@agentdeck/bridge 1.0.8 → 1.0.10

package/dist/daemon-server.js

@@ -25,9 +25,10 @@ import { SessionFocusRelay } from './session-focus-relay.js';
 import { SubagentTimelineTracker } from './subagent-timeline.js';
 import { getRemoteSession, getRemoteSender, listRemoteEnriched, } from './remote-sessions.js';
 import { createPushChannelHandler } from './session-push-channel.js';
-import { setAwaitingOverlay, setPermissionNotificationOverlay, setAskUserQuestionOverlay, clearAwaitingOverlay, clearAskUserQuestionOverlay, getAwaitingOverlay, isPermissionNotification, applyAwaitingOverlayToObserved, } from './awaiting-overlay.js';
-import { registerPending, resolvePending, sweepStalePending, drainAllPending, isPendingRequest } from './permission-resolver.js';
-import { shouldHoldPreToolUse, gateReleased, buildGateQuestion, consumeStop, requestStop, clearStop, STOP_DENY_REASON, queueDirective, takeDirective, clearOnUserPrompt, clearSession as clearSteeringSession, } from './observed-steering.js';
+import { setAwaitingOverlay, setPermissionNotificationOverlay, setAskUserQuestionOverlay, advanceAskUserQuestionOverlay, getAskUserQuestionAnswers, clearAwaitingOverlay, clearAskUserQuestionOverlay, getAwaitingOverlay, isPermissionNotification, applyAwaitingOverlayToObserved, } from './awaiting-overlay.js';
+import { askEchoMatches, askGateDecision, askPressVerdict } from './ask-gate.js';
+import { registerPending, resolvePending, resolvePendingWithReason, sweepStalePending, drainAllPending, isPendingRequest, } from './permission-resolver.js';
+import { shouldHoldPreToolUse, beginAskGate, gateReleased, buildGateQuestion, buildAskAnswerReason, consumeStop, requestStop, clearStop, STOP_DENY_REASON, queueDirective, takeDirective, clearOnUserPrompt, clearSession as clearSteeringSession, } from './observed-steering.js';
 import { notePermissionPromptShown, noteToolEnd, steeringSnapshot, } from './observed-steering.js';
 import { resolveSessionIdPrefix } from './session-id-resolve.js';
 import { injectObservedSelection, injectObservedText } from './observed-inject.js';
@@ -46,6 +47,15 @@ const OBSERVED_APPROVAL_ENABLED = process.env.AGENTDECK_OBSERVED_APPROVAL !== '0
  *  call to Claude's own permission flow. Must stay well under the hook curl's
  *  --max-time 60 so the release reaches Claude before curl gives up. */
 const OBSERVED_APPROVAL_HOLD_MS = Math.min(50_000, Math.max(5_000, Number(process.env.AGENTDECK_APPROVAL_HOLD_MS) || 25_000));
+/** AskUserQuestion ask-gate (PreToolUse hold so a device can answer the
+ *  question). Only ever engaged when this daemon has no way to type the answer
+ *  into the session's terminal, so it costs the terminal user nothing whenever
+ *  injection is available. Kill switch for field issues. */
+const ASK_GATE_ENABLED = process.env.AGENTDECK_ASK_GATE !== '0';
+/** Hold budget for an ask-gate. Longer than the permission gate because the
+ *  user may answer several question groups in one call, and still under the
+ *  hook curl's --max-time 60 so the release reaches Claude. */
+const ASK_GATE_HOLD_MS = Math.min(50_000, Math.max(5_000, Number(process.env.AGENTDECK_ASK_GATE_HOLD_MS) || 45_000));
 /** Inactivity after which an unclosed APME run is treated as abandoned and
  *  finalized. Deliberately generous: an orphan stays reapable forever, so
  *  closing it late costs nothing, while reaping a live run corrupts the unit
@@ -55,9 +65,10 @@ const OBSERVED_APPROVAL_HOLD_MS = Math.min(50_000, Math.max(5_000, Number(proces
 const APME_ABANDONED_RUN_STALE_SEC = Math.max(600, Number(process.env.AGENTDECK_APME_ABANDON_SEC) || 7200);
 import { VoiceManager } from './voice.js';
 import { VoiceAssistantManager } from './voice-assistant.js';
-import { listActive as listActiveSessions, findAvailablePort, findExistingDaemon, DAEMON_DEFAULT_PORT, probeDaemonHealth, requestDaemonShutdown, scanDaemonPortWindow, shouldConcedePortToOccupant, waitForDaemonExit, writeDaemonInfo, ensureDaemonInfo, removeDaemonInfo, readDaemonInfo, removeDaemonSession, getCandidateDataDirs, getOwnTimelineFile, } from './session-registry.js';
