juicyjuicy 0.2.0 → 0.3.0

package/dist/index.js

@@ -5156,7 +5156,7 @@ var recursive = /* @__PURE__ */ new WeakMap();
 var NONE = 0;
 var ASSUMED = 1;
 var PROVEN = 2;
-function isRecursive(inst, stack, resolve5) {
+function isRecursive(inst, stack, resolve6) {
   const cached2 = recursive.get(inst);
   if (cached2 !== void 0)
     return cached2 ? PROVEN : NONE;
@@ -5166,7 +5166,7 @@ function isRecursive(inst, stack, resolve5) {
   let result = NONE;
   const check3 = (child) => {
     if (result !== PROVEN && child?._zod) {
-      const answer = isRecursive(child, stack, resolve5);
+      const answer = isRecursive(child, stack, resolve6);
       if (answer > result)
         result = answer;
     }
@@ -5177,7 +5177,7 @@ function isRecursive(inst, stack, resolve5) {
       const desc = Object.getOwnPropertyDescriptor(sh, key);
       if (spread && !desc.enumerable)
         continue;
-      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve5) : NONE;
+      const child = desc.get ? ASSUMED : desc.value?._zod ? isRecursive(desc.value, stack, resolve6) : NONE;
       if (child > answer)
         answer = child;
     }
@@ -5241,7 +5241,7 @@ function isRecursive(inst, stack, resolve5) {
       break;
     // `$ZodLazy` caches its inner on the def, so a resolved edge is followed exactly
     case "lazy": {
-      const inner = def._cachedInner ?? (resolve5 ? inst._zod.innerType : void 0);
+      const inner = def._cachedInner ?? (resolve6 ? inst._zod.innerType : void 0);
       merge2(inner ? isRecursive(inner, stack, false) : ASSUMED);
       break;
     }
@@ -19818,76 +19818,33 @@ var LIMITS = {
   maxThumbnailBytes: 2 * MB,
   maxHowItWasMadeBytes: 20 * 1024,
   maxApiTokensPerUser: 20,
-  maxTokenNameLength: 60
+  maxTokenNameLength: 60,
+  /** Characters in a comment (plain text, ARCHITECTURE §14). */
+  maxCommentLength: 1e3,
+  /** Characters in a report's details. */
+  maxReportDetailsLength: 1e3,
+  /** Bytes a creator's kept versions may take up in total, across all their games (S4). */
+  maxStorageBytesPerUser: 2 * 1024 * MB
 };
-var THUMBNAIL_EXTENSIONS = ["png", "jpg", "jpeg", "webp"];
-
-// ../shared/src/api.ts
-var PUBLISH_SOURCES = ["cli", "web", "github"];
-var startVersionRequestSchema = external_exports.object({
-  /** Raw `juicy.json`. Its `slug` must match the URL. */
-  manifest: external_exports.unknown(),
-  /** The build folder after `planUpload`. */
-  files: external_exports.array(external_exports.object({ path: external_exports.string().max(1024), size: external_exports.number() })).max(LIMITS.maxFiles * 4),
-  thumbnail: external_exports.object({ sha256: external_exports.string(), size: external_exports.number(), extension: external_exports.string() }).optional(),
-  /** Contents of the manifest's `howItWasMade` markdown file. */
-  howItWasMade: external_exports.string().optional(),
-  /** A note for the version history, e.g. what changed or a commit SHA. */
-  message: external_exports.string().trim().max(200).optional(),
-  source: external_exports.enum(PUBLISH_SOURCES).default("cli")
-});
-
-// ../shared/src/device.ts
-var DEVICE_LOGIN = {
-  /** How long a code can be approved. */
-  expiresInSeconds: 10 * 60,
-  /** Minimum seconds between polls; polling faster answers SLOW_DOWN. */
-  intervalSeconds: 5,
-  /** RFC 8628: after SLOW_DOWN, the client adds this many seconds to its interval. */
-  slowDownSeconds: 5,
-  maxClientNameLength: 60
-};
-var deviceCodeRequestSchema = external_exports.object({
-  /** Shown on the approval page and used as the token's name, e.g. "juicyjuicy CLI on Lukasz-PC". */
-  clientName: external_exports.string().trim().min(1).max(DEVICE_LOGIN.maxClientNameLength).optional()
-});
-var deviceTokenRequestSchema = external_exports.object({ deviceCode: external_exports.string().min(1).max(200) });
-
-// ../shared/src/errors.ts
-var ERROR_STATUS = {
-  UNAUTHORIZED: 401,
-  FORBIDDEN: 403,
-  NOT_FOUND: 404,
-  VALIDATION_FAILED: 400,
-  INVALID_MANIFEST: 400,
-  INVALID_PATH: 400,
-  TOO_LARGE: 413,
-  TOO_MANY_FILES: 413,
-  ENTRY_MISSING: 400,
-  SLUG_TAKEN: 409,
-  GAME_LIMIT_REACHED: 403,
-  UPLOAD_INCOMPLETE: 409,
-  VERSION_NOT_UPLOADING: 409,
-  NOT_REMIXABLE: 403,
-  RATE_LIMITED: 429,
-  // Device-code login polling (RFC 8628 semantics)
-  AUTHORIZATION_PENDING: 400,
-  SLOW_DOWN: 400,
-  EXPIRED_TOKEN: 400,
-  ACCESS_DENIED: 400,
-  INTERNAL_ERROR: 500
+var RATE_LIMITS = {
+  /** New accounts, site-wide. */
+  signUp: { limit: 30, windowSeconds: 60 * 60 },
+  /** Versions started (each publish starts one). */
+  publish: { limit: 30, windowSeconds: 60 * 60 },
+  /** Finalize calls, including retries. */
+  finalize: { limit: 60, windowSeconds: 60 * 60 },
+  comment: { limit: 10, windowSeconds: 10 * 60 },
+  /** Likes and unlikes. */
+  like: { limit: 60, windowSeconds: 10 * 60 },
+  report: { limit: 10, windowSeconds: 60 * 60 },
+  /** Play beacons; over the limit a play just isn't counted. */
+  play: { limit: 120, windowSeconds: 60 * 60 },
+  /** Connection reports per reporter (S6); over it reports are dropped. */
+  connectionReport: { limit: 60, windowSeconds: 60 * 60 },
+  /** AI reviews of a creator's versions per day (S5); over it a version isn't reviewed. */
+  review: { limit: 20, windowSeconds: 24 * 60 * 60 }
 };
-function isApiErrorBody(value) {
-  if (typeof value !== "object" || value === null || !("error" in value)) return false;
-  const { error: error62 } = value;
-  if (typeof error62 !== "object" || error62 === null) return false;
-  const { code } = error62;
-  return typeof code === "string" && code in ERROR_STATUS;
-}
-
-// ../shared/src/ids.ts
-var PUBLIC_ID_LENGTH = 10;
-var PUBLIC_ID_PATTERN = new RegExp(`^[a-z0-9]{${PUBLIC_ID_LENGTH}}$`);
+var THUMBNAIL_EXTENSIONS = ["png", "jpg", "jpeg", "webp"];
 
 // ../shared/src/paths.ts
 var IGNORED_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "__MACOSX"]);
@@ -19929,6 +19886,7 @@ function commonTopFolder(paths) {
   }
   return top;
 }
+var SHA256_PATTERN = /^[0-9a-f]{64}$/;
 function planUpload(entries, options = {}) {
   const normalized = entries.map((entry) => ({ ...entry, path: normalizePath(entry.path) }));
   const macJunk = normalized.filter((entry) => entry.path.startsWith("__MACOSX/"));
@@ -19945,7 +19903,7 @@ function planUpload(entries, options = {}) {
     const issue2 = validatePath(path2);
     if (issue2) plan.invalid.push({ path: path2, issue: issue2 });
     else if (isIgnoredPath(path2, options)) plan.ignored.push(path2);
-    else plan.files.push({ path: path2, size: entry.size });
+    else plan.files.push({ ...entry, path: path2 });
   }
   return plan;
 }
@@ -19961,32 +19919,108 @@ var relativePath = (what) => external_exports.string().transform(normalizePath).
