Skip to content

feat(pit): promote build + managed hosting on /pit - #583

Merged
ralyodio merged 1 commit into
mainfrom
worktree-pit-promote-build
Oct 17, 2026
Merged

ralyodio merged 1 commit into
mainfrom
worktree-pit-promote-build

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Promotes pit.world/build (the chovy Starter plan: $49 build incl. 30 days, then $2/mo hosting via CoinPay) on app.moshcode.sh/pit.

  • New card under the success/error banner on every /pit render, with an idea box that submits to chovy.com/start?plan=starter&ref=moshpit (same intake pit.world/build uses; ref passes chovy's slug filter).
  • After a purchase (?ok=pay.agent is yours.) the card reads "We build it for pay.agent" and seeds the idea with "A site at pay.agent: ".
  • Links in the "how do I host a site" help and on the "already yours" landing card.
  • Tests: test/moshpit-build-promo.test.mjs; existing /pit page tests still pass.

🤖 Generated with Claude Code

A build-and-host card under the banner on every /pit render: describe the
app, chovy.com builds it on the Profullstack stack, $49 then $2/month via
CoinPay. The form goes straight to chovy.com/start (plan=starter,
ref=moshpit); after a buy (?ok=<name> is yours.) it names the name and seeds
the idea with it. Also linked from the hosting help and the already-yours card.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

1 finding(s) in the 3 file(s) this pull request changes.

MEDIUM: 1

Severity Rule Location
MEDIUM js-unescaped-html-sink apps/pwa/src/routes/moshpit.mjs:2986
105 pre-existing finding(s) elsewhere in the repository — **HIGH/CRITICAL**: 8 | **MEDIUM**: 86 | **LOW**: 11

Not introduced by this pull request. The full set is in the Security tab.

Severity Rule Location
HIGH js-ssrf-outbound-request apps/pwa/public/sw.js:76
HIGH tls-verification-disabled apps/pwa/src/lib/moshpit-gateway.mjs:299
HIGH sh-remote-script-execution install.sh:86
HIGH sh-remote-script-execution install.sh:90
HIGH sh-remote-script-execution install.sh:258
HIGH sh-remote-script-execution install.sh:269
HIGH sh-remote-script-execution install.sh:275
HIGH tls-verification-disabled src/dns.mjs:766
MEDIUM js-unescaped-html-sink apps/pwa/public/herd/herd.js:117
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:44
MEDIUM sql-template-interpolation apps/pwa/src/lib/moshpit-certs.mjs:82
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:139
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:153
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:179
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:373
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:377
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:422
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:674
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:870
MEDIUM sql-template-interpolation apps/pwa/src/moshpit.mjs:872

…and 85 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit bad3409 into main Oct 17, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant