Align Windows client auth defaults

install.ps1

@@ -415,6 +415,13 @@ predict = true
 predict_mode = "experimental"
 cache_attach_tickets = true
 credential_cache = "~/.local/share/dosh/credentials"
+auth_preference = "native,ssh"
+trust_on_first_use = false
+native_auth_timeout_ms = 700
+known_hosts = "~/.config/dosh/known_hosts"
+identity_files = ["~/.ssh/id_ed25519"]
+use_ssh_agent = true
+forward_agent = false
 escape_key = "^]"
 "@ | Set-Content -NoNewline -Encoding utf8 $clientConfig
 }

src/protocol.rs

@@ -5,10 +5,11 @@ use anyhow::{Context, Result, bail};
 use serde::{Deserialize, Serialize};
 use std::time::{SystemTime, UNIX_EPOCH};
 
-/// Generate a name for an implicit, ephemeral terminal session — the kind
+/// Generate a name for an implicit terminal session: the kind created by
-/// created by `dosh host` with no `--session`. Single source of truth shared by
+/// `dosh host` with no `--session`. Single source of truth shared by the client
-/// the client (which generates it) and the server (which recognizes it via
+/// (which generates it) and the server (which recognizes it via
-/// [`is_implicit_session_name`] to decide a session is NOT worth persisting).
+/// [`is_implicit_session_name`] to apply shorter cleanup grace than named
+/// sessions).
 pub fn generate_implicit_session_name() -> String {
     let millis = SystemTime::now()
         .duration_since(UNIX_EPOCH)
@@ -18,9 +19,9 @@ pub fn generate_implicit_session_name() -> String {
 }
 
 /// Whether `name` is a client-generated implicit session name
-/// (`term-<digits>-<digits>`). Such sessions are ephemeral: the user can never
+/// (`term-<digits>-<digits>`). Such sessions are update-survivable while the
-/// reattach by name, so the server must not persist them across restarts.
+/// original client can reconnect with its ticket, but they are reaped sooner
-/// Explicitly-named (`--session work`) and prewarmed sessions are not implicit.
+/// than explicitly-named sessions once no clients remain.
 pub fn is_implicit_session_name(name: &str) -> bool {
     let Some(rest) = name.strip_prefix("term-") else {
         return false;

tests/release_scripts.rs

@@ -133,6 +133,30 @@ fn unix_installer_rejects_unsafe_source_update_cache_paths() {
     );
 }
 
+#[test]
+fn installers_generate_same_native_auth_client_defaults() {
+    let install = include_str!("../install.sh");
+    let ps1 = include_str!("../install.ps1");
+    for setting in [
+        "auth_preference = \"native,ssh\"",
+        "trust_on_first_use = false",
+        "native_auth_timeout_ms = 700",
+        "known_hosts = \"~/.config/dosh/known_hosts\"",
+        "identity_files = [\"~/.ssh/id_ed25519\"]",
+        "use_ssh_agent = true",
+        "forward_agent = false",
+    ] {
+        assert!(
+            install.contains(setting),
+            "Unix installer missing client default {setting}"
+        );
+        assert!(
+            ps1.contains(setting),
+            "Windows installer missing client default {setting}"
+        );
+    }
+}
+
 #[test]
 fn package_check_verifies_only_artifacts_it_builds() {
     let makefile = include_str!("../Makefile");