Fix: show SecureConfig codes on screen during configuration

The Agent only opened the on-screen passcode splash when IsMachineConfigured()
was false (Ethernet adapter on DHCP). But during SecureConfig the Service assigns
a TEMPORARY static IP to the adapter so it can broadcast — which flips
IsMachineConfigured() to true. So an Agent starting at auto-login (in the
SecureConfig wait window) saw a "configured" adapter and skipped the splash
entirely; the Request ID / Passphrase only reached the log and the COM2 plasma
display, never the screen.

Gate the splash on the configuring.json file the Service writes (before the temp
IP) as well as the DHCP check, and make the splash dismiss robustly when
SecureConfig finishes (file gone after being seen, or the machine becomes
configured). The COM2 plasma path in the Service was already correct.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Launcher/TeslaLauncherAgent.cs

@@ -58,16 +58,22 @@ namespace Tesla.Launcher.Agent
             Application.EnableVisualStyles();
             Application.SetCompatibleTextRenderingDefault(false);
 
-            // First-boot check: if this machine is unconfigured (DHCP adapter),
+            // First-boot check: show the configuring splash (with the SecureConfig
-            // show a waiting splash. The Service (Session 0) runs the full
+            // Request ID + Passphrase) when the machine is unconfigured OR when
-            // SecureConfig protocol and applies the static IP.
+            // SecureConfig is actively running.
-            // When the splash detects configuration is complete it closes itself,
+            //
-            // and we fall through to start the normal Agent with the pipe server.
+            // The second condition is essential: during SecureConfig the Service
-            if (!IsMachineConfigured())
+            // assigns a TEMPORARY static IP to the Ethernet adapter so it can
+            // broadcast. That makes IsMachineConfigured() report true, so the DHCP
+            // check ALONE would skip the splash and the codes would never reach the
+            // screen — they'd only be in the log / on the COM2 plasma display. The
+            // Service writes configuring.json *before* assigning that temp IP, so its
+            // presence is the authoritative "SecureConfig in progress" signal.
+            if (!IsMachineConfigured() || File.Exists(ConfiguringFilePath()))
             {
-                ShowConfiguringWait();   // blocks until config detected or form closed
+                ShowConfiguringWait();   // blocks until config completes or form closed
 
-                // If still not configured (user closed the splash manually), exit.
+                // If still not configured (config failed / user closed splash), exit.
                 if (!IsMachineConfigured())
                     return;
             }
@@ -109,6 +115,12 @@ namespace Tesla.Launcher.Agent
             return false; // all Ethernet adapters are DHCP or absent → needs configuration
         }
 
+        /// <summary>Shared file the Service writes (before assigning the temp IP) while
+        /// SecureConfig is in progress; holds the RequestId/Passphrase for the splash.</summary>
+        private static string ConfiguringFilePath() => Path.Combine(
+            Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData),
+            "TeslaLauncher", "configuring.json");
+
         private static bool IsVirtualAdapter(NetworkInterface nic)
         {
             var desc = nic.Description ?? "";
@@ -224,22 +236,24 @@ namespace Tesla.Launcher.Agent
             form.Controls.Add(lblHint);
 
             string lastJson = null;
-            bool codesLoaded = false;
+            bool sawFile = false;
-            var cfgFile = Path.Combine(
+            var cfgFile = ConfiguringFilePath();
-                Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData),
-                "TeslaLauncher", "configuring.json");
 
             // Poll every 2 s — read codes from the Service's shared file.
             // The file lifecycle:
             //   1. Service deletes stale file on startup
-            //   2. Service writes fresh file with new codes
+            //   2. Service writes fresh file with new codes (before the temp IP)
             //   3. Agent reads and displays codes
             //   4. Service deletes file when config is complete → splash closes
+            // If the Agent started before the file appeared, it keeps waiting; it
+            // closes once the file we saw is gone, or the machine becomes configured
+            // (covers the case where config finished before we managed to read it).
             var timer = new System.Windows.Forms.Timer { Interval = 2000 };
             timer.Tick += (s, e) =>
             {
                 if (File.Exists(cfgFile))
                 {
+                    sawFile = true;
                     try
                     {
                         var json = File.ReadAllText(cfgFile);
@@ -252,14 +266,14 @@ namespace Tesla.Launcher.Agent
                                 lblRequestId.Text = rid.GetString();
                             if (root.TryGetProperty("Passphrase", out var pp))
                                 lblPassphrase.Text = pp.GetString();
-                            codesLoaded = true;
                         }
                     }
                     catch { /* file may be mid-write, retry next tick */ }
                 }
-                else if (codesLoaded)
+                else if (sawFile || IsMachineConfigured())
                 {
-                    // Service deleted the file → configuration complete.
+                    // File gone after we saw it, or the machine is now configured →
+                    // SecureConfig is complete.
                     timer.Stop();
                     form.Close();
                 }