Harden reconnect paths under UDP churn

Cargo.lock

@@ -436,7 +436,7 @@ dependencies = [
 
 [[package]]
 name = "dosh"
-version = "1.0.0-rc16"
+version = "1.0.0-rc23"
 dependencies = [
  "anyhow",
  "base64",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dosh"
-version = "1.0.0-rc16"
+version = "1.0.0-rc23"
 edition = "2024"
 license = "MIT"
 

Makefile

@@ -36,7 +36,9 @@ persistence-check:
 package-check:
 	$(MAKE) package-release-linux
 	$(MAKE) package-release-windows
-	sh scripts/verify-release-artifacts.sh
+	sh scripts/verify-release-artifacts.sh \
+		target/dosh-release/dosh-linux-x86_64.tar.gz \
+		target/dosh-release/dosh-windows-x86_64.zip
 
 install:
 	sh install.sh --from-current

README.md

@@ -44,6 +44,7 @@ dosh setup HOST
 dosh HOST
 dosh HOST COMMAND
 dosh update
+dosh update --client|--server|--both
 ```
 
 Useful commands:
@@ -97,6 +98,16 @@ cache_attach_tickets = true
 disconnect_status = true
 ```
 
+Example host entry:
+
+```toml
+[prod]
+ssh = "prod"
+ssh_config = "prod" # OpenSSH alias for IdentityFile, ProxyJump, SendEnv, etc.
+dosh_host = "prod.example.com"
+port = 50000
+```
+
 ## Rust Library
 
 Dosh exposes a Rust transport for encrypted, reconnecting application streams.

build.rs

@@ -1,3 +1,4 @@
+use std::env;
 use std::process::Command;
 
 fn git(args: &[&str]) -> Option<String> {
@@ -12,14 +13,29 @@ fn git(args: &[&str]) -> Option<String> {
 fn main() {
     println!("cargo:rerun-if-changed=.git/HEAD");
     println!("cargo:rerun-if-changed=.git/index");
+    println!("cargo:rerun-if-env-changed=DOSH_BUILD_GIT_HASH");
+    println!("cargo:rerun-if-env-changed=DOSH_BUILD_COMMIT_DATE");
+    println!("cargo:rerun-if-env-changed=DOSH_BUILD_GIT_DIRTY");
 
-    let hash = git(&["rev-parse", "--short=12", "HEAD"]).unwrap_or_else(|| "unknown".into());
+    let hash = env::var("DOSH_BUILD_GIT_HASH")
-    let date = git(&["show", "-s", "--format=%cs", "HEAD"]).unwrap_or_else(|| "unknown".into());
+        .ok()
-    let dirty = Command::new("git")
+        .filter(|value| !value.is_empty())
-        .args(["diff", "--quiet", "--ignore-submodules", "--"])
+        .or_else(|| git(&["rev-parse", "--short=12", "HEAD"]))
-        .status()
+        .unwrap_or_else(|| "unknown".into());
-        .map(|status| if status.success() { "" } else { "+dirty" })
+    let date = env::var("DOSH_BUILD_COMMIT_DATE")
-        .unwrap_or("");
+        .ok()
+        .filter(|value| !value.is_empty())
+        .or_else(|| git(&["show", "-s", "--format=%cs", "HEAD"]))
+        .unwrap_or_else(|| "unknown".into());
+    let dirty = match env::var("DOSH_BUILD_GIT_DIRTY").ok().as_deref() {
+        Some("1" | "true" | "yes" | "+dirty") => "+dirty",
+        Some(_) => "",
+        None => Command::new("git")
+            .args(["diff", "--quiet", "--ignore-submodules", "--"])
+            .status()
+            .map(|status| if status.success() { "" } else { "+dirty" })
+            .unwrap_or(""),
+    };
 
     println!("cargo:rustc-env=DOSH_GIT_HASH={hash}{dirty}");
     println!("cargo:rustc-env=DOSH_COMMIT_DATE={date}");

scripts/package-release.sh

@@ -52,6 +52,22 @@ else
   release_dir="target/release"
 fi
 
+if command -v git >/dev/null 2>&1 && git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  if [ -z "${DOSH_BUILD_GIT_HASH:-}" ]; then
+    export DOSH_BUILD_GIT_HASH="$(git rev-parse --short=12 HEAD)"
+  fi
+  if [ -z "${DOSH_BUILD_COMMIT_DATE:-}" ]; then
+    export DOSH_BUILD_COMMIT_DATE="$(git show -s --format=%cs HEAD)"
+  fi
+  if [ -z "${DOSH_BUILD_GIT_DIRTY+x}" ]; then
+    if git diff --quiet --ignore-submodules --; then
+      export DOSH_BUILD_GIT_DIRTY=0
+    else
+      export DOSH_BUILD_GIT_DIRTY=1
+    fi
+  fi
+fi
+
 if [ "$os" = "windows" ]; then
   if [ -n "$target" ]; then
     cargo build --release --target "$target" --bin dosh-client --bin dosh-bench

scripts/verify-release-artifacts.sh

@@ -22,11 +22,14 @@ artifact_version() {
   esac
 }
 
+if [ "$#" -gt 0 ]; then
+  artifacts="$*"
+else
+  artifacts="$out_dir/dosh-linux-x86_64.tar.gz $out_dir/dosh-macos-aarch64.tar.gz $out_dir/dosh-windows-x86_64.zip"
+fi
+
 failed=0
-for artifact in \
+for artifact in $artifacts; do
-  "$out_dir/dosh-linux-x86_64.tar.gz" \
-  "$out_dir/dosh-macos-aarch64.tar.gz" \
-  "$out_dir/dosh-windows-x86_64.zip"; do
   if [ ! -f "$artifact" ]; then
     echo "missing release artifact: $artifact" >&2
     failed=1

src/bin/dosh-client.rs

@@ -36,7 +36,10 @@ use dosh::transport::{
     DoshTransport, SessionEvent, SessionRole, SessionTransportConfig, TransportConfig,
     TransportEvent,
 };
-use dosh::udp::is_transient_udp_send_error;
+use dosh::udp::{
+    is_transient_udp_error, is_transient_udp_send_error, recv_udp_retrying_transient,
+    send_udp_retrying_transient,
+};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use std::collections::BTreeMap;
@@ -260,7 +263,7 @@ async fn main() -> Result<()> {
         return run_file_cat_command(&args);
     }
     if args.server.as_deref() == Some("update") {
-        return run_update(&config, update_check_requested(&args.command)?);
+        return run_update(&config, parse_update_options(&args.command)?);
     }
     if args.server.as_deref() == Some("setup") {
         return run_setup_command(&config, &args).await;
@@ -302,8 +305,7 @@ async fn main() -> Result<()> {
         .get(&requested_server)
         .cloned()
         .unwrap_or_default();
-    let raw_server = host.ssh.clone().unwrap_or_else(|| requested_server.clone());
+    let server = ssh_command_target(&requested_server, &host);
-    let server = ssh_with_user(&raw_server, host.user.as_deref());
     let startup_command = resolved_startup_command(&args.command, &config, &host);
     let local_forwards = parse_local_forwards(&args.local_forward)?;
     let remote_forwards = parse_remote_forwards(&args.remote_forward)?;
@@ -655,8 +657,7 @@ fn run_trust_command(config: &dosh::config::ClientConfig, args: &Args) -> Result
 
     let hosts = load_hosts_config(None).unwrap_or_default();
     let host_config = hosts.hosts.get(host).cloned().unwrap_or_default();
-    let raw_server = host_config.ssh.clone().unwrap_or_else(|| host.to_string());
+    let server = ssh_command_target(host, &host_config);
-    let server = ssh_with_user(&raw_server, host_config.user.as_deref());
     let ssh_port = args.ssh_port.or(host_config.ssh_port).or(config.ssh_port);
     let ssh_auth_command = args
         .ssh_auth_command
@@ -701,8 +702,8 @@ async fn run_setup_command(config: &dosh::config::ClientConfig, args: &Args) ->
     for entry in imported {
         match entry.action {
             ImportAction::Added => println!(
-                "[ok] host config: [{}] ssh={} dosh_host={} port={}",
+                "[ok] host config: [{}] ssh={} ssh_config={} dosh_host={} port={}",
-                entry.alias, entry.ssh, entry.dosh_host, entry.port
+                entry.alias, entry.ssh, entry.ssh_config, entry.dosh_host, entry.port
             ),
             ImportAction::Skipped => println!("[ok] host config: [{}] already exists", entry.alias),
         }
@@ -710,8 +711,7 @@ async fn run_setup_command(config: &dosh::config::ClientConfig, args: &Args) ->
 
