Wire download links directly to the latest release installers

os-detect.js -> downloads.js: after OS highlight, resolve the latest
release via the GitHub API and point every download link at the exact
installer asset (asset names carry the version, so we read them, not
guess URLs). Validated against real v26.7.1 assets — incl. separate
macOS Intel dmg.

- Per-variant links carry data-dl asset patterns; hero button + card
  links get real browser_download_url; Windows stays on the MS Store
- 'v26.7.1' chip becomes live from the real latest tag (data-latest-tag)
- localStorage cache (1h) keeps well under GitHub's rate limit
- Graceful fallback: API failure/offline/artifact-CSP keeps the existing
  /releases/latest links; no-JS still works
- CSP: add connect-src https://api.github.com
- build.py inlines downloads.js into the single-file artifact

Author: patj

_headers

@@ -6,7 +6,7 @@
   X-Frame-Options: DENY
   Referrer-Policy: strict-origin-when-cross-origin
   Permissions-Policy: geolocation=(), microphone=(), camera=(), interest-cohort=()
-  Content-Security-Policy: default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; font-src 'self' data:; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
+  Content-Security-Policy: default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self'; connect-src 'self' https://api.github.com; font-src 'self' data:; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
 
 # Fingerprinted/rarely-changing media can cache hard
 /assets/*

assets/js/downloads.js

@@ -0,0 +1,119 @@
+/* AetherSDR download wiring — progressive enhancement.
+ *
+ * 1. Highlights the download card matching the visitor's OS (no network).
+ * 2. Resolves the LATEST release from the GitHub API and points every
+ *    download link straight at the correct installer asset — the asset
+ *    filenames carry the version, so we read them rather than guess URLs.
+ *
+ * If the API is unavailable (offline, rate-limited, or the artifact CSP),
+ * every link keeps its fallback href to the GitHub "latest release" page,
+ * so nothing ever breaks.
+ */
+(function () {
+  var REPO = 'aethersdr/AetherSDR';
+  var API = 'https://api.github.com/repos/' + REPO + '/releases/latest';
+  var STORE_URL = 'https://apps.microsoft.com/detail/9nc6bmwfn811';
+  var CACHE_KEY = 'aetherLatestRelease';
+  var TTL = 3600 * 1000; // 1 hour
+
+  function detectOS() {
+    var uaData = navigator.userAgentData;
+    var platform = (uaData && uaData.platform) || navigator.platform || '';
+    var s = (platform + ' ' + (navigator.userAgent || '')).toLowerCase();
+    if (/mac|iphone|ipad|ipod|darwin/.test(s)) return 'macos';
+    if (/win/.test(s)) return 'windows';
+    if (/linux|x11|android|cros/.test(s)) return 'linux';
+    return null;
+  }
+
+  var currentOS = detectOS();
+
+  function highlight() {
+    if (!currentOS) return;
+    var card = document.querySelector('.dl-card[data-os="' + currentOS + '"]');
+    if (!card) return;
+    card.classList.add('is-recommended');
+    var badge = card.querySelector('.dl-reco');
+    if (badge) badge.hidden = false;
+  }
+
+  // First asset whose name contains one of the priority substrings.
+  function pick(assets, patterns) {
+    for (var p = 0; p < patterns.length; p++) {
+      var pat = patterns[p].trim().toLowerCase();
+      if (!pat) continue;
+      for (var i = 0; i < assets.length; i++) {
+        if (assets[i].name.toLowerCase().indexOf(pat) !== -1) return assets[i];
+      }
+    }
+    return null;
+  }
+
+  function wire(release) {
+    if (!release || !release.assets) return;
+    var assets = release.assets;
+
+    // Per-variant links carry their own asset patterns.
+    var links = document.querySelectorAll('[data-dl]');
+    for (var i = 0; i < links.length; i++) {
+      var asset = pick(assets, links[i].getAttribute('data-dl').split(','));
+      if (asset) links[i].href = asset.browser_download_url;
+    }
+
+    // Hero primary button -> the detected OS's installer (Store on Windows).
+    var primary = document.querySelector('[data-dl-primary]');
+    if (primary && currentOS) {
+      if (currentOS === 'windows') {
+        primary.href = STORE_URL;
+        primary.target = '_blank';
+        primary.rel = 'noopener';
+      } else {
+        var patts = currentOS === 'macos'
+          ? ['apple-silicon.dmg', '.dmg']
+          : ['x86_64.appimage', '.appimage'];
+        var a = pick(assets, patts);
+        if (a) primary.href = a.browser_download_url;
+      }
+    }
+
+    // Live "latest release" version label.
+    if (release.tag_name) {
+      var tag = release.tag_name.charAt(0) === 'v' ? release.tag_name : 'v' + release.tag_name;
+      var tags = document.querySelectorAll('[data-latest-tag]');
+      for (var j = 0; j < tags.length; j++) tags[j].textContent = tag;
+    }
+  }
+
+  function readCache() {
+    try {
+      var o = JSON.parse(localStorage.getItem(CACHE_KEY));
+      return o && Date.now() - o.t < TTL ? o.r : null;
+    } catch (e) { return null; }
+  }
+  function writeCache(r) {
+    try { localStorage.setItem(CACHE_KEY, JSON.stringify({ t: Date.now(), r: r })); } catch (e) {}
+  }
+
+  function loadRelease() {
+    var cached = readCache();
+    if (cached) { wire(cached); return; }
+    if (!window.fetch) return;
+    fetch(API, { headers: { Accept: 'application/vnd.github+json' } })
+      .then(function (res) { if (!res.ok) throw new Error('github ' + res.status); return res.json(); })
+      .then(function (release) {
+        var slim = {
+          tag_name: release.tag_name,
+          assets: (release.assets || []).map(function (a) {
+            return { name: a.name, browser_download_url: a.browser_download_url };
+          })
+        };
+        writeCache(slim);
+        wire(slim);
+      })
+      .catch(function () { /* keep fallback /releases/latest links */ });
+  }
+
+  function init() { highlight(); loadRelease(); }
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', init);
+  else init();
+})();