   `${what} must be a relative path inside the project`
 );
 var tagSchema = external_exports.string().min(2).max(24).regex(/^[a-z0-9]+(-[a-z0-9]+)*$/, "tags are lowercase words, e.g. puzzle or tower-defense");
+var gameFieldSchemas = {
+  title: external_exports.string().trim().min(1).max(60),
+  description: external_exports.string().trim().max(500),
+  engine: external_exports.enum(ENGINES),
+  madeWith: external_exports.array(external_exports.string().trim().min(1).max(40)).max(5),
+  tags: external_exports.array(tagSchema).max(5),
+  input: external_exports.array(external_exports.enum(INPUTS)),
+  orientation: external_exports.enum(ORIENTATIONS),
+  aspectRatio: external_exports.string().regex(/^(fill|\d{1,2}:\d{1,2})$/, 'use "W:H" like "16:9", or "fill"'),
+  remixable: external_exports.boolean(),
+  sourceUrl: external_exports.url({ protocol: /^https$/ })
+};
 var manifestSchema = external_exports.strictObject({
   $schema: external_exports.string().optional(),
   slug: slugSchema,
-  title: external_exports.string().trim().min(1).max(60),
-  description: external_exports.string().trim().max(500).default(""),
+  title: gameFieldSchemas.title,
+  description: gameFieldSchemas.description.default(""),
   buildDir: external_exports.string().default(".").transform((dir) => normalizePath(dir).replace(/\/+$/, "") || ".").refine(
     (dir) => dir === "." || validatePath(dir) === null,
     "buildDir must be a folder inside the project"
   ),
   entry: relativePath("entry").refine((path2) => /\.html?$/i.test(path2), "entry must be an .html file").default("index.html"),
-  engine: external_exports.enum(ENGINES).default("other"),
-  madeWith: external_exports.array(external_exports.string().trim().min(1).max(40)).max(5).default([]),
-  tags: external_exports.array(tagSchema).max(5).default([]),
-  input: external_exports.array(external_exports.enum(INPUTS)).default([]),
-  orientation: external_exports.enum(ORIENTATIONS).default("any"),
-  aspectRatio: external_exports.string().regex(/^(fill|\d{1,2}:\d{1,2})$/, 'use "W:H" like "16:9", or "fill"').default("16:9"),
+  engine: gameFieldSchemas.engine.default("other"),
+  madeWith: gameFieldSchemas.madeWith.default([]),
+  tags: gameFieldSchemas.tags.default([]),
+  input: gameFieldSchemas.input.default([]),
+  orientation: gameFieldSchemas.orientation.default("any"),
+  aspectRatio: gameFieldSchemas.aspectRatio.default("16:9"),
   thumbnail: relativePath("thumbnail").refine(
     (path2) => THUMBNAIL_EXTENSIONS.some((ext) => path2.toLowerCase().endsWith(`.${ext}`)),
     `thumbnail must be one of: ${THUMBNAIL_EXTENSIONS.join(", ")}`
   ).optional(),
   howItWasMade: relativePath("howItWasMade").refine((path2) => path2.toLowerCase().endsWith(".md"), "howItWasMade must be a .md file").optional(),
-  remixable: external_exports.boolean().default(false),
-  sourceUrl: external_exports.url({ protocol: /^https$/ }).optional(),
+  remixable: gameFieldSchemas.remixable.default(false),
+  sourceUrl: gameFieldSchemas.sourceUrl.optional(),
   remixedFrom: slugSchema.nullable().optional()
 });
 var MANIFEST_SCHEMA_URL = "https://juicyjuicy.games/schema/juicy.json";
+function slugify2(name) {
+  const slug = name.normalize("NFKD").replace(/[̀-ͯ]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40).replace(/-+$/, "");
+  return slug.length >= 3 ? slug : `${slug || "my"}-game`;
+}
+function titleFromName(name) {
+  return name.split(/[-_\s]+/).filter(Boolean).map((word) => word[0]?.toUpperCase() + word.slice(1)).join(" ").slice(0, 60);
+}
+
+// ../shared/src/api.ts
+var PUBLISH_SOURCES = ["cli", "web", "github"];
+var startVersionRequestSchema = external_exports.object({
+  /** Raw `juicy.json`. Its `slug` must match the URL. */
+  manifest: external_exports.unknown(),
+  /** The build folder after `planUpload`. */
+  files: external_exports.array(
+    external_exports.object({
+      path: external_exports.string().max(1024),
+      size: external_exports.number(),
+      /** Hex SHA-256; R2 refuses an upload that doesn't match it (D15). Optional for older CLIs. */
+      sha256: external_exports.string().regex(SHA256_PATTERN, "sha256 must be 64 hex digits").optional()
+    })
+  ).max(LIMITS.maxFiles * 4),
+  thumbnail: external_exports.object({ sha256: external_exports.string(), size: external_exports.number(), extension: external_exports.string() }).optional(),
+  /** Contents of the manifest's `howItWasMade` markdown file. */
+  howItWasMade: external_exports.string().optional(),
+  /** A note for the version history, e.g. what changed or a commit SHA. */
+  message: external_exports.string().trim().max(200).optional(),
+  source: external_exports.enum(PUBLISH_SOURCES).default("cli")
+});
+var updateGameRequestSchema = external_exports.object({
