From 7830b3c5e89f0339949940b8986bf4849ad7f223 Mon Sep 17 00:00:00 2001
From: salmonik <salmonik@tuta.io>
Date: Sun, 1 Nov 2026 21:35:30 +0100
Subject: v4.3.0: package the desktop app with verifiable installers

publish.sh builds the GUI with the gui-release profile, names it zagan-bet-gui-<version>-<platform>-<arch>, and renders a bash and a PowerShell installer next to each app. Both embed the app's SHA-256, verify the file (or fetch it), install per-user and add a launcher: a desktop entry plus an SVG icon on Linux, a Start-menu shortcut on Windows.

The download page gains a Desktop app section with the apps and installers, keeps the terminal client and server, links the public git repository for the GPL source, and lists every file in the sha256sum block. deploy.sh verifies all four artifact kinds. Publishing refuses a dirty tree so the linked history matches the binaries.
---
 AGENTS.md                         |  6 +++
 Cargo.toml                        |  2 +-
 docs/GUI-PLAN.md                  | 31 +++++++++++-----
 docs/TESTING.md                   | 17 +++++++++
 gui/Cargo.toml                    |  2 +-
 gui/assets/zagan-bet.svg          |  6 +++
 scripts/deploy.sh                 |  9 ++++-
 scripts/installers/linux.sh.in    | 78 +++++++++++++++++++++++++++++++++++++++
 scripts/installers/windows.ps1.in | 75 +++++++++++++++++++++++++++++++++++++
 scripts/publish.sh                | 66 +++++++++++++++++++++++++++++++--
 scripts/render-installer.py       | 49 ++++++++++++++++++++++++
 web/README.md                     | 43 +++++++++++++++------
 web/index.php                     | 78 +++++++++++++++++++++++++++++++--------
 13 files changed, 416 insertions(+), 46 deletions(-)
 create mode 100644 gui/assets/zagan-bet.svg
 create mode 100644 scripts/installers/linux.sh.in
 create mode 100644 scripts/installers/windows.ps1.in
 create mode 100644 scripts/render-installer.py

diff --git a/AGENTS.md b/AGENTS.md
index 368a348..7258710 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -85,6 +85,12 @@
 - The embedded fonts have no suit or arrow glyphs. Draw card suits as shapes
   and use plain words for navigation; a glyph that is not in Open Sans or Hack
   renders as tofu.
+- `scripts/publish.sh` builds the GUI with `gui-release` and renders the
+  installers with the published SHA-256. Installers verify the hash and install
+  per-user; never install system-wide or skip the check.
+- The download page links the public git repository
+  (https://git.2137697.xyz/zagan-bet.git) for the GPL corresponding source.
+  Run publish from a clean tree so the linked history matches the binaries.
 
 ## Client TUI
 - `render_lines()` and `render()` must agree. If `render()` uses `\r\n`,
diff --git a/Cargo.toml b/Cargo.toml
index 179cb39..22a6ec7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,7 @@ members = ["gui"]
 
 [package]
 name = "zagan-bet"
-version = "4.2.1"
+version = "4.3.0"
 edition = "2024"
 license = "GPL-3.0-or-later"
 
diff --git a/docs/GUI-PLAN.md b/docs/GUI-PLAN.md
index 89cf495..f058e41 100644
--- a/docs/GUI-PLAN.md
+++ b/docs/GUI-PLAN.md
@@ -162,17 +162,28 @@ Measured on Linux at 1080p with llvmpipe software GL:
 **Gate:** the screenshot set is ready for review. Remaining for the gate:
 frame rate on integrated graphics and the Windows interactive pass.
 
