From e700a5804483eb0b9b05f2bc23cd067c40f30fdd Mon Sep 17 00:00:00 2001 From: bluedotiya <75704012+ChefControl@users.noreply.github.com> Date: Wed, 28 Oct 2026 02:41:50 +0200 Subject: [PATCH 1/3] Legal checks as repo skills: legals-update runs privacy, Steam and licence checks side by side Four skills under .claude/skills/. legals-privacy compares a feature with the privacy notice (public/privacy.html), its short version in Settings and the report dialog's "What's sent" list. legals-steam compares it with the content survey answers and store texts agreed on #151 and the prep page. legals-licenses checks every new package and asset's licence and its credit under Credits & Copyrights, and flags recordings for a listen. legals-update pins one target and runs the three at once in subagents, then puts their reports together. Each reports and proposes; none edits unless the owner asks. CLAUDE.md points to it. Co-Authored-By: Claude Opus 5.5 --- .claude/skills/legals-licenses/SKILL.md | 83 +++++++++++++++++++++++++ .claude/skills/legals-privacy/SKILL.md | 75 ++++++++++++++++++++++ .claude/skills/legals-steam/SKILL.md | 77 +++++++++++++++++++++++ .claude/skills/legals-update/SKILL.md | 68 ++++++++++++++++++++ CLAUDE.md | 4 ++ 5 files changed, 307 insertions(+) create mode 100644 .claude/skills/legals-licenses/SKILL.md create mode 100644 .claude/skills/legals-privacy/SKILL.md create mode 100644 .claude/skills/legals-steam/SKILL.md create mode 100644 .claude/skills/legals-update/SKILL.md diff --git a/.claude/skills/legals-licenses/SKILL.md b/.claude/skills/legals-licenses/SKILL.md new file mode 100644 index 0000000..3bfd42d --- /dev/null +++ b/.claude/skills/legals-licenses/SKILL.md @@ -0,0 +1,83 @@ +--- +name: legals-licenses +description: Use to check that everything a Floe Market feature (the current branch against main, or a named PR or branch) brings in may ship in a paid, closed Steam game, and is credited. Covers npm packages (GPL, LGPL, AGPL and other copyleft), fonts, emoji and icons, sounds, music and recordings (copyrighted songs hiding in them), images, textures and 3D models, real people's likenesses, brands and logos, and Settings → Credits & Copyrights. Triggers on "licence check", "license check", "can we use this", "is this credited", "legals-licenses", and is one of the three checks /legals-update runs. +--- + +# Licence check + +Goes through every new or changed asset and dependency in a feature and says, for each, whether its licence allows +commercial use and redistribution and whether the game credits it. + +**It reports and proposes. It doesn't edit the credits, remove assets or change packages unless the owner asks.** +Never commit Valve's Steamworks SDK; if the feature adds any of its files, that's a "can't use". + +## 1. The feature + +Work out what to read, in this order: +- A PR number: `gh pr view --json state,files,mergeCommit` and `gh pr diff `. For a merged PR, `git show `. +- A branch: `git diff main...`. +- Nothing named: the current branch, `git diff main...HEAD` plus `git diff HEAD` for what isn't committed. + +List what it brings in: `package.json` and `package-lock.json` changes, and any added or replaced file under +`public/`, `src/sounds/`, `src/` (imported media), `scripts/fonts/` and `scripts/icons/`. Code the game draws or +synthesises itself (three.js scenes, `src/icons/*.ts`, the music in `src/audio.ts`) is the game's own: check only that +it doesn't copy someone else's (a real tune's melody, a real logo). + +## 2. The sources of truth + +- **npm packages**: `scripts/licences.ts` and the `licences()` plugin in `vite.config.ts`, from PR #209 (#149). The + build lists the packages it actually bundles (dev tools never ship; the Steam build leaves Firebase out), writes + `dist/licences.txt` and fills the `` list under + **Open-source licences** in `#creditsCard`. It stops on GPL, LGPL, AGPL or a licence it can't read, unless the package + is in `APPROVED`; `PERMISSIVE` lists what passes. Tests: `test/licences.test.ts`. If `gh pr view 209 --json state` + isn't `MERGED`, read