+  slug: slugSchema.optional(),
+  status: external_exports.enum(["published", "unlisted"]).optional(),
+  title: gameFieldSchemas.title.optional(),
+  description: gameFieldSchemas.description.optional(),
+  engine: gameFieldSchemas.engine.optional(),
+  madeWith: gameFieldSchemas.madeWith.optional(),
+  tags: gameFieldSchemas.tags.optional(),
+  input: gameFieldSchemas.input.optional(),
+  orientation: gameFieldSchemas.orientation.optional(),
+  aspectRatio: gameFieldSchemas.aspectRatio.optional(),
+  remixable: gameFieldSchemas.remixable.optional(),
+  sourceUrl: gameFieldSchemas.sourceUrl.nullable().optional(),
+  /** Markdown, ≤ 20 KB. */
+  howItWasMade: external_exports.string().nullable().optional()
+});
+var rollbackRequestSchema = external_exports.object({ version: external_exports.number().int().positive() });
+var postCommentRequestSchema = external_exports.object({
+  body: external_exports.string().trim().min(1, "write something first").max(LIMITS.maxCommentLength, `comments are at most ${LIMITS.maxCommentLength} characters`)
+});
+var REPORT_REASONS = [
+  "broken",
+  "harmful",
+  "inappropriate",
+  "copyright",
+  "spam",
+  "other"
+];
+var reportGameRequestSchema = external_exports.object({
+  reason: external_exports.enum(REPORT_REASONS),
+  details: external_exports.string().trim().max(
+    LIMITS.maxReportDetailsLength,
+    `details are at most ${LIMITS.maxReportDetailsLength} characters`
+  ).optional()
+});
 
 // ../shared/src/tokens.ts
 var TOKEN_PREFIX = "jj_pat_";
@@ -20065,6 +20099,330 @@ function checkThumbnail(extension, size) {
   return null;
 }
 
+// ../shared/src/checks.ts
+var MAX_SCAN_BYTES = 20 * 1024 * 1024;
+var SCANNED_EXTENSIONS = /* @__PURE__ */ new Set(["html", "htm", "js", "mjs", "cjs", "css", "json"]);
+var EXECUTABLE_EXTENSIONS = [
+  "exe",
+  "dll",
+  "msi",
+  "msix",
+  "bat",
+  "cmd",
+  "com",
+  "scr",
+  "ps1",
+  "vbs",
+  "hta",
+  "sh",
+  "jar",
+  "apk",
+  "ipa",
+  "dmg",
+  "pkg",
+  "deb",
+  "rpm",
+  "appimage"
+];
+var KNOWN_LIBRARY_SHA256 = /* @__PURE__ */ new Set([
+  // Phaser 4.2.1 dist/phaser.min.js and dist/phaser.js, as copied from npm or a CDN.
+  "66348b1b5141e49b7d5ebbe688cddcb502eab1cb00f21c538686a5b2c5abe4de",
+  "eb1bef9b0b35cab1f95e00d14ba728a2b14e6ae1dd9ecfa3b60dc16ca04fa259"
+]);
+function extensionOf(path2) {
+  const name = path2.slice(path2.lastIndexOf("/") + 1);
+  const dot = name.lastIndexOf(".");
+  return dot > 0 ? name.slice(dot + 1).toLowerCase() : "";
+}
+function isScannedFile(path2) {
+  return SCANNED_EXTENSIONS.has(extensionOf(path2));
+}
+var LIMIT_RULES = {
+  TOO_MANY_FILES: "too-many-files",
+  TOO_LARGE: "too-large",
+  INVALID_PATH: "unsafe-path",
+  ENTRY_MISSING: "entry-missing",
+  VALIDATION_FAILED: "bad-file-size"
+};
+function checkGameFiles(files, entry) {
+  const findings = checkVersionFiles(files, entry).map((issue2) => ({
+    rule: LIMIT_RULES[issue2.code] ?? "limits",
+    severity: "error",
+    ...issue2
+  }));
+  for (const { path: path2 } of files) {
+    const extension = extensionOf(path2);
+    if (EXECUTABLE_EXTENSIONS.includes(extension)) {
+      findings.push({
+        rule: "executable",
+        severity: "error",
+        code: "UNSAFE_CONTENT",
+        message: `.${extension} files are programs or installers; games can't include them`,
+        path: path2
+      });
+    }
+  }
+  return findings;
+}
+var KEY_MESSAGE = (what) => (found) => `contains what looks like ${what} (${found}). Every player can read a game's files: remove it, and revoke the key`;
+var CONTENT_RULES = [
+  {
+    rule: "secret-key",
+    severity: "error",
+    pattern: /\bsk-ant-[a-z]+\d*-[A-Za-z0-9_-]{32,}/,
+    message: KEY_MESSAGE("an Anthropic API key")
+  },
+  {
+    rule: "secret-key",
+    severity: "error",
+    pattern: /\bsk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{32,}|\bsk-[A-Za-z0-9]{20}T3BlbkFJ[A-Za-z0-9]{20}\b/,
+    message: KEY_MESSAGE("an OpenAI API key")
+  },
+  {
+    rule: "secret-key",
+    severity: "error",
+    pattern: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/,
+    message: KEY_MESSAGE("an AWS access key")
+  },
+  {
+    rule: "secret-key",
+    severity: "error",
+    pattern: /\bgh[pousr]_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{60,}/,
+    message: KEY_MESSAGE("a GitHub token")
+  },
+  {
+    rule: "secret-key",
+    severity: "error",
+    pattern: /\b[rs]k_live_[A-Za-z0-9]{20,}/,
+    message: KEY_MESSAGE("a live Stripe secret key")
+  },
+  {
+    rule: "secret-key",
+    severity: "error",
+    pattern: new RegExp(`\\b${TOKEN_PREFIX}[0-9A-Za-z]{${TOKEN_SECRET_LENGTH}}\\b`),
+    message: KEY_MESSAGE("a JuicyJuicy API token")
+  },
+  {
+    // The key itself must follow: crypto libraries contain the bare header as a string.
