@intentic/sandbox-contract 1.316.0 → 1.318.0

package/src/schemas/context-trim.ts

@@ -1,5 +1,6 @@
 // context-trim: what a window too small for a full turn made the sandbox leave out
 import { z } from "zod";
+import type { SandboxNotice } from "../events/sandbox-notice.js";
 
 // The only disclosure of a note that never rode; without it a turn runs thinner and nothing on screen says why.
 export const ContextTrimSchema = z.object({
@@ -18,12 +19,16 @@ export type ContextTrim = z.infer<typeof ContextTrimSchema>;
 // 16k, 32k; a server's own odd number spelled out in full.
 const windowLabel = (tokens: number): string => (tokens % 1024 === 0 ? `${tokens / 1024}k` : tokens.toLocaleString("en-US"));
 
+/** The trim's notice by code and facts, for a reader that words it in its own language. */
+export const contextTrimNotice = ({ window, omitted, base }: ContextTrim): Extract<SandboxNotice, { code: "contextTrim" }> => ({
+    code: "contextTrim",
+    params: { window: windowLabel(window), ...(omitted.length === 0 ? {} : { omitted: omitted.join(`, `) }), base },
+});
+
 // The closing clause is load-bearing: without it the row reads as "my AGENTS.md may not have arrived".
-export const contextTrimLine = ({ window, omitted, base }: ContextTrim): string => {
+export const contextTrimLine = (trim: ContextTrim): string => {
+    const { window, omitted, base } = contextTrimNotice(trim).params;
     const swapped = base ? ` The agent's own base instructions were swapped for a short paragraph, too.` : ``;
-    const left = omitted.length === 0 ? `` : ` — left out: ${omitted.join(`, `)}`;
-    return (
-        `Sent thin for this model's ${windowLabel(window)} window${left}.${swapped}` +
-        ` Your workspace rules, this turn's persona and where its files live still rode.`
-    );
+    const left = omitted === undefined ? `` : ` — left out: ${omitted}`;
+    return `Sent thin for this model's ${window} window${left}.${swapped}` + ` Your workspace rules, this turn's persona and where its files live still rode.`;
 };

