6 files changed, 430 insertions, 323 deletions

diff --git a/web/README.md b/web/README.md
index 1ee794f..13f5f85 100644
--- a/web/README.md
+++ b/web/README.md
@@ -8,10 +8,14 @@ browser defaults: black text, blue links, monospace checksums. PHP 8.0+.
 
 ```
 web/
-  index.php
-  bin/gui/       served at /bin/gui/... (app and installers)
-  bin/client/    served at /bin/client/...
-  bin/server/    served at /bin/server/...
+  index.php      the download page
+  latest.php     newest-version feed for the installers
+  releases.php   shared scanner and hash cache
+  install.sh     stable Linux installer
+  install.ps1    stable Windows installer
+  bin/gui/       apps, served at /bin/gui/...
+  bin/client/    terminal clients
+  bin/server/    servers
 ```
 
 Serve `web/` as the document root. Binaries in `bin/` are gitignored.
@@ -23,8 +27,6 @@ those directories is ignored.
 
 ```
 bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
-bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
-bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
 bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
 bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
 ```
@@ -32,12 +34,14 @@ bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
 `<version>` is `MAJOR.MINOR.PATCH`, `<platform>` is `linux`, `windows` or
 `macos`, `<arch>` is `x86_64`, `i686` or `aarch64`.
 
-The installers are generated next to their app. They embed the app's SHA-256,
-check the file (or download it) and install it for the current user: Linux
+The installers are not versioned. They read `latest.php`, pick the newest build
+for the machine, verify its SHA-256 and install it for the current user: Linux
 writes `~/.local/bin/zagan-bet-gui` plus a `.desktop` launcher, Windows writes
-`%LOCALAPPDATA%\Programs\Zagan-Bet` plus a Start-menu shortcut. The Windows
-installer waits for Enter before closing (`-NoPause` for automation). The page
-links the public git repository for the GPL corresponding source.
+`%LOCALAPPDATA%\Programs\Zagan-Bet` plus a Start-menu shortcut. Updating the
+site only needs `publish.sh`; the installer links never change. Set
+`ZAGAN_SITE` (Linux) or `-Site` (Windows) to test against a staging site. The
+Windows installer waits for Enter before closing (`-NoPause` for automation).
+The page links the public git repository for the GPL corresponding source.
 
 ## Publishing a build
 
@@ -49,19 +53,17 @@ From the repository root:
 
 It reads the version from `Cargo.toml`, builds every artifact and installs
 them under `web/bin` with the names above. The GUI is built with the
-workspace's `gui-release` profile (LTO, stripped) and the installers are
-rendered with Python 3 and the published SHA-256. Run it from a clean tree so
+workspace's `gui-release` profile (LTO, stripped). Run it from a clean tree so
 the release commit is the source the page links to. Override the destination
-with `DEST=/srv/www/bin ./scripts/publish.sh`, and the download origin baked
-into the installers with `URL_BASE=https://staging.example/ ./scripts/publish.sh`.
-`ALLOW_DIRTY=1` skips the clean-tree check for a preview.
+with `DEST=/srv/www/bin ./scripts/publish.sh`; `ALLOW_DIRTY=1` skips the
+clean-tree check for a preview. The installers are static and need no
+regeneration.
 
 Builds are per target triple, so these must be installed:
 `x86_64-unknown-linux-gnu`, `i686-unknown-linux-gnu` and
 `x86_64-pc-windows-gnu`, plus the mingw linker for the Windows build. Client
 builds always pass `--no-default-features`, which drops the server's OpenSSL
-dependency; the client is rustls-only. The GUI needs Python 3 at publish time
-for the installer templates in `scripts/installers/`.
+dependency; the client is rustls-only.
 
 Cargo itself cannot produce these names: it always writes
 `target/<triple>/release/<bin>`. The script renames after each build.
diff --git a/web/index.php b/web/index.php
index 77edf95..3f0ab92 100644
--- a/web/index.php
+++ b/web/index.php
@@ -1,63 +1,34 @@
 <?php
 declare(strict_types=1);
 
