fix(tun): skip host-key pinning for localhost + surface daemon errors

Two dev-ergonomics fixes found while testing the daemon against a local agent:

- TOFU host-key pinning is pointless for a loopback agent (nothing to intercept)
  and caused false "host key changed" failures every time a local dev agent
  (e.g. a recreated container) came up with a fresh key. Skip pinning for
  localhost / 127.0.0.1 / ::1; keep pinning real hosts.
- When the detached macOS daemon fails to come up, the launcher printed an opaque
  "daemon did not come up (see <log>)". Surface the daemon's actual last log line
  (e.g. the connect error) directly on the terminal.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hhfrancois

cli/daemon_darwin.go

@@ -9,6 +9,7 @@ import (
 	"os/exec"
 	"os/signal"
 	"path/filepath"
+	"strings"
 	"syscall"
 	"time"
 
@@ -158,9 +159,25 @@ func startDaemonDetached(cfg config) error {
 	if n, _ := r.Read(buf); n == 1 {
 		return nil // ready
 	}
+	// Surface the daemon's own failure reason (its last log line) instead of an
+	// opaque "did not come up".
+	if reason := lastLogLine(logPath); reason != "" {
+		return fmt.Errorf("%s", reason)
+	}
 	return fmt.Errorf("daemon did not come up (see %s)", logPath)
 }
 
+// lastLogLine returns the last non-empty line of the daemon log — its failure
+// reason — stripped of the "[plug] " prefix.
+func lastLogLine(path string) string {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return ""
+	}
+	lines := strings.Split(strings.TrimRight(string(b), "\n"), "\n")
+	return strings.TrimPrefix(strings.TrimSpace(lines[len(lines)-1]), "[plug] ")
+}
+
 // cmdDown stops the running datapath daemon for the resolved cluster (`plug down`).
 func cmdDown(args []string) {
 	opts, _ := parseArgs(args)

cli/socks_run.go

@@ -1,20 +1,39 @@
 package main
 
 import (
+	"net"
 	"os"
 	"path/filepath"
 
 	"github.com/softwarity/plug/cli/internal/tunnel"
 )
 
-// dialTunnel opens the SSH transport to the cluster agent (TOFU host-key pin next
-// to the profiles). Shared by coreRun (Linux/Windows) and the macOS datapath
-// daemon. coreRun itself is per-OS (socks_run_darwin.go / socks_run_other.go):
-// macOS routes through a persistent daemon, elsewhere each launch is autonomous.
+// dialTunnel opens the SSH transport to the cluster agent. Shared by coreRun
+// (Linux/Windows) and the macOS datapath daemon. coreRun itself is per-OS
+// (socks_run_darwin.go / socks_run_other.go): macOS routes through a persistent
+// daemon, elsewhere each launch is autonomous.
 func dialTunnel(cfg config) (*tunnel.Transport, error) {
 	knownHosts := ""
-	if home, err := os.UserHomeDir(); err == nil {
-		knownHosts = filepath.Join(home, ".plug", "known_hosts")
+	// TOFU host-key pinning is pointless for a loopback agent (there is no network
+	// to intercept) and just causes false "host key changed" errors when a local
+	// dev agent is recreated with a fresh key — so skip it for localhost. For real
+	// hosts, pin the key next to the profiles.
+	if !isLoopback(cfg.host) {
+		if home, err := os.UserHomeDir(); err == nil {
+			knownHosts = filepath.Join(home, ".plug", "known_hosts")
+		}
 	}
 	return tunnel.Dial(cfg.host, cfg.port, sshUser, embeddedKey, knownHosts, info)
 }
+
+// isLoopback reports whether host is the local machine (no network to intercept).
+func isLoopback(host string) bool {
+	switch host {
+	case "localhost", "127.0.0.1", "::1":
+		return true
+	}
+	if ip := net.ParseIP(host); ip != nil {
+		return ip.IsLoopback()
+	}
+	return false
+}