# axi0 0Games: sources, licenses and what we changed

Every game under `search/static/games/<id>/` is a finished free-software game vendored from its upstream repository at
one pinned commit, with its license file kept in place and our changes recorded next to it in `axi0.patch`
(`diff -ruN upstream ours`). We wrote none of the games; we wrote the page around them (`index.html`, `games.css`,
`games.js`, `games-core.js`), the sandbox shim every game loads first (`axi0-game.js`) and the two-library Chess page.
License read from the LICENSE file in the upstream repository at the pinned commit, not from a README. Date read:
2026-10-27. Allowed: MIT, BSD, Apache-2.0, GPL-2/3, MPL, Unlicense, CC0, CC BY, CC BY-SA. Anything NonCommercial,
"all rights reserved" or without a license file is out.

## The register (ASLW rows: provider, document, clause, date read, verdict)

| id | Game, upstream | Pinned commit | License file and clause | Verdict | Our patch |
|---|---|---|---|---|---|
| 2048 | 2048 by Gabriele Cirulli, https://github.com/gabrielecirulli/2048 | 478b6ec346e3787f589e4af751378d06ded4cbbc | LICENSE.txt, MIT: "Permission is hereby granted, free of charge, to any person obtaining a copy of this software ... to deal in the Software without restriction" | IN | shim first; the best score goes to the page where `setBestScore` is called; the Apple start-up images and `favicon` links we do not ship are out. Fonts: Clear Sans (Apache-2.0, Intel), bundled by upstream, woff only. |
| hextris | Hextris by Logan Engstrom, Garrett Finucane, Noah Moroze, Michael Yang, https://github.com/Hextris/hextris | 3f4847dc8fd7dab3d1c87e6324b9159d92fbd396 | LICENSE.md, GPL-3.0: "GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 ... Everyone is permitted to copy and distribute verbatim copies" | IN (GPL-3: our patch is published beside it) | shim first; Google Analytics, the ads script, the Google Fonts link, the share buttons (rrssb), the app-store badges and the `GET` of the final score to a score server (54.183.184.126) and the `hextris.io/a.js` loader are out; the score goes to the page instead; three inline styles of the high-score list and the pause/start overlays became classes; jQuery 1.9.1 replaced by the shared jQuery 3.4.1 (1.x's feature tests set an inline handler), `$(window).unload` -> `.on('unload')`. Bundled by upstream: hammer.js (MIT), js-cookie (MIT), keypress (Apache-2.0), JSONfn and sweet-alert (MIT by their authors; no header in the minified files: not verified from a LICENSE file), Font Awesome 4 (OFL/MIT), Exo 2, Lovelo, Quattrocento Sans (OFL, by upstream's say). |
| clumsy-bird | Clumsy Bird by Ellison Leão, https://github.com/ellisonleao/clumsy-bird | fae3d487d5102af29fb3f78431cbd45e9b83aed3 | LICENSE.md, GPL-3.0 (same text) | IN | shim first; the page loads the six source files instead of the Grunt bundle (so the hook is readable): the score goes to the page where the bird dies; audio: mp3 only (the ogg and wav copies are not shipped, `me.audio.init("mp3")`); `humans.txt` and icon links out. Bundled: melonJS (MIT), the gamefont (woff only; the ttf/eot/svg copies are not shipped). |
| astray | Astray by Rye Terrell, https://github.com/wwwtyro/Astray | d3c4f61f2cbbe35752fbfa205f85a41d7f9fe0f0 | License.md, Unlicense: "This is free and unencumbered software released into the public domain." | IN | the page's inline script and style became files; textures loaded from the game's own directory (upstream used `/ball.png` at the site root); levels finished go to the page when a maze is solved; jQuery 1.7.2 replaced by the shared 3.4.1. Bundled: Three.js r49-era (MIT, three.js project), Box2dWeb (zlib, port of Box2D), KeyboardJS (BSD, header in the file). |