assets/js/os-detect.js

@@ -67,7 +67,7 @@ <h1>The native workstation for your <span class="grad-text">whole station</span>
         not just in front of the radio.
       </p>
       <div class="hero-cta">
-        <a class="btn btn-primary" href="#download">
+        <a class="btn btn-primary" href="#download" data-dl-primary>
           <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M12 3v12m0 0 4-4m-4 4-4-4M4 17v2a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2v-2"/></svg>
           Download for your platform
         </a>
@@ -81,7 +81,7 @@ <h1>The native workstation for your <span class="grad-text">whole station</span>
         </a>
       </div>
       <div class="hero-meta">
-        <span class="chip"><b>v26.7.1</b> · latest release</span>
+        <span class="chip"><b data-latest-tag>v26.7.1</b> · latest release</span>
         <span class="chip">GPL v3</span>
         <span class="chip">Qt6 · C++20</span>
         <span class="chip">GPG-signed commits</span>
@@ -295,17 +295,17 @@ <h2>Native builds, released together</h2>
           <span class="dl-reco" hidden>Your platform</span>
           <div class="os"><svg viewBox="0 0 24 24"><path d="M12 2C9.5 2 8.7 4 8.7 6.2c0 1 .2 1.6.2 2.4-.5.6-2.4 2.9-2.4 6.1 0 2 .6 3.4 1.4 4.4.4.5.2 1.3-.4 1.6-.7.4-1.2 1-1.2 1.6 0 .8.9 1.2 2.2 1.2h6.6c1.3 0 2.2-.4 2.2-1.2 0-.6-.5-1.2-1.2-1.6-.6-.3-.8-1.1-.4-1.6.8-1 1.4-2.4 1.4-4.4 0-3.2-1.9-5.5-2.4-6.1 0-.8.2-1.4.2-2.4C15.3 4 14.5 2 12 2Z"/></svg> Linux</div>
           <div class="variants">
-            <a href="https://github.com/aethersdr/AetherSDR/releases/latest">AppImage <span class="arch">x86_64</span></a>
-            <a href="https://github.com/aethersdr/AetherSDR/releases/latest">AppImage <span class="arch">aarch64 · Pi</span></a>
+            <a data-dl="x86_64.AppImage" href="https://github.com/aethersdr/AetherSDR/releases/latest">AppImage <span class="arch">x86_64</span></a>
+            <a data-dl="aarch64.AppImage" href="https://github.com/aethersdr/AetherSDR/releases/latest">AppImage <span class="arch">aarch64 · Pi</span></a>
           </div>
         </div>
 
