Preserve OpenSSH alias config for hosts

Cargo.lock

@@ -436,7 +436,7 @@ dependencies = [
 
 [[package]]
 name = "dosh"
-version = "1.0.0-rc13"
+version = "1.0.0-rc20"
 dependencies = [
  "anyhow",
  "base64",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dosh"
-version = "1.0.0-rc13"
+version = "1.0.0-rc20"
 edition = "2024"
 license = "MIT"
 

Makefile

@@ -36,7 +36,9 @@ persistence-check:
 package-check:
 	$(MAKE) package-release-linux
 	$(MAKE) package-release-windows
-	sh scripts/verify-release-artifacts.sh
+	sh scripts/verify-release-artifacts.sh \
+		target/dosh-release/dosh-linux-x86_64.tar.gz \
+		target/dosh-release/dosh-windows-x86_64.zip
 
 install:
 	sh install.sh --from-current

README.md

@@ -44,6 +44,7 @@ dosh setup HOST
 dosh HOST
 dosh HOST COMMAND
 dosh update
+dosh update --client|--server|--both
 ```
 
 Useful commands:
@@ -97,6 +98,16 @@ cache_attach_tickets = true
 disconnect_status = true
 ```
 
+Example host entry:
+
+```toml
+[prod]
+ssh = "prod"
+ssh_config = "prod" # OpenSSH alias for IdentityFile, ProxyJump, SendEnv, etc.
+dosh_host = "prod.example.com"
+port = 50000
+```
+
 ## Rust Library
 
 Dosh exposes a Rust transport for encrypted, reconnecting application streams.

build.rs

@@ -1,3 +1,4 @@
+use std::env;
 use std::process::Command;
 
 fn git(args: &[&str]) -> Option<String> {
@@ -12,14 +13,29 @@ fn git(args: &[&str]) -> Option<String> {
 fn main() {
     println!("cargo:rerun-if-changed=.git/HEAD");
     println!("cargo:rerun-if-changed=.git/index");
+    println!("cargo:rerun-if-env-changed=DOSH_BUILD_GIT_HASH");
+    println!("cargo:rerun-if-env-changed=DOSH_BUILD_COMMIT_DATE");
+    println!("cargo:rerun-if-env-changed=DOSH_BUILD_GIT_DIRTY");
 
-    let hash = git(&["rev-parse", "--short=12", "HEAD"]).unwrap_or_else(|| "unknown".into());
+    let hash = env::var("DOSH_BUILD_GIT_HASH")
-    let date = git(&["show", "-s", "--format=%cs", "HEAD"]).unwrap_or_else(|| "unknown".into());
+        .ok()
-    let dirty = Command::new("git")
+        .filter(|value| !value.is_empty())
+        .or_else(|| git(&["rev-parse", "--short=12", "HEAD"]))
+        .unwrap_or_else(|| "unknown".into());
+    let date = env::var("DOSH_BUILD_COMMIT_DATE")
+        .ok()
+        .filter(|value| !value.is_empty())
+        .or_else(|| git(&["show", "-s", "--format=%cs", "HEAD"]))
+        .unwrap_or_else(|| "unknown".into());
+    let dirty = match env::var("DOSH_BUILD_GIT_DIRTY").ok().as_deref() {
+        Some("1" | "true" | "yes" | "+dirty") => "+dirty",
+        Some(_) => "",
+        None => Command::new("git")
             .args(["diff", "--quiet", "--ignore-submodules", "--"])
             .status()
             .map(|status| if status.success() { "" } else { "+dirty" })
-        .unwrap_or("");
+            .unwrap_or(""),
+    };
 
     println!("cargo:rustc-env=DOSH_GIT_HASH={hash}{dirty}");
     println!("cargo:rustc-env=DOSH_COMMIT_DATE={date}");

scripts/package-release.sh

@@ -52,6 +52,22 @@ else
   release_dir="target/release"
 fi
 
+if command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  if [ -z "${DOSH_BUILD_GIT_HASH:-}" ]; then
+    export DOSH_BUILD_GIT_HASH="$(git rev-parse --short=12 HEAD)"
+  fi
+  if [ -z "${DOSH_BUILD_COMMIT_DATE:-}" ]; then
+    export DOSH_BUILD_COMMIT_DATE="$(git show -s --format=%cs HEAD)"
+  fi
+  if [ -z "${DOSH_BUILD_GIT_DIRTY+x}" ]; then
+    if git diff --quiet --ignore-submodules --; then
+      export DOSH_BUILD_GIT_DIRTY=0
+    else
+      export DOSH_BUILD_GIT_DIRTY=1
+    fi
+  fi
+fi
+
 if [ "$os" = "windows" ]; then
   if [ -n "$target" ]; then
     cargo build --release --target "$target" --bin dosh-client --bin dosh-bench

scripts/verify-release-artifacts.sh

@@ -22,11 +22,14 @@ artifact_version() {
   esac
 }
 
+if [ "$#" -gt 0 ]; then
+  artifacts="$*"
+else
+  artifacts="$out_dir/dosh-linux-x86_64.tar.gz $out_dir/dosh-macos-aarch64.tar.gz $out_dir/dosh-windows-x86_64.zip"
+fi
+
 failed=0
-for artifact in \
+for artifact in $artifacts; do
-  "$out_dir/dosh-linux-x86_64.tar.gz" \
-  "$out_dir/dosh-macos-aarch64.tar.gz" \
-  "$out_dir/dosh-windows-x86_64.zip"; do
   if [ ! -f "$artifact" ]; then
     echo "missing release artifact: $artifact" >&2
     failed=1

src/bin/dosh-client.rs

@@ -61,6 +61,7 @@ use tokio::net::{TcpListener, TcpStream, UdpSocket};
 use tokio::sync::mpsc;
 
 const STREAM_INITIAL_WINDOW: usize = 1024 * 1024;
+const STREAM_RETIRED_TOMBSTONES: usize = 16 * 1024;
 const MAX_PENDING_USER_INPUT_BYTES: usize = 1024 * 1024;
 const STARTUP_INPUT_HOLD: Duration = Duration::from_millis(750);
 const POST_SUBMIT_ALL_INPUT_HOLD: Duration = Duration::from_millis(120);
@@ -259,7 +260,7 @@ async fn main() -> Result<()> {
         return run_file_cat_command(&args);
     }
     if args.server.as_deref() == Some("update") {
-        return run_update(&config, update_check_requested(&args.command)?);
+        return run_update(&config, parse_update_options(&args.command)?);
     }
     if args.server.as_deref() == Some("setup") {
         return run_setup_command(&config, &args).await;
@@ -301,8 +302,7 @@ async fn main() -> Result<()> {
         .get(&requested_server)
         .cloned()
         .unwrap_or_default();
-    let raw_server = host.ssh.clone().unwrap_or_else(|| requested_server.clone());
+    let server = ssh_command_target(&requested_server, &host);
-    let server = ssh_with_user(&raw_server, host.user.as_deref());
     let startup_command = resolved_startup_command(&args.command, &config, &host);
     let local_forwards = parse_local_forwards(&args.local_forward)?;
     let remote_forwards = parse_remote_forwards(&args.remote_forward)?;
@@ -654,8 +654,7 @@ fn run_trust_command(config: &dosh::config::ClientConfig, args: &Args) -> Result
 
     let hosts = load_hosts_config(None).unwrap_or_default();
     let host_config = hosts.hosts.get(host).cloned().unwrap_or_default();
-    let raw_server = host_config.ssh.clone().unwrap_or_else(|| host.to_string());
+    let server = ssh_command_target(host, &host_config);
-    let server = ssh_with_user(&raw_server, host_config.user.as_deref());
     let ssh_port = args.ssh_port.or(host_config.ssh_port).or(config.ssh_port);
     let ssh_auth_command = args
         .ssh_auth_command
@@ -700,8 +699,8 @@ async fn run_setup_command(config: &dosh::config::ClientConfig, args: &Args) ->
     for entry in imported {
         match entry.action {
             ImportAction::Added => println!(
-                "[ok] host config: [{}] ssh={} dosh_host={} port={}",
+                "[ok] host config: [{}] ssh={} ssh_config={} dosh_host={} port={}",
-                entry.alias, entry.ssh, entry.dosh_host, entry.port
+                entry.alias, entry.ssh, entry.ssh_config, entry.dosh_host, entry.port
             ),
             ImportAction::Skipped => println!("[ok] host config: [{}] already exists", entry.alias),
         }
@@ -709,8 +708,7 @@ async fn run_setup_command(config: &dosh::config::ClientConfig, args: &Args) ->
 