+require __DIR__ . '/releases.php';
+
 /**
  * zagan.bet download page.
  *
- * Scans ./bin/{gui,client,server} and renders every build it finds, with its
- * version, size and SHA-256. The GPL source link points at the public git
- * repository. No database, no JavaScript, no dependencies.
- *
- * Expected file names (anything else is ignored):
- *
- *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
- *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
- *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
- *   bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
- *   bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
- *
- * <version> is MAJOR.MINOR.PATCH, <platform> is linux|windows|macos and
- * <arch> is x86_64|i686|aarch64. Example:
- *
- *   bin/gui/zagan-bet-gui-4.3.0-linux-x86_64
- *   bin/client/zagan-bet-client-4.3.0-linux-x86_64
- *
- * SHA-256 values are cached in a JSON file keyed on size and mtime, so a file
- * is only re-read when it changes. The cache lives in the system temp
- * directory by default (the web root is often not writable by the PHP user);
- * set ZAGAN_HASH_CACHE to put it somewhere else.
+ * Lists every published app, terminal client and server, with version, size
+ * and SHA-256. The installers are stable links that ask latest.php for the
+ * newest build. The GPL source link points at the public git repository. No
+ * database, no JavaScript, no dependencies.
  */
 
-const KINDS = [
-    'gui' => [
-        'title' => 'Desktop app',
-        'hint' => 'Windows 10 or newer, or a Linux desktop. No terminal needed.',
-    ],
-    'client' => [
-        'title' => 'Client',
-        'hint' => 'Needs a terminal of at least 80×24 cells.',
-    ],
-    'server' => [
-        'title' => 'Server',
-        'hint' => 'Generates its own TLS identity on first run.',
-    ],
-];
+$scan = scan_releases();
+$releases = $scan['releases'];
+$newest = $scan['newest_mtime'];
 
-const PLATFORMS = [
-    'linux' => 'Linux',
-    'windows' => 'Windows',
-    'macos' => 'macOS',
-];
+$base = rtrim(str_replace('\\', '/', dirname($_SERVER['SCRIPT_NAME'] ?? '/')), '/');
+if ($base === '.' || $base === '/') {
+    $base = '';
+}
 
-const ARCHES = [
-    'x86_64' => '64-bit',
-    'i686' => '32-bit',
-    'aarch64' => 'ARM64',
-];
+foreach ($releases as $kind => &$found) {
+    foreach ($found as &$release) {
+        $release['href'] = $base . '/bin/' . $kind . '/' . rawurlencode($release['file']);
+    }
+}
+unset($found, $release);
 
-// Newest version first, then 64-bit builds before 32-bit.
-const PLATFORM_ORDER = ['linux' => 0, 'windows' => 1, 'macos' => 2];
-const ARCH_ORDER = ['x86_64' => 0, 'aarch64' => 1, 'i686' => 2];
+$all = array_merge($releases['gui'], $releases['client'], $releases['server']);
 