     let hosts = load_hosts_config(None).unwrap_or_default();
     let host_config = hosts.hosts.get(&host).cloned().unwrap_or_default();
-    let raw_server = host_config.ssh.clone().unwrap_or_else(|| host.clone());
+    let server = ssh_command_target(&host, &host_config);
-    let server = ssh_with_user(&raw_server, host_config.user.as_deref());
     let ssh_port = args.ssh_port.or(host_config.ssh_port).or(config.ssh_port);
     let ssh_auth_command = args
         .ssh_auth_command
@@ -843,9 +843,15 @@ fn run_restart_command(config: &dosh::config::ClientConfig, args: &Args) -> Resu
 }
 
 fn status_ssh_target(requested: &str, host_config: &dosh::config::HostConfig) -> String {
+    ssh_command_target(requested, host_config)
+}
+
+fn ssh_command_target(requested: &str, host_config: &dosh::config::HostConfig) -> String {
     let raw_server = host_config
-        .ssh
+        .ssh_config
-        .clone()
+        .as_ref()
+        .or(host_config.ssh.as_ref())
+        .cloned()
         .unwrap_or_else(|| requested.to_string());
     ssh_with_user(&raw_server, host_config.user.as_deref())
 }
@@ -882,11 +888,7 @@ async fn run_doctor_for_host(
 ) -> Result<()> {
     let hosts = load_hosts_config(None).unwrap_or_default();
     let host_config = hosts.hosts.get(requested).cloned().unwrap_or_default();
-    let raw_server = host_config
+    let server = ssh_command_target(requested, &host_config);
-        .ssh
-        .clone()
-        .unwrap_or_else(|| requested.to_string());
-    let server = ssh_with_user(&raw_server, host_config.user.as_deref());
     let ssh_port = args.ssh_port.or(host_config.ssh_port).or(config.ssh_port);
     let dosh_port = args
         .dosh_port
@@ -1393,8 +1395,7 @@ async fn run_proxy_stdio_command(config: &dosh::config::ClientConfig, args: &Arg
         .get(&requested_server)
         .cloned()
         .unwrap_or_default();
-    let raw_server = host.ssh.clone().unwrap_or_else(|| requested_server.clone());
+    let server = ssh_command_target(&requested_server, &host);
-    let server = ssh_with_user(&raw_server, host.user.as_deref());
     let ssh_port = args.ssh_port.or(host.ssh_port).or(config.ssh_port);
     let resolved_ssh_config = ssh_config(&server, ssh_port).unwrap_or_default();
     let requested_udp_host = args
@@ -1561,11 +1562,7 @@ fn ensure_vscode_ssh_host(
 ) -> Result<GeneratedVscodeHost> {
     let hosts = load_hosts_config(None).unwrap_or_default();
     let host_config = hosts.hosts.get(requested).cloned().unwrap_or_default();
-    let raw_server = host_config
+    let server = ssh_command_target(requested, &host_config);
-        .ssh
-        .clone()
-        .unwrap_or_else(|| requested.to_string());
-    let server = ssh_with_user(&raw_server, host_config.user.as_deref());
     let ssh_port = args.ssh_port.or(host_config.ssh_port).or(config.ssh_port);
     let ssh_config = ssh_config(&server, ssh_port).unwrap_or_default();
     let target_ssh_port = ssh_config.port.or(ssh_port).unwrap_or(22);
@@ -2501,7 +2498,6 @@ fn download_file(
     let mut file = if offset > 0 {
         let file = fs::OpenOptions::new()
             .read(true)
-            .write(true)
             .append(true)
             .open(local)
             .with_context(|| format!("open {}", local.display()))?;
@@ -2842,12 +2838,95 @@ fn run_remote_script(
     Ok(())
 }
 
-fn update_check_requested(command: &[String]) -> Result<bool> {
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-    match command {
+enum UpdateRole {
-        [] => Ok(false),
+    Auto,
-        [flag] if flag == "--check" || flag == "-n" => Ok(true),
+    Client,
-        _ => Err(anyhow!("usage: dosh update [--check]")),
+    Server,
+    Both,
+}
+
+impl UpdateRole {
+    fn installer_arg(self) -> &'static str {
+        match self {
+            UpdateRole::Auto => {
+                if local_server_install_detected() {
+                    "both"
+                } else {
+                    "client"
+                }
+            }
+            UpdateRole::Client => "client",
+            UpdateRole::Server => "server",
+            UpdateRole::Both => "both",
+        }
     }
+
+    fn installer_arg_for_os(self, os: &str) -> Result<&'static str> {
+        if os == "windows" {
+            return match self {
+                UpdateRole::Auto | UpdateRole::Client => Ok("client"),
+                UpdateRole::Server | UpdateRole::Both => {
+                    Err(anyhow!("Windows installs support client updates only"))
+                }
+            };
+        }
+        Ok(self.installer_arg())
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+struct UpdateOptions {
+    check_only: bool,
+    role: UpdateRole,
+}
+
+fn parse_update_options(command: &[String]) -> Result<UpdateOptions> {
+    let mut options = UpdateOptions {
+        check_only: false,
+        role: UpdateRole::Auto,
+    };
+    for arg in command {
+        match arg.as_str() {
+            "--check" | "-n" => options.check_only = true,
+            "--client" => options.role = update_role_flag(options.role, UpdateRole::Client)?,
+            "--server" => options.role = update_role_flag(options.role, UpdateRole::Server)?,
+            "--both" => options.role = update_role_flag(options.role, UpdateRole::Both)?,
+            _ => {
+                return Err(anyhow!(
+                    "usage: dosh update [--check] [--client|--server|--both]"
+                ));
+            }
+        }
+    }
+    Ok(options)
+}
+
+fn update_role_flag(current: UpdateRole, requested: UpdateRole) -> Result<UpdateRole> {
+    if current != UpdateRole::Auto && current != requested {
+        return Err(anyhow!("choose only one of --client, --server, or --both"));
+    }
+    Ok(requested)
+}
+
+fn local_server_install_detected() -> bool {
+    if cfg!(windows) {
+        return false;
+    }
+    let service = dirs::home_dir()
+        .map(|home| home.join(".config/systemd/user/dosh-server.service"))
+        .filter(|path| path.exists())
+        .is_some();
+    if service {
+        return true;
+    }
+    let Ok(exe) = std::env::current_exe() else {
+        return false;
+    };
+    let Some(bin_dir) = exe.parent() else {
+        return false;
+    };
+    bin_dir.join("dosh-server").exists() || bin_dir.join("dosh-server.exe").exists()
 }
 
 fn release_artifact_name() -> &'static str {
@@ -2862,6 +2941,18 @@ fn release_artifact_name() -> &'static str {
     }
 }
 
+fn update_installer_name(os: &str) -> &'static str {
+    if os == "windows" {
+        "install.ps1"
+    } else {
+        "install.sh"
+    }
+}
+
+fn update_installer_url(raw_base: &str, os: &str) -> String {
+    format!("{raw_base}/raw/branch/main/{}", update_installer_name(os))
+}
+
 fn latest_release_download_url(repo: &str, artifact: &str) -> Option<String> {
     let web = repo
         .strip_suffix(".git")
@@ -2968,20 +3059,23 @@ fn url_reachable(url: &str) -> Result<bool> {
     Ok(status.success())
 }
 