| pacman | Pac-Man canvas by platzh1rsch, https://github.com/platzhersh/pacman-canvas | 6c42e3c991830283c8b6022a2d1237f2332c32ab | LICENSE.md, CC0 1.0 Universal: "the person who associated a work with this deed has dedicated the work to the public domain" | REMOVED 2026-10-27: trademark/trade-dress risk (the name and look are a third party's mark: Tetris v. Xio, 2012; Pac-Man is Bandai Namco's). Files deleted; the row stays as the record. | shim first; Google Analytics and the ad slot out; the high-score server (`data/db-handler.php`) is off (`HIGHSCORE_ENABLED = false`, `getHighscore` returns) and the final score goes to the page; the wav `<source>` tags out (mp3 stays); jQuery 1.10.2 replaced by the shared 3.4.1 with `crossDomain: true` (an opaque origin must not send X-Requested-With) and `.on('unload')`. Bundled: jquery.hammer (MIT), VirtualJoystick.js (MIT by Jerome Etienne; no header in the file), Press Start 2P (OFL). The map JSON is loaded by XHR: the game directories answer with `Access-Control-Allow-Origin: *`. |
| tetris | JavaScript Tetris by Jake Gordon, https://github.com/jakesgordon/javascript-tetris | e5c0c42f7dac0f3514a55eff656c6e22e95d68ed | LICENSE, MIT (same clause) | REMOVED 2026-10-27: trademark/trade-dress risk (the name and look are a third party's mark: Tetris v. Xio, 2012; Pac-Man is Bandai Namco's). Files deleted; the row stays as the record. | the page's inline script and style became files; the final score goes to the page in `lose()`; the FPS meter (stats.js by mrdoob, MIT) is left out: it wrote inline styles. |
| minesweeper | Emoji Minesweeper by Mu-An Chiou, https://github.com/muan/emoji-minesweeper | 2187e371e9a0f87cf54a207031760fc33b858a9a | LICENSE, MIT (same clause) | IN | the inline scripts and style became files; Google Analytics, the Google Fonts link, the service worker and Twemoji (it fetched emoji pictures from a CDN; the browser's own emoji are used, the Twemoji choice is hidden) out; the time of a win, in seconds, goes to the page (lower is better). |
| snake | JavaScript Snake by Patrick Gillespie, https://github.com/patorjk/JavaScript-Snake | 3243086c0badb4b4c6bedfe6d95d5a52a7caaa88 | LICENSE, MIT (same clause) | IN | from `src/` (no Parcel build needed); the inline scripts and style became files; Google tag manager out; six inline styles and the pause box's one became classes; the best length goes to the page; TuiCss (MIT, LICENSE.md kept) with its woff2 font only (the ttf copies are not shipped). |
| breakout | JavaScript Breakout by Jake Gordon, https://github.com/jakesgordon/javascript-breakout | eed59e2affa9423b93d2ac8ff93061bb88b33284 | LICENSE, MIT (same clause) | IN | the inline start script became a file; the instructions box's inline `display:none` moved to the stylesheet (and `show()` sets block); the final score goes to the page on `lose`. Bundled: SoundManager 2 (BSD, `sound/license.txt`), HTML5 audio only (the Flash files are not shipped). |
| pong | JavaScript Pong by Jake Gordon, https://github.com/jakesgordon/javascript-pong | ca3240536e4f79ab7144388e56ed19de715b6662 | LICENSE, MIT (same clause) | IN | the inline start script became a file. No score hook: a match, not a best. |
| sudoku | sudoku.js by Rob McGuire-Dale, https://github.com/robatron/sudoku.js | 4362a13510925f03a2f749b4657a8e4c5f36a869 | LICENSE, MIT (same clause) | IN | the `demo/` page; a full, correct board counts one puzzle solved (to the page); the IE shim and icon links out; jQuery 1.9.0 replaced by the shared 3.4.1 and the Bootstrap 2 tab call replaced by a class toggle (the links have `href="#"`). Bundled: Bootstrap 2 (Apache-2.0). |
| chess | chess.js by Jeff Hlywa, https://github.com/jhlywa/chess.js, tag v0.13.4 | 6334c656705101ca758de29cac4c866c4d305745 | LICENSE, BSD-2-Clause: "Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met" | IN | unchanged (loaded as the ES module it is). |