 function e(?string $value): string
 {
@@ -74,220 +45,6 @@ function human_size(int $bytes): string
     }
     return $bytes . ' B';
 }
-
-/**
- * Hash to use for a published file, reusing the cached value when the file has
- * not changed since it was hashed.
- *
- * A cached hash is valid only when the size and mtime still match and the hash
- * was taken at or after the file's mtime, so a restored or touched file is
- * re-read.
- *
- * @param array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} $cache
- */
-function cached_hash(
-    string $key,
-    string $path,
-    int $size,
-    int $mtime,
-    array &$cache,
-    bool &$dirty
-): ?string {
-    $entry = $cache['files'][$key] ?? null;
-    if (
-        is_array($entry)
-        && ($entry['size'] ?? null) === $size
-        && ($entry['mtime'] ?? null) === $mtime
-        && (int) ($entry['hashed_at'] ?? 0) >= $mtime
-        && isset($entry['sha256'])
-        && is_string($entry['sha256'])
-        && preg_match('/\A[0-9a-f]{64}\z/', $entry['sha256']) === 1
-    ) {
-        return $entry['sha256'];
-    }
-
-    $hash = hash_file('sha256', $path);
-    if ($hash === false) {
-        return null;
-    }
-
-    $cache['files'][$key] = [
-        'size' => $size,
-        'mtime' => $mtime,
-        'sha256' => $hash,
-        'hashed_at' => time(),
-    ];
-    $dirty = true;
-
-    return $hash;
-}
-
-/** @return array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} */
-function load_hash_cache(string $path): array
-{
-    $raw = @file_get_contents($path);
-    if ($raw === false || $raw === '') {
-        return ['files' => []];
-    }
-    $decoded = json_decode($raw, true);
-    if (!is_array($decoded) || !isset($decoded['files']) || !is_array($decoded['files'])) {
-        return ['files' => []];
-    }
-
-    return ['files' => $decoded['files']];
-}
-
-/**
- * Best effort: a read-only web root, a full disk or a racing writer must never
- * break the page, so failures are ignored and the next request recomputes.
- *
- * @param array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} $cache
- */
-function save_hash_cache(string $path, array $cache): void
-{
-    $json = json_encode($cache, JSON_UNESCAPED_SLASHES);
-    if ($json === false) {
-        return;
-    }
-    $directory = dirname($path);
-    $temporary = @tempnam($directory, '.zagan-hashes-');
-    if ($temporary === false) {
-        return;
-    }
-    if (@file_put_contents($temporary, $json, LOCK_EX) === false || !@rename($temporary, $path)) {
-        @unlink($temporary);
-    }
-}
-
-/**
- * @return array{version:string,platform:string,arch:string,file:string,size:int,mtime:int,sha256:string}|null
- */
-function read_release(
-    string $kind,
-    string $directory,
-    string $entry,
-    array &$cache,
-    bool &$dirty
-): ?array {
-    $pattern = '/^zagan-bet-' . preg_quote($kind, '/')
-        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(-install\.sh|-install\.ps1|\.exe)?$/i';
-    if (preg_match($pattern, $entry, $matches) !== 1) {
-        return null;
-    }
-
-    $realDirectory = realpath($directory);
-    $real = realpath($directory . '/' . $entry);
-    if ($realDirectory === false || $real === false) {
-        return null;
-    }
-    // Never serve anything that resolves outside the published directory.
-    if (!str_starts_with($real, $realDirectory . DIRECTORY_SEPARATOR)) {
-        return null;
-    }
-    if (!is_file($real)) {
-        return null;
-    }
-
-    $size = filesize($real);
-    $mtime = filemtime($real);
-    if ($size === false || $mtime === false) {
-        return null;
-    }
-
-    $hash = cached_hash($kind . '/' . $entry, $real, $size, $mtime, $cache, $dirty);
-    if ($hash === null) {
-        return null;
-    }
-
-    $suffix = strtolower($matches[4] ?? '');
-    $variant = str_starts_with($suffix, '-install.') ? 'installer' : 'binary';
-
-    return [
-        'version' => $matches[1],
-        'platform' => strtolower($matches[2]),
-        'arch' => strtolower($matches[3]),
-        'variant' => $variant,
-        'file' => $entry,
-        'size' => $size,
-        'mtime' => $mtime,
-        'sha256' => $hash,
-    ];
-}
-
-$base = rtrim(str_replace('\\', '/', dirname($_SERVER['SCRIPT_NAME'] ?? '/')), '/');
-if ($base === '.' || $base === '/') {
-    $base = '';
-}
-
-$cachePath = getenv('ZAGAN_HASH_CACHE');
-if (!is_string($cachePath) || $cachePath === '') {
-    $cachePath = rtrim(sys_get_temp_dir(), DIRECTORY_SEPARATOR)
-        . DIRECTORY_SEPARATOR . 'zagan-bet-hashes-'
-        . substr(hash('sha256', __DIR__), 0, 16) . '.json';
-}
-$cache = load_hash_cache($cachePath);
-$cacheDirty = false;
-$seen = [];
-
-$releases = [];
-$newest = 0;
-
-foreach (KINDS as $kind => $meta) {
-    $found = [];
-    $directory = __DIR__ . '/bin/' . $kind;
-
-    if (is_dir($directory)) {
-        $entries = scandir($directory);
-        if ($entries !== false) {
-            foreach ($entries as $entry) {
-                if ($entry === '.' || $entry === '..') {
-                    continue;
-                }
-                $release = read_release($kind, $directory, $entry, $cache, $cacheDirty);
-                if ($release === null) {
-                    continue;
-                }
-                $seen[$kind . '/' . $entry] = true;
-                $release['href'] = $base . '/bin/' . $kind . '/' . rawurlencode($release['file']);
-                $found[] = $release;
-                $newest = max($newest, $release['mtime']);
-            }
-        }
-    }
-
-    usort($found, static function (array $a, array $b): int {
-        $byVersion = version_compare($b['version'], $a['version']);
-        if ($byVersion !== 0) {
-            return $byVersion;
-        }
-        $byPlatform = (PLATFORM_ORDER[$a['platform']] ?? 9) <=> (PLATFORM_ORDER[$b['platform']] ?? 9);
-        if ($byPlatform !== 0) {
-            return $byPlatform;
-        }
-        $byArch = (ARCH_ORDER[$a['arch']] ?? 9) <=> (ARCH_ORDER[$b['arch']] ?? 9);
-        if ($byArch !== 0) {
-            return $byArch;
-        }
-        $byVariant = ($a['variant'] === 'installer' ? 1 : 0) <=> ($b['variant'] === 'installer' ? 1 : 0);
-        if ($byVariant !== 0) {
-            return $byVariant;
-        }
-        return strcmp($a['file'], $b['file']);
-    });
-
-    $releases[$kind] = $found;
-}
-
-// Drop cache entries for files that are no longer published.
-foreach (array_keys($cache['files']) as $key) {
-    if (!isset($seen[$key])) {
-        unset($cache['files'][$key]);
-        $cacheDirty = true;
-    }
-}
-if ($cacheDirty) {
-    save_hash_cache($cachePath, $cache);
-}
 ?>
 <!doctype html>
 <html lang="en">
@@ -308,24 +65,20 @@ if ($cacheDirty) {
 