+import { listActive as listActiveSessions, findAvailablePort, findExistingDaemon, DAEMON_DEFAULT_PORT, probeDaemonHealth, requestDaemonShutdown, scanDaemonPortWindow, shouldConcedePortToOccupant, waitForDaemonExit, waitForPortBindable, writeDaemonInfo, ensureDaemonInfo, removeDaemonInfo, readDaemonInfo, removeDaemonSession, getCandidateDataDirs, getOwnTimelineFile, } from './session-registry.js';
 import { fetchUsageFromApi, hasOAuthToken, resetConsecutiveFailures } from './usage-api.js';
 import { isLocalConnection, validateToken } from './auth.js';
+import { buildPublicHealth, gateHttpRequest, isAuthorizedHttpRequest } from './http-auth-gate.js';
 import { getLastFrame, renderPreviewFrame, onFrameRendered, offFrameRendered } from './pixoo/pixoo-bridge.js';
 import { loadIDotMatrixDevices } from './idotmatrix/idotmatrix-settings.js';
 import { handlePixooWake } from './pixoo/pixoo-client.js';
@@ -893,6 +904,10 @@ export async function startDaemon(opts) {
                 log(`[agentdeck] Swift daemon detected on port ${probePort}. Requesting shutdown to take over...`);
                 await requestDaemonShutdown(probePort);
                 await waitForDaemonExit(probePort);
+                // …and until the socket is actually released. NWListener.cancel()
+                // returns before the port is free, so "stopped answering" alone would
+                // let the bind below land on a fallback port.
+                await waitForPortBindable(probePort);
                 removeDaemonInfo();
             }
             else {
@@ -937,6 +952,7 @@ export async function startDaemon(opts) {
                     log(`[agentdeck] Swift daemon detected on port ${requestedPort} via /health. Requesting shutdown to take over...`);
                     await requestDaemonShutdown(requestedPort);
                     await waitForDaemonExit(requestedPort);
+                    await waitForPortBindable(requestedPort);
                 }
                 else {
                     // Daemon alive but not in our registry — race condition or stale state
@@ -989,6 +1005,33 @@ export async function startDaemon(opts) {
     // Codex sessions known only from `codex_*` hooks — the backstop for when the
     // process scan can't see one (lsof timeout, no rollout held open).
     const hookCodexSessions = new HookCodexSessions();
+    // Declared before the HTTP server: the PreToolUse route reads it to decide
+    // whether this daemon can type into a session's terminal, and hooks start
+    // arriving the moment the port binds — several hundred milliseconds before
+    // the rest of startup finishes. A later `const` would leave that window
+    // throwing on the temporal dead zone.
+    const passiveSessionObserver = new PassiveSessionObserver();
+    /** Observed Claude sessions whose AskUserQuestion PreToolUse is held open for
+     *  a device answer, keyed by the bare Claude session UUID. Its presence is
+     *  what makes the session's options pressable (`liveAnswerable`) and what
+     *  routes a `select_option` press to the gate instead of terminal injection. */
+    const pendingAskGateBySession = new Map();
+    /** Per session UUID: the timestamp until which `select_option` presses are
+     *  swallowed because a terminal injection is typing (or has just finished).
+     *  A second press landing mid-injection would aim its arrow keys at a picker
+     *  that is about to advance to the next question, selecting the wrong option
+     *  there — so the guard spans the keystrokes plus a short settle window. */
+    const injectionGuardUntil = new Map();
+    /** Per session UUID: when the next ask-gate press will be accepted. An
+     *  answer is irreversible (it resolves the agent's hook), and a grouped
+     *  prompt advances on each one, so two frames from a bouncing key would
+     *  answer two different questions with the same index. */
+    const askPressGuardUntil = new Map();
+    const ASK_PRESS_DEBOUNCE_MS = 400;
+    /** Upper bound for one injection attempt (host ladder + paced keystrokes). */
+    const INJECTION_GUARD_MAX_MS = 60_000;
+    /** Settle window after the keys land, covering the TUI's own redraw. */
+    const INJECTION_SETTLE_MS = 1_200;
     // Declare early — HTTP /health handler references this in its closure.