+    rule: "secret-key",
+    severity: "error",
+    pattern: /-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----(?:\s|\\[rn])*[A-Za-z0-9+/]{40}/,
+    message: KEY_MESSAGE("a private key")
+  },
+  {
+    rule: "crypto-miner",
+    severity: "error",
+    pattern: /stratum\+(?:tcp|ssl|tls):\/\/|\bCoinHive\.(?:Anonymous|User|Token)\b|\bcoin-?hive\.com\b|\bauthedmine\.com\b|\bcrypto-loot\.(?:com|org)\b|\bCRLT\.Anonymous\b|\bcoinimp\.com\b|\bwebminepool\.com\b|\bminero\.cc\b|\bdeepMiner\.(?:Anonymous|Init)\b|\bcryptonight(?:_wasm|\.wasm)\b/,
+    message: (found) => `contains crypto-mining code (${found}). Mining in players' browsers isn't allowed`
+  },
+  {
+    rule: "google-api-key",
+    severity: "warning",
+    pattern: /\bAIza[0-9A-Za-z_-]{35}\b/,
+    message: (found) => `contains a Google API key (${found}). Firebase web keys are public by design, but make sure the project's security rules and the key's restrictions don't let players do more than the game needs`
+  },
+  {
+    rule: "threads",
+    severity: "warning",
+    pattern: /\bnew SharedArrayBuffer\b|\bAtomics\.wait\(/,
+    message: () => "uses SharedArrayBuffer or Atomics.wait, which need cross-origin isolation that JuicyJuicy doesn't offer. A threaded build won't start: export without threads"
+  },
+  {
+    rule: "popup",
+    severity: "warning",
+    pattern: /\bwindow\.open\(/,
+    message: () => "calls window.open; popups are blocked inside the game frame"
+  },
+  {
+    rule: "top-navigation",
+    severity: "warning",
+    pattern: /\btop\.location\b|\btarget\s*=\s*["']?_top\b/,
+    message: () => "tries to navigate the top page; the game frame doesn't allow that"
+  },
+  {
+    rule: "insecure-url",
+    severity: "warning",
+    pattern: /\b(?:src|href)\s*=\s*["']http:\/\/|\burl\(\s*["']?http:\/\/|\b(?:fetch|import)\(\s*["'`]http:\/\/|["'`]ws:\/\//,
+    message: (found) => `loads something over plain http or ws (${found}); browsers block that on an https page. Use https:// or wss://`
+  },
+  {
+    rule: "localhost-url",
+    severity: "warning",
+    pattern: /["'`(](?:https?|wss?):\/\/(?:localhost|127\.0\.0\.1)(?=[:/"'`)])/,
+    message: (found) => `points at localhost (${found}), which is the player's own computer, not your dev server`
+  },
+  {
+    rule: "password-input",
+    severity: "warning",
+    pattern: /\btype\s*=\s*["']?password\b|\.type\s*=\s*["']password["']/,
+    message: () => "has a password field. A game should never ask for a password: players can't tell a game's form from a phishing page"
+  }
+];
+function shorten(found, rule) {
+  const text2 = found.replace(/\s+/g, " ");
+  if (rule === "secret-key") return `${text2.slice(0, 10)}\u2026`;
+  return text2.length > 60 ? `${text2.slice(0, 57)}\u2026` : text2;
+}
+function checkFileContent(path2, text2) {
+  const extension = extensionOf(path2);
+  const findings = [];
+  const reported = /* @__PURE__ */ new Set();
+  for (const rule of CONTENT_RULES) {
+    if (rule.only && !rule.only.includes(extension)) continue;
+    const key = `${rule.rule}:${rule.pattern.source}`;
+    if (reported.has(key)) continue;
+    const match = rule.pattern.exec(text2);
+    if (!match) continue;
+    reported.add(key);
+    findings.push({
+      rule: rule.rule,
+      severity: rule.severity,
+      ...rule.severity === "error" ? { code: "UNSAFE_CONTENT" } : {},
+      message: rule.message(shorten(match[0], rule.rule)),
+      path: path2
+    });
+  }
+  return findings;
+}
+var SCRIPT_SRC = /<script\b[^>]*\bsrc\s*=\s*["']?(?:https?:)?\/\/([^/"'\s>]+)/gi;
+var DYNAMIC_IMPORT = /\bimport\(\s*["'`]https?:\/\/([^/"'`\s]+)/g;
+function scriptHostsIn(path2, text2) {
+  const hosts = /* @__PURE__ */ new Set();
+  const patterns = ["html", "htm"].includes(extensionOf(path2)) ? [SCRIPT_SRC, DYNAMIC_IMPORT] : [DYNAMIC_IMPORT];
+  for (const pattern of patterns) {
+    for (const match of text2.matchAll(pattern)) {
+      if (match[1]) hosts.add(match[1].toLowerCase());
+    }
+  }
+  return [...hosts];
+}
+async function checkGame({
+  files,
+  entry,
+  readText,
+  concurrency = 8
+}) {
+  const findings = checkGameFiles(files, entry);
+  const hosts = /* @__PURE__ */ new Set();
+  let budget = MAX_SCAN_BYTES;
+  let complete = true;
+  const toScan = [];
+  for (const file2 of files) {
+    if (!isScannedFile(file2.path)) continue;
+    if (file2.sha256 && KNOWN_LIBRARY_SHA256.has(file2.sha256)) continue;
+    if (file2.size > budget) {
+      complete = false;
+      continue;
+    }
+    budget -= file2.size;
+    toScan.push(file2);
+  }
+  const perFile = new Array(toScan.length);
+  let next = 0;
+  async function worker() {
+    while (next < toScan.length) {
+      const index = next++;
+      const { path: path2 } = toScan[index];
+      const text2 = await readText(path2);
+      if (text2 === null) {
+        perFile[index] = [];
+        continue;
+      }
+      perFile[index] = checkFileContent(path2, text2);
+      for (const host of scriptHostsIn(path2, text2)) hosts.add(host);
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, toScan.length) }, worker));
+  findings.push(...perFile.flat());
+  return { findings, scriptHosts: [...hosts].sort(), complete };
+}
+
+// ../shared/src/device.ts
+var DEVICE_LOGIN = {
+  /** How long a code can be approved. */
+  expiresInSeconds: 10 * 60,
+  /** Minimum seconds between polls; polling faster answers SLOW_DOWN. */
+  intervalSeconds: 5,
+  /** RFC 8628: after SLOW_DOWN, the client adds this many seconds to its interval. */
+  slowDownSeconds: 5,
+  maxClientNameLength: 60
+};
+var deviceCodeRequestSchema = external_exports.object({
+  /** Shown on the approval page and used as the token's name, e.g. "juicyjuicy CLI on Lukasz-PC". */
+  clientName: external_exports.string().trim().min(1).max(DEVICE_LOGIN.maxClientNameLength).optional()
+});
+var deviceTokenRequestSchema = external_exports.object({ deviceCode: external_exports.string().min(1).max(200) });
+
+// ../shared/src/errors.ts
+var ERROR_STATUS = {
+  UNAUTHORIZED: 401,
+  FORBIDDEN: 403,
+  NOT_FOUND: 404,
+  VALIDATION_FAILED: 400,
+  INVALID_MANIFEST: 400,
+  INVALID_PATH: 400,
+  TOO_LARGE: 413,
+  TOO_MANY_FILES: 413,
+  ENTRY_MISSING: 400,
+  SLUG_TAKEN: 409,
+  GAME_LIMIT_REACHED: 403,
+  UPLOAD_INCOMPLETE: 409,
+  VERSION_NOT_UPLOADING: 409,
+  NOT_REMIXABLE: 403,
+  /** A game check (SECURITY-PLAN S2) found something that can't be published: a key, a program, a miner. */
+  UNSAFE_CONTENT: 400,
+  RATE_LIMITED: 429,
+  /** An admin paused all publishing (PUBLISHING_PAUSED, the incident switch). Retry later. */
+  PUBLISHING_PAUSED: 503,
+  // Device-code login polling (RFC 8628 semantics)
+  AUTHORIZATION_PENDING: 400,
+  SLOW_DOWN: 400,
+  EXPIRED_TOKEN: 400,
+  ACCESS_DENIED: 400,
+  INTERNAL_ERROR: 500
+};
+function isApiErrorBody(value) {
+  if (typeof value !== "object" || value === null || !("error" in value)) return false;
+  const { error: error62 } = value;
+  if (typeof error62 !== "object" || error62 === null) return false;
+  const { code } = error62;
+  return typeof code === "string" && code in ERROR_STATUS;
+}
+
+// ../shared/src/ids.ts
+var PUBLIC_ID_LENGTH = 10;
+var PUBLIC_ID_PATTERN = new RegExp(`^[a-z0-9]{${PUBLIC_ID_LENGTH}}$`);
+
+// ../shared/src/license.ts
+var REMIX_LICENSE_NAME = "JuicyJuicy remix license";
