From 4887abc5773b33ab1e213ed5f528dfebd242e2cd Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Sun, 1 Nov 2026 22:23:00 +0100
Subject: v4.4.0: stable installers that follow the newest published build

Adds web/latest.php: a plain-text feed of the newest version with each artifact's filename and SHA-256. The per-release generated installers are replaced by stable web/install.sh and web/install.ps1; both read the feed, pick the newest build, verify it, install per-user and add a launcher. Publishing a new app version no longer regenerates or versions the installers.

publish.sh drops the installer renderer and Python dependency. deploy.sh now also verifies latest.php against the local artifacts and that the served installer scripts match the repository.
---
 AGENTS.md                         |  10 +-
 Cargo.toml                        |   2 +-
 docs/GUI-PLAN.md                  |  12 +-
 docs/TESTING.md                   |  16 +-
 gui/Cargo.toml                    |   2 +-
 scripts/deploy.sh                 |  24 +++
 scripts/installers/linux.sh.in    |  78 ----------
 scripts/installers/windows.ps1.in |  87 -----------
 scripts/publish.sh                |  37 +----
 scripts/render-installer.py       |  49 ------
 web/README.md                     |  38 ++---
 web/index.php                     | 308 ++++----------------------------------
 web/install.ps1                   | 108 +++++++++++++
 web/install.sh                    |  98 ++++++++++++
 web/latest.php                    |  50 +++++++
 web/releases.php                  | 262 ++++++++++++++++++++++++++++++++
 16 files changed, 623 insertions(+), 558 deletions(-)
 delete mode 100644 scripts/installers/linux.sh.in
 delete mode 100644 scripts/installers/windows.ps1.in
 delete mode 100644 scripts/render-installer.py
 create mode 100644 web/install.ps1
 create mode 100644 web/install.sh
 create mode 100644 web/latest.php
 create mode 100644 web/releases.php

diff --git a/AGENTS.md b/AGENTS.md
index cd5c71b..ab794f8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -85,10 +85,12 @@
 - The embedded fonts have no suit or arrow glyphs. Draw card suits as shapes
   and use plain words for navigation; a glyph that is not in Open Sans or Hack
   renders as tofu.
-- `scripts/publish.sh` builds the GUI with `gui-release` and renders the
-  installers with the published SHA-256. Installers verify the hash and install
-  per-user; never install system-wide or skip the check. The Windows installer
-  waits for Enter before closing; `-NoPause` is only for automation.
+- `scripts/publish.sh` builds the GUI with `gui-release`; the installers are
+  stable site files (`web/install.sh`, `web/install.ps1`) that read
+  `web/latest.php` for the newest build and its SHA-256. Never regenerate or
+  version the installers per release, install system-wide, or skip the hash
+  check. The Windows installer waits for Enter before closing; `-NoPause` is
+  only for automation.
 - Windows renders through wgpu on Direct3D 12, including the WARP software
   adapter, so a machine with only OpenGL 1.1 (VM, Remote Desktop) still runs.
   Linux keeps the smaller glow renderer. Do not assume OpenGL 2.0 on Windows.
diff --git a/Cargo.toml b/Cargo.toml
index 8897f9d..16ed8c6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ members = ["gui"]
 
 [package]
 name = "zagan-bet"
-version = "4.3.1"
+version = "4.4.0"
 edition = "2024"
 license = "GPL-3.0-or-later"
 
diff --git a/docs/GUI-PLAN.md b/docs/GUI-PLAN.md
index a322057..c0370a0 100644
--- a/docs/GUI-PLAN.md
+++ b/docs/GUI-PLAN.md
@@ -169,13 +169,13 @@ frame rate on integrated graphics and the Windows interactive pass.
 
 - `publish.sh` builds the GUI with the `gui-release` profile for Linux and
   Windows and names the app `zagan-bet-gui-<version>-<platform>-<arch>[.exe]`.
-- It renders a bash installer and a PowerShell installer next to each app.
-  Both embed the app's SHA-256, verify the file (or download it), install
-  per-user and add a launcher: `.desktop` plus an SVG icon on Linux, a
-  Start-menu shortcut on Windows. Templates live in `scripts/installers/`;
-  `render-installer.py` fills them in.
+- The installers are stable, unversioned site files: `install.sh` and
+  `install.ps1` read `latest.php`, pick the newest build for the machine,
+  verify its SHA-256, install per-user and add a launcher (`.desktop` plus an
+  SVG icon on Linux, a Start-menu shortcut on Windows). Publishing a new
+  version does not regenerate them.
 - The download page scans `bin/gui`, `bin/client` and `bin/server`, lists
-  apps, installers, clients and servers, and includes every file in the
+  apps, stable installers, clients and servers, and includes every file in the
   `sha256sum` block. A Source section links the public git repository
   (<https://git.2137697.xyz/zagan-bet.git>) for the GPL corresponding source.
   `deploy.sh` verifies every artifact kind over the public URL.
diff --git a/docs/TESTING.md b/docs/TESTING.md
index c32ac22..09ceb82 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -272,14 +272,16 @@ terminal client; a saved login from one signs in the other.
 1. Set the version in `Cargo.toml` and `gui/Cargo.toml` (same MAJOR.MINOR),
    run `cargo test --workspace`, and commit. `publish.sh` refuses a dirty tree
    because the site links the committed git history as the GPL source.
-2. `./scripts/publish.sh` (add `DEST=` and `URL_BASE=` to stage elsewhere). It
-   builds the GUI with `gui-release`, the terminal clients and servers, and
-   renders the bash/PowerShell installers with each app's SHA-256.
+2. `./scripts/publish.sh` (add `DEST=` to stage elsewhere). It builds the GUI
+   with `gui-release` and the terminal clients and servers. The installers are
+   stable site files and are not regenerated.
 3. `php -S 127.0.0.1:8899 -t <staging>` and
    `./scripts/deploy.sh <staging> http://127.0.0.1:8899/` to upload and verify
-   every app, installer, client and server against the page's checksums.
-4. On a clean user account: download an app with its installer, run the
-   installer, and launch the new menu entry. The installer must refuse a
-   corrupted download.
+   every app, client and server against the page's checksums, the stable
+   installers, and the newest-version feed at `latest.php`.
+4. On a clean user account: run the stable installer
+   (`ZAGAN_SITE=http://127.0.0.1:8899 ./web/install.sh`) and launch the new
+   menu entry. It must install the newest version even when an older app sits
+   next to it, and refuse a corrupted download.
 5. Repeat on Windows for the `.ps1` installer and the Start-menu shortcut.
 
diff --git a/gui/Cargo.toml b/gui/Cargo.toml
index 24bf560..e216309 100644
--- a/gui/Cargo.toml
+++ b/gui/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "zagan-bet-gui"
-version = "4.3.1"
+version = "4.4.0"
 edition = "2024"
 license = "GPL-3.0-or-later"
 description = "Desktop frontend for zagan-bet"
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index b18d462..63bd31c 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -95,6 +95,20 @@ origin=$(printf '%s' "$URL" | sed -E 's#^(https?://[^/]+).*#\1#')
 grep -oE '[0-9a-f]{64}  [A-Za-z0-9._-]+' "$tmp/page.html" > "$tmp/sums" || true
 [ -s "$tmp/sums" ] || die "no SHA-256 lines on the page (is index.php being served?)"
 
