feat(chat): full sudo.request support with expire, cancel-unblock, secret fields (#1056)

app/src/main/java/com/m57/hermescontrol/data/ws/EventParser.kt

@@ -291,9 +291,21 @@ object EventParser {
                 WsEvent.SudoRequest(requestId, sessionId)
             }
 
+            "sudo.expire" -> {
+                val requestId = payload?.get("request_id") as? String
+                WsEvent.SudoExpire(requestId, sessionId)
+            }
+
             "secret.request" -> {
                 val requestId = payload?.get("request_id") as? String
-                WsEvent.SecretRequest(requestId, sessionId)
+                val envVar = payload?.get("env_var") as? String
+                val prompt = payload?.get("prompt") as? String
+                WsEvent.SecretRequest(requestId, sessionId, envVar, prompt)
+            }
+
+            "secret.expire" -> {
+                val requestId = payload?.get("request_id") as? String
+                WsEvent.SecretExpire(requestId, sessionId)
             }
 
             else -> {

app/src/main/java/com/m57/hermescontrol/data/ws/WsEvent.kt

@@ -244,14 +244,37 @@ sealed class WsEvent {
         val sessionId: String?,
     ) : WsEvent()
 
+    /**
+     * Backend sudo timeout (120s `_block`) — clears the matching dialog.
+     * Payload: `{ request_id }`. Only clears when ids match so a late
+     * expire for an old prompt never kills the current one (desktop parity).
+     */
+    data class SudoExpire(
+        val requestId: String?,
+        val sessionId: String?,
+    ) : WsEvent()
+
     /**
      * Backend needs a secret value (password / token) to continue a turn
      * (desktop: `secret.request` → `secret.respond {request_id, value}`).
      * Mobile previously dropped this and the agent hung forever.
+     * `envVar`/`prompt` mirror desktop: title = envVar ?: secretTitle,
+     * body = prompt ?: secretDesc.
      */
     data class SecretRequest(
         val requestId: String?,
         val sessionId: String?,
+        val envVar: String? = null,
+        val prompt: String? = null,
+    ) : WsEvent()
+
+    /**
+     * Backend secret timeout — clears the matching dialog.
+     * Payload: `{ request_id }`. Match-only clear like [SudoExpire].
+     */
+    data class SecretExpire(
+        val requestId: String?,
+        val sessionId: String?,
     ) : WsEvent()
 
     // ── Gateway-level errors ───────────────────────────────────────────