     // Must be declared before the HTTP server so it's initialized (not in TDZ)
     // when the first /health request arrives.
@@ -1089,6 +1132,32 @@ export async function startDaemon(opts) {
     let subagentTimeline = null;
     // ===== HTTP server =====
     const httpServer = createServer((req, res) => {
+        // LAN default-deny (issue #145): a request that is neither same-machine
+        // nor token-bearing reaches exactly one route — a minimal GET /health
+        // with no pairingToken, no module/device inventory, no session state.
+        // Everything else 401s here, before any route dispatch. The per-route
+        // token checks further down remain as defense in depth.
+        {
+            const gatePathname = (() => {
+                try {
+                    return new URL(req.url ?? '/', 'http://localhost').pathname;
+                }
+                catch {
+                    return '/';
+                }
+            })();
+            const decision = gateHttpRequest(req.method ?? 'GET', gatePathname, isAuthorizedHttpRequest(req));
+            if (decision === 'public-health') {
+                res.writeHead(200, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify(buildPublicHealth(port)));
+                return;
+            }
+            if (decision === 'deny') {
+                res.writeHead(401, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Unauthorized — pairing token required for LAN access' }));
+                return;
+            }
+        }
         // APME routes: auth-gated (task prompts, project paths, hook payloads are sensitive).
         if ((req.url ?? '').startsWith('/apme')) {
             const ip = req.socket.remoteAddress ?? '';
@@ -1112,7 +1181,10 @@ export async function startDaemon(opts) {
         }
         const parsedUrl = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
         const pathname = parsedUrl.pathname;
-        // Health check is public (no auth) — used by iOS/Android for pairing token discovery
+        // Full health — only reachable same-machine or with a valid pairing token
+        // (the LAN gate above serves unauthenticated peers buildPublicHealth
+        // instead). pairingToken stays here for local consumers: sibling bridges,
+        // the TUI, and the macOS companion's file-less fallback.
         if (req.method === 'GET' && pathname === '/health') {
             const snap = core.stateMachine.getSnapshot();
             res.writeHead(200, { 'Content-Type': 'application/json' });
@@ -1415,8 +1487,8 @@ export async function startDaemon(opts) {
         }
         // ===== Card Feed pull sync (M6) — wake-sync-sleep battery clients =====
         // Auth mirrors /apme: local connections are free; anything else needs the
-        // pairing token (?token=). Devices hold it from provisioning; /health
-        // exposes it for LAN pairing.
+        // pairing token (?token=). Devices hold it from provisioning — since
+        // issue #145 the daemon no longer hands it to unauthenticated LAN peers.
         // ===== Glance Frame (M8) — daemon-rendered pixels of the glance =====
         // The device-side glance renderer is the offline fallback; this is the
         // rich face. `?format=png` returns the exact dithered panel pixels, so a
@@ -1789,6 +1861,9 @@ export async function startDaemon(opts) {
                         }
                         else if (mapped === 'session_end') {
                             clearSteeringSession(claudeSid);
+                            pendingAskGateBySession.delete(claudeSid);
+                            injectionGuardUntil.delete(claudeSid);
+                            askPressGuardUntil.delete(claudeSid);
                         }
                         const currentOverlay = getAwaitingOverlay(claudeSid);
                         let cleared = false;
@@ -2118,7 +2193,66 @@ export async function startDaemon(opts) {
                         core.broadcastSessionsList().catch(() => { });
                         return;
                     }
-                    // 2. Device-approval gate: hold the response for a device decision,
+                    // 2. AskUserQuestion ask-gate: the structured overlay was set from
+                    //    this same hook above, so devices are already showing the real
+                    //    choices. Hold the call so a device press can answer it — the
+                    //    only delivery channel a sandboxed daemon has, since it cannot
+                    //    type into the user's terminal. Skipped whenever injection IS
+                    //    available: answering the live picker costs the person sitting at
+                    //    that terminal nothing, whereas a hold makes them wait for it to
+                    //    appear. Timeout releases with an empty body, so an unanswered
+                    //    question just shows up in the terminal as usual.
