# Browser terminal third-party components

Runtime assets are self-hosted. No upstream CDN is contacted by visitors.

- v86 0.5.473: BSD-2-Clause, `v86-LICENSE.txt`. Sources: https://github.com/copy/v86 ; exact npm package/integrity in package-lock.json. Its bundled SoftFloat and zstd notices are included separately.
- xterm.js 6.0.0 and addon-fit 0.11.0: MIT, included notices. Sources: https://github.com/xtermjs/xterm.js ; exact npm artifacts in package-lock.json.
- Linux 6.12.115, Alpine linux-virt 6.12.115-r0 x86: GPL-2.0-only. Official package artifact and SHA-256 are pinned in config/runtime-assets.json. Alpine build recipe/config/patches: https://gitlab.alpinelinux.org/alpine/aports/-/tree/3.21-stable/main/linux-lts . Kernel sources: https://www.kernel.org/ .
- BusyBox 1.37.0, Alpine busybox-static 1.37.0-r14 x86: GPL-2.0-only. Artifact/checksum pinned in config/runtime-assets.json. Alpine recipe/config/patches: https://gitlab.alpinelinux.org/alpine/aports/-/tree/3.21-stable/main/busybox . Upstream: https://busybox.net/ . The static binary includes musl; its copyright notice is included.
- SeaBIOS and VGA BIOS: pinned v86 upstream commit 315b2b0b758703ef0e6cc7b4088d6068f83f3c20, see config/runtime-assets.json. SeaBIOS LGPLv3/GPL notices included; v86 source contains the BIOS source/build references. https://github.com/copy/v86/tree/315b2b0b758703ef0e6cc7b4088d6068f83f3c20/bios

- sl 5.02, Alpine sl 5.02-r1 x86: Toyoda Masashi's original steam-locomotive program; upstream permissive license requiring attribution, included as `sl-LICENSE.txt` (Alpine classifies it as MIT). Source: https://github.com/mtoyoda/sl .
- ncurses 6.5-20241006, Alpine libncursesw/ncurses-terminfo-base 6.5_p20241006-r3: X11/MIT-style terms, `ncurses-COPYING.txt`. Only libncursesw and the xterm-256color terminfo entry are placed in the guest. Source: https://invisible-island.net/ncurses/ .
- musl 1.2.5, Alpine musl 1.2.5-r12 x86: MIT and bundled notices, `musl-1.2.5-COPYRIGHT.txt`. The dynamic loader/library required by sl is additional to BusyBox's static musl. Source: https://musl.libc.org/ .

The above sl/runtime packages are pinned by size/SHA-256. Exact sources, Alpine recipes and patches are also provided; upstream archive SHA-512 values were checked against those recipes. Their original notices are included both under `/runtime/licenses/` and inside the guest at `/usr/share/licenses/`. TripSurf's wrapper adapts screen height and restores the terminal on interruption; the upstream sl binary is unmodified.

The project's guest initramfs construction and init/scripts are in scripts/runtime/guest.mjs. No proprietary game data is included. DOOM/Freedoom is not installed.

## Corresponding sources

The generated [/sources/](/sources/) page provides exact upstream archives,
Alpine recipe/configuration/patch snapshots and BIOS provenance on the same host
as the binaries. Full archives and split parts are SHA-256 pinned in
config/runtime-sources.json and the generated manifest. See [SOURCES.txt](SOURCES.txt)
for reconstruction and build instructions. The Linux and BusyBox source commits
come from the distributed APK metadata; BIOS rel-1.16.2 matches its embedded
version and the pinned v86 build script/configuration. Rolling links above are
background references, not the supplied source set.

Publication still requires the remaining release acceptance and owner approval.
Keep the exact source files available for every distributed binary version;
never deploy binary-only output. Generated dist includes both by default.

## Freedoom browser game

`doom` loads **Freedoom: Phase 1 0.13.0** data (BSD-3-Clause), not proprietary id Software game assets. Original license and contributor/music credits are included as freedoom-COPYING.txt, freedoom-CREDITS.txt and freedoom-CREDITS-MUSIC.txt.

The engine is **doomgeneric** commit e257a09527062bfb986b6e5e0780839b6cbd5b71 (Doom/Chocolate Doom lineage, GPL-2.0-or-later), compiled locally with **Emscripten 4.0.10**, **SDL 2.32.0** and **SDL_mixer 2.8.0**. Original license texts are included. The TripSurf C backend and game-frame integration are GPL-2.0-or-later. Engine artifacts are integrity-pinned in config/doom-assets.json. No WAD uploads or multiplayer backend are included. Sound effects use SDL_mixer; music synthesizer/patch data is not bundled in this version.

Exact upstream archives, including Emscripten's runtime/libc sources and bundled license notices, are distributed through /sources/ with checksums. The original Freedoom release archive includes both phases; only Phase 1 is loaded for gameplay. See SOURCES.txt for the build recipe and the complete unminified integration source links. Compressed engine files are stored under config/doom-artifacts only as reproducible build outputs, never as the sole corresponding-source distribution.


## Local HTML preview

The self-hosted preview parser bundle uses parse5 8.1.0 (MIT), entities 9.0.0 (BSD-2-Clause), css-tree 3.2.1 (MIT), mdn-data 2.27.1 (CC0-1.0) and source-map-js 1.2.2 (BSD-3-Clause). Original notices are shipped as parse5-LICENSE.txt, entities-LICENSE.txt, css-tree-LICENSE.txt, mdn-data-LICENSE.txt and source-map-js-LICENSE.txt. Tree shaking may omit unused dependency modules. Build dependency esbuild 0.28.2 is not executed by visitors. The parser libraries do not themselves provide the application's security allowlist; that policy and the isolated rendering layers are implemented by TripSurf.


## Browser-local AI preview

Qwen3.5-0.8B (Qwen Team, Apache-2.0) is distributed as the MLC q4f16_1 conversion from mlc-ai/Qwen3.5-0.8B-q4f16_1-MLC. Exact model and WebGPU-library revisions, upstream URLs, sizes and hashes are in config/ai-assets.json. WebLLM 0.2.87 and its bundled MLC runtime/tokenizer/grammar components are Apache-2.0; the package's license is webllm-LICENSE.txt. loglevel is MIT (loglevel-LICENSE.txt). Upstream license comments embedded in the bundle are preserved. No external model host or inference API is contacted by visitors; model parts are served from this site after consent.

The single-batch build rebuilds the model library with maximum batch size 1 and pairs it with the corresponding Apache TVM browser module (Apache-2.0). Weights and tokenizer are unchanged. Local artifact hashes and compiler/runtime source revisions are recorded in config/ai-assets.json; build modifications and reconstruction commands are described in scripts/ai/model-build.md. TVM shard loading is modified to upload one shard at a time and avoid tensor-body copies. These Apache-2.0 source modifications and the build recipe are included in /sources/.

Upstream notices for the rebuilt native components (preserved verbatim):

```text
MLC LLM

Copyright (c) 2023-2025 by MLC LLM Contributors

Apache TVM
Copyright 2019-2023 The Apache Software Foundation

This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).

Apache TVM FFI
Copyright 2024-present The Apache Software Foundation

This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
```

The native FP16 conversion helper also carries this upstream notice:

```text
Copyright (c) 2009-2015 by llvm/compiler-rt contributors

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
```