+var REMIX_LICENSE = "Members may download this game's files and publish a changed version of it on JuicyJuicy, credited to the original. It doesn't allow publishing the game or a remix of it anywhere else, or passing the files on. Turning Remixable off stops new remix downloads; remixes already published stay up.";
+
+// ../shared/src/security-headers.ts
+var DENIED_FEATURES = [
+  "camera",
+  "microphone",
+  "geolocation",
+  "display-capture",
+  "payment",
+  "usb",
+  "serial",
+  "hid",
+  "bluetooth",
+  "midi",
+  "magnetometer",
+  "ambient-light-sensor",
+  "idle-detection",
+  "local-fonts",
+  "window-management",
+  "publickey-credentials-get",
+  "publickey-credentials-create",
+  "otp-credentials",
+  "identity-credentials-get",
+  "browsing-topics",
+  "attribution-reporting"
+];
+var PERMISSIONS_POLICY = DENIED_FEATURES.map((feature) => `${feature}=()`).join(", ");
+
 // ../../node_modules/.pnpm/commander@15.0.0/node_modules/commander/lib/error.js
 var CommanderError = class extends Error {
   /**
@@ -23436,7 +23794,7 @@ var program = new Command();
 // package.json
 var package_default = {
   name: "juicyjuicy",
-  version: "0.2.0",
+  version: "0.3.0",
   description: "Publish AI-made browser games to juicyjuicy.games",
   type: "module",
   license: "MIT",
@@ -23444,6 +23802,9 @@ var package_default = {
     "games",
     "publish",
     "claude",
+    "codex",
+    "copilot",
+    "agent-skills",
     "cli"
   ],
   homepage: "https://juicyjuicy.games/docs/publish",
@@ -24390,7 +24751,12 @@ ${i2}
 // src/output.ts
 var EXIT = { ok: 0, validation: 1, auth: 2, network: 3 };
 var AUTH_CODES = /* @__PURE__ */ new Set(["UNAUTHORIZED", "EXPIRED_TOKEN", "ACCESS_DENIED"]);
-var NETWORK_CODES = /* @__PURE__ */ new Set(["NETWORK_ERROR", "INTERNAL_ERROR", "RATE_LIMITED"]);
+var NETWORK_CODES = /* @__PURE__ */ new Set([
+  "NETWORK_ERROR",
+  "INTERNAL_ERROR",
+  "RATE_LIMITED",
+  "PUBLISHING_PAUSED"
+]);
 function exitCodeFor(code) {
   if (AUTH_CODES.has(code)) return EXIT.auth;
   if (NETWORK_CODES.has(code)) return EXIT.network;
@@ -24554,16 +24920,16 @@ function openBrowser(url2) {
     // Not `cmd /c start`: cmd would treat `&` in the URL as a command separator.
     ["rundll32", ["url.dll,FileProtocolHandler", url2]]
   ) : process.platform === "darwin" ? ["open", [url2]] : ["xdg-open", [url2]];
-  return new Promise((resolve5) => {
+  return new Promise((resolve6) => {
     try {
       const child = spawn(command2, args, { stdio: "ignore", detached: true });
-      child.once("error", () => resolve5(false));
+      child.once("error", () => resolve6(false));
       child.once("spawn", () => {
         child.unref();
-        resolve5(true);
+        resolve6(true);
       });
     } catch {
-      resolve5(false);
+      resolve6(false);
     }
   });
 }
@@ -24770,7 +25136,7 @@ async function loadManifest(dir) {
   const raw = await readRawManifest(dir);
   if (!raw) {
     throw new CliError("INVALID_MANIFEST", `There's no ${MANIFEST_FILE} in ${dir}.`, {
-      hint: "Run `npx juicyjuicy init` to create one. Claude: `npx -y juicyjuicy@latest setup` installs the JuicyJuicy skill, which has the whole publishing procedure."
+      hint: "Run `npx juicyjuicy init` to create one. AI agents: `npx -y juicyjuicy@latest setup` installs the JuicyJuicy skill, which has the whole publishing procedure."
     });
   }
   const parsed = manifestSchema.safeParse(raw);
@@ -24814,7 +25180,9 @@ async function checkProject(dir, options = {}) {
     thumbnail: null,
     howItWasMade: null,
     issues: [],
-    warnings: []
+    warnings: [],
+    findings: [],
+    scriptHosts: []
   };
   if (!(await stat(buildDir).catch(() => null))?.isDirectory()) {
     check3.issues.push({
@@ -24838,7 +25206,19 @@ async function checkProject(dir, options = {}) {
     }
     check3.files = plan.files;
     check3.totalBytes = plan.files.reduce((sum, file2) => sum + file2.size, 0);
-    check3.issues.push(...checkVersionFiles(plan.files, manifest.entry));
+    const result = await checkGame({
+      files: plan.files,
+      entry: manifest.entry,
+      readText: (path2) => readFile2(join3(buildDir, path2), "utf8").catch(() => null)
+    });
+    for (const { severity, code, ...finding } of result.findings) {
+      if (severity === "error") check3.issues.push({ code: code ?? "UNSAFE_CONTENT", ...finding });
+      else {
+        check3.findings.push({ severity, ...finding });
+        check3.warnings.push(`${finding.path ? `${finding.path}: ` : ""}${finding.message}`);
+      }
+    }
+    check3.scriptHosts = result.scriptHosts;
   }
   if (manifest.thumbnail) {
     const file2 = await projectFile(dir, manifest.thumbnail);
@@ -24894,6 +25274,19 @@ async function projectFile(dir, path2) {
 async function sha256File(absolute) {
   return createHash("sha256").update(await readFile2(absolute)).digest("hex");
 }
+async function hashFiles(dir, files, concurrency = 8) {
+  const hashed = new Array(files.length);
+  let next = 0;
+  async function worker() {
+    while (next < files.length) {
+      const index = next++;
+      const file2 = files[index];
+      hashed[index] = { ...file2, sha256: await sha256File(join3(dir, file2.path)) };
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, files.length) }, worker));
+  return hashed;
+}
 async function readPackageJson(dir) {
   try {
     return JSON.parse(await readFile2(join3(dir, "package.json"), "utf8"));
@@ -24980,13 +25373,6 @@ async function firstExisting(dir, names) {
   }
   return void 0;
 }
-function slugify2(name) {
-  const slug = name.normalize("NFKD").replace(/[̀-ͯ]/g, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40).replace(/-+$/, "");
-  return slug.length >= 3 ? slug : `${slug || "my"}-game`;
-}
-function titleFromName(name) {
-  return name.split(/[-_\s]+/).filter(Boolean).map((word) => word[0]?.toUpperCase() + word.slice(1)).join(" ").slice(0, 60);
-}
 
 // src/init.ts
 var KEY_ORDER = [
@@ -25080,6 +25466,7 @@ function splitList(value) {
 // src/commands/project.ts
 async function init(out, dir, flags) {
   const { path: path2, created, manifest } = await createManifest(out, resolve2(dir), flags);
+  if (manifest.remixable) out.info(`Remixable grants the ${REMIX_LICENSE_NAME}: ${REMIX_LICENSE}`);
   out.result(
     { path: path2, created, manifest },
     `${created ? "Created" : "Updated"} ${relative2(process.cwd(), path2) || path2}. Next: npx juicyjuicy check`
@@ -25112,7 +25499,9 @@ async function check2(out, dir, options) {
       totalBytes: result.totalBytes,
       thumbnail: result.thumbnail?.path ?? null,
       howItWasMade: result.howItWasMade?.path ?? null,
-      warnings: result.warnings
+      warnings: result.warnings,
+      findings: result.findings,
+      scriptHosts: result.scriptHosts
     },
     `${result.manifest.slug} is ready: ${result.files.length} files, ${formatBytes(result.totalBytes)}, entry ${result.manifest.entry}.`
   );
@@ -25166,6 +25555,11 @@ async function uploadFiles(tasks, options = {}) {
         const response = await fetchImpl(task.url, { method: "PUT", body, headers: task.headers });
         if (response.ok) return;
         failure2 = `storage answered ${response.status}`;
+        if (response.status === 400 && (await response.text()).includes("BadDigest")) {
+          throw new CliError("UPLOAD_INCOMPLETE", `${task.path} changed while publishing.`, {
+            hint: "Wait for your build to finish, then publish again."
