@capybara-hq/kernel 0.1.0-rc.12 → 0.1.0-rc.14

package/dist/runtime/context/{environment-paths.d.ts → device-paths.d.ts}

@@ -1,40 +1,40 @@
 import type { SandboxRoots } from "@capybara-hq/plugin-sdk";
 import type { ConversationEvent } from "../../conversations/events.js";
 /**
- * The `environment_paths` event (environments spec §13.1, ruling R22): the first sandbox tool call
+ * The `device_paths` event (environments spec §13.1, ruling R22): the first sandbox tool call
  * of every conversation records the instance's roots (the defaults included), and a later call
  * records them again whenever they differ from the conversation's latest recorded ones (a
  * connected machine's real paths, a mode switch back to the defaults). Model-visible: rendered at
  * its position as a system message; in the log, so it needs no `DriftReason`.
  */
-/** The system line of an `environment_paths` event (model-visible, English). */
-export declare function environmentPathsText(r: SandboxRoots): string;
+/** The system line of an `device_paths` event (model-visible, English). */
+export declare function devicePathsText(r: SandboxRoots): string;
 /** Whether two sets of roots are the same paths. */
 export declare const sameRoots: (a: SandboxRoots, b: SandboxRoots) => boolean;
 /**
- * The idempotency key of an `environment_paths` event for `r` that follows the conversation's
+ * The idempotency key of an `device_paths` event for `r` that follows the conversation's
  * event at `prevSeq` (0: none). Unique per change (A → B → A gets three events), while parallel
  * calls that saw the same latest event write it once.
  */
-export declare const environmentPathsIdemKey: (r: SandboxRoots, prevSeq: number) => string;
+export declare const devicePathsIdemKey: (r: SandboxRoots, prevSeq: number) => string;
 /**
- * The `environment_paths` event to append when a sandbox call holds an instance with `roots` and
+ * The `device_paths` event to append when a sandbox call holds an instance with `roots` and
  * the conversation's latest such event is `latest`; null when nothing changed.
  */
-export declare function environmentPathsChange(latest: {
+export declare function devicePathsChange(latest: {
     seq: number;
     payload: {
         roots: SandboxRoots;
     };
 } | undefined, roots: SandboxRoots, runId: string | undefined): {
-    type: "environment_paths";
+    type: "device_paths";
     runId?: string;
     idemKey: string;
     payload: {
         roots: SandboxRoots;
     };
 } | null;
-/** The latest `environment_paths` event at or before `seq`; undefined without one. */
-export declare function environmentPathsAt(events: readonly ConversationEvent[], seq: number): Extract<ConversationEvent, {
-    type: "environment_paths";
+/** The latest `device_paths` event at or before `seq`; undefined without one. */
+export declare function devicePathsAt(events: readonly ConversationEvent[], seq: number): Extract<ConversationEvent, {
+    type: "device_paths";
 }> | undefined;