package/src/schemas/devices.ts

@@ -1,6 +1,7 @@
 // What one of the user's own machines is running.
 import { z } from "zod";
 import { parseHostConnection, type DeviceFacts, DeviceFactsSchema, MachineIdSchema, userDistrosOf, WslEnvironmentSchema } from "./hosts.js";
+import { RollbackTargetSchema, UpdateOutcomeSchema } from "./updates.js";
 import { DEV_VERSION } from "../state/versions.js";
 // Desktop-sync report shape shared by the agent, daemon and browser, produced only by the agent's own `deviceReport`.
 // The agent never reports `sandboxes`; the docker half is filled in by whoever reads the report, scoped to the reader's
@@ -76,6 +77,19 @@ export const DeviceSandboxSchema = z.object({
     resources: SandboxResourcesSchema.optional(),
     // The update `ic sandbox prepare` built and left waiting for this sandbox; absent when nothing is staged.
     staged: z.object({ image: z.string(), version: z.string().optional(), channel: z.string().optional() }).optional(),
+    // Everything below is read off an `ic` new enough to know it; an older ic's listing simply lacks it.
+    // What the running image says it is.
+    version: z.string().optional(),
+    // An interrupted swap left the old container set aside with no replacement: the sandbox is down, and `start` (or
+    // any swap) puts it back. `running` is false while this is true.
+    parked: z.boolean().optional(),
+    // A swap has just happened and the previous version is still parked and ready: until this moment the host watches
+    // the new one and goes back by itself if it keeps crashing, never becomes ready, or loses its tunnel.
+    probationUntil: z.number().optional(),
+    // What the host last did about this sandbox's version (the same record the sandbox reads as `lastUpdate`).
+    lastUpdate: UpdateOutcomeSchema.optional(),
+    // Newest first: what `rollback` would return to, then the older versions kept on this machine for `rollback --to`.
+    rollbackTargets: z.array(RollbackTargetSchema).optional(),
 });
 export type DeviceSandbox = z.infer<typeof DeviceSandboxSchema>;
 // One operation on one sandbox, streamed as lines ending in a `result` or `error` frame. `prepare` builds the pending
@@ -118,6 +132,9 @@ export const DeviceSandboxFlowSchema = z.strictObject({
     slug: z.string().min(1),
     // Approved overlay's sha256, required only by `rebuild`; only content matching it is ever built.
     hash: z.string().optional(),
+    // `rollback` only: a version or pinned image from the sandbox's `rollbackTargets` to go back to instead of the
+    // previous one. Sent only to an agent that advertises `rollback-to`: an older one refuses the field.
+    to: z.string().min(1).optional(),
     // `set-shape` only, both required by it: the whole shape, and when it takes effect.
     // Strict too, unlike the same shape read off a report (where a newer ic's extra field must not fail an older
     // reader): an order carrying a field this agent does not know is refused rather than carried out without it.
@@ -161,8 +178,10 @@ export const icShapeArgs = (slug: string, fields: SandboxShapeFields, when: Sand
 export const icForgetShapeArgs = (slug: string): string[] => ["sandbox", "shape", slug, "--forget"];
 // Power goes through ic too, so a Start or Restart from any door applies the shape saved for the next restart.
 export const icPowerArgs = (op: "start" | "stop" | "restart", slug: string): string[] => ["sandbox", op, slug];
-// Adds the device id to the flow input; the daemon looks up machines by id.
-export const DeviceSandboxFlowInputSchema = DeviceSandboxFlowSchema.extend({ id: z.string().min(1) });
+// Adds the device id to the flow input; the daemon looks up machines by id. `resumeTurns` is the owner saying, as they
+// restart the sandbox relaying this, that the turns it cuts should run again once it is back; the daemon keeps it for
+// its next boot and never forwards it to the machine. A sandbox older than it ignores it, and the cut turns wait.
+export const DeviceSandboxFlowInputSchema = DeviceSandboxFlowSchema.extend({ id: z.string().min(1), resumeTurns: z.boolean().optional() });
 export type DeviceSandboxFlowInput = z.infer<typeof DeviceSandboxFlowInputSchema>;
 // Streamed operation output, matching `IntenticLineSchema`: `line` frames as printed, then one terminal frame, `result`
 // or `error`, carrying the machine's own message rather than a code.
@@ -357,6 +376,9 @@ export const DevicePairingSchema = z.object({
     mode: z.enum(["sync", "mirror"]),
     // Set only for mode "sync", and only for the sandbox being reported to.
     localDir: z.string().optional(),
+    // Which sandbox folder `localDir` holds when it is not /work itself: a project pairing's `/work/<name>`, the
+    // owner's own folder, which carries no state backup and no git bridge. Absent means /work.
+    remoteDir: z.string().optional(),
     // Machine-owned switch (agent's own `sync mirror off`); absent reads as "on", not merely unknown.
     mirroring: z.enum(["on", "off"]).optional(),
     // Mutagen's own status word, kept verbatim rather than reduced to a traffic light.
@@ -495,6 +517,37 @@ export const DeviceSyncSchema = z.object({
     environment: z.string().optional(),
 });
 export type DeviceSync = z.infer<typeof DeviceSyncSchema>;
+
+// A public host key as a machine pins it in known_hosts: its type and base64 body, no comment and nothing after.
+export const SshHostKeySchema = z
+    .string()
+    .regex(/^(?:ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp(?:256|384|521)|sk-ssh-ed25519@openssh\.com|sk-ecdsa-sha2-nistp256@openssh\.com) [A-Za-z0-9+/]+={0,2}$/);
+
+// POST /system/authorized-key: a machine's agent enrolling its SSH key for desktop sync, redeeming a pairing token.
+// Every field past `key` is optional: an older agent sends none of them and is still enrolled.
+export const SyncEnrollmentRequestSchema = z.object({
+    // One authorized_keys line; its comment is the name the enrollment goes by (`DeviceSync.machine`).
+    key: z.string(),
+    // The computer and the environment on it that are enrolling, so the enrollment joins that machine's card.
+    machineId: MachineIdSchema.optional(),
+    environment: z.string().min(1).optional(),
+});
+export type SyncEnrollmentRequest = z.infer<typeof SyncEnrollmentRequestSchema>;
+
+// The daemon's answer to an enrollment. Every field is optional for the agent reading it, since each arrived in a later
+// daemon than the route: without `syncToken` the agent refuses the enrollment, without `mode` it reads "sync", and
+// without `hostKey` it falls back to recording whatever key the sandbox presents first.
+export const SyncEnrollmentAnswerSchema = z.object({
+    ok: z.literal(true).optional(),
+    // Authorizes the ports poll, the machine report and the SSH transport, sent as `x-intentic-sync`.
+    syncToken: z.string().optional(),
+    // What the pairing granted: a member's pairing only ever enrolls "mirror".
+    mode: z.enum(["sync", "mirror"]).optional(),
+    // The public key the sandbox's sshd presents (an SshHostKeySchema line), for the agent to pin under the pairing's
+    // alias. Checked by the agent on its own, so a key it cannot read costs the pin, never the enrollment.
+    hostKey: z.string().optional(),
+});
+export type SyncEnrollmentAnswer = z.infer<typeof SyncEnrollmentAnswerSchema>;
 export const DeviceSchema = z.object({
     // Stable row key: the reported hostname when either door produced one, else the name that door knows it by.
     key: z.string(),