+                    if (claudeSid && toolName === 'AskUserQuestion') {
+                        const askOverlay = getAwaitingOverlay(claudeSid);
+                        if (askOverlay?.kind === 'option') {
+                            const obs = passiveSessionObserver.collect([])
+                                .find((s) => s.id === `observed:claude:${claudeSid}`);
+                            const worthHolding = askGateDecision({
+                                enabled: ASK_GATE_ENABLED,
+                                clientCount: core.wsServer.getClientCount(),
+                                observed: obs,
+                            });
+                            const gate = worthHolding.hold
+                                ? beginAskGate({
+                                    sessionId: claudeSid,
+                                    clientCount: core.wsServer.getClientCount(),
+                                    enabled: ASK_GATE_ENABLED,
+                                })
+                                : { hold: false, requestId: undefined, reason: worthHolding.reason };
+                            if (gate.hold && gate.requestId) {
+                                const requestId = gate.requestId;
+                                const askToolUseId = typeof json.tool_use_id === 'string' ? json.tool_use_id : undefined;
+                                debug('daemon', `AskUserQuestion gate held: req=${requestId} sid=${claudeSid.slice(0, 8)}`);
+                                pendingAskGateBySession.set(claudeSid, { requestId, toolUseId: askToolUseId });
+                                core.broadcastSessionsList().catch(() => { }); // liveAnswerable → true
+                                registerPending(requestId, res, {
+                                    sessionId: claudeSid,
+                                    tool: toolName,
+                                    timeoutMs: ASK_GATE_HOLD_MS,
+                                    onResolved: (decision) => {
+                                        pendingAskGateBySession.delete(claudeSid);
+                                        // `undecided: false` always: an unanswered question says
+                                        // nothing about what Claude auto-approves, so it must not
+                                        // feed the auto-approval learner.
+                                        gateReleased(claudeSid, requestId, {
+                                            undecided: false, tool: toolName, toolInput,
+                                        });
+                                        // Answered → the tool call is denied and never runs, so no
+                                        // PostToolUse will ever arrive to clear the overlay; clear
+                                        // it here. Timed out → the picker is now on the user's own
+                                        // screen, so the overlay stays as a display-only prompt and
+                                        // liveAnswerable falls back to false.
+                                        if (decision === 'deny')
+                                            clearAskUserQuestionOverlay(claudeSid, askToolUseId);
+                                        core.broadcastSessionsList().catch(() => { });
+                                    },
+                                });
+                                return; // response held open — resolved by device / timeout
+                            }
+                            debug('daemon', `AskUserQuestion not held: ${gate.reason} (${claudeSid.slice(0, 8)})`);
+                        }
+                    }
+                    // 3. Device-approval gate: hold the response for a device decision,
                     //    but ONLY for calls the precision guards say Claude would
                     //    genuinely prompt for (see shouldHoldPreToolUse — mode gate,
                     //    never-prompt/prompt-prone sets, allowlist prediction, learned
@@ -2401,6 +2535,12 @@ export async function startDaemon(opts) {
         if (!socket.destroyed)
             socket.destroy();
     });
+    // All-interfaces bind is deliberate — companion apps, ESP32 boards, and
+    // pull-sync e-ink clients live on the LAN — and the security boundary is the
+    // pairing token (http-auth-gate.ts default-denies unauthenticated LAN
+    // requests; the WS server has always token-gated non-local peers). Users
+    // with no LAN devices can opt into a loopback-only bind (issue #145).
+    const bindHost = process.env.AGENTDECK_LOOPBACK_ONLY === '1' ? '127.0.0.1' : '0.0.0.0';
     await new Promise((resolve, reject) => {
         httpServer.on('error', (err) => {
             if (err.code === 'EADDRINUSE') {
@@ -2411,7 +2551,7 @@ export async function startDaemon(opts) {
                 reject(err);
             }
         });
-        httpServer.listen(port, '0.0.0.0', () => resolve());
+        httpServer.listen(port, bindHost, () => resolve());
     }).catch(async (err) => {
         // Handle race condition: port became unavailable after our pre-bind probe.