package/dist/runtime/context/{environment-paths.js → device-paths.js}

@@ -1,47 +1,47 @@
 import { createHash } from "node:crypto";
 /**
- * The `environment_paths` event (environments spec §13.1, ruling R22): the first sandbox tool call
+ * The `device_paths` event (environments spec §13.1, ruling R22): the first sandbox tool call
  * of every conversation records the instance's roots (the defaults included), and a later call
  * records them again whenever they differ from the conversation's latest recorded ones (a
  * connected machine's real paths, a mode switch back to the defaults). Model-visible: rendered at
  * its position as a system message; in the log, so it needs no `DriftReason`.
  */
-/** The system line of an `environment_paths` event (model-visible, English). */
-export function environmentPathsText(r) {
-    return `This environment's directories: workspace ${r.workspace}, skills ${r.skills} (read only), temporary files ${r.tmp}. Use these paths in commands and tool calls.`;
+/** The system line of an `device_paths` event (model-visible, English). */
+export function devicePathsText(r) {
+    return `This device's directories: workspace ${r.workspace}, skills ${r.skills} (read only), temporary files ${r.tmp}. Use these paths in commands and tool calls.`;
 }
 /** Whether two sets of roots are the same paths. */
 export const sameRoots = (a, b) => a.workspace === b.workspace && a.skills === b.skills && a.tmp === b.tmp;
 /**
- * The idempotency key of an `environment_paths` event for `r` that follows the conversation's
+ * The idempotency key of an `device_paths` event for `r` that follows the conversation's
  * event at `prevSeq` (0: none). Unique per change (A → B → A gets three events), while parallel
  * calls that saw the same latest event write it once.
  */
-export const environmentPathsIdemKey = (r, prevSeq) => `environment_paths:${createHash("sha256")
+export const devicePathsIdemKey = (r, prevSeq) => `device_paths:${createHash("sha256")
     .update(JSON.stringify([r.workspace, r.skills, r.tmp]))
     .digest("hex")
     .slice(0, 16)}:${prevSeq}`;
 /**
- * The `environment_paths` event to append when a sandbox call holds an instance with `roots` and
+ * The `device_paths` event to append when a sandbox call holds an instance with `roots` and
  * the conversation's latest such event is `latest`; null when nothing changed.
  */
-export function environmentPathsChange(latest, roots, runId) {
+export function devicePathsChange(latest, roots, runId) {
     if (latest && sameRoots(latest.payload.roots, roots))
         return null;
     return {
-        type: "environment_paths",
+        type: "device_paths",
         ...(runId !== undefined && { runId }),
-        idemKey: environmentPathsIdemKey(roots, latest?.seq ?? 0),
+        idemKey: devicePathsIdemKey(roots, latest?.seq ?? 0),
         payload: { roots: { workspace: roots.workspace, skills: roots.skills, tmp: roots.tmp } },
     };
 }
-/** The latest `environment_paths` event at or before `seq`; undefined without one. */
-export function environmentPathsAt(events, seq) {
+/** The latest `device_paths` event at or before `seq`; undefined without one. */
+export function devicePathsAt(events, seq) {
     let found;
     for (const e of events) {
         if (e.seq > seq)
             break;
-        if (e.type === "environment_paths")
+        if (e.type === "device_paths")
             found = e;
     }
     return found;

package/dist/runtime/maintenance.d.ts

@@ -32,7 +32,7 @@ export declare class MaintenanceProcessor extends WorkerHost<Worker> {
     private readonly scheduled;
     private readonly log;
     private readonly queue;
-    constructor(waits: Pick<Waits, "processTimeout">, sandbox: Pick<SandboxService, "destroyEnvironment" | "resetFileSystem">, drift: Pick<ToolDrift, "check">, directory: Pick<DirectorySync, "runSyncJob">, runs: Pick<RunQueue, "ensureRun">, ownedCleanup: Pick<OwnedPluginCleanup, "run">, scheduled: Pick<ScheduledRuns, "runNow">, log: Pick<KernelLogger, "error" | "warn">, queue: Pick<Queue, "removeJobScheduler">);
+    constructor(waits: Pick<Waits, "processTimeout">, sandbox: Pick<SandboxService, "destroyDevice" | "resetFileSystem">, drift: Pick<ToolDrift, "check">, directory: Pick<DirectorySync, "runSyncJob">, runs: Pick<RunQueue, "ensureRun">, ownedCleanup: Pick<OwnedPluginCleanup, "run">, scheduled: Pick<ScheduledRuns, "runNow">, log: Pick<KernelLogger, "error" | "warn">, queue: Pick<Queue, "removeJobScheduler">);
     /**
      * Removes the retired job schedulers (`RETIRED_SCHEDULER_IDS`, runtime/retired-schedulers.ts): every fixed-period
      * maintenance job is a `@LockedCron` / `@LockedInterval` now. Idempotent; called once when a