 <h2>Desktop app</h2>
 <p>Windows 10 or newer, or a Linux desktop. No terminal needed.</p>
-<?php $guiBinaries = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'binary')); ?>
-<?php $guiInstallers = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'installer')); ?>
-<?php if ($guiBinaries === []): ?>
+<?php if ($releases['gui'] === []): ?>
 <p>Nothing published yet.</p>
 <?php else: ?>
 <ul>
-<?php foreach ($guiBinaries as $release): ?>
+<?php foreach ($releases['gui'] as $release): ?>
 <li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?><?php if (isset(ARCHES[$release['arch']])): ?> (<?= e(ARCHES[$release['arch']]) ?>)<?php endif; ?> v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
 <?php endforeach; ?>
 </ul>
-<?php endif; ?>
-<?php if ($guiInstallers !== []): ?>
+
 <h3>Installers</h3>
-<p>The installer checks the download, installs Zagan-Bet for your user and adds it to your programs. Run it next to a downloaded app, or on its own to fetch one.</p>
+<p>Downloads the newest build, checks its SHA-256 and installs it for your user.</p>
 <ul>
-<?php foreach ($guiInstallers as $release): ?>
-<li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?> installer (<?= str_ends_with($release['file'], '.ps1') ? 'PowerShell' : 'bash' ?>) v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
-<?php endforeach; ?>
+<li><a href="<?= e($base) ?>/install.sh" download>Linux installer (bash)</a></li>
+<li><a href="<?= e($base) ?>/install.ps1" download>Windows installer (PowerShell)</a></li>
 </ul>
 <?php endif; ?>
 
@@ -353,7 +106,6 @@ if ($cacheDirty) {
 </ul>
 <?php endif; ?>
 
-<?php $all = array_merge($releases['gui'], $releases['client'], $releases['server']); ?>
 <?php if ($all !== []): ?>
 <h2>SHA-256</h2>
 <p>On Linux use <code>sha256sum &lt;file&gt;</code>. On Windows use <code>Get-FileHash &lt;file&gt;</code>.</p>
@@ -372,11 +124,11 @@ echo e($sums);
 
 <h2>Running it</h2>
 <p>Desktop app on Linux:</p>
-<pre><code>chmod +x zagan-bet-gui-*-linux-x86_64-install.sh
-./zagan-bet-gui-*-linux-x86_64-install.sh</code></pre>
+<pre><code>chmod +x install.sh
+./install.sh</code></pre>
 <p>Desktop app on Windows (PowerShell):</p>
-<pre><code>powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-windows-x86_64-install.ps1</code></pre>
-<p>The installers verify the SHA-256 before installing. You can also run the downloaded app directly.</p>
+<pre><code>powershell -ExecutionPolicy Bypass -File .\install.ps1</code></pre>
+<p>The installers fetch the newest build, verify its SHA-256, install it for your user and add a launcher.</p>
 <p>Terminal client:</p>
 <pre><code>chmod +x &lt;downloaded-client&gt;
 ./&lt;downloaded-client&gt;</code></pre>
diff --git a/scripts/installers/windows.ps1.in b/web/install.ps1
index 4b8e61d..92eef83 100644
--- a/scripts/installers/windows.ps1.in
+++ b/web/install.ps1
@@ -1,21 +1,18 @@
-# Zagan-Bet desktop installer for Windows.
+# Zagan-Bet installer for Windows.
 #
-# Verifies the app against its published SHA-256, installs it for the current
-# user and adds a Start-menu shortcut. Put the downloaded app next to this
-# script, or run the script on its own and it will fetch the matching binary.
+# Asks the site which build is newest, verifies its SHA-256, installs it for
+# the current user and adds a Start-menu shortcut. Point it at a staging site
+# with -Site http://127.0.0.1:8899; add -NoPause for automation.
 #
 # Run it with:
-#   powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-install.ps1
-# Add -NoPause to run it unattended.
-param([switch]$NoPause)
+#   powershell -ExecutionPolicy Bypass -File .\install.ps1
+param(
+    [string]$Site = "https://zagan.2137697.xyz",
+    [switch]$NoPause
+)
 