| chess | chessboard.js by Chris Oakman, https://github.com/oakmac/chessboardjs | bfb9315cd44d22c4a3ccc883ab4c0b42e902557e | LICENSE.md, MIT (same clause) | IN | the two inline size styles it wrote into its markup became a CSS variable set from `resize()`; pieces: the Wikipedia set by Colin M.L. Burnett, CC BY-SA 3.0 (credited on the page). The page itself (`chess/index.html`, `axi0-chess.js`, `axi0-chess.css`) is ours. |
| (shared) | jQuery 3.4.1, from the chessboard.js repository at the same commit (`website/js/jquery-3.4.1.min.js`) | bfb9315cd44d22c4a3ccc883ab4c0b42e902557e | header: "jQuery v3.4.1 | (c) JS Foundation and other contributors | jquery.org/license" (MIT) | IN | one copy at `games/jquery-3.4.1.min.js` for Hextris, Astray, Pac-Man, Sudoku, Chess and A Dark Room. |
| four-in-a-row | Four in a Row by QveenCoder (repository "connect-four"), https://github.com/QveenCoder/connect-four | 17005566c6a4c493cbc86038808469e52434be54 | LICENSE, MIT: "Permission is hereby granted, free of charge, to any person obtaining a copy of this software ... to deal in the Software without restriction" (read 2026-10-27) | IN | shim first; the page says "Four in a Row" everywhere a person reads it (the upstream's own title; "Connect Four" is Hasbro's mark, so the board's label and the repository name are not shown); `game.js` rewritten around three modes: against the house (upstream's game), two players at one screen, and online through the page's play protocol (the frame validates every move with upstream's `ai.js` and reports its own; ivory = "w" moves first, burgundy = "b"); a Two players button and a mode line; a footer credit. |
| adarkroom | A Dark Room by Michael Townsend, Doublespeak Games, https://github.com/doublespeakgames/adarkroom | 1fada4620b6c66bd07bf15a3f1eb8223df8bc1d7 | LICENSE.md, MPL-2.0: "Mozilla Public License Version 2.0 ... 2.1. Grants: Each Contributor hereby grants You a world-wide, royalty-free, non-exclusive license" (read 2026-10-27) | IN (MPL-2.0: our changes to its files are published beside it in `axi0.patch`) | shim first; the CDN jQuery 1.10.1 and its inline fallback replaced by the shared jQuery 3.4.1; the Google tag script and its inline config out; the inline scripts (language pick, old-IE flags, the "saved." note) became files; one SVG `style` attribute became a class. Not shipped: the translations (`lang/*/`, 4 MB; English is built in, `lang/langs.js` stays), `tools/`, `doc/`, the dev server. The 86 FLAC tracks (5 MB) are shipped and fetched one by one when the sound is on. Saves live in the frame's memory for the visit (the shim's localStorage). |
| hexgl | HexGL by Thibaut Despoulain (BKcore), https://github.com/BKcore/HexGL | 6addc95a2fce3bf05f4d751823cc054c61a16d68 | LICENSE, MIT: "The MIT License (MIT) Copyright (c) 2015 Thibaut Despoulain ... Permission is hereby granted, free of charge" (read 2026-10-27); README: "HexGL's code and resources are now licensed under the MIT License" | IN | shim first; the Google Analytics block out; the `manifest="cache.appcache"` attribute and the two favicon links to hexgl.bkcore.com out; the inline launch script and style block became files; seven `style="display: none"` attributes became classes; one texture set (`textures/`, 4 MB): `textures.full/` (5 MB) is not shipped and `Cityscape.js` points every quality at `textures/`; the Bebas Neue font as woff only (`fonts.css` trimmed); `replays/` and `package.zip` not shipped; the race time (three laps) goes to the page in seconds from `HexGL.js` (lower is better). Bundled by upstream: Three.js r5x-era (MIT), Leap Motion JS 0.4.1 (Apache-2.0), dat.GUI (Apache-2.0), Stats.js (MIT); their licenses are named from their headers, not from a LICENSE file. 10 MB, loaded only when the game opens. |