-## Phase 5 — packaging
-## Phase 5 — packaging
-
-- `publish.sh` emits `zagan-bet-gui-<version>-<platform>-<arch>[.exe]`.
-- Bash and PowerShell installers that verify the SHA-256, install to the user
-  directory, and create `.desktop`/Start-menu entries.
-- Download page lists raw binaries and installers; add the source-code link.
-
-**Gate:** `deploy.sh` verifies both artifact kinds; a clean machine installs
-from the page and launches.
+## Phase 5 — packaging (code complete, v4.3.0)
+
+- `publish.sh` builds the GUI with the `gui-release` profile for Linux and
+  Windows and names the app `zagan-bet-gui-<version>-<platform>-<arch>[.exe]`.
+- It renders a bash installer and a PowerShell installer next to each app.
+  Both embed the app's SHA-256, verify the file (or download it), install
+  per-user and add a launcher: `.desktop` plus an SVG icon on Linux, a
+  Start-menu shortcut on Windows. Templates live in `scripts/installers/`;
+  `render-installer.py` fills them in.
+- The download page scans `bin/gui`, `bin/client` and `bin/server`, lists
+  apps, installers, clients and servers, and includes every file in the
+  `sha256sum` block. A Source section links the public git repository
+  (<https://git.2137697.xyz/zagan-bet.git>) for the GPL corresponding source.
+  `deploy.sh` verifies every artifact kind over the public URL.
+- `publish.sh` refuses to run from a dirty tree so the linked history matches
+  the binaries.
+
+**Gate:** deploy verification passes for apps, installers, clients and
+servers; the Linux installer is exercised in a clean HOME. The Windows
+installer needs a Windows machine before the gate closes.
 
+## Testing split
 ## Testing split
 
 - `View`/`Command` tests in the core: flows, gating, state. Always.
diff --git a/docs/TESTING.md b/docs/TESTING.md
index 613cd08..c32ac22 100644
--- a/docs/TESTING.md
+++ b/docs/TESTING.md
@@ -266,3 +266,20 @@ terminal client; a saved login from one signs in the other.
   the row is upgraded to bcrypt.
 - Spin several times and confirm `plays` grows by one row per spin while
   `users.balance` changes by `winnings - bet`.
+
+## Packaging checklist
+
+1. Set the version in `Cargo.toml` and `gui/Cargo.toml` (same MAJOR.MINOR),
+   run `cargo test --workspace`, and commit. `publish.sh` refuses a dirty tree
+   because the site links the committed git history as the GPL source.
+2. `./scripts/publish.sh` (add `DEST=` and `URL_BASE=` to stage elsewhere). It
+   builds the GUI with `gui-release`, the terminal clients and servers, and
+   renders the bash/PowerShell installers with each app's SHA-256.
+3. `php -S 127.0.0.1:8899 -t <staging>` and
+   `./scripts/deploy.sh <staging> http://127.0.0.1:8899/` to upload and verify
+   every app, installer, client and server against the page's checksums.
+4. On a clean user account: download an app with its installer, run the
+   installer, and launch the new menu entry. The installer must refuse a
+   corrupted download.
+5. Repeat on Windows for the `.ps1` installer and the Start-menu shortcut.
+
diff --git a/gui/Cargo.toml b/gui/Cargo.toml
index 5418794..8bcbda0 100644
--- a/gui/Cargo.toml
+++ b/gui/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "zagan-bet-gui"
-version = "4.2.1"
+version = "4.3.0"
 edition = "2024"
 license = "GPL-3.0-or-later"
 description = "Desktop frontend for zagan-bet"
diff --git a/gui/assets/zagan-bet.svg b/gui/assets/zagan-bet.svg
new file mode 100644
index 0000000..74e5a3a
--- /dev/null
+++ b/gui/assets/zagan-bet.svg
@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <rect width="64" height="64" rx="14" fill="#0a0e12"/>
+  <rect x="9" y="9" width="46" height="46" rx="10" fill="#0f1a14" stroke="#1f7d52" stroke-width="2"/>
+  <path d="M22 20h20L22 44h20" fill="none" stroke="#4ec27b" stroke-width="6"
+        stroke-linecap="round" stroke-linejoin="round"/>
+</svg>
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 99129ad..b18d462 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
-# Upload web/ and verify every published artifact over the public URL.
+# Upload web/ and verify every published artifact (GUI app and installers,
+# terminal client and server) over the public URL.
 #
 # Usage:
 #   ./scripts/deploy.sh user@host:/srv/zagan.bet https://zagan.bet/
@@ -50,7 +51,11 @@ done
 [ -f web/index.php ] || die "web/index.php is missing"
 
 shopt -s nullglob
-artifacts=(web/bin/client/zagan-bet-* web/bin/server/zagan-bet-*)
+artifacts=(
+  web/bin/gui/zagan-bet-*
+  web/bin/client/zagan-bet-*
+  web/bin/server/zagan-bet-*
+)
 shopt -u nullglob
 [ ${#artifacts[@]} -gt 0 ] || die "no artifacts in web/bin; run scripts/publish.sh first"
 