package/src/schemas/environment.ts

@@ -40,10 +40,17 @@ export const RuntimeInstallSchema = z.object({
     declinedAt: z.number().optional(),
 });
 export type RuntimeInstall = z.infer<typeof RuntimeInstallSchema>;
+// A draft the owner already answered (approved, removed or declined), by its tool and the hash of its steps: the same
+// file coming back with an agent's land, which still carries it on its branch, proposes nothing. An agent asking again
+// (`environment propose`) clears its tool's entries.
+export const SettledDraftSchema = z.object({ tool: z.string(), hash: z.string(), at: z.number() });
+export type SettledDraft = z.infer<typeof SettledDraftSchema>;
 export const RuntimeInstallsFileSchema = z.object({
     installs: z.array(RuntimeInstallSchema),
     // The last drift snapshot, persisted so a daemon restart does not blank the card until the next sweep.
     drift: EnvironmentDriftSchema.optional(),
+    // Drafts already answered, newest last and capped; absent on a ledger written before removal existed.
+    settled: z.array(SettledDraftSchema).optional(),
 });
 export type RuntimeInstallsFile = z.infer<typeof RuntimeInstallsFileSchema>;
 // Ledger entry as the Environment card shows it: recurrence joined with whether it's present in the live container
@@ -74,6 +81,26 @@ export type EnvironmentRuntimeDecision = z.infer<typeof EnvironmentRuntimeDecisi
 // there (SANDBOX_DEV_ROOT), absent on a sandbox that was handed a local image without one.
 export const EnvironmentLocalImageSchema = z.object({ base: z.string(), root: z.string().optional() });
 export type EnvironmentLocalImage = z.infer<typeof EnvironmentLocalImageSchema>;
+// A rebuild the owner asked to start by itself once no agent is mid-turn, kept by the sandbox rather than the page that
+// asked, so a page closed or a phone locked meanwhile does not lose it. Held in the sandbox's memory: a restart of the
+// sandbox for any other reason drops it, and the card offers the rebuild again.
+export const EnvironmentRebuildWaitSchema = z.object({
+    // The approved overlay it builds, and the connected device that runs it.
+    hash: z.string(),
+    host: z.string(),
+    requestedAt: z.number(),
+    // waiting: until no agent is mid-turn. rebuilding: handed to the device, which restarts this sandbox at the end.
+    // failed: the device refused or could not be reached; said until the owner dismisses it or asks again.
+    phase: z.enum(["waiting", "rebuilding", "failed"]),
+    // Who it waits on, by the title the board shows them under; empty once it is no longer waiting.
+    waitingOn: z.array(z.string()),
+    // The device's own words for a failed one.
+    message: z.string().optional(),
+});
+export type EnvironmentRebuildWait = z.infer<typeof EnvironmentRebuildWaitSchema>;
+// Asks for that rebuild: the approved overlay's hash and the device that rebuilds this sandbox.
+export const EnvironmentRebuildWhenIdleSchema = z.object({ host: z.string().min(1), hash: z.string().min(1) });
+export type EnvironmentRebuildWhenIdle = z.infer<typeof EnvironmentRebuildWhenIdleSchema>;
 export const EnvironmentSchema = z.object({
     proposal: environmentFileSchema.optional(),
     // The owner-approved agent-written custom section (.intentic/config/environment.custom.Dockerfile).
@@ -89,6 +116,12 @@ export const EnvironmentSchema = z.object({
     recurring: z.array(EnvironmentRecurringSchema).optional(),
     // Absent on a sandbox running a published image, which is every sandbox but a dogfooding one.
     localImage: EnvironmentLocalImageSchema.optional(),
+    // A rebuild waiting for the agents to be idle, or started or refused once they were; absent when none is asked.
+    rebuildWhenIdle: EnvironmentRebuildWaitSchema.optional(),
+    // This sandbox can hold a rebuild until no agent is mid-turn (POST /environment/rebuild-when-idle), and resume the
+    // turns a restart the owner starts cuts when asked (a device swap's `resumeTurns`). Absent from one too old to,
+    // where the rebuild dialog offers only "Rebuild now" and the cut turns wait to be continued, as before.
+    waitsForAgents: z.literal(true).optional(),
 });
 export type Environment = z.infer<typeof EnvironmentSchema>;
 export const EnvironmentApproveSchema = z.object({ hash: z.string().min(1) });
@@ -127,8 +160,14 @@ export const EnvironmentItemSchema = z.object({
     detail: z.string().optional(),
     // The block's own instruction lines, for the reader who wants to see exactly what runs.
     commands: z.string().optional(),
+    // The custom-section block this row is, which the owner may take out (POST /environment/remove names it). Absent
+    // on capability and base rows, and from a sandbox that cannot remove one, so no Remove is offered there.
+    block: z.string().optional(),
 });
 export type EnvironmentItem = z.infer<typeof EnvironmentItemSchema>;
+// Takes one tool out of the environment: its approved block, its pending draft, or both.
+export const EnvironmentRemoveSchema = z.object({ block: z.string() });
+export type EnvironmentRemove = z.infer<typeof EnvironmentRemoveSchema>;
 export const EnvironmentContentsSchema = z.object({ items: z.array(EnvironmentItemSchema) });
 export type EnvironmentContents = z.infer<typeof EnvironmentContentsSchema>;
 // A sandbox is four stores: /work, /history, the container, and the AI-provider credential root. A bundle carries only