+for script in install.sh install.ps1; do
+  grep -qE "href=\"[^\"]*/$script\"" "$tmp/page.html" \
+    || die "$script is not linked from the page"
+  curl -fsSL --max-time 30 "$origin/$script" -o "$tmp/$script" \
+    || die "could not fetch $script"
+  cmp -s "web/$script" "$tmp/$script" \
+    || die "$script served from the site differs from the local file"
+done
+
+curl -fsSL --max-time 30 "$origin/latest.php" -o "$tmp/latest.txt" \
+  || die "could not fetch latest.php"
+newest=$(awk '$1 == "version" { print $2; exit }' "$tmp/latest.txt")
+[ -n "$newest" ] || die "latest.php has no version line"
+
 failed=0
 verified=0
 for local in "${artifacts[@]}"; do
@@ -132,6 +146,16 @@ for local in "${artifacts[@]}"; do
     continue
   fi
 
+  version=$(printf '%s' "$file" | sed -E 's/^zagan-bet-[a-z]+-([0-9]+\.[0-9]+\.[0-9]+)-.*/\1/')
+  if [ "$version" = "$newest" ]; then
+    latest_hash=$(awk -v kind="$kind" -v name="$file" '$1 == kind && $5 == name { print $6 }' "$tmp/latest.txt")
+    if [ "$latest_hash" != "$local_hash" ]; then
+      echo "  $file: latest.php shows ${latest_hash:-nothing}, local is $local_hash"
+      failed=1
+      continue
+    fi
+  fi
+
   echo "  $file: ok"
   verified=$((verified + 1))
 done
diff --git a/scripts/installers/linux.sh.in b/scripts/installers/linux.sh.in
deleted file mode 100644
index 5b53c02..0000000
--- a/scripts/installers/linux.sh.in
+++ /dev/null
@@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-# Zagan-Bet desktop installer for Linux.
-#
-# Verifies the app against its published SHA-256, installs it for the current
-# user and adds a launcher. Put the downloaded app next to this script, or run
-# the script on its own and it will fetch the matching binary.
-set -euo pipefail
-
-VERSION="__VERSION__"
-BINARY="__BINARY__"
-SHA256="__SHA256__"
-URL="__URL__"
-
-say() { printf '%s\n' "$*"; }
-die() { printf 'install: %s\n' "$*" >&2; exit 1; }
-
-command -v sha256sum >/dev/null 2>&1 || die "sha256sum is required"
-
-here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
-source_file=""
-for candidate in "$here/$BINARY" "./$BINARY" "$HOME/Downloads/$BINARY"; do
-  if [ -f "$candidate" ]; then
-    source_file=$candidate
-    break
-  fi
-done
-
-cleanup=""
-if [ -z "$source_file" ]; then
-  command -v curl >/dev/null 2>&1 || die "put $BINARY next to this installer, or install curl"
-  cleanup=$(mktemp) || die "cannot create a temporary file"
-  say "Downloading $BINARY..."
-  curl -fsSL --max-time 300 "$URL" -o "$cleanup" || die "download failed"
-  source_file=$cleanup
-fi
-trap 'if [ -n "$cleanup" ]; then rm -f "$cleanup"; fi' EXIT
-
-actual=$(sha256sum "$source_file" | awk '{print $1}')
-[ "$actual" = "$SHA256" ] || die "checksum mismatch: expected $SHA256, got $actual"
-
-bin_dir="${XDG_BIN_HOME:-$HOME/.local/bin}"
-data_dir="${XDG_DATA_HOME:-$HOME/.local/share}"
-app="$bin_dir/zagan-bet-gui"
-desktop_dir="$data_dir/applications"
-icon_dir="$data_dir/icons/hicolor/scalable/apps"
-
-mkdir -p "$bin_dir" "$desktop_dir" "$icon_dir"
-install -m 0755 "$source_file" "$app"
-
-cat > "$icon_dir/zagan-bet.svg" <<'ICON'
-__ICON__
-ICON
-
-cat > "$desktop_dir/zagan-bet.desktop" <<DESKTOP
-[Desktop Entry]
-Type=Application
-Name=Zagan-Bet
-Comment=Slots, roulette, blackjack and crash
-Exec=$app
-Icon=zagan-bet
-Terminal=false
-Categories=Game;
-DESKTOP
-chmod 0644 "$desktop_dir/zagan-bet.desktop" "$icon_dir/zagan-bet.svg"
-
-if command -v update-desktop-database >/dev/null 2>&1; then
-  update-desktop-database "$desktop_dir" >/dev/null 2>&1 || true
-fi
-if command -v gtk-update-icon-cache >/dev/null 2>&1; then
-  gtk-update-icon-cache -q "$data_dir/icons/hicolor" >/dev/null 2>&1 || true
-fi
-
-say "Installed Zagan-Bet $VERSION to $app"
-say "A launcher was added to your applications menu."
-case ":$PATH:" in
-  *":$bin_dir:"*) ;;
-  *) say "Add $bin_dir to PATH to start it as 'zagan-bet-gui'." ;;
-esac
diff --git a/scripts/installers/windows.ps1.in b/scripts/installers/windows.ps1.in
deleted file mode 100644
index 4b8e61d..0000000
--- a/scripts/installers/windows.ps1.in
+++ /dev/null
@@ -1,87 +0,0 @@
-# Zagan-Bet desktop installer for Windows.
-#
-# Verifies the app against its published SHA-256, installs it for the current
-# user and adds a Start-menu shortcut. Put the downloaded app next to this
-# script, or run the script on its own and it will fetch the matching binary.
-#
-# Run it with:
-#   powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-install.ps1
-# Add -NoPause to run it unattended.
-param([switch]$NoPause)
-
-$ErrorActionPreference = "Stop"
-
-$Version = "__VERSION__"
-$Binary  = "__BINARY__"
-$Sha256  = "__SHA256__"
-$Url     = "__URL__"
-
-function Finish([int]$Code) {
-    if (-not $NoPause) {
-        Read-Host "Press Enter to close" | Out-Null
-    }
-    exit $Code
-}
-
-function Stop-Install([string]$Message) {
-    Write-Host "install: $Message" -ForegroundColor Red
-    Finish 1
-}
-
-$here = Split-Path -Parent $MyInvocation.MyCommand.Path
-$candidates = @(
-    (Join-Path $here $Binary),
-    (Join-Path (Get-Location) $Binary),
-    (Join-Path $env:USERPROFILE "Downloads\$Binary")
-)
-$sourceFile = $null
-foreach ($candidate in $candidates) {
-    if (Test-Path -LiteralPath $candidate) {
-        $sourceFile = $candidate
-        break
-    }
-}
-
-$temporary = $null
-if (-not $sourceFile) {
-    $temporary = Join-Path ([System.IO.Path]::GetTempPath()) $Binary
-    Write-Host "Downloading $Binary..."
-    try {
-        Invoke-WebRequest -Uri $Url -OutFile $temporary -UseBasicParsing
-    } catch {
-        Stop-Install "download failed: $_"
-    }
-    $sourceFile = $temporary
-}
-
-try {
-    $actual = (Get-FileHash -LiteralPath $sourceFile -Algorithm SHA256).Hash.ToLowerInvariant()
-    if ($actual -ne $Sha256.ToLowerInvariant()) {
-        Stop-Install "checksum mismatch: expected $Sha256, got $actual"
-    }
-
-    $installDir = Join-Path $env:LOCALAPPDATA "Programs\Zagan-Bet"
-    New-Item -ItemType Directory -Force -Path $installDir | Out-Null
-    $target = Join-Path $installDir "zagan-bet-gui.exe"
-    Copy-Item -LiteralPath $sourceFile -Destination $target -Force
-
-    $startMenu = Join-Path $env:APPDATA "Microsoft\Windows\Start Menu\Programs"
-    New-Item -ItemType Directory -Force -Path $startMenu | Out-Null
-    $shortcutPath = Join-Path $startMenu "Zagan-Bet.lnk"
-    $shell = New-Object -ComObject WScript.Shell
-    $shortcut = $shell.CreateShortcut($shortcutPath)
-    $shortcut.TargetPath = $target
-    $shortcut.WorkingDirectory = $installDir
-    $shortcut.IconLocation = "$target,0"
-    $shortcut.Description = "Slots, roulette, blackjack and crash"
-    $shortcut.Save()
-
-    Write-Host "Installed Zagan-Bet $Version to $target"
-    Write-Host "A Start-menu shortcut was created."
-} finally {
-    if ($temporary -and (Test-Path -LiteralPath $temporary)) {
-        Remove-Item -LiteralPath $temporary -Force
-    }
-}
-
-Finish 0
diff --git a/scripts/publish.sh b/scripts/publish.sh
index 3a04631..fbcd588 100755
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -5,20 +5,19 @@
 #   zagan-bet-client-<version>-<platform>-<arch>[.exe]
 #   zagan-bet-server-<version>-<platform>-<arch>[.exe]
 #   zagan-bet-gui-<version>-<platform>-<arch>[.exe]
-#   zagan-bet-gui-<version>-<platform>-<arch>-install.sh
-#   zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
 #
 # Cargo always writes target/<triple>/<profile>/<bin>, so the rename happens
 # here after each build. The version comes from Cargo.toml.
 #
 # The GUI uses the workspace's `gui-release` profile (small, stripped, LTO).
-# The public git repository is the GPL source for these binaries, so publish
-# from a clean tree (or set ALLOW_DIRTY=1 for a preview).
+# The installers are stable site files (web/install.sh and web/install.ps1):
+# they ask web/latest.php for the newest build, so they are not regenerated
+# here. The public git repository is the GPL source for these binaries, so
+# publish from a clean tree (or set ALLOW_DIRTY=1 for a preview).
 #
 # Usage:
 #   ./scripts/publish.sh
 #   DEST=/srv/www/bin ./scripts/publish.sh
-#   URL_BASE=https://staging.example/ ./scripts/publish.sh
 set -euo pipefail
 