diff --git a/scripts/installers/linux.sh.in b/scripts/installers/linux.sh.in
new file mode 100644
index 0000000..5b53c02
--- /dev/null
+++ b/scripts/installers/linux.sh.in
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Zagan-Bet desktop installer for Linux.
+#
+# Verifies the app against its published SHA-256, installs it for the current
+# user and adds a launcher. Put the downloaded app next to this script, or run
+# the script on its own and it will fetch the matching binary.
+set -euo pipefail
+
+VERSION="__VERSION__"
+BINARY="__BINARY__"
+SHA256="__SHA256__"
+URL="__URL__"
+
+say() { printf '%s\n' "$*"; }
+die() { printf 'install: %s\n' "$*" >&2; exit 1; }
+
+command -v sha256sum >/dev/null 2>&1 || die "sha256sum is required"
+
+here=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+source_file=""
+for candidate in "$here/$BINARY" "./$BINARY" "$HOME/Downloads/$BINARY"; do
+  if [ -f "$candidate" ]; then
+    source_file=$candidate
+    break
+  fi
+done
+
+cleanup=""
+if [ -z "$source_file" ]; then
+  command -v curl >/dev/null 2>&1 || die "put $BINARY next to this installer, or install curl"
+  cleanup=$(mktemp) || die "cannot create a temporary file"
+  say "Downloading $BINARY..."
+  curl -fsSL --max-time 300 "$URL" -o "$cleanup" || die "download failed"
+  source_file=$cleanup
+fi
+trap 'if [ -n "$cleanup" ]; then rm -f "$cleanup"; fi' EXIT
+
+actual=$(sha256sum "$source_file" | awk '{print $1}')
+[ "$actual" = "$SHA256" ] || die "checksum mismatch: expected $SHA256, got $actual"
+
+bin_dir="${XDG_BIN_HOME:-$HOME/.local/bin}"
+data_dir="${XDG_DATA_HOME:-$HOME/.local/share}"
+app="$bin_dir/zagan-bet-gui"
+desktop_dir="$data_dir/applications"
+icon_dir="$data_dir/icons/hicolor/scalable/apps"
+
+mkdir -p "$bin_dir" "$desktop_dir" "$icon_dir"
+install -m 0755 "$source_file" "$app"
+
+cat > "$icon_dir/zagan-bet.svg" <<'ICON'
+__ICON__
+ICON
+
+cat > "$desktop_dir/zagan-bet.desktop" <<DESKTOP
+[Desktop Entry]
+Type=Application
+Name=Zagan-Bet
+Comment=Slots, roulette, blackjack and crash
+Exec=$app
+Icon=zagan-bet
+Terminal=false
+Categories=Game;
+DESKTOP
+chmod 0644 "$desktop_dir/zagan-bet.desktop" "$icon_dir/zagan-bet.svg"
+
+if command -v update-desktop-database >/dev/null 2>&1; then
+  update-desktop-database "$desktop_dir" >/dev/null 2>&1 || true
+fi
+if command -v gtk-update-icon-cache >/dev/null 2>&1; then
+  gtk-update-icon-cache -q "$data_dir/icons/hicolor" >/dev/null 2>&1 || true
+fi
+
+say "Installed Zagan-Bet $VERSION to $app"
+say "A launcher was added to your applications menu."
+case ":$PATH:" in
+  *":$bin_dir:"*) ;;
+  *) say "Add $bin_dir to PATH to start it as 'zagan-bet-gui'." ;;
+esac
diff --git a/scripts/installers/windows.ps1.in b/scripts/installers/windows.ps1.in
new file mode 100644
index 0000000..fd2b8b3
--- /dev/null
+++ b/scripts/installers/windows.ps1.in
@@ -0,0 +1,75 @@
+# Zagan-Bet desktop installer for Windows.
+#
+# Verifies the app against its published SHA-256, installs it for the current
+# user and adds a Start-menu shortcut. Put the downloaded app next to this
+# script, or run the script on its own and it will fetch the matching binary.
+#
+# Run it with:
+#   powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-install.ps1
+$ErrorActionPreference = "Stop"
+
+$Version = "__VERSION__"
+$Binary  = "__BINARY__"