-fn run_update(config: &dosh::config::ClientConfig, check_only: bool) -> Result<()> {
+fn run_update(config: &dosh::config::ClientConfig, options: UpdateOptions) -> Result<()> {
     let repo = config
         .update_repo
         .clone()
         .unwrap_or_else(|| "https://git.palav.dev/Palav/dosh.git".to_string());
     let raw_base = raw_base_from_repo(&repo);
-    let installer = format!("{raw_base}/raw/branch/main/install.sh");
+    let os = std::env::consts::OS;
+    let installer = update_installer_url(&raw_base, os);
     let artifact = release_artifact_name();
-    if check_only {
+    let installer_role = options.role.installer_arg_for_os(os)?;
+    if options.check_only {
         let local_version = env!("CARGO_PKG_VERSION");
         let latest_tag = latest_release_tag(&repo)?;
         println!("dosh {local_version}");
         println!("repo: {repo}");
         println!("installer: {installer}");
+        println!("role: {installer_role}");
         match latest_tag.as_deref() {
             Some(tag) => {
                 let latest_version = release_version_from_tag(tag);
@@ -3017,13 +3111,79 @@ fn run_update(config: &dosh::config::ClientConfig, check_only: bool) -> Result<(
         .join("dosh")
         .join("source");
     let use_prebuilt = std::env::var("DOSH_USE_PREBUILT").unwrap_or_else(|_| "1".to_string());
+    let status = run_update_installer(
+        config,
+        &repo,
+        &installer,
+        installer_role,
+        &update_cache.display().to_string(),
+        &use_prebuilt,
+    )?;
+    if !status.success() {
+        return Err(anyhow!("dosh update failed with status {status}"));
+    }
+    Ok(())
+}
+
+fn run_update_installer(
+    config: &dosh::config::ClientConfig,
+    repo: &str,
+    installer: &str,
+    installer_role: &str,
+    update_cache: &str,
+    use_prebuilt: &str,
+) -> Result<std::process::ExitStatus> {
+    if cfg!(windows) {
+        let script = windows_update_script(
+            config,
+            repo,
+            installer,
+            installer_role,
+            update_cache,
+            use_prebuilt,
+        );
+        return Command::new("powershell.exe")
+            .arg("-NoProfile")
+            .arg("-ExecutionPolicy")
+            .arg("Bypass")
+            .arg("-Command")
+            .arg(script)
+            .stdin(Stdio::null())
+            .status()
+            .context("run dosh update installer");
+    }
+    let script = unix_update_script(
+        config,
+        repo,
+        installer,
+        installer_role,
+        update_cache,
+        use_prebuilt,
+    );
+    Command::new("sh")
+        .arg("-c")
+        .arg(script)
+        .stdin(Stdio::null())
+        .status()
+        .context("run dosh update installer")
+}
+
+fn unix_update_script(
+    config: &dosh::config::ClientConfig,
+    repo: &str,
+    installer: &str,
+    installer_role: &str,
+    update_cache: &str,
+    use_prebuilt: &str,
+) -> String {
     let mut script = format!(
-        "curl -fsSL {} | DOSH_REPO={} DOSH_PORT={} DOSH_UPDATE_CACHE={} DOSH_UPDATE_QUIET=1 DOSH_USE_PREBUILT={} sh -s -- client",
+        "curl -fsSL {} | DOSH_REPO={} DOSH_PORT={} DOSH_UPDATE_CACHE={} DOSH_UPDATE_QUIET=1 DOSH_USE_PREBUILT={} sh -s -- {}",
-        shell_word(&installer),
+        shell_word(installer),
-        shell_word(&repo),
+        shell_word(repo),
         config.update_port.unwrap_or(config.dosh_port),
-        shell_word(&update_cache.display().to_string()),
+        shell_word(update_cache),
-        shell_word(&use_prebuilt)
+        shell_word(use_prebuilt),
+        shell_word(installer_role)
     );
     if config.server != "user@example.com" {
         script.push_str(&format!(" --server {}", shell_word(&config.server)));
@@ -3031,16 +3191,47 @@ fn run_update(config: &dosh::config::ClientConfig, check_only: bool) -> Result<(
     if let Some(host) = &config.dosh_host {
         script.push_str(&format!(" --dosh-host {}", shell_word(host)));
     }
-    let status = Command::new("sh")
+    script
-        .arg("-c")
+}
-        .arg(script)
+
-        .stdin(Stdio::null())
+fn windows_update_script(
-        .status()
+    config: &dosh::config::ClientConfig,
-        .context("run dosh update installer")?;
+    repo: &str,
-    if !status.success() {
+    installer: &str,
-        return Err(anyhow!("dosh update failed with status {status}"));
+    installer_role: &str,
+    update_cache: &str,
+    use_prebuilt: &str,
+) -> String {
+    let mut script = String::from("$ErrorActionPreference='Stop';");
+    script.push_str("$ProgressPreference='SilentlyContinue';");
+    for (name, value) in [
+        ("DOSH_REPO", repo),
+        ("DOSH_ROLE", installer_role),
+        (
+            "DOSH_PORT",
+            &config.update_port.unwrap_or(config.dosh_port).to_string(),
+        ),
+        ("DOSH_UPDATE_CACHE", update_cache),
+        ("DOSH_UPDATE_QUIET", "1"),
+        ("DOSH_USE_PREBUILT", use_prebuilt),
+    ] {
+        script.push_str(&format!("$env:{name}={};", powershell_string(value)));
     }
-    Ok(())
+    if config.server != "user@example.com" {
+        script.push_str(&format!(
+            "$env:DOSH_SERVER={};",
+            powershell_string(&config.server)
+        ));
+    }
+    if let Some(host) = &config.dosh_host {
+        script.push_str(&format!("$env:DOSH_HOST={};", powershell_string(host)));
+    }
+    script.push_str(&format!("irm {} | iex", powershell_string(installer)));
+    script
+}
+
+fn powershell_string(value: &str) -> String {
+    format!("'{}'", value.replace('\'', "''"))
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -3053,6 +3244,7 @@ enum ImportAction {
 struct ImportedHost {
     alias: String,
     ssh: String,
+    ssh_config: String,
     dosh_host: String,
     port: u16,
     action: ImportAction,
@@ -3066,8 +3258,8 @@ fn run_import_ssh(config: &dosh::config::ClientConfig, aliases: &[String]) -> Re
     for entry in imported {
         match entry.action {
             ImportAction::Added => eprintln!(
-                "dosh import-ssh: added [{}] ssh={} dosh_host={}",
+                "dosh import-ssh: added [{}] ssh={} ssh_config={} dosh_host={}",
-                entry.alias, entry.ssh, entry.dosh_host
+                entry.alias, entry.ssh, entry.ssh_config, entry.dosh_host
             ),
             ImportAction::Skipped => {
                 eprintln!(
@@ -3109,6 +3301,7 @@ fn import_ssh_aliases(
             imported.push(ImportedHost {
                 alias: alias.clone(),
                 ssh: alias.clone(),
+                ssh_config: alias.clone(),
                 dosh_host: udp_host,
                 port: config.dosh_port,
                 action: ImportAction::Skipped,
@@ -3118,6 +3311,7 @@ fn import_ssh_aliases(
         raw.push('\n');
         raw.push_str(&format!("[{}]\n", toml_bare_key_or_quoted(alias)));
         raw.push_str(&format!("ssh = {}\n", toml_string(alias)));
+        raw.push_str(&format!("ssh_config = {}\n", toml_string(alias)));
         raw.push_str(&format!("dosh_host = {}\n", toml_string(&udp_host)));
         raw.push_str(&format!("port = {}\n", config.dosh_port));
         if let Some(user) = &ssh_config.user {
@@ -3132,6 +3326,7 @@ fn import_ssh_aliases(
         imported.push(ImportedHost {
             alias: alias.clone(),
             ssh: alias.clone(),
+            ssh_config: alias.clone(),
             dosh_host: udp_host,
             port: config.dosh_port,
             action: ImportAction::Added,
@@ -3597,14 +3792,11 @@ async fn try_native_auth(
             hello: hello.clone(),
         })?,
     )?;
-    socket.send_to(&packet, addr).await?;
+    let auth_timeout = Duration::from_millis(config.native_auth_timeout_ms.max(1));
+    send_udp_retrying_transient(socket, &packet, addr, auth_timeout).await?;
 
     let mut buf = vec![0u8; 65535];
-    let (n, _) = tokio::time::timeout(
+    let (n, _) = recv_udp_retrying_transient(socket, &mut buf, auth_timeout).await?;
-        Duration::from_millis(config.native_auth_timeout_ms.max(1)),
-        socket.recv_from(&mut buf),
-    )
-    .await??;
     let packet = protocol::decode(&buf[..n])?;
     if packet.header.kind != PacketKind::NativeServerHello {
         if packet.header.kind == PacketKind::AttachReject {
@@ -3667,13 +3859,9 @@ async fn try_native_auth(
         CLIENT_TO_SERVER,
         &auth_body,
     )?;
-    socket.send_to(&packet, addr).await?;
+    send_udp_retrying_transient(socket, &packet, addr, auth_timeout).await?;
 
-    let (n, _) = tokio::time::timeout(
+    let (n, _) = recv_udp_retrying_transient(socket, &mut buf, auth_timeout).await?;
-        Duration::from_millis(config.native_auth_timeout_ms.max(1)),
-        socket.recv_from(&mut buf),
-    )
-    .await??;
     let packet = protocol::decode(&buf[..n])?;
     if packet.header.kind != PacketKind::NativeAuthOk {
         if packet.header.kind == PacketKind::AttachReject {
@@ -3755,14 +3943,11 @@ async fn try_native_auth_check(
             hello: hello.clone(),
         })?,
     )?;
-    socket.send_to(&packet, addr).await?;
+    let auth_timeout = Duration::from_millis(config.native_auth_timeout_ms.max(1));
+    send_udp_retrying_transient(socket, &packet, addr, auth_timeout).await?;
 
     let mut buf = vec![0u8; 65535];
-    let (n, _) = tokio::time::timeout(
+    let (n, _) = recv_udp_retrying_transient(socket, &mut buf, auth_timeout).await?;
-        Duration::from_millis(config.native_auth_timeout_ms.max(1)),
-        socket.recv_from(&mut buf),
-    )
-    .await??;
     let packet = protocol::decode(&buf[..n])?;
     if packet.header.kind != PacketKind::NativeServerHello {
         if packet.header.kind == PacketKind::AttachReject {
@@ -3824,13 +4009,9 @@ async fn try_native_auth_check(
         CLIENT_TO_SERVER,
         &protocol::to_body(&NativeUserAuthBody { auth })?,
     )?;
-    socket.send_to(&packet, addr).await?;
+    send_udp_retrying_transient(socket, &packet, addr, auth_timeout).await?;
 