+          });
+        }
         if (!RETRYABLE_STATUS.has(response.status)) {
           throw new CliError("UPLOAD_INCOMPLETE", `Uploading ${task.path} failed: ${failure2}.`, {
             hint: response.status === 403 ? "The upload link may have expired (they last an hour). Publish again." : void 0
@@ -25220,7 +25614,7 @@ async function publish(out, dir, options) {
   const { thumbnail, howItWasMade } = checked;
   const request = {
     manifest: checked.rawManifest,
-    files: checked.files,
+    files: await hashFiles(checked.buildDir, checked.files),
     thumbnail: thumbnail ? {
       sha256: await sha256File(thumbnail.absolute),
       size: thumbnail.size,
@@ -25316,47 +25710,283 @@ async function open2(out, slug, options) {
   out.result({ url: url2, opened }, opened ? `Opened ${url2}` : url2);
 }
 
+// src/commands/remix.ts
+import { readdir as readdir2 } from "fs/promises";
+import { join as join6, relative as relative4, resolve as resolve4 } from "path";
+
+// src/download.ts
+import { createHash as createHash2 } from "crypto";
+import { mkdir as mkdir2, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname2 } from "path";
+import { setTimeout as sleep3 } from "timers/promises";
+var RETRYABLE_STATUS2 = /* @__PURE__ */ new Set([408, 429, 500, 502, 503, 504]);
+async function downloadFiles(tasks, options = {}) {
+  const {
+    concurrency = 6,
+    retries = 3,
+    backoffMs = (attempt) => 500 * 2 ** (attempt - 1),
+    fetchImpl = fetch,
+    onProgress
+  } = options;
+  const progress = {
+    files: 0,
+    totalFiles: tasks.length,
+    bytes: 0,
+    totalBytes: tasks.reduce((sum, task) => sum + task.size, 0)
+  };
+  async function fetchOne(task) {
+    for (let attempt = 0; ; attempt++) {
+      if (attempt > 0) await sleep3(backoffMs(attempt));
+      let failure2;
+      try {
+        const response = await fetchImpl(task.url);
+        if (response.ok) return new Uint8Array(await response.arrayBuffer());
+        failure2 = `storage answered ${response.status}`;
+        if (!RETRYABLE_STATUS2.has(response.status)) {
+          throw new CliError("NETWORK_ERROR", `Downloading ${task.path} failed: ${failure2}.`, {
+            hint: response.status === 403 ? "The download links may have expired (they last an hour). Run remix again." : void 0
+          });
+        }
+      } catch (error62) {
+        if (error62 instanceof CliError) throw error62;
+        failure2 = error62 instanceof Error ? error62.message : String(error62);
+      }
+      if (attempt >= retries) {
+        throw new CliError(
+          "NETWORK_ERROR",
+          `Downloading ${task.path} failed after ${retries + 1} tries: ${failure2}.`
+        );
+      }
+    }
+  }
+  async function downloadOne(task) {
+    const bytes = await fetchOne(task);
+    const sha256 = createHash2("sha256").update(bytes).digest("hex");
+    if (bytes.length !== task.size || task.sha256 && sha256 !== task.sha256) {
+      throw new CliError(
+        "UPLOAD_INCOMPLETE",
+        `${task.path} isn't the file that was published (its size or SHA-256 differs).`,
+        { hint: "Run remix again; if it keeps happening, tell an admin." }
+      );
+    }
+    await mkdir2(dirname2(task.absolute), { recursive: true });
+    await writeFile3(task.absolute, bytes);
+    progress.files++;
+    progress.bytes += task.size;
+    onProgress?.({ ...progress });
+  }
+  let next = 0;
+  async function worker() {
+    while (next < tasks.length) {
+      await downloadOne(tasks[next++]);
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, tasks.length) }, worker));
+}
+
+// src/commands/remix.ts
+async function remix(out, original, dir, options) {
+  const server = apiUrl();
+  const auth = await ensureLogin(out, server);
+  const api = new ApiClient(server, auth.token);
+  const source = await api.get(`/games/${encodeURIComponent(original)}/remix`);
+  const { game, license } = source;
+  out.event("license", { ...license });
+  out.info(`${license.name}: ${license.text}`);
+  const slug = await chooseSlug(out, game.slug, options.slug);
+  const root = resolve4(dir ?? slug);
+  await ensureEmptyFolder(root);
+  const downloads = [...source.files, ...source.thumbnail ? [source.thumbnail] : []];
+  for (const file2 of downloads) {
+    const issue2 = validatePath(file2.path);
+    if (issue2) throw new CliError("INVALID_PATH", `The server sent a bad path: ${file2.path}`);
+  }
+  const totalBytes = downloads.reduce((sum, file2) => sum + file2.size, 0);
+  const bar = out.interactive ? spinner() : null;
+  bar?.start(`Downloading ${downloads.length} files (${formatBytes(totalBytes)})`);
+  let lastEvent = 0;
+  try {
+    await downloadFiles(
+      downloads.map((file2) => ({ ...file2, absolute: join6(root, file2.path) })),
+      {
+        onProgress: (progress) => {
+          bar?.message(
+            `Downloading ${progress.files}/${progress.totalFiles} files (${formatBytes(progress.bytes)} of ${formatBytes(progress.totalBytes)})`
+          );
+          const now = Date.now();
+          if (now - lastEvent > 500 || progress.files === progress.totalFiles) {
+            lastEvent = now;
+            out.event("download_progress", { ...progress });
+          }
+        }
+      }
+    );
+  } catch (error62) {
+    bar?.error("Download failed");
+    throw error62;
+  }
+  bar?.stop(`Downloaded ${downloads.length} files (${formatBytes(totalBytes)})`);
+  const manifest = remixManifest(source, slug);
+  await writeManifest(root, manifest);
+  const shown = relative4(process.cwd(), root) || ".";
+  const next = [
+    `Work in ${root}. If the user hasn't said what to change, ask them.`,
+    "After each change, ask the user whether to change something else or publish it to JuicyJuicy.",
+    `Before publishing, give it its own "title" in juicy.json (just the remix's name, e.g. "Goose Custom Skins": its page and tile already say Remix of "${game.title}") and a new "description", then run npx juicyjuicy publish.`,
+    "After publishing, give the user the link and ask again: change something else (publishing again makes a new version) or stop."