+$Sha256  = "__SHA256__"
+$Url     = "__URL__"
+
+function Stop-Install([string]$Message) {
+    Write-Host "install: $Message" -ForegroundColor Red
+    exit 1
+}
+
+$here = Split-Path -Parent $MyInvocation.MyCommand.Path
+$candidates = @(
+    (Join-Path $here $Binary),
+    (Join-Path (Get-Location) $Binary),
+    (Join-Path $env:USERPROFILE "Downloads\$Binary")
+)
+$sourceFile = $null
+foreach ($candidate in $candidates) {
+    if (Test-Path -LiteralPath $candidate) {
+        $sourceFile = $candidate
+        break
+    }
+}
+
+$temporary = $null
+if (-not $sourceFile) {
+    $temporary = Join-Path ([System.IO.Path]::GetTempPath()) $Binary
+    Write-Host "Downloading $Binary..."
+    try {
+        Invoke-WebRequest -Uri $Url -OutFile $temporary -UseBasicParsing
+    } catch {
+        Stop-Install "download failed: $_"
+    }
+    $sourceFile = $temporary
+}
+
+try {
+    $actual = (Get-FileHash -LiteralPath $sourceFile -Algorithm SHA256).Hash.ToLowerInvariant()
+    if ($actual -ne $Sha256.ToLowerInvariant()) {
+        Stop-Install "checksum mismatch: expected $Sha256, got $actual"
+    }
+
+    $installDir = Join-Path $env:LOCALAPPDATA "Programs\Zagan-Bet"
+    New-Item -ItemType Directory -Force -Path $installDir | Out-Null
+    $target = Join-Path $installDir "zagan-bet-gui.exe"
+    Copy-Item -LiteralPath $sourceFile -Destination $target -Force
+
+    $startMenu = Join-Path $env:APPDATA "Microsoft\Windows\Start Menu\Programs"
+    New-Item -ItemType Directory -Force -Path $startMenu | Out-Null
+    $shortcutPath = Join-Path $startMenu "Zagan-Bet.lnk"
+    $shell = New-Object -ComObject WScript.Shell
+    $shortcut = $shell.CreateShortcut($shortcutPath)
+    $shortcut.TargetPath = $target
+    $shortcut.WorkingDirectory = $installDir
+    $shortcut.IconLocation = "$target,0"
+    $shortcut.Description = "Slots, roulette, blackjack and crash"
+    $shortcut.Save()
+
+    Write-Host "Installed Zagan-Bet $Version to $target"
+    Write-Host "A Start-menu shortcut was created."
+} finally {
+    if ($temporary -and (Test-Path -LiteralPath $temporary)) {
+        Remove-Item -LiteralPath $temporary -Force
+    }
+}
diff --git a/scripts/publish.sh b/scripts/publish.sh
index 8240859..3a04631 100755
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -3,14 +3,22 @@
 # download page expects:
 #
 #   zagan-bet-client-<version>-<platform>-<arch>[.exe]
-#   zagan-bet-server-<version>-<platform>-<arch>
+#   zagan-bet-server-<version>-<platform>-<arch>[.exe]
+#   zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+#   zagan-bet-gui-<version>-<platform>-<arch>-install.sh
+#   zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
 #
-# Cargo always writes target/<triple>/release/<bin>, so the rename happens here
-# after each build. The version comes from Cargo.toml.
+# Cargo always writes target/<triple>/<profile>/<bin>, so the rename happens
+# here after each build. The version comes from Cargo.toml.
+#
+# The GUI uses the workspace's `gui-release` profile (small, stripped, LTO).
+# The public git repository is the GPL source for these binaries, so publish
+# from a clean tree (or set ALLOW_DIRTY=1 for a preview).
 #
 # Usage:
 #   ./scripts/publish.sh
 #   DEST=/srv/www/bin ./scripts/publish.sh
+#   URL_BASE=https://staging.example/ ./scripts/publish.sh
 set -euo pipefail
 