     let hosts = load_hosts_config(None).unwrap_or_default();
     let host_config = hosts.hosts.get(&host).cloned().unwrap_or_default();
-    let raw_server = host_config.ssh.clone().unwrap_or_else(|| host.clone());
+    let server = ssh_command_target(&host, &host_config);
-    let server = ssh_with_user(&raw_server, host_config.user.as_deref());
     let ssh_port = args.ssh_port.or(host_config.ssh_port).or(config.ssh_port);
     let ssh_auth_command = args
         .ssh_auth_command
@@ -842,9 +840,15 @@ fn run_restart_command(config: &dosh::config::ClientConfig, args: &Args) -> Resu
 }
 
 fn status_ssh_target(requested: &str, host_config: &dosh::config::HostConfig) -> String {
+    ssh_command_target(requested, host_config)
+}
+
+fn ssh_command_target(requested: &str, host_config: &dosh::config::HostConfig) -> String {
     let raw_server = host_config
-        .ssh
+        .ssh_config
-        .clone()
+        .as_ref()
+        .or(host_config.ssh.as_ref())
+        .cloned()
         .unwrap_or_else(|| requested.to_string());
     ssh_with_user(&raw_server, host_config.user.as_deref())
 }
@@ -881,11 +885,7 @@ async fn run_doctor_for_host(
 ) -> Result<()> {
     let hosts = load_hosts_config(None).unwrap_or_default();
     let host_config = hosts.hosts.get(requested).cloned().unwrap_or_default();
-    let raw_server = host_config
+    let server = ssh_command_target(requested, &host_config);
-        .ssh
-        .clone()
-        .unwrap_or_else(|| requested.to_string());
-    let server = ssh_with_user(&raw_server, host_config.user.as_deref());
     let ssh_port = args.ssh_port.or(host_config.ssh_port).or(config.ssh_port);
     let dosh_port = args
         .dosh_port
@@ -1392,8 +1392,7 @@ async fn run_proxy_stdio_command(config: &dosh::config::ClientConfig, args: &Arg
         .get(&requested_server)
         .cloned()
         .unwrap_or_default();
-    let raw_server = host.ssh.clone().unwrap_or_else(|| requested_server.clone());
+    let server = ssh_command_target(&requested_server, &host);
-    let server = ssh_with_user(&raw_server, host.user.as_deref());
     let ssh_port = args.ssh_port.or(host.ssh_port).or(config.ssh_port);
     let resolved_ssh_config = ssh_config(&server, ssh_port).unwrap_or_default();
     let requested_udp_host = args
@@ -1560,11 +1559,7 @@ fn ensure_vscode_ssh_host(
 ) -> Result<GeneratedVscodeHost> {
     let hosts = load_hosts_config(None).unwrap_or_default();
     let host_config = hosts.hosts.get(requested).cloned().unwrap_or_default();
-    let raw_server = host_config
+    let server = ssh_command_target(requested, &host_config);
-        .ssh
-        .clone()
-        .unwrap_or_else(|| requested.to_string());
-    let server = ssh_with_user(&raw_server, host_config.user.as_deref());
     let ssh_port = args.ssh_port.or(host_config.ssh_port).or(config.ssh_port);
     let ssh_config = ssh_config(&server, ssh_port).unwrap_or_default();
     let target_ssh_port = ssh_config.port.or(ssh_port).unwrap_or(22);
@@ -2500,7 +2495,6 @@ fn download_file(
     let mut file = if offset > 0 {
         let file = fs::OpenOptions::new()
             .read(true)
-            .write(true)
             .append(true)
             .open(local)
             .with_context(|| format!("open {}", local.display()))?;
@@ -2841,12 +2835,95 @@ fn run_remote_script(
     Ok(())
 }
 
-fn update_check_requested(command: &[String]) -> Result<bool> {
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-    match command {
+enum UpdateRole {
-        [] => Ok(false),
+    Auto,
-        [flag] if flag == "--check" || flag == "-n" => Ok(true),
+    Client,
-        _ => Err(anyhow!("usage: dosh update [--check]")),
+    Server,
+    Both,
 }
+
+impl UpdateRole {
+    fn installer_arg(self) -> &'static str {
+        match self {
+            UpdateRole::Auto => {
+                if local_server_install_detected() {
+                    "both"
+                } else {
+                    "client"
+                }
+            }
+            UpdateRole::Client => "client",
+            UpdateRole::Server => "server",
+            UpdateRole::Both => "both",
+        }
+    }
+
+    fn installer_arg_for_os(self, os: &str) -> Result<&'static str> {
+        if os == "windows" {
+            return match self {
+                UpdateRole::Auto | UpdateRole::Client => Ok("client"),
+                UpdateRole::Server | UpdateRole::Both => {
+                    Err(anyhow!("Windows installs support client updates only"))
+                }
+            };
+        }
+        Ok(self.installer_arg())
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+struct UpdateOptions {
+    check_only: bool,
+    role: UpdateRole,
+}
+
+fn parse_update_options(command: &[String]) -> Result<UpdateOptions> {
+    let mut options = UpdateOptions {
+        check_only: false,
+        role: UpdateRole::Auto,
+    };
+    for arg in command {
+        match arg.as_str() {
+            "--check" | "-n" => options.check_only = true,
+            "--client" => options.role = update_role_flag(options.role, UpdateRole::Client)?,
+            "--server" => options.role = update_role_flag(options.role, UpdateRole::Server)?,
+            "--both" => options.role = update_role_flag(options.role, UpdateRole::Both)?,
+            _ => {
+                return Err(anyhow!(
+                    "usage: dosh update [--check] [--client|--server|--both]"
+                ));
+            }
+        }
+    }
+    Ok(options)
+}
+
+fn update_role_flag(current: UpdateRole, requested: UpdateRole) -> Result<UpdateRole> {
+    if current != UpdateRole::Auto && current != requested {
+        return Err(anyhow!("choose only one of --client, --server, or --both"));
+    }
+    Ok(requested)
+}
+
+fn local_server_install_detected() -> bool {
+    if cfg!(windows) {
+        return false;
+    }
+    let service = dirs::home_dir()
+        .map(|home| home.join(".config/systemd/user/dosh-server.service"))
+        .filter(|path| path.exists())
+        .is_some();
+    if service {
+        return true;
+    }
+    let Ok(exe) = std::env::current_exe() else {
+        return false;
+    };
+    let Some(bin_dir) = exe.parent() else {
+        return false;
+    };
+    bin_dir.join("dosh-server").exists() || bin_dir.join("dosh-server.exe").exists()
 }
 
 fn release_artifact_name() -> &'static str {
@@ -2861,6 +2938,18 @@ fn release_artifact_name() -> &'static str {
     }
 }
 
+fn update_installer_name(os: &str) -> &'static str {
+    if os == "windows" {
+        "install.ps1"
+    } else {
+        "install.sh"
+    }
+}
+
+fn update_installer_url(raw_base: &str, os: &str) -> String {
+    format!("{raw_base}/raw/branch/main/{}", update_installer_name(os))
+}
+
 fn latest_release_download_url(repo: &str, artifact: &str) -> Option<String> {
     let web = repo
         .strip_suffix(".git")
@@ -2967,20 +3056,23 @@ fn url_reachable(url: &str) -> Result<bool> {
     Ok(status.success())
 }
 
