v0.12.2 — web terminal

/sessions/:id is a real terminal now. It used to be a <div> fed by a hand-rolled ANSI translator that kept colour and dropped every other escape, so spinners, progress lines and anything the pit redrew in place either vanished or stacked up as duplicate text. It runs xterm.js over the raw stream instead — the bytes were always there, only the renderer was throwing them away.

• the CLI reports its tty size on register, on every flush and on resize; the page runs at exactly that geometry, so output no longer wraps at the wrong column
• selection and copy work
• typing anywhere on the terminal reaches the prompt; commands sent from the web are reported beside it rather than injected into the stream
• no size is sent when there is no tty to measure (piped runs, CI), and the page falls back to filling its box

Also in this release, since v0.12.1:

the pit — the Moshpit namespace lands on app.moshcode.sh: claim a TLD, register names under it, and reach it from the nav (#113, #117)

mirror — engine and tool output is captured through a real pseudo-terminal via script(1), so an engine that takes the terminal is finally visible in the mirror (#92); a split multi-byte character no longer corrupts the stream (#99); engine-only updates are sent (#109); the mirror subscribes before replaying its scrollback, so a chunk committed mid-read can't fall in the gap (#90)

console — a browser terminal on this box, gated by moshcode login (#93), with IPv6 ttyd targets (#111) and a malformed cookie no longer killing the gateway (#96)

tools — railway, gh, supabase, doppler, doctl, tailscale (#89) and the Turso CLI (#94); upgrade installs a missing target instead of running its updater (#112)

mcp — a known-server catalog, starting with Porkbun (#95)

sessions & approvals — command acknowledgements and the long-poll window are validated (#107, #115); device approvals are atomic (#98); approvals preserve the first resolution (#101); the sessions page shows the current credit balance (#103); SMS without a target is rejected (#105); a duplicate passkey registration no longer strands an account (#91)