 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
@@ -23,6 +31,21 @@ if [ -z "${VERSION:-}" ]; then
 fi
 
 DEST=${DEST:-web/bin}
+URL_BASE=${URL_BASE:-https://zagan.2137697.xyz}
+
+if [ "${ALLOW_DIRTY:-0}" != "1" ] && [ -n "$(git status --porcelain)" ]; then
+  echo "the working tree is dirty; commit the release first (or ALLOW_DIRTY=1)" >&2
+  exit 1
+fi
+
+command -v python3 >/dev/null || {
+  echo "python3 is required to render the installers" >&2
+  exit 1
+}
+
+hash_of() {
+  sha256sum "$1" | awk '{print $1}'
+}
 
 publish() {
   local triple=$1 kind=$2 platform=$3 arch=$4
@@ -47,11 +70,46 @@ publish() {
   echo "    $DEST/$kind/$artifact ($(du -h "$DEST/$kind/$artifact" | cut -f1))"
 }
 
+publish_gui() {
+  local triple=$1 platform=$2 arch=$3
+  local ext=""
+  if [ "$platform" = windows ]; then
+    ext=".exe"
+  fi
+
+  local artifact="zagan-bet-gui-$VERSION-$platform-$arch$ext"
+  local source="target/$triple/gui-release/zagan-bet-gui$ext"
+
+  echo "==> $artifact"
+  cargo build -p zagan-bet-gui --profile gui-release --quiet --target "$triple"
+
+  mkdir -p "$DEST/gui"
+  install -m 0755 "$source" "$DEST/gui/$artifact"
+  local sha
+  sha=$(hash_of "$DEST/gui/$artifact")
+  echo "    $DEST/gui/$artifact ($(du -h "$DEST/gui/$artifact" | cut -f1))"
+
+  if [ "$platform" = linux ]; then
+    python3 scripts/render-installer.py \
+      scripts/installers/linux.sh.in \
+      "$DEST/gui/zagan-bet-gui-$VERSION-linux-$arch-install.sh" \
+      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
+  elif [ "$platform" = windows ]; then
+    python3 scripts/render-installer.py \
+      scripts/installers/windows.ps1.in \
+      "$DEST/gui/zagan-bet-gui-$VERSION-windows-$arch-install.ps1" \
+      "$VERSION" "$artifact" "$sha" "$URL_BASE/bin/gui/$artifact"
+  fi
+}
+
+publish_gui x86_64-unknown-linux-gnu linux x86_64
+publish_gui x86_64-pc-windows-gnu windows x86_64
+
 publish x86_64-unknown-linux-gnu client linux x86_64
 publish i686-unknown-linux-gnu   client linux i686
 publish x86_64-pc-windows-gnu    client windows x86_64
 publish x86_64-unknown-linux-gnu server linux x86_64
-publish x86_64-pc-windows-gnu	 server windows x86_64
+publish x86_64-pc-windows-gnu    server windows x86_64
 
 echo
 echo "published $VERSION to $DEST"
diff --git a/scripts/render-installer.py b/scripts/render-installer.py
new file mode 100644
index 0000000..1a00551
--- /dev/null
+++ b/scripts/render-installer.py
@@ -0,0 +1,49 @@
+#!/usr/bin/env python3
+"""Fill an installer template with one published artifact's details.
+
+Usage: render-installer.py <template> <output> <version> <binary> <sha256> <url>
+
+The Linux template embeds the application icon so the installer works offline.
+"""
+
+from __future__ import annotations
+
+import pathlib
+import sys
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) != 7:
+        print(
+            "usage: render-installer.py <template> <output> <version> "
+            "<binary> <sha256> <url>",
+            file=sys.stderr,
+        )
+        return 2
+
+    template, output, version, binary, sha256, url = argv[1:]
+    root = pathlib.Path(__file__).resolve().parent.parent
+    icon = (root / "gui" / "assets" / "zagan-bet.svg").read_text()
+
+    text = pathlib.Path(template).read_text()
+    replacements = {
+        "__VERSION__": version,
+        "__BINARY__": binary,
+        "__SHA256__": sha256,
+        "__URL__": url,
+        "__ICON__": icon.rstrip("\n"),
+    }
+    for placeholder, value in replacements.items():
+        text = text.replace(placeholder, value)
+
+    destination = pathlib.Path(output)
+    destination.write_text(text)
+    if destination.suffix == ".sh":
+        destination.chmod(0o755)
+
+    print(f"    {destination} ({destination.stat().st_size} bytes)")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv))
diff --git a/web/README.md b/web/README.md
index e79abd4..bd87e11 100644
--- a/web/README.md
+++ b/web/README.md
@@ -1,15 +1,15 @@
 # Download page
 
-`index.php` scans `bin/client` and `bin/server` on every request and renders
-whatever builds it finds, with version, size and SHA-256. No database, no
-JavaScript, no CSS, no dependencies. The page is plain browser defaults:
-black text, blue links, monospace checksums. PHP 8.0+.
+`index.php` scans `bin/gui`, `bin/client` and `bin/server` on every request and
+renders whatever builds it finds, with version, size and SHA-256. No database, no JavaScript, no CSS, no dependencies. The page is plain
+browser defaults: black text, blue links, monospace checksums. PHP 8.0+.
 