         <div class="dl-card" data-os="macos">
           <span class="dl-reco" hidden>Your platform</span>
           <div class="os"><svg viewBox="0 0 24 24"><path d="M16.4 2c.1 1.2-.3 2.3-1 3.2-.8.9-2 1.6-3.1 1.5-.1-1.1.4-2.3 1.1-3.1.8-.9 2-1.5 3-1.6ZM19 17.3c-.5 1.2-.8 1.8-1.5 2.8-1 1.5-2.5 3.3-4.3 3.3-1.6 0-2-.9-4.1-.9-2.1 0-2.6.9-4.1.9-1.8 0-3.2-1.7-4.2-3.1C-1 16-1.4 9.8 1.4 6.9 2.7 5.4 4.5 4.5 6.3 4.5c1.8 0 3 1 4.1 1 1 0 2.4-1 4.3-1 1.4 0 3.4.6 4.7 2.4-4.1 2.3-3.5 8.2.6 10.4Z"/></svg> macOS</div>
           <div class="variants">
-            <a href="https://github.com/aethersdr/AetherSDR/releases/latest">DMG <span class="arch">Apple Silicon</span></a>
-            <a href="https://github.com/aethersdr/AetherSDR/releases/latest">DMG <span class="arch">Intel · Rosetta</span></a>
+            <a data-dl="apple-silicon.dmg,.dmg" href="https://github.com/aethersdr/AetherSDR/releases/latest">DMG <span class="arch">Apple Silicon</span></a>
+            <a data-dl="intel.dmg,x86_64.dmg,apple-silicon.dmg,.dmg" href="https://github.com/aethersdr/AetherSDR/releases/latest">DMG <span class="arch">Intel · Rosetta</span></a>
           </div>
         </div>
 
@@ -314,8 +314,8 @@ <h2>Native builds, released together</h2>
           <div class="os"><svg viewBox="0 0 24 24"><path d="M3 5.5 10.5 4.4v7.1H3V5.5ZM11.6 4.2 21 3v8.5h-9.4V4.2ZM3 12.5h7.5v7.1L3 18.5v-6ZM11.6 12.5H21V21l-9.4-1.3v-7.2Z"/></svg> Windows</div>
           <div class="variants">
             <a class="primary-dl" href="https://apps.microsoft.com/detail/9nc6bmwfn811" target="_blank" rel="noopener">Microsoft Store <span class="arch">recommended</span></a>
-            <a href="https://github.com/aethersdr/AetherSDR/releases/latest">Installer <span class="arch">x64 setup.exe</span></a>
-            <a href="https://github.com/aethersdr/AetherSDR/releases/latest">Portable <span class="arch">x64 zip</span></a>
+            <a data-dl="Windows-x64-setup.exe,setup.exe" href="https://github.com/aethersdr/AetherSDR/releases/latest">Installer <span class="arch">x64 setup.exe</span></a>
+            <a data-dl="Windows-x64-portable.zip,portable.zip,portable" href="https://github.com/aethersdr/AetherSDR/releases/latest">Portable <span class="arch">x64 zip</span></a>
           </div>
           <div class="winget"><span class="prompt">&gt; </span>winget install aethersdr -s msstore</div>
           <p class="winget-note">Auto-updating via the Store, or one line for PowerShell users.</p>
@@ -489,6 +489,6 @@ <h4>Resources</h4>
     </div>
   </footer>
 
-  <script src="assets/js/os-detect.js?v=1" defer></script>
+  <script src="assets/js/downloads.js?v=2" defer></script>
 </body>
 </html>

index.html

@@ -35,10 +35,10 @@ def main():
 
     # Inline JS as a real <script> before the asset pass — data-URI-ing a
     # script src would break execution in the single-file bundle.
-    with open(os.path.join(ROOT, "assets/js/os-detect.js"), encoding="utf-8") as f:
+    with open(os.path.join(ROOT, "assets/js/downloads.js"), encoding="utf-8") as f:
         js = f.read()
     html = re.sub(
-        r'<script src="assets/js/os-detect\.js[^"]*"[^>]*></script>',
+        r'<script src="assets/js/downloads\.js[^"]*"[^>]*></script>',
         f"<script>\n{js}\n</script>",
         html,
     )