Fix tunnel key exchange stale cache, LAN dual-stack detection, and daemon trust flag

Three fixes for tunnel connectivity:
- Invalidate cached Ed25519 pubkey on mismatch and re-fetch from registry before
  rejecting, fixing persistent key exchange failures after peer restart
- Treat wildcard listen addresses (::, 0.0.0.0) as dual-stack in address family
  check, allowing LAN peer detection when tunnel binds to IPv6 wildcard
- Expose trust-auto-approve flag on raw daemon binary (was only available via
  pilotctl daemon start)

Also removes leftover tui entry from pilotctl help text.

Author: teovl

cmd/daemon/main.go

@@ -46,6 +46,7 @@ func main() {
 	webhookURL := flag.String("webhook", "", "HTTP(S) endpoint for event notifications (empty = disabled)")
 	adminToken := flag.String("admin-token", "", "admin token for network operations")
 	networks := flag.String("networks", "", "comma-separated network IDs to auto-join at startup")
+	trustAutoApprove := flag.Bool("trust-auto-approve", false, "automatically approve all incoming trust handshakes")
 	showVersion := flag.Bool("version", false, "print version and exit")
 	logLevel := flag.String("log-level", "info", "log level (debug, info, warn, error)")
 	logFormat := flag.String("log-format", "text", "log format (text, json)")
@@ -94,6 +95,7 @@ func main() {
 		AdminToken:            *adminToken,
 		Networks:              parseNetworkIDs(*networks),
 		Version:               version,
+		TrustAutoApprove:      *trustAutoApprove,
 	})
 
 	if err := d.Start(); err != nil {

pkg/daemon/daemon.go

@@ -733,6 +733,10 @@ func (d *Daemon) addrFamilyMismatch(addr string) bool {
 	if localIP == nil || remoteIP == nil {
 		return false
 	}
+	// Wildcard addresses (:: or 0.0.0.0) are dual-stack — they accept both families.
+	if localIP.IsUnspecified() {
+		return false
+	}
 	localIs4 := localIP.To4() != nil
 	remoteIs4 := remoteIP.To4() != nil
 	return localIs4 != remoteIs4

pkg/daemon/tunnel.go

@@ -488,10 +488,23 @@ func (tm *TunnelManager) handleAuthKeyExchange(data []byte, from *net.UDPAddr, f
 		return
 	}
 
-	// Verify the packet-provided Ed25519 pubkey matches the registry
+	// Verify the packet-provided Ed25519 pubkey matches the registry.
+	// On mismatch, invalidate cache and re-fetch — the peer may have restarted
+	// with a new identity since we last cached their key.
 	if !peerEd25519PubKey.Equal(expectedPubKey) {
-		slog.Error("auth key exchange: Ed25519 pubkey mismatch with registry", "peer_node_id", peerNodeID)
-		return
+		tm.mu.Lock()
+		delete(tm.peerPubKeys, peerNodeID)
+		tm.mu.Unlock()
+		expectedPubKey, err = tm.getPeerPubKey(peerNodeID)
+		if err != nil || expectedPubKey == nil {
+			slog.Warn("auth key exchange rejected: cannot re-verify peer identity", "peer_node_id", peerNodeID, "error", err)
+			return
+		}
+		if !peerEd25519PubKey.Equal(expectedPubKey) {
+			slog.Error("auth key exchange: Ed25519 pubkey mismatch with registry", "peer_node_id", peerNodeID)
+			return
+		}
+		slog.Info("auth key exchange: peer pubkey updated from registry", "peer_node_id", peerNodeID)
 	}
 
 	// Verify signature against the registry-verified key