 ## Layout
 
 ```
 web/
   index.php
+  bin/gui/       served at /bin/gui/... (app and installers)
   bin/client/    served at /bin/client/...
   bin/server/    served at /bin/server/...
 ```
@@ -22,13 +22,22 @@ The page only lists files that match the release pattern; anything else in
 those directories is ignored.
 
 ```
-zagan-bet-client-<version>-<platform>-<arch>[.exe]
-zagan-bet-server-<version>-<platform>-<arch>
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
+bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
+bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
+bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
 ```
 
 `<version>` is `MAJOR.MINOR.PATCH`, `<platform>` is `linux`, `windows` or
 `macos`, `<arch>` is `x86_64`, `i686` or `aarch64`.
 
+The installers are generated next to their app. They embed the app's SHA-256,
+check the file (or download it) and install it for the current user: Linux
+writes `~/.local/bin/zagan-bet-gui` plus a `.desktop` launcher, Windows writes
+`%LOCALAPPDATA%\Programs\Zagan-Bet` plus a Start-menu shortcut. The source
+archives satisfy the GPL's corresponding-source requirement.
+
 ## Publishing a build
 
 From the repository root:
@@ -37,15 +46,21 @@ From the repository root:
 ./scripts/publish.sh
 ```
 
-It reads the version from `Cargo.toml`, builds all four artifacts and installs
-them under `web/bin` with the names above. Override the destination with
-`DEST=/srv/www/bin ./scripts/publish.sh`.
+It reads the version from `Cargo.toml`, builds every artifact and installs
+them under `web/bin` with the names above. The GUI is built with the
+workspace's `gui-release` profile (LTO, stripped) and the installers are
+rendered with Python 3 and the published SHA-256. Run it from a clean tree so
+the release commit is the source the page links to. Override the destination
+with `DEST=/srv/www/bin ./scripts/publish.sh`, and the download origin baked
+into the installers with `URL_BASE=https://staging.example/ ./scripts/publish.sh`.
+`ALLOW_DIRTY=1` skips the clean-tree check for a preview.
 
 Builds are per target triple, so these must be installed:
 `x86_64-unknown-linux-gnu`, `i686-unknown-linux-gnu` and
 `x86_64-pc-windows-gnu`, plus the mingw linker for the Windows build. Client
 builds always pass `--no-default-features`, which drops the server's OpenSSL
-dependency; the client is rustls-only.
+dependency; the client is rustls-only. The GUI needs Python 3 at publish time
+for the installer templates in `scripts/installers/`.
 
 Cargo itself cannot produce these names: it always writes
 `target/<triple>/release/<bin>`. The script renames after each build.
@@ -100,8 +115,9 @@ Then open <http://127.0.0.1:8899/>.
 ```
 
 `deploy.sh` rsyncs `web/` with `--delay-updates`, so a visitor never sees a
-half-written binary, then fetches the live page and every artifact it lists and
-compares the downloaded bytes with the local SHA-256. `--verify-only` skips the
+half-written binary, then fetches the live page and every artifact it lists —
+GUI apps, installers, terminal clients and servers — and compares the
+downloaded bytes with the local SHA-256. `--verify-only` skips the
 upload and only checks the live site. Old versions are left on the server;
 prune them by hand.
 