 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
@@ -31,22 +30,12 @@ if [ -z "${VERSION:-}" ]; then
 fi
 
 DEST=${DEST:-web/bin}
-URL_BASE=${URL_BASE:-https://zagan.2137697.xyz}
 
 if [ "${ALLOW_DIRTY:-0}" != "1" ] && [ -n "$(git status --porcelain)" ]; then
   echo "the working tree is dirty; commit the release first (or ALLOW_DIRTY=1)" >&2
   exit 1
 fi
 
-command -v python3 >/dev/null || {
-  echo "python3 is required to render the installers" >&2
-  exit 1
-}
-
-hash_of() {
-  sha256sum "$1" | awk '{print $1}'
-}
-
 publish() {
   local triple=$1 kind=$2 platform=$3 arch=$4
   local ext=""
@@ -85,23 +74,13 @@ publish_gui() {
 
   mkdir -p "$DEST/gui"
   install -m 0755 "$source" "$DEST/gui/$artifact"
-  local sha
-  sha=$(hash_of "$DEST/gui/$artifact")
   echo "    $DEST/gui/$artifact ($(du -h "$DEST/gui/$artifact" | cut -f1))"
-
-  if [ "$platform" = linux ]; then
-    python3 scripts/render-installer.py \
-      scripts/installers/linux.sh.in \
-      "$DEST/gui/zagan-bet-gui-$VERSION-linux-$arch-install.sh" \
-      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
-  elif [ "$platform" = windows ]; then
-    python3 scripts/render-installer.py \
-      scripts/installers/windows.ps1.in \
-      "$DEST/gui/zagan-bet-gui-$VERSION-windows-$arch-install.ps1" \
-      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
-  fi
 }
 
+rm web/bin/client/*
+rm web/bin/gui/*
+rm web/bin/server/*
+
 publish_gui x86_64-unknown-linux-gnu linux x86_64
 publish_gui x86_64-pc-windows-gnu windows x86_64
 
diff --git a/scripts/render-installer.py b/scripts/render-installer.py
deleted file mode 100644
index 1a00551..0000000
--- a/scripts/render-installer.py
+++ /dev/null
@@ -1,49 +0,0 @@
-#!/usr/bin/env python3
-"""Fill an installer template with one published artifact's details.
-
-Usage: render-installer.py <template> <output> <version> <binary> <sha256> <url>
-
-The Linux template embeds the application icon so the installer works offline.
-"""
-
-from __future__ import annotations
-
-import pathlib
-import sys
-
-
-def main(argv: list[str]) -> int:
-    if len(argv) != 7:
-        print(
-            "usage: render-installer.py <template> <output> <version> "
-            "<binary> <sha256> <url>",
-            file=sys.stderr,
-        )
-        return 2
-
-    template, output, version, binary, sha256, url = argv[1:]
-    root = pathlib.Path(__file__).resolve().parent.parent
-    icon = (root / "gui" / "assets" / "zagan-bet.svg").read_text()
-
-    text = pathlib.Path(template).read_text()
-    replacements = {
-        "__VERSION__": version,
-        "__BINARY__": binary,
-        "__SHA256__": sha256,
-        "__URL__": url,
-        "__ICON__": icon.rstrip("\n"),
-    }
-    for placeholder, value in replacements.items():
-        text = text.replace(placeholder, value)
-
-    destination = pathlib.Path(output)
-    destination.write_text(text)
-    if destination.suffix == ".sh":
-        destination.chmod(0o755)
-
-    print(f"    {destination} ({destination.stat().st_size} bytes)")
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main(sys.argv))
diff --git a/web/README.md b/web/README.md
index 1ee794f..13f5f85 100644
--- a/web/README.md
+++ b/web/README.md
@@ -8,10 +8,14 @@ browser defaults: black text, blue links, monospace checksums. PHP 8.0+.
 
 ```
 web/
-  index.php
-  bin/gui/       served at /bin/gui/... (app and installers)
-  bin/client/    served at /bin/client/...
-  bin/server/    served at /bin/server/...
+  index.php      the download page
+  latest.php     newest-version feed for the installers
+  releases.php   shared scanner and hash cache
+  install.sh     stable Linux installer
+  install.ps1    stable Windows installer
+  bin/gui/       apps, served at /bin/gui/...
+  bin/client/    terminal clients
+  bin/server/    servers
 ```
 
 Serve `web/` as the document root. Binaries in `bin/` are gitignored.
@@ -23,8 +27,6 @@ those directories is ignored.
 
 ```
 bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
-bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
-bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
 bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
 bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
 ```
@@ -32,12 +34,14 @@ bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
 `<version>` is `MAJOR.MINOR.PATCH`, `<platform>` is `linux`, `windows` or
 `macos`, `<arch>` is `x86_64`, `i686` or `aarch64`.
 
