moshcode 0.98.4 — scoped live-session MCP

Connect a live Moshcode session to a remote MCP client with /mcp answer (/mcp share is an alias). The CLI can now authenticate and establish or retry its live connection without restarting the pit. /mcp connect reconnects under the newly authenticated account.

Shares default to read-only. Request write, approval, or cancellation explicitly with --scope; the terminal shows granted permissions. Browser OAuth uses PKCE and the exact share resource, refresh tokens rotate, and revocation cancels undelivered input. Client setup and permission boundaries are documented in the README.

Includes the server work for #497 and its independently reviewed authorization, replay, scope and queue revocation coverage. Combined validation: 3,163 passing tests, four existing skips; 739 PWA tests and 16 independent security checks pass. The public endpoint is supplied by moshcoder/moshcoding#118.

Chovy 2.2.0 now includes a native connector: Settings → Moshcode → paste the share URL → Check permissions → Authorize with Moshcode. Read access is selected by default. Production desktop and mobile OAuth, scoped read and controls, rotating refresh and disconnect passed with a disposable session; independent checks confirmed revocation and complete fixture cleanup. Hosted ChatGPT/Claude account flows remain dependent on their account and workspace policies and were not tested through signed-in hosted accounts.