@@ -124,3 +140,6 @@ php -S 127.0.0.1:8899 -t /srv/staging
   stay downloadable until you remove them from `bin/`.
 - The checksum block is in `sha256sum` format, so visitors can save it as
   `SHA256SUMS` and run `sha256sum -c SHA256SUMS`.
+- The page links <https://git.2137697.xyz/zagan-bet.git> for the GPL
+  corresponding source; publish only from a committed release so that link
+  contains the exact source.
diff --git a/web/index.php b/web/index.php
index 7ed79da..77edf95 100644
--- a/web/index.php
+++ b/web/index.php
@@ -4,20 +4,23 @@ declare(strict_types=1);
 /**
  * zagan.bet download page.
  *
- * Scans ./bin/client and ./bin/server and renders every build it finds, with
- * its version, size and SHA-256. No database, no JavaScript, no dependencies.
+ * Scans ./bin/{gui,client,server} and renders every build it finds, with its
+ * version, size and SHA-256. The GPL source link points at the public git
+ * repository. No database, no JavaScript, no dependencies.
  *
  * Expected file names (anything else is ignored):
  *
- *   bin/client/zagan-bet-client-<version>-<platform>-<arch>
- *   bin/client/zagan-bet-client-<version>-<platform>-<arch>.exe
- *   bin/server/zagan-bet-server-<version>-<platform>-<arch>
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>[.exe]
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.sh
+ *   bin/gui/zagan-bet-gui-<version>-<platform>-<arch>-install.ps1
+ *   bin/client/zagan-bet-client-<version>-<platform>-<arch>[.exe]
+ *   bin/server/zagan-bet-server-<version>-<platform>-<arch>[.exe]
  *
  * <version> is MAJOR.MINOR.PATCH, <platform> is linux|windows|macos and
  * <arch> is x86_64|i686|aarch64. Example:
  *
- *   bin/client/zagan-bet-client-3.1.1-linux-x86_64
- *   bin/server/zagan-bet-server-3.1.1-linux-x86_64
+ *   bin/gui/zagan-bet-gui-4.3.0-linux-x86_64
+ *   bin/client/zagan-bet-client-4.3.0-linux-x86_64
  *
  * SHA-256 values are cached in a JSON file keyed on size and mtime, so a file
  * is only re-read when it changes. The cache lives in the system temp
@@ -26,6 +29,10 @@ declare(strict_types=1);
  */
 
 const KINDS = [
+    'gui' => [
+        'title' => 'Desktop app',
+        'hint' => 'Windows 10 or newer, or a Linux desktop. No terminal needed.',
+    ],
     'client' => [
         'title' => 'Client',
         'hint' => 'Needs a terminal of at least 80×24 cells.',
@@ -163,7 +170,7 @@ function read_release(
     bool &$dirty
 ): ?array {
     $pattern = '/^zagan-bet-' . preg_quote($kind, '/')
-        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(\.exe)?$/i';
+        . '-v?(\d+\.\d+\.\d+)-([a-z]+)-([a-z0-9_]+)(-install\.sh|-install\.ps1|\.exe)?$/i';
     if (preg_match($pattern, $entry, $matches) !== 1) {
         return null;
     }
@@ -192,10 +199,14 @@ function read_release(
         return null;
     }
 
+    $suffix = strtolower($matches[4] ?? '');
+    $variant = str_starts_with($suffix, '-install.') ? 'installer' : 'binary';
+
     return [
         'version' => $matches[1],
         'platform' => strtolower($matches[2]),
         'arch' => strtolower($matches[3]),
+        'variant' => $variant,
         'file' => $entry,
         'size' => $size,
         'mtime' => $mtime,
@@ -257,6 +268,10 @@ foreach (KINDS as $kind => $meta) {
         if ($byArch !== 0) {
             return $byArch;
         }
+        $byVariant = ($a['variant'] === 'installer' ? 1 : 0) <=> ($b['variant'] === 'installer' ? 1 : 0);
+        if ($byVariant !== 0) {
+            return $byVariant;
+        }
         return strcmp($a['file'], $b['file']);
     });
 
@@ -280,18 +295,41 @@ if ($cacheDirty) {
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <title>żagań.bet</title>
-<meta name="description" content="Official zagan.bet client and server downloads.">
+<meta name="description" content="Official zagan.bet desktop app, terminal client and server downloads.">
 <meta http-equiv="Content-Security-Policy" content="default-src 'none'">
 </head>
 <body>
 
 <h1>żagań.bet</h1>
-<p>Official client and server builds.</p>
+<p>Official desktop app, terminal client and server builds.</p>
 <?php if ($newest > 0): ?>
 <p>Builds published <?= e(gmdate('j M Y H:i', $newest)) ?> UTC.</p>
 <?php endif; ?>
 