-The installers are generated next to their app. They embed the app's SHA-256,
-check the file (or download it) and install it for the current user: Linux
+The installers are not versioned. They read `latest.php`, pick the newest build
+for the machine, verify its SHA-256 and install it for the current user: Linux
 writes `~/.local/bin/zagan-bet-gui` plus a `.desktop` launcher, Windows writes
-`%LOCALAPPDATA%\Programs\Zagan-Bet` plus a Start-menu shortcut. The Windows
-installer waits for Enter before closing (`-NoPause` for automation). The page
-links the public git repository for the GPL corresponding source.
+`%LOCALAPPDATA%\Programs\Zagan-Bet` plus a Start-menu shortcut. Updating the
+site only needs `publish.sh`; the installer links never change. Set
+`ZAGAN_SITE` (Linux) or `-Site` (Windows) to test against a staging site. The
+Windows installer waits for Enter before closing (`-NoPause` for automation).
+The page links the public git repository for the GPL corresponding source.
 
 ## Publishing a build
 
@@ -49,19 +53,17 @@ From the repository root:
 
 It reads the version from `Cargo.toml`, builds every artifact and installs
 them under `web/bin` with the names above. The GUI is built with the
-workspace's `gui-release` profile (LTO, stripped) and the installers are
-rendered with Python 3 and the published SHA-256. Run it from a clean tree so
+workspace's `gui-release` profile (LTO, stripped). Run it from a clean tree so
 the release commit is the source the page links to. Override the destination
-with `DEST=/srv/www/bin ./scripts/publish.sh`, and the download origin baked
-into the installers with `URL_BASE=https://staging.example/ ./scripts/publish.sh`.
-`ALLOW_DIRTY=1` skips the clean-tree check for a preview.
+with `DEST=/srv/www/bin ./scripts/publish.sh`; `ALLOW_DIRTY=1` skips the
+clean-tree check for a preview. The installers are static and need no
+regeneration.
 
 Builds are per target triple, so these must be installed:
 `x86_64-unknown-linux-gnu`, `i686-unknown-linux-gnu` and
 `x86_64-pc-windows-gnu`, plus the mingw linker for the Windows build. Client
 builds always pass `--no-default-features`, which drops the server's OpenSSL
-dependency; the client is rustls-only. The GUI needs Python 3 at publish time
-for the installer templates in `scripts/installers/`.
+dependency; the client is rustls-only.
 
 Cargo itself cannot produce these names: it always writes
 `target/<triple>/release/<bin>`. The script renames after each build.
diff --git a/web/index.php b/web/index.php
index 77edf95..3f0ab92 100644
--- a/web/index.php
+++ b/web/index.php
@@ -1,63 +1,34 @@
 <?php
 declare(strict_types=1);
 
+require __DIR__ . '/releases.php';
+
 /**
  * zagan.bet download page.
  *
- * Scans ./bin/{gui,client,server} and renders every build it finds, with its
- * version, size and SHA-256. The GPL source link points at the public git
- * repository. No database, no JavaScript, no dependencies.
- *
- * Expected file names (anything else is ignored):
- *
- *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
- *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
- *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
- *   bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
- *   bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
- *
- * <version> is MAJOR.MINOR.PATCH, <platform> is linux|windows|macos and
- * <arch> is x86_64|i686|aarch64. Example:
- *
- *   bin/gui/zagan-bet-gui-4.3.0-linux-x86_64
- *   bin/client/zagan-bet-client-4.3.0-linux-x86_64
- *
- * SHA-256 values are cached in a JSON file keyed on size and mtime, so a file
- * is only re-read when it changes. The cache lives in the system temp
- * directory by default (the web root is often not writable by the PHP user);
- * set ZAGAN_HASH_CACHE to put it somewhere else.
+ * Lists every published app, terminal client and server, with version, size
+ * and SHA-256. The installers are stable links that ask latest.php for the
+ * newest build. The GPL source link points at the public git repository. No
+ * database, no JavaScript, no dependencies.
  */
 
-const KINDS = [
-    'gui' => [
-        'title' => 'Desktop app',
-        'hint' => 'Windows 10 or newer, or a Linux desktop. No terminal needed.',
-    ],
-    'client' => [
-        'title' => 'Client',
-        'hint' => 'Needs a terminal of at least 80×24 cells.',
-    ],
-    'server' => [
-        'title' => 'Server',
-        'hint' => 'Generates its own TLS identity on first run.',
-    ],
-];
+$scan = scan_releases();
+$releases = $scan['releases'];
+$newest = $scan['newest_mtime'];
 
-const PLATFORMS = [
-    'linux' => 'Linux',
-    'windows' => 'Windows',
-    'macos' => 'macOS',
-];
+$base = rtrim(str_replace('\\', '/', dirname($_SERVER['SCRIPT_NAME'] ?? '/')), '/');
+if ($base === '.' || $base === '/') {
+    $base = '';
+}
 
-const ARCHES = [
-    'x86_64' => '64-bit',
-    'i686' => '32-bit',
-    'aarch64' => 'ARM64',
-];
+foreach ($releases as $kind => &$found) {
+    foreach ($found as &$release) {
+        $release['href'] = $base . '/bin/' . $kind . '/' . rawurlencode($release['file']);
+    }
+}
+unset($found, $release);
 
-// Newest version first, then 64-bit builds before 32-bit.
-const PLATFORM_ORDER = ['linux' => 0, 'windows' => 1, 'macos' => 2];
-const ARCH_ORDER = ['x86_64' => 0, 'aarch64' => 1, 'i686' => 2];
+$all = array_merge($releases['gui'], $releases['client'], $releases['server']);
 