them from its branch: `git show origin/claude/licences-list-149-5b7b29:scripts/licences.ts`. +- **Fonts**: `public/fonts/*.woff2`, each with its licence beside it (`OFL-*.txt`), built from pinned upstream files by + `scripts/fonts/build.py`; credited under **Fonts** in `#creditsCard`. From PR #210 (#148). +- **Emoji and icons**: every emoji is the game's own drawing (`src/icons.ts`, `src/icons/*.ts`, built into Floe Emoji, + `public/fonts/emoji.woff2`). `test/fonts.test.ts` fails on an emoji with no drawing. An emoji or icon from another set + (Noto, Twemoji, Apple, Font Awesome) is a finding. From PR #210. +- **Recordings**: `src/sounds/*.mp3` (the casino yacht), credited in `#creditsCard` under **The casino yacht's room + sound** and in docs/game.md's **Sound credits**; `public/sounds/*.mp3` (the ring's crowd), credited in + `public/sounds/CREDITS.md` and under **The ring's crowd**. +- **Credits & Copyrights**: `#creditsCard` in `index.html` (Settings → ©). `test/ui.test.ts` ("ends with Credits & + Copyrights…") checks its contents, so a credit change changes the test too. + +## 3. The rules + +- **Packages.** Find each new package's licence (`node -p "require('./node_modules//package.json').license"`, or + `npm view @ license`), and its new dependencies' too (`package-lock.json`). Permissive (MIT, ISC, BSD, + Apache-2.0, Zlib, CC0, Unlicense…) is OK and the build credits it. GPL, LGPL, AGPL, MPL, EUPL, SSPL, "non-commercial" + or none is "can't use": Steam needs Valve's agreement for GPL and LGPL, and the game is closed. A dev-only tool is fine + unless what it makes ships under its licence. +- **Fonts.** OFL 1.1 or Apache-2.0, its licence text shipped beside it in `public/fonts`, and a line under **Fonts**. + Not "free for personal use". +- **Sounds and music.** CC0 is OK. CC BY is OK with a credit (title, author, licence link, what was changed). CC BY-NC, + CC BY-ND (the game cuts and loops), "personal use", unknown, YouTube or a ripped track: can't use. Freesound, + BigSoundBank and OpenGameArt pages show the licence; quote the URL. +- **Copyrighted music hiding in a recording** is the known risk: it happened twice, in the ring crowd's murmur and swell + (replaced October 2026, `public/sounds/CREDITS.md`) and in the casino's `slots.mp3`, which had "Blijf Bij Mij" by + Volumia! (replaced in PR #212, #147). Every new or changed recording of people, a room, a crowd, a bar or a casino + gets flagged for the owner's listen and a music-recognition scan (10 s windows, as on #147), unless that's already been + done and posted. Say which file and how long. +- **Images, textures, models.** Anything not drawn by the game's code needs its source and licence. Gemini or other AI + mockups never ship. Store art and screenshots come from the game's own engine. +- **People, brands, songs.** No real person's name or likeness, no real logo or brand, no real song's melody or lyrics + (the rain crooner stays unnamed for this reason). + +## 4. Report + +One line per thing brought in, each with one of three verdicts: + +``` +## Licences: no change | N updates +Target: > +- OK: (, ), credited under
| credited by the build +- Missing credit: (, ). Add to index.html #creditsCard,
: + "
  • …
    • " (and docs/game.md / public/sounds/CREDITS.md where the others are) +- Can't use: : . Replace with: +- Needs a listen: (): a recording of , not yet checked for music +Checked: +``` + +A feature that brings in nothing new (code only, drawn or synthesised by the game) is "no change". Match the existing +credit lines' wording: title in quotes, author, linked licence, then what was changed ("trimmed, levelled and made mono"). diff --git a/.claude/skills/legals-privacy/SKILL.md b/.claude/skills/legals-privacy/SKILL.md new file mode 100644 index 0000000..b168b87 --- /dev/null +++ b/.claude/skills/legals-privacy/SKILL.md @@ -0,0 +1,75 @@ +--- +name: legals-privacy +description: Use to check whether a Floe Market feature (the current branch against main, or a named PR or branch) changes what the game collects, stores, shares