 $ErrorActionPreference = "Stop"
 
-$Version = "__VERSION__"
-$Binary  = "__BINARY__"
-$Sha256  = "__SHA256__"
-$Url     = "__URL__"
-
 function Finish([int]$Code) {
     if (-not $NoPause) {
         Read-Host "Press Enter to close" | Out-Null
@@ -28,6 +25,30 @@ function Stop-Install([string]$Message) {
     Finish 1
 }
 
+try {
+    $latest = (Invoke-WebRequest -Uri "$Site/latest.php" -UseBasicParsing).Content
+} catch {
+    Stop-Install "could not read $Site/latest.php: $_"
+}
+
+$line = ($latest -split "`r?`n") |
+    Where-Object { $_ -match '^gui windows x86_64 ' } |
+    Select-Object -First 1
+if (-not $line) {
+    Stop-Install "no Windows build is published yet"
+}
+
+$parts = $line.Trim() -split '\s+'
+if ($parts.Count -lt 6) {
+    Stop-Install "the latest-build file is malformed"
+}
+$Version = $parts[3]
+$Binary = $parts[4]
+$Sha256 = $parts[5]
+$Url = "$Site/bin/gui/$Binary"
+
+Write-Host "Newest Zagan-Bet is $Version."
+
 $here = Split-Path -Parent $MyInvocation.MyCommand.Path
 $candidates = @(
     (Join-Path $here $Binary),
diff --git a/scripts/installers/linux.sh.in b/web/install.sh
index 5b53c02..998b262 100644
--- a/scripts/installers/linux.sh.in
+++ b/web/install.sh
@@ -1,24 +1,38 @@
 #!/usr/bin/env bash
-# Zagan-Bet desktop installer for Linux.
+# Zagan-Bet installer for Linux.
 #
-# Verifies the app against its published SHA-256, installs it for the current
-# user and adds a launcher. Put the downloaded app next to this script, or run
-# the script on its own and it will fetch the matching binary.
+# Asks the site which build is newest, verifies its SHA-256, installs it for
+# the current user and adds a launcher. Point it at a staging site with
+# ZAGAN_SITE=http://127.0.0.1:8899.
 set -euo pipefail
 
-VERSION="__VERSION__"
-BINARY="__BINARY__"
-SHA256="__SHA256__"
-URL="__URL__"
+SITE=${ZAGAN_SITE:-https://zagan.2137697.xyz}
+PLATFORM=linux
+ARCH=x86_64
 
 say() { printf '%s\n' "$*"; }
 die() { printf 'install: %s\n' "$*" >&2; exit 1; }
 
+command -v curl >/dev/null 2>&1 || die "curl is required"
 command -v sha256sum >/dev/null 2>&1 || die "sha256sum is required"
 
+latest=$(curl -fsSL --max-time 30 "$SITE/latest.php") \
+  || die "could not read $SITE/latest.php"
+line=$(printf '%s\n' "$latest" \
+  | awk -v p="$PLATFORM" -v a="$ARCH" '$1 == "gui" && $2 == p && $3 == a { print; exit }')
+[ -n "$line" ] || die "no Linux build is published yet"
+
+version=$(printf '%s\n' "$line" | awk '{print $4}')
+binary=$(printf '%s\n' "$line" | awk '{print $5}')
+sha=$(printf '%s\n' "$line" | awk '{print $6}')
+[ -n "$version" ] && [ -n "$binary" ] && [ -n "$sha" ] \
+  || die "the latest-build file is malformed"
+
+say "Newest Zagan-Bet is $version."
+
 here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 source_file=""
-for candidate in "$here/$BINARY" "./$BINARY" "$HOME/Downloads/$BINARY"; do
+for candidate in "$here/$binary" "./$binary" "$HOME/Downloads/$binary"; do
   if [ -f "$candidate" ]; then
     source_file=$candidate
     break
@@ -27,16 +41,17 @@ done
 