package/dist/sandbox/jobs.d.ts

@@ -7,20 +7,20 @@ export declare const SANDBOX_SUSPEND_JOB = "sandbox-suspend-idle";
 /** The inactivity destruction sweep (hourly, once per tick across replicas). */
 export declare const SANDBOX_DESTROY_JOB = "sandbox-destroy-inactive";
 /**
- * One-off job: destroy a batch of environments now, instance and file system (environment
- * deletion, offboarding; data `{ environmentIds }`).
+ * One-off job: destroy a batch of devices now, instance and file system (device
+ * deletion, offboarding; data `{ deviceIds }`).
  */
 export declare const SANDBOX_DESTROY_FOR_JOB = "sandbox-destroy-for";
 /**
- * One-off job: start an environment over with empty files (`resetFileSystem`; data
- * `{ environmentId }`, job id {@link resetFilesJobId}).
+ * One-off job: start a device over with empty files (`resetFileSystem`; data
+ * `{ deviceId }`, job id {@link resetFilesJobId}).
  */
 export declare const SANDBOX_RESET_FILES_JOB = "sandbox-reset-files";
 /**
- * The deterministic id of an environment's reset job: a second request while one is waiting or
+ * The deterministic id of a device's reset job: a second request while one is waiting or
  * running joins it (that reset still empties the files); once it ended, a new request is a new job.
  */
-export declare const resetFilesJobId: (environmentId: string) => string;
+export declare const resetFilesJobId: (deviceId: string) => string;
 /**
  * The producer of the sandbox maintenance jobs: {@link SANDBOX_DESTROY_FOR_JOB} (BullMQ's own job
  * ids, as before: every enqueue is a new job, also after a batch failed all its attempts) and
@@ -30,16 +30,16 @@ export declare class SandboxJobs {
     private readonly queue;
     constructor(queue: Pick<Queue, "add">);
     /**
-     * Enqueues the destruction of these environments: a failed batch is retried whole (destroying
+     * Enqueues the destruction of these devices: a failed batch is retried whole (destroying
      * one already destroyed does nothing).
      */
-    destroy(environmentIds: string[]): Promise<void>;
+    destroy(deviceIds: string[]): Promise<void>;
     /**
-     * Enqueues the reset of an environment's files (see {@link resetFilesJobId}): retried on failure
+     * Enqueues the reset of a device's files (see {@link resetFilesJobId}): retried on failure
      * (the exclusive lease not obtained in time, the provider failing); a job that failed all its
      * attempts is removed, so the id never blocks a later request.
      */
-    resetFiles(environmentId: string): Promise<void>;
+    resetFiles(deviceId: string): Promise<void>;
 }
 /**
  * The worker side of {@link SANDBOX_RESET_FILES_JOB}: `resetFileSystem` under the exclusive lease;
@@ -47,14 +47,14 @@ export declare class SandboxJobs {
  */
 export declare function runSandboxResetFiles(sandbox: Pick<SandboxService, "resetFileSystem">, job: Pick<Job, "data">): Promise<void>;
 /**
- * The worker side of {@link SANDBOX_DESTROY_FOR_JOB}: `destroyEnvironment` one by one; a failure is
+ * The worker side of {@link SANDBOX_DESTROY_FOR_JOB}: `destroyDevice` one by one; a failure is
  * warned and fails the job (the whole batch is retried) after the others were destroyed.
  */
-export declare function runSandboxDestroyFor(sandbox: Pick<SandboxService, "destroyEnvironment">, log: Pick<KernelLogger, "warn">, job: Pick<Job, "data">): Promise<void>;
+export declare function runSandboxDestroyFor(sandbox: Pick<SandboxService, "destroyDevice">, log: Pick<KernelLogger, "warn">, job: Pick<Job, "data">): Promise<void>;
 /**
  * The sandbox sweeps (exactly once per tick across replicas): every minute the idle and overdue
  * running instances are suspended, every hour the inactive instances are destroyed (files kept)
- * and deleted environments, or those of deleted orgs, are destroyed with their files. Both do nothing without a sandbox provider. They replace the
+ * and deleted devices, or those of deleted orgs, are destroyed with their files. Both do nothing without a sandbox provider. They replace the
  * maintenance schedulers `sandbox-suspend-idle-every-minute` and `sandbox-destroy-inactive-hourly`
  * (retired at worker start).
  */

