feat(mirror): capture engine and tool output via a pty

[ralyodio]

The session page showed the pit's own output and nothing else — "it only prints sometimes."

Why

teeOutput() patches process.stdout/stderr, but children are spawned like this:

// src/engines.mjs
child = spawn(spec.cmd, spec.args, { stdio: "inherit", env });

inherit hands the child the tty's own file descriptors, so its bytes never pass
through this process. Result: you get the banner, prompts, /help, and hand-off
notices — and nothing from claude, opencode, gh, or ugig. Not intermittent;
exactly and always. mirror.mjs documented it as a known limitation.

The transport was never the problem: apps/pwa already streams over SSE with
reconnect.

Why script(1)

• A pipe won't do. Every one of these programs checks isTTY and drops colour,
  prompts, and full-screen UI when it sees one.
• node-pty won't do. Native module; moshcode installs by untarring a release and
  running node (install.sh) — no compiler in that path.
• script(1) allocates the same real pseudo-terminal using only the base system.

Verified end to end

Ran a probe child through the new path:

HELLO-FROM-CHILD
isTTY=true          ← child still sees a real terminal
ok: true code: 23   ← exit status still propagates
captured: "HELLO-FROM-CHILD\r\nisTTY=true\r\n"

Blast radius

Capture engages only when a mirror is attached. No mirror → the untouched
inherit path, byte for byte what ships today. No usable script(1), or
MOSHCODE_MIRROR_PTY=0 → same fallback. util-linux and BSD flag sets are both
handled and pinned by tests; anything unrecognised falls back rather than guessing.

script -q silences its "Script started/done" notices on the terminal but still
writes them to the transcript, so those are stripped — anchored to start/end so
child output containing those words survives.

Tests

12 new in test/pty.test.mjs (both flavours' argv, shQuote injection safety,
banner stripping, follower streaming + tail drain). Full suite: 325 tests, 247
pass, 0 fail, 78 pre-existing skips.

Not in this PR

The page renders SGR colour only — sessions.mjs:352 drops every non-SGR escape. So
a full-screen TUI now arrives but won't render. Making the session page a real
terminal (arrow keys, history, cursor addressing) needs xterm.js plus raw keystroke
relay into the pty. That's the follow-up.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.