 function e(?string $value): string
 {
@@ -74,220 +45,6 @@ function human_size(int $bytes): string
     }
     return $bytes . ' B';
 }
-
-/**
- * Hash to use for a published file, reusing the cached value when the file has
- * not changed since it was hashed.
- *
- * A cached hash is valid only when the size and mtime still match and the hash
- * was taken at or after the file's mtime, so a restored or touched file is
- * re-read.
- *
- * @param array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} $cache
- */
-function cached_hash(
-    string $key,
-    string $path,
-    int $size,
-    int $mtime,
-    array &$cache,
-    bool &$dirty
-): ?string {
-    $entry = $cache['files'][$key] ?? null;
-    if (
-        is_array($entry)
-        && ($entry['size'] ?? null) === $size
-        && ($entry['mtime'] ?? null) === $mtime
-        && (int) ($entry['hashed_at'] ?? 0) >= $mtime
-        && isset($entry['sha256'])
-        && is_string($entry['sha256'])
-        && preg_match('/\A[0-9a-f]{64}\z/', $entry['sha256']) === 1
-    ) {
-        return $entry['sha256'];
-    }
-
-    $hash = hash_file('sha256', $path);
-    if ($hash === false) {
-        return null;
-    }
-
-    $cache['files'][$key] = [
-        'size' => $size,
-        'mtime' => $mtime,
-        'sha256' => $hash,
-        'hashed_at' => time(),
-    ];
-    $dirty = true;
-
-    return $hash;
-}
-
-/** @return array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} */
-function load_hash_cache(string $path): array
-{
-    $raw = @file_get_contents($path);
-    if ($raw === false || $raw === '') {
-        return ['files' => []];
-    }
-    $decoded = json_decode($raw, true);
-    if (!is_array($decoded) || !isset($decoded['files']) || !is_array($decoded['files'])) {
-        return ['files' => []];
-    }
-
-    return ['files' => $decoded['files']];
-}
-
-/**
- * Best effort: a read-only web root, a full disk or a racing writer must never
- * break the page, so failures are ignored and the next request recomputes.
- *
- * @param array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} $cache
- */
-function save_hash_cache(string $path, array $cache): void
-{
-    $json = json_encode($cache, JSON_UNESCAPED_SLASHES);
-    if ($json === false) {
-        return;
-    }
-    $directory = dirname($path);
-    $temporary = @tempnam($directory, '.zagan-hashes-');
-    if ($temporary === false) {
-        return;
-    }
-    if (@file_put_contents($temporary, $json, LOCK_EX) === false || !@rename($temporary, $path)) {
-        @unlink($temporary);
-    }
-}
-
-/**
- * @return array{version:string,platform:string,arch:string,file:string,size:int,mtime:int,sha256:string}|null
- */
-function read_release(
-    string $kind,
-    string $directory,
-    string $entry,
-    array &$cache,
-    bool &$dirty
-): ?array {
-    $pattern = '/^zagan-bet-' . preg_quote($kind, '/')
-        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(-install\.sh|-install\.ps1|\.exe)?$/i';
-    if (preg_match($pattern, $entry, $matches) !== 1) {
-        return null;
-    }
-
-    $realDirectory = realpath($directory);
-    $real = realpath($directory . '/' . $entry);
-    if ($realDirectory === false || $real === false) {
-        return null;
-    }
-    // Never serve anything that resolves outside the published directory.
-    if (!str_starts_with($real, $realDirectory . DIRECTORY_SEPARATOR)) {
-        return null;
-    }
-    if (!is_file($real)) {
-        return null;
-    }
-
-    $size = filesize($real);
-    $mtime = filemtime($real);
-    if ($size === false || $mtime === false) {
-        return null;
-    }
-
-    $hash = cached_hash($kind . '/' . $entry, $real, $size, $mtime, $cache, $dirty);
-    if ($hash === null) {
-        return null;
-    }
-
-    $suffix = strtolower($matches[4] ?? '');
-    $variant = str_starts_with($suffix, '-install.') ? 'installer' : 'binary';
-
-    return [
-        'version' => $matches[1],
-        'platform' => strtolower($matches[2]),
-        'arch' => strtolower($matches[3]),
-        'variant' => $variant,
-        'file' => $entry,
-        'size' => $size,
-        'mtime' => $mtime,
-        'sha256' => $hash,
-    ];
-}
-
-$base = rtrim(str_replace('\\', '/', dirname($_SERVER['SCRIPT_NAME'] ?? '/')), '/');
-if ($base === '.' || $base === '/') {
-    $base = '';
-}
-
-$cachePath = getenv('ZAGAN_HASH_CACHE');
-if (!is_string($cachePath) || $cachePath === '') {
-    $cachePath = rtrim(sys_get_temp_dir(), DIRECTORY_SEPARATOR)
-        . DIRECTORY_SEPARATOR . 'zagan-bet-hashes-'
-        . substr(hash('sha256', __DIR__), 0, 16) . '.json';
-}
-$cache = load_hash_cache($cachePath);
-$cacheDirty = false;
-$seen = [];
-
-$releases = [];
-$newest = 0;
-
-foreach (KINDS as $kind => $meta) {
-    $found = [];
-    $directory = __DIR__ . '/bin/' . $kind;
-
-    if (is_dir($directory)) {
-        $entries = scandir($directory);
-        if ($entries !== false) {
-            foreach ($entries as $entry) {
-                if ($entry === '.' || $entry === '..') {
-                    continue;
-                }
-                $release = read_release($kind, $directory, $entry, $cache, $cacheDirty);
-                if ($release === null) {
-                    continue;
-                }
-                $seen[$kind . '/' . $entry] = true;
-                $release['href'] = $base . '/bin/' . $kind . '/' . rawurlencode($release['file']);
-                $found[] = $release;
-                $newest = max($newest, $release['mtime']);
-            }
-        }
-    }
-
-    usort($found, static function (array $a, array $b): int {
-        $byVersion = version_compare($b['version'], $a['version']);
-        if ($byVersion !== 0) {
-            return $byVersion;
-        }
-        $byPlatform = (PLATFORM_ORDER[$a['platform']] ?? 9) <=> (PLATFORM_ORDER[$b['platform']] ?? 9);
-        if ($byPlatform !== 0) {
-            return $byPlatform;
-        }
-        $byArch = (ARCH_ORDER[$a['arch']] ?? 9) <=> (ARCH_ORDER[$b['arch']] ?? 9);
-        if ($byArch !== 0) {
-            return $byArch;
-        }
-        $byVariant = ($a['variant'] === 'installer' ? 1 : 0) <=> ($b['variant'] === 'installer' ? 1 : 0);
-        if ($byVariant !== 0) {
-            return $byVariant;
-        }
-        return strcmp($a['file'], $b['file']);
-    });
-
-    $releases[$kind] = $found;
-}
-
-// Drop cache entries for files that are no longer published.
-foreach (array_keys($cache['files']) as $key) {
-    if (!isset($seen[$key])) {
-        unset($cache['files'][$key]);
-        $cacheDirty = true;
-    }
-}
-if ($cacheDirty) {
-    save_hash_cache($cachePath, $cache);
-}
 ?>
 <!doctype html>
 <html lang="en">
@@ -308,24 +65,20 @@ if ($cacheDirty) {
 