 cleanup=""
 if [ -z "$source_file" ]; then
-  command -v curl >/dev/null 2>&1 || die "put $BINARY next to this installer, or install curl"
   cleanup=$(mktemp) || die "cannot create a temporary file"
-  say "Downloading $BINARY..."
-  curl -fsSL --max-time 300 "$URL" -o "$cleanup" || die "download failed"
+  say "Downloading $binary..."
+  curl -fsSL --max-time 300 "$SITE/bin/gui/$binary" -o "$cleanup" \
+    || die "download failed"
   source_file=$cleanup
 fi
 trap 'if [ -n "$cleanup" ]; then rm -f "$cleanup"; fi' EXIT
 
 actual=$(sha256sum "$source_file" | awk '{print $1}')
-[ "$actual" = "$SHA256" ] || die "checksum mismatch: expected $SHA256, got $actual"
+[ "$actual" = "$sha" ] \
+  || die "checksum mismatch: expected $sha, got $actual"
 
 bin_dir="${XDG_BIN_HOME:-$HOME/.local/bin}"
 data_dir="${XDG_DATA_HOME:-$HOME/.local/share}"
@@ -48,7 +63,12 @@ mkdir -p "$bin_dir" "$desktop_dir" "$icon_dir"
 install -m 0755 "$source_file" "$app"
 
 cat > "$icon_dir/zagan-bet.svg" <<'ICON'
-__ICON__
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <rect width="64" height="64" rx="14" fill="#0a0e12"/>
+  <rect x="9" y="9" width="46" height="46" rx="10" fill="#0f1a14" stroke="#1f7d52" stroke-width="2"/>
+  <path d="M22 20h20L22 44h20" fill="none" stroke="#4ec27b" stroke-width="6"
+        stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
 ICON
 
 cat > "$desktop_dir/zagan-bet.desktop" <<DESKTOP
@@ -70,7 +90,7 @@ if command -v gtk-update-icon-cache >/dev/null 2>&1; then
   gtk-update-icon-cache -q "$data_dir/icons/hicolor" >/dev/null 2>&1 || true
 fi
 