-fn run_update(config: &dosh::config::ClientConfig, check_only: bool) -> Result<()> {
+fn run_update(config: &dosh::config::ClientConfig, options: UpdateOptions) -> Result<()> {
     let repo = config
         .update_repo
         .clone()
         .unwrap_or_else(|| "https://git.palav.dev/Palav/dosh.git".to_string());
     let raw_base = raw_base_from_repo(&repo);
-    let installer = format!("{raw_base}/raw/branch/main/install.sh");
+    let os = std::env::consts::OS;
+    let installer = update_installer_url(&raw_base, os);
     let artifact = release_artifact_name();
-    if check_only {
+    let installer_role = options.role.installer_arg_for_os(os)?;
+    if options.check_only {
         let local_version = env!("CARGO_PKG_VERSION");
         let latest_tag = latest_release_tag(&repo)?;
         println!("dosh {local_version}");
         println!("repo: {repo}");
         println!("installer: {installer}");
+        println!("role: {installer_role}");
         match latest_tag.as_deref() {
             Some(tag) => {
                 let latest_version = release_version_from_tag(tag);
@@ -3016,13 +3108,79 @@ fn run_update(config: &dosh::config::ClientConfig, check_only: bool) -> Result<(
         .join("dosh")
         .join("source");
     let use_prebuilt = std::env::var("DOSH_USE_PREBUILT").unwrap_or_else(|_| "1".to_string());
+    let status = run_update_installer(
+        config,
+        &repo,
+        &installer,
+        installer_role,
+        &update_cache.display().to_string(),
+        &use_prebuilt,
+    )?;
+    if !status.success() {
+        return Err(anyhow!("dosh update failed with status {status}"));
+    }
+    Ok(())
+}
+
+fn run_update_installer(
+    config: &dosh::config::ClientConfig,
+    repo: &str,
+    installer: &str,
+    installer_role: &str,
+    update_cache: &str,
+    use_prebuilt: &str,
+) -> Result<std::process::ExitStatus> {
+    if cfg!(windows) {
+        let script = windows_update_script(
+            config,
+            repo,
+            installer,
+            installer_role,
+            update_cache,
+            use_prebuilt,
+        );
+        return Command::new("powershell.exe")
+            .arg("-NoProfile")
+            .arg("-ExecutionPolicy")
+            .arg("Bypass")
+            .arg("-Command")
+            .arg(script)
+            .stdin(Stdio::null())
+            .status()
+            .context("run dosh update installer");
+    }
+    let script = unix_update_script(
+        config,
+        repo,
+        installer,
+        installer_role,
+        update_cache,
+        use_prebuilt,
+    );
+    Command::new("sh")
+        .arg("-c")
+        .arg(script)
+        .stdin(Stdio::null())
+        .status()
+        .context("run dosh update installer")
+}
+
+fn unix_update_script(
+    config: &dosh::config::ClientConfig,
+    repo: &str,
+    installer: &str,
+    installer_role: &str,
+    update_cache: &str,
+    use_prebuilt: &str,
+) -> String {
     let mut script = format!(
-        "curl -fsSL {} | DOSH_REPO={} DOSH_PORT={} DOSH_UPDATE_CACHE={} DOSH_UPDATE_QUIET=1 DOSH_USE_PREBUILT={} sh -s -- client",
+        "curl -fsSL {} | DOSH_REPO={} DOSH_PORT={} DOSH_UPDATE_CACHE={} DOSH_UPDATE_QUIET=1 DOSH_USE_PREBUILT={} sh -s -- {}",
-        shell_word(&installer),
+        shell_word(installer),
-        shell_word(&repo),
+        shell_word(repo),
         config.update_port.unwrap_or(config.dosh_port),
-        shell_word(&update_cache.display().to_string()),
+        shell_word(update_cache),
-        shell_word(&use_prebuilt)
+        shell_word(use_prebuilt),
+        shell_word(installer_role)
     );
     if config.server != "user@example.com" {
         script.push_str(&format!(" --server {}", shell_word(&config.server)));
@@ -3030,16 +3188,47 @@ fn run_update(config: &dosh::config::ClientConfig, check_only: bool) -> Result<(
     if let Some(host) = &config.dosh_host {
         script.push_str(&format!(" --dosh-host {}", shell_word(host)));
     }
-    let status = Command::new("sh")
+    script
-        .arg("-c")
-        .arg(script)
-        .stdin(Stdio::null())
-        .status()
-        .context("run dosh update installer")?;
-    if !status.success() {
-        return Err(anyhow!("dosh update failed with status {status}"));
 }
-    Ok(())
+
+fn windows_update_script(
+    config: &dosh::config::ClientConfig,
+    repo: &str,
+    installer: &str,
+    installer_role: &str,
+    update_cache: &str,
+    use_prebuilt: &str,
+) -> String {
+    let mut script = String::from("$ErrorActionPreference='Stop';");
+    script.push_str("$ProgressPreference='SilentlyContinue';");
+    for (name, value) in [
+        ("DOSH_REPO", repo),
+        ("DOSH_ROLE", installer_role),
+        (
+            "DOSH_PORT",
+            &config.update_port.unwrap_or(config.dosh_port).to_string(),
+        ),
+        ("DOSH_UPDATE_CACHE", update_cache),
+        ("DOSH_UPDATE_QUIET", "1"),
+        ("DOSH_USE_PREBUILT", use_prebuilt),
+    ] {
+        script.push_str(&format!("$env:{name}={};", powershell_string(value)));
+    }
+    if config.server != "user@example.com" {
+        script.push_str(&format!(
+            "$env:DOSH_SERVER={};",
+            powershell_string(&config.server)
+        ));
+    }
+    if let Some(host) = &config.dosh_host {
+        script.push_str(&format!("$env:DOSH_HOST={};", powershell_string(host)));
+    }
+    script.push_str(&format!("irm {} | iex", powershell_string(installer)));
+    script
+}
+
+fn powershell_string(value: &str) -> String {
+    format!("'{}'", value.replace('\'', "''"))
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -3052,6 +3241,7 @@ enum ImportAction {
 struct ImportedHost {
     alias: String,
     ssh: String,
+    ssh_config: String,
     dosh_host: String,
     port: u16,
     action: ImportAction,
@@ -3065,8 +3255,8 @@ fn run_import_ssh(config: &dosh::config::ClientConfig, aliases: &[String]) -> Re
     for entry in imported {
         match entry.action {
             ImportAction::Added => eprintln!(
-                "dosh import-ssh: added [{}] ssh={} dosh_host={}",
+                "dosh import-ssh: added [{}] ssh={} ssh_config={} dosh_host={}",
-                entry.alias, entry.ssh, entry.dosh_host
+                entry.alias, entry.ssh, entry.ssh_config, entry.dosh_host
             ),
             ImportAction::Skipped => {
                 eprintln!(
@@ -3108,6 +3298,7 @@ fn import_ssh_aliases(
             imported.push(ImportedHost {
                 alias: alias.clone(),
                 ssh: alias.clone(),
+                ssh_config: alias.clone(),
                 dosh_host: udp_host,
                 port: config.dosh_port,
                 action: ImportAction::Skipped,
@@ -3117,6 +3308,7 @@ fn import_ssh_aliases(
         raw.push('\n');
         raw.push_str(&format!("[{}]\n", toml_bare_key_or_quoted(alias)));
         raw.push_str(&format!("ssh = {}\n", toml_string(alias)));
+        raw.push_str(&format!("ssh_config = {}\n", toml_string(alias)));
         raw.push_str(&format!("dosh_host = {}\n", toml_string(&udp_host)));
         raw.push_str(&format!("port = {}\n", config.dosh_port));
         if let Some(user) = &ssh_config.user {
@@ -3131,6 +3323,7 @@ fn import_ssh_aliases(
         imported.push(ImportedHost {
             alias: alias.clone(),
             ssh: alias.clone(),
+            ssh_config: alias.clone(),
             dosh_host: udp_host,
             port: config.dosh_port,
             action: ImportAction::Added,
@@ -4335,6 +4528,8 @@ async fn run_terminal(
     let mut stream_sent_data: HashMap<u64, BTreeMap<u64, PendingStreamChunk>> = HashMap::new();
     let mut stream_next_recv_offset: HashMap<u64, u64> = HashMap::new();
     let mut stream_recv_pending: HashMap<u64, BTreeMap<u64, Vec<u8>>> = HashMap::new();
+    let mut stream_retired: HashSet<u64> = HashSet::new();
+    let mut stream_retired_order: VecDeque<u64> = VecDeque::new();
     let mut pending_user_input: VecDeque<PendingUserInput> = VecDeque::new();
     let mut pending_user_input_bytes = 0usize;
     let mut startup_input_hold_until: Option<Instant> = None;
@@ -4827,6 +5022,18 @@ async fn run_terminal(
                             continue;
                         };
                         last_packet_at = Instant::now();
+                        if stream_retired.contains(&open.stream_id) {
+                            send_stream_open_reject(
+                                &socket,
+                                addr,
+                                &cred,
+                                &mut send_seq,
+                                open.stream_id,
+                                "stream closed".to_string(),
+                            )
+                            .await?;
+                            continue;
+                        }
                         if opened_streams.contains(&open.stream_id) {
                             send_stream_open_ok(
                                 &socket,
@@ -5024,7 +5231,7 @@ async fn run_terminal(
                         {
                             let _ = writer.write_all(&[5, 5, 0, 1, 0, 0, 0, 0, 0, 0]).await;
                         }
-                        cleanup_stream_state(
+                        retire_stream_state(
                             reject.stream_id,
                             &mut opened_streams,
                             &mut stream_send_credit,
@@ -5034,6 +5241,8 @@ async fn run_terminal(
                             &mut stream_sent_data,
                             &mut stream_next_recv_offset,
                             &mut stream_recv_pending,
+                            &mut stream_retired,
+                            &mut stream_retired_order,
                         );
                         stream_writers.remove(&reject.stream_id);
                     }
@@ -5113,7 +5322,7 @@ async fn run_terminal(
                         };
                         last_packet_at = Instant::now();
                         pending_socks_replies.remove(&close.stream_id);
-                        cleanup_stream_state(
+                        retire_stream_state(
                             close.stream_id,
                             &mut opened_streams,
                             &mut stream_send_credit,
@@ -5123,6 +5332,8 @@ async fn run_terminal(
                             &mut stream_sent_data,
                             &mut stream_next_recv_offset,
                             &mut stream_recv_pending,
+                            &mut stream_retired,
+                            &mut stream_retired_order,
                         );
                         stream_writers.remove(&close.stream_id);
                         #[cfg(unix)]
@@ -5175,7 +5386,7 @@ async fn run_terminal(
                     }
                     Some(ForwardEvent::Close { stream_id }) => {
                         pending_socks_replies.remove(&stream_id);
-                        cleanup_stream_state(
+                        retire_stream_state(
                             stream_id,
                             &mut opened_streams,
                             &mut stream_send_credit,
@@ -5185,6 +5396,8 @@ async fn run_terminal(
                             &mut stream_sent_data,
                             &mut stream_next_recv_offset,
                             &mut stream_recv_pending,
+                            &mut stream_retired,
+                            &mut stream_retired_order,
                         );
                         stream_writers.remove(&stream_id);
                         #[cfg(unix)]
@@ -6188,6 +6401,77 @@ fn cleanup_stream_state(
     stream_recv_pending.remove(&stream_id);
 }
 
