fix: declare static agent routes before dynamic id route

central/tests/test_agent_distribution.py

@@ -215,6 +215,49 @@ def test_direct_authenticated_download_does_not_need_a_link(hub):
     assert payload["installation_id"] == installation_uuid
 
 
+# ---------- route precedence: /agents/new vs /agents/{agent_id} ----------
+
+def test_get_agents_new_renders_form_not_captured_by_dynamic_route(hub):
+    client, factory = hub
+    publish_release(factory)
+    login(client)
+    response = client.get("/agents/new")
+    assert response.status_code == 200
+    assert "text/html" in response.headers["content-type"]
+    assert "Nova instalação" in response.text
+    assert "Criar instalação" in response.text
+
+
+def test_get_agents_releases_page_not_captured_by_dynamic_route(hub):
+    client, _factory = hub
+    login(client)
+    response = client.get("/agents/releases")
+    assert response.status_code == 200
+    assert "text/html" in response.headers["content-type"]
+    assert "Versões do Agent" in response.text
+
+
+def test_get_agent_detail_still_renders_for_valid_numeric_id(hub):
+    client, factory = hub
+    login(client)
+    with factory() as session:
+        agent_id = session.scalar(select(Agent.id))
+    response = client.get(f"/agents/{agent_id}")
+    assert response.status_code == 200
+    assert "text/html" in response.headers["content-type"]
+
+
+def test_get_agents_non_numeric_slug_is_controlled_404_and_never_captures_statics(hub):
+    client, _factory = hub
+    login(client)
+    response = client.get("/agents/abc")
+    assert response.status_code == 404
+    assert "text/html" in response.headers["content-type"]
+    # the legitimate static routes keep working regardless of the slug above
+    assert client.get("/agents/new").status_code == 200
+    assert client.get("/agents/releases").status_code == 200
+
+
 # ---------- download-link security ----------
 
 def _pending(factory, release_id, **overrides):