         // This is the concurrent-start case (e.g. two logon-trigger fires landing
@@ -2439,13 +2579,19 @@ export async function startDaemon(opts) {
             log(`[agentdeck] Port ${requestedPort} grabbed by ${occupant?.mode ?? 'a non-daemon'}, retrying on ${port}...`);
             await new Promise((resolve, reject) => {
                 httpServer.on('error', (e) => reject(e));
-                httpServer.listen(port, '0.0.0.0', () => resolve());
+                httpServer.listen(port, bindHost, () => resolve());
             });
         }
         else {
             throw err;
         }
     });
+    if (bindHost === '127.0.0.1') {
+        log(`[agentdeck] AGENTDECK_LOOPBACK_ONLY=1 — daemon bound to 127.0.0.1:${port}; LAN devices (companion apps, ESP32/WiFi boards) cannot connect.`);
+    }
+    else {
+        log(`[agentdeck] Daemon listening on all interfaces (:${port}) — LAN requests require the pairing token (~/.agentdeck/auth-token). Set AGENTDECK_LOOPBACK_ONLY=1 for a loopback-only bind.`);
+    }
     // Write daemon.json for client discovery (must be after successful bind).
     // Keep the original startedAt stable when the self-heal timer rewrites it.
     const daemonInfo = { port, pid: process.pid, startedAt: new Date().toISOString() };
@@ -2863,7 +3009,7 @@ export async function startDaemon(opts) {
         }
     }
     log(`[agentdeck] WebSocket server ready on port ${port}`);
-    log(`[agentdeck] Pairing URL: ${core.wsUrl}`);
+    log('[agentdeck] Pairing credential ready; run "agentdeck qr" to pair a device.');
     // Initialize APME store + collector so the daemon can serve /apme/* HTTP
     // routes. `setApme` on core is gated against the `daemon` meta-session so
     // register/deregister won't open a bogus run. Session bridges opening their
@@ -2908,7 +3054,6 @@ export async function startDaemon(opts) {
     }
     // Register session
     core.registerSession('daemon');
-    const passiveSessionObserver = new PassiveSessionObserver();
     // The observer scans in the background now (collect() returns the cache
     // immediately). When a scan lands fresh observations, push them out via
     // the debounced broadcast so clients don't wait for the next 10 s poll.
@@ -2939,12 +3084,15 @@ export async function startDaemon(opts) {
             // "stopping at next tool" / queued-directive badges from these.
             if (!s.id.startsWith('observed:claude:'))
                 return { ...s, liveAnswerable: false };
-            // Can this daemon type into the session's live prompt? Only observed
-            // Claude routes select_option to the injector, and only with a host to
-            // aim at. Sent in both polarities — decks read it to decide whether an
-            // AskUserQuestion option is a button or an inert mirror of the terminal.
-            const liveAnswerable = Boolean(s.tty || s.appName);
-            const snap = steeringSnapshot(s.id.slice('observed:claude:'.length));
+            // Will a device press on this session's options reach the agent? Two
+            // rungs qualify: this daemon can type into the session's live prompt
+            // (a reachable terminal/app host), or it is holding the session's
+            // AskUserQuestion open and will answer it with the device's choice.
+            // Sent in both polarities — decks read it to decide whether an option
+            // is a button or an inert mirror of the terminal.
+            const uuid = s.id.slice('observed:claude:'.length);
+            const liveAnswerable = Boolean(s.tty || s.appName) || pendingAskGateBySession.has(uuid);
+            const snap = steeringSnapshot(uuid);
             return {
                 ...s,
                 liveAnswerable,
@@ -3468,6 +3616,51 @@ export async function startDaemon(opts) {
         }
         if (type === 'respond' || type === 'select_option') {
             const ov = getAwaitingOverlay(uuid);
+            // Stale-press guard. A multi-group AskUserQuestion moves to the next
+            // question the instant one is answered, so an index pressed against the
+            // question the device was still displaying would select the wrong option
+            // in the new list. Devices that echo what they showed get validated;
+            // re-broadcasting re-syncs them to the live question.
+            const echo = typeof command.question === 'string' ? command.question : undefined;
+            if (ov?.kind === 'option' && echo && ov.question && !askEchoMatches(echo, ov.question)) {
+                debug('daemon', `observed ${type} dropped: answers a stale question (${uuid.slice(0, 8)})`);
+                core.broadcastSessionsList().catch(() => { });
+                return;
+            }
+            // Held AskUserQuestion gate — this daemon owns the prompt (the picker
+            // never reached the user's terminal). Record the answer, show the next
+            // group, and resolve the hook once every group has one. Every rejection
+            // below is a press that would otherwise commit an answer the user did
+            // not give, so `askPressVerdict` is deliberately strict.