+#[allow(clippy::too_many_arguments)]
+fn stream_state_exists(
+    stream_id: u64,
+    opened_streams: &HashSet<u64>,
+    stream_send_credit: &HashMap<u64, usize>,
+    stream_pending_data: &HashMap<u64, VecDeque<Vec<u8>>>,
+    stream_pending_opens: &HashMap<u64, PendingStreamOpen>,
+    stream_next_send_offset: &HashMap<u64, u64>,
+    stream_sent_data: &HashMap<u64, BTreeMap<u64, PendingStreamChunk>>,
+    stream_next_recv_offset: &HashMap<u64, u64>,
+    stream_recv_pending: &HashMap<u64, BTreeMap<u64, Vec<u8>>>,
+) -> bool {
+    opened_streams.contains(&stream_id)
+        || stream_send_credit.contains_key(&stream_id)
+        || stream_pending_data.contains_key(&stream_id)
+        || stream_pending_opens.contains_key(&stream_id)
+        || stream_next_send_offset.contains_key(&stream_id)
+        || stream_sent_data.contains_key(&stream_id)
+        || stream_next_recv_offset.contains_key(&stream_id)
+        || stream_recv_pending.contains_key(&stream_id)
+}
+
+#[allow(clippy::too_many_arguments)]
+fn retire_stream_state(
+    stream_id: u64,
+    opened_streams: &mut HashSet<u64>,
+    stream_send_credit: &mut HashMap<u64, usize>,
+    stream_pending_data: &mut HashMap<u64, VecDeque<Vec<u8>>>,
+    stream_pending_opens: &mut HashMap<u64, PendingStreamOpen>,
+    stream_next_send_offset: &mut HashMap<u64, u64>,
+    stream_sent_data: &mut HashMap<u64, BTreeMap<u64, PendingStreamChunk>>,
+    stream_next_recv_offset: &mut HashMap<u64, u64>,
+    stream_recv_pending: &mut HashMap<u64, BTreeMap<u64, Vec<u8>>>,
+    stream_retired: &mut HashSet<u64>,
+    stream_retired_order: &mut VecDeque<u64>,
+) {
+    let had_state = stream_state_exists(
+        stream_id,
+        opened_streams,
+        stream_send_credit,
+        stream_pending_data,
+        stream_pending_opens,
+        stream_next_send_offset,
+        stream_sent_data,
+        stream_next_recv_offset,
+        stream_recv_pending,
+    );
+    cleanup_stream_state(
+        stream_id,
+        opened_streams,
+        stream_send_credit,
+        stream_pending_data,
+        stream_pending_opens,
+        stream_next_send_offset,
+        stream_sent_data,
+        stream_next_recv_offset,
+        stream_recv_pending,
+    );
+    if !had_state || STREAM_RETIRED_TOMBSTONES == 0 {
+        return;
+    }
+    if stream_retired.insert(stream_id) {
+        stream_retired_order.push_back(stream_id);
+    }
+    while stream_retired_order.len() > STREAM_RETIRED_TOMBSTONES {
+        if let Some(expired) = stream_retired_order.pop_front() {
+            stream_retired.remove(&expired);
+        }
+    }
+}
+
 fn ack_stream_data(
     stream_sent_data: &mut HashMap<u64, BTreeMap<u64, PendingStreamChunk>>,
     stream_send_credit: &mut HashMap<u64, usize>,
@@ -7473,30 +7757,31 @@ mod tests {
         FRAME_GAP_RESYNC_AFTER_MS, FrameBuffer, LocalForward, MAX_PENDING_USER_INPUT_BYTES,
         POST_SUBMIT_ALL_INPUT_HOLD, PendingStreamOpen, PredictMode, Predictor,
         RESTART_STATUS_SCRIPT, RemoteForward, STARTUP_INPUT_HOLD, SshConfig, StartupGateMode,
-        StatusAction, auth_allows, cache_key, cache_server_prefix, cleanup_stream_state,
+        StatusAction, UpdateOptions, UpdateRole, auth_allows, cache_key, cache_server_prefix,
-        clear_cached_credentials, ensure_tui_safe_status_overlay, input_contains_focus_in,
+        cleanup_stream_state, clear_cached_credentials, ensure_tui_safe_status_overlay,
-        input_matches_escape, is_local_status_target, is_resume_response_for_client,
+        input_contains_focus_in, input_matches_escape, is_local_status_target,
-        latest_release_download_url, load_first_native_identity_with_prompt, parse_dynamic_forward,
+        is_resume_response_for_client, latest_release_download_url,
-        parse_escape_key, parse_local_forward, parse_remote_forward, parse_ssh_config,
+        load_first_native_identity_with_prompt, parse_dynamic_forward, parse_escape_key,
+        parse_local_forward, parse_remote_forward, parse_ssh_config, parse_update_options,
         post_submit_hold_duration, queue_pending_user_input, raw_contains_host_table,
         recv_response_until, refresh_live_addr, release_tag_download_url,
         release_tag_from_effective_url, release_version_from_tag, render_status_clear,
-        render_status_overlay, requested_env, resolved_startup_command, retransmit_stream_opens,
+        render_status_overlay, requested_env, resolved_startup_command, retire_stream_state,
-        rewrite_forward_command, selected_predict_mode, selected_udp_host, server_version_mismatch,
+        retransmit_stream_opens, rewrite_forward_command, selected_predict_mode, selected_udp_host,
-        should_flush_terminal_input_after_contact, should_hold_during_startup_gate,
+        server_version_mismatch, should_flush_terminal_input_after_contact,
-        should_hold_post_submit_input, should_repaint_idle_alternate_screen,
+        should_hold_during_startup_gate, should_hold_post_submit_input,
-        split_after_command_submit, ssh_destination_host, ssh_username, ssh_with_user,
+        should_repaint_idle_alternate_screen, split_after_command_submit, ssh_destination_host,
-        startup_command, status_ssh_target, strip_stale_mouse_reports,
+        ssh_username, ssh_with_user, ssh_command_target, startup_command, status_ssh_target,
-        strip_terminal_focus_reports, terminal_private_mode_transition, toml_bare_key_or_quoted,
+        strip_stale_mouse_reports, strip_terminal_focus_reports, terminal_private_mode_transition,
-        update_check_requested, update_version_status, upsert_managed_block, valid_forward_host,
+        toml_bare_key_or_quoted, unix_update_script, update_installer_url, update_version_status,
-        vscode_safe_alias,
+        upsert_managed_block, valid_forward_host, vscode_safe_alias, windows_update_script,
     };
     use dosh::config::{ClientConfig, CommandExtension, HostConfig};
     use dosh::native::EnvVar;
     use dosh::protocol::{self, Frame, PacketKind};
     use dosh::udp::is_transient_udp_send_error;
     use ed25519_dalek::{SigningKey, VerifyingKey};
-    use std::collections::{BTreeMap, HashMap, VecDeque};
+    use std::collections::{BTreeMap, HashMap, HashSet, VecDeque};
     use std::fs;
     use std::time::{Duration, Instant};
 
