Bugfix: Intel DMG download 404

- Map `x86_64` → `x64` in `/download/:version/:arch` redirect; `tauri-action` names the Intel DMG `Cmdr_<ver>_x64.dmg` while the rest of the codebase uses canonical `x86_64`.
- Add tests covering all three arch redirects and confirming D1 still records `x86_64`.
- Document the boundary mapping as a gotcha.

Author: vdavid

apps/api-server/CLAUDE.md

@@ -407,6 +407,11 @@ silently failing. Costs one extra HMAC check on mismatch.
 under concurrent `/activate` requests. **Why**: KV doesn't support atomic increment. The counter is approximate — if
 exact counts matter, query the CF API to list KV keys, or switch to Durable Objects / D1.
 
+**Gotcha**: The `/download/:version/:arch` redirect maps `x86_64` → `x64` in the filename. **Why**: `tauri-action` names
+the Intel DMG `Cmdr_<ver>_x64.dmg`, but the rest of the codebase (URL path, D1 telemetry, website data attrs, Rust
+target triple, `uname -m`) consistently uses `x86_64`. Mapping at the boundary keeps everything else canonical. Same
+convention is already used in `.github/workflows/release.yml` when reading DMG sizes for `latest.json`.
+
 ## Dependencies
 
 Runtime: `hono`, `@noble/ed25519`, `resend` Dev: `wrangler`, `vitest`, `typescript`, `eslint`, `prettier`

apps/api-server/src/download-and-update-check.test.ts

@@ -32,7 +32,7 @@ function createBindings(overrides: Record<string, unknown> = {}) {
 }
 
 describe('GET /download/:version/:arch', () => {
-  it('redirects to GitHub Releases', async () => {
+  it('redirects aarch64 to the matching DMG', async () => {
     const bindings = createBindings()
     const res = await app.request('/download/1.2.3/aarch64', {}, bindings)
 
@@ -42,6 +42,36 @@ describe('GET /download/:version/:arch', () => {
     )
   })
 
+  it('redirects x86_64 to the x64-named DMG (tauri-action filename quirk)', async () => {
+    const bindings = createBindings()
+    const res = await app.request('/download/1.2.3/x86_64', {}, bindings)
+
+    expect(res.status).toBe(302)
+    expect(res.headers.get('location')).toBe(
+      'https://github.com/vdavid/cmdr/releases/download/v1.2.3/Cmdr_1.2.3_x64.dmg',
+    )
+  })
+
+  it('redirects universal to the matching DMG', async () => {
+    const bindings = createBindings()
+    const res = await app.request('/download/1.2.3/universal', {}, bindings)
+
+    expect(res.status).toBe(302)
+    expect(res.headers.get('location')).toBe(
+      'https://github.com/vdavid/cmdr/releases/download/v1.2.3/Cmdr_1.2.3_universal.dmg',
+    )
+  })
+
+  it('still records x86_64 (not x64) in D1 — filename mapping is purely cosmetic', async () => {
+    const { db, bindMock } = createMockD1()
+    const bindings = createBindings({ TELEMETRY_DB: db })
+
+    await app.request('/download/1.2.3/x86_64', {}, bindings)
+
+    // bindArgs: [app_version, arch, country, continent]
+    expect(bindMock.mock.calls[0][1]).toBe('x86_64')
+  })
+
   it('inserts correct data into D1 downloads table', async () => {
     const { db, prepareMock, bindMock } = createMockD1()
     const bindings = createBindings({ TELEMETRY_DB: db })

apps/api-server/src/telemetry.ts

@@ -153,7 +153,10 @@ telemetry.get('/download/:version/:arch', async (c) => {
     await dbWrite
   }
 
-  return c.redirect(`https://github.com/vdavid/cmdr/releases/download/v${version}/Cmdr_${version}_${arch}.dmg`, 302)
+  // tauri-action names the Intel DMG `_x64.dmg`, not `_x86_64.dmg`. Map at the boundary —
+  // we keep `x86_64` everywhere else (uname, Rust target triple, D1, telemetry, website).
+  const fileArch = arch === 'x86_64' ? 'x64' : arch
+  return c.redirect(`https://github.com/vdavid/cmdr/releases/download/v${version}/Cmdr_${version}_${fileArch}.dmg`, 302)
 })
 
 export { telemetry }