| elevatorsaga | Elevator Saga by Magnus Wolffelt, https://github.com/magwo/elevatorsaga | e0c55bf8cf59243c32dc371b2cc7b2e3ec1664af | LICENSE.txt, MIT: "The MIT License (MIT) Copyright (c) 2014 Magnus Wolffelt ... Permission is hereby granted, free of charge" (read 2026-10-27) | IN (its directory alone allows `unsafe-eval`: the game runs the code a person writes with `eval`, inside the opaque sandboxed frame with no network and no storage; nginx and the local test server carry that one exception) | shim first; the inline start script became a file; the riot templates stay as `type="text/template"` data blocks (not executed; the policy is about executable inline script); the templates' four templated `style` attributes (a floor's top, an elevator's width, the error line's display, a blink) were removed and `presenters.js` sets the same values through the CSSOM after rendering; the remaining static `style` attributes became classes; `app.js` sends the number of the challenge cleared to the page. Not shipped: `documentation.html`, the tests, the deploy script, Font Awesome's eot/ttf/svg copies (woff only). Bundled: jQuery 2.1.1, lodash, riot.js 1.0, CodeMirror 4, Font Awesome 4.1 (MIT / OFL by their projects; no license file of their own in `libs/`). The code a person writes lives in the frame's memory for the visit. |
| tiny-platformer | Tiny Platformer by Jake Gordon, https://github.com/jakesgordon/javascript-tiny-platformer | 50cbd06c410efe768b7c76f4458387a194130339 | LICENSE, MIT (same clause; read 2026-10-27) | IN | shim first; the inline script and style became files. `tiles.png` and `level.json` are upstream's own files (no credit named; a guess that the tiles are the author's). Bundled: FPSMeter (MIT, header in the file). No score hook: a run, not a best. |
| underrun | Underrun by Dominic Szablewski (phoboslab), https://github.com/phoboslab/underrun | f933e29152d7fc1ca61d4b3eaa8b29551d7d7a62 | LICENSE.md, MIT (same clause; read 2026-10-27) | IN | the source page `index-debug.html` runs the unbuilt `source/` files (the repository's `build/` holds a placeholder; no build step here); shim first; the style block became a file and the body's `style` attribute a class. Art and music are upstream's own (`m/`, the Sonant-X synth). WebGL. |
| q1k3 | Q1K3 by Dominic Szablewski (phoboslab), https://github.com/phoboslab/q1k3 | 8ee934856c3f5de3c584724b9dd554314a911694 | LICENSE.md, MIT (same clause; read 2026-10-27) | IN | the source page `index.html` runs the unbuilt `source/` files with `assets/` (maps, models, textures: upstream's own, fetched from the game's directory); shim first; nothing else changed. WebGL. |
| space-huggers | Space Huggers by Frank Force (KilledByAPixel), https://github.com/KilledByAPixel/SpaceHuggers | bdabe47ffb983d9c646e25b42e20de2338a37cc8 | LICENSE, GPL-3.0: "GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007" (read 2026-10-27) | IN (GPL-3: our patch is published beside it) | shim first; the favicon link out; nothing else changed (no inline script or style). Art is upstream's `tiles.png` plus procedural drawing; the engine is the author's own (pre-LittleJS). |
| bounce-back | Bounce Back by Frank Force (KilledByAPixel), https://github.com/KilledByAPixel/BounceBack | 395fd046338e6c5d5840d10e7fbd74132f90b8f6 | LICENSE, GPL-3.0 (same text; the page header says "version 2 of the License, or (at your option) any later version"; read 2026-10-27) | IN (GPL: our patch is published beside it) | shim first; the style block became a file and the hidden canvas's `style` attribute a class. Saves (coins, best time) live in the frame's memory for the visit. |