@@ -7636,6 +7921,54 @@ mod tests {
         assert!(stream_recv_pending.contains_key(&other_stream_id));
     }
 
+    #[test]
+    fn retire_stream_state_tombstones_only_real_stream_state() {
+        let stream_id = 42;
+        let mut opened_streams = HashSet::from([stream_id]);
+        let mut stream_send_credit = HashMap::from([(stream_id, 12)]);
+        let mut stream_pending_data = HashMap::new();
+        let mut stream_pending_opens = HashMap::new();
+        let mut stream_next_send_offset = HashMap::new();
+        let mut stream_sent_data = HashMap::new();
+        let mut stream_next_recv_offset = HashMap::new();
+        let mut stream_recv_pending = HashMap::new();
+        let mut stream_retired = HashSet::new();
+        let mut stream_retired_order = VecDeque::new();
+
+        retire_stream_state(
+            stream_id,
+            &mut opened_streams,
+            &mut stream_send_credit,
+            &mut stream_pending_data,
+            &mut stream_pending_opens,
+            &mut stream_next_send_offset,
+            &mut stream_sent_data,
+            &mut stream_next_recv_offset,
+            &mut stream_recv_pending,
+            &mut stream_retired,
+            &mut stream_retired_order,
+        );
+        retire_stream_state(
+            99,
+            &mut opened_streams,
+            &mut stream_send_credit,
+            &mut stream_pending_data,
+            &mut stream_pending_opens,
+            &mut stream_next_send_offset,
+            &mut stream_sent_data,
+            &mut stream_next_recv_offset,
+            &mut stream_recv_pending,
+            &mut stream_retired,
+            &mut stream_retired_order,
+        );
+
+        assert!(!opened_streams.contains(&stream_id));
+        assert!(!stream_send_credit.contains_key(&stream_id));
+        assert!(stream_retired.contains(&stream_id));
+        assert!(!stream_retired.contains(&99));
+        assert_eq!(stream_retired_order, VecDeque::from([stream_id]));
+    }
+
     #[test]
     fn managed_ssh_block_is_replaced_not_duplicated() {
         let dir = tempfile::tempdir().unwrap();
@@ -8555,12 +8888,114 @@ mod tests {
     }
 
     #[test]
-    fn update_check_accepts_only_check_flag() {
+    fn update_options_accept_check_and_role_flags() {
-        assert!(!update_check_requested(&[]).unwrap());
+        assert_eq!(
-        assert!(update_check_requested(&["--check".to_string()]).unwrap());
+            parse_update_options(&[]).unwrap(),
-        assert!(update_check_requested(&["-n".to_string()]).unwrap());
+            UpdateOptions {
-        assert!(update_check_requested(&["--wat".to_string()]).is_err());
+                check_only: false,
-        assert!(update_check_requested(&["--check".to_string(), "extra".to_string()]).is_err());
+                role: UpdateRole::Auto,
+            }
+        );
+        assert_eq!(
+            parse_update_options(&["--check".to_string()]).unwrap(),
+            UpdateOptions {
+                check_only: true,
+                role: UpdateRole::Auto,
+            }
+        );
+        assert_eq!(
+            parse_update_options(&["-n".to_string(), "--server".to_string()]).unwrap(),
+            UpdateOptions {
+                check_only: true,
+                role: UpdateRole::Server,
+            }
+        );
+        assert_eq!(
+            parse_update_options(&["--both".to_string()]).unwrap(),
+            UpdateOptions {
+                check_only: false,
+                role: UpdateRole::Both,
+            }
+        );
+        assert!(parse_update_options(&["--wat".to_string()]).is_err());
+        assert!(parse_update_options(&["--client".to_string(), "--server".to_string()]).is_err());
+    }
+
+    #[test]
+    fn update_installer_uses_platform_native_script() {
+        assert_eq!(
+            update_installer_url("https://git.palav.dev/Palav/dosh", "linux"),
+            "https://git.palav.dev/Palav/dosh/raw/branch/main/install.sh"
+        );
+        assert_eq!(
+            update_installer_url("https://git.palav.dev/Palav/dosh", "macos"),
+            "https://git.palav.dev/Palav/dosh/raw/branch/main/install.sh"
+        );
+        assert_eq!(
+            update_installer_url("https://git.palav.dev/Palav/dosh", "windows"),
+            "https://git.palav.dev/Palav/dosh/raw/branch/main/install.ps1"
+        );
+    }
+
+    #[test]
+    fn windows_update_roles_are_client_only() {
+        assert_eq!(
+            UpdateRole::Auto.installer_arg_for_os("windows").unwrap(),
+            "client"
+        );
+        assert_eq!(
+            UpdateRole::Client.installer_arg_for_os("windows").unwrap(),
+            "client"
+        );
+        assert!(UpdateRole::Server.installer_arg_for_os("windows").is_err());
+        assert!(UpdateRole::Both.installer_arg_for_os("windows").is_err());
+        assert_eq!(
+            UpdateRole::Both.installer_arg_for_os("linux").unwrap(),
+            "both"
+        );
+    }
+
+    #[test]
+    fn update_scripts_are_native_to_the_platform() {
+        let config = ClientConfig {
+            server: "palav".to_string(),
+            dosh_host: Some("dosh.example.com".to_string()),
+            dosh_port: 50000,
+            update_port: Some(50001),
+            ..ClientConfig::default()
+        };
+        let unix = unix_update_script(
+            &config,
+            "https://git.palav.dev/Palav/dosh.git",
+            "https://git.palav.dev/Palav/dosh/raw/branch/main/install.sh",
+            "both",
+            "/tmp/dosh-cache",
+            "1",
+        );
+        assert!(unix.contains("curl -fsSL"));
+        assert!(unix.contains("install.sh"));
+        assert!(unix.contains("sh -s -- 'both'"));
+        assert!(unix.contains("--server 'palav'"));
+        assert!(unix.contains("--dosh-host 'dosh.example.com'"));
+
+        let windows = windows_update_script(
+            &config,
+            "https://git.palav.dev/Palav/dosh.git",
+            "https://git.palav.dev/Palav/dosh/raw/branch/main/install.ps1",
+            "client",
+            "C:\\Users\\palav\\AppData\\Local\\dosh\\source",
+            "1",
+        );
+        assert!(
+            windows.contains(
+                "irm 'https://git.palav.dev/Palav/dosh/raw/branch/main/install.ps1' | iex"
+            )
+        );
+        assert!(windows.contains("$env:DOSH_ROLE='client';"));
+        assert!(windows.contains("$env:DOSH_SERVER='palav';"));
+        assert!(windows.contains("$env:DOSH_HOST='dosh.example.com';"));
+        assert!(!windows.contains("install.sh"));
+        assert!(!windows.contains(" sh -s "));
     }
 
     #[test]
@@ -8580,6 +9015,19 @@ mod tests {
         );
     }
 
+    #[test]
+    fn ssh_command_target_prefers_explicit_ssh_config_alias() {
+        let host = HostConfig {
+            ssh: Some("server.example.com".to_string()),
+            ssh_config: Some("work-alias".to_string()),
+            user: Some("alice".to_string()),
+            ..HostConfig::default()
+        };
+
+        assert_eq!(ssh_command_target("work", &host), "alice@work-alias");
+        assert_eq!(status_ssh_target("work", &host), "alice@work-alias");
+    }
+
     #[test]
     fn status_detects_local_targets() {
         assert!(is_local_status_target("localhost"));

src/bin/dosh-server.rs

@@ -47,11 +47,13 @@ use tokio::process::Command as TokioCommand;
 use tokio::sync::mpsc;
 
 const STREAM_INITIAL_WINDOW: usize = 1024 * 1024;
+const STREAM_RETIRED_TOMBSTONES: usize = 16 * 1024;
 
