Angry Pig

A first-person 3D throwing-destruction game: aim, charge, hurl balls at crate-and-brick fortresses and knock the animals off — Angry Birds re-imagined from inside the slingshot.

6.5/10
weighted total
Technical Depth
7
Game Design
8
Backend & Security
6.5
Code Quality
6.5
Testing
1
Completeness
8
Originality
6
Dimension by dimension

The seven dimensions

memoryTechnical Depth 7/10

Solid physics integration: SAPBroadphase, body sleep, four ContactMaterials, and a correct fixed-step accumulator loop (1/60, max 5 substeps). The standout is measureAnimatedBounds() — because Box3.setFromObject misses skinned deformation, it samples the idle animation at 6 timestamps, applies bone transforms per vertex (with stride sampling on dense meshes) and unions the boxes. A pitfall many three.js veterans fall into, solved properly. No InstancedMesh for dynamic objects, no LOD.

stadia_controllerGame Design 8/10

The juice engineering is the best in the series: hit-stop that scales with combo (capped 0.11 s), combo pitch rising a semitone per hit, an in-flight score counter with comet trail and milestone burst text, and an air-snipe bounty (2.5 m off the ground, once per animal to prevent farming). The economy deliberately decouples coins from score 'to avoid inflation'; 15 hand-built levels teach chain-collapse via explosive foundations. First-person fixed positioning limits depth; late-game special balls are badly imbalanced.

securityBackend & Security 6.5/10

Careful cost engineering — parameterized queries, dual-layer XSS defense, IP rate limits, edge caching (30–300 s), full CSP in _headers, and the presence system's evolution from ~1,900 requests/tab/day heartbeats to check-in-once with 13% probabilistic maintenance, each step quantified in commit messages. Then the blunders: README literally prints the ADMIN_KEY 0501 in its deploy instructions, message DELETE is unthrottled (a 4-digit key, brute-forceable), scores are forgeable (wave=60 → ~18M points), and names are identities so anyone can impersonate the leaderboard.

codeCode Quality 6.5/10

Comment quality is exceptional (nearly every block explains *why*, e.g. why leaderboard keys avoid emoji variation selectors), and the level-building DSL (stack/tower/plankTower combinators) defines 15 levels in a few lines each. But fps.js is a 2,612-line single file mixing rendering, physics, UI, network, levels and shop — and dropping TypeScript costs: the game object carries 20+ dynamic fields and entities are typed by ad-hoc tags like e.boss.

experimentTesting 1/10

Zero everything: no test files, no test script, no CI, and — unlike the TS siblings — no typecheck as a fallback line of defense. High-regression-risk physics and scoring formulas rely entirely on manual play.

verifiedCompleteness 8/10

Nine days, astonishing delivery: 4 modes, 15 levels, 8 special balls, bosses, 4 biomes, mobile touch with iOS crosshair fixes, a settings menu, opening camera sweep, one-time tutorial, offline fallback, a thorough README with deploy steps, an intro page, screenshots and a YouTube video.

emoji_objectsOriginality 6/10

An open Angry Birds homage — but the perspective shift is a substantive gameplay change: 2D side-view parabolas become first-person charging with a predicted-arc dot, a genuinely different aiming feel. Add the highest-flight leaderboard, air-snipe double hits, and physics-toy special balls (summon pig, black hole, tornado): derivative theme, original execution.

trending_upHighlights

  • Skinned-mesh animated bounds — samples the idle animation at 6 timestamps and unions per-vertex bone-transformed boxes, fixing floating feet (fps.js:402-432)
  • Quota-driven backend evolution — heartbeat → conditional upsert → check-in, each commit quantified (~1,900 req/day → 1-2 req/session)
  • Level-building DSLtower()/plankTower() combinators make an 8-line skyscraper level; the same helpers drive deathmatch procedural generation (fps.js:1289-1329)
  • Layered game feel — hit-stop + combo pitch + milestone burst text + screen shake, all hand-written and mutually tuned
  • Dual-layer degradation — every API call has a localStorage fallback; fully playable with no backend at all (fps.js:1770-1792)

trending_downWeaknesses

  • ADMIN_KEY printed in the README (printf 0501 | npx wrangler …) and message DELETE unthrottled — a brute-forceable 4-digit key (README.md:112)
  • Scores fully forgeable — self-reported wave=60 yields ~18M points; name-keyed ranking allows impersonation (score.js)
  • 2,612-line single file with no module boundaries; no TS means 20+ untyped dynamic fields on game (fps.js)
  • Zero tests, zero CI, zero typecheck
  • Rate-limiter race — SELECT and INSERT are not atomic; concurrent requests slip through (_lib.js:46-57)

smart_toyAI-assisted development

46 of 47 commits co-authored by Claude Opus 4.8, every message wrapped in an @ prefix from the automation tooling. Burst cadence (11 commits on 7/5, 15 on 7/11), quantified commit messages, and a human clearly in the loop for real-world issues — Cloudflare quotas, iOS viewport quirks, emoji variation selectors.

summarizeFacts

Stackthree.js r160 · cannon-es · JavaScript · Vite 5 · CF Pages Functions · D1
GenrePhysics destruction
Period2026-07-04 → 2026-07-12
Active dev days7 days
Commits47
Lines of code~3,987
Authorcraig7351 (Book AI)

Verdict

The best game-feel of the series and a real physics-engineering gem, shipped with the series' worst safety story: no tests, no types, and an admin key printed in the manual.