pam/adapter: skip authModeSelection stage for interactive terminal

pam/internal/adapter/authmodeselection.go

@@ -143,13 +143,18 @@ func (m authModeSelectionModel) Update(msg tea.Msg) (authModeSelectionModel, tea
 
 		cmd := m.SetItems(allAuthModes)
 
-		// Autoselect first auth mode if any, as soon as we've the focus.
+		// Auto-select the first auth mode when available.
+		// For InteractiveTerminal, always select immediately because the
+		// authModeSelection stage is skipped entirely (see model.go).
+		// For GDM/Native, defer the selection until the auth mode selection
+		// stage is active (list is focused), so the stage transition completes
+		// before we request the corresponding UI layout.
 		if len(m.availableAuthModes) == 0 {
 			return m, cmd
 		}
 
 		firstAuthModeID := m.availableAuthModes[0].Id
-		if !m.Focused() {
+		if m.clientType != InteractiveTerminal && !m.Focused() {
 			m.autoSelectedAuthModeID = firstAuthModeID
 			return m, cmd
 		}

pam/internal/adapter/model.go

@@ -345,10 +345,33 @@ func (m uiModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
 			return m, nil
 		}
 
-		return m, tea.Sequence(
-			getAuthenticationModes(m.client, m.currentSession.sessionID, m.authModeSelectionModel.SupportedUILayouts()),
-			sendEvent(ChangeStage{proto.Stage_authModeSelection}),
-		)
+		getModesCmd := getAuthenticationModes(m.client, m.currentSession.sessionID, m.authModeSelectionModel.SupportedUILayouts())
+
+		// For InteractiveTerminal, skip the authModeSelection stage entirely.
+		// The first auth mode is auto-selected immediately when modes arrive
+		// (see authModesReceived), so transitioning to the authModeSelection
+		// stage would only cause the auth mode list to flash briefly on screen
+		// before the auto-selected challenge view replaces it.
+		if m.clientType == InteractiveTerminal {
+			return m, getModesCmd
+		}
+
+		changeStageCmd := sendEvent(ChangeStage{proto.Stage_authModeSelection})
+
+		// For native/SSH mode during MFA (auth.Next), the stage is still
+		// "challenge". We need to transition through authModeSelection so
+		// that the subsequent auto-selection properly triggers a new challenge
+		// via the normal stage change path (Compose → ChangeStage{challenge}
+		// → StageChanged → nativeChallengeRequested).
+		// Stage change must happen BEFORE fetching modes, so that when
+		// authModesReceived fires the list is already focused and the
+		// immediate auto-selection is safe (no risk of the deferred
+		// ChangeStage{authModeSelection} pulling us back after challenge starts).
+		if m.currentStage() == proto.Stage_challenge {
+			return m, tea.Sequence(changeStageCmd, getModesCmd)
+		}
+
+		return m, tea.Sequence(getModesCmd, changeStageCmd)
 
 	case AuthModeSelected:
 		safeMessageDebug(msg)