-    let (n, _) = tokio::time::timeout(
+    let (n, _) = recv_udp_retrying_transient(socket, &mut buf, auth_timeout).await?;
-        Duration::from_millis(config.native_auth_timeout_ms.max(1)),
-        socket.recv_from(&mut buf),
-    )
-    .await??;
     let packet = protocol::decode(&buf[..n])?;
     if packet.header.kind != PacketKind::NativeAuthCheckOk {
         if packet.header.kind == PacketKind::AttachReject {
@@ -3990,7 +4171,7 @@ async fn bootstrap_attach(
     let body = protocol::to_body(&req)?;
     let packet =
         protocol::encode_plain(PacketKind::BootstrapAttachRequest, [0u8; 16], 1, 0, &body)?;
-    socket.send_to(&packet, addr).await?;
+    send_udp_retrying_transient(socket, &packet, addr, Duration::from_secs(5)).await?;
     let expected_key_id = protocol::session_key_id(&bootstrap.session_key);
     let ok = recv_response_until(socket, Duration::from_secs(5), |packet| {
         if packet.header.kind == PacketKind::AttachReject && packet.header.conn_id == [0u8; 16] {
@@ -4070,7 +4251,7 @@ async fn try_ticket_attach(
         0,
         &protocol::to_body(&envelope)?,
     )?;
-    socket.send_to(&packet, addr).await?;
+    send_udp_retrying_transient(socket, &packet, addr, Duration::from_millis(700)).await?;
 
     let ok = recv_response_until(socket, Duration::from_millis(700), |packet| {
         if packet.header.kind == PacketKind::AttachReject && packet.header.conn_id == [0u8; 16] {
@@ -4146,7 +4327,7 @@ async fn try_resume_fresh_process(
         CLIENT_TO_SERVER,
         &body,
     )?;
-    socket.send_to(&packet, addr).await?;
+    send_udp_retrying_transient(socket, &packet, addr, Duration::from_millis(700)).await?;
     let frame = recv_response_until(socket, Duration::from_millis(700), |packet| {
         if !is_resume_response_for_client(&packet, cached.client_id) {
             return Ok(None);
@@ -4201,7 +4382,7 @@ async fn try_live_resume(
         &body,
     )?;
     *send_seq += 1;
-    socket.send_to(&packet, addr).await?;
+    send_udp_retrying_transient(socket, &packet, addr, Duration::from_millis(700)).await?;
     let frame = recv_response_until(socket, Duration::from_millis(700), |packet| {
         if !is_resume_response_for_client(&packet, cached.client_id) {
             return Ok(None);
@@ -4248,9 +4429,9 @@ where
             return Err(anyhow!("timed out waiting for server response"));
         }
         let remaining = wait - elapsed;
-        let (n, _) = tokio::time::timeout(remaining, socket.recv_from(&mut buf))
+        let (n, _) = recv_udp_retrying_transient(socket, &mut buf, remaining)
             .await
-            .context("timed out waiting for server response")??;
+            .context("timed out waiting for server response")?;
         let Ok(packet) = protocol::decode(&buf[..n]) else {
             continue;
         };
@@ -4640,7 +4821,11 @@ async fn run_terminal(
                 }
             }
             recv = socket.recv_from(&mut recv_buf) => {
-                let (n, _) = recv?;
+                let (n, _) = match recv {
+                    Ok(value) => value,
+                    Err(err) if is_transient_udp_error(&err) => continue,
+                    Err(err) => return Err(err.into()),
+                };
                 let Ok(packet) = protocol::decode(&recv_buf[..n]) else {
                     continue;
                 };
@@ -7565,11 +7750,12 @@ mod tests {
         FRAME_GAP_RESYNC_AFTER_MS, FrameBuffer, LocalForward, MAX_PENDING_USER_INPUT_BYTES,
         POST_SUBMIT_ALL_INPUT_HOLD, PendingStreamOpen, PredictMode, Predictor,
         RESTART_STATUS_SCRIPT, RemoteForward, STARTUP_INPUT_HOLD, SshConfig, StartupGateMode,
-        StatusAction, auth_allows, cache_key, cache_server_prefix, cleanup_stream_state,
+        StatusAction, UpdateOptions, UpdateRole, auth_allows, cache_key, cache_server_prefix,
-        clear_cached_credentials, ensure_tui_safe_status_overlay, input_contains_focus_in,
+        cleanup_stream_state, clear_cached_credentials, ensure_tui_safe_status_overlay,
-        input_matches_escape, is_local_status_target, is_resume_response_for_client,
+        input_contains_focus_in, input_matches_escape, is_local_status_target,
-        latest_release_download_url, load_first_native_identity_with_prompt, parse_dynamic_forward,
+        is_resume_response_for_client, latest_release_download_url,
-        parse_escape_key, parse_local_forward, parse_remote_forward, parse_ssh_config,
+        load_first_native_identity_with_prompt, parse_dynamic_forward, parse_escape_key,
+        parse_local_forward, parse_remote_forward, parse_ssh_config, parse_update_options,
         post_submit_hold_duration, queue_pending_user_input, raw_contains_host_table,
         recv_response_until, refresh_live_addr, release_tag_download_url,
         release_tag_from_effective_url, release_version_from_tag, render_status_clear,
@@ -7577,11 +7763,11 @@ mod tests {
         retransmit_stream_opens, rewrite_forward_command, selected_predict_mode, selected_udp_host,
         server_version_mismatch, should_flush_terminal_input_after_contact,
         should_hold_during_startup_gate, should_hold_post_submit_input,
-        should_repaint_idle_alternate_screen, split_after_command_submit, ssh_destination_host,
+        should_repaint_idle_alternate_screen, split_after_command_submit, ssh_command_target,
-        ssh_username, ssh_with_user, startup_command, status_ssh_target, strip_stale_mouse_reports,
+        ssh_destination_host, ssh_username, ssh_with_user, startup_command, status_ssh_target,
-        strip_terminal_focus_reports, terminal_private_mode_transition, toml_bare_key_or_quoted,
+        strip_stale_mouse_reports, strip_terminal_focus_reports, terminal_private_mode_transition,
-        update_check_requested, update_version_status, upsert_managed_block, valid_forward_host,
+        toml_bare_key_or_quoted, unix_update_script, update_installer_url, update_version_status,
-        vscode_safe_alias,
+        upsert_managed_block, valid_forward_host, vscode_safe_alias, windows_update_script,
     };
     use dosh::config::{ClientConfig, CommandExtension, HostConfig};
     use dosh::native::EnvVar;
@@ -8695,12 +8881,114 @@ mod tests {
     }
 