 <h2>Desktop app</h2>
 <p>Windows 10 or newer, or a Linux desktop. No terminal needed.</p>
-<?php $guiBinaries = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'binary')); ?>
-<?php $guiInstallers = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'installer')); ?>
-<?php if ($guiBinaries === []): ?>
+<?php if ($releases['gui'] === []): ?>
 <p>Nothing published yet.</p>
 <?php else: ?>
 <ul>
-<?php foreach ($guiBinaries as $release): ?>
+<?php foreach ($releases['gui'] as $release): ?>
 <li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?><?php if (isset(ARCHES[$release['arch']])): ?> (<?= e(ARCHES[$release['arch']]) ?>)<?php endif; ?> v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
 <?php endforeach; ?>
 </ul>
-<?php endif; ?>
-<?php if ($guiInstallers !== []): ?>
+
 <h3>Installers</h3>
-<p>The installer checks the download, installs Zagan-Bet for your user and adds it to your programs. Run it next to a downloaded app, or on its own to fetch one.</p>
+<p>Downloads the newest build, checks its SHA-256 and installs it for your user.</p>
 <ul>
-<?php foreach ($guiInstallers as $release): ?>
-<li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?> installer (<?= str_ends_with($release['file'], '.ps1') ? 'PowerShell' : 'bash' ?>) v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
-<?php endforeach; ?>
+<li><a href="<?= e($base) ?>/install.sh" download>Linux installer (bash)</a></li>
+<li><a href="<?= e($base) ?>/install.ps1" download>Windows installer (PowerShell)</a></li>
 </ul>
 <?php endif; ?>
 
@@ -353,7 +106,6 @@ if ($cacheDirty) {
 </ul>
 <?php endif; ?>
 
-<?php $all = array_merge($releases['gui'], $releases['client'], $releases['server']); ?>
 <?php if ($all !== []): ?>
 <h2>SHA-256</h2>
 <p>On Linux use <code>sha256sum &lt;file&gt;</code>. On Windows use <code>Get-FileHash &lt;file&gt;</code>.</p>
@@ -372,11 +124,11 @@ echo e($sums);
 
