From a06ada4c9b6a03a1697c65ddf2f64cd083af81af Mon Sep 17 00:00:00 2001
From: Bryan Van Deusen <bryan.vandeusen@fabledsword.com>
Date: Tue, 26 May 2026 08:07:22 -0400
Subject: [PATCH] =?UTF-8?q?fix(ext-ui):=20direct=20:href=20install=20butto?=
 =?UTF-8?q?n=20(Firefox=20needs=20anchor=20click,=20not=20programmatic=20n?=
 =?UTF-8?q?avigation)=20+=20manifest=20version=20detection=20ignores=20-la?=
 =?UTF-8?q?test.xpi=20alias=20=E2=80=94=20Co-Authored-By:=20Claude=20Opus?=
 =?UTF-8?q?=204.7=20(1M=20context)=20<noreply@anthropic.com>?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/app/api/extension.py                     | 16 +++++++++++++---
 .../components/settings/BrowserExtensionCard.vue | 14 ++++++++------
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/backend/app/api/extension.py b/backend/app/api/extension.py
index 54d569f..4f4766f 100644
--- a/backend/app/api/extension.py
+++ b/backend/app/api/extension.py
@@ -93,10 +93,20 @@ def _read_manifest_sync() -> dict | None:
     asyncio.to_thread (ASYNC240: no pathlib I/O in async functions)."""
     if not XPI_DIR.is_dir():
         return None
-    xpis = sorted(XPI_DIR.glob("fabledcurator-*.xpi"), key=lambda p: p.stat().st_mtime)
-    if not xpis:
+    # Exclude the `fabledcurator-latest.xpi` alias when picking the file to
+    # extract a version from — it's a copy of the latest versioned XPI,
+    # written at the same mtime by build.yml, and would otherwise tie or
+    # win the sort (operator-flagged 2026-05-26: UI displayed "v latest"
+    # because `_extract_version("fabledcurator-latest.xpi")` returns
+    # the literal "latest"). The alias still serves as `latest_url`.
+    versioned = [
+        p for p in XPI_DIR.glob("fabledcurator-*.xpi")
+        if p.name != "fabledcurator-latest.xpi"
+    ]
+    if not versioned:
         return None
-    latest = xpis[-1]
+    versioned.sort(key=lambda p: p.stat().st_mtime)
+    latest = versioned[-1]
     return {
         "installed": True,
         "version": _extract_version(latest.name),
diff --git a/frontend/src/components/settings/BrowserExtensionCard.vue b/frontend/src/components/settings/BrowserExtensionCard.vue
index 2dbe591..db5d3a3 100644
--- a/frontend/src/components/settings/BrowserExtensionCard.vue
+++ b/frontend/src/components/settings/BrowserExtensionCard.vue
@@ -34,11 +34,18 @@
 
       <template v-else-if="manifest?.installed">
         <div class="fc-ext-install mt-3">
+          <!-- Install button: direct :href anchor click (no programmatic
+               window.location.assign). Firefox's XPI-install gesture
+               requires a user-clicked anchor pointing at an
+               application/x-xpinstall response; programmatic navigation
+               sometimes triggered nothing instead of the install dialog
+               (operator-flagged 2026-05-26). No `download` attribute —
+               that would force a save dialog instead of install. -->
           <v-btn
             v-if="isFirefox"
             color="accent" variant="flat" rounded="pill"
             prepend-icon="mdi-firefox"
-            @click="installXpi"
+            :href="manifest.latest_url"
           >Install Firefox extension</v-btn>
 
           <v-btn
@@ -146,11 +153,6 @@ async function loadKey() {
   }
 }
 
-function installXpi() {
-  if (!manifest.value?.latest_url) return
-  window.location.assign(manifest.value.latest_url)
-}
-
 async function rotateKey() {
   rotating.value = true
   try {