From ab256285d18c2d78607819ff325d433bf088f613 Mon Sep 17 00:00:00 2001
From: DuProcess <273172371+DuProcess@users.noreply.github.com>
Date: Sun, 12 Jul 2026 22:41:48 -0400
Subject: [PATCH] Align Windows client auth defaults

---
 install.ps1              |  7 +++++++
 src/protocol.rs          | 15 ++++++++-------
 tests/release_scripts.rs | 24 ++++++++++++++++++++++++
 3 files changed, 39 insertions(+), 7 deletions(-)

diff --git a/install.ps1 b/install.ps1
index d2c91d8..9990805 100644
--- a/install.ps1
+++ b/install.ps1
@@ -415,6 +415,13 @@ predict = true
 predict_mode = "experimental"
 cache_attach_tickets = true
 credential_cache = "~/.local/share/dosh/credentials"
+auth_preference = "native,ssh"
+trust_on_first_use = false
+native_auth_timeout_ms = 700
+known_hosts = "~/.config/dosh/known_hosts"
+identity_files = ["~/.ssh/id_ed25519"]
+use_ssh_agent = true
+forward_agent = false
 escape_key = "^]"
 "@ | Set-Content -NoNewline -Encoding utf8 $clientConfig
 }
diff --git a/src/protocol.rs b/src/protocol.rs
index 816c331..f93bb9b 100644
--- a/src/protocol.rs
+++ b/src/protocol.rs
@@ -5,10 +5,11 @@ use anyhow::{Context, Result, bail};
 use serde::{Deserialize, Serialize};
 use std::time::{SystemTime, UNIX_EPOCH};
 
-/// Generate a name for an implicit, ephemeral terminal session — the kind
-/// created by `dosh host` with no `--session`. Single source of truth shared by
-/// the client (which generates it) and the server (which recognizes it via
-/// [`is_implicit_session_name`] to decide a session is NOT worth persisting).
+/// Generate a name for an implicit terminal session: the kind created by
+/// `dosh host` with no `--session`. Single source of truth shared by the client
+/// (which generates it) and the server (which recognizes it via
+/// [`is_implicit_session_name`] to apply shorter cleanup grace than named
+/// sessions).
 pub fn generate_implicit_session_name() -> String {
     let millis = SystemTime::now()
         .duration_since(UNIX_EPOCH)
@@ -18,9 +19,9 @@ pub fn generate_implicit_session_name() -> String {
 }
 
 /// Whether `name` is a client-generated implicit session name
-/// (`term-<digits>-<digits>`). Such sessions are ephemeral: the user can never
-/// reattach by name, so the server must not persist them across restarts.
-/// Explicitly-named (`--session work`) and prewarmed sessions are not implicit.
+/// (`term-<digits>-<digits>`). Such sessions are update-survivable while the
+/// original client can reconnect with its ticket, but they are reaped sooner
+/// than explicitly-named sessions once no clients remain.
 pub fn is_implicit_session_name(name: &str) -> bool {
     let Some(rest) = name.strip_prefix("term-") else {
         return false;
diff --git a/tests/release_scripts.rs b/tests/release_scripts.rs
index 211e193..df301c9 100644
--- a/tests/release_scripts.rs
+++ b/tests/release_scripts.rs
@@ -133,6 +133,30 @@ fn unix_installer_rejects_unsafe_source_update_cache_paths() {
     );
 }
 
+#[test]
+fn installers_generate_same_native_auth_client_defaults() {
+    let install = include_str!("../install.sh");
+    let ps1 = include_str!("../install.ps1");
+    for setting in [
+        "auth_preference = \"native,ssh\"",
+        "trust_on_first_use = false",
+        "native_auth_timeout_ms = 700",
+        "known_hosts = \"~/.config/dosh/known_hosts\"",
+        "identity_files = [\"~/.ssh/id_ed25519\"]",
+        "use_ssh_agent = true",
+        "forward_agent = false",
+    ] {
+        assert!(
+            install.contains(setting),
+            "Unix installer missing client default {setting}"
+        );
+        assert!(
+            ps1.contains(setting),
+            "Windows installer missing client default {setting}"
+        );
+    }
+}
+
 #[test]
 fn package_check_verifies_only_artifacts_it_builds() {
     let makefile = include_str!("../Makefile");