-<h2>Client</h2>
+<h2>Desktop app</h2>
+<p>Windows 10 or newer, or a Linux desktop. No terminal needed.</p>
+<?php $guiBinaries = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'binary')); ?>
+<?php $guiInstallers = array_values(array_filter($releases['gui'], static fn (array $r): bool => $r['variant'] === 'installer')); ?>
+<?php if ($guiBinaries === []): ?>
+<p>Nothing published yet.</p>
+<?php else: ?>
+<ul>
+<?php foreach ($guiBinaries as $release): ?>
+<li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?><?php if (isset(ARCHES[$release['arch']])): ?> (<?= e(ARCHES[$release['arch']]) ?>)<?php endif; ?> v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
+<?php endforeach; ?>
+</ul>
+<?php endif; ?>
+<?php if ($guiInstallers !== []): ?>
+<h3>Installers</h3>
+<p>The installer checks the download, installs Zagan-Bet for your user and adds it to your programs. Run it next to a downloaded app, or on its own to fetch one.</p>
+<ul>
+<?php foreach ($guiInstallers as $release): ?>
+<li><a href="<?= e($release['href']) ?>" download><?= e(PLATFORMS[$release['platform']] ?? ucfirst($release['platform'])) ?> <?= e($release['arch']) ?> installer (<?= str_ends_with($release['file'], '.ps1') ? 'PowerShell' : 'bash' ?>) v<?= e($release['version']) ?> — <?= e(human_size($release['size'])) ?></a></li>
+<?php endforeach; ?>
+</ul>
+<?php endif; ?>
+
+<h2>Terminal client</h2>
 <p>Needs a terminal of at least 80×24 cells.</p>
 <?php if ($releases['client'] === []): ?>
 <p>Nothing published yet.</p>
@@ -315,7 +353,7 @@ if ($cacheDirty) {
 </ul>
 <?php endif; ?>
 
-<?php $all = array_merge($releases['client'], $releases['server']); ?>
+<?php $all = array_merge($releases['gui'], $releases['client'], $releases['server']); ?>
 <?php if ($all !== []): ?>
 <h2>SHA-256</h2>
 <p>On Linux use <code>sha256sum &lt;file&gt;</code>. On Windows use <code>Get-FileHash &lt;file&gt;</code>.</p>
@@ -329,8 +367,17 @@ echo e($sums);
 ?></pre>
 <?php endif; ?>
 
+<h2>Source</h2>
+<p>Zagan-Bet is free software under the GNU GPL v3 or later. The source for these builds is at <a href="https://git.2137697.xyz/zagan-bet.git">https://git.2137697.xyz/zagan-bet.git</a>.</p>
+
 <h2>Running it</h2>
-<p>Client:</p>
+<p>Desktop app on Linux:</p>
+<pre><code>chmod +x zagan-bet-gui-*-linux-x86_64-install.sh
+./zagan-bet-gui-*-linux-x86_64-install.sh</code></pre>
+<p>Desktop app on Windows (PowerShell):</p>
+<pre><code>powershell -ExecutionPolicy Bypass -File .\zagan-bet-gui-*-windows-x86_64-install.ps1</code></pre>
+<p>The installers verify the SHA-256 before installing. You can also run the downloaded app directly.</p>
+<p>Terminal client:</p>
 <pre><code>chmod +x &lt;downloaded-client&gt;
 ./&lt;downloaded-client&gt;</code></pre>
 <p>Server, first run creates <code>identity.p12</code>, <code>key.pem</code> and <code>cert.pem</code>:</p>
@@ -338,8 +385,7 @@ echo e($sums);
 ./&lt;downloaded-server&gt; --init
 ./&lt;downloaded-server&gt; -i 0.0.0.0 -p 11525</code></pre>
 
-<p>Windows: run the <code>.exe</code> from Windows Terminal or another real terminal.</p>
-
-<p>When lost, execute <code>help</code> command inside zagan.bet client. Server binary supports <code>--help</code> flag</p>
+<p>Terminal client on Windows: run the <code>.exe</code> from Windows Terminal or another real terminal.</p>
+<p>Run <code>help</code> inside the terminal client; the server binary supports <code>--help</code>.</p>
 </body>
 </html>
-- 
cgit v1.2.3