package/src/schemas/git/git.ts

@@ -86,7 +86,7 @@ export const PushSchema = RepoParamSchema.extend({
 });
 // Who said no to a push, read off git's own words (`pushRefusal`); the three answers ask three different things of the
 // owner.
-// hook: this repo's own pre-push hook refused it; the code is known wrong, worth a fix.
+// hook: this repo's own pre-push hook refused it; what it printed is about the code, and the terminal holds all of it.
 // remote: the server rejected the refs (non-fast-forward, protected branch); pull first or push elsewhere.
 // transport: it never got there (credentials, unreachable host); a retry is the only useful button.
 export const PushRefusalSchema = z.enum(["hook", "remote", "transport"]);
@@ -100,7 +100,7 @@ export const PushRunSchema = CommandRunSchema.extend({
         .optional()
         .describe("Why not, in git's own words: the last verdict line, for a row that has room for one line. The whole tail is `output`."),
     refusedBy: PushRefusalSchema.optional().describe(
-        "Who refused a failed push: this repository's pre-push hook (the code is wrong, a fix is worth proposing), the remote (pull first), or the transport (credentials, network: retry). Absent while it runs and for a push that went.",
+        "Who refused a failed push: this repository's own pre-push hook (what it printed is about the code), the remote (pull first), or the transport (credentials, network: retry). Absent while it runs and for a push that went.",
     ),
 });
 export type PushRun = z.infer<typeof PushRunSchema>;
@@ -389,6 +389,17 @@ export const AgentChangeSchema = GitChangeSchema.extend({
         ),
 });
 export type AgentChange = z.infer<typeof AgentChangeSchema>;
+// One manifest's new dependency names: the file at the delta's anchor against the file as it stands now, so a review
+// can say what the project takes on before it lands.
+export const AddedDependenciesSchema = z.object({
+    path: z.string().describe("The manifest, relative to the repository root, such as video/package.json."),
+    added: z
+        .array(z.string())
+        .describe(
+            "The names it declares now and did not declare before, sorted. Only new names: a version bump of a dependency already there is not listed.",
+        ),
+});
+export type AddedDependencies = z.infer<typeof AddedDependenciesSchema>;
 // An agent worktree's delta vs its base, deliberately not RepoChanges: no index here, so sharing that shape would force
 // an empty `staged` and a staging affordance that cannot work on a worktree nobody checks out.
 export const AgentRepoChangesSchema = z.object({
@@ -401,6 +412,13 @@ export const AgentRepoChangesSchema = z.object({
         .describe(
             "The packages of the tree these changes came from, so a review can group by package. Carried with the changes rather than looked up separately, because a package the conversation has just created exists only in its own copy and the shared tree has never heard of it.",
         ),
+    // Absent rather than empty when nothing was added, the common case.
+    addedDependencies: z
+        .array(AddedDependenciesSchema)
+        .optional()
+        .describe(
+            "Dependencies the changed manifests here declare that they did not before (package.json, pyproject.toml, requirements.txt), one entry per manifest that gained any. The review is where a new dependency is approved: a conversation installs freely in its own copy, and this is what the project takes on if the work lands. Absent when none was added.",
+        ),
 });
 export type AgentRepoChanges = z.infer<typeof AgentRepoChangesSchema>;
 // The review, plus why the last land refused: a conflict is found when the turn ends but resolved later on this

