From 063b35f1dc345a208bcbecb3b5e59b35d6d89150 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Wed, 10 Dec 2025 14:32:54 +0000
Subject: [PATCH] mac: surface gateway auth failures

---
 apps/macos/Sources/Clawdis/ControlChannel.swift | 8 ++++++++
 apps/macos/Sources/Clawdis/GatewayChannel.swift | 7 +++++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/apps/macos/Sources/Clawdis/ControlChannel.swift b/apps/macos/Sources/Clawdis/ControlChannel.swift
index f95252317..dec849e9e 100644
--- a/apps/macos/Sources/Clawdis/ControlChannel.swift
+++ b/apps/macos/Sources/Clawdis/ControlChannel.swift
@@ -140,6 +140,14 @@ final class ControlChannel: ObservableObject {
             return desc
         }
 
+        // If the gateway explicitly rejects the hello (e.g., auth/token mismatch), surface it.
+        if let urlErr = error as? URLError,
+           urlErr.code == .dataNotAllowed // used for WS close 1008 auth failures
+        {
+            let reason = urlErr.failureURLString ?? urlErr.localizedDescription
+            return "Gateway rejected token; set CLAWDIS_GATEWAY_TOKEN in the mac app environment or clear it on the gateway. Reason: \(reason)"
+        }
+
         // Common misfire: we connected to localhost:18789 but the port is occupied
         // by some other process (e.g. a local dev gateway or a stuck SSH forward).
         // The gateway handshake returns something we can't parse, which currently
diff --git a/apps/macos/Sources/Clawdis/GatewayChannel.swift b/apps/macos/Sources/Clawdis/GatewayChannel.swift
index 53e76e31e..f12a0f103 100644
--- a/apps/macos/Sources/Clawdis/GatewayChannel.swift
+++ b/apps/macos/Sources/Clawdis/GatewayChannel.swift
@@ -141,10 +141,13 @@ private actor GatewayChannelActor {
             return
         }
         if let err = try? decoder.decode(HelloError.self, from: data) {
+            let reason = err.reason ?? "unknown"
+            // Log and throw a detailed error so UI can surface token/hello issues.
+            self.logger.error("gateway hello-error: \(reason, privacy: .public)")
             throw NSError(
                 domain: "Gateway",
-                code: 1,
-                userInfo: [NSLocalizedDescriptionKey: "hello-error: \(err.reason)"])
+                code: 1008,
+                userInfo: [NSLocalizedDescriptionKey: "hello-error: \(reason)"])
         }
         throw NSError(
             domain: "Gateway",