Licenses of components bundled inside a game that carry no license file of their own at the pinned commit are
named from their file headers or their projects and are marked above; we did not verify those from a LICENSE file.

## Looked at and not taken

| Candidate | Why not |
|---|---|
| daleharvey/pacman (WTFPL) | WTFPL is not on the list of licenses we take. |
| end3r/Gamedev-Canvas-workshop (MDN Breakout) | LICENSE names MDN's terms (prose CC BY-SA, samples CC0) rather than one license for the repository; jakesgordon's Breakout is MIT and complete. |
| rjanjic/js-solitaire (MIT) | needs a webpack + Sass build of 2018 tooling; left for a later round. cyanharlow/solitaire has no license file. |
| ShizukuIchi/minesweeper, kubowania/minesweeper | no license file. |
| mozilla/BrowserQuest | no license file at the repository root for the client build; 68 MB. |
| DavidNHill/JSMinesweeper (MIT) | a solver and analyzer more than a game; Emoji Minesweeper is smaller. |
| jakesgordon/javascript-racer (MIT code) | README: the music is "licensed ONLY for use in this project" and the sprites are "placeholder graphics borrowed" from an old game: the assets fail the read. |
| nuclear-unicorn/kittensgame | license.txt is a "WET PAWS LICENSE": "Using the game code for commercial gain or creation of derivative works is not permitted." |
| AlexNisnevich/untrusted, ondras/sleeping-beauty, candybox2/candybox2, jakesgordon/javascript-boulderdash, hundredrabbits/Markl | no license file at the repository root. |
| hundredrabbits/Verreciel | CC BY-NC-SA 4.0: NonCommercial. |
| IvarK/AntimatterDimensionsSourceCode (MIT) | the playable build (`gh-pages`) is 67 MB (22 MB of images, 37 MB of scripts) and the source needs a Vue build; too big for this host. Later, on an asset host. |
| Jacorb90/Prestige-Tree (MIT) | Vue 2 from a CDN compiling templates at run time (needs `unsafe-eval`) and 37 inline handlers in the page: not patchable under the policy without rewriting it. |
| Trimps/Trimps.github.io (GPL-3) | 364 inline handlers and 108 style attributes in the page, PlayFab cloud saves and a Kongregate shell: too much to patch honestly. |
| w84death/Tanks-of-Freedom (MIT, code and art) | a Godot project with no HTML5 export in the repository or its releases: it needs a Godot build. |
| freedoom/freedoom (BSD) + cloudflare/doom-wasm (GPL-2.0) | doom-wasm ships no built WebAssembly (an Emscripten build of Chocolate Doom) and the Freedoom WADs are 20 MB each: a build and an asset host. Later. |
| SuperTux (GPL-3) | play.supertux.org showed a maintenance page on 2026-10-27; no published file set to vendor. |
| hundredrabbits/Oquonie (MIT), doublespeakgames/gridland (MIT) | 67 MB and 35 MB of assets: too big for this host. |
| graememcc/micropolisJS (GPL-3 + a name license) | needs a webpack build; the Micropolis Public Name License is a second read. Later. |
| phoboslab/q1k3 (MIT) | vendored, then dropped: the source page loads the packed level and model files (`build/l`, `build/m`) that only the build step (C and PHP packers) produces. Later, with a build. |
| hundredrabbits/Donsol (MIT, the 2019 web version at 49e73a8) | the cards are read with Electron's `require('fs')`: a patch to fetch, later. |
| lynn/hello-wordl (MIT) | the name leans on a third party's mark. |
| pmotschmann/Evolve (MPL-2.0), Pseudonian/Synergism (MIT), erosson/swarm (GPL-3) | built with a toolchain (or 9 MB of translations): not static files at the pinned commit. Later. |