+  ].join(" ");
+  out.result(
+    {
+      dir: root,
+      slug,
+      remixedFrom: game.slug,
+      title: manifest.title,
+      files: downloads.length,
+      sourceUrl: game.sourceUrl,
+      license,
+      next
+    },
+    [
+      `Remixed ${game.title} by @${game.owner} into ${shown}/ as "${slug}".`,
+      `Open ${shown} in your AI agent and describe your changes. Before publishing, give it its own title in juicy.json (it's shown as Remix of "${game.title}").`,
+      "Then publish with: npx juicyjuicy publish",
+      ...game.sourceUrl ? [
+        `These are the built files. The original's source code is public: git clone ${game.sourceUrl}`
+      ] : [],
+      "Remixes are published on JuicyJuicy only (see the license above)."
+    ].join("\n")
+  );
+}
+function remixManifest(source, slug) {
+  const { sourceUrl: _theirs, ...metadata } = source.manifest;
+  const manifest = {
+    $schema: MANIFEST_SCHEMA_URL,
+    slug,
+    ...metadata,
+    // The original's title until the remixer names theirs; the "Remix of" badge shows the lineage.
+    title: source.game.title,
+    remixable: false,
+    remixedFrom: source.game.slug
+  };
+  const parsed = manifestSchema.safeParse(manifest);
+  if (!parsed.success) {
+    throw new CliError("INVALID_MANIFEST", "The remix's juicy.json came out invalid.", {
+      details: parsed.error.issues.map((issue2) => ({
+        path: issue2.path.join("."),
+        message: issue2.message
+      }))
+    });
+  }
+  return manifest;
+}
+async function chooseSlug(out, original, given) {
+  const fallback = defaultRemixSlug(original);
+  const check3 = (value) => {
+    const result = slugSchema.safeParse(value);
+    if (!result.success) return result.error.issues[0]?.message ?? "not a valid slug";
+    if (value === original) return "pick a new slug: this one belongs to the original";
+    return void 0;
+  };
+  if (given !== void 0) {
+    const issue2 = check3(given);
+    if (issue2) throw new CliError("VALIDATION_FAILED", `--slug ${given}: ${issue2}`);
+    return given;
+  }
+  if (!out.interactive) return fallback;
+  const answer = await text({
+    message: "Slug for your remix (its URL name)",
+    initialValue: fallback,
+    validate: (value) => check3(value ?? "")
+  });
+  if (isCancel(answer)) throw new CliError("VALIDATION_FAILED", "Cancelled.");
+  return answer;
+}
+function defaultRemixSlug(original) {
+  return `${original.slice(0, 40 - "-remix".length).replace(/-+$/, "")}-remix`;
+}
+async function ensureEmptyFolder(root) {
+  const entries = await readdir2(root).catch((error62) => {
+    if (error62.code === "ENOENT") return [];
+    throw error62;
+  });
+  if (entries.length > 0) {
+    throw new CliError("VALIDATION_FAILED", `${root} isn't empty.`, {
+      hint: "Pick a new folder: npx juicyjuicy remix <slug> <new-folder>"
+    });
+  }
+}
+
 // src/commands/setup.ts
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 
 // src/commands/skill.ts
 import { existsSync as existsSync2 } from "fs";
 import { cp, rm as rm2 } from "fs/promises";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join6, resolve as resolve4 } from "path";
+import { dirname as dirname3, join as join7, resolve as resolve5 } from "path";
 import { fileURLToPath } from "url";
 var SKILL_NAME = "juicyjuicy-publish";
 function skillSourceDir() {
-  const here = dirname2(fileURLToPath(import.meta.url));
-  const candidates = [join6(here, "skill"), resolve4(here, "../../../skill/skills", SKILL_NAME)];
-  const found = candidates.find((dir) => existsSync2(join6(dir, "SKILL.md")));
+  const here = dirname3(fileURLToPath(import.meta.url));
+  const candidates = [join7(here, "skill"), resolve5(here, "../../../skill/skills", SKILL_NAME)];
+  const found = candidates.find((dir) => existsSync2(join7(dir, "SKILL.md")));
   if (!found)
     throw new CliError("INTERNAL_ERROR", "This copy of the CLI doesn't include the skill.");
   return found;
 }
-function defaultSkillTarget(env = process.env) {
-  return join6(env.CLAUDE_CONFIG_DIR?.trim() || join6(homedir2(), ".claude"), "skills", SKILL_NAME);
+function skillTargets(env = process.env, home = homedir2()) {
+  const claude = env.CLAUDE_CONFIG_DIR?.trim() || join7(home, ".claude");
+  const gemini = join7(home, ".gemini");
+  const shared = {
+    agents: "Codex, GitHub Copilot, Cursor, Gemini CLI, Antigravity and other agents",
+    dir: join7(home, ".agents", "skills")
+  };
+  const own2 = [
+    { agents: "Claude Code", home: claude, running: env.CLAUDECODE === "1" },
+    { agents: "Antigravity CLI", home: join7(gemini, "antigravity-cli"), running: false },
+    { agents: "Antigravity (older versions)", home: join7(gemini, "antigravity"), running: false }
+  ].filter((agent) => agent.running || existsSync2(agent.home)).map((agent) => ({
+    agents: agent.agents,
+    dir: join7(agent.home, "skills"),
+    running: agent.running
+  }));
+  const running = own2.filter((target) => target.running);
+  const rest = own2.filter((target) => !target.running);
+  return [...running, shared, ...rest].map(({ agents, dir }) => ({ agents, dir }));
 }
 async function installSkill(out, options) {
-  const { path: path2, updated } = await copySkill(options);
+  const skill = await copySkill(options);
   out.result(
-    { path: path2, updated },
-    `${updated ? "Updated" : "Installed"} the ${SKILL_NAME} skill in ${path2}. In Claude Code, say "publish this game to JuicyJuicy".`
+    skill,
+    `${skill.updated ? "Updated" : "Installed"} the ${SKILL_NAME} skill ${describeInstalls(skill.installed)}. Ask your AI agent to "publish this game to JuicyJuicy".`
   );
 }
 async function copySkill(options) {
-  const path2 = options.dir ? resolve4(options.dir, SKILL_NAME) : defaultSkillTarget();
-  const updated = existsSync2(path2);
-  await rm2(path2, { recursive: true, force: true });
-  await cp(skillSourceDir(), path2, { recursive: true });
-  return { path: path2, updated };
+  const targets = options.dir ? [{ agents: "", dir: resolve5(options.dir) }] : skillTargets();
+  const installed = [];
