mac: surface gateway auth failures

apps/macos/Sources/Clawdis/ControlChannel.swift

@@ -140,6 +140,14 @@ final class ControlChannel: ObservableObject {
             return desc
         }
 
+        // If the gateway explicitly rejects the hello (e.g., auth/token mismatch), surface it.
+        if let urlErr = error as? URLError,
+           urlErr.code == .dataNotAllowed // used for WS close 1008 auth failures
+        {
+            let reason = urlErr.failureURLString ?? urlErr.localizedDescription
+            return "Gateway rejected token; set CLAWDIS_GATEWAY_TOKEN in the mac app environment or clear it on the gateway. Reason: \(reason)"
+        }
+
         // Common misfire: we connected to localhost:18789 but the port is occupied
         // by some other process (e.g. a local dev gateway or a stuck SSH forward).
         // The gateway handshake returns something we can't parse, which currently

apps/macos/Sources/Clawdis/GatewayChannel.swift

@@ -141,10 +141,13 @@ private actor GatewayChannelActor {
             return
         }
         if let err = try? decoder.decode(HelloError.self, from: data) {
+            let reason = err.reason ?? "unknown"
+            // Log and throw a detailed error so UI can surface token/hello issues.
+            self.logger.error("gateway hello-error: \(reason, privacy: .public)")
             throw NSError(
                 domain: "Gateway",
-                code: 1,
+                code: 1008,
-                userInfo: [NSLocalizedDescriptionKey: "hello-error: \(err.reason)"])
+                userInfo: [NSLocalizedDescriptionKey: "hello-error: \(reason)"])
         }
         throw NSError(
             domain: "Gateway",