package/src/schemas/hosts.ts

@@ -68,10 +68,16 @@ export type DeviceFacts = z.infer<typeof DeviceFactsSchema>;
 // - `set-shape`: the `set-shape`/`forget-shape` ops, and `start`/`restart` applying a saved shape, all through an `ic`
 //   whose `ic sandbox shape` takes the contract's own shape (`--set`); advertised only when the agent's `ic` does.
 //   Both features ride that verb, so an agent advertises both or neither.
-export const DeviceFeatureSchema = z.enum(["reshape-later", "set-shape"]);
+// - `rollback-to`: the `rollback` op's `to`, going back to an older version kept on the machine rather than the
+//   previous one; advertised only when the agent's `ic sandbox rollback` takes `--to`.
+// - `loopback-catch`: the `catchLoopback` procedure, a sign-in's loopback redirect caught on this machine
+//   (loopback-catch.ts); an agent without it rejects the call as an unknown procedure.
+export const DeviceFeatureSchema = z.enum(["reshape-later", "set-shape", "rollback-to", "loopback-catch"]);
 export type DeviceFeature = z.infer<typeof DeviceFeatureSchema>;
 export const DEVICE_FEATURE_RESHAPE_LATER: DeviceFeature = "reshape-later";
 export const DEVICE_FEATURE_SET_SHAPE: DeviceFeature = "set-shape";
+export const DEVICE_FEATURE_ROLLBACK_TO: DeviceFeature = "rollback-to";
+export const DEVICE_FEATURE_LOOPBACK_CATCH: DeviceFeature = "loopback-catch";
 // The features an agent advertised that this build knows; an unknown one is a newer agent's and means nothing here.
 export const deviceFeatures = (facts: Pick<DeviceFacts, "features"> | undefined): DeviceFeature[] =>
     (facts?.features ?? []).flatMap((feature) => {

package/src/schemas/keep-warm.ts

@@ -2,6 +2,7 @@
 // clock lives here; how many refreshes a hold may spend is priced by the provider that serves it (runtimes/claude).
 
 import { z } from "zod";
+import type { SandboxNotice } from "../events/sandbox-notice.js";
 
 // A cache clock as the daemon publishes it: the last request that touched the entry, and the entry's lifetime.
 export interface CacheClock {
@@ -95,16 +96,28 @@ const spanLabel = (ms: number): string => {
     return hours === 0 ? `${minutes}m` : `${hours}h ${minutes % 60}m`;
 };
 
-/** The transcript's line for a turn that picked up a conversation kept warm for it; undefined for any other turn. */
-export const keptWarmLine = (opening: PromptCacheOpening): string | undefined => {
+/** The notice for a turn that picked up a conversation kept warm for it, by code and facts; undefined for any other turn. */
+export const keptWarmNotice = (opening: PromptCacheOpening): Extract<SandboxNotice, { code: "keptWarm" | "keptCold" }> | undefined => {
     const { kept } = opening;
     if (kept === undefined) {
         return undefined;
     }
-    const held = `kept warm for ${spanLabel(kept.forMs)} with ${kept.refreshes} ${kept.refreshes === 1 ? "refresh" : "refreshes"}`;
-    return opening.readTokens >= opening.writtenTokens
-        ? `Picked up warm: ${tokensLabel(opening.readTokens)} tokens read from the cache, ${held}.`
-        : `Picked up cold despite being ${held}: ${tokensLabel(opening.writtenTokens)} tokens sent again, because this turn's prompt no longer matched the cache.`;
+    const warm = opening.readTokens >= opening.writtenTokens;
+    const params = { tokens: tokensLabel(warm ? opening.readTokens : opening.writtenTokens), span: spanLabel(kept.forMs), refreshes: kept.refreshes };
+    return warm ? { code: "keptWarm", params } : { code: "keptCold", params };
+};
+
+/** The transcript's line for a turn that picked up a conversation kept warm for it; undefined for any other turn. */
+export const keptWarmLine = (opening: PromptCacheOpening): string | undefined => {
+    const notice = keptWarmNotice(opening);
+    if (notice === undefined) {
+        return undefined;
+    }
+    const { tokens, span, refreshes } = notice.params;
+    const held = `kept warm for ${span} with ${refreshes} ${refreshes === 1 ? "refresh" : "refreshes"}`;
+    return notice.code === "keptWarm"
+        ? `Picked up warm: ${tokens} tokens read from the cache, ${held}.`
+        : `Picked up cold despite being ${held}: ${tokens} tokens sent again, because this turn's prompt no longer matched the cache.`;
 };
 