+  for (const target of targets) {
+    const path2 = join7(target.dir, SKILL_NAME);
+    const updated = existsSync2(path2);
+    await rm2(path2, { recursive: true, force: true });
+    await cp(skillSourceDir(), path2, { recursive: true });
+    installed.push({ path: path2, agents: target.agents, updated });
+  }
+  const [first] = installed;
+  return { path: first.path, updated: first.updated, installed };
+}
+function describeInstalls(installed) {
+  if (installed.length === 1 && !installed[0]?.agents) return `in ${installed[0]?.path}`;
+  const parts = installed.map(({ path: path2, agents }) => `${agents} (${path2})`);
+  return `for ${parts.length > 1 ? `${parts.slice(0, -1).join(", ")} and ${parts.at(-1)}` : parts[0]}`;
 }
 
 // src/commands/setup.ts
 async function setup(out, options) {
   const skill = await copySkill(options);
   out.event("skill_installed", skill);
-  out.success(`${skill.updated ? "Updated" : "Installed"} the Claude skill in ${skill.path}`);
+  out.success(
+    `${skill.updated ? "Updated" : "Installed"} the JuicyJuicy skill ${describeInstalls(skill.installed)}`
+  );
   const server = apiUrl();
   let user = await currentUser(server);
   if (user) out.success(`Already logged in as @${user.username}`);
@@ -25367,9 +25997,9 @@ async function setup(out, options) {
       user,
       apiUrl: server,
       skill,
-      next: `Read ${join7(skill.path, "SKILL.md")} and follow it to publish the game.`
+      next: `Read ${join8(skill.path, "SKILL.md")} and follow it to publish the game.`
     },
-    `All set, @${user.username}. Open Claude Code in your game's folder and say "${prompt}". (If Claude doesn't know the ${SKILL_NAME} skill yet, start a new session.)`
+    `All set, @${user.username}. Open your AI agent in your game's folder and say "${prompt}". (If it doesn't know the ${SKILL_NAME} skill yet, start a new session.)`
   );
 }
 async function currentUser(server) {
@@ -25390,7 +26020,7 @@ function createProgram() {
     "after",
     "\nEnvironment:\n  JUICY_TOKEN    token to use instead of the saved login (CI)\n  JUICY_API_URL  server to talk to (default https://juicyjuicy.games)"
   );
-  command(program2, "setup", "Set up once: install the Claude skill and log in").option("--dir <dir>", "install the skill into this skills folder, e.g. .claude/skills").option("--no-browser", "don't open the browser, just print the link").action(run((out, options) => setup(out, options)));
+  command(program2, "setup", "Set up once: install the skill for your AI agents and log in").option("--dir <dir>", "install the skill into only this skills folder, e.g. .agents/skills").option("--no-browser", "don't open the browser, just print the link").action(run((out, options) => setup(out, options)));
   command(program2, "login", "Log in through your browser (device code) and save a token").option("--no-browser", "don't open the browser, just print the link").action(run((out, options) => login(out, options)));
   command(program2, "whoami", "Show who you're logged in as").action(run((out) => whoami(out)));
   command(program2, "logout", "Forget and revoke the saved token").action(run((out) => logout(out)));
@@ -25398,7 +26028,11 @@ function createProgram() {
     "--made-with <list>",
     'models and tools, e.g. "Claude Opus 5.5, Claude Code"',
     splitList
-  ).option("--tags <list>", "up to 5 tags, e.g. arcade,space", splitList).addOption(new Option("--input <list>", `controls: ${INPUTS.join(", ")}`).argParser(splitList)).addOption(new Option("--orientation <orientation>").choices(ORIENTATIONS)).option("--aspect-ratio <ratio>", 'like 16:9, or "fill"').option("--thumbnail <file>", "png/jpg/webp in the game folder").option("--remixable", "let others remix it").option("--source-url <url>", "public source code, e.g. a GitHub repo").action(run((out, options, dir) => init(out, dir, options)));
+  ).option("--tags <list>", "up to 5 tags, e.g. arcade,space", splitList).addOption(new Option("--input <list>", `controls: ${INPUTS.join(", ")}`).argParser(splitList)).addOption(new Option("--orientation <orientation>").choices(ORIENTATIONS)).option("--aspect-ratio <ratio>", 'like 16:9, or "fill"').option("--thumbnail <file>", "png/jpg/webp in the game folder").option("--remixable", `let other members remix it on JuicyJuicy only (${REMIX_LICENSE_NAME})`).option("--source-url <url>", "public source code, e.g. a GitHub repo").addHelpText(
+    "after",
+    `
+${REMIX_LICENSE_NAME} (--remixable): ${REMIX_LICENSE}`
+  ).action(run((out, options, dir) => init(out, dir, options)));
   command(program2, "check", "Check juicy.json and the build folder without uploading").argument("[dir]", "game folder", ".").option("--include-source-maps", "upload *.map files too").action(
     run((out, options, dir) => check2(out, dir, options))
   );
@@ -25415,8 +26049,17 @@ function createProgram() {
       (out, options, slug) => open2(out, slug, options)
     )
   );
-  const skill = program2.command("skill").description("Manage the Claude skill");
-  command(skill, "install", "Install the JuicyJuicy skill for Claude (~/.claude/skills)").option("--dir <dir>", "install into this skills folder instead, e.g. .claude/skills").action(run((out, options) => installSkill(out, options)));
+  command(
+    program2,
+    "remix",
+    "Download a remixable game into a new folder to change it and publish it on JuicyJuicy"
+  ).argument("<slug>", "the game to remix, e.g. space-goose").argument("[dir]", "new folder (default: the remix's slug)").option("--slug <slug>", "your remix's slug (default: <slug>-remix)").action(
+    run(
+      (out, options, slug, dir) => remix(out, slug, dir, options)
+    )
+  );
+  const skill = program2.command("skill").description("Manage the JuicyJuicy skill for AI agents");
+  command(skill, "install", "Install the JuicyJuicy skill for the AI agents on this machine").option("--dir <dir>", "install into only this skills folder, e.g. .agents/skills").action(run((out, options) => installSkill(out, options)));
   return program2;
 }
 function command(parent, name, description) {