package/dist/sandbox/jobs.js

@@ -19,20 +19,20 @@ export const SANDBOX_SUSPEND_JOB = "sandbox-suspend-idle";
 /** The inactivity destruction sweep (hourly, once per tick across replicas). */
 export const SANDBOX_DESTROY_JOB = "sandbox-destroy-inactive";
 /**
- * One-off job: destroy a batch of environments now, instance and file system (environment
- * deletion, offboarding; data `{ environmentIds }`).
+ * One-off job: destroy a batch of devices now, instance and file system (device
+ * deletion, offboarding; data `{ deviceIds }`).
  */
 export const SANDBOX_DESTROY_FOR_JOB = "sandbox-destroy-for";
 /**
- * One-off job: start an environment over with empty files (`resetFileSystem`; data
- * `{ environmentId }`, job id {@link resetFilesJobId}).
+ * One-off job: start a device over with empty files (`resetFileSystem`; data
+ * `{ deviceId }`, job id {@link resetFilesJobId}).
  */
 export const SANDBOX_RESET_FILES_JOB = "sandbox-reset-files";
 /**
- * The deterministic id of an environment's reset job: a second request while one is waiting or
+ * The deterministic id of a device's reset job: a second request while one is waiting or
  * running joins it (that reset still empties the files); once it ended, a new request is a new job.
  */
-export const resetFilesJobId = (environmentId) => `${SANDBOX_RESET_FILES_JOB}-${environmentId}`;
+export const resetFilesJobId = (deviceId) => `${SANDBOX_RESET_FILES_JOB}-${deviceId}`;
 /**
  * The producer of the sandbox maintenance jobs: {@link SANDBOX_DESTROY_FOR_JOB} (BullMQ's own job
  * ids, as before: every enqueue is a new job, also after a batch failed all its attempts) and
@@ -44,11 +44,11 @@ let SandboxJobs = class SandboxJobs {
         this.queue = queue;
     }
     /**
-     * Enqueues the destruction of these environments: a failed batch is retried whole (destroying
+     * Enqueues the destruction of these devices: a failed batch is retried whole (destroying
      * one already destroyed does nothing).
      */
-    async destroy(environmentIds) {
-        await this.queue.add(SANDBOX_DESTROY_FOR_JOB, { environmentIds }, {
+    async destroy(deviceIds) {
+        await this.queue.add(SANDBOX_DESTROY_FOR_JOB, { deviceIds }, {
             attempts: 5,
             backoff: { type: "exponential", delay: 30_000 },
             removeOnComplete: true,
@@ -56,13 +56,13 @@ let SandboxJobs = class SandboxJobs {
         });
     }
     /**
-     * Enqueues the reset of an environment's files (see {@link resetFilesJobId}): retried on failure
+     * Enqueues the reset of a device's files (see {@link resetFilesJobId}): retried on failure
      * (the exclusive lease not obtained in time, the provider failing); a job that failed all its
      * attempts is removed, so the id never blocks a later request.
      */
-    async resetFiles(environmentId) {
-        await this.queue.add(SANDBOX_RESET_FILES_JOB, { environmentId }, {
-            jobId: resetFilesJobId(environmentId),
+    async resetFiles(deviceId) {
+        await this.queue.add(SANDBOX_RESET_FILES_JOB, { deviceId }, {
+            jobId: resetFilesJobId(deviceId),
             attempts: 5,
             backoff: { type: "exponential", delay: 30_000 },
             removeOnComplete: true,
@@ -80,17 +80,17 @@ export { SandboxJobs };
  * a failure fails the job (retried).
  */
 export async function runSandboxResetFiles(sandbox, job) {
-    const id = job.data.environmentId;
+    const id = job.data.deviceId;
     if (typeof id !== "string")
         return;
     await sandbox.resetFileSystem(id);
 }
 /**
- * The worker side of {@link SANDBOX_DESTROY_FOR_JOB}: `destroyEnvironment` one by one; a failure is
+ * The worker side of {@link SANDBOX_DESTROY_FOR_JOB}: `destroyDevice` one by one; a failure is
  * warned and fails the job (the whole batch is retried) after the others were destroyed.
  */
 export async function runSandboxDestroyFor(sandbox, log, job) {
-    const ids = job.data.environmentIds;
+    const ids = job.data.deviceIds;
     if (!Array.isArray(ids))
         return;
     let failed = 0;
@@ -98,20 +98,20 @@ export async function runSandboxDestroyFor(sandbox, log, job) {
         if (typeof id !== "string")
             continue;
         try {
-            await sandbox.destroyEnvironment(id);
+            await sandbox.destroyDevice(id);
         }
         catch (err) {
             failed++;
-            log.warn("cannot destroy environment; will retry", { environmentId: id, err });
+            log.warn("cannot destroy device; will retry", { deviceId: id, err });
         }
     }
     if (failed > 0)
-        throw new Error(`${failed} of ${ids.length} environments could not be destroyed`);
+        throw new Error(`${failed} of ${ids.length} devices could not be destroyed`);
 }
 /**
  * The sandbox sweeps (exactly once per tick across replicas): every minute the idle and overdue
  * running instances are suspended, every hour the inactive instances are destroyed (files kept)
- * and deleted environments, or those of deleted orgs, are destroyed with their files. Both do nothing without a sandbox provider. They replace the
+ * and deleted devices, or those of deleted orgs, are destroyed with their files. Both do nothing without a sandbox provider. They replace the
  * maintenance schedulers `sandbox-suspend-idle-every-minute` and `sandbox-destroy-inactive-hourly`
  * (retired at worker start).
  */

