# Tasks

- [x] 1. Server: `GITEA_URL`/`FPAGENT_REPO` constants, the installer key read
  from `GITEA_RELEASE_INSTALL_KEY`, and two public proxy routes registered
  before the session middleware: `GET /fpagent/releases/latest` (trimmed
  `{tag, assets:[{name,url}]}`, same-origin URLs, unsafe names dropped) and
  `GET /fpagent/releases/download/:tag/:name` (validated names, streamed with
  the key, 404/502 mapping, 503 when unconfigured).
- [x] 2. Installer script `tools/public/fpagent/install.sh`: fetch metadata,
  prefer the host-codename offline bundle over the generic one, download and
  verify sha256, extract, and forward all options to the bundle's `install.sh`.
  Served uncached at `/fpagent/install.sh`.
- [x] 3. Tests (`tools/test/fpagent-install.test.js`): latest proxy shape and
  token non-disclosure, asset streaming with upstream auth, invalid-name
  rejection, missing-asset 404, unconfigured 503, public script serving, and
  `bash -n` on the script.
- [x] 4. Docs/config: `GITEA_RELEASE_INSTALL_KEY` in `.env.example`, installer
  and configuration notes in `README.md`.
- [x] 5. Verified: 55 tests pass (48 existing + 7 new); routes exercised live
  against the forge (latest release `v1.0.0`, proxied checksum matches the
  publisher's, invalid name refused); the installer run end to end against a
  fake release base — codename bundle chosen, checksum pass and fail, options
  forwarded to the extracted bundle installer.