 // A turn's prefix, part by part, so two turns that should share a cache can say which part stopped matching.

package/src/schemas/loopback-catch.ts

@@ -0,0 +1,45 @@
+// Loopback catch: how a sign-in whose redirect lands on http://localhost:<port>/… finishes without a paste. The daemon
+// is not on the machine the browser is on, so something that is (a device agent, the browser extension) watches that
+// one address for the attempt's lifetime and hands back where the browser landed. Both peers answer the same
+// procedure (`catchLoopback`) with the same frames, so the daemon drives them identically.
+// Named imports rather than the `z` namespace: the extension bundles this module (see webext.ts).
+import { discriminatedUnion, enum as zEnum, literal, number, object, string } from "zod";
+import type * as z from "zod";
+
+// What one catcher is asked to watch. The state is deliberately absent: the daemon checks it on what comes back, so a
+// catcher can hold nothing that tells a real landing from a forged one, and needs nothing to.
+export const LoopbackCatchSchema = object({
+    // The attempt's own id, for logs on both ends; not redeemable.
+    id: string().min(1),
+    // The host the provider redirects to, spelled as its registration spells it: some are registered as
+    // `localhost`, some as `127.0.0.1`, and a browser treats the two as different origins.
+    host: zEnum(["localhost", "127.0.0.1"]),
+    port: number().int().min(1).max(65535),
+    // The path only, leading slash included; the query is the grant and is never matched.
+    path: string().startsWith("/"),
+    // Epoch ms; a catcher stops watching by itself here even if nobody aborts the stream.
+    expiresAt: number(),
+    // Who the page thanks once the browser lands ("Claude"), so the tab says what just happened.
+    title: string().min(1),
+}).strict();
+export type LoopbackCatch = z.infer<typeof LoopbackCatchSchema>;
+
+// What a catcher streams back. `busy` ends its part (the port is taken on that machine, or it cannot watch at all);
+// `landed` may come more than once, since anything on the machine can hit a loopback port and only the daemon can
+// tell which hit is the sign-in.
+export const LoopbackCatchEventSchema = discriminatedUnion("type", [
+    object({ type: literal("listening") }),
+    object({ type: literal("busy"), reason: string() }),
+    object({ type: literal("landed"), url: string().min(1) }),
+]);
+export type LoopbackCatchEvent = z.infer<typeof LoopbackCatchEventSchema>;
+
+// Advertised in a device's `features` and a browser's facts; only a peer that says it is asked.
+export const LOOPBACK_CATCH_FEATURE = "loopback-catch";
+
+// Who is watching for this attempt's landing, for the card to say "finishes by itself on rog".
+export const SignInCatcherSchema = object({
+    kind: zEnum(["device", "browser"]),
+    label: string().min(1),
+});
+export type SignInCatcher = z.infer<typeof SignInCatcherSchema>;

package/src/schemas/maintenance.ts

@@ -137,7 +137,7 @@ export const MutationScoreSchema = z.object({
         .number()
         .describe("The share of injected faults the suite caught. Not a coverage figure: coverage says a line ran, this says an assertion depended on it."),
     killed: z.number().int().nonnegative().describe("Faults the suite caught."),
-    survived: z.number().int().nonnegative().describe("Faults it did not: code that can be broken with every test still green."),
+    survived: z.number().int().nonnegative().describe("Faults it did not: code that can be broken with every test still passing."),
     // A timeout counts as detected here (Stryker's own convention), not as inconclusive.
     inconclusive: z
         .number()