fix(auth): raise default session TTL from 2 h to 7 d

CHANGELOG.md

@@ -9,6 +9,25 @@ Each entry starts with a **plain-language summary** (what changed, in
 everyday words) before any technical detail — written so someone outside
 engineering can understand what shipped and why it matters.
 
+## [0.8.6] - 2026-08-31
+
+**In plain terms:** the refresh-token session lifetime now defaults to
+**7 days** instead of 2 hours. Combined with the v0.7.10 access-token
+auto-refresh, operators can leave for a long weekend and still be
+logged in when they come back.
+
+### Changed
+
+- **`DELTIX_SESSION_TTL_SECONDS` default raised from 120 (2 h) to
+  604800 (7 d).** This is the sliding-window inactivity window for the
+  refresh token. Every `/refresh` call (which the CLI does every time
+  it needs an access token) slides the window out to 7 days from that
+  point, so an active operator effectively stays logged in forever.
+  Inactive operators still get booted after 7 days, which matches the
+  realistic security-vs-convenience tradeoff for a CLI tool.
+  Override via the env var to dial it back for higher-security
+  installations.
+
 ## [0.8.5] - 2026-08-31
 
 **In plain terms:** `deltix push` no longer crashes the server when the

package.json

@@ -1,6 +1,6 @@
 {
   "name": "deltix-server",
-  "version": "0.8.5",
+  "version": "0.8.6",
   "private": true,
   "license": "BUSL-1.1",
   "type": "module",

src/shared/env.ts

@@ -48,7 +48,18 @@ const envSchema = z
     DELTIX_BOOTSTRAP_ADMIN_PASSWORD: z.string().min(1).optional(),
     DELTIX_SESSION_DB_PATH: z.string().min(1, 'DELTIX_SESSION_DB_PATH is required'),
     DELTIX_ACCESS_TOKEN_TTL_SECONDS: z.coerce.number().int().positive().default(900),
-    DELTIX_SESSION_TTL_SECONDS: z.coerce.number().int().positive().default(120),
+    DELTIX_SESSION_TTL_SECONDS: z.coerce
+      .number()
+      .int()
+      .positive()
+      // Sliding-window session lifetime in seconds. With the default 15-minute
+      // access-token TTL the CLI auto-refreshes tokens every call (see v0.7.10),
+      // so the refresh-token session only needs to stay alive as long as the
+      // operator wants to keep their login. 7 days covers a long weekend; the
+      // window slides on every keepAlive so active operators never lose
+      // session, and any /refresh call extends it back out to 7 days from
+      // that point. Set lower for higher-security environments.
+      .default(7 * 24 * 60 * 60),
     DELTIX_CORS_ALLOWED_ORIGINS: z
       .string()
       .default('')