 /// Persist a persistent session's screen to disk after this many bytes of output
 /// have accumulated since the last mirror. Keeps the atomic write off the
 /// per-packet hot path while bounding how much fresh output a crash can lose.
 const SCREEN_PERSIST_BYTES: usize = 4096;
+const SCREEN_PERSIST_MAX_AGE: Duration = Duration::from_millis(250);
 const IMPLICIT_EMPTY_SESSION_GRACE_SECS: u64 = 300;
 
 /// Sentinel `target_host` sent to the client on a server-initiated `StreamOpen`
@@ -250,7 +252,7 @@ async fn serve(config_path: Option<std::path::PathBuf>) -> Result<()> {
     if config.persist_sessions {
         let flush_state = Arc::clone(&state);
         tokio::spawn(async move {
-            let mut interval = tokio::time::interval(Duration::from_secs(2));
+            let mut interval = tokio::time::interval(SCREEN_PERSIST_MAX_AGE);
             loop {
                 interval.tick().await;
                 flush_persistent_screens(&flush_state);
@@ -375,6 +377,10 @@ struct Session {
     /// `output_seq` at the last successful screen mirror, so the periodic flush
     /// skips sessions whose screen has not changed.
     last_persisted_seq: u64,
+    /// Last time this session's screen was considered for a mirror. Combined
+    /// with the byte threshold so low-throughput prompt/TUI updates persist
+    /// quickly without writing on every packet in high-throughput bursts.
+    last_screen_persist_at: Instant,
 }
 
 #[derive(Clone)]
@@ -399,6 +405,8 @@ struct ClientState {
     stream_sent_data: HashMap<u64, BTreeMap<u64, PendingStreamChunk>>,
     stream_next_recv_offset: HashMap<u64, u64>,
     stream_recv_pending: HashMap<u64, BTreeMap<u64, Vec<u8>>>,
+    stream_retired: HashSet<u64>,
+    stream_retired_order: VecDeque<u64>,
     /// Current transport key epoch (0 = original handshake key). Bumped on rekey.
     epoch: u64,
     /// When the current epoch began, for the wall-clock rekey trigger.
@@ -508,6 +516,7 @@ impl ServerState {
                 persistent,
                 bytes_since_persist: 0,
                 last_persisted_seq: 0,
+                last_screen_persist_at: Instant::now() - SCREEN_PERSIST_MAX_AGE,
             },
         );
         Ok(())
@@ -645,6 +654,7 @@ impl ServerState {
                     persistent: true,
                     bytes_since_persist: 0,
                     last_persisted_seq: output_seq,
+                    last_screen_persist_at: Instant::now(),
                 },
             );
             eprintln!(
@@ -1201,6 +1211,8 @@ async fn handle_native_user_auth(
                     stream_sent_data: HashMap::new(),
                     stream_next_recv_offset: HashMap::new(),
                     stream_recv_pending: HashMap::new(),
+                    stream_retired: HashSet::new(),
+                    stream_retired_order: VecDeque::new(),
                     epoch: 0,
                     epoch_started: Instant::now(),
                     epoch_packets: 0,
@@ -1348,6 +1360,8 @@ async fn handle_bootstrap_attach(
                     stream_sent_data: HashMap::new(),
                     stream_next_recv_offset: HashMap::new(),
                     stream_recv_pending: HashMap::new(),
+                    stream_retired: HashSet::new(),
+                    stream_retired_order: VecDeque::new(),
                     epoch: 0,
                     epoch_started: Instant::now(),
                     epoch_packets: 0,
@@ -1482,6 +1496,8 @@ async fn handle_ticket_attach(
                     stream_sent_data: HashMap::new(),
                     stream_next_recv_offset: HashMap::new(),
                     stream_recv_pending: HashMap::new(),
+                    stream_retired: HashSet::new(),
+                    stream_retired_order: VecDeque::new(),
                     epoch: 0,
                     epoch_started: Instant::now(),
                     epoch_packets: 0,
@@ -1727,11 +1743,11 @@ async fn handle_detach(state: &Arc<Mutex<ServerState>>, packet: &protocol::Packe
     let (key, _) = find_client_decrypt_key(state, &packet.header)?;
     let _ = protocol::decrypt_body(packet, &key, CLIENT_TO_SERVER)?;
     let mut locked = state.lock().expect("server state poisoned");
-    if let Some(client) = locked.client_mut(&packet.header.conn_id) {
+    if let Some(client) = locked.client_mut(&packet.header.conn_id)
-        if !client.replay.accept(packet.header.seq) {
+        && !client.replay.accept(packet.header.seq)
+    {
         return Ok(());
     }
-    }
     locked.remove_client_everywhere(&packet.header.conn_id);
     Ok(())
 }
@@ -1831,7 +1847,9 @@ async fn handle_stream_open(
         }
         client.endpoint = peer;
         client.last_seen = Instant::now();
-        if client.opened_streams.contains(&open.stream_id) {
+        if client.stream_retired.contains(&open.stream_id) {
+            StreamOpenCheck::New(Err(anyhow!("stream {} is closed", open.stream_id)))
+        } else if client.opened_streams.contains(&open.stream_id) {
             StreamOpenCheck::Duplicate
         } else {
             StreamOpenCheck::New(stream_open_allowed(&config, client, &open))
@@ -2138,7 +2156,7 @@ async fn handle_stream_open_reject(
     }
     client.endpoint = peer;
     client.last_seen = Instant::now();
-    cleanup_client_stream(client, reject.stream_id);
+    retire_client_stream(client, reject.stream_id);
     Ok(())
 }
 
@@ -2196,7 +2214,7 @@ async fn handle_stream_close(
     // Connection migration on any authenticated, fresh packet (spec §11).
     client.endpoint = peer;
     client.last_seen = Instant::now();
-    cleanup_client_stream(client, close.stream_id);
+    retire_client_stream(client, close.stream_id);
     Ok(())
 }
 
@@ -2663,7 +2681,6 @@ async fn handle_file_request(
             let (file, temp_path, written, atomic) = if resume && final_path.exists() {
                 let mut file = fs::OpenOptions::new()
                     .read(true)
-                    .write(true)
                     .append(true)
                     .open(&final_path)
                     .with_context(|| format!("open {}", final_path.display()))?;
@@ -3288,6 +3305,34 @@ fn cleanup_client_stream(client: &mut ClientState, stream_id: u64) {
     client.stream_recv_pending.remove(&stream_id);
 }
 