package/dist/sandbox/leases.d.ts

@@ -4,11 +4,11 @@ import { LockService } from "../infra/lock/lock.service.js";
 import type { KernelLogger } from "../log.js";
 /**
  * Shared and exclusive sandbox leases (sub-agents spec §10.3; environments spec §4.2): the Redis
- * protocol that lets several holders (every conversation bound to the environment, and their
- * sub-agents) use one environment's running instance concurrently (shared leases: commands, file
+ * protocol that lets several holders (every conversation bound to the device, and their
+ * sub-agents) use one device's running instance concurrently (shared leases: commands, file
  * reads and writes) while lifecycle changes (create, resume, rebuild, suspend, destroy, reset) stay
  * alone (exclusive leases). Every `sandbox@2` provider runs commands concurrently and kills by tag,
- * so there is no single-holder mode. Keys, env = the environment id:
+ * so there is no single-holder mode. Keys, env = the device id:
  *
  * - `capk:sandbox:<env>`: the lock key: an exclusive holder's token, or `shared` while shared
  *   leases exist.
@@ -28,17 +28,17 @@ import type { KernelLogger } from "../log.js";
  * the renewal deadline (send time of the last successful renewal + 2/3 TTL): its `signal` aborts
  * with {@link SandboxLockLostError}.
  */
-/** Prefix of the lock key `capk:sandbox:<environmentId>`. */
+/** Prefix of the lock key `capk:sandbox:<deviceId>`. */
 export declare const SANDBOX_LOCK_PREFIX = "capk:sandbox:";
 /** TTL of a lease (ms): renewed every TTL / 3 while held. */
 export declare const SANDBOX_LOCK_TTL_MS = 60000;
-/** The environment's sandbox is busy: waited longer than `sandbox.lockWaitSeconds` (409). */
+/** The device's sandbox is busy: waited longer than `sandbox.lockWaitSeconds` (409). */
 export declare const sandboxBusy: () => ApiError;
 /** A lease was lost while held, or the record changed under it (generation mismatch). */
 export declare class SandboxLockLostError extends Error {
     /** `lock`: the lease was lost (renewal failed or none succeeded in time); `generation`: the record's fence changed. */
     readonly reason: "lock" | "generation";
-    constructor(environmentId: string, reason?: "lock" | "generation");
+    constructor(deviceId: string, reason?: "lock" | "generation");
 }
 /** Another holder kept writing the same file longer than the path lease wait (model-visible text). */
 export declare class SandboxPathBusyError extends Error {
@@ -49,7 +49,7 @@ export type LeaseKind = "shared" | "exclusive";
 export interface SandboxLease {
     readonly kind: LeaseKind;
     readonly token: string;
-    readonly environmentId: string;
+    readonly deviceId: string;
     /** Aborts with {@link SandboxLockLostError} when the lease is lost. */
     readonly signal: AbortSignal;
     /** Renews once now; false when the lease is lost (the signal then aborts). */
@@ -131,9 +131,9 @@ export declare class SandboxLeases {
      * (it should then {@link clearIntent}).
      */
     tryShared(env: string, cap: number, token?: string): Promise<SandboxLease | null>;
-    /** Deletes the environment's intent when it is `token`'s. */
+    /** Deletes the device's intent when it is `token`'s. */
     clearIntent(env: string, token: string): Promise<void>;
-    /** Live shared leases of the environment. */
+    /** Live shared leases of the device. */
     sharedCount(env: string): Promise<number>;
     /**
      * Records (or refreshes) a holder that may run commands (before its provider calls); `ttlMs`