     #[test]
-    fn update_check_accepts_only_check_flag() {
+    fn update_options_accept_check_and_role_flags() {
-        assert!(!update_check_requested(&[]).unwrap());
+        assert_eq!(
-        assert!(update_check_requested(&["--check".to_string()]).unwrap());
+            parse_update_options(&[]).unwrap(),
-        assert!(update_check_requested(&["-n".to_string()]).unwrap());
+            UpdateOptions {
-        assert!(update_check_requested(&["--wat".to_string()]).is_err());
+                check_only: false,
-        assert!(update_check_requested(&["--check".to_string(), "extra".to_string()]).is_err());
+                role: UpdateRole::Auto,
+            }
+        );
+        assert_eq!(
+            parse_update_options(&["--check".to_string()]).unwrap(),
+            UpdateOptions {
+                check_only: true,
+                role: UpdateRole::Auto,
+            }
+        );
+        assert_eq!(
+            parse_update_options(&["-n".to_string(), "--server".to_string()]).unwrap(),
+            UpdateOptions {
+                check_only: true,
+                role: UpdateRole::Server,
+            }
+        );
+        assert_eq!(
+            parse_update_options(&["--both".to_string()]).unwrap(),
+            UpdateOptions {
+                check_only: false,
+                role: UpdateRole::Both,
+            }
+        );
+        assert!(parse_update_options(&["--wat".to_string()]).is_err());
+        assert!(parse_update_options(&["--client".to_string(), "--server".to_string()]).is_err());
+    }
+
+    #[test]
+    fn update_installer_uses_platform_native_script() {
+        assert_eq!(
+            update_installer_url("https://git.palav.dev/Palav/dosh", "linux"),
+            "https://git.palav.dev/Palav/dosh/raw/branch/main/install.sh"
+        );
+        assert_eq!(
+            update_installer_url("https://git.palav.dev/Palav/dosh", "macos"),
+            "https://git.palav.dev/Palav/dosh/raw/branch/main/install.sh"
+        );
+        assert_eq!(
+            update_installer_url("https://git.palav.dev/Palav/dosh", "windows"),
+            "https://git.palav.dev/Palav/dosh/raw/branch/main/install.ps1"
+        );
+    }
+
+    #[test]
+    fn windows_update_roles_are_client_only() {
+        assert_eq!(
+            UpdateRole::Auto.installer_arg_for_os("windows").unwrap(),
+            "client"
+        );
+        assert_eq!(
+            UpdateRole::Client.installer_arg_for_os("windows").unwrap(),
+            "client"
+        );
+        assert!(UpdateRole::Server.installer_arg_for_os("windows").is_err());
+        assert!(UpdateRole::Both.installer_arg_for_os("windows").is_err());
+        assert_eq!(
+            UpdateRole::Both.installer_arg_for_os("linux").unwrap(),
+            "both"
+        );
+    }
+
+    #[test]
+    fn update_scripts_are_native_to_the_platform() {
+        let config = ClientConfig {
+            server: "palav".to_string(),
+            dosh_host: Some("dosh.example.com".to_string()),
+            dosh_port: 50000,
+            update_port: Some(50001),
+            ..ClientConfig::default()
+        };
+        let unix = unix_update_script(
+            &config,
+            "https://git.palav.dev/Palav/dosh.git",
+            "https://git.palav.dev/Palav/dosh/raw/branch/main/install.sh",
+            "both",
+            "/tmp/dosh-cache",
+            "1",
+        );
+        assert!(unix.contains("curl -fsSL"));
+        assert!(unix.contains("install.sh"));
+        assert!(unix.contains("sh -s -- 'both'"));
+        assert!(unix.contains("--server 'palav'"));
+        assert!(unix.contains("--dosh-host 'dosh.example.com'"));
+
+        let windows = windows_update_script(
+            &config,
+            "https://git.palav.dev/Palav/dosh.git",
+            "https://git.palav.dev/Palav/dosh/raw/branch/main/install.ps1",
+            "client",
+            "C:\\Users\\palav\\AppData\\Local\\dosh\\source",
+            "1",
+        );
+        assert!(
+            windows.contains(
+                "irm 'https://git.palav.dev/Palav/dosh/raw/branch/main/install.ps1' | iex"
+            )
+        );
+        assert!(windows.contains("$env:DOSH_ROLE='client';"));
+        assert!(windows.contains("$env:DOSH_SERVER='palav';"));
+        assert!(windows.contains("$env:DOSH_HOST='dosh.example.com';"));
+        assert!(!windows.contains("install.sh"));
+        assert!(!windows.contains(" sh -s "));
     }
 
     #[test]
@@ -8720,6 +9008,19 @@ mod tests {
         );
     }
 
+    #[test]
+    fn ssh_command_target_prefers_explicit_ssh_config_alias() {
+        let host = HostConfig {
+            ssh: Some("server.example.com".to_string()),
+            ssh_config: Some("work-alias".to_string()),
+            user: Some("alice".to_string()),
+            ..HostConfig::default()
+        };
+
+        assert_eq!(ssh_command_target("work", &host), "alice@work-alias");
+        assert_eq!(status_ssh_target("work", &host), "alice@work-alias");
+    }
+
     #[test]
     fn status_detects_local_targets() {
         assert!(is_local_status_target("localhost"));

src/bin/dosh-server.rs

@@ -28,7 +28,7 @@ use dosh::protocol::{
     TicketAttachBody, TicketAttachEnvelope, TicketAttachOkEnvelope,
 };
 use dosh::pty::{PtyHandle, PtyOutput, adopt_pty_from_fd, spawn_pty_session};
-use dosh::udp::is_transient_udp_send_error;
+use dosh::udp::{is_transient_udp_error, is_transient_udp_send_error};
 use sha2::{Digest, Sha256};
 use std::collections::{BTreeMap, HashMap, HashSet, VecDeque};
 use std::fs;
@@ -262,7 +262,11 @@ async fn serve(config_path: Option<std::path::PathBuf>) -> Result<()> {
 
     let mut buf = vec![0u8; 65535];
     loop {
-        let (n, peer) = socket.recv_from(&mut buf).await?;
+        let (n, peer) = match socket.recv_from(&mut buf).await {
+            Ok(value) => value,
+            Err(err) if is_transient_udp_error(&err) => continue,
+            Err(err) => return Err(err.into()),
+        };
         if let Err(err) = handle_packet(&state, &socket, peer, &buf[..n]).await {
             eprintln!("packet from {peer}: {err:#}");
         }
@@ -357,6 +361,7 @@ impl NativeAuthRateLimiter {
 struct Session {
     pty: Option<PtyHandle>,
     parser: vt100::Parser,
+    restored_screen: Option<RestoredScreenSnapshot>,
     clients: HashMap<[u8; 16], ClientState>,
     output_seq: u64,
     recent: VecDeque<Vec<u8>>,
@@ -383,6 +388,14 @@ struct Session {
     last_screen_persist_at: Instant,
 }
 
+#[derive(Clone)]
+struct RestoredScreenSnapshot {
+    cols: u16,
+    rows: u16,
+    output_seq: u64,
+    snapshot: Vec<u8>,
+}
+
 #[derive(Clone)]
 struct ClientState {
     endpoint: SocketAddr,
@@ -508,6 +521,7 @@ impl ServerState {
             Session {
                 pty,
                 parser: vt100::Parser::new(rows.max(1), cols.max(1), self.config.scrollback),
+                restored_screen: None,
                 clients: HashMap::new(),
                 output_seq: 0,
                 recent: VecDeque::with_capacity(self.config.scrollback),
@@ -637,15 +651,23 @@ impl ServerState {
                 .unwrap_or((80, 24));
             let mut parser = vt100::Parser::new(rows, cols, self.config.scrollback);
             let mut output_seq = 0;
+            let mut restored_screen = None;
             if let Some(saved) = saved {
                 parser.process(&saved.snapshot);
                 output_seq = saved.output_seq;
+                restored_screen = Some(RestoredScreenSnapshot {
+                    cols,
+                    rows,
+                    output_seq,
+                    snapshot: saved.snapshot,
+                });
             }
             self.sessions.insert(
                 name.clone(),
                 Session {
                     pty: Some(pty),
                     parser,
+                    restored_screen,
                     clients: HashMap::new(),
                     output_seq,
                     recent: VecDeque::with_capacity(self.config.scrollback),
@@ -758,6 +780,19 @@ fn apply_terminal_size(
     Ok(())
 }
 