## Cloud: the nuage.games linker (an outside service, read 2026-10-27)

The page's Cloud section lists titles people may own on Steam that nuage.games streams in a browser, each with two plain links:
nuage's play page (`https://nuage.games/play/<slug>`) and the Steam store page (`https://store.steampowered.com/app/<id>/`).
We embed nothing of theirs, hold no account of theirs, send no referrer, and run none of these games. ASLW row:

| Provider | Document | Clause (quoted) | Date read | Verdict |
|---|---|---|---|---|
| Nuage (nuage.games) | Terms of Service, https://nuage.games/terms (the text is in the page's `legal.js`, "updated: October 23, 2026") | "Nuage rents you remote access to a computer in the cloud (a "Cloud PC") that runs the Steam client, and streams that computer's screen to your browser." "We don't sell, rent, license or distribute games." "Every game you play is licensed to you by its publisher through your own Steam account, under the Steam Subscriber Agreement and that game's own license terms." "you save your Steam login (account name and password) once. We store it encrypted, with the encryption key kept separate from our storage, and we never log it." "You must be at least 13 years old (and old enough to use Steam where you live)". | 2026-10-27 | LINK ONLY: a third party with its own account and Steam's; it holds the person's Steam password, which our Key rule never allows us to do, so nothing of theirs is embedded or proxied; the page says so. |
| Nuage pricing | https://nuage.games/pricing (text in `compare.js` / `app.js`) | "Day pass $5.99 · 7 days $14.99 (local prices: ₹199, R$29.90) · nothing renews"; Pro is "no longer sold to new players (currently $19.99 per month ...)"; the app notes "no free play". | 2026-10-27 | Stated on the page: a paid pass, theirs. |
| Nuage catalogue | https://nuage.games/games.js (their public list, 49 entries with Steam app ids; `app.js` derives `slug` from the name: trademark signs dropped, NFKD, ASCII, lower case, runs of other characters to a dash) | the list is "Generated by tools/fetch_games.py: Steam store data + ProtonDB tiers" | 2026-10-27 | 40 titles kept (49 less the two marked unplayable, one pending, two on the lowest tier and four little-known survival titles); the slugs are their own derivation, so each `/play/<slug>` is a page their app knows. Their site is a single-page app that answers 200 for any path, so a status code alone proves nothing; the slug rule is the verification. |
| Steam store | https://store.steampowered.com/app/<id>/ (public store pages) | Valve's Steam Subscriber Agreement grants "a non-exclusive license and right, to use the Content and Services for your personal, non-commercial use" | 2026-10-27 (via the radar note) | Plain links to public store pages; the names of the titles are their publishers' marks, used to name them and for nothing else. |

## How a game runs here

- `index.html` is the grid; a tile opens the game in `<iframe sandbox="allow-scripts">`: an opaque origin with no
  storage, no cookies, no dialogs and no access to the page or the Key. The page's policy allows frames from this
  origin only; each game directory answers with its own policy (`default-src 'none'`, `script-src 'self'`,
  `style-src 'self'`, `connect-src 'self'`, `sandbox allow-scripts`) and `Access-Control-Allow-Origin: *` for the
  games that load their own JSON or audio by XHR from the opaque origin. No inline script or style anywhere: every
  inline block became a file, every `style=""` became a class (the browser test reports any violation).
- `axi0-game.js` is loaded first by every game: an in-memory `localStorage`/`sessionStorage` and `document.cookie`
  (the games keep their own "best" logic for the visit), and `axi0Game.score(n)` which posts
  `{axi0: "score", game, score}` to the parent. That is the only way out of the frame.
- `games.js` accepts a score only from the frame it opened, for the game it opened. `games-core.js` keeps the table
  `{v: 1, best: {<game>: {s, at}}}` (lower is better for Minesweeper, higher for the rest) in ONE Keep locker under
  `svc = HKDF(Key, "axi0-key/service/games")`, sealed client-side like Notes, with a sealed copy next to the Key
  (`axi0.mine.games`, wiped on Lock). Without a Key the table lives in the page's memory for the visit, and the page
  says so; unlocking adopts it (the better score wins per game).
- Regenerating a game: clone the upstream at the pinned commit, copy the files the game needs, apply `axi0.patch`
  with `patch -p1` from inside the game's directory. The patches are the record; `search/tests/games.test.mjs`
  checks the rules above against every game directory.


Display names (2026-10-27): the Breakout and Pong clones are shown as "Bricks" and "Paddles": Breakout and Pong are Atari marks; the directories, ids and upstream names stay.