steps listed for every version between yours and the new one, then compare your .env with the new .env.example.
7. RedeployDeploy the new build (Deployment). Database changes are applied automatically when the server starts.

Versions follow major.minor.patch: a patch fixes bugs, a minor adds features with safe defaults, a major may need migration steps, which are always listed here.