+fn attach_snapshot(session: &Session, cols: u16, rows: u16) -> Vec<u8> {
+    let cols = cols.max(1);
+    let rows = rows.max(1);
+    if let Some(restored) = &session.restored_screen
+        && restored.output_seq == session.output_seq
+        && restored.cols == cols
+        && restored.rows == rows
+    {
+        return restored.snapshot.clone();
+    }
+    screen_snapshot(session.parser.screen())
+}
+
 fn mode_allows_terminal_updates(mode: &str) -> bool {
     mode != "view-only" && mode != "forward-only"
 }
@@ -1185,7 +1220,7 @@ async fn handle_native_user_auth(
                 apply_terminal_size(session.pty.as_ref(), &mut session.parser, cols, rows)?;
             }
             let client_id = crypto::random_16();
-            let snapshot = screen_snapshot(session.parser.screen());
+            let snapshot = attach_snapshot(session, cols, rows);
             let output_seq = session.output_seq;
             locked.insert_client(
                 &session_name,
@@ -1333,7 +1368,7 @@ async fn handle_bootstrap_attach(
                 )?;
             }
             let client_id = crypto::random_16();
-            let snapshot = screen_snapshot(session.parser.screen());
+            let snapshot = attach_snapshot(session, req.cols, req.rows);
             let output_seq = session.output_seq;
             let bootstrap_session = req.bootstrap.session.clone();
             locked.insert_client(
@@ -1469,7 +1504,7 @@ async fn handle_ticket_attach(
                 )?;
             }
             let client_id = crypto::random_16();
-            let snapshot = screen_snapshot(session.parser.screen());
+            let snapshot = attach_snapshot(session, req.cols, req.rows);
             let output_seq = session.output_seq;
             let ticket_session = req.session.clone();
             locked.insert_client(
@@ -1582,20 +1617,23 @@ async fn handle_resume(
             .sessions
             .get_mut(&req.session)
             .ok_or_else(|| anyhow!("unknown session"))?;
-        let client = session
+        let (send_seq, allow_terminal_updates) = {
-            .clients
+            let client = session
-            .get_mut(&packet.header.conn_id)
+                .clients
-            .ok_or_else(|| anyhow!("unknown client"))?;
+                .get_mut(&packet.header.conn_id)
-        if !client.replay.accept(packet.header.seq) {
+                .ok_or_else(|| anyhow!("unknown client"))?;
-            return Ok(());
+            if !client.replay.accept(packet.header.seq) {
-        }
+                return Ok(());
-        client.endpoint = peer;
+            }
-        client.last_acked = req.last_rendered_seq;
+            client.endpoint = peer;
-        client.cols = req.cols;
+            client.last_acked = req.last_rendered_seq;
-        client.rows = req.rows;
+            client.cols = req.cols;
-        client.last_seen = Instant::now();
+            client.rows = req.rows;
-        client.send_seq += 1;
+            client.last_seen = Instant::now();
-        if mode_allows_terminal_updates(&client.mode) {
+            client.send_seq += 1;
+            (client.send_seq, mode_allows_terminal_updates(&client.mode))
+        };
+        if allow_terminal_updates {
             apply_terminal_size(
                 session.pty.as_ref(),
                 &mut session.parser,
@@ -1603,8 +1641,8 @@ async fn handle_resume(
                 req.rows,
             )?;
         }
-        let snapshot = screen_snapshot(session.parser.screen());
+        let snapshot = attach_snapshot(session, req.cols, req.rows);
-        (client.send_seq, session.output_seq, snapshot)
+        (send_seq, session.output_seq, snapshot)
     };
     let frame = Frame {
         session: session_name,
@@ -1743,10 +1781,10 @@ async fn handle_detach(state: &Arc<Mutex<ServerState>>, packet: &protocol::Packe
     let (key, _) = find_client_decrypt_key(state, &packet.header)?;
     let _ = protocol::decrypt_body(packet, &key, CLIENT_TO_SERVER)?;
     let mut locked = state.lock().expect("server state poisoned");
-    if let Some(client) = locked.client_mut(&packet.header.conn_id) {
+    if let Some(client) = locked.client_mut(&packet.header.conn_id)
-        if !client.replay.accept(packet.header.seq) {
+        && !client.replay.accept(packet.header.seq)
-            return Ok(());
+    {
-        }
+        return Ok(());
     }
     locked.remove_client_everywhere(&packet.header.conn_id);
     Ok(())
@@ -2681,7 +2719,6 @@ async fn handle_file_request(
             let (file, temp_path, written, atomic) = if resume && final_path.exists() {
                 let mut file = fs::OpenOptions::new()
                     .read(true)
-                    .write(true)
                     .append(true)
                     .open(&final_path)
                     .with_context(|| format!("open {}", final_path.display()))?;
@@ -3451,6 +3488,7 @@ async fn broadcast_output(
             .get_mut(&output.session)
             .ok_or_else(|| anyhow!("unknown session"))?;
         session.parser.process(&output.bytes);
+        session.restored_screen = None;
         session.output_seq += 1;
         let output_seq = session.output_seq;
         session.recent.push_back(output.bytes.clone());
@@ -4046,6 +4084,34 @@ mod tests {
         assert_eq!(ServerConfig::default().client_timeout_secs, 2_592_000);
     }
 
+    #[test]
+    fn attach_snapshot_prefers_restored_screen_for_same_size_reattach() {
+        let restored = b"\x1b[?1049lRESTORED_SCREEN_MARKER".to_vec();
+        let mut session = Session {
+            pty: None,
+            parser: vt100::Parser::new(24, 80, 100),
+            restored_screen: Some(RestoredScreenSnapshot {
+                cols: 80,
+                rows: 24,
+                output_seq: 7,
+                snapshot: restored.clone(),
+            }),
+            clients: HashMap::new(),
+            output_seq: 7,
+            recent: VecDeque::new(),
+            empty_since: Some(Instant::now()),
+            holder_control: None,
+            persistent: true,
+            bytes_since_persist: 0,
+            last_persisted_seq: 7,
+            last_screen_persist_at: Instant::now(),
+        };
+
+        session.parser.set_size(24, 80);
+        assert_eq!(attach_snapshot(&session, 80, 24), restored);
+        assert_ne!(attach_snapshot(&session, 100, 30), restored);
+    }
+
     #[tokio::test]
     async fn unknown_resume_reject_keeps_client_id() {
         let (pty_tx, _rx) = mpsc::unbounded_channel();
@@ -4396,6 +4462,7 @@ mod tests {
             Session {
                 pty: None,
                 parser: vt100::Parser::new(24, 80, 100),
+                restored_screen: None,
                 clients: HashMap::from([(client_id, client)]),
                 output_seq: 0,
                 recent: VecDeque::new(),
@@ -4460,6 +4527,7 @@ mod tests {
             Session {
                 pty: None,
                 parser: vt100::Parser::new(24, 80, 100),
+                restored_screen: None,
                 clients: HashMap::from([(client_id, client)]),
                 output_seq: 0,
                 recent: VecDeque::new(),
@@ -4536,6 +4604,7 @@ mod tests {
             Session {
                 pty: None,
                 parser: vt100::Parser::new(24, 80, 100),
+                restored_screen: None,
                 clients: HashMap::from([(client_id, client)]),
                 output_seq: 0,
                 recent: VecDeque::new(),
@@ -4676,6 +4745,7 @@ mod tests {
             Session {
                 pty: None,
                 parser: vt100::Parser::new(24, 80, 100),
+                restored_screen: None,
                 clients: HashMap::from([(
                     client_id,
                     ClientState {
@@ -4773,6 +4843,7 @@ mod tests {
             Session {
                 pty: None,
                 parser: vt100::Parser::new(24, 80, 100),
+                restored_screen: None,
                 clients: HashMap::from([(
                     client_id,
                     ClientState {

src/client.rs

@@ -13,6 +13,7 @@ use crate::protocol::{
 };
 use crate::ssh_agent;
 use crate::transport::{DoshTransport, SessionRole, SessionTransportConfig, TransportConfig};
+use crate::udp::{recv_udp_retrying_transient, send_udp_retrying_transient};
 use anyhow::{Context, Result, anyhow, bail};
 use std::net::{SocketAddr, ToSocketAddrs};
 use std::path::PathBuf;
@@ -214,10 +215,10 @@ impl DoshClientBuilder {
                 hello: hello.clone(),
             })?,
         )?;
-        socket.send_to(&packet, peer_addr).await?;
+        send_udp_retrying_transient(&socket, &packet, peer_addr, timeout).await?;
 
         let mut buf = vec![0u8; 65535];
-        let (n, _) = tokio::time::timeout(timeout, socket.recv_from(&mut buf)).await??;
+        let (n, _) = recv_udp_retrying_transient(&socket, &mut buf, timeout).await?;
         let packet = protocol::decode(&buf[..n])?;
         if packet.header.kind != PacketKind::NativeServerHello {
             if packet.header.kind == PacketKind::AttachReject {
@@ -261,8 +262,8 @@ impl DoshClientBuilder {
             CLIENT_TO_SERVER,
             &protocol::to_body(&NativeUserAuthBody { auth })?,
         )?;
-        socket.send_to(&auth_packet, peer_addr).await?;
+        send_udp_retrying_transient(&socket, &auth_packet, peer_addr, timeout).await?;
-        let (n, _) = tokio::time::timeout(timeout, socket.recv_from(&mut buf)).await??;
+        let (n, _) = recv_udp_retrying_transient(&socket, &mut buf, timeout).await?;
         let packet = protocol::decode(&buf[..n])?;
         if packet.header.kind != PacketKind::NativeAuthOk {
             if packet.header.kind == PacketKind::AttachReject {

src/config.rs

@@ -150,6 +150,12 @@ pub struct ClientConfig {
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]
 pub struct HostConfig {
     pub ssh: Option<String>,
+    /// Optional OpenSSH config host name to use for SSH-backed bootstrap,
+    /// trust/setup/doctor checks, and native-auth identity selection. This lets
+    /// a Dosh host keep a separate UDP endpoint while still inheriting
+    /// alias-scoped OpenSSH settings like IdentityFile, ProxyJump, and SendEnv.
+    #[serde(default)]
+    pub ssh_config: Option<String>,
     pub user: Option<String>,
     pub dosh_host: Option<String>,
     pub port: Option<u16>,

src/persist.rs

@@ -23,12 +23,14 @@ use std::io::{Read, Write};
 use std::os::fd::{AsRawFd, FromRawFd, IntoRawFd, RawFd};
 use std::os::unix::net::{UnixListener, UnixStream};
 use std::path::{Path, PathBuf};
+use std::sync::Mutex;
 use std::time::Duration;
 