or shows about players, and so needs the privacy notice updated. Covers Firestore writes and rules, Google sign-in, scoreboards and the wall of shame, names shown to others, reports and their screenshots, local saves and localStorage, requests to other sites, analytics, and the Steam build's Steam IDs, Cloud and leaderboards. Triggers on "privacy check", "does this need the privacy notice", "legals-privacy", and is one of the three checks /legals-update runs. +--- + +# Privacy check + +Compares what a feature does with players' data against the privacy notice, and lists the exact edits the notice needs, +or says "no change". + +**It reports and proposes. It doesn't edit the notice, the short version or any other file unless the owner asks.** The +notice is the owner's text: every change needs their OK (docs/game.md, "Privacy notice"). + +## 1. The feature + +Work out what to read, in this order: +- A PR number: `gh pr view --json state,files,mergeCommit` and `gh pr diff `. For a merged PR, `git show `. +- A branch: `git diff main...`. +- Nothing named: the current branch, `git diff main...HEAD` plus `git diff HEAD` for what isn't committed. + +Read the changed files whole where the diff touches data, not just the hunks. + +## 2. Where the notice lives + +- **`public/privacy.html`**, the full notice, on the site at `/privacy.html`. Its parts: *The short version* (the + `.short` list), *Who I am*, *The web game* (*If you don't sign in*, *If you sign in with Google*, *Reports*, *Links to + other sites*), *The Steam version*, *Why I'm allowed to use it*, *Who else handles it*, *Your rights*, *Children*, + *Changes to this notice*. The `

    ` line carries **Last changed**. Added by PR #211 (#150). +- **The short version in Settings**: About → 🛡️ Privacy opens `#privacyCard` in `index.html`, with **Read the full notice** + (`#privacyFull`) opening the page in `#privacyDialog` (wired in `src/settings.ts`). Its list must match the notice's + `.short` list word for word; `test/ui.test.ts` ("opens Privacy into the notice's short version…") checks it. This came + in PR #214 (#213). If `gh pr view 214 --json state` isn't `MERGED`, main still has the older `` link + row: read #214's version with `gh pr diff 214`. +- **The report dialog's "What's sent" list**: `#reportWhat` in `index.html`, its kept-for line filled in by + `src/report.ts`. It's a privacy notice too, so it has to agree with the notice's *Reports* part. +- **docs/game.md**: *Privacy notice* (the rules above) and *Reports* (every Firestore collection and the intake's 30 days). + +The web build keeps Firebase and Google sign-in. The Steam build stands alone: no Firebase, no Google, no Ko-fi +(`src/flags.ts`, `src/kofi.ts`; epic #142, issues #160, #170, #172). The notice covers both, in their own parts, so say +which version each finding is about. + +## 3. What to look for + +Search the feature's changed files (and anything new they call) for: + +| Touches | Look in | Notice part | +| --- | --- | --- | +| Firestore: a new collection, a new field, a longer keep, a delete | `src/firebase.ts`, `src/cloud.ts`, `firestore.rules` (`saves/`, `scores/`, `shame/`, `reports/`, `limits/`, `config/`); `setDoc`, `updateDoc`, `addDoc`, `writeBatch`, `deleteDoc` | If you sign in with Google; Your rights | +| Sign-in, the account, what's read from Google | `src/firebase.ts`, `src/cloud.ts` | If you sign in with Google | +| A name or anything else other players see | `src/publicName.ts` ("Pat S.", from PR #214), scoreboards in `src/cloud.ts`, `src/wallOfShame.ts`, `src/worstBet.ts` | The short version; If you sign in | +| Reports: what goes, the picture, the save, how long | `src/report.ts`, `intake/` (private repo `ChefControl/floe-market-reports`) | Reports; `#reportWhat` | +| What stays on the device | `localStorage`, `sessionStorage`, IndexedDB, cookies (`src/save.ts`, `src/settings.ts`, `src/flags.ts` and others: `grep -rn localStorage src`) | If you don't sign in; The Steam version | +| A request to another site | `fetch(`, `XMLHttpRequest`, `new WebSocket`, `