-say "Installed Zagan-Bet $VERSION to $app"
+say "Installed Zagan-Bet $version to $app"
 say "A launcher was added to your applications menu."
 case ":$PATH:" in
   *":$bin_dir:"*) ;;
diff --git a/web/latest.php b/web/latest.php
new file mode 100644
index 0000000..3e7368c
--- /dev/null
+++ b/web/latest.php
@@ -0,0 +1,50 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * The newest published build, for install.sh and install.ps1.
+ *
+ * Plain text, one record per line, so both a shell script and PowerShell can
+ * parse it without a JSON library:
+ *
+ *   version 4.4.0
+ *   gui linux x86_64 4.4.0 zagan-bet-gui-4.4.0-linux-x86_64 <sha256>
+ *   gui windows x86_64 4.4.0 zagan-bet-gui-4.4.0-windows-x86_64.exe <sha256>
+ *   client ...
+ *   server ...
+ *
+ * Only the newest version is listed. The installers verify the SHA-256 they
+ * read here against the bytes they download.
+ */
+
+require __DIR__ . '/releases.php';
+
+$scan = scan_releases();
+$all = array_merge(
+    $scan['releases']['gui'],
+    $scan['releases']['client'],
+    $scan['releases']['server']
+);
+
+$newest = '0.0.0';
+foreach ($all as $release) {
+    if (version_compare($release['version'], $newest, '>')) {
+        $newest = $release['version'];
+    }
+}
+
+header('Content-Type: text/plain; charset=utf-8');
+header('Cache-Control: no-cache');
+
+echo 'version ' . $newest . "\n";
+foreach ($all as $release) {
+    if ($release['version'] !== $newest) {
+        continue;
+    }
+    echo $release['kind'] . ' '
+        . $release['platform'] . ' '
+        . $release['arch'] . ' '
+        . $release['version'] . ' '
+        . $release['file'] . ' '
+        . $release['sha256'] . "\n";
+}
diff --git a/web/releases.php b/web/releases.php
new file mode 100644
index 0000000..b9c7284
--- /dev/null
+++ b/web/releases.php
@@ -0,0 +1,262 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Shared release scanning for the download page and the latest-build endpoint.
+ *
+ * Expected file names under bin/<kind>/ (anything else is ignored):
+ *
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+ *   bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
+ *   bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
+ *
+ * <version> is MAJOR.MINOR.PATCH, <platform> is linux|windows|macos and
+ * <arch> is x86_64|i686|aarch64.
+ *
+ * SHA-256 values are cached in a JSON file keyed on size and mtime, so a file
+ * is only re-read when it changes. The cache lives in the system temp
+ * directory by default (the web root is often not writable by the PHP user);
+ * set ZAGAN_HASH_CACHE to put it somewhere else.
+ */
+
+const KINDS = [
+    'gui' => [
+        'title' => 'Desktop app',
+        'hint' => 'Windows 10 or newer, or a Linux desktop. No terminal needed.',
+    ],
+    'client' => [
+        'title' => 'Client',
+        'hint' => 'Needs a terminal of at least 80×24 cells.',
+    ],
+    'server' => [
+        'title' => 'Server',
+        'hint' => 'Generates its own TLS identity on first run.',
+    ],
+];
+
+const PLATFORMS = [
+    'linux' => 'Linux',
+    'windows' => 'Windows',
+    'macos' => 'macOS',
+];
+
+const ARCHES = [
+    'x86_64' => '64-bit',
+    'i686' => '32-bit',
+    'aarch64' => 'ARM64',
+];
+
+// Newest version first, then 64-bit builds before 32-bit.
+const PLATFORM_ORDER = ['linux' => 0, 'windows' => 1, 'macos' => 2];
+const ARCH_ORDER = ['x86_64' => 0, 'aarch64' => 1, 'i686' => 2];
+
+/**
+ * Hash to use for a published file, reusing the cached value when the file has
+ * not changed since it was hashed.
+ *
+ * A cached hash is valid only when the size and mtime still match and the hash
+ * was taken at or after the file's mtime, so a restored or touched file is
+ * re-read.
+ *
+ * @param array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} $cache
+ */
+function cached_hash(
+    string $key,
+    string $path,
+    int $size,
+    int $mtime,
+    array &$cache,
+    bool &$dirty
+): ?string {
+    $entry = $cache['files'][$key] ?? null;
+    if (
+        is_array($entry)
+        && ($entry['size'] ?? null) === $size
+        && ($entry['mtime'] ?? null) === $mtime
+        && (int) ($entry['hashed_at'] ?? 0) >= $mtime
+        && isset($entry['sha256'])
+        && is_string($entry['sha256'])
+        && preg_match('/\A[0-9a-f]{64}\z/', $entry['sha256']) === 1
+    ) {
+        return $entry['sha256'];
+    }
+
+    $hash = hash_file('sha256', $path);
+    if ($hash === false) {
+        return null;
+    }
+
+    $cache['files'][$key] = [
+        'size' => $size,
+        'mtime' => $mtime,
+        'sha256' => $hash,
+        'hashed_at' => time(),
+    ];
+    $dirty = true;
+
+    return $hash;
+}
+
+/** @return array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} */
+function load_hash_cache(string $path): array
+{
+    $raw = @file_get_contents($path);
+    if ($raw === false || $raw === '') {
+        return ['files' => []];
+    }
+    $decoded = json_decode($raw, true);