 /// One-byte commands a server sends to a holder over its control socket after
 /// the holder has handed back the master fd.
 const HOLDER_CMD_SHUTDOWN: u8 = b'X';
 const HOLDER_STARTUP_TIMEOUT: Duration = Duration::from_millis(750);
+static SCREEN_WRITE_LOCK: Mutex<()> = Mutex::new(());
 
 /// Magic written into a holder's `meta` file, bumped if the on-disk layout
 /// changes so a stale holder from an incompatible build is ignored.
@@ -140,13 +142,28 @@ pub fn save_screen(
         // No holder runtime for this session (non-persistent): nothing to do.
         return Ok(());
     }
+    let _guard = SCREEN_WRITE_LOCK
+        .lock()
+        .map_err(|_| anyhow!("screen persistence lock poisoned"))?;
+    let path = screen_path(&dir);
+    if existing_screen_output_seq(&path).is_some_and(|existing| existing >= output_seq) {
+        return Ok(());
+    }
     let mut buf = Vec::with_capacity(snapshot.len() + 32);
     buf.extend_from_slice(&cols.to_be_bytes());
     buf.extend_from_slice(&rows.to_be_bytes());
     buf.extend_from_slice(&output_seq.to_be_bytes());
     buf.extend_from_slice(&(snapshot.len() as u32).to_be_bytes());
     buf.extend_from_slice(snapshot);
-    atomic_write(&screen_path(&dir), &buf)
+    atomic_write(&path, &buf)
+}
+
+fn existing_screen_output_seq(path: &Path) -> Option<u64> {
+    let data = std::fs::read(path).ok()?;
+    if data.len() < 12 {
+        return None;
+    }
+    Some(u64::from_be_bytes(data[4..12].try_into().ok()?))
 }
 
 /// A restored screen for a re-adopted session.
@@ -619,6 +636,20 @@ mod tests {
         assert_eq!(loaded.snapshot, snap);
     }
 
+    #[test]
+    fn save_screen_never_overwrites_newer_snapshot_with_older_seq() {
+        let tmp = tempfile::tempdir().unwrap();
+        let sessions_dir = tmp.path();
+        ensure_runtime_dir(sessions_dir, "work").unwrap();
+
+        save_screen(sessions_dir, "work", 80, 24, 10, b"new-screen").unwrap();
+        save_screen(sessions_dir, "work", 80, 24, 9, b"old-screen").unwrap();
+
+        let loaded = load_screen(sessions_dir, "work").expect("screen restored");
+        assert_eq!(loaded.output_seq, 10);
+        assert_eq!(loaded.snapshot, b"new-screen");
+    }
+
     #[test]
     fn load_screen_absent_is_none() {
         let tmp = tempfile::tempdir().unwrap();

src/server.rs

@@ -13,7 +13,7 @@ use crate::transport::{
     DoshTransport, SessionEvent, SessionRole, SessionTransportConfig, TransportConfig,
     service_name_from_target,
 };
-use crate::udp::is_transient_udp_send_error;
+use crate::udp::{is_transient_udp_error, is_transient_udp_send_error};
 use anyhow::{Context, Result, anyhow, bail};
 use ed25519_dalek::SigningKey;
 use std::collections::{HashMap, HashSet};
@@ -169,7 +169,11 @@ impl DoshServer {
         let mut buf = vec![0u8; 65535];
         loop {
             self.expire_pending();
-            let (n, peer) = self.socket.recv_from(&mut buf).await?;
+            let (n, peer) = match self.socket.recv_from(&mut buf).await {
+                Ok(value) => value,
+                Err(err) if is_transient_udp_error(&err) => continue,
+                Err(err) => return Err(err.into()),
+            };
             let packet = match protocol::decode(&buf[..n]) {
                 Ok(packet) => packet,
                 Err(_) => continue,

src/transport.rs

@@ -19,7 +19,7 @@ use crate::protocol::{
     self, CLIENT_TO_SERVER, PacketKind, ReplayWindow, SERVER_TO_CLIENT, StreamClose, StreamData,
     StreamOpen, StreamOpenOk, StreamOpenReject, StreamWindowAdjust,
 };
-use crate::udp::is_transient_udp_send_error;
+use crate::udp::{is_transient_udp_error, is_transient_udp_send_error};
 use anyhow::{Result, anyhow, bail};
 use std::collections::{BTreeMap, HashMap, HashSet, VecDeque};
 use std::net::SocketAddr;
@@ -852,7 +852,11 @@ impl DoshTransport {
     pub async fn recv(&mut self) -> Result<SessionEvent> {
         let mut buf = vec![0u8; 65535];
         loop {
-            let (n, peer) = self.socket.recv_from(&mut buf).await?;
+            let (n, peer) = match self.socket.recv_from(&mut buf).await {
+                Ok(value) => value,
+                Err(err) if transport_recv_error_is_retryable(&err) => continue,
+                Err(err) => return Err(err.into()),
+            };
             let packet = match protocol::decode(&buf[..n]) {
                 Ok(packet) => packet,
                 Err(_) => continue,
@@ -984,6 +988,10 @@ impl DoshTransport {
     }
 }
 
+fn transport_recv_error_is_retryable(err: &std::io::Error) -> bool {
+    is_transient_udp_error(err)
+}
+
 fn initial_stream_id(role: SessionRole) -> u64 {
     match role {
         SessionRole::Client => 1,
@@ -1033,6 +1041,35 @@ mod tests {
         assert!(service_target("../bad").is_err());
     }
 
+    #[test]
+    fn transport_recv_retries_network_churn_errors() {
+        for kind in [
+            std::io::ErrorKind::Interrupted,
+            std::io::ErrorKind::TimedOut,
+            std::io::ErrorKind::WouldBlock,
+        ] {
+            let err = std::io::Error::from(kind);
+            assert!(transport_recv_error_is_retryable(&err));
+        }
+        assert!(!transport_recv_error_is_retryable(&std::io::Error::from(
+            std::io::ErrorKind::PermissionDenied,
+        )));
+
+        #[cfg(unix)]
+        for code in [libc::ENETUNREACH, libc::EHOSTUNREACH, libc::ECONNRESET] {
+            assert!(transport_recv_error_is_retryable(
+                &std::io::Error::from_raw_os_error(code)
+            ));
+        }
+
+        #[cfg(windows)]
+        for code in [10051, 10054, 10065] {
+            assert!(transport_recv_error_is_retryable(
+                &std::io::Error::from_raw_os_error(code)
+            ));
+        }
+    }
+
     #[test]
     fn service_registry_matches_registered_service_opens() {
         let mut registry = ServiceRegistry::new();

src/udp.rs

@@ -1,6 +1,10 @@
 //! UDP error classification shared by Dosh clients, servers, and embedders.
 
-pub fn is_transient_udp_send_error(err: &std::io::Error) -> bool {
+use std::net::SocketAddr;
+use std::time::{Duration, Instant};
+use tokio::net::UdpSocket;
+
+pub fn is_transient_udp_error(err: &std::io::Error) -> bool {
     matches!(
         err.kind(),
         std::io::ErrorKind::Interrupted
@@ -9,6 +13,58 @@ pub fn is_transient_udp_send_error(err: &std::io::Error) -> bool {
     ) || err.raw_os_error().is_some_and(is_transient_udp_os_error)
 }
 
+pub fn is_transient_udp_send_error(err: &std::io::Error) -> bool {
+    is_transient_udp_error(err)
+}
+
+pub async fn send_udp_retrying_transient(
+    socket: &UdpSocket,
+    packet: &[u8],
+    peer: SocketAddr,
+    wait: Duration,
+) -> std::io::Result<()> {
+    let deadline = Instant::now() + wait.max(Duration::from_millis(1));
+    loop {
+        match socket.send_to(packet, peer).await {
+            Ok(_) => return Ok(()),
+            Err(err) if is_transient_udp_send_error(&err) && Instant::now() < deadline => {
+                sleep_until_retry(deadline).await;
+            }
+            Err(err) => return Err(err),
+        }
+    }
+}
+
+pub async fn recv_udp_retrying_transient(
+    socket: &UdpSocket,
+    buf: &mut [u8],
+    wait: Duration,
+) -> std::io::Result<(usize, SocketAddr)> {
+    let deadline = Instant::now() + wait.max(Duration::from_millis(1));
+    loop {
+        let now = Instant::now();
+        if now >= deadline {
+            return Err(std::io::Error::from(std::io::ErrorKind::TimedOut));
+        }
+        match tokio::time::timeout(deadline - now, socket.recv_from(buf)).await {
+            Ok(Ok(value)) => return Ok(value),
+            Ok(Err(err)) if is_transient_udp_error(&err) && Instant::now() < deadline => {
+                sleep_until_retry(deadline).await;
+            }
+            Ok(Err(err)) => return Err(err),
+            Err(_) => return Err(std::io::Error::from(std::io::ErrorKind::TimedOut)),
+        }
+    }
+}
+
+async fn sleep_until_retry(deadline: Instant) {
+    let now = Instant::now();
+    if now >= deadline {
+        return;
+    }
+    tokio::time::sleep((deadline - now).min(Duration::from_millis(20))).await;
+}
+
 #[cfg(unix)]
 fn is_transient_udp_os_error(code: i32) -> bool {
     matches!(
@@ -48,20 +104,56 @@ fn is_transient_udp_os_error(_code: i32) -> bool {
 
