fix(desktop): dismiss stale prompt overlays

[frizikk]

What does this PR do?

Fixes #59765.

Hermes Desktop can show sudo/admin or secret prompt overlays whose backend-side pending request has already timed out or completed. Before this change, responding/cancelling after that race produced a no pending ... request gateway error, showed an error toast, and left the local overlay store populated, so the dialog stayed stuck on screen.

This PR treats that specific stale-prompt gateway response as an already-resolved prompt: clear the local overlay state and do not show a failure toast for the stale response. Other gateway failures still keep the dialog open and surface the existing error notification.

Related Issue

Fixes #59765

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• apps/desktop/src/components/prompt-overlays.tsx
  • Clears stale sudo prompt overlays when sudo.respond returns no pending password request.
  • Clears stale secret prompt overlays when secret.respond returns no pending value request.
  • Avoids showing an error toast for those stale-prompt races, while preserving the existing error path for unrelated failures.
• apps/desktop/src/lib/gateway-rpc.ts
  • Adds isMissingPendingPromptRequest(...) for detecting stale prompt-response errors from the JSON-RPC gateway.
• apps/desktop/src/components/prompt-overlays.test.tsx
  • Adds renderer coverage for stale sudo and secret prompt dismissal.
  • Verifies stale prompt dismissal does not show a failure toast.
• apps/desktop/src/lib/gateway-rpc.test.ts
  • Covers stale prompt-response error detection and unrelated error rejection.

How to Test

1. Manual repro path:
   • Trigger a Desktop sudo/admin password prompt.
   • Let the backend-side pending password request disappear first, e.g. by timeout/completion/race.
   • Click Cancel/close on the Desktop dialog.
   • Expected: the dialog disappears and no stale no pending password request failure toast is shown.
2. Automated checks run locally after rebasing onto latest origin/main:

NODE_ENV=test NODE_OPTIONS='--max-old-space-size=8192 --localstorage-file=/tmp/hermes-vitest-pr59778-final-localstorage.json' \
  npm --workspace apps/desktop exec -- vitest run --environment jsdom \
  src/components/prompt-overlays.test.tsx \
  src/lib/gateway-rpc.test.ts

NODE_ENV=test npm --workspace apps/desktop run typecheck

NODE_ENV=test npm --workspace apps/desktop exec -- eslint \
  src/components/prompt-overlays.tsx \
  src/components/prompt-overlays.test.tsx \
  src/lib/gateway-rpc.ts \
  src/lib/gateway-rpc.test.ts

NODE_ENV=production npm --workspace apps/desktop run build

git diff --check HEAD

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run the relevant automated checks for this desktop-only TypeScript/React change (see How to Test; no Python files touched, so pytest tests/ -q is N/A here)
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Linux (CachyOS), Node.js v25.4.0 / npm 11.7.0

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — N/A, behavior is covered by tests and inline helper comment
• I've updated cli-config.yaml.example if I added/changed config keys — N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — browser/React-only overlay logic, no platform-specific APIs added
• I've updated tool descriptions/schemas if I changed tool behavior — N/A

For New Skills

N/A — this PR does not add a skill.

Screenshots / Logs

Local verification results after rebasing onto latest origin/main:

• Targeted Vitest: 2 passed, 6 tests passed.
• TypeScript: tsc -p . --noEmit passed.
• Changed-file ESLint: passed.
• Desktop production build: passed; assert-dist-built confirmed dist/index.html + assets present.
• git diff --check HEAD: passed.

[OutThisLife]

Approve. Clean, correctly-scoped desktop (Electron) fix — a different renderer from the Ink TUI work in #61885, so both are needed.

When sudo.respond / secret.respond races a backend timeout/completion and comes back "no pending … request", the dialog now clears the local overlay instead of toasting an error and leaving a stuck box; other failures still keep the dialog open and surface the error. isMissingPendingPromptRequest is a tidy, testable helper.

Degrades gracefully alongside #61885: once the server returns {status: expired} (success) for late secret/sudo responds, this catch simply stops firing and the existing success path clears the overlay — no conflict, no double-handling. Merges clean, tests included. Thanks @frizikk.