+            const askGate = pendingAskGateBySession.get(uuid);
+            if (askGate) {
+                const now = Date.now();
+                if (now < (askPressGuardUntil.get(uuid) ?? 0)) {
+                    debug('daemon', `ask-gate press dropped: too soon after the last one (${uuid.slice(0, 8)})`);
+                    return;
+                }
+                const verdict = askPressVerdict({
+                    overlay: ov, gateToolUseId: askGate.toolUseId, command,
+                });
+                if (!verdict.ok) {
+                    debug('daemon', `ask-gate press dropped: ${verdict.reason} (${uuid.slice(0, 8)})`);
+                    if (verdict.resync)
+                        core.broadcastSessionsList().catch(() => { });
+                    return;
+                }
+                askPressGuardUntil.set(uuid, now + ASK_PRESS_DEBOUNCE_MS);
+                const { label } = verdict;
+                const step = advanceAskUserQuestionOverlay(uuid, label);
+                if (step === 'complete') {
+                    resolvePendingWithReason(askGate.requestId, 'deny', buildAskAnswerReason(getAskUserQuestionAnswers(uuid)));
+                    debug('daemon', `ask-gate answered (${uuid.slice(0, 8)}): "${label.slice(0, 40)}"`);
+                }
+                else {
+                    // Next question group — devices swap to it on this broadcast.
+                    core.broadcastSessionsList().catch(() => { });
+                }
+                return;
+            }
             if (ov?.requestId) {
                 const allow = type === 'select_option'
                     ? command.index === 0
@@ -3481,16 +3674,42 @@ export async function startDaemon(opts) {
             // terminal isn't reachable the prompt simply stays for the user.
             if (type === 'select_option' && typeof command.index === 'number') {
                 const idx = command.index;
+                const now = Date.now();
+                if (now < (injectionGuardUntil.get(uuid) ?? 0)) {
+                    debug('daemon', `observed select_option dropped: injection in flight (${uuid.slice(0, 8)})`);
+                    return;
+                }
+                injectionGuardUntil.set(uuid, now + INJECTION_GUARD_MAX_MS);
                 const obs = passiveSessionObserver.collect([])
                     .find((s) => s.id === `observed:claude:${uuid}`);
                 // The option's visible label lets app-hosted prompts press the matching
                 // native button instead of guessing cursor movement.
                 const label = ov?.options?.[idx]?.label;
-                injectObservedSelection({ tty: obs?.tty, appName: obs?.appName, label }, idx).then((r) => {
+                // A grouped AskUserQuestion does not close on its last answer — it
+                // shows a "Review your answers → Submit answers" confirmation. Nobody
+                // is at that screen to press it, so the last answer carries the extra
+                // Enter. Single-question prompts have no such step.
+                //
+                // The count that decides this is what CLAUDE rendered, not what we
+                // parsed: a group we dropped as malformed is still a tab in the user's
+                // form, so trusting `groups.length` would skip the confirmation on a
+                // form that has one — and the agent would wait on it forever.
+                const groupCount = ov?.rawGroupCount ?? ov?.groups?.length ?? 1;
+                const parsedCount = ov?.groups?.length ?? 1;
+                const confirmSubmit = groupCount > 1 && (ov?.activeGroup ?? 0) === parsedCount - 1;
+                injectObservedSelection({ tty: obs?.tty, appName: obs?.appName, label }, idx, { confirmSubmit }).then((r) => {
+                    injectionGuardUntil.set(uuid, Date.now() + INJECTION_SETTLE_MS);
                     debug('daemon', r.ok
                         ? `observed selection injected via ${r.via} (idx ${idx}, ${uuid.slice(0, 8)})`
                         : `observed selection NOT injected: ${r.reason} (${uuid.slice(0, 8)})`);
-                }).catch(() => { });
+                    // The keys landed, so the TUI has moved to the next question group —
+                    // move the overlay with it or devices keep offering the answered one.
+                    if (r.ok && advanceAskUserQuestionOverlay(uuid, label) !== 'ignored') {
+                        core.broadcastSessionsList().catch(() => { });
+                    }
+                }).catch(() => {
+                    injectionGuardUntil.set(uuid, Date.now() + INJECTION_SETTLE_MS);
+                });
             }
             return;
         }