 <h2>Running it</h2>
 <p>Desktop app on Linux:</p>
-<pre><code>chmod +x zagan-bet-gui-*-linux-x86_64-install.sh
-./zagan-bet-gui-*-linux-x86_64-install.sh</code></pre>
+<pre><code>chmod +x install.sh
+./install.sh</code></pre>
 <p>Desktop app on Windows (PowerShell):</p>
-<pre><code>powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-windows-x86_64-install.ps1</code></pre>
-<p>The installers verify the SHA-256 before installing. You can also run the downloaded app directly.</p>
+<pre><code>powershell -ExecutionPolicy Bypass -File .\install.ps1</code></pre>
+<p>The installers fetch the newest build, verify its SHA-256, install it for your user and add a launcher.</p>
 <p>Terminal client:</p>
 <pre><code>chmod +x &lt;downloaded-client&gt;
 ./&lt;downloaded-client&gt;</code></pre>
diff --git a/web/install.ps1 b/web/install.ps1
new file mode 100644
index 0000000..92eef83
--- /dev/null
+++ b/web/install.ps1
@@ -0,0 +1,108 @@
+# Zagan-Bet installer for Windows.
+#
+# Asks the site which build is newest, verifies its SHA-256, installs it for
+# the current user and adds a Start-menu shortcut. Point it at a staging site
+# with -Site http://127.0.0.1:8899; add -NoPause for automation.
+#
+# Run it with:
+#   powershell -ExecutionPolicy Bypass -File .\install.ps1
+param(
+    [string]$Site = "https://zagan.2137697.xyz",
+    [switch]$NoPause
+)
+
+$ErrorActionPreference = "Stop"
+
+function Finish([int]$Code) {
+    if (-not $NoPause) {
+        Read-Host "Press Enter to close" | Out-Null
+    }
+    exit $Code
+}
+
+function Stop-Install([string]$Message) {
+    Write-Host "install: $Message" -ForegroundColor Red
+    Finish 1
+}
+
+try {
+    $latest = (Invoke-WebRequest -Uri "$Site/latest.php" -UseBasicParsing).Content
+} catch {
+    Stop-Install "could not read $Site/latest.php: $_"
+}
+
+$line = ($latest -split "`r?`n") |
+    Where-Object { $_ -match '^gui windows x86_64 ' } |
+    Select-Object -First 1
+if (-not $line) {
+    Stop-Install "no Windows build is published yet"
+}
+
+$parts = $line.Trim() -split '\s+'
+if ($parts.Count -lt 6) {
+    Stop-Install "the latest-build file is malformed"
+}
+$Version = $parts[3]
+$Binary = $parts[4]
+$Sha256 = $parts[5]
+$Url = "$Site/bin/gui/$Binary"
+
+Write-Host "Newest Zagan-Bet is $Version."
+
+$here = Split-Path -Parent $MyInvocation.MyCommand.Path
+$candidates = @(
+    (Join-Path $here $Binary),
+    (Join-Path (Get-Location) $Binary),
+    (Join-Path $env:USERPROFILE "Downloads\$Binary")
+)
+$sourceFile = $null
+foreach ($candidate in $candidates) {
+    if (Test-Path -LiteralPath $candidate) {
+        $sourceFile = $candidate
+        break
+    }
+}
+
+$temporary = $null
+if (-not $sourceFile) {
+    $temporary = Join-Path ([System.IO.Path]::GetTempPath()) $Binary
+    Write-Host "Downloading $Binary..."
+    try {
+        Invoke-WebRequest -Uri $Url -OutFile $temporary -UseBasicParsing
+    } catch {
+        Stop-Install "download failed: $_"
+    }
+    $sourceFile = $temporary
+}
+
+try {
+    $actual = (Get-FileHash -LiteralPath $sourceFile -Algorithm SHA256).Hash.ToLowerInvariant()
+    if ($actual -ne $Sha256.ToLowerInvariant()) {
+        Stop-Install "checksum mismatch: expected $Sha256, got $actual"
+    }
+
+    $installDir = Join-Path $env:LOCALAPPDATA "Programs\Zagan-Bet"
+    New-Item -ItemType Directory -Force -Path $installDir | Out-Null
+    $target = Join-Path $installDir "zagan-bet-gui.exe"
+    Copy-Item -LiteralPath $sourceFile -Destination $target -Force
+
+    $startMenu = Join-Path $env:APPDATA "Microsoft\Windows\Start Menu\Programs"
+    New-Item -ItemType Directory -Force -Path $startMenu | Out-Null
+    $shortcutPath = Join-Path $startMenu "Zagan-Bet.lnk"
+    $shell = New-Object -ComObject WScript.Shell
+    $shortcut = $shell.CreateShortcut($shortcutPath)
+    $shortcut.TargetPath = $target
+    $shortcut.WorkingDirectory = $installDir
+    $shortcut.IconLocation = "$target,0"
+    $shortcut.Description = "Slots, roulette, blackjack and crash"
+    $shortcut.Save()
+
+    Write-Host "Installed Zagan-Bet $Version to $target"
+    Write-Host "A Start-menu shortcut was created."
+} finally {
+    if ($temporary -and (Test-Path -LiteralPath $temporary)) {
+        Remove-Item -LiteralPath $temporary -Force
+    }
+}
+
+Finish 0
diff --git a/web/install.sh b/web/install.sh
new file mode 100644
index 0000000..998b262
--- /dev/null
+++ b/web/install.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# Zagan-Bet installer for Linux.
+#
+# Asks the site which build is newest, verifies its SHA-256, installs it for
+# the current user and adds a launcher. Point it at a staging site with
+# ZAGAN_SITE=http://127.0.0.1:8899.
+set -euo pipefail
+
+SITE=${ZAGAN_SITE:-https://zagan.2137697.xyz}
+PLATFORM=linux
+ARCH=x86_64
+
+say() { printf '%s\n' "$*"; }
+die() { printf 'install: %s\n' "$*" >&2; exit 1; }
+
+command -v curl >/dev/null 2>&1 || die "curl is required"
+command -v sha256sum >/dev/null 2>&1 || die "sha256sum is required"
+
+latest=$(curl -fsSL --max-time 30 "$SITE/latest.php") \
+  || die "could not read $SITE/latest.php"
+line=$(printf '%s\n' "$latest" \
+  | awk -v p="$PLATFORM" -v a="$ARCH" '$1 == "gui" && $2 == p && $3 == a { print; exit }')
+[ -n "$line" ] || die "no Linux build is published yet"
+
+version=$(printf '%s\n' "$line" | awk '{print $4}')
+binary=$(printf '%s\n' "$line" | awk '{print $5}')
+sha=$(printf '%s\n' "$line" | awk '{print $6}')
+[ -n "$version" ] && [ -n "$binary" ] && [ -n "$sha" ] \
+  || die "the latest-build file is malformed"
+
+say "Newest Zagan-Bet is $version."
+
+here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+source_file=""
+for candidate in "$here/$binary" "./$binary" "$HOME/Downloads/$binary"; do
+  if [ -f "$candidate" ]; then
+    source_file=$candidate
+    break
+  fi
+done
+
+cleanup=""
+if [ -z "$source_file" ]; then
+  cleanup=$(mktemp) || die "cannot create a temporary file"
+  say "Downloading $binary..."
+  curl -fsSL --max-time 300 "$SITE/bin/gui/$binary" -o "$cleanup" \
+    || die "download failed"
+  source_file=$cleanup
+fi
+trap 'if [ -n "$cleanup" ]; then rm -f "$cleanup"; fi' EXIT
+
+actual=$(sha256sum "$source_file" | awk '{print $1}')
+[ "$actual" = "$sha" ] \
+  || die "checksum mismatch: expected $sha, got $actual"
+
+bin_dir="${XDG_BIN_HOME:-$HOME/.local/bin}"
+data_dir="${XDG_DATA_HOME:-$HOME/.local/share}"
+app="$bin_dir/zagan-bet-gui"
+desktop_dir="$data_dir/applications"
+icon_dir="$data_dir/icons/hicolor/scalable/apps"
+
+mkdir -p "$bin_dir" "$desktop_dir" "$icon_dir"
+install -m 0755 "$source_file" "$app"
+
+cat > "$icon_dir/zagan-bet.svg" <<'ICON'
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <rect width="64" height="64" rx="14" fill="#0a0e12"/>
+  <rect x="9" y="9" width="46" height="46" rx="10" fill="#0f1a14" stroke="#1f7d52" stroke-width="2"/>
+  <path d="M22 20h20L22 44h20" fill="none" stroke="#4ec27b" stroke-width="6"
+        stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
+ICON
+
+cat > "$desktop_dir/zagan-bet.desktop" <<DESKTOP
+[Desktop Entry]
+Type=Application
+Name=Zagan-Bet
+Comment=Slots, roulette, blackjack and crash
+Exec=$app
+Icon=zagan-bet
+Terminal=false
+Categories=Game;
+DESKTOP
+chmod 0644 "$desktop_dir/zagan-bet.desktop" "$icon_dir/zagan-bet.svg"
+
+if command -v update-desktop-database >/dev/null 2>&1; then
+  update-desktop-database "$desktop_dir" >/dev/null 2>&1 || true
+fi
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -q "$data_dir/icons/hicolor" >/dev/null 2>&1 || true
+fi
+
+say "Installed Zagan-Bet $version to $app"
+say "A launcher was added to your applications menu."
+case ":$PATH:" in
+  *":$bin_dir:"*) ;;
+  *) say "Add $bin_dir to PATH to start it as 'zagan-bet-gui'." ;;
+esac
diff --git a/web/latest.php b/web/latest.php
new file mode 100644
index 0000000..3e7368c
--- /dev/null
+++ b/web/latest.php
@@ -0,0 +1,50 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * The newest published build, for install.sh and install.ps1.
+ *
+ * Plain text, one record per line, so both a shell script and PowerShell can
+ * parse it without a JSON library:
+ *
+ *   version 4.4.0
+ *   gui linux x86_64 4.4.0 zagan-bet-gui-4.4.0-linux-x86_64 <sha256>
+ *   gui windows x86_64 4.4.0 zagan-bet-gui-4.4.0-windows-x86_64.exe <sha256>
+ *   client ...
+ *   server ...
+ *
+ * Only the newest version is listed. The installers verify the SHA-256 they
+ * read here against the bytes they download.
+ */
+
+require __DIR__ . '/releases.php';
+
+$scan = scan_releases();
+$all = array_merge(
+    $scan['releases']['gui'],
+    $scan['releases']['client'],
+    $scan['releases']['server']
+);
+
+$newest = '0.0.0';
+foreach ($all as $release) {
+    if (version_compare($release['version'], $newest, '>')) {
+        $newest = $release['version'];