+    if (!is_array($decoded) || !isset($decoded['files']) || !is_array($decoded['files'])) {
+        return ['files' => []];
+    }
+
+    return ['files' => $decoded['files']];
+}
+
+/**
+ * Best effort: a read-only web root, a full disk or a racing writer must never
+ * break the page, so failures are ignored and the next request recomputes.
+ *
+ * @param array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} $cache
+ */
+function save_hash_cache(string $path, array $cache): void
+{
+    $json = json_encode($cache, JSON_UNESCAPED_SLASHES);
+    if ($json === false) {
+        return;
+    }
+    $directory = dirname($path);
+    $temporary = @tempnam($directory, '.zagan-hashes-');
+    if ($temporary === false) {
+        return;
+    }
+    if (@file_put_contents($temporary, $json, LOCK_EX) === false || !@rename($temporary, $path)) {
+        @unlink($temporary);
+    }
+}
+
+/**
+ * @return array{kind:string,version:string,platform:string,arch:string,file:string,size:int,mtime:int,sha256:string}|null
+ */
+function read_release(
+    string $kind,
+    string $directory,
+    string $entry,
+    array &$cache,
+    bool &$dirty
+): ?array {
+    $pattern = '/^zagan-bet-' . preg_quote($kind, '/')
+        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(\.exe)?$/i';
+    if (preg_match($pattern, $entry, $matches) !== 1) {
+        return null;
+    }
+
+    $realDirectory = realpath($directory);
+    $real = realpath($directory . '/' . $entry);
+    if ($realDirectory === false || $real === false) {
+        return null;
+    }
+    // Never serve anything that resolves outside the published directory.
+    if (!str_starts_with($real, $realDirectory . DIRECTORY_SEPARATOR)) {
+        return null;
+    }
+    if (!is_file($real)) {
+        return null;
+    }
+
+    $size = filesize($real);
+    $mtime = filemtime($real);
+    if ($size === false || $mtime === false) {
+        return null;
+    }
+
+    $hash = cached_hash($kind . '/' . $entry, $real, $size, $mtime, $cache, $dirty);
+    if ($hash === null) {
+        return null;
+    }
+
+    return [
+        'kind' => $kind,
+        'version' => $matches[1],
+        'platform' => strtolower($matches[2]),
+        'arch' => strtolower($matches[3]),
+        'file' => $entry,
+        'size' => $size,
+        'mtime' => $mtime,
+        'sha256' => $hash,
+    ];
+}
+
+/**
+ * Scan every kind and return its releases, newest version first.
+ *
+ * @return array{releases:array<string,array<int,array{kind:string,version:string,platform:string,arch:string,file:string,size:int,mtime:int,sha256:string}>>,newest_mtime:int}
+ */
+function scan_releases(): array
+{
+    $cachePath = getenv('ZAGAN_HASH_CACHE');
+    if (!is_string($cachePath) || $cachePath === '') {
+        $cachePath = rtrim(sys_get_temp_dir(), DIRECTORY_SEPARATOR)
+            . DIRECTORY_SEPARATOR . 'zagan-bet-hashes-'
+            . substr(hash('sha256', __DIR__), 0, 16) . '.json';
+    }
+    $cache = load_hash_cache($cachePath);
+    $dirty = false;
+    $seen = [];
+
+    $releases = [];
+    $newestMtime = 0;
+
+    foreach (KINDS as $kind => $meta) {
+        $found = [];
+        $directory = __DIR__ . '/bin/' . $kind;
+
+        if (is_dir($directory)) {
+            $entries = scandir($directory);
+            if ($entries !== false) {
+                foreach ($entries as $entry) {
+                    if ($entry === '.' || $entry === '..') {
+                        continue;
+                    }
+                    $release = read_release($kind, $directory, $entry, $cache, $dirty);
+                    if ($release === null) {
+                        continue;
+                    }
+                    $seen[$kind . '/' . $entry] = true;
+                    $found[] = $release;
+                    $newestMtime = max($newestMtime, $release['mtime']);
+                }
+            }
+        }
+
+        usort($found, static function (array $a, array $b): int {
+            $byVersion = version_compare($b['version'], $a['version']);
+            if ($byVersion !== 0) {
+                return $byVersion;
+            }
+            $byPlatform = (PLATFORM_ORDER[$a['platform']] ?? 9) <=> (PLATFORM_ORDER[$b['platform']] ?? 9);
+            if ($byPlatform !== 0) {
+                return $byPlatform;
+            }
+            $byArch = (ARCH_ORDER[$a['arch']] ?? 9) <=> (ARCH_ORDER[$b['arch']] ?? 9);
+            if ($byArch !== 0) {
+                return $byArch;
+            }
+            return strcmp($a['file'], $b['file']);
+        });
+
+        $releases[$kind] = $found;
+    }
+
+    // Drop cache entries for files that are no longer published.
+    foreach (array_keys($cache['files']) as $key) {
+        if (!isset($seen[$key])) {
+            unset($cache['files'][$key]);
+            $dirty = true;
+        }
+    }
+    if ($dirty) {
+        save_hash_cache($cachePath, $cache);
+    }
+
+    return ['releases' => $releases, 'newest_mtime' => $newestMtime];
+}