+fn client_has_stream_state(client: &ClientState, stream_id: u64) -> bool {
+    client.stream_writers.contains_key(&stream_id)
+        || client.stream_pending_opens.contains_key(&stream_id)
+        || client.opened_streams.contains(&stream_id)
+        || client.stream_send_credit.contains_key(&stream_id)
+        || client.stream_pending_data.contains_key(&stream_id)
+        || client.stream_next_send_offset.contains_key(&stream_id)
+        || client.stream_sent_data.contains_key(&stream_id)
+        || client.stream_next_recv_offset.contains_key(&stream_id)
+        || client.stream_recv_pending.contains_key(&stream_id)
+}
+
+fn retire_client_stream(client: &mut ClientState, stream_id: u64) {
+    let had_state = client_has_stream_state(client, stream_id);
+    cleanup_client_stream(client, stream_id);
+    if !had_state || STREAM_RETIRED_TOMBSTONES == 0 {
+        return;
+    }
+    if client.stream_retired.insert(stream_id) {
+        client.stream_retired_order.push_back(stream_id);
+    }
+    while client.stream_retired_order.len() > STREAM_RETIRED_TOMBSTONES {
+        if let Some(expired) = client.stream_retired_order.pop_front() {
+            client.stream_retired.remove(&expired);
+        }
+    }
+}
+
 fn ack_stream_data(client: &mut ClientState, stream_id: u64, received_offset: u64) {
     let Some(sent) = client.stream_sent_data.get_mut(&stream_id) else {
         return;
@@ -3348,7 +3393,7 @@ async fn send_stream_close_to_client(
     {
         let mut locked = state.lock().expect("server state poisoned");
         if let Some(client) = locked.client_mut(&client_id) {
-            cleanup_client_stream(client, stream_id);
+            retire_client_stream(client, stream_id);
         }
     }
     let body = protocol::to_body(&StreamClose { stream_id })?;
@@ -3412,16 +3457,20 @@ async fn broadcast_output(
             session.recent.pop_front();
         }
         // For a persistent session, mirror the screen to disk periodically so a
-        // post-restart reattach repaints. Throttled by accumulated bytes to keep
+        // post-restart reattach repaints. Throttled by accumulated bytes or a
-        // the (atomic) write off the per-packet hot path. The actual file write
+        // short wall-clock age so low-throughput prompt/TUI changes persist
-        // happens after the lock is dropped.
+        // quickly while large bursts still avoid per-packet disk writes. The
+        // actual file write happens after the lock is dropped.
         if session.persistent {
             session.bytes_since_persist = session
                 .bytes_since_persist
                 .saturating_add(output.bytes.len());
-            if session.bytes_since_persist >= SCREEN_PERSIST_BYTES {
+            let now = Instant::now();
+            if session.bytes_since_persist >= SCREEN_PERSIST_BYTES
+                || now.duration_since(session.last_screen_persist_at) >= SCREEN_PERSIST_MAX_AGE
+            {
                 session.bytes_since_persist = 0;
-                session.last_persisted_seq = output_seq;
+                session.last_screen_persist_at = now;
                 let screen = session.parser.screen();
                 persist_screen = Some((
                     output.session.clone(),
@@ -3480,6 +3529,8 @@ async fn broadcast_output(
             persist::save_screen(&sessions_dir, &name, cols, rows, output_seq, &snapshot)
         {
             eprintln!("screen persist for {name} failed: {err:#}");
+        } else {
+            mark_screen_persisted(state, &name, output_seq);
         }
     }
     for (endpoint, packet) in sends {
@@ -3761,8 +3812,8 @@ fn flush_persistent_screens(state: &Arc<Mutex<ServerState>>) {
             if !session.persistent || session.output_seq == session.last_persisted_seq {
                 continue;
             }
-            session.last_persisted_seq = session.output_seq;
             session.bytes_since_persist = 0;
+            session.last_screen_persist_at = Instant::now();
             let screen = session.parser.screen();
             to_write.push((
                 name.clone(),
@@ -3779,10 +3830,19 @@ fn flush_persistent_screens(state: &Arc<Mutex<ServerState>>) {
             persist::save_screen(&sessions_dir, &name, cols, rows, output_seq, &snapshot)
         {
             eprintln!("screen flush for {name} failed: {err:#}");
+        } else {
+            mark_screen_persisted(state, &name, output_seq);
         }
     }
 }
 
+fn mark_screen_persisted(state: &Arc<Mutex<ServerState>>, name: &str, output_seq: u64) {
+    let mut locked = state.lock().expect("server state poisoned");
+    if let Some(session) = locked.sessions.get_mut(name) {
+        session.last_persisted_seq = session.last_persisted_seq.max(output_seq);
+    }
+}
+
 fn cleanup_disconnected_clients(state: &Arc<Mutex<ServerState>>) {
     // Sessions removed here are dropped after the lock is released so their
     // shells are killed (PtyHandle::drop) without holding up the event loop.
@@ -4047,6 +4107,8 @@ mod tests {
             stream_sent_data: HashMap::new(),
             stream_next_recv_offset: HashMap::new(),
             stream_recv_pending: HashMap::new(),
+            stream_retired: HashSet::new(),
+            stream_retired_order: VecDeque::new(),
             epoch: 0,
             epoch_started: Instant::now(),
             epoch_packets: 0,
@@ -4154,6 +4216,25 @@ mod tests {
         assert!(client.stream_recv_pending.contains_key(&other_stream_id));
     }
 
+    #[test]
+    fn retire_client_stream_tombstones_only_real_stream_state() {
+        let stream_id = 42;
+        let mut client = test_client_state([8u8; 32]);
+        client.opened_streams.insert(stream_id);
+        client
+            .stream_send_credit
+            .insert(stream_id, STREAM_INITIAL_WINDOW);
+
+        retire_client_stream(&mut client, stream_id);
+        retire_client_stream(&mut client, 99);
+
+        assert!(!client.opened_streams.contains(&stream_id));
+        assert!(!client.stream_send_credit.contains_key(&stream_id));
+        assert!(client.stream_retired.contains(&stream_id));
+        assert!(!client.stream_retired.contains(&99));
+        assert_eq!(client.stream_retired_order, VecDeque::from([stream_id]));
+    }
+
     #[test]
     fn client_index_stays_in_sync_with_session_clients() {
         let (pty_tx, _pty_rx) = mpsc::unbounded_channel();
@@ -4322,6 +4403,7 @@ mod tests {
                 persistent: false,
                 bytes_since_persist: 0,
                 last_persisted_seq: 0,
+                last_screen_persist_at: Instant::now(),
             },
         );
         state.client_index.insert(client_id, "test".to_string());
@@ -4359,6 +4441,75 @@ mod tests {
         assert_eq!(ok.stream_id, stream_id);
     }
 
+    #[tokio::test]
+    async fn retired_stream_open_is_rejected_not_reopened() {
+        let (pty_tx, _pty_rx) = mpsc::unbounded_channel();
+        let mut state = ServerState::new(ServerConfig::default(), [0u8; 32], pty_tx);
+        let client_id = [15u8; 16];
+        let session_key = [16u8; 32];
+        let stream_id = 100;
+        let receiver = UdpSocket::bind("127.0.0.1:0").await.unwrap();
+        let sender = Arc::new(UdpSocket::bind("127.0.0.1:0").await.unwrap());
+        let mut client = test_client_state(session_key);
+        client.endpoint = receiver.local_addr().unwrap();
+        client.stream_retired.insert(stream_id);
+        client.stream_retired_order.push_back(stream_id);
+        state.sessions.insert(
+            "test".to_string(),
+            Session {
+                pty: None,
+                parser: vt100::Parser::new(24, 80, 100),
+                clients: HashMap::from([(client_id, client)]),
+                output_seq: 0,
+                recent: VecDeque::new(),
+                empty_since: None,
+                holder_control: None,
+                persistent: false,
+                bytes_since_persist: 0,
+                last_persisted_seq: 0,
+                last_screen_persist_at: Instant::now(),
+            },
+        );
+        state.client_index.insert(client_id, "test".to_string());
+        let state = Arc::new(Mutex::new(state));
+        let raw = protocol::encode_encrypted(
+            PacketKind::StreamOpen,
+            client_id,
+            2,
+            0,
+            &session_key,
+            CLIENT_TO_SERVER,
+            &protocol::to_body(&StreamOpen {
+                stream_id,
+                target_host: "127.0.0.1".to_string(),
+                target_port: 9,
+            })
+            .unwrap(),
+        )
+        .unwrap();
+        let packet = protocol::decode(&raw).unwrap();
+
+        handle_stream_open(&state, &sender, receiver.local_addr().unwrap(), &packet)
+            .await
+            .unwrap();
+
+        let mut buf = [0u8; 2048];
+        let (n, _) = tokio::time::timeout(Duration::from_secs(1), receiver.recv_from(&mut buf))
+            .await
+            .unwrap()
+            .unwrap();
+        let packet = protocol::decode(&buf[..n]).unwrap();
+        assert_eq!(packet.header.kind, PacketKind::StreamOpenReject);
+        let plain = protocol::decrypt_body(&packet, &session_key, SERVER_TO_CLIENT).unwrap();
+        let reject: StreamOpenReject = protocol::from_body(&plain).unwrap();
+        assert_eq!(reject.stream_id, stream_id);
+        assert!(reject.reason.contains("closed"));
+
+        let locked = state.lock().unwrap();
+        let client = locked.sessions["test"].clients.get(&client_id).unwrap();
+        assert!(!client.opened_streams.contains(&stream_id));
+    }
+
     #[tokio::test]
     async fn pending_server_stream_open_is_retransmitted() {
         let (pty_tx, _pty_rx) = mpsc::unbounded_channel();
@@ -4392,6 +4543,7 @@ mod tests {
                 persistent: false,
                 bytes_since_persist: 0,
                 last_persisted_seq: 0,
+                last_screen_persist_at: Instant::now(),
             },
         );
         state.client_index.insert(client_id, "test".to_string());
@@ -4546,6 +4698,8 @@ mod tests {
                         stream_sent_data: HashMap::new(),
                         stream_next_recv_offset: HashMap::new(),
                         stream_recv_pending: HashMap::new(),
+                        stream_retired: HashSet::new(),
+                        stream_retired_order: VecDeque::new(),
                         epoch: 0,
                         epoch_started: Instant::now(),
                         epoch_packets: 0,
@@ -4559,6 +4713,7 @@ mod tests {
                 persistent: false,
                 bytes_since_persist: 0,
                 last_persisted_seq: 0,
+                last_screen_persist_at: Instant::now(),
             },
         );
         // Keep the O(1) conn_id index in sync, matching `insert_client`.
@@ -4640,6 +4795,8 @@ mod tests {
                         stream_sent_data: HashMap::new(),
                         stream_next_recv_offset: HashMap::new(),
                         stream_recv_pending: HashMap::new(),
+                        stream_retired: HashSet::new(),
+                        stream_retired_order: VecDeque::new(),
                         epoch: 0,
                         epoch_started: Instant::now(),
                         epoch_packets: 0,
@@ -4653,6 +4810,7 @@ mod tests {
                 persistent: false,
                 bytes_since_persist: 0,
                 last_persisted_seq: 0,
+                last_screen_persist_at: Instant::now(),
             },
         );
         state.client_index.insert(client_id, "test".to_string());