+    }
+}
+
+header('Content-Type: text/plain; charset=utf-8');
+header('Cache-Control: no-cache');
+
+echo 'version ' . $newest . "\n";
+foreach ($all as $release) {
+    if ($release['version'] !== $newest) {
+        continue;
+    }
+    echo $release['kind'] . ' '
+        . $release['platform'] . ' '
+        . $release['arch'] . ' '
+        . $release['version'] . ' '
+        . $release['file'] . ' '
+        . $release['sha256'] . "\n";
+}
diff --git a/web/releases.php b/web/releases.php
new file mode 100644
index 0000000..b9c7284
--- /dev/null
+++ b/web/releases.php
@@ -0,0 +1,262 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Shared release scanning for the download page and the latest-build endpoint.
+ *
+ * Expected file names under bin/<kind>/ (anything else is ignored):
+ *
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+ *   bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
+ *   bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
+ *
+ * <version> is MAJOR.MINOR.PATCH, <platform> is linux|windows|macos and
+ * <arch> is x86_64|i686|aarch64.
+ *
+ * SHA-256 values are cached in a JSON file keyed on size and mtime, so a file
+ * is only re-read when it changes. The cache lives in the system temp
+ * directory by default (the web root is often not writable by the PHP user);
+ * set ZAGAN_HASH_CACHE to put it somewhere else.
+ */
+
+const KINDS = [
+    'gui' => [
+        'title' => 'Desktop app',
+        'hint' => 'Windows 10 or newer, or a Linux desktop. No terminal needed.',
+    ],
+    'client' => [
+        'title' => 'Client',
+        'hint' => 'Needs a terminal of at least 80×24 cells.',
+    ],
+    'server' => [
+        'title' => 'Server',
+        'hint' => 'Generates its own TLS identity on first run.',
+    ],
+];
+
+const PLATFORMS = [
+    'linux' => 'Linux',
+    'windows' => 'Windows',
+    'macos' => 'macOS',
+];
+
+const ARCHES = [
+    'x86_64' => '64-bit',
+    'i686' => '32-bit',
+    'aarch64' => 'ARM64',
+];
+
+// Newest version first, then 64-bit builds before 32-bit.
+const PLATFORM_ORDER = ['linux' => 0, 'windows' => 1, 'macos' => 2];
+const ARCH_ORDER = ['x86_64' => 0, 'aarch64' => 1, 'i686' => 2];
+
+/**
+ * Hash to use for a published file, reusing the cached value when the file has
+ * not changed since it was hashed.
+ *
+ * A cached hash is valid only when the size and mtime still match and the hash
+ * was taken at or after the file's mtime, so a restored or touched file is
+ * re-read.
+ *
+ * @param array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} $cache
+ */
+function cached_hash(
+    string $key,
+    string $path,
+    int $size,
+    int $mtime,
+    array &$cache,
+    bool &$dirty
+): ?string {
+    $entry = $cache['files'][$key] ?? null;
+    if (
+        is_array($entry)
+        && ($entry['size'] ?? null) === $size
+        && ($entry['mtime'] ?? null) === $mtime
+        && (int) ($entry['hashed_at'] ?? 0) >= $mtime
+        && isset($entry['sha256'])
+        && is_string($entry['sha256'])
+        && preg_match('/\A[0-9a-f]{64}\z/', $entry['sha256']) === 1
+    ) {
+        return $entry['sha256'];
+    }
+
+    $hash = hash_file('sha256', $path);
+    if ($hash === false) {
+        return null;
+    }
+
+    $cache['files'][$key] = [
+        'size' => $size,
+        'mtime' => $mtime,
+        'sha256' => $hash,
+        'hashed_at' => time(),
+    ];
+    $dirty = true;
+
+    return $hash;
+}
+
+/** @return array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} */
+function load_hash_cache(string $path): array
+{
+    $raw = @file_get_contents($path);
+    if ($raw === false || $raw === '') {
+        return ['files' => []];
+    }
+    $decoded = json_decode($raw, true);
+    if (!is_array($decoded) || !isset($decoded['files']) || !is_array($decoded['files'])) {
+        return ['files' => []];
+    }
+
+    return ['files' => $decoded['files']];
+}
+
+/**
+ * Best effort: a read-only web root, a full disk or a racing writer must never
+ * break the page, so failures are ignored and the next request recomputes.
+ *
+ * @param array{files:array<string,array{size:int,mtime:int,sha256:string,hashed_at:int}>} $cache
+ */
+function save_hash_cache(string $path, array $cache): void
+{
+    $json = json_encode($cache, JSON_UNESCAPED_SLASHES);
+    if ($json === false) {
+        return;
+    }
+    $directory = dirname($path);
+    $temporary = @tempnam($directory, '.zagan-hashes-');
+    if ($temporary === false) {
+        return;
+    }
+    if (@file_put_contents($temporary, $json, LOCK_EX) === false || !@rename($temporary, $path)) {
+        @unlink($temporary);
+    }
+}
+
+/**
+ * @return array{kind:string,version:string,platform:string,arch:string,file:string,size:int,mtime:int,sha256:string}|null
+ */
+function read_release(
+    string $kind,
+    string $directory,
+    string $entry,
+    array &$cache,
+    bool &$dirty
+): ?array {
+    $pattern = '/^zagan-bet-' . preg_quote($kind, '/')
+        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(\.exe)?$/i';
+    if (preg_match($pattern, $entry, $matches) !== 1) {
+        return null;
+    }
+
+    $realDirectory = realpath($directory);
+    $real = realpath($directory . '/' . $entry);
+    if ($realDirectory === false || $real === false) {
+        return null;
+    }
+    // Never serve anything that resolves outside the published directory.
+    if (!str_starts_with($real, $realDirectory . DIRECTORY_SEPARATOR)) {
+        return null;
+    }
+    if (!is_file($real)) {
+        return null;
+    }
+
+    $size = filesize($real);
+    $mtime = filemtime($real);
+    if ($size === false || $mtime === false) {
+        return null;
+    }
+
+    $hash = cached_hash($kind . '/' . $entry, $real, $size, $mtime, $cache, $dirty);
+    if ($hash === null) {
+        return null;
+    }
+
+    return [
+        'kind' => $kind,
+        'version' => $matches[1],
+        'platform' => strtolower($matches[2]),
+        'arch' => strtolower($matches[3]),
+        'file' => $entry,
+        'size' => $size,
+        'mtime' => $mtime,
+        'sha256' => $hash,
+    ];
+}
+
+/**
+ * Scan every kind and return its releases, newest version first.
+ *
+ * @return array{releases:array<string,array<int,array{kind:string,version:string,platform:string,arch:string,file:string,size:int,mtime:int,sha256:string}>>,newest_mtime:int}
+ */
+function scan_releases(): array
+{
+    $cachePath = getenv('ZAGAN_HASH_CACHE');
+    if (!is_string($cachePath) || $cachePath === '') {
+        $cachePath = rtrim(sys_get_temp_dir(), DIRECTORY_SEPARATOR)
+            . DIRECTORY_SEPARATOR . 'zagan-bet-hashes-'
+            . substr(hash('sha256', __DIR__), 0, 16) . '.json';
+    }
+    $cache = load_hash_cache($cachePath);
+    $dirty = false;
+    $seen = [];
+
+    $releases = [];
+    $newestMtime = 0;
+
+    foreach (KINDS as $kind => $meta) {
+        $found = [];
+        $directory = __DIR__ . '/bin/' . $kind;
+
+        if (is_dir($directory)) {
+            $entries = scandir($directory);
+            if ($entries !== false) {
+                foreach ($entries as $entry) {
+                    if ($entry === '.' || $entry === '..') {
+                        continue;
+                    }
+                    $release = read_release($kind, $directory, $entry, $cache, $dirty);
+                    if ($release === null) {
+                        continue;
+                    }
+                    $seen[$kind . '/' . $entry] = true;
+                    $found[] = $release;
+                    $newestMtime = max($newestMtime, $release['mtime']);
+                }
+            }
+        }
+
+        usort($found, static function (array $a, array $b): int {
+            $byVersion = version_compare($b['version'], $a['version']);
+            if ($byVersion !== 0) {
+                return $byVersion;
+            }
+            $byPlatform = (PLATFORM_ORDER[$a['platform']] ?? 9) <=> (PLATFORM_ORDER[$b['platform']] ?? 9);
+            if ($byPlatform !== 0) {
+                return $byPlatform;
+            }
+            $byArch = (ARCH_ORDER[$a['arch']] ?? 9) <=> (ARCH_ORDER[$b['arch']] ?? 9);
+            if ($byArch !== 0) {
+                return $byArch;
+            }
+            return strcmp($a['file'], $b['file']);
+        });
+
+        $releases[$kind] = $found;
+    }
+
+    // Drop cache entries for files that are no longer published.
+    foreach (array_keys($cache['files']) as $key) {
+        if (!isset($seen[$key])) {
+            unset($cache['files'][$key]);
+            $dirty = true;
+        }
+    }
+    if ($dirty) {
+        save_hash_cache($cachePath, $cache);
+    }
+
+    return ['releases' => $releases, 'newest_mtime' => $newestMtime];
+}
-- 
cgit v1.2.3