 #[cfg(test)]
 mod tests {
-    use super::is_transient_udp_send_error;
+    use super::{
+        is_transient_udp_error, is_transient_udp_send_error, recv_udp_retrying_transient,
+        send_udp_retrying_transient,
+    };
+    use std::time::Duration;
+    use tokio::net::UdpSocket;
 
     #[test]
-    fn classifies_portable_transient_send_errors() {
+    fn classifies_portable_transient_udp_errors() {
         for kind in [
             std::io::ErrorKind::Interrupted,
             std::io::ErrorKind::TimedOut,
             std::io::ErrorKind::WouldBlock,
         ] {
-            assert!(is_transient_udp_send_error(&std::io::Error::from(kind)));
+            let err = std::io::Error::from(kind);
+            assert!(is_transient_udp_error(&err));
+            assert!(is_transient_udp_send_error(&err));
         }
-        assert!(!is_transient_udp_send_error(&std::io::Error::from(
+        let fatal = std::io::Error::from(std::io::ErrorKind::PermissionDenied);
-            std::io::ErrorKind::PermissionDenied,
+        assert!(!is_transient_udp_error(&fatal));
-        )));
+        assert!(!is_transient_udp_send_error(&fatal));
+    }
+
+    #[tokio::test]
+    async fn retrying_udp_send_and_receive_round_trip() {
+        let receiver = UdpSocket::bind("127.0.0.1:0").await.unwrap();
+        let sender = UdpSocket::bind("127.0.0.1:0").await.unwrap();
+        let addr = receiver.local_addr().unwrap();
+
+        send_udp_retrying_transient(&sender, b"hello", addr, Duration::from_millis(50))
+            .await
+            .unwrap();
+        let mut buf = [0u8; 16];
+        let (n, peer) = recv_udp_retrying_transient(&receiver, &mut buf, Duration::from_millis(50))
+            .await
+            .unwrap();
+
+        assert_eq!(&buf[..n], b"hello");
+        assert_eq!(peer, sender.local_addr().unwrap());
+    }
+
+    #[tokio::test]
+    async fn retrying_udp_receive_times_out_cleanly() {
+        let receiver = UdpSocket::bind("127.0.0.1:0").await.unwrap();
+        let mut buf = [0u8; 16];
+        let err = recv_udp_retrying_transient(&receiver, &mut buf, Duration::from_millis(1))
+            .await
+            .unwrap_err();
+
+        assert_eq!(err.kind(), std::io::ErrorKind::TimedOut);
     }
 
     #[cfg(unix)]
@@ -78,9 +170,9 @@ mod tests {
             libc::ENETUNREACH,
             libc::ETIMEDOUT,
         ] {
-            assert!(is_transient_udp_send_error(
+            let err = std::io::Error::from_raw_os_error(code);
-                &std::io::Error::from_raw_os_error(code)
+            assert!(is_transient_udp_error(&err));
-            ));
+            assert!(is_transient_udp_send_error(&err));
         }
     }
 
@@ -90,9 +182,9 @@ mod tests {
         for code in [
             10049, 10050, 10051, 10052, 10054, 10060, 10061, 10064, 10065,
         ] {
-            assert!(is_transient_udp_send_error(
+            let err = std::io::Error::from_raw_os_error(code);
-                &std::io::Error::from_raw_os_error(code)
+            assert!(is_transient_udp_error(&err));
-            ));
+            assert!(is_transient_udp_send_error(&err));
         }
     }
 }

tests/integration_smoke.rs

@@ -6,6 +6,7 @@ use std::net::{TcpListener, TcpStream, UdpSocket};
 use std::os::unix::net::{UnixListener, UnixStream};
 use std::path::{Path, PathBuf};
 use std::process::{Child, Command, Stdio};
+use std::sync::atomic::{AtomicU32, Ordering};
 use std::sync::mpsc;
 use std::thread;
 use std::time::Duration;
@@ -23,14 +24,35 @@ use dosh::protocol::{
 };
 use ed25519_dalek::{Signer, SigningKey, VerifyingKey};
 
+const TEST_PORT_START: u16 = 30_000;
+const TEST_PORT_END: u16 = 60_999;
+static NEXT_UDP_PORT: AtomicU32 = AtomicU32::new(TEST_PORT_START as u32);
+static NEXT_TCP_PORT: AtomicU32 = AtomicU32::new(TEST_PORT_START as u32);
+
+fn next_test_port(counter: &AtomicU32) -> u16 {
+    let span = u32::from(TEST_PORT_END - TEST_PORT_START) + 1;
+    let offset = counter.fetch_add(1, Ordering::SeqCst) % span;
+    TEST_PORT_START + offset as u16
+}
+
 fn free_udp_port() -> u16 {
-    let socket = UdpSocket::bind("127.0.0.1:0").unwrap();
+    for _ in TEST_PORT_START..=TEST_PORT_END {
-    socket.local_addr().unwrap().port()
+        let port = next_test_port(&NEXT_UDP_PORT);
+        if UdpSocket::bind(("127.0.0.1", port)).is_ok() {
+            return port;
+        }
+    }
+    panic!("no free UDP test port in {TEST_PORT_START}-{TEST_PORT_END}");
 }
 
 fn free_tcp_port() -> u16 {
-    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
+    for _ in TEST_PORT_START..=TEST_PORT_END {
-    listener.local_addr().unwrap().port()
+        let port = next_test_port(&NEXT_TCP_PORT);
+        if TcpListener::bind(("127.0.0.1", port)).is_ok() {
+            return port;
+        }
+    }
+    panic!("no free TCP test port in {TEST_PORT_START}-{TEST_PORT_END}");
 }
 
 fn write_server_config(dir: &tempfile::TempDir, port: u16) -> std::path::PathBuf {

tests/release_scripts.rs

@@ -19,6 +19,46 @@ fn release_scripts_skip_stale_artifacts_when_auto_discovering() {
     assert!(publish.contains("actual=\"$(artifact_version \"$artifact\" || true)\""));
 }
 
+#[test]
+fn package_check_verifies_only_artifacts_it_builds() {
+    let makefile = include_str!("../Makefile");
+    let verify = include_str!("../scripts/verify-release-artifacts.sh");
+    assert!(
+        verify.contains("if [ \"$#\" -gt 0 ]; then"),
+        "release verifier must accept an explicit artifact list"
+    );
+    let package_check = makefile
+        .split("package-check:")
+        .nth(1)
+        .and_then(|tail| tail.split("\ninstall:").next())
+        .expect("package-check target");
+    assert!(package_check.contains("package-release-linux"));
+    assert!(package_check.contains("package-release-windows"));
+    assert!(package_check.contains("dosh-linux-x86_64.tar.gz"));
+    assert!(package_check.contains("dosh-windows-x86_64.zip"));
+    assert!(
+        !package_check.contains("dosh-macos-aarch64.tar.gz"),
+        "Linux package-check does not build macOS artifacts, so it must not depend on one"
+    );
+}
+
+#[test]
+fn package_release_stamps_git_build_info() {
+    let package = include_str!("../scripts/package-release.sh");
+    let build = include_str!("../build.rs");
+    for name in [
+        "DOSH_BUILD_GIT_HASH",
+        "DOSH_BUILD_COMMIT_DATE",
+        "DOSH_BUILD_GIT_DIRTY",
+    ] {
+        assert!(package.contains(name), "package script must export {name}");
+        assert!(build.contains(name), "build.rs must consume {name}");
+    }
+    assert!(package.contains("git rev-parse --short=12 HEAD"));
+    assert!(package.contains("git show -s --format=%cs HEAD"));
+    assert!(build.contains("cargo:rerun-if-env-changed=DOSH_BUILD_GIT_HASH"));
+}
+
 #[test]
 fn systemd_service_does_not_sandbox_remote_shells() {
     let service = include_str!("../packaging/systemd/dosh-server.service");