fix: surface app errors in gateway logs

packages/dev-server/test/gateway.test.ts

@@ -5,6 +5,8 @@ import {
   forwardAuthHeaders,
   gatewayProxyHeaders,
   gatewayRestartDelay,
+  internalError,
+  stripInternalError,
 } from "../src/gateway.ts";
 import { resolveProductionHostname } from "../src/prod.ts";
 
@@ -47,6 +49,21 @@ test("forward auth preserves intentional verifier redirects", () => {
   expect(denied.headers.has("location")).toBe(false);
 });
 
+test("gateway reads and strips internal app diagnostics", async () => {
+  const response = new Response("safe public error", {
+    status: 500,
+    headers: {
+      "x-wrnexus-internal-error": encodeURIComponent('Error: Unknown workspace app "admin"'),
+    },
+  });
+
+  expect(internalError(response)).toBe('Error: Unknown workspace app "admin"');
+  const stripped = stripInternalError(response);
+  expect(stripped.status).toBe(500);
+  expect(stripped.headers.has("x-wrnexus-internal-error")).toBe(false);
+  expect(await stripped.text()).toBe("safe public error");
+});
+
 test("forward auth describes the original gateway request", () => {
   const headers = forwardAuthHeaders(
     new Request("https://admin.example.test/settings?tab=security", {