Installation
a production build you can keep.

01Install and check

1. Install packages Required

   pnpm install

2. Run the checksType check, lint, format check and all automated tests should pass. The tests cover the engine, the backtest fill model, the lab, the server and the admin mapping.

   pnpm check

3. Build RequiredType-checks, then writes the landing page, the desk and the admin console into dist/.

   pnpm build

02Settings file

The server reads its settings from environment variables. Keep them in a .env file next to package.json; it is ignored by git.

cp .env.example .env
openssl rand -hex 32          # paste the answer after ADMIN_SECRET_KEY= in .env

Open .env and fill at least ADMIN_SECRET_KEY. Every variable is explained in Configuration.

03Start the server

One Node process serves the landing page (/), the desk (/app), the admin (/admin) and the API. pnpm build compiles the server to JavaScript in dist-server/; the start command pnpm start runs it with plain node (node dist-server/server/node.js). It does not read .env by itself, so load the file into the shell first (macOS and Linux shells):

set -a && . ./.env && set +a   # export every line of .env
pnpm start

The first line of the output confirms the address, where the AI key comes from and where the admin is stored, for example THESIS on http://localhost:8787 · … · SQLite in …/data. Open http://localhost:8787.

04Create the owner

Creating the first owner needs a one-time secret, so whoever reaches a fresh /admin first cannot claim it. On a server, choose it yourself: set ADMIN_SETUP_TOKEN in the environment (openssl rand -hex 24, at least 24 characters), restart, open /admin and enter that value. Once the owner exists it is never accepted again; remove it from the environment.

Without ADMIN_SETUP_TOKEN, every start until an owner exists prints a one-time setup code instead:

[admin] No owner account yet. Open /admin and create it with this one-time setup code:
    XXXX-XXXX-XXXX-XXXX

1. Find the codeIn the terminal, or in your process manager's log (journalctl, pm2 logs, docker logs). Each start before the owner exists prints a new code; any printed code works.
2. Open /adminEnter the token or the code, your email and a password of at least 12 characters. Press Create owner and sign in. The token or code is then spent.
3. Secure the accountTurn on two-factor under Security & alerts. Add managers or viewers under Team (roles).
4. Walk through Get startedThe admin's setup wizard asks for the product name, accent colour and support email.

05AI key (optional)

Chart reading needs an Anthropic API key. Two ways to set it:

Who pays: you, the operator. Anthropic bills your own Anthropic account per use; the item price does not include it. The daily and hourly limits under AI chart reading keep the bill bounded (Costs).

1. Create the keySign in to the Anthropic Console at console.anthropic.com, set up billing and create an API key, following Anthropic's own documentation. Where to click (labels as of October 2026): console.anthropic.com → Settings → API keys → Create key → name it (for example "thesis") → copy the key, which starts with sk-ant- and is shown only once. Billing is under Settings → Billing. Anthropic's guide: Anthropic docs → API → Getting started.
2. Paste it in the admin Option ASign in as the owner, open Integrations, paste the key into Anthropic API key and press Save changes. Then press Test connection: it checks the key without spending tokens. The key is stored encrypted with ADMIN_SECRET_KEY and is write-only: it can be replaced or tested, never read back. Only the owner can change it. No restart is needed; the server picks it up within about a minute.
3. Or put it on the server Option BANTHROPIC_API_KEY= in .env (Vercel: an environment variable), then restart or redeploy. It then wins and locks the admin field.
4. Check itStatus → Anthropic API key accepted turns green, and the desk's top bar shows AI instead of AI off after a reload.

Then look at AI chart reading in the admin: it is on by default (model claude-opus-5, effort high), with a per-visitor hourly limit (20) and a daily cap for the whole desk (500 requests) that protects your API bill. You pay Anthropic for every request.

06Where data is stored

The server never stores IP addresses, user agents, wallets or per-visitor IDs. Rate limits use salted IP hashes kept in memory.

07Optional checks

pnpm smoke:runner     # one live decision on mainnet data with the paper broker, then the kill switch
pnpm smoke:testnet    # a signed bracket order to testnet from an unfunded throwaway key

The first needs internet access to Hyperliquid. The second is expected to be rejected by the exchange because the throwaway account does not exist; the point is that Hyperliquid recovers the right signer.