package/dist/sandbox/leases.js

@@ -15,11 +15,11 @@ import { redisClockScript, sharedLeaseReadScript, } from "../infra/lock/shared-l
 import { KERNEL_LOGGER, REDIS } from "../infra/tokens.js";
 /**
  * Shared and exclusive sandbox leases (sub-agents spec §10.3; environments spec §4.2): the Redis
- * protocol that lets several holders (every conversation bound to the environment, and their
- * sub-agents) use one environment's running instance concurrently (shared leases: commands, file
+ * protocol that lets several holders (every conversation bound to the device, and their
+ * sub-agents) use one device's running instance concurrently (shared leases: commands, file
  * reads and writes) while lifecycle changes (create, resume, rebuild, suspend, destroy, reset) stay
  * alone (exclusive leases). Every `sandbox@2` provider runs commands concurrently and kills by tag,
- * so there is no single-holder mode. Keys, env = the environment id:
+ * so there is no single-holder mode. Keys, env = the device id:
  *
  * - `capk:sandbox:<env>`: the lock key: an exclusive holder's token, or `shared` while shared
  *   leases exist.
@@ -39,7 +39,7 @@ import { KERNEL_LOGGER, REDIS } from "../infra/tokens.js";
  * the renewal deadline (send time of the last successful renewal + 2/3 TTL): its `signal` aborts
  * with {@link SandboxLockLostError}.
  */
-/** Prefix of the lock key `capk:sandbox:<environmentId>`. */
+/** Prefix of the lock key `capk:sandbox:<deviceId>`. */
 export const SANDBOX_LOCK_PREFIX = "capk:sandbox:";
 /** TTL of a lease (ms): renewed every TTL / 3 while held. */
 export const SANDBOX_LOCK_TTL_MS = 60_000;
@@ -51,16 +51,16 @@ const PATH_PREFIX = "capk:sandbox-path:";
 const PATH_LEASE_TTL_MS = 30_000;
 /** Shortest life of an exclusive waiter's intent (ms): outlasts event-loop lag between polls. */
 const INTENT_TTL_FLOOR_MS = 2000;
-/** The environment's sandbox is busy: waited longer than `sandbox.lockWaitSeconds` (409). */
-export const sandboxBusy = () => new ApiError("sandbox.busy", "The sandbox of this environment is busy with other commands; wait for them to finish and try again");
+/** The device's sandbox is busy: waited longer than `sandbox.lockWaitSeconds` (409). */
+export const sandboxBusy = () => new ApiError("sandbox.busy", "The sandbox of this device is busy with other commands; wait for them to finish and try again");
 /** A lease was lost while held, or the record changed under it (generation mismatch). */
 export class SandboxLockLostError extends Error {
     /** `lock`: the lease was lost (renewal failed or none succeeded in time); `generation`: the record's fence changed. */
     reason;
-    constructor(environmentId, reason = "lock") {
+    constructor(deviceId, reason = "lock") {
         super(reason === "lock"
-            ? `sandbox lock lost for environment ${environmentId}`
-            : `sandbox state of environment ${environmentId} changed concurrently (generation mismatch)`);
+            ? `sandbox lock lost for device ${deviceId}`
+            : `sandbox state of device ${deviceId} changed concurrently (generation mismatch)`);
         this.name = "SandboxLockLostError";
         this.reason = reason;
     }
@@ -208,7 +208,7 @@ let SandboxLeases = class SandboxLeases {
         }
         catch (e) {
             if (o.intent) {
-                await this.clearIntent(env, token).catch((err) => this.log.warn("cannot clear sandbox intent", { environmentId: env, err }));
+                await this.clearIntent(env, token).catch((err) => this.log.warn("cannot clear sandbox intent", { deviceId: env, err }));
             }
             throw e;
         }
@@ -231,11 +231,11 @@ let SandboxLeases = class SandboxLeases {
         const h = await this.locks.tryShared(this.keys(env), token, cap, this.ttlMs);
         return h ? this.held(env, h) : null;
     }
-    /** Deletes the environment's intent when it is `token`'s. */
+    /** Deletes the device's intent when it is `token`'s. */
     async clearIntent(env, token) {
         await this.locks.releaseIf(this.keys(env).intent, token);
     }
-    /** Live shared leases of the environment. */
+    /** Live shared leases of the device. */
     sharedCount(env) {
         return this.locks.sharedCount(this.keys(env));
     }
@@ -291,7 +291,7 @@ let SandboxLeases = class SandboxLeases {
         return {
             kind,
             token: h.token,
-            environmentId: env,
+            deviceId: env,
             signal,
             // a Redis error is warned, not thrown: the deadline decides whether the lease is lost
             renew: async () => {
@@ -301,7 +301,7 @@ let SandboxLeases = class SandboxLeases {
                     return await h.renew();
                 }
                 catch (err) {
-                    this.log.warn("sandbox lease renew failed", { environmentId: env, err });
+                    this.log.warn("sandbox lease renew failed", { deviceId: env, err });
                     return !signal.aborted;
                 }
             },

package/dist/sandbox/providers.d.ts

@@ -1,7 +1,7 @@
 import { type SandboxProvider } from "@capybara-hq/plugin-sdk";
 import { ExtensionRegistry } from "../extensions/registry.js";
-/** The kernel-internal provider of connected machines (`device` environments). */
-export declare const DEVICE_PROVIDER = "@device";
+/** The kernel-internal provider of connected machines (local devices). */
+export declare const LOCAL_PROVIDER = "@local";
 /**
  * A kernel-internal provider name: it starts with `@`, which no extension name can
  * (`EXTENSION_NAME_RE`), so it never collides with a loaded `sandbox@2` plugin.
@@ -15,7 +15,7 @@ export interface SandboxProviderEntry {
 /**
  * The sandbox providers of this process. The cloud provider is the loaded `sandbox@2` extension,
  * read from the {@link ExtensionRegistry} at every call (providers are ready only after the
- * extension load, and change with installs). Kernel-internal providers (`@device`) are registered
+ * extension load, and change with installs). Kernel-internal providers (`@local`) are registered
  * by their module on init, in every replica: they are code, not shared state.
  *
  * Every `sandbox@2` extension is handed out guarded: a network-level failure to reach it is
@@ -38,9 +38,9 @@ export declare class SandboxProviders {
     forName(name: string): SandboxProviderEntry | undefined;
 }
 /**
- * The provider an environment works with, from its `environments.provider`: an internal one
- * (`@device`) by that name only, never falling back to the cloud provider; any other environment
- * is a cloud environment and uses the current cloud provider (files kept by another provider are
- * refused by the sandbox service, `environment.unavailable`).
+ * The provider a device works with, from its `devices.provider`: an internal one
+ * (`@local`) by that name only, never falling back to the cloud provider; any other device
+ * is a cloud device and uses the current cloud provider (files kept by another provider are
+ * refused by the sandbox service, `device.unavailable`).
  */
-export declare function providerForEnvironment(providers: Pick<SandboxProviders, "cloud" | "forName">, provider: string | null): SandboxProviderEntry | undefined;
+export declare function providerForDevice(providers: Pick<SandboxProviders, "cloud" | "forName">, provider: string | null): SandboxProviderEntry | undefined;

package/dist/sandbox/providers.js

@@ -11,8 +11,8 @@ import { SANDBOX_EXTENSION_POINT } from "@capybara-hq/plugin-sdk";
 import { Inject, Injectable } from "@nestjs/common";
 import { ExtensionRegistry } from "../extensions/registry.js";
 import { guardProviderConnection } from "./unreachable.js";
-/** The kernel-internal provider of connected machines (`device` environments). */
-export const DEVICE_PROVIDER = "@device";
+/** The kernel-internal provider of connected machines (local devices). */
+export const LOCAL_PROVIDER = "@local";
 /**
  * A kernel-internal provider name: it starts with `@`, which no extension name can
  * (`EXTENSION_NAME_RE`), so it never collides with a loaded `sandbox@2` plugin.
@@ -21,7 +21,7 @@ export const isInternalProvider = (name) => name.startsWith("@");
 /**
  * The sandbox providers of this process. The cloud provider is the loaded `sandbox@2` extension,
  * read from the {@link ExtensionRegistry} at every call (providers are ready only after the
- * extension load, and change with installs). Kernel-internal providers (`@device`) are registered
+ * extension load, and change with installs). Kernel-internal providers (`@local`) are registered
  * by their module on init, in every replica: they are code, not shared state.
  *
  * Every `sandbox@2` extension is handed out guarded: a network-level failure to reach it is
@@ -71,12 +71,12 @@ SandboxProviders = __decorate([
 ], SandboxProviders);
 export { SandboxProviders };
 /**
- * The provider an environment works with, from its `environments.provider`: an internal one
- * (`@device`) by that name only, never falling back to the cloud provider; any other environment
- * is a cloud environment and uses the current cloud provider (files kept by another provider are
- * refused by the sandbox service, `environment.unavailable`).
+ * The provider a device works with, from its `devices.provider`: an internal one
+ * (`@local`) by that name only, never falling back to the cloud provider; any other device
+ * is a cloud device and uses the current cloud provider (files kept by another provider are
+ * refused by the sandbox service, `device.unavailable`).
  */
-export function providerForEnvironment(providers, provider) {
+export function providerForDevice(providers, provider) {
     if (provider !== null && isInternalProvider(provider))
         return providers.forName(provider);
     return providers.cloud();

package/dist/sandbox/sandbox.module.d.ts

@@ -1,5 +1,5 @@
 /**
- * Sandboxes: the one {@link SandboxService} (an environment's file system and instance over the
+ * Sandboxes: the one {@link SandboxService} (a device's file system and instance over the
  * `sandbox@2` provider, with the shared / exclusive leases of {@link SandboxLeases}) and the
  * producer of the
  * one-off `sandbox-destroy-for` jobs (`MaintenanceProcessor` consumes them). The sweeps

package/dist/sandbox/sandbox.module.js

@@ -14,7 +14,7 @@ import { SandboxLeases } from "./leases.js";
 import { SandboxProviders } from "./providers.js";
 import { SandboxService } from "./sandbox.service.js";
 /**
- * Sandboxes: the one {@link SandboxService} (an environment's file system and instance over the
+ * Sandboxes: the one {@link SandboxService} (a device's file system and instance over the
  * `sandbox@2` provider, with the shared / exclusive leases of {@link SandboxLeases}) and the
  * producer of the
  * one-off `sandbox-destroy-for` jobs (`MaintenanceProcessor` consumes them). The sweeps