src/config.rs

@@ -150,6 +150,12 @@ pub struct ClientConfig {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct HostConfig {
     pub ssh: Option<String>,
+    /// Optional OpenSSH config host name to use for SSH-backed bootstrap,
+    /// trust/setup/doctor checks, and native-auth identity selection. This lets
+    /// a Dosh host keep a separate UDP endpoint while still inheriting
+    /// alias-scoped OpenSSH settings like IdentityFile, ProxyJump, and SendEnv.
+    #[serde(default)]
+    pub ssh_config: Option<String>,
     pub user: Option<String>,
     pub dosh_host: Option<String>,
     pub port: Option<u16>,

src/transport.rs

@@ -30,6 +30,7 @@ use tokio::net::UdpSocket;
 pub const DEFAULT_INITIAL_WINDOW: usize = 1024 * 1024;
 pub const DEFAULT_RETRANSMIT_AFTER: Duration = Duration::from_millis(200);
 pub const DEFAULT_KEEPALIVE_AFTER: Duration = Duration::from_secs(2);
+pub const DEFAULT_RETIRED_STREAM_TOMBSTONES: usize = 16 * 1024;
 pub const SERVICE_TARGET_PREFIX: &str = "@dosh-";
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -37,6 +38,7 @@ pub struct TransportConfig {
     pub initial_window: usize,
     pub retransmit_after: Duration,
     pub keepalive_after: Duration,
+    pub retired_stream_tombstones: usize,
 }
 
 impl Default for TransportConfig {
@@ -45,6 +47,7 @@ impl Default for TransportConfig {
             initial_window: DEFAULT_INITIAL_WINDOW,
             retransmit_after: DEFAULT_RETRANSMIT_AFTER,
             keepalive_after: DEFAULT_KEEPALIVE_AFTER,
+            retired_stream_tombstones: DEFAULT_RETIRED_STREAM_TOMBSTONES,
         }
     }
 }
@@ -174,6 +177,7 @@ pub struct StreamMux {
     next_recv_offset: HashMap<u64, u64>,
     recv_pending: HashMap<u64, BTreeMap<u64, Vec<u8>>>,
     retired_streams: HashSet<u64>,
+    retired_stream_order: VecDeque<u64>,
 }
 
 #[derive(Debug, Clone, Default)]
@@ -230,6 +234,7 @@ impl StreamMux {
             next_recv_offset: HashMap::new(),
             recv_pending: HashMap::new(),
             retired_streams: HashSet::new(),
+            retired_stream_order: VecDeque::new(),
         }
     }
 
@@ -687,7 +692,17 @@ impl StreamMux {
 
     fn retire_stream(&mut self, stream_id: u64) {
         self.cleanup_stream(stream_id);
-        self.retired_streams.insert(stream_id);
+        if self.config.retired_stream_tombstones == 0 {
+            return;
+        }
+        if self.retired_streams.insert(stream_id) {
+            self.retired_stream_order.push_back(stream_id);
+        }
+        while self.retired_stream_order.len() > self.config.retired_stream_tombstones {
+            if let Some(expired) = self.retired_stream_order.pop_front() {
+                self.retired_streams.remove(&expired);
+            }
+        }
     }
 
     fn cleanup_stream(&mut self, stream_id: u64) {
@@ -1318,6 +1333,35 @@ mod tests {
         assert!(mux.retired_streams.contains(&1));
     }
 
+    #[test]
+    fn retired_stream_tombstones_are_bounded() {
+        let mut mux = StreamMux::new(TransportConfig {
+            retired_stream_tombstones: 2,
+            ..TransportConfig::default()
+        });
+        for stream_id in 1..=3 {
+            mux.open_stream(stream_id, "@dosh-test", 0).unwrap();
+            mux.close_stream(stream_id).unwrap();
+        }
+
+        assert_eq!(mux.retired_streams.len(), 2);
+        assert!(!mux.retired_streams.contains(&1));
+        assert!(mux.retired_streams.contains(&2));
+        assert!(mux.retired_streams.contains(&3));
+
+        let stale_open = protocol::to_body(&StreamOpen {
+            stream_id: 3,
+            target_host: "@dosh-test".to_string(),
+            target_port: 0,
+        })
+        .unwrap();
+        assert_eq!(
+            mux.handle_packet(PacketKind::StreamOpen, &stale_open)
+                .unwrap(),
+            TransportEvent::Ignored { stream_id: 3 }
+        );
+    }
+
     #[tokio::test]
     async fn session_transport_partitions_client_and_server_stream_ids() {
         let client_socket = UdpSocket::bind("127.0.0.1:0").await.unwrap();

tests/release_scripts.rs

@@ -19,6 +19,46 @@ fn release_scripts_skip_stale_artifacts_when_auto_discovering() {
     assert!(publish.contains("actual=\"$(artifact_version \"$artifact\" || true)\""));
 }
 
+#[test]
+fn package_check_verifies_only_artifacts_it_builds() {
+    let makefile = include_str!("../Makefile");
+    let verify = include_str!("../scripts/verify-release-artifacts.sh");
+    assert!(
+        verify.contains("if [ \"$#\" -gt 0 ]; then"),
+        "release verifier must accept an explicit artifact list"
+    );
+    let package_check = makefile
+        .split("package-check:")
+        .nth(1)
+        .and_then(|tail| tail.split("\ninstall:").next())
+        .expect("package-check target");
+    assert!(package_check.contains("package-release-linux"));
+    assert!(package_check.contains("package-release-windows"));
+    assert!(package_check.contains("dosh-linux-x86_64.tar.gz"));
+    assert!(package_check.contains("dosh-windows-x86_64.zip"));
+    assert!(
+        !package_check.contains("dosh-macos-aarch64.tar.gz"),
+        "Linux package-check does not build macOS artifacts, so it must not depend on one"
+    );
+}
+
+#[test]
+fn package_release_stamps_git_build_info() {
+    let package = include_str!("../scripts/package-release.sh");
+    let build = include_str!("../build.rs");
+    for name in [
+        "DOSH_BUILD_GIT_HASH",
+        "DOSH_BUILD_COMMIT_DATE",
+        "DOSH_BUILD_GIT_DIRTY",
+    ] {
+        assert!(package.contains(name), "package script must export {name}");
+        assert!(build.contains(name), "build.rs must consume {name}");
+    }
+    assert!(package.contains("git rev-parse --short=12 HEAD"));
+    assert!(package.contains("git show -s --format=%cs HEAD"));
+    assert!(build.contains("cargo:rerun-if-env-changed=DOSH_BUILD_GIT_HASH"));
+}
+
 #[test]
 fn systemd_service_does_not_sandbox_remote_shells() {
